From 9008ded1b091ef385d1fb373210d97de27a079ed Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 19 Aug 2026 22:06:39 +0200 Subject: [PATCH] =?UTF-8?q?WARDEN-WP-0032:=20net-kingdom=20amendment=20?= =?UTF-8?q?=E2=80=94=20carrier=20file=20settled,=20organization=5Fposture?= =?UTF-8?q?=20answered?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Amended by net-kingdom as canon owner of tenancy-posture_v0.1, answering ZONE-WP-0001-T01. T01: organization_posture does not fold into zones and does not belong in a per-repo declaration — it is a fleet-wide time-varying scalar. Hand it over as an input. T03: zone membership is declared in tenancy.yaml under a reserved zones: key (canon Decision 5.6). ops-warden has no tenancy.yaml, so this now implies declaring the six-axis posture vector too. Also records why this declaration may not set stance: a declarer that sets its own stance makes exempt conformant. Co-Authored-By: Claude Opus 5 --- workplans/WARDEN-WP-0032-security-zones.md | 40 ++++++++++++++++++++-- 1 file changed, 38 insertions(+), 2 deletions(-) diff --git a/workplans/WARDEN-WP-0032-security-zones.md b/workplans/WARDEN-WP-0032-security-zones.md index ae98b11..4094ec1 100644 --- a/workplans/WARDEN-WP-0032-security-zones.md +++ b/workplans/WARDEN-WP-0032-security-zones.md @@ -64,6 +64,16 @@ same zone as one ops-warden owns outright). Include the `organization_posture` fold-in question honestly, including the case against keeping it. +**Answered by net-kingdom 2026-08-19** (canon owner of `tenancy-posture_v0.1`, +answering `ZONE-WP-0001-T01`): **do not fold it in, and do not put it in a +per-repo declaration under any key.** `organization_posture` is a fleet-wide, +time-varying scalar describing the *estate*, not a property of a declaring +service; a per-repo copy of a global goes stale in as many places as there are +repos. It stays what WP-0029 made it — an input to stance selection that the +zone model reads. Hand it over as an input, not as a candidate axis. Environment +posture and `M0`–`M3` are per-workload and remain genuinely composable; those two +are still open for `ZONE-WP-0001-T02`. + ```task id: WARDEN-WP-0032-T02 status: wait @@ -119,8 +129,31 @@ priority: medium state_hub_task_id: "fd642377-8d64-473c-b684-f8f1a842c223" ``` -**Declare ops-warden's zones** in whatever format `ZONE-WP-0001-T05` settles, -alongside the existing posture descriptors. Per flex-auth's T05 amendment, this +**Declare ops-warden's zones** in the format `ZONE-WP-0001-T05` settles, +alongside the existing posture descriptors. + +**Amended by net-kingdom 2026-08-19 — the carrier file is already settled, only +its contents are open.** Canon Decision 5.6 (`tenancy-posture_v0.1` draft-9) +rules that zone membership is declared in **`tenancy.yaml` under a reserved +top-level `zones:` key**, sibling to `tenancy:` and `provider:` and never inside +`tenancy.current`. §5.4 makes that file the repo's single posture declaration +surface, and a second root file would be the second-source-of-truth failure +`ADR-0001` exists to prevent — in ops-warden's own idiom. The key is reserved and +deliberately unconstrained in `net-kingdom/canon/schemas/tenancy-posture_v0.1.schema.json`, +so a combined declaration validates today. + +Note the consequence for this repo: **ops-warden does not currently have a +`tenancy.yaml`.** Declaring zones means writing one, which means declaring the +six-axis posture vector too. That is a real and probably overdue cost, not an +accident of this amendment — canon would rather ops-warden declare both +accurately than declare a zone with no posture beside it. + +Note also *why* stance is not something this declaration may set: canon Decision +5.6 rules that a declarer must not be the party that sets the stance, or an +accurately declared `exempt` becomes conformant *and* exempt. ops-warden declares +which zone a lane or actor is in. The stance of the pre-sign gate in that zone is +flex-auth's policy package; the failure mode is ops-warden's own setting, per +flex-auth's T03 amendment. Per flex-auth's T05 amendment, this declaration must also say whether a zone rides the **actor** (a flex-auth subject) or the **lane** (a flex-auth per-actor resource) — in the compiled registry an actor is both, and the compiler needs to be told which record @@ -145,3 +178,6 @@ owning it — a superseding record, never an in-place edit. Update `SCOPE.md`, - `zone-engine` `ZONE-WP-0001` — the model, and where this work is led from - `ADR-0006` — enforcement is zone-scoped, never a global flag - `WARDEN-WP-0031` — the deferred flip and its readiness evidence +- `net-kingdom` `tenancy-posture_v0.1` draft-9 Decisions 5.6, 8.4.1, 8.4.2 — canon's + answer to `ZONE-WP-0001-T01`; enforcement stance is a sibling standard, not a + seventh axis, and the declaration surface is `tenancy.yaml`