docs: record live zone config migration

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1

docs/evidence/security-zone-admission-2026-08-22.md

@@ -24,7 +24,10 @@ This record supports the `z1-operational` membership declared in
 - Data handling: `ADR-0002` makes ops-warden a transparent conduit and
   `ADR-0004`/`ADR-0007` prevent raw agent reads and fail safe on ungraded lanes.
 - Policy path: `history/2026-08-19-flex-auth-caller-identity-evidence.md` proves
-  the authenticated caller path and anonymous rejection.
+  the authenticated caller path and anonymous rejection. At adoption, the
+  migrated real operator config reran the check successfully through the
+  existing tunnel: HTTP 200, effect `allow`, decision
+  `decision:f3f7c88f9585582a`.
 
 ## Why not z2
 

scripts/check_policy_caller_identity.py

@@ -190,9 +190,9 @@ def main() -> int:
         )
         return 1
     print(
-        "\nREADY — the calling side presents an identity. Next: tell flex-auth to set "
+        "\nREADY — the calling side presents an identity. Verify "
-        "callerAuth.mode: enforce on flex-auth-ops-warden and re-run this check. "
+        "callerAuth.mode remains enforce on flex-auth-ops-warden after rollout. "
-        "Zone-specific PEP failure modes already replace the retired global switches."
+        "Zone-specific PEP failure modes replace the retired global switches."
     )
     return 0
 

workplans/WARDEN-WP-0032-security-zones.md

@@ -166,17 +166,10 @@ explicit `unknown` profile and its configured failure mode.
 stance over every v0.1 zone plus `unknown`, preserves native enforcement for
 `not-applicable`, and returns `audit_only` for advisory decisions. The required
 live caller check passed through the existing tunnel with command-mode caller
-identity and decision `decision:f3f7c88f9585582a`; the check used a temporary
+identity and decision `decision:f3f7c88f9585582a`. The operator config was then
-migrated copy because the operator's persistent config still carries the two
+migrated from the two rejected global keys to `zone_registry_path`, and the
-retired keys. Full repo tests pass and sign/audit evidence records zone,
+same live check passed against that real config. Full repo tests pass and
-failure mode, outcome, and decision id.
+sign/audit evidence records zone, failure mode, outcome, and decision id.
-
-The required readiness recheck was run on 2026-08-22 after `warden plan`
-returned `autonomous`. It correctly returned **NOT READY** before obtaining or
-printing any token because the active operator `warden.yaml` still contains
-the two retired global keys. Operator configuration migration is therefore an
-explicit remaining acceptance step, followed by the value-safe live
-`/v1/check` smoke. Do not ask flex-auth to enforce caller authentication yet.
 
 ```task
 id: WARDEN-WP-0032-T03