apiVersion: helixforge.repo-manager/v1
kind: OwnerTaskInterface
metadata:
  id: helixforge.workloads.zone-engine-resolution.v1
  title: Consume explicit workload references without inference
source:
  repo: repo-manager
  workplan_task: RMGR-WP-0010-T07
target:
  repo: zone-engine
  owner_agent: zone-engine
  suggested_work_record: ZONE-WP-0001-T07
approval:
  dispositions: [approved, amended, rejected]
  record_in: ZONE-WP-0001-T07 or a Zone Engine owner decision
task:
  title: Prove Zone Engine workload resolution without inference
  priority: high
  objective: >-
    Join ops-warden lane pointers to authoritative Repo Manager workload
    projections and expose unresolved workload identity without guessing.
  inputs:
    - ref: repo-manager/docs/workload-reference-contract_v1.md
      authority: repo-manager
    - ref: helixforge.workloads.ops-warden-reference.v1
      authority: ops-warden after approval
    - ref: zone-engine/docs/security-zones_v0.1.md
      authority: zone-engine draft pending canon adoption
  deliverables:
    - Consume exact rapp_id and workload name pairs plus optional deployable.
    - Preserve resolved, unknown, and owner-asserted not-applicable as distinct states.
    - Join authoritative projection data to explicit catalog references only.
    - Emit evidence that name and path drift cannot change zone membership.
  constraints:
    - Do not parse repository slugs, owner_repo, credential paths, or path templates as identity.
    - Unknown must fail closed wherever zone policy requires workload identity.
    - Zone Engine does not author workload identity or ops-warden lane pointers.
  acceptance:
    - A valid exact reference resolves to one authoritative workload projection.
    - A mismatched qonto versus rapp-qonto name remains unknown.
    - A non-workload lane remains not-applicable rather than becoming unknown.
    - No fallback identity path exists in implementation or fixtures.
  verification:
    - >-
      uv run --project /home/worsch/repo-manager rmgr workload resolve --root
      /home/worsch --rapp-id rapp-issue-core --name issue-core --deployable issue-core
    - >-
      uv run --project /home/worsch/repo-manager rmgr workload resolve --root
      /home/worsch --rapp-id rapp-qonto --name rapp-qonto