coulomb/zone-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Headless multi-application, multi-tenant security zone mangement engine.
60 commits 1 branch 0 tags 614 KiB
Find a file
Exact
tegwick 7e7e3f307c docs(reuse): establish reviewed NetKingdom security capabilities 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684
2026-10-14 06:47:01 +02:00
docs Check accepted layer v0.8 and nested declaration pins 2026-10-11 02:21:25 +02:00
fixtures Repoint live flex-auth repository path to access-engine (FLEX-WP-0020) 2026-09-30 18:52:08 +02:00
history feat: finish ZONE-WP-0003 Engine/PIP freeze and claim mapping 2026-08-29 12:49:24 +02:00
intakes Close flex-auth -> access-engine rename intake with evidence (FLEX-WP-0020) 2026-09-30 18:57:38 +02:00
profiles feat: harden zone reference contracts 2026-08-23 12:27:13 +02:00
registry docs(reuse): establish reviewed NetKingdom security capabilities 2026-10-14 06:47:01 +02:00
tests Check accepted layer v0.8 and nested declaration pins 2026-10-11 02:21:25 +02:00
tools Check accepted layer v0.8 and nested declaration pins 2026-10-11 02:21:25 +02:00
workplans feat: finish ZONE-WP-0003 Engine/PIP freeze and claim mapping 2026-08-29 12:49:24 +02:00
.custodian-brief.md chore(consistency): sync task status from DB [auto] 2026-09-30 15:07:24 +02:00
.gitignore chore: ignore local .repo-manager cache 2026-08-29 11:59:01 +02:00
.repo-classification.yaml Seed zone-engine — authority for security zones and exception lifecycle 2026-08-19 21:18:44 +02:00
AGENTS.md Seed zone-engine — authority for security zones and exception lifecycle 2026-08-19 21:18:44 +02:00
DECISIONS.md fix(workplans): adopt ADR-007 derived identifiers 2026-08-25 19:31:02 +02:00
GOAL.md docs: mark ZONE-WP-0003 as delivered in GOAL.md 2026-08-29 14:37:09 +02:00
INTENT.md Apply GH-DEC-2026-017 to the layer declaration 2026-09-21 07:34:22 +02:00
layer.yaml Apply GH-DEC-2026-017 to the layer declaration 2026-09-21 07:34:22 +02:00
Makefile feat: finish ZONE-WP-0003 Engine/PIP freeze and claim mapping 2026-08-29 12:49:24 +02:00
README.md feat: finish ZONE-WP-0003 Engine/PIP freeze and claim mapping 2026-08-29 12:49:24 +02:00
SCOPE.md feat: finish ZONE-WP-0003 Engine/PIP freeze and claim mapping 2026-08-29 12:49:24 +02:00
WORK-RECORDS.md Minor update 2026-10-03 00:29:56 +02:00

README.md

zone-engine

Engine-layer PIP for NetKingdom security-zone identity and membership, retained as offline reference conformance. This repository validates workload membership and admission, projects only explicit owner-versioned control profiles, checks time-boxed exception fixtures, and verifies the lineage of the canonical standard.

It is not a live engine, not a PEP, and not a policy decision point. Canon is published by net-kingdom. access-engine (currently flex-auth) is the only PDP; each enforcement-point owner retains live policy and failure-mode authority. Layer declaration: INTENT.md frontmatter and layer.yaml.

Checks

make check
make canon-lineage CANON_ROOT=/path/to/net-kingdom

Resolve the versioned reference manifest and optional owner profile:

python3 tools/resolve_zones.py \
  --manifest fixtures/manifests/reference.yaml \
  --control-profile profiles/netkingdom-build-v0.1.yaml

Evaluate exception conformance at an explicit instant:

python3 tools/check_zone_exceptions.py \
  fixtures/exceptions/valid-active.yaml \
  --policy fixtures/exceptions/policy.yaml \
  --at 2026-08-23T10:00:00Z

Orient: GOAL.md → SCOPE.md → workplans/.