zone-engine/AGENTS.md

# Agent instructions — zone-engine

Orient: GOAL.md → SCOPE.md → workplans/.
Workplan prefix: `ZONE-WP-`.
Seed zone-engine — authority for security zones and exception lifecycle Enforcement controls in this estate have been repo-wide booleans. ops-warden's flex-auth pre-sign gate was the first to become flippable, and flipping it would have made flex-auth a hard dependency of every warden sign — including the SSH certs the ops-bridge tunnels depend on, one of which carries the policy call. Uniform enforcement across an estate under deep refactor hardens exactly the access needed to perform the refactor. Deferred under ops-warden ADR-0006; this repo is what that ADR defers to. Seeded deliberately without a schema. ZONE-WP-0001 produces a model and a canon draft, not an API: an engine that ships a wire format before it has partitioned the real estate defines the model by accident. Whether a runtime is warranted is an output of the exception-lifecycle task, not an assumption. Invariants set now, because they are the ones easy to lose later: flex-auth stays the only PDP and receives membership by compilation, not a synchronous lookup in a latency-critical decision path; placement (reefs) is not posture; accuracy not altitude, per tenancy-posture v0.1 §6. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> 2026-08-19 21:18:44 +02:00			`# Agent instructions — zone-engine`

			`Orient: GOAL.md → SCOPE.md → workplans/.`
			Workplan prefix: `ZONE-WP-`.