50 lines
2 KiB
Markdown
50 lines
2 KiB
Markdown
|
---
|
||
|
|
repo: zone-engine
|
||
|
|
repo_flavor: project
|
||
|
|
project_status: draft
|
||
|
|
started: "2026-08-19"
|
||
|
|
---
|
||
|
|
|
||
|
|
# Goal — zone-engine
|
||
|
|
|
||
|
|
## Outcome
|
||
|
|
|
||
|
|
Enforcement rigidity is a declared, reviewable property of a named zone rather
|
||
|
|
than a boolean per repo. A control can be turned on for the band of the estate
|
||
|
|
that wants its failure mode, and left advisory where that failure mode would
|
||
|
|
stop the work. Deep refactors get relaxed rigidity through an exception that
|
||
|
|
expires on its own.
|
||
|
|
|
||
|
|
## Invariants
|
||
|
|
|
||
|
|
- **`flex-auth` remains the only policy decision point.** Zone membership
|
||
|
|
reaches it by compilation into the registry it already consumes. Nothing this
|
||
|
|
repo builds sits synchronously in a decision path.
|
||
|
|
- **A zone that can be quietly widened is not a boundary.** Every change of
|
||
|
|
stance is observable, and every exception has an enforced expiry.
|
||
|
|
- **Accuracy, not altitude** (`tenancy-posture_v0.1` §6). A repo declaring a
|
||
|
|
stricter zone than it can evidence is the failure to design against, because
|
||
|
|
it looks like progress.
|
||
|
|
- **Placement is not posture.** Reefs are a separate axis and stay separate.
|
||
|
|
- **The model precedes the schema.** No API, no storage, no wire format until
|
||
|
|
`ZONE-WP-0001` has partitioned the real estate.
|
||
|
|
|
||
|
|
## Success gates
|
||
|
|
|
||
|
|
1. The model partitions today's estate — the 27 ops-warden catalog lanes, the
|
||
|
|
actor inventory, the posture-carrying workloads — without a residue of
|
||
|
|
unexplained exceptions.
|
||
|
|
2. A canon standard is drafted and offered to `net-kingdom`, in the family of
|
||
|
|
`tenancy-posture_v0.1`.
|
||
|
|
3. At least two repos declare zones and are read by a third — a model only its
|
||
|
|
author honours is not adopted.
|
||
|
|
4. `ops-warden`'s `policy.enabled` is retired in favour of a zone-aware control,
|
||
|
|
closing `WARDEN-WP-0031-T05`.
|
||
|
|
5. Whether a runtime is needed is answered on evidence from the exception
|
||
|
|
lifecycle, not assumed.
|
||
|
|
|
||
|
|
## Project retirement
|
||
|
|
|
||
|
|
Archive when the standard is canon, the declarations are live, and either a
|
||
|
|
runtime exists with an owner or the decision that none is needed is recorded.
|