zone-engine/README.md

# zone-engine

Headless authority for **security zones** — named bands of the estate with
different enforcement rigidity, and the lifecycle of time-boxed exceptions to
them.

A zone answers a question no existing axis answers: *is this control enforced
here, and what happens when it fails?* NetKingdom can already say how exposed a
workload is (environment posture), how ready it is (workload maturity `M0`–`M3`),
and what state the organization is in (`organization_posture`). All three
describe. None decides.

`zone-engine` is **not** a policy decision point. `flex-auth` remains the only
PDP; zone membership reaches it by compilation into the registry it already
consumes, never by a synchronous lookup in the decision path.

Orient: `GOAL.md` → `SCOPE.md` → `workplans/`.
-												Initial commit

											
										
										
											2026-08-19 19:15:55 +00:00
+								# zone-engine
-												Seed zone-engine — authority for security zones and exception lifecycle

Enforcement controls in this estate have been repo-wide booleans. ops-warden's
flex-auth pre-sign gate was the first to become flippable, and flipping it would
have made flex-auth a hard dependency of every warden sign — including the SSH
certs the ops-bridge tunnels depend on, one of which carries the policy call.
Uniform enforcement across an estate under deep refactor hardens exactly the
access needed to perform the refactor. Deferred under ops-warden ADR-0006; this
repo is what that ADR defers to.

Seeded deliberately without a schema. ZONE-WP-0001 produces a model and a canon
draft, not an API: an engine that ships a wire format before it has partitioned
the real estate defines the model by accident. Whether a runtime is warranted is
an output of the exception-lifecycle task, not an assumption.

Invariants set now, because they are the ones easy to lose later: flex-auth
stays the only PDP and receives membership by compilation, not a synchronous
lookup in a latency-critical decision path; placement (reefs) is not posture;
accuracy not altitude, per tenancy-posture v0.1 §6.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

											
										
										
											2026-08-19 21:18:44 +02:00
+								Headless authority for **security zones** — named bands of the estate with
 								different enforcement rigidity, and the lifecycle of time-boxed exceptions to
 								them.
 								A zone answers a question no existing axis answers: *is this control enforced
 								here, and what happens when it fails?* NetKingdom can already say how exposed a
 								workload is (environment posture), how ready it is (workload maturity `M0`–`M3`),
 								and what state the organization is in (`organization_posture`). All three
 								describe. None decides.
 								`zone-engine` is **not** a policy decision point. `flex-auth` remains the only
 								PDP; zone membership reaches it by compilation into the registry it already
 								consumes, never by a synchronous lookup in the decision path.
 								Orient: `GOAL.md` → `SCOPE.md` → `workplans/`.