Refine SCOPE, add INTENT, fix the GOAL invariant flex-auth rejected

GOAL.md still carried the first-draft invariant — "nothing this repo builds sits
synchronously in a decision path" — after flex-auth's review had rejected it as
a latency guarantee wearing an authority guarantee's clothes. Under that wording
zone-engine could compile enforced: false for a lane, flip warden sign from deny
to allow with no flex-auth policy change, and be literally compliant. Replaced:
identity and membership here, effect in a flex-auth policy package. Compiled-not-
queried is demoted to a consequence of that, which is what it always was.

SCOPE now records what the two reviews settled rather than what was proposed:
separate standard (canon Decision 5.6), membership declared in tenancy.yaml's
reserved zones: key, stance out of scope for controls flex-auth decides, the
fail-open axis modelled PEP-side because a PDP structurally cannot express it,
organization_posture an input rather than a declaration field, and reefs not
ours. Plus the two inherited constraints: the dead trust_zone field already
sitting where membership would go, and flex-auth's lack of a reload path.

INTENT.md states the argument, including what would falsify the repo — the
exception lifecycle not needing a runtime is called out as a legitimate outcome
that should archive this repo rather than keep it for its own sake.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

INTENT.md

@@ -0,0 +1,127 @@
+# INTENT
+
+> Why `zone-engine` exists and where it is going.
+> What is true today is `SCOPE.md`. Checkable gates and the retirement
+> condition are `GOAL.md`. This file is the argument, not the checklist.
+
+---
+
+## 1. The sentence this repo exists to make sayable
+
+> *"This control is enforced **there**, advisory **here**, and relaxed **in this
+> band until Friday** — and all three of those are written down, reviewable, and
+> expire on their own."*
+
+NetKingdom cannot say that today. It can say how exposed a workload is
+(environment posture), how ready it is (`M0`–`M3`), and what state the
+organization is in (`organization_posture`). Every one of those **describes**.
+None of them **decides**. So every enforcement control in the estate has been a
+boolean over a whole repo.
+
+## 2. Where that bit
+
+ops-warden built a pre-sign authorization gate, flex-auth enforced its side, and
+the gate verified clean. Then it was deliberately not switched on.
+
+`policy.enabled` is one boolean over the entire repo. With `fail_closed: true`
+it makes flex-auth a hard dependency of *every* `warden sign` — including the
+SSH certificates the ops-bridge tunnels depend on, one of which carries the
+policy call itself. Turning it on would have been correct for a settled
+production lane and wrong for an estate in the middle of decommissioning one
+host and moving a service off it.
+
+That is not a story about a flag. **Security that stops the work stops being
+security and becomes an outage with good intentions** — and the reason it would
+have was structural: there was nowhere to say *where* it applies. The decision
+is ops-warden's `ADR-0006`; this repo is what it defers to.
+
+## 3. What a zone has to be, to be worth having
+
+A classification that changes nothing is a label. A zone earns its keep only if
+it decides something, so the model must carry:
+
+- **Membership** — what puts a lane, actor or workload in a zone, derived from
+  posture already declared rather than a fourth hand-maintained list.
+- **Stance per control** — enforced, advisory, or exempt.
+- **Failure mode** — what happens when the control cannot run. This is where
+  the bite is; `fail_closed` is what turns a dead tunnel into an outage.
+- **Exceptions that expire without anyone remembering them.**
+
+The last is the reason this is a repo rather than a document. A standing
+classification needs no engine — canon plus a declaration file covers it, which
+is exactly how tenancy posture works. **A relaxation with an expiry is state**,
+and state wants an owner, an audit trail, and something other than good
+intentions enforcing the deadline.
+
+## 4. The line this repo must not cross
+
+`flex-auth` is the policy decision point. It stays the only one.
+
+zone-engine is authority over zone **identity and membership**. The **effect**
+of a zone on a decision flex-auth renders belongs in a flex-auth policy package,
+because flex-auth's decision envelope stamps `matched_policy_version` and
+`policy_package` — and registry content appears nowhere in that provenance. Put
+stance in the registry and two decisions with the same policy version and the
+same request can differ, with nothing in the audit trail explaining why.
+
+That boundary was drawn by flex-auth on review, against a first draft of ours
+that got it wrong in an instructive way: the original invariant forbade sitting
+*synchronously* in a decision path, which is a latency guarantee wearing an
+authority guarantee's clothes. Compiled data that determines an outcome is still
+deciding; it just decided earlier.
+
+**Held to, in one line: membership is ours, stance is theirs, and the decision
+point is neither.**
+
+## 5. What success looks like from outside
+
+Someone who has never read this repo should be able to:
+
+- open a service's `tenancy.yaml`, read its `zones:` key, and know which
+  controls bite it;
+- ask "why was this relaxed?" and get a justification, an author and an expiry,
+  not a shrug;
+- watch a relaxation lapse **without a human remembering it**;
+- and find the rule published in NetKingdom canon rather than in this repo's
+  prose.
+
+If a reader has to come here to understand their own posture, the model has
+failed at being a standard and has succeeded only at being a service.
+
+## 6. What would make this repo wrong
+
+Stated up front, because a repo created on a recommendation should say what
+would falsify it:
+
+- **The exception lifecycle turns out not to need a runtime.** If reviewed
+  declarations in git, with expiry evaluated at decision time, are sufficient,
+  then the honest outcome is a canon standard and no engine — and this repo
+  should be archived rather than kept for the sake of existing. `GOAL.md` gate 5
+  and `ZONE-WP-0001-T04` both hold that door open deliberately.
+- **The zones do not partition the real estate.** If the model needs a residue
+  of special cases to cover today's 27 routing lanes and actor inventory, it is
+  describing an aspiration, not a structure.
+- **Nobody but the author declares one.** Two repos declaring and a third
+  reading is the minimum evidence of a model rather than a preference.
+- **It becomes a second decision point.** The failure would not announce itself;
+  it would arrive as a small convenience — a stance compiled into membership
+  "just for now".
+
+## 7. What this repo deliberately will not become
+
+Not a PDP. Not network segmentation — "zone" is overloaded and the routing sense
+is someone else's word. Not a placement model: reefs answer *where a thing runs*
+and are `repo-manager`'s, and the fact that `reef-railiance` caps availability
+for everything bound to it is a canon composition problem (`NK-WP-0027`), not
+ours. Not an owner of anyone's controls — the controls stay with the repos that
+enforce them; this model only says where they bite.
+
+## 8. Direction
+
+Model first, from the real estate. Canon standard drafted here and published by
+`net-kingdom`, in the family of `tenancy-posture_v0.1`. Membership declared in
+the `zones:` key that canon has already reserved. Two consumers before it is
+called adopted, the first being ops-warden retiring `policy.enabled`.
+
+A runtime only if `ZONE-WP-0001-T04` proves the exception lifecycle needs one —
+and the cheaper answer is a legitimate result, not a disappointment.