coulomb/zone-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ZONE-WP-0001-T02 done — result recorded in the workplan

Browse source 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-08-19 23:09:09 +02:00
parent e5af1ba270
commit 4c5c6b9fca
1 changed files with 33 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

34
workplans/ZONE-WP-0001-security-zone-model.md
View file

@ -192,7 +192,7 @@ surface is `tenancy.yaml`'s `zones:` key rather than a new file.
```task
id: ZONE-WP-0001-T02
status: todo
status: done
priority: high
state_hub_task_id: "f1016c71-ccb0-46a7-9143-e81c7ac34cad"
```
@ -220,6 +220,38 @@ Answer explicitly:
The *other* two axes (environment posture, `M0`–`M3`) remain an open question
for this task — they are per-workload and genuinely composable.
**Done 2026-08-19.** Full result: `docs/estate-partition-2026-08-19.md`.
Four bands, each of the 27 lanes in exactly one — **Decided** (1, the only lane
ops-warden decides), **Fronted** (10, owner has a front door), **Covered** (12,
ops-warden proxies what it does not own), **Signposted** (4, routed, nothing
flows). Derived from declared fields, not invented.
The discriminator is `delegation.mode`, not `risk`: 10 of 11 high-risk lanes are
interim and 8 of those are `exec_capable`. A field added to answer a governance
question predicts operational danger better than the one named for it.
Three results that bind the later tasks:
- **Stance is per control per zone, never per zone alone.** The three existing
controls cut the estate differently — pre-sign gate 1 lane, fetch gate 13,
read-boundary 11, with only 8 in the overlap. They were built independently
and their scopes were never reconciled.
- **Zone is a property of the lane.** The caller (`WARDEN_AGENT_ID`) is a
*modifier*, not the zone — collapsing them would make one lane need two. And
the moment is confirmed as a separate object: nothing in the corpus represents
it, and `delegation.blocked_on` is exactly the expiry-by-intention shape T04
must not reproduce.
- **Environment posture and `M0`–`M3` compose but cannot be joined today** —
they are per-workload, zones are per-lane, and no registry carries a join key.
Inventing one would be fabrication under §6.
**Residue, and the most valuable output:** 14 of 27 lanes carry no `risk` value,
and `is_high_risk` is `risk == "high"`, so the agent read-boundary never fires
for them; 5 are `exec_capable`. Routed to `risk-nexus` as **`RISK-F-0003`**.
Consequence for this workplan: `risk` is not usable as a membership input until
those lanes are graded.
```task
id: ZONE-WP-0001-T03
status: todo