docs: finish zone reference hardening workplan

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1

README.md

@@ -1,17 +1,36 @@
 # zone-engine
 
-Headless authority for **security zones** — named bands of the estate with
-different enforcement rigidity, and the lifecycle of time-boxed exceptions to
-them.
+Offline reference conformance for NetKingdom **security zones**. This repository
+validates workload membership and admission, projects only explicit
+owner-versioned control profiles, checks time-boxed exception fixtures, and
+verifies the lineage of the canonical standard.
 
-A zone answers a question no existing axis answers: *is this control enforced
-here, and what happens when it fails?* NetKingdom can already say how exposed a
-workload is (environment posture), how ready it is (workload maturity `M0`–`M3`),
-and what state the organization is in (`organization_posture`). All three
-describe. None decides.
+It is not a service or policy decision point. Canon is published by
+`net-kingdom`; flex-auth and each enforcement-point owner retain live policy
+authority.
 
-`zone-engine` is **not** a policy decision point. `flex-auth` remains the only
-PDP; zone membership reaches it by compilation into the registry it already
-consumes, never by a synchronous lookup in the decision path.
+## Checks
+
+```bash
+make check
+make canon-lineage CANON_ROOT=/path/to/net-kingdom
+```
+
+Resolve the versioned reference manifest and optional owner profile:
+
+```bash
+python3 tools/resolve_zones.py \
+  --manifest fixtures/manifests/reference.yaml \
+  --control-profile profiles/netkingdom-build-v0.1.yaml
+```
+
+Evaluate exception conformance at an explicit instant:
+
+```bash
+python3 tools/check_zone_exceptions.py \
+  fixtures/exceptions/valid-active.yaml \
+  --policy fixtures/exceptions/policy.yaml \
+  --at 2026-08-23T10:00:00Z
+```
 
 Orient: `GOAL.md` → `SCOPE.md` → `workplans/`.