docs: finish zone reference hardening workplan

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1

tools/check_zone_exceptions.py

@@ -12,14 +12,18 @@ from typing import Any, Mapping
 
 import yaml
 
-try:
-    from tools.resolve_zones import ZONE_FLOOR
-except ModuleNotFoundError:  # direct ``python tools/...`` execution
-    from resolve_zones import ZONE_FLOOR
-
 
 POLICY_STANDARD = "security-zone-exception-policy_v0.1"
 RECORD_STANDARD = "security-zone-exceptions_v0.1"
+ZONE_IDS = frozenset(
+    {
+        "z0-experimental",
+        "z1-operational",
+        "z2-protected",
+        "z2-continuity",
+        "z3-critical",
+    }
+)
 
 
 class ExceptionConformanceError(ValueError):
@@ -103,7 +107,7 @@ def _validate_relaxation(record: Mapping[str, Any], errors: list[str]) -> None:
             "enforced": {"advisory", "exempt"},
             "advisory": {"exempt"},
         }
-        if relaxed_stance not in allowed.get(base_stance, set()):
+        if relaxed_stance not in allowed.get(str(base_stance), set()):
             errors.append("relaxation.stance must strictly relax the base stance")
         else:
             changed = True
@@ -155,10 +159,12 @@ def _record_result(
         if value is None or value == "" or value == () or value == []:
             errors.append(f"{key} is required")
     zone = record.get("security_zone")
-    if zone not in ZONE_FLOOR:
+    if zone not in ZONE_IDS:
         errors.append("security_zone must be a named zone")
     control_id = record.get("control")
-    control_policy = policy["controls"].get(control_id)
+    control_policy = (
+        policy["controls"].get(str(control_id)) if control_id is not None else None
+    )
     if control_policy is None:
         errors.append("control is absent from the owner exception policy")
     workloads = record.get("workloads")
@@ -226,7 +232,7 @@ def _record_result(
                 )
     valid = not errors
     active = bool(valid and before and after and before <= at < after)
-    if not valid:
+    if not valid or before is None or after is None:
         state = "invalid"
     elif at < before:
         state = "future"