feat: compile security zone declarations

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1

docs/security-zones_v0.1.md

@@ -83,11 +83,12 @@ adds one non-monotone continuity band required by ops-warden `ADR-0006`.
 | `z1-operational` | `M1` promotion evidence | Production secret handling for at most `internal` data | Early operational workloads with an owned front door |
 | `z2-protected` | `M2` promotion evidence | `prod`; at most `confidential` data | Production workloads requiring review, SLO/on-call, and incident readiness |
 | `z3-critical` | `M3` promotion evidence | `prod`; at most `restricted` data | Critical or regulated workloads with the strongest normal failure behavior |
-| `z3-continuity` | `M3` plus dependency/recovery evidence | `prod`; at most `restricted` data | Foundational access or recovery workloads where fail-closed dependency cycles would cause an outage |
+| `z2-continuity` | `M2` plus dependency/recovery evidence | `prod`; at most `confidential` data | Foundational access or recovery workloads where fail-closed dependency cycles would cause an outage |
 
-`z3-continuity` is a sibling of `z3-critical`, not a lower rung. It exists
+`z2-continuity` is a sibling of `z2-protected`, not a relaxation of its
+admission floor. It exists
 because enforcement stance is not monotone: a tunnel or credential-issuance
-path can require M3 scrutiny while deliberately remaining fail-open for one
+path can require production scrutiny while deliberately remaining fail-open for one
 availability-sensitive control. Placement on a reef is never evidence for any
 zone.
 
@@ -146,7 +147,7 @@ owns the other rows and every PEP failure mode.
 | `z1-operational` | `advisory` / `fail_open` | `enforced` / `fail_closed` | `advisory`; evaluator failure cannot produce `autonomous` |
 | `z2-protected` | `enforced` / `fail_open` | `enforced` / `fail_closed` | `enforced`; minimum `founder_required` when the zone rule matches |
 | `z3-critical` | `enforced` / `fail_closed` | `enforced` / `fail_closed` | `enforced`; minimum `founder_required` when the zone rule matches |
-| `z3-continuity` | `enforced` / `fail_open` | `enforced` / `fail_closed` | `enforced`; minimum `founder_required` when the zone rule matches |
+| `z2-continuity` | `enforced` / `fail_open` | `enforced` / `fail_closed` | `enforced`; minimum `founder_required` when the zone rule matches |
 | `unknown` | `advisory` / `fail_open` under the versioned `build` profile | `enforced` / `fail_closed` | `enforced`; never `autonomous` from zone evidence |
 
 The `unknown` pre-sign treatment is an explicit organization-build policy, not
@@ -159,7 +160,7 @@ does not extend to disclosing high-risk credentials. For a missing lane risk:
 - `z0-experimental` may resolve to `standard` only when admission proves the
   lane can expose synthetic material exclusively;
 - `z1-operational` and `z2-protected` resolve to at least `high`;
-- `z3-critical` and `z3-continuity` resolve to `critical`, treated by the
+- `z3-critical` resolves to `critical`, treated by the
   boundary as at least `high`; and
 - unresolved membership resolves to at least `high`.
 
@@ -201,12 +202,16 @@ tenancy:
   # tenancy-posture_v0.1 content omitted
 zones:
   standard: security-zones_v0.1
-  membership: z3-continuity
+  membership: z2-continuity
   responsible_party: ops-bridge
   justification: foundational tunnel path must retain availability under PDP loss
+  context:
+    maturity: M2
+    criticality: high
+    data_classification: confidential
   evidence:
     - ref: docs/evidence/ops-bridge-tunnel-zone.md
-      supports: [M3, continuity-dependency, recovery]
+      supports: [M2, continuity-dependency, recovery]
   reviewed: "2026-08-22"
   review_due: "2026-11-22"
 ```
@@ -220,6 +225,10 @@ Required fields are:
 - `membership` — one zone id from §4;
 - `responsible_party` — the party answering for this membership;
 - `justification` — why the zone fits the workload's actual context;
+- `context` — the evidenced `maturity`, `criticality`, and
+  `data_classification` used for admission. A managed workload's latter two
+  values must agree with its resolved rapp projection; `n/a` requires an
+  evidence-backed reason;
 - `evidence` — one or more references and the admission facts each supports;
 - `reviewed` and `review_due` — ISO dates, with review due after review.
 
@@ -240,9 +249,9 @@ workload_ref:
   name: ops-bridge-tunnel
   deployable: null              # optional for a managed deployable
 identity_binding: ssh-certificate/ops-warden/agt-ops-bridge
-declared_zone: z3-continuity
+declared_zone: z2-continuity
 admission: satisfied
-effective_zone: z3-continuity
+effective_zone: z2-continuity
 membership_revision: sha256:<digest>
 guarantees:
   - authoritative-workload-identity