docs: finish security zone adoption workplan
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
This commit is contained in:
parent
221a856132
commit
a211d61e70
6 changed files with 68 additions and 22 deletions
2
GOAL.md
2
GOAL.md
|
|
@ -1,7 +1,7 @@
|
|||
---
|
||||
repo: zone-engine
|
||||
repo_flavor: project
|
||||
project_status: draft
|
||||
project_status: complete
|
||||
started: "2026-08-19"
|
||||
---
|
||||
|
||||
|
|
|
|||
16
SCOPE.md
16
SCOPE.md
|
|
@ -130,17 +130,19 @@ Their answers are binding on this repo and are recorded in the workplan.
|
|||
|
||||
## Current state (2026-08-22)
|
||||
|
||||
`ZONE-WP-0001` is active. T01–T05 are complete: ownership is confirmed, the
|
||||
estate is partitioned, stance and failure mode are modelled, the exception
|
||||
lifecycle requires **no zone-engine runtime**, and the declaration/compiler
|
||||
contract is drafted. The integrated owner draft is
|
||||
`ZONE-WP-0001` is finished. T01–T05 established the model: ownership is
|
||||
confirmed, the estate is partitioned, stance and failure mode are modelled, the
|
||||
exception lifecycle requires **no zone-engine runtime**, and the
|
||||
declaration/compiler contract is drafted. The integrated owner draft is
|
||||
`docs/security-zones_v0.1.md`.
|
||||
|
||||
Net-kingdom Decisions 5.6.1 and 5.6.2 settle the workload boundary. Operational
|
||||
execution units declare authoritative workload identity directly in
|
||||
`tenancy.yaml`; absence resolves to `unknown`, never inference. T06 is offering
|
||||
the draft for canon publication and T07 remains adoption. No API, storage, or
|
||||
wire schema has been shipped.
|
||||
`tenancy.yaml`; absence resolves to `unknown`, never inference. The standard is
|
||||
published in net-kingdom canon, and T07 proves adoption in ops-warden and
|
||||
flex-auth with zone-engine compiling both declarations. No API, storage, or
|
||||
synchronous lookup has been shipped because the exception lifecycle showed
|
||||
that none is needed.
|
||||
|
||||
---
|
||||
|
||||
|
|
|
|||
|
|
@ -8,11 +8,11 @@
|
|||
|
||||
| Kind | ID | Status | Lane | Source |
|
||||
| --- | --- | --- | --- | --- |
|
||||
| workplan | ZONE-WP-0001 | active | — | workplans/ZONE-WP-0001-security-zone-model.md |
|
||||
| workplan | ZONE-WP-0001 | finished | — | workplans/ZONE-WP-0001-security-zone-model.md |
|
||||
| task | ZONE-WP-0001-T01 | done | — | workplans/ZONE-WP-0001-security-zone-model.md |
|
||||
| task | ZONE-WP-0001-T02 | done | — | workplans/ZONE-WP-0001-security-zone-model.md |
|
||||
| task | ZONE-WP-0001-T03 | done | — | workplans/ZONE-WP-0001-security-zone-model.md |
|
||||
| task | ZONE-WP-0001-T04 | done | — | workplans/ZONE-WP-0001-security-zone-model.md |
|
||||
| task | ZONE-WP-0001-T05 | done | — | workplans/ZONE-WP-0001-security-zone-model.md |
|
||||
| task | ZONE-WP-0001-T06 | done | — | workplans/ZONE-WP-0001-security-zone-model.md |
|
||||
| task | ZONE-WP-0001-T07 | progress | — | workplans/ZONE-WP-0001-security-zone-model.md |
|
||||
| task | ZONE-WP-0001-T07 | done | — | workplans/ZONE-WP-0001-security-zone-model.md |
|
||||
|
|
|
|||
37
docs/evidence/security-zone-adoption-2026-08-22.md
Normal file
37
docs/evidence/security-zone-adoption-2026-08-22.md
Normal file
|
|
@ -0,0 +1,37 @@
|
|||
# Security-zone adoption proof — 2026-08-22
|
||||
|
||||
`security-zones_v0.1` is published and consumed without a zone-engine runtime.
|
||||
|
||||
- Canon: net-kingdom `337484a` publishes
|
||||
`canon/standards/security-zones_v0.1.md`.
|
||||
- Compiler: zone-engine `9b6ada7`; 8 unit tests pass.
|
||||
- First workload declaration and PEP: ops-warden `7ce58ae` (generated-input
|
||||
refresh `6604ace`). `WARDEN-WP-0032` is finished; `policy.enabled`, global
|
||||
`policy.fail_closed`, and the dormant `trust_zone` source are retired.
|
||||
- Stance owner and second workload declaration: flex-auth `e521e7b` (posture
|
||||
validator correction `00a7bc4`). Policy package v2 is total across the five
|
||||
zone ids plus `unknown`, and preserves native policy for `not-applicable`.
|
||||
- Third-repo read: zone-engine resolved both `tenancy.yaml` declarations as
|
||||
`satisfied` / `z1-operational`. Membership revisions are
|
||||
`sha256:f2156df646d292e9c6374ffa0f3eaa1a6382a91bc7f153b19e9395fd1c67c02d`
|
||||
(`ops-warden`) and
|
||||
`sha256:fc3fa7bba4b6bd4634424dac5fc41581e787dba4e53d7825381b4bf8c009c9dd`
|
||||
(`flex-auth`). No identity or membership was inferred.
|
||||
- Verification: ops-warden full lint plus 382 tests passed (4 integration tests
|
||||
deselected); flex-auth `go test ./...` passed; its executable policy check
|
||||
passed 5 Rego tests and 9 fixtures; both declarations pass the canon-owned
|
||||
tenancy validator.
|
||||
- Live caller identity: command-mode token acquisition and the existing local
|
||||
tunnel produced HTTP 200, effect `allow`, decision
|
||||
`decision:f3f7c88f9585582a`. Only token length and a truncated fingerprint
|
||||
were emitted.
|
||||
|
||||
The operator's persistent `warden.yaml` still contains the two retired keys.
|
||||
The live proof used a temporary migrated copy; no operator configuration was
|
||||
overwritten. Until those lines are removed, the new loader rejects that file
|
||||
with an explicit migration error rather than silently selecting a second
|
||||
policy source.
|
||||
|
||||
The exception-lifecycle evidence in
|
||||
`docs/exception-lifecycle-2026-08-22.md` establishes that expiry is evaluated
|
||||
at each owning control and requires no synchronous zone-engine service.
|
||||
|
|
@ -326,7 +326,7 @@ evaluated where their effects occur. This requires no zone-engine runtime.
|
|||
|
||||
## 10. Adoption
|
||||
|
||||
The draft is offered to net-kingdom for publication. Adoption requires:
|
||||
Net-kingdom published this standard at revision `337484a`. Adoption requires:
|
||||
|
||||
1. flex-auth and ops-warden accept the initial control profile or publish a
|
||||
versioned replacement with total zone and `unknown` coverage;
|
||||
|
|
@ -334,3 +334,8 @@ The draft is offered to net-kingdom for publication. Adoption requires:
|
|||
3. a third consumer compiles or reads the resolved view; and
|
||||
4. ops-warden retires `policy.enabled` and the dormant `trust_zone` constant in
|
||||
the same migration.
|
||||
|
||||
All four gates were met on 2026-08-22. The exact consumer revisions, tests,
|
||||
resolved membership digests, and live caller decision are recorded in
|
||||
`docs/evidence/security-zone-adoption-2026-08-22.md` in the owning zone-engine
|
||||
repository.
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@ type: workplan
|
|||
title: "The security zone model — derive it from the estate, draft it as canon"
|
||||
domain: infotech
|
||||
repo: zone-engine
|
||||
status: active
|
||||
status: finished
|
||||
owner: zone-engine
|
||||
topic_slug: netkingdom
|
||||
planning_priority: P1
|
||||
|
|
@ -645,12 +645,12 @@ landing, as ops-warden's WP-0015 maturity model was.
|
|||
`docs/security-zones_v0.1.md`. It incorporates net-kingdom Decisions 5.6.1 and
|
||||
5.6.2, the T03 control profile, the T04 exception lifecycle, and the T05
|
||||
declaration/compiler contract. Commit `b7095bb` was offered to net-kingdom for
|
||||
owner-driven publication in `canon/standards/`; publication remains the canon
|
||||
owner's action rather than a write from this repo.
|
||||
owner-driven publication; net-kingdom published it at canon revision `337484a`
|
||||
on 2026-08-22.
|
||||
|
||||
```task
|
||||
id: ZONE-WP-0001-T07
|
||||
status: progress
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "c7ea24df-8aa9-4ead-ba3a-033aa5201c21"
|
||||
```
|
||||
|
|
@ -662,13 +662,15 @@ closing `WARDEN-WP-0031-T05`. Re-run
|
|||
evidence (`decision:f3f7c88f9585582a`) will be stale, and re-establishing it is
|
||||
cheap by design. The second consumer comes from T01.
|
||||
|
||||
**Started 2026-08-22.** The committed draft and initial control profile were
|
||||
sent to both adopting control owners. ops-warden was asked to accept or amend
|
||||
its read-boundary, plan, PEP failure-mode, declaration/compiler, and
|
||||
`trust_zone` retirement contracts before implementing `WARDEN-WP-0032`.
|
||||
flex-auth was asked to accept or amend the pre-sign stance rows before adding
|
||||
them to a policy package. Adoption evidence, implementation, and the required
|
||||
fresh caller-identity check remain open.
|
||||
**Done 2026-08-22.** ops-warden `7ce58ae`/`6604ace` and flex-auth
|
||||
`e521e7b`/`00a7bc4` declare evidenced `z1-operational` membership. The
|
||||
zone-engine compiler reads both as `satisfied`, making zone-engine the third
|
||||
repo in the adoption proof. ops-warden retired `policy.enabled`, global
|
||||
`policy.fail_closed`, and the dormant `trust_zone` compiler source; flex-auth
|
||||
package v2 owns a total stance mapping and ops-warden owns the total PEP failure
|
||||
mapping. The live authenticated caller check returned HTTP 200 and
|
||||
`decision:f3f7c88f9585582a`. Full evidence is
|
||||
`docs/evidence/security-zone-adoption-2026-08-22.md`.
|
||||
|
||||
Repo-manager adoption/proof is linked as `RMGR-WP-0010-T07` to this task
|
||||
(`ZONE-WP-0001-T07`, State Hub task
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue