diff --git a/GOAL.md b/GOAL.md index ff82bbb..5e77825 100644 --- a/GOAL.md +++ b/GOAL.md @@ -1,7 +1,7 @@ --- repo: zone-engine repo_flavor: project -project_status: draft +project_status: complete started: "2026-08-19" --- diff --git a/SCOPE.md b/SCOPE.md index 28033f6..88aaa40 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -130,17 +130,19 @@ Their answers are binding on this repo and are recorded in the workplan. ## Current state (2026-08-22) -`ZONE-WP-0001` is active. T01–T05 are complete: ownership is confirmed, the -estate is partitioned, stance and failure mode are modelled, the exception -lifecycle requires **no zone-engine runtime**, and the declaration/compiler -contract is drafted. The integrated owner draft is +`ZONE-WP-0001` is finished. T01–T05 established the model: ownership is +confirmed, the estate is partitioned, stance and failure mode are modelled, the +exception lifecycle requires **no zone-engine runtime**, and the +declaration/compiler contract is drafted. The integrated owner draft is `docs/security-zones_v0.1.md`. Net-kingdom Decisions 5.6.1 and 5.6.2 settle the workload boundary. Operational execution units declare authoritative workload identity directly in -`tenancy.yaml`; absence resolves to `unknown`, never inference. T06 is offering -the draft for canon publication and T07 remains adoption. No API, storage, or -wire schema has been shipped. +`tenancy.yaml`; absence resolves to `unknown`, never inference. The standard is +published in net-kingdom canon, and T07 proves adoption in ops-warden and +flex-auth with zone-engine compiling both declarations. No API, storage, or +synchronous lookup has been shipped because the exception lifecycle showed +that none is needed. --- diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 5d188e5..5eb9595 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -8,11 +8,11 @@ | Kind | ID | Status | Lane | Source | | --- | --- | --- | --- | --- | -| workplan | ZONE-WP-0001 | active | — | workplans/ZONE-WP-0001-security-zone-model.md | +| workplan | ZONE-WP-0001 | finished | — | workplans/ZONE-WP-0001-security-zone-model.md | | task | ZONE-WP-0001-T01 | done | — | workplans/ZONE-WP-0001-security-zone-model.md | | task | ZONE-WP-0001-T02 | done | — | workplans/ZONE-WP-0001-security-zone-model.md | | task | ZONE-WP-0001-T03 | done | — | workplans/ZONE-WP-0001-security-zone-model.md | | task | ZONE-WP-0001-T04 | done | — | workplans/ZONE-WP-0001-security-zone-model.md | | task | ZONE-WP-0001-T05 | done | — | workplans/ZONE-WP-0001-security-zone-model.md | | task | ZONE-WP-0001-T06 | done | — | workplans/ZONE-WP-0001-security-zone-model.md | -| task | ZONE-WP-0001-T07 | progress | — | workplans/ZONE-WP-0001-security-zone-model.md | +| task | ZONE-WP-0001-T07 | done | — | workplans/ZONE-WP-0001-security-zone-model.md | diff --git a/docs/evidence/security-zone-adoption-2026-08-22.md b/docs/evidence/security-zone-adoption-2026-08-22.md new file mode 100644 index 0000000..40fe5ea --- /dev/null +++ b/docs/evidence/security-zone-adoption-2026-08-22.md @@ -0,0 +1,37 @@ +# Security-zone adoption proof — 2026-08-22 + +`security-zones_v0.1` is published and consumed without a zone-engine runtime. + +- Canon: net-kingdom `337484a` publishes + `canon/standards/security-zones_v0.1.md`. +- Compiler: zone-engine `9b6ada7`; 8 unit tests pass. +- First workload declaration and PEP: ops-warden `7ce58ae` (generated-input + refresh `6604ace`). `WARDEN-WP-0032` is finished; `policy.enabled`, global + `policy.fail_closed`, and the dormant `trust_zone` source are retired. +- Stance owner and second workload declaration: flex-auth `e521e7b` (posture + validator correction `00a7bc4`). Policy package v2 is total across the five + zone ids plus `unknown`, and preserves native policy for `not-applicable`. +- Third-repo read: zone-engine resolved both `tenancy.yaml` declarations as + `satisfied` / `z1-operational`. Membership revisions are + `sha256:f2156df646d292e9c6374ffa0f3eaa1a6382a91bc7f153b19e9395fd1c67c02d` + (`ops-warden`) and + `sha256:fc3fa7bba4b6bd4634424dac5fc41581e787dba4e53d7825381b4bf8c009c9dd` + (`flex-auth`). No identity or membership was inferred. +- Verification: ops-warden full lint plus 382 tests passed (4 integration tests + deselected); flex-auth `go test ./...` passed; its executable policy check + passed 5 Rego tests and 9 fixtures; both declarations pass the canon-owned + tenancy validator. +- Live caller identity: command-mode token acquisition and the existing local + tunnel produced HTTP 200, effect `allow`, decision + `decision:f3f7c88f9585582a`. Only token length and a truncated fingerprint + were emitted. + +The operator's persistent `warden.yaml` still contains the two retired keys. +The live proof used a temporary migrated copy; no operator configuration was +overwritten. Until those lines are removed, the new loader rejects that file +with an explicit migration error rather than silently selecting a second +policy source. + +The exception-lifecycle evidence in +`docs/exception-lifecycle-2026-08-22.md` establishes that expiry is evaluated +at each owning control and requires no synchronous zone-engine service. diff --git a/docs/security-zones_v0.1.md b/docs/security-zones_v0.1.md index 8bbc402..eb2047c 100644 --- a/docs/security-zones_v0.1.md +++ b/docs/security-zones_v0.1.md @@ -326,7 +326,7 @@ evaluated where their effects occur. This requires no zone-engine runtime. ## 10. Adoption -The draft is offered to net-kingdom for publication. Adoption requires: +Net-kingdom published this standard at revision `337484a`. Adoption requires: 1. flex-auth and ops-warden accept the initial control profile or publish a versioned replacement with total zone and `unknown` coverage; @@ -334,3 +334,8 @@ The draft is offered to net-kingdom for publication. Adoption requires: 3. a third consumer compiles or reads the resolved view; and 4. ops-warden retires `policy.enabled` and the dormant `trust_zone` constant in the same migration. + +All four gates were met on 2026-08-22. The exact consumer revisions, tests, +resolved membership digests, and live caller decision are recorded in +`docs/evidence/security-zone-adoption-2026-08-22.md` in the owning zone-engine +repository. diff --git a/workplans/ZONE-WP-0001-security-zone-model.md b/workplans/ZONE-WP-0001-security-zone-model.md index c7010bb..54ea63a 100644 --- a/workplans/ZONE-WP-0001-security-zone-model.md +++ b/workplans/ZONE-WP-0001-security-zone-model.md @@ -4,7 +4,7 @@ type: workplan title: "The security zone model — derive it from the estate, draft it as canon" domain: infotech repo: zone-engine -status: active +status: finished owner: zone-engine topic_slug: netkingdom planning_priority: P1 @@ -645,12 +645,12 @@ landing, as ops-warden's WP-0015 maturity model was. `docs/security-zones_v0.1.md`. It incorporates net-kingdom Decisions 5.6.1 and 5.6.2, the T03 control profile, the T04 exception lifecycle, and the T05 declaration/compiler contract. Commit `b7095bb` was offered to net-kingdom for -owner-driven publication in `canon/standards/`; publication remains the canon -owner's action rather than a write from this repo. +owner-driven publication; net-kingdom published it at canon revision `337484a` +on 2026-08-22. ```task id: ZONE-WP-0001-T07 -status: progress +status: done priority: medium state_hub_task_id: "c7ea24df-8aa9-4ead-ba3a-033aa5201c21" ``` @@ -662,13 +662,15 @@ closing `WARDEN-WP-0031-T05`. Re-run evidence (`decision:f3f7c88f9585582a`) will be stale, and re-establishing it is cheap by design. The second consumer comes from T01. -**Started 2026-08-22.** The committed draft and initial control profile were -sent to both adopting control owners. ops-warden was asked to accept or amend -its read-boundary, plan, PEP failure-mode, declaration/compiler, and -`trust_zone` retirement contracts before implementing `WARDEN-WP-0032`. -flex-auth was asked to accept or amend the pre-sign stance rows before adding -them to a policy package. Adoption evidence, implementation, and the required -fresh caller-identity check remain open. +**Done 2026-08-22.** ops-warden `7ce58ae`/`6604ace` and flex-auth +`e521e7b`/`00a7bc4` declare evidenced `z1-operational` membership. The +zone-engine compiler reads both as `satisfied`, making zone-engine the third +repo in the adoption proof. ops-warden retired `policy.enabled`, global +`policy.fail_closed`, and the dormant `trust_zone` compiler source; flex-auth +package v2 owns a total stance mapping and ops-warden owns the total PEP failure +mapping. The live authenticated caller check returned HTTP 200 and +`decision:f3f7c88f9585582a`. Full evidence is +`docs/evidence/security-zone-adoption-2026-08-22.md`. Repo-manager adoption/proof is linked as `RMGR-WP-0010-T07` to this task (`ZONE-WP-0001-T07`, State Hub task