docs: finish security zone adoption workplan

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1

docs/evidence/security-zone-adoption-2026-08-22.md

@@ -0,0 +1,37 @@
+# Security-zone adoption proof — 2026-08-22
+
+`security-zones_v0.1` is published and consumed without a zone-engine runtime.
+
+- Canon: net-kingdom `337484a` publishes
+  `canon/standards/security-zones_v0.1.md`.
+- Compiler: zone-engine `9b6ada7`; 8 unit tests pass.
+- First workload declaration and PEP: ops-warden `7ce58ae` (generated-input
+  refresh `6604ace`). `WARDEN-WP-0032` is finished; `policy.enabled`, global
+  `policy.fail_closed`, and the dormant `trust_zone` source are retired.
+- Stance owner and second workload declaration: flex-auth `e521e7b` (posture
+  validator correction `00a7bc4`). Policy package v2 is total across the five
+  zone ids plus `unknown`, and preserves native policy for `not-applicable`.
+- Third-repo read: zone-engine resolved both `tenancy.yaml` declarations as
+  `satisfied` / `z1-operational`. Membership revisions are
+  `sha256:f2156df646d292e9c6374ffa0f3eaa1a6382a91bc7f153b19e9395fd1c67c02d`
+  (`ops-warden`) and
+  `sha256:fc3fa7bba4b6bd4634424dac5fc41581e787dba4e53d7825381b4bf8c009c9dd`
+  (`flex-auth`). No identity or membership was inferred.
+- Verification: ops-warden full lint plus 382 tests passed (4 integration tests
+  deselected); flex-auth `go test ./...` passed; its executable policy check
+  passed 5 Rego tests and 9 fixtures; both declarations pass the canon-owned
+  tenancy validator.
+- Live caller identity: command-mode token acquisition and the existing local
+  tunnel produced HTTP 200, effect `allow`, decision
+  `decision:f3f7c88f9585582a`. Only token length and a truncated fingerprint
+  were emitted.
+
+The operator's persistent `warden.yaml` still contains the two retired keys.
+The live proof used a temporary migrated copy; no operator configuration was
+overwritten. Until those lines are removed, the new loader rejects that file
+with an explicit migration error rather than silently selecting a second
+policy source.
+
+The exception-lifecycle evidence in
+`docs/exception-lifecycle-2026-08-22.md` establishes that expiry is evaluated
+at each owning control and requires no synchronous zone-engine service.

docs/security-zones_v0.1.md

@@ -326,7 +326,7 @@ evaluated where their effects occur. This requires no zone-engine runtime.
 
 ## 10. Adoption
 
-The draft is offered to net-kingdom for publication. Adoption requires:
+Net-kingdom published this standard at revision `337484a`. Adoption requires:
 
 1. flex-auth and ops-warden accept the initial control profile or publish a
    versioned replacement with total zone and `unknown` coverage;
@@ -334,3 +334,8 @@ The draft is offered to net-kingdom for publication. Adoption requires:
 3. a third consumer compiles or reads the resolved view; and
 4. ops-warden retires `policy.enabled` and the dormant `trust_zone` constant in
    the same migration.
+
+All four gates were met on 2026-08-22. The exact consumer revisions, tests,
+resolved membership digests, and live caller decision are recorded in
+`docs/evidence/security-zone-adoption-2026-08-22.md` in the owning zone-engine
+repository.