coulomb/zone-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: finish security zone adoption workplan

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
This commit is contained in:
tegwick 2026-08-22 15:40:55 +02:00
parent 221a856132
commit a211d61e70
6 changed files with 68 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

24
workplans/ZONE-WP-0001-security-zone-model.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "The security zone model — derive it from the estate, draft it as canon"
domain: infotech
repo: zone-engine
status: active
status: finished
owner: zone-engine
topic_slug: netkingdom
planning_priority: P1
@ -645,12 +645,12 @@ landing, as ops-warden's WP-0015 maturity model was.
`docs/security-zones_v0.1.md`. It incorporates net-kingdom Decisions 5.6.1 and
5.6.2, the T03 control profile, the T04 exception lifecycle, and the T05
declaration/compiler contract. Commit `b7095bb` was offered to net-kingdom for
owner-driven publication in `canon/standards/`; publication remains the canon
owner's action rather than a write from this repo.
owner-driven publication; net-kingdom published it at canon revision `337484a`
on 2026-08-22.
```task
id: ZONE-WP-0001-T07
status: progress
status: done
priority: medium
state_hub_task_id: "c7ea24df-8aa9-4ead-ba3a-033aa5201c21"
```
@ -662,13 +662,15 @@ closing `WARDEN-WP-0031-T05`. Re-run
evidence (`decision:f3f7c88f9585582a`) will be stale, and re-establishing it is
cheap by design. The second consumer comes from T01.
**Started 2026-08-22.** The committed draft and initial control profile were
sent to both adopting control owners. ops-warden was asked to accept or amend
its read-boundary, plan, PEP failure-mode, declaration/compiler, and
`trust_zone` retirement contracts before implementing `WARDEN-WP-0032`.
flex-auth was asked to accept or amend the pre-sign stance rows before adding
them to a policy package. Adoption evidence, implementation, and the required
fresh caller-identity check remain open.
**Done 2026-08-22.** ops-warden `7ce58ae`/`6604ace` and flex-auth
`e521e7b`/`00a7bc4` declare evidenced `z1-operational` membership. The
zone-engine compiler reads both as `satisfied`, making zone-engine the third
repo in the adoption proof. ops-warden retired `policy.enabled`, global
`policy.fail_closed`, and the dormant `trust_zone` compiler source; flex-auth
package v2 owns a total stance mapping and ops-warden owns the total PEP failure
mapping. The live authenticated caller check returned HTTP 200 and
`decision:f3f7c88f9585582a`. Full evidence is
`docs/evidence/security-zone-adoption-2026-08-22.md`.
Repo-manager adoption/proof is linked as `RMGR-WP-0010-T07` to this task
(`ZONE-WP-0001-T07`, State Hub task