Complete security zone model and canon draft

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1

INTENT.md

@@ -63,8 +63,12 @@ remembering to collect a signature."* Decision 5.6 then ruled that stance
 A classification that changes nothing is a label. A zone earns its keep only if
 it decides something, so the model must carry:
 
-- **Membership** — what puts a lane, actor or workload in a zone, derived from
-  posture already declared rather than a fourth hand-maintained list.
+- **Identity and membership** — an authoritative workload binding and its
+  responsible party's declared zone. Lanes, actors, paths and repositories are
+  inputs or caller context, never substitute policy subjects.
+- **Admission** — a mechanical reconciliation of that declaration against the
+  zone floor and the workload posture. Missing identity, membership or evidence
+  remains `unknown`; it is never inferred into a permissive zone.
 - **Stance per control** — enforced, advisory, or exempt.
 - **Failure mode** — what happens when the control cannot run. This is where
   the bite is; `fail_closed` is what turns a dead tunnel into an outage.