coulomb/zone-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Complete security zone model and canon draft

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
This commit is contained in:
tegwick 2026-08-22 14:03:46 +02:00
parent 14f789d080
commit b7095bbabd
5 changed files with 346 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

49
workplans/ZONE-WP-0001-security-zone-model.md
View file

@ -269,7 +269,7 @@ those lanes are graded.
```task
id: ZONE-WP-0001-T03
status: wait
status: done
priority: high
state_hub_task_id: "7f47b750-1ae4-467d-b3c4-064f4ec07dbd"
```
@ -283,18 +283,24 @@ Controls in scope at minimum: the flex-auth pre-sign gate (`policy.enabled`,
`fail_closed`), the agent read-boundary on `risk: high` lanes (ops-warden
`ADR-0004`), and the `warden plan` escalation verdicts.
**Waiting on owner rulings, 2026-08-22.** Re-running
**Owner rulings arrived and task completed, 2026-08-22.** Re-running
`ops-warden/scripts/report_workload_join.py` finds **nine** declared rapp
workloads, but still only **one of 27 lanes** joins to a workload; 13 name an
undeclared candidate and 13 have no workload-shaped path. The exact residue was
sent to `repo-manager` (declaration ownership/surface) and `net-kingdom`
(whether operational control-plane consumers must acquire workload identities,
and whether unknown is a required result). This is the consultation required by
the 2026-08-20 finding below; stance modelling will not reopen the policy subject
merely to make the corpus fit. In the interim, `RISK-N-0004`'s consumer
requirements are accepted: the resolved view is workload-addressable,
undeclared candidate and 13 have no workload-shaped path. Net-kingdom Decisions
5.6.1 and 5.6.2 settle the residue: operational/control-plane execution units
are workloads; non-rapp workloads declare authoritative identity directly in
`tenancy.yaml`; the stable workload id is the explicit join key; and absent
identity, membership, or floor resolves to `unknown` without inference. Canon's
schema now requires `workload_identity` beside every `zones:` block, which also
settles the declaration surface originally asked of `repo-manager`.
The stance, failure-mode, maturity-derived default, and initial control profile
are defined in `docs/security-zones_v0.1.md` §§4–5. `RISK-N-0004`'s consumer
requirements are carried into §7's resolved view: it is workload-addressable,
authoritative, machine-readable, exposes guarantees as well as membership, and
returns unknown without inference.
returns `unknown` without manufacturing a zone. The unresolved `public`
DataClassification floor is handled honestly as `unknown` pending
info-tech-canon's ruling; it no longer blocks the model.
**Operator direction 2026-08-19 — defaults derive from maturity, not from
nothing.** An ungraded lane must not inherit the safest-for-the-tool default; it
@ -553,7 +559,7 @@ cheaper outcome, but it is T04's call.
```task
id: ZONE-WP-0001-T05
status: todo
status: done
priority: medium
state_hub_task_id: "f4556ca0-cb26-46ed-9351-d00270bd2309"
```
@ -563,6 +569,19 @@ with evidence, `reviewed`, and `review_due`; carry over *accuracy, not
altitude*. Include how a zone assignment changes and how that change is
observed — a zone that can be quietly widened is not a boundary.
**Done 2026-08-22.** `docs/security-zones_v0.1.md` §§6–8 defines the `zones:`
shape, the workload-addressable resolved view, and membership-change evidence.
Membership is attached to an authoritative `workload_identity` in the same
service entry and compiled to the governed workload resource as `workload_id`,
`security_zone`, `security_zone_admission`, and
`security_zone_revision`. Caller identity remains subject context. A control
that governs the caller must name that workload role explicitly.
The dormant hardcoded `trust_zone: platform` is not reused; it must be retired
before `security_zone` is emitted. Membership changes require a reviewed source
change, a new content/source revision, and a compiler diff against the preceding
snapshot. Temporary relaxation is always an exception, never a membership edit.
**Carrier file settled by net-kingdom 2026-08-19 (see T01).** The declaration
rides `tenancy.yaml` under a reserved top-level `zones:` key, not a new root
file. The key is already permitted and deliberately unconstrained in
@ -604,7 +623,7 @@ Two things to decide anyway, and both belong in this task:
```task
id: ZONE-WP-0001-T06
status: todo
status: progress
priority: medium
state_hub_task_id: "8a000c18-6ee7-4328-99c7-53c490435316"
```
@ -613,6 +632,12 @@ state_hub_task_id: "8a000c18-6ee7-4328-99c7-53c490435316"
`net-kingdom/canon/standards/`, drafted here, published there. Owner-driven
landing, as ops-warden's WP-0015 maturity model was.
**Drafted 2026-08-22.** The owner draft is
`docs/security-zones_v0.1.md`. It incorporates net-kingdom Decisions 5.6.1 and
5.6.2, the T03 control profile, the T04 exception lifecycle, and the T05
declaration/compiler contract. It remains `progress` until the committed draft
has been offered to net-kingdom for owner-driven publication.
```task
id: ZONE-WP-0001-T07
status: todo