feat: harden zone reference contracts

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1

fixtures/exceptions/invalid-overlap.yaml

@@ -0,0 +1,30 @@
+standard: security-zone-exceptions_v0.1
+exceptions:
+  - exception_id: zone-exc-fixture-001
+    security_zone: z2-protected
+    control: flex-auth/pre-sign
+    workloads: [issue-core]
+    base: {stance: enforced, failure_mode: fail_closed}
+    relaxation: {stance: advisory}
+    justification: first overlapping fixture
+    requested_by: issue-core
+    granted_by: ops-warden/security-owner
+    issued_at: "2026-08-23T09:00:00Z"
+    not_before: "2026-08-23T10:00:00Z"
+    not_after: "2026-08-23T12:00:00Z"
+    maximum_duration_policy: ops-warden/security-zone-exceptions@1
+    change_ref: ops-warden@fixture-1
+  - exception_id: zone-exc-fixture-002
+    security_zone: z2-protected
+    control: flex-auth/pre-sign
+    workloads: [issue-core]
+    base: {stance: enforced, failure_mode: fail_closed}
+    relaxation: {stance: advisory}
+    justification: second overlapping fixture
+    requested_by: issue-core
+    granted_by: ops-warden/security-owner
+    issued_at: "2026-08-23T09:30:00Z"
+    not_before: "2026-08-23T11:00:00Z"
+    not_after: "2026-08-23T12:30:00Z"
+    maximum_duration_policy: ops-warden/security-zone-exceptions@1
+    change_ref: ops-warden@fixture-2

fixtures/exceptions/policy.yaml

@@ -0,0 +1,8 @@
+standard: security-zone-exception-policy_v0.1
+policy_id: ops-warden/security-zone-exceptions
+version: "1"
+controls:
+  flex-auth/pre-sign:
+    grant_authorities:
+      - ops-warden/security-owner
+    maximum_duration_seconds: 7200

fixtures/exceptions/valid-active.yaml

@@ -0,0 +1,19 @@
+standard: security-zone-exceptions_v0.1
+exceptions:
+  - exception_id: zone-exc-fixture-001
+    security_zone: z2-protected
+    control: flex-auth/pre-sign
+    workloads: [issue-core]
+    base: {stance: enforced, failure_mode: fail_closed}
+    relaxation: {stance: advisory}
+    justification: bounded migration fixture
+    requested_by: issue-core
+    granted_by: ops-warden/security-owner
+    issued_at: "2026-08-23T09:00:00Z"
+    not_before: "2026-08-23T10:00:00Z"
+    not_after: "2026-08-23T12:00:00Z"
+    maximum_duration_policy: ops-warden/security-zone-exceptions@1
+    change_ref: ops-warden@fixture
+    durable_authorities:
+      - id: ssh-cert:fixture
+        not_after: "2026-08-23T11:00:00Z"

fixtures/manifests/adoption.yaml

@@ -0,0 +1,12 @@
+standard: zone-resolver-input_v0.1
+sources:
+  - path: ../../../flex-auth/tenancy.yaml
+    source_revision: flex-auth@00a7bc46090ceb71dc23fef0530629f18398d3b1
+  - path: ../../../ops-warden/tenancy.yaml
+    source_revision: ops-warden@c8fa02adf0ab9ef699508141f099bc71c38e76f3
+subjects:
+  - subject_id: human-operator
+    source: ops-warden/catalog@c8fa02adf0ab9ef699508141f099bc71c38e76f3
+    source_revision: ops-warden@c8fa02adf0ab9ef699508141f099bc71c38e76f3
+    workload_ref:
+      applicability: not-applicable

fixtures/manifests/reference.yaml

@@ -0,0 +1,16 @@
+standard: zone-resolver-input_v0.1
+sources:
+  - path: tenancy.yaml
+    source_revision: fixture-owner@abc123
+    workload_refs:
+      fixture-workload:
+        applicability: applicable
+        rapp_id: rapp-fixture
+        name: fixture-workload
+        deployable: fixture-workload
+subjects:
+  - subject_id: human-operator
+    source: fixture-catalog@abc123
+    source_revision: fixture-catalog@abc123
+    workload_ref:
+      applicability: not-applicable

fixtures/manifests/tenancy.yaml

@@ -0,0 +1,28 @@
+schema_version: "0.1"
+framework: netkingdom-tenancy-posture
+service: fixture-workload
+role: fixture
+workload_identity:
+  name: fixture-workload
+  kind: managed-deployable
+  responsible_repo: fixture-owner
+  identity_bindings:
+    - scheme: kubernetes-service-account
+      authority: railiance01
+      subject: system:serviceaccount:fixture:fixture-workload
+      principal_type: service
+tenancy: {}
+zones:
+  standard: security-zones_v0.1
+  membership: z2-protected
+  responsible_party: fixture-owner
+  justification: canonical resolver fixture
+  context:
+    maturity: M2
+    criticality: high
+    data_classification: internal
+  evidence:
+    - ref: fixture
+      supports: [M2]
+  reviewed: "2026-08-23"
+  review_due: "2026-11-23"