feat: harden zone reference contracts

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1

history/2026-08-23-canon-lineage-and-lifecycle.md

@@ -0,0 +1,28 @@
+# Canon lineage and lifecycle ruling — 2026-08-23
+
+## Evidence reviewed
+
+- net-kingdom `337484a` added the canonical security-zone standard with
+  `status: proposed`.
+- net-kingdom `104d5c6` recorded completion of all four adoption gates while
+  deliberately retaining `status: proposed`.
+- The sibling `tenancy-posture_v0.1` standard is also published as
+  `status: proposed`; publication is therefore not evidence of acceptance.
+- The canonical security-zone content at `104d5c6` has SHA-256
+  `32e71e9c0d6946bb14099eb66193822da26f199de0e11d8488464207f3bd9906`.
+
+## Ruling applied
+
+The canon owner's checked-in lifecycle is authoritative: v0.1 remains
+`proposed` until net-kingdom explicitly changes it. zone-engine does not promote
+the standard by inference and does not maintain a second normative copy.
+
+The former local draft at `docs/security-zones_v0.1.md` is replaced by a
+non-authoritative pointer. `docs/canon-lineage.yaml` pins canonical owner, path,
+revision, lifecycle, and content hash. `tools/check_canon_lineage.py` verifies
+both the reviewed revision and the current checkout, so either content drift or
+a lifecycle change requires a reviewed lineage update.
+
+This closes the duplicate-authority shape without changing canon. Any future
+status promotion is a net-kingdom source change and a trigger to refresh the
+lineage record here if this repository is retained.