coulomb/zone-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Correct the rapp count: eight declarations, not nine

Browse source 
An inflated count in a document whose subject is accuracy.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-08-20 07:21:02 +02:00
parent 26e3490c9b
commit de2d8e2dda
2 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/estate-partition-2026-08-19.md
View file

@ -216,7 +216,7 @@ The missing join found in §4 is therefore not a tidy-up. **It is the model.**
> **Corrected 2026-08-20.** "No registry carries a join key" was too strong — it > **Corrected 2026-08-20.** "No registry carries a join key" was too strong — it
> was concluded from ops-warden's catalog alone, the one place a *workload* > was concluded from ops-warden's catalog alone, the one place a *workload*
> declaration would not live. `rapp-*/declarations/rapp.yaml` declares > declaration would not live. `rapp-*/declarations/rapp.yaml` declares
> `workload_identity` with `data_classification` and `criticality` for nine > `workload_identity` with `data_classification` and `criticality` for eight
> workloads, and ops-warden's `dataclass_floor` already maps classification to > workloads, and ops-warden's `dataclass_floor` already maps classification to
> `M0`–`M3`. The chain exists and spans two repos. What is genuinely missing is > `M0`–`M3`. The chain exists and spans two repos. What is genuinely missing is
> an explicit `workload:` field on catalog entries — the key is currently only > an explicit `workload:` field on catalog entries — the key is currently only

4
workplans/ZONE-WP-0001-security-zone-model.md
View file

@ -337,7 +337,7 @@ it.** T02 concluded no registry carries a join key. That was too strong; it was
derived from ops-warden's catalog alone, which is the one place a workload derived from ops-warden's catalog alone, which is the one place a workload
declaration would *not* live. declaration would *not* live.
`rapp-*/declarations/rapp.yaml` is the workload declaration surface. **Nine** `rapp-*/declarations/rapp.yaml` is the workload declaration surface. **Eight**
rapps declare `workload_identity` (`name`, `principal`, `service_account`, rapps declare `workload_identity` (`name`, `principal`, `service_account`,
`tenant`) together with `data_classification`, `criticality` `tenant`) together with `data_classification`, `criticality`
(`low`/`medium`/`high`/`critical`), `readiness_state`, and `bound_reefs`. (`low`/`medium`/`high`/`critical`), `readiness_state`, and `bound_reefs`.
@ -366,7 +366,7 @@ blocking unknown:
2. **Vocabulary mismatch.** rapps declare `public`, which `dataclass_floor` does 2. **Vocabulary mismatch.** rapps declare `public`, which `dataclass_floor` does
not map. `rapp-policy-nexus` is `public` today, so the floor cannot grade it. not map. `rapp-policy-nexus` is `public` today, so the floor cannot grade it.
One of the two vocabularies must move; canon owns `DataClassification`. One of the two vocabularies must move; canon owns `DataClassification`.
3. **Coverage is partial.** Nine workloads are declared; ops-warden's catalog 3. **Coverage is partial.** Eight workloads are declared; ops-warden's catalog
yields ~17 distinct path identities. The unmatched remainder is the yields ~17 distinct path identities. The unmatched remainder is the
interesting set — it is where a lane exists for something that is not a interesting set — it is where a lane exists for something that is not a
declared workload at all. declared workload at all.