Amended by net-kingdom as canon owner of tenancy-posture_v0.1.
T01: enforcement stance is a sibling canon standard, not a seventh axis (the six
ladders are monotone and stance is not; and a descriptive framework cannot carry
a prescriptive axis without handing out its own exemptions). Ownership confirmed;
the repo is not archived. Declaration surface is tenancy.yaml's reserved zones:
key, not a new root file.
T02: the reef question is struck — the unreconciled pair is reef vs P/V and it is
canon's defect (NK-WP-0027), not this model's scope. organization_posture: do not
fold in, consume as an input.
T05: carrier file settled; only the shape inside zones: remains open.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Reviewed as the only policy decision point. Four task amendments:
T01 - the 'only PDP' invariant guards latency, not authority. Compiled
data that determines an outcome still decides. Tightened wording:
zone-engine owns membership, flex-auth policy owns stance.
T03 - split membership from stance rather than rejecting option (c)
wholesale. Stance for the pre-sign gate belongs in the policy package
because registry content is absent from decision provenance. Also:
fail-open is a PEP property and no PDP can express it.
T05 - no registry schema change needed; metadata/attributes already
flatten into rego input. But trust_zone is a live name collision -
a hardcoded 'platform' constant no policy reads.
T04 - flex-auth loads registry and policy once at process start with
no reload path, so an inert compiled exception expires only by human
redeploy. Enforced expiry requires a not_after evaluated in rego.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Enforcement controls in this estate have been repo-wide booleans. ops-warden's
flex-auth pre-sign gate was the first to become flippable, and flipping it would
have made flex-auth a hard dependency of every warden sign — including the SSH
certs the ops-bridge tunnels depend on, one of which carries the policy call.
Uniform enforcement across an estate under deep refactor hardens exactly the
access needed to perform the refactor. Deferred under ops-warden ADR-0006; this
repo is what that ADR defers to.
Seeded deliberately without a schema. ZONE-WP-0001 produces a model and a canon
draft, not an API: an engine that ships a wire format before it has partitioned
the real estate defines the model by accident. Whether a runtime is warranted is
an output of the exception-lifecycle task, not an assumption.
Invariants set now, because they are the ones easy to lose later: flex-auth
stays the only PDP and receives membership by compilation, not a synchronous
lookup in a latency-critical decision path; placement (reefs) is not posture;
accuracy not altitude, per tenancy-posture v0.1 §6.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
