# zone-engine

Engine-layer **PIP** for NetKingdom **security-zone** identity and membership,
retained as offline reference conformance. This repository validates workload
membership and admission, projects only explicit owner-versioned control
profiles, checks time-boxed exception fixtures, and verifies the lineage of
the canonical standard.

It is not a live engine, not a PEP, and not a policy decision point. Canon is
published by `net-kingdom`. `access-engine` (currently `flex-auth`) is the
only PDP; each enforcement-point owner retains live policy and failure-mode
authority. Layer declaration: `INTENT.md` frontmatter and `layer.yaml`.

## Checks

```bash
make check
make canon-lineage CANON_ROOT=/path/to/net-kingdom
```

Resolve the versioned reference manifest and optional owner profile:

```bash
python3 tools/resolve_zones.py \
  --manifest fixtures/manifests/reference.yaml \
  --control-profile profiles/netkingdom-build-v0.1.yaml
```

Evaluate exception conformance at an explicit instant:

```bash
python3 tools/check_zone_exceptions.py \
  fixtures/exceptions/valid-active.yaml \
  --policy fixtures/exceptions/policy.yaml \
  --at 2026-08-23T10:00:00Z
```

Orient: `GOAL.md` → `SCOPE.md` → `workplans/`.