# Estate partition — ZONE-WP-0001-T02

**Date:** 2026-08-19 · **Corpus:** ops-warden `registry/routing/catalog.yaml`
(27 entries), `inventory.yaml` (4 actors), `registry/policy/security-posture.yaml`
(3 env postures, 4 maturity levels).

The test set by T02: *the model must partition what exists without a residue of
unexplained exceptions, and the exceptions found are the most informative
output.* This is the raw result, before any model is fitted to it.

---

## 1. What the data actually says

Cross-tabulating the three declared fields that could plausibly drive
membership — `delegation.mode`, `risk`, `exec_capable` — fills **9 of 27
possible cells**. The estate clusters hard.

| delegation | risk | exec_capable | n | character |
| --- | --- | --- | --- | --- |
| `permanent` | ungraded | — | 1 | The one lane ops-warden decides (`ssh-cert-host-access`) |
| `native` | ungraded | — | 7 | Pure pointers: route to an owner, nothing executes |
| `native` | ungraded | `false`/`true` | 2 | Owner-fronted exec (`whynot-design-npm-publish`, `audit-core-senders`) |
| `native` | high | `false` | 1 | `database-dynamic-credentials` — owner-fronted, dangerous |
| `interim` | ungraded | `true` | 4 | **ops-warden proxying, ungraded** |
| `interim` | standard | `false` | 2 | Interim, graded, not proxyable |
| `interim` | high | `false` | 2 | Interim, dangerous, routed only |
| `interim` | high | `true` | 8 | **ops-warden proxying a high-risk credential for an absent owner** |

The three fields are **not independent**, and that is the finding. Danger
concentrates in `interim`: 10 of the 11 high-risk lanes are interim, and 8 of
those are `exec_capable`. `permanent` and `native` are almost entirely benign.

**Delegation mode is doing most of the discriminating work.** It was introduced
by WP-0030 to answer a governance question — *should ops-warden own this?* — and
it turns out to predict operational danger better than the field named `risk`.

## 2. The bands that exist

Four, derived rather than invented. Every one of the 27 lanes lands in exactly
one.

| Band | n | Defining property | What it means for a control |
| --- | --- | --- | --- |
| **Decided** | 1 | `warden_executes: true` — ops-warden is the decision point | The only place a pre-sign gate can bite at all |
| **Fronted** | 10 | `delegation.mode` is `native` — the owner has a front door | Stance is the *owner's*; ops-warden holds nothing |
| **Covered** | 12 | `interim` and `exec_capable: true` — ops-warden proxies a value it does not own | The band that actually needs rigidity, and the band a refactor most needs relaxed |
| **Signposted** | 4 | `interim`, not `exec_capable` — routed, nothing flows | Advisory at most; there is no value to leak |

The interesting boundary is **Covered vs Fronted**, and it is not a risk
judgement — it is a statement about *whether the owning component exists yet*.
That is why it moves over time and why bands must be re-derived, not assigned
once.

## 3. The existing controls already imply bands — and they disagree

Before any zone model, ops-warden's three controls each cut the estate
differently:

| Control | Lanes touched | Selector |
| --- | --- | --- |
| flex-auth pre-sign gate | **1** | `warden_executes` |
| fetch policy gate | **13** | `exec_capable` |
| agent read-boundary (`ADR-0004`) | **11** | `risk == "high"` |
| `warden plan` escalation | 27 | all |

Only **8 lanes** are in both the fetch gate and the read-boundary. The controls
were built independently and their scopes were never reconciled. A zone model
that assigns one zone per lane and expects all controls to agree with it will
misfit immediately — which answers a question T03 was going to have to ask:
**stance is per control per zone, never per zone alone.**

## 4. The residue — and it is the most valuable output

**14 of 27 lanes carry no `risk` value at all.**

This is not a modelling inconvenience. `is_high_risk` is `risk == "high"`
(`routing/models.py:123`), so an ungraded lane never triggers the agent
read-boundary. Five of the fourteen are `exec_capable: true`, meaning
`warden access --fetch` can stream a real value for them to an agent session:
`openbao-api-key`, `whynot-design-npm-publish`, `key-cape-oidc-login`,
`issue-core-ingestion-api-key`, `reuse-surface-hub-write-token`.

`ADR-0004` reads as a categorical rule. The implementation is an opt-in list,
and absence fails open.

**Routed to `risk-nexus` as `RISK-F-0003`.** It is a defect in a shipped
control, not a known gap being worked — the distinction ops-warden's own
finding-routing rule draws. Severity is risk-nexus's to set.

For this task it also means: **a zone model cannot be derived from `risk` as it
stands.** Half the corpus is unlabelled on that field, and grading it is real
judgement, not backfill.

Two further gaps, less severe but structural:

- `warden_role` and `has_rotation` are **derived at load, not declared** — they
  are absent from every raw entry despite appearing in `warden route --json`. A
  membership compiler must read the model, not the file.
- The posture registry (`env_postures`, `M0`–`M3`) and the catalog share **no
  join key**. No lane references a workload or an environment. They are
  currently disjoint vocabularies.

## 5. Answers to T02's questions

### Is a zone a property of the actor, the lane, the workload, or the moment?

**The lane**, on the evidence. Every field that discriminates —
`delegation.mode`, `exec_capable`, `risk` — is a lane property. The actor
inventory holds 4 actors mapping to a single lane and cannot carry a partition.
No lane references a workload.

With two qualifications the data forces:

- **The caller is a modifier, not the zone.** The read-boundary keys on
  `WARDEN_AGENT_ID` — a property of *who is asking*, orthogonal to the lane. A
  zone says what the lane requires; the caller decides which requirement
  applies. Collapsing them would make one lane need two zones.
- **The moment is a different object, confirmed.** Nothing in the corpus
  represents it. `delegation.blocked_on` carries a free-text claim with a
  `reviewed` date and no expiry — precisely the "expiry by intention" shape
  `ZONE-WP-0001-T04` must not reproduce. A time-boxed relaxation is an
  **exception against a zone**, never a zone.

### Do zones compose with, or fold in, environment posture and `M0`–`M3`?

**Compose — and the composition cannot be built yet.** They are per-workload;
zones as derived here are per-lane; and there is **no join key between them in
any registry today**. Folding them in would require inventing a lane→workload
mapping that does not exist, which is fabrication under §6.

The honest sequence: zones stand alone on lane properties now, and a join is
proposed only when something actually declares it. (`organization_posture` was
already ruled out of the declaration entirely by net-kingdom — it is an input.)

### Reefs

Struck by net-kingdom. Per `tenancy-posture` Decision 8.4.1, substrate location
is never by itself evidence for a level. The unreconciled pair is reef ↔ `P`/`V`
and it is canon's, tracked as `NK-WP-0027`.

## 6. What this hands to T03 and T04

- Four bands, each lane in exactly one, derived from declared fields.
- **Stance must be per control per zone** — the existing controls demonstrably
  disagree about scope.
- **`Covered` is the band the model exists for**: 12 lanes where ops-warden
  proxies what it does not own, holding the highest concentration of high-risk
  `exec_capable` lanes, and the band a deep refactor most needs relaxed.
- **`risk` is not usable as a membership input until the 14 ungraded lanes are
  graded** (`RISK-F-0003`). `delegation.mode` is usable today and is a better
  predictor.
- Membership must be computed from the loaded model, not read from raw YAML.