# Security-zone adoption proof — 2026-08-22

`security-zones_v0.1` is published and consumed without a zone-engine runtime.

- Canon: net-kingdom `337484a` publishes
  `canon/standards/security-zones_v0.1.md`; `104d5c6` records the completed
  adoption gates in that canonical copy.
- Compiler: zone-engine `9b6ada7`; 8 unit tests pass.
- First workload declaration and PEP: ops-warden `7ce58ae` (generated-input
  refresh `6604ace`). `WARDEN-WP-0032` is finished; `policy.enabled`, global
  `policy.fail_closed`, and the dormant `trust_zone` source are retired.
- Stance owner and second workload declaration: flex-auth `e521e7b` (posture
  validator correction `00a7bc4`). Policy package v2 is total across the five
  zone ids plus `unknown`, and preserves native policy for `not-applicable`.
- Third-repo read: zone-engine resolved both `tenancy.yaml` declarations as
  `satisfied` / `z1-operational`. Membership revisions are
  `sha256:f2156df646d292e9c6374ffa0f3eaa1a6382a91bc7f153b19e9395fd1c67c02d`
  (`ops-warden`) and
  `sha256:fc3fa7bba4b6bd4634424dac5fc41581e787dba4e53d7825381b4bf8c009c9dd`
  (`flex-auth`). No identity or membership was inferred.
- Verification: ops-warden full lint plus 382 tests passed (4 integration tests
  deselected); flex-auth `go test ./...` passed; its executable policy check
  passed 5 Rego tests and 9 fixtures; both declarations pass the canon-owned
  tenancy validator.
- Live caller identity: command-mode token acquisition and the existing local
  tunnel produced HTTP 200, effect `allow`, decision
  `decision:f3f7c88f9585582a`. Only token length and a truncated fingerprint
  were emitted.

The operator's `warden.yaml` was migrated from the two retired keys to the
compiled `zone_registry_path`. The live proof was then repeated successfully
against that real configuration. The new loader continues to reject either
retired key with an explicit migration error rather than silently selecting a
second policy source.

The exception-lifecycle evidence in
`docs/exception-lifecycle-2026-08-22.md` establishes that expiry is evaluated
at each owning control and requires no synchronous zone-engine service.