tegwick
38a186d308
GOAL.md still carried the first-draft invariant — "nothing this repo builds sits synchronously in a decision path" — after flex-auth's review had rejected it as a latency guarantee wearing an authority guarantee's clothes. Under that wording zone-engine could compile enforced: false for a lane, flip warden sign from deny to allow with no flex-auth policy change, and be literally compliant. Replaced: identity and membership here, effect in a flex-auth policy package. Compiled-not- queried is demoted to a consequence of that, which is what it always was. SCOPE now records what the two reviews settled rather than what was proposed: separate standard (canon Decision 5.6), membership declared in tenancy.yaml's reserved zones: key, stance out of scope for controls flex-auth decides, the fail-open axis modelled PEP-side because a PDP structurally cannot express it, organization_posture an input rather than a declaration field, and reefs not ours. Plus the two inherited constraints: the dead trust_zone field already sitting where membership would go, and flex-auth's lack of a reload path. INTENT.md states the argument, including what would falsify the repo — the exception lifecycle not needing a runtime is called out as a legitimate outcome that should archive this repo rather than keep it for its own sake. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
127 lines
6.1 KiB
Markdown
127 lines
6.1 KiB
Markdown
# INTENT
|
||
|
||
> Why `zone-engine` exists and where it is going.
|
||
> What is true today is `SCOPE.md`. Checkable gates and the retirement
|
||
> condition are `GOAL.md`. This file is the argument, not the checklist.
|
||
|
||
---
|
||
|
||
## 1. The sentence this repo exists to make sayable
|
||
|
||
> *"This control is enforced **there**, advisory **here**, and relaxed **in this
|
||
> band until Friday** — and all three of those are written down, reviewable, and
|
||
> expire on their own."*
|
||
|
||
NetKingdom cannot say that today. It can say how exposed a workload is
|
||
(environment posture), how ready it is (`M0`–`M3`), and what state the
|
||
organization is in (`organization_posture`). Every one of those **describes**.
|
||
None of them **decides**. So every enforcement control in the estate has been a
|
||
boolean over a whole repo.
|
||
|
||
## 2. Where that bit
|
||
|
||
ops-warden built a pre-sign authorization gate, flex-auth enforced its side, and
|
||
the gate verified clean. Then it was deliberately not switched on.
|
||
|
||
`policy.enabled` is one boolean over the entire repo. With `fail_closed: true`
|
||
it makes flex-auth a hard dependency of *every* `warden sign` — including the
|
||
SSH certificates the ops-bridge tunnels depend on, one of which carries the
|
||
policy call itself. Turning it on would have been correct for a settled
|
||
production lane and wrong for an estate in the middle of decommissioning one
|
||
host and moving a service off it.
|
||
|
||
That is not a story about a flag. **Security that stops the work stops being
|
||
security and becomes an outage with good intentions** — and the reason it would
|
||
have was structural: there was nowhere to say *where* it applies. The decision
|
||
is ops-warden's `ADR-0006`; this repo is what it defers to.
|
||
|
||
## 3. What a zone has to be, to be worth having
|
||
|
||
A classification that changes nothing is a label. A zone earns its keep only if
|
||
it decides something, so the model must carry:
|
||
|
||
- **Membership** — what puts a lane, actor or workload in a zone, derived from
|
||
posture already declared rather than a fourth hand-maintained list.
|
||
- **Stance per control** — enforced, advisory, or exempt.
|
||
- **Failure mode** — what happens when the control cannot run. This is where
|
||
the bite is; `fail_closed` is what turns a dead tunnel into an outage.
|
||
- **Exceptions that expire without anyone remembering them.**
|
||
|
||
The last is the reason this is a repo rather than a document. A standing
|
||
classification needs no engine — canon plus a declaration file covers it, which
|
||
is exactly how tenancy posture works. **A relaxation with an expiry is state**,
|
||
and state wants an owner, an audit trail, and something other than good
|
||
intentions enforcing the deadline.
|
||
|
||
## 4. The line this repo must not cross
|
||
|
||
`flex-auth` is the policy decision point. It stays the only one.
|
||
|
||
zone-engine is authority over zone **identity and membership**. The **effect**
|
||
of a zone on a decision flex-auth renders belongs in a flex-auth policy package,
|
||
because flex-auth's decision envelope stamps `matched_policy_version` and
|
||
`policy_package` — and registry content appears nowhere in that provenance. Put
|
||
stance in the registry and two decisions with the same policy version and the
|
||
same request can differ, with nothing in the audit trail explaining why.
|
||
|
||
That boundary was drawn by flex-auth on review, against a first draft of ours
|
||
that got it wrong in an instructive way: the original invariant forbade sitting
|
||
*synchronously* in a decision path, which is a latency guarantee wearing an
|
||
authority guarantee's clothes. Compiled data that determines an outcome is still
|
||
deciding; it just decided earlier.
|
||
|
||
**Held to, in one line: membership is ours, stance is theirs, and the decision
|
||
point is neither.**
|
||
|
||
## 5. What success looks like from outside
|
||
|
||
Someone who has never read this repo should be able to:
|
||
|
||
- open a service's `tenancy.yaml`, read its `zones:` key, and know which
|
||
controls bite it;
|
||
- ask "why was this relaxed?" and get a justification, an author and an expiry,
|
||
not a shrug;
|
||
- watch a relaxation lapse **without a human remembering it**;
|
||
- and find the rule published in NetKingdom canon rather than in this repo's
|
||
prose.
|
||
|
||
If a reader has to come here to understand their own posture, the model has
|
||
failed at being a standard and has succeeded only at being a service.
|
||
|
||
## 6. What would make this repo wrong
|
||
|
||
Stated up front, because a repo created on a recommendation should say what
|
||
would falsify it:
|
||
|
||
- **The exception lifecycle turns out not to need a runtime.** If reviewed
|
||
declarations in git, with expiry evaluated at decision time, are sufficient,
|
||
then the honest outcome is a canon standard and no engine — and this repo
|
||
should be archived rather than kept for the sake of existing. `GOAL.md` gate 5
|
||
and `ZONE-WP-0001-T04` both hold that door open deliberately.
|
||
- **The zones do not partition the real estate.** If the model needs a residue
|
||
of special cases to cover today's 27 routing lanes and actor inventory, it is
|
||
describing an aspiration, not a structure.
|
||
- **Nobody but the author declares one.** Two repos declaring and a third
|
||
reading is the minimum evidence of a model rather than a preference.
|
||
- **It becomes a second decision point.** The failure would not announce itself;
|
||
it would arrive as a small convenience — a stance compiled into membership
|
||
"just for now".
|
||
|
||
## 7. What this repo deliberately will not become
|
||
|
||
Not a PDP. Not network segmentation — "zone" is overloaded and the routing sense
|
||
is someone else's word. Not a placement model: reefs answer *where a thing runs*
|
||
and are `repo-manager`'s, and the fact that `reef-railiance` caps availability
|
||
for everything bound to it is a canon composition problem (`NK-WP-0027`), not
|
||
ours. Not an owner of anyone's controls — the controls stay with the repos that
|
||
enforce them; this model only says where they bite.
|
||
|
||
## 8. Direction
|
||
|
||
Model first, from the real estate. Canon standard drafted here and published by
|
||
`net-kingdom`, in the family of `tenancy-posture_v0.1`. Membership declared in
|
||
the `zones:` key that canon has already reserved. Two consumers before it is
|
||
called adopted, the first being ops-warden retiring `policy.enabled`.
|
||
|
||
A runtime only if `ZONE-WP-0001-T04` proves the exception lifecycle needs one —
|
||
and the cheaper answer is a legitimate result, not a disappointment.
|