tegwick
d6e74a55f6
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
38 lines
2.1 KiB
Markdown
38 lines
2.1 KiB
Markdown
# Security-zone adoption proof — 2026-08-22
|
|
|
|
`security-zones_v0.1` is published and consumed without a zone-engine runtime.
|
|
|
|
- Canon: net-kingdom `337484a` publishes
|
|
`canon/standards/security-zones_v0.1.md`; `104d5c6` records the completed
|
|
adoption gates in that canonical copy.
|
|
- Compiler: zone-engine `9b6ada7`; 8 unit tests pass.
|
|
- First workload declaration and PEP: ops-warden `7ce58ae` (generated-input
|
|
refresh `6604ace`). `WARDEN-WP-0032` is finished; `policy.enabled`, global
|
|
`policy.fail_closed`, and the dormant `trust_zone` source are retired.
|
|
- Stance owner and second workload declaration: flex-auth `e521e7b` (posture
|
|
validator correction `00a7bc4`). Policy package v2 is total across the five
|
|
zone ids plus `unknown`, and preserves native policy for `not-applicable`.
|
|
- Third-repo read: zone-engine resolved both `tenancy.yaml` declarations as
|
|
`satisfied` / `z1-operational`. Membership revisions are
|
|
`sha256:f2156df646d292e9c6374ffa0f3eaa1a6382a91bc7f153b19e9395fd1c67c02d`
|
|
(`ops-warden`) and
|
|
`sha256:fc3fa7bba4b6bd4634424dac5fc41581e787dba4e53d7825381b4bf8c009c9dd`
|
|
(`flex-auth`). No identity or membership was inferred.
|
|
- Verification: ops-warden full lint plus 382 tests passed (4 integration tests
|
|
deselected); flex-auth `go test ./...` passed; its executable policy check
|
|
passed 5 Rego tests and 9 fixtures; both declarations pass the canon-owned
|
|
tenancy validator.
|
|
- Live caller identity: command-mode token acquisition and the existing local
|
|
tunnel produced HTTP 200, effect `allow`, decision
|
|
`decision:f3f7c88f9585582a`. Only token length and a truncated fingerprint
|
|
were emitted.
|
|
|
|
The operator's `warden.yaml` was migrated from the two retired keys to the
|
|
compiled `zone_registry_path`. The live proof was then repeated successfully
|
|
against that real configuration. The new loader continues to reject either
|
|
retired key with an explicit migration error rather than silently selecting a
|
|
second policy source.
|
|
|
|
The exception-lifecycle evidence in
|
|
`docs/exception-lifecycle-2026-08-22.md` establishes that expiry is evaluated
|
|
at each owning control and requires no synchronous zone-engine service.
|