coulomb/zone-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
zone-engine/docs/evidence/security-zone-adoption-2026-08-22.md
tegwick 4b908e7189 docs: link canon adoption record 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
2026-08-22 15:44:06 +02:00

2.1 KiB
Raw Blame History

Security-zone adoption proof — 2026-08-22

security-zones_v0.1 is published and consumed without a zone-engine runtime.

  • Canon: net-kingdom 337484a publishes canon/standards/security-zones_v0.1.md; 104d5c6 records the completed adoption gates in that canonical copy.
  • Compiler: zone-engine 9b6ada7; 8 unit tests pass.
  • First workload declaration and PEP: ops-warden 7ce58ae (generated-input refresh 6604ace). WARDEN-WP-0032 is finished; policy.enabled, global policy.fail_closed, and the dormant trust_zone source are retired.
  • Stance owner and second workload declaration: flex-auth e521e7b (posture validator correction 00a7bc4). Policy package v2 is total across the five zone ids plus unknown, and preserves native policy for not-applicable.
  • Third-repo read: zone-engine resolved both tenancy.yaml declarations as satisfied / z1-operational. Membership revisions are sha256:f2156df646d292e9c6374ffa0f3eaa1a6382a91bc7f153b19e9395fd1c67c02d (ops-warden) and sha256:fc3fa7bba4b6bd4634424dac5fc41581e787dba4e53d7825381b4bf8c009c9dd (flex-auth). No identity or membership was inferred.
  • Verification: ops-warden full lint plus 382 tests passed (4 integration tests deselected); flex-auth go test ./... passed; its executable policy check passed 5 Rego tests and 9 fixtures; both declarations pass the canon-owned tenancy validator.
  • Live caller identity: command-mode token acquisition and the existing local tunnel produced HTTP 200, effect allow, decision decision:f3f7c88f9585582a. Only token length and a truncated fingerprint were emitted.

The operator's persistent warden.yaml still contains the two retired keys. The live proof used a temporary migrated copy; no operator configuration was overwritten. Until those lines are removed, the new loader rejects that file with an explicit migration error rather than silently selecting a second policy source.

The exception-lifecycle evidence in docs/exception-lifecycle-2026-08-22.md establishes that expiry is evaluated at each owning control and requires no synchronous zone-engine service.