tegwick
38c450f4ab
Enforcement controls in this estate have been repo-wide booleans. ops-warden's flex-auth pre-sign gate was the first to become flippable, and flipping it would have made flex-auth a hard dependency of every warden sign — including the SSH certs the ops-bridge tunnels depend on, one of which carries the policy call. Uniform enforcement across an estate under deep refactor hardens exactly the access needed to perform the refactor. Deferred under ops-warden ADR-0006; this repo is what that ADR defers to. Seeded deliberately without a schema. ZONE-WP-0001 produces a model and a canon draft, not an API: an engine that ships a wire format before it has partitioned the real estate defines the model by accident. Whether a runtime is warranted is an output of the exception-lifecycle task, not an assumption. Invariants set now, because they are the ones easy to lose later: flex-auth stays the only PDP and receives membership by compilation, not a synchronous lookup in a latency-critical decision path; placement (reefs) is not posture; accuracy not altitude, per tenancy-posture v0.1 §6. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
49 lines
2 KiB
Markdown
49 lines
2 KiB
Markdown
---
|
|
repo: zone-engine
|
|
repo_flavor: project
|
|
project_status: draft
|
|
started: "2026-08-19"
|
|
---
|
|
|
|
# Goal — zone-engine
|
|
|
|
## Outcome
|
|
|
|
Enforcement rigidity is a declared, reviewable property of a named zone rather
|
|
than a boolean per repo. A control can be turned on for the band of the estate
|
|
that wants its failure mode, and left advisory where that failure mode would
|
|
stop the work. Deep refactors get relaxed rigidity through an exception that
|
|
expires on its own.
|
|
|
|
## Invariants
|
|
|
|
- **`flex-auth` remains the only policy decision point.** Zone membership
|
|
reaches it by compilation into the registry it already consumes. Nothing this
|
|
repo builds sits synchronously in a decision path.
|
|
- **A zone that can be quietly widened is not a boundary.** Every change of
|
|
stance is observable, and every exception has an enforced expiry.
|
|
- **Accuracy, not altitude** (`tenancy-posture_v0.1` §6). A repo declaring a
|
|
stricter zone than it can evidence is the failure to design against, because
|
|
it looks like progress.
|
|
- **Placement is not posture.** Reefs are a separate axis and stay separate.
|
|
- **The model precedes the schema.** No API, no storage, no wire format until
|
|
`ZONE-WP-0001` has partitioned the real estate.
|
|
|
|
## Success gates
|
|
|
|
1. The model partitions today's estate — the 27 ops-warden catalog lanes, the
|
|
actor inventory, the posture-carrying workloads — without a residue of
|
|
unexplained exceptions.
|
|
2. A canon standard is drafted and offered to `net-kingdom`, in the family of
|
|
`tenancy-posture_v0.1`.
|
|
3. At least two repos declare zones and are read by a third — a model only its
|
|
author honours is not adopted.
|
|
4. `ops-warden`'s `policy.enabled` is retired in favour of a zone-aware control,
|
|
closing `WARDEN-WP-0031-T05`.
|
|
5. Whether a runtime is needed is answered on evidence from the exception
|
|
lifecycle, not assumed.
|
|
|
|
## Project retirement
|
|
|
|
Archive when the standard is canon, the declarations are live, and either a
|
|
runtime exists with an owner or the decision that none is needed is recorded.
|