feat: add deployment zone overlays

workplans/RAIL-FAB-WP-0020-deployment-zone-discovery-visualization.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Deployment Zone Discovery And Visualization"
 domain: railiance
 repo: railiance-fabric
-status: ready
+status: finished
 owner: codex
 topic_slug: railiance
 created: "2026-05-24"
@@ -49,7 +49,7 @@ Railiance currently treats:
 
 ```task
 id: RAIL-FAB-WP-0020-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "b8cf7d91-7743-4e58-9b13-ce99f2d9eef1"
 ```
@@ -70,11 +70,15 @@ Fields should cover:
 Done when identity projection, financial export, and graph-explorer payloads
 have a clear place to carry these fields without changing fabric membership.
 
+Result: added a normalized `deployment_overlay` object and threaded it through
+identity candidates, financial exports, State Hub export schema validation, and
+graph-explorer payload fields/modes.
+
 ## T02 - Discover Local Dev Routing Evidence
 
 ```task
 id: RAIL-FAB-WP-0020-T02
-status: todo
+status: done
 priority: high
 state_hub_task_id: "b072e11b-08b5-426f-9f98-001abf8afd70"
 ```
@@ -95,11 +99,16 @@ Done when local-only surfaces are marked as `deployment_environment: dev`,
 `deployment_scenario: bernd-laptop`, and `access_zone: private-dev` with
 provenance.
 
+Result: known local surfaces are declared or discovered with `dev`,
+`bernd-laptop`, `private-dev`, local-loopback policy authority, and route
+evidence: Fabric registry/explorer `8765`, NetKingdom control surface `8876`,
+State Hub API `8000`, State Hub MCP `8001`, and State Hub dashboard `3000`.
+
 ## T03 - Discover Test And Production Routing Authorities
 
 ```task
 id: RAIL-FAB-WP-0020-T03
-status: todo
+status: done
 priority: high
 state_hub_task_id: "91fc3f28-fbb9-43d2-bb46-44d179f4b485"
 ```
@@ -118,11 +127,16 @@ Done when test-stage routes can be attributed to `coulombcore` and production
 routes can be attributed to `railiance01`, with access zones flagged as
 candidate values for operator review.
 
+Result: published `fabric/discovery/snapshots/2026-05-24-deployment-zone-inventory.yaml`
+with `coulombcore` test tunnel evidence, `railiance01` Traefik ingress evidence,
+candidate access zones, and explicit ambiguity flags for host/IP conflicts and
+operator review.
+
 ## T04 - Add Zone Overlay Graph Explorer Modes
 
 ```task
 id: RAIL-FAB-WP-0020-T04
-status: todo
+status: done
 priority: high
 state_hub_task_id: "664c2688-f45b-47bf-90ff-b17096a326fb"
 ```
@@ -146,11 +160,15 @@ The UI should make it easy to answer:
 Done when the graph explorer can group/filter by overlay fields and surface the
 basic warnings without making policy decisions.
 
+Result: graph-explorer manifests and payloads expose deployment overlay fields;
+the UI includes zone modes, overlay search/rule filtering, visible zone summaries,
+and route-without-policy-authority warnings.
+
 ## T05 - Preserve State Hub Read-Model Compatibility
 
 ```task
 id: RAIL-FAB-WP-0020-T05
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "1a5ef6f9-357f-4803-a1f8-ebd1ff5443fb"
 ```
@@ -161,11 +179,15 @@ Done when Fabric exports remain backward compatible, State Hub keeps importing
 valid v1alpha2 exports, and overlay fields are visible enough for dashboard or
 search views.
 
+Result: `schemas/state-hub-export.schema.yaml` accepts optional
+`deployment_overlay` objects on financial nodes and edges while preserving the
+legacy export shape. Focused compatibility tests pass.
+
 ## T06 - Publish Current Zone Inventory
 
 ```task
 id: RAIL-FAB-WP-0020-T06
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "a1b208e3-3321-4792-ba44-d32aba682183"
 ```
@@ -180,3 +202,7 @@ Done when there is a saved artifact answering:
 - which production services are visible on `railiance01`;
 - which routes or ports are ambiguous, conflicting, or missing a policy
   authority.
+
+Result: saved the current inventory at
+`fabric/discovery/snapshots/2026-05-24-deployment-zone-inventory.yaml` and added
+focused test coverage to keep the dev/test/prod scenario answers present.