FLEX-WP-0036: binary renamed to access-engine; flex-auth is a stub naming the rename (FLEX-DEC-2026-020)

- cmd/flex-auth -> cmd/access-engine; usage and serving lines say access-engine
- cmd/flex-auth: prints the rename and exits 2, with a test
- image: entrypoint /usr/local/bin/access-engine, flex-auth stub alongside;
  live pins pass only args, so their next roll is unaffected
- Makefile, CI, verify-posture, tenancy.yaml, live docs updated; workplans,
  decisions and ADRs left as written
- runtime names (module, audience, k8s, image package, /opt paths) unchanged

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 735967@bnt-lap001
Assistant-Session: 5971967f-77f8-4ced-9e02-c6ef67040ffc

docs/application-access-readback.md

@@ -232,7 +232,7 @@ or revoke surface.
 ```bash
 # --registry and --package repeat once per participating system;
 # system ids must not repeat across registries.
-flex-auth serve-readback \
+access-engine serve-readback \
   --registry examples/<system>/registry_snapshot.json \
   --package <system>=examples/<system>/policy_package.md \
   --caller-auth-mode enforce \
@@ -243,4 +243,4 @@ The pin mounts `/healthz`, `POST /v1/readback/application_access` and
 `GET /v1/readback/systems`, and no enforcement route. `--readback-caller` is
 bound under the key `application-readback`. That key is not a protected
 system, so the principal can never represent a system on any pin's
-`/v1/check`. Tests: `cmd/flex-auth/readback_test.go`.
+`/v1/check`. Tests: `cmd/access-engine/readback_test.go`.

docs/decision-input-freshness.md

@@ -35,7 +35,7 @@ flex-auth does not store or mutate the approval object (`approval-engine`).
 | | |
 | --- | --- |
 | What is joined | Protected systems, resources, subjects, groups, teams, tenants, relationship facts |
-| Mechanism | In-memory `registry.Store` loaded at process start and by `flex-auth load-registry`. There is no background watch. |
+| Mechanism | In-memory `registry.Store` loaded at process start and by `access-engine load-registry`. There is no background watch. |
 | Deadline | A registry-borne revocation is visible after the operator reloads the snapshot **or** when the current allow TTL ends, whichever is first. On a running process that has not reloaded, the snapshot is otherwise unchanged. |
 | Provenance | `registry_snapshot_digest` — SHA-256 of canonical snapshot JSON |
 

docs/delegated-mode-operations.md

@@ -6,7 +6,7 @@ Status: implemented for FLEX-WP-0004 P4.6.
 
 Delegated mode lets flex-auth coordinate external authorization systems
 without changing the protected-system-facing API. Protected systems keep
-using flex-auth check, batch, list, explanation, and audit contracts.
+using access-engine check, batch, list, explanation, and audit contracts.
 Topaz, relationship PDPs, rule PDPs, Keycloak Authorization Services,
 and directory resolvers stay behind adapter boundaries.
 

docs/ops-warden-policy-gate-handoff.md

@@ -16,7 +16,7 @@ Ops-warden unblocker: WARDEN-WP-0009 T01
 
 ## Local service command
 
-    flex-auth serve --addr 127.0.0.1:8080 --registry examples/ops-warden/registry_snapshot.json --policy examples/ops-warden/policy_package.md --log /tmp/flex-auth-ops-warden-decisions.jsonl
+    access-engine serve --addr 127.0.0.1:8080 --registry examples/ops-warden/registry_snapshot.json --policy examples/ops-warden/policy_package.md --log /tmp/flex-auth-ops-warden-decisions.jsonl
 
 Ops-warden can point policy.flex_auth_url at that base URL for local smoke.
 Production should keep policy.fail_closed true unless an explicit break-glass
@@ -91,7 +91,7 @@ Additional published assets:
 
 Production runtime command:
 
-    flex-auth serve --addr 0.0.0.0:8080 --registry examples/ops-warden/production_registry_snapshot.json --policy examples/ops-warden/policy_package.md --log /var/log/flex-auth/ops-warden-decisions.jsonl
+    access-engine serve --addr 0.0.0.0:8080 --registry examples/ops-warden/production_registry_snapshot.json --policy examples/ops-warden/policy_package.md --log /var/log/flex-auth/ops-warden-decisions.jsonl
 
 Use http://flex-auth.flex-auth.svc.cluster.local:8080 when cluster DNS is
 reachable from warden workstations. Otherwise use the approved operator tunnel

docs/ops-warden-registry-sync.md

@@ -26,7 +26,7 @@ from the same workstation:
 Start the runtime with the production registry snapshot and the ops-warden
 policy package:
 
-    flex-auth serve --addr 0.0.0.0:8080 --registry examples/ops-warden/production_registry_snapshot.json --policy examples/ops-warden/policy_package.md --log /var/log/flex-auth/ops-warden-decisions.jsonl
+    access-engine serve --addr 0.0.0.0:8080 --registry examples/ops-warden/production_registry_snapshot.json --policy examples/ops-warden/policy_package.md --log /var/log/flex-auth/ops-warden-decisions.jsonl
 
 The checked-in production snapshot is a non-secret fixture and initial load
 target. Regenerate it from ops-warden inventory whenever actors, principals, or
@@ -68,7 +68,7 @@ Service if flex-auth should run inside the cluster.
 
 3. Validate the generated file before handoff:
 
-       flex-auth load-registry --file registry/flex-auth/production_registry_snapshot.json
+       access-engine load-registry --file registry/flex-auth/production_registry_snapshot.json
 
 4. Copy or promote the snapshot to the flex-auth runtime. For repo-level drift
    coverage, update examples/ops-warden/production_registry_snapshot.json when

docs/request-enrichment.md

@@ -157,11 +157,11 @@ be inferred from the key name:
   precedence)
 
 Package changes wait until T03 makes "read a declared registry key" a
-`flex-auth validate` finding rather than a review note.
+`access-engine validate` finding rather than a review note.
 
 ## Validate flags undeclared attribute reads (FLEX-WP-0025-T03)
 
-`flex-auth validate --kind policy` now emits
+`access-engine validate --kind policy` now emits
 `POLICY-ATTRIBUTE-UNDECLARED` (error) for every
 `input.{resource,subject}.attributes.<key>` the package reads that no sibling
 `registry_snapshot.json`, `production_registry_snapshot.json`,