Complete renamed image source and verify bounded consumer migration readiness

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

docs/evidence/2026-10-11-runtime-source/validation.json

@@ -0,0 +1,42 @@
+{
+  "schema": "access-runtime-source-validation/v1",
+  "task": "FLEX-WP-0036-T04",
+  "source_sha256": {
+    "Containerfile": "85094ed869bbcd24a8b1fadff46038c891fef2d2b2f20b2689a59004b94d19a9",
+    "Containerfile.lifecycle": "248a36de72c49513dac478367863610a54a1499c22f5505a1cc08a0565eb050d",
+    ".forgejo/workflows/image.yaml": "af7768f4c223b9151060bf1c61d2bc22a09dfe5ad52349409545135660108e27",
+    "tools/publish-runtime-images.sh": "796f2d402a5d118879f45f47e762004602c612ccf783fc6c60e51ee7f16bca5a",
+    "internal/adapters/topaz/integration_test.go": "4b506ff3d27f8ad36f4a7d3d2a263e959be32d14857321cfcfd54c9899c702e6"
+  },
+  "local_image_tag": "custodian-access-runtime-t04:20261011",
+  "local_build_passed": true,
+  "policy_path_checks": [
+    {
+      "path": "/opt/access-engine/examples/tenant-engine/policy_package.md",
+      "exit": 0,
+      "valid": true,
+      "checks": 75
+    },
+    {
+      "path": "/opt/flex-auth/examples/tenant-engine/policy_package.md",
+      "exit": 0,
+      "valid": true,
+      "checks": 75
+    }
+  ],
+  "legacy_stub_exit": 2,
+  "legacy_stub_rename_message": true,
+  "publisher_failure_and_scope_tests": 5,
+  "go_suite_passed": true,
+  "registry_publication_proven": false,
+  "native_rollout": false,
+  "preparation_failures": [
+    {
+      "stage": "local validation invocation",
+      "exit": 64,
+      "reason": "incorrect registry/policy flags for validate command",
+      "recovery": "used documented -kind policy -file; both paths passed"
+    }
+  ],
+  "oci_index_handling": "Registry verification uses independent pull and exact repository RepoDigest; retained build provenance/index. No Buildx plugin dependency in publisher."
+}

docs/runtime-rename-inventory.md

@@ -106,3 +106,32 @@ Live pins: `flex-auth-informed-decision-lifecycle`, `-sitting`, `-t03`.
 Requested after T01 fixes the target names, so each owner gets one message
 with the exact new URL and audience: `ops-warden`, `secrets-engine`,
 `user-engine` with `net-kingdom`, `tenant-engine`, and `informed-decision`.
+
+
+## Deterministic consumer readiness check (2026-10-11, T06)
+
+Run `python3 tools/verify_runtime_consumer_migration.py --estate-root /home/worsch`.
+The class parses only the bounded public inventory source paths as YAML/JSON,
+TOML or Python literal strings, excludes comments and records file SHA256s.
+It emits exact old/new pin origins, source-owner handoff responsibilities and
+source migration phases. It never marks native readiness or closes a task.
+Unsigned completion flags, source URL strings and a missing log are not live
+proof. Operator configuration, ops-bridge ClusterIP tunnels and Secrets CLI
+runtime selection remain owner evidence requirements; no private operator
+configuration or credentials are read by this tool.
+
+The 2026-10-11 re-derivation found remaining owner source work for ops-warden,
+secrets-engine, user-engine with net-kingdom, tenant-engine and informed-decision.
+No new endpoint appeared in these bounded files. The five owner handoffs are
+prepared by the report, not sent or claimed acknowledged. Source owners first
+retain old egress while adding the new namespace, then change one consumer's
+endpoint and projected audience after T02/T05 and ordered live prerequisites.
+Each new pin needs authenticated allow/deny and exact deployed revision/digest
+correspondence; old-twin logs need an explicit observation interval and
+no-traffic/soak evidence before old egress removal or T07 retirement.
+
+The earlier `flex-auth-policy-check` catalogue example is a policy routing lane,
+not a secret-fetch package lane. Its naming migration does not authorize adding
+PDP-self resource systems to packages that govern other protected consumers.
+T05's nine new TokenReview ServiceAccount grants are a separate red daily-batch
+item. This report does not authorize those grants or the consumer changes.