diff --git a/.claude/rules/credential-routing.md b/.claude/rules/credential-routing.md
index 6f7d8e1..5b55ca5 100644
--- a/.claude/rules/credential-routing.md
+++ b/.claude/rules/credential-routing.md
@@ -19,7 +19,7 @@ Requires the `warden` CLI from `~/ops-warden` (`uv tool install .` or `uv run wa
 
 | Agent runtime | How to orient |
 | --- | --- |
-| **Codex / Grok** (shell, HTTP State Hub) | `warden route` commands above; inbox `to_agent=flex-auth` is for coordination, not secret vending |
+| **Codex / Grok** (shell, HTTP State Hub) | `warden route` commands above; inbox `to_agent=access-engine` is for coordination, not secret vending |
 | **Claude Code** (MCP when available) | `get_domain_summary("custodian")` for workplans; **still** use `warden route` for credential ownership |
 | **llm-connect** (inference service) | Never put secret retrieval in prompts; route custody to OpenBao/operator paths surfaced by `warden route` |
 
diff --git a/.claude/rules/repo-identity.md b/.claude/rules/repo-identity.md
index fd377f9..8004626 100644
--- a/.claude/rules/repo-identity.md
+++ b/.claude/rules/repo-identity.md
@@ -1,5 +1,5 @@
 **Purpose:** flex-auth - (fill in purpose)
 
 **Domain:** infotech
-**Repo slug:** flex-auth
+**Repo slug:** access-engine (hub alias `flex-auth`; runtime names stay `flex-auth`, FLEX-WP-0020)
 **Topic ID:** cee7bedf-2b48-46ef-8601-006474f2ad7a
diff --git a/.claude/rules/session-protocol.md b/.claude/rules/session-protocol.md
index 5b7471f..8d0e577 100644
--- a/.claude/rules/session-protocol.md
+++ b/.claude/rules/session-protocol.md
@@ -22,14 +22,14 @@ If the hub is offline: `cd ~/state-hub && make api`
 **Step 2 — Check inbox**
 With MCP tools:
 ```
-get_messages(to_agent="flex-auth", unread_only=True)
+get_messages(to_agent="access-engine", unread_only=True)
 ```
 Mark read with `mark_message_read(message_id)`. Reply or act on coordination
 requests before proceeding.
 
 Without MCP tools:
 ```bash
-curl -s "http://127.0.0.1:8000/messages/?to_agent=flex-auth&unread_only=true" \
+curl -s "http://127.0.0.1:8000/messages/?to_agent=access-engine&unread_only=true" \
   | python3 -m json.tool
 curl -s -X PATCH "http://127.0.0.1:8000/messages/<id>/read" \
   -H "Content-Type: application/json" -d '{}'
@@ -45,7 +45,7 @@ For each file with `status: ready`, `active`, or `blocked`, note pending
 **Step 4 — Present brief**
 
 1. **Active workplans** for `infotech` — title, task counts, blocking decisions
-2. **Pending tasks** from `workplans/` + any `[repo:flex-auth]` hub tasks
+2. **Pending tasks** from `workplans/` + any `[repo:access-engine]` hub tasks
 3. **Goal guidance** — if `goal_guidance` in summary:
    - `needs_workplan`: surface as top action — *"Repo goal '{title}' has no workplan yet"*
    - `alignment_warnings`: flag if active work is not aligned with current goal
@@ -85,7 +85,7 @@ statehub fix-consistency
 For repos where implementation runs on a remote machine (e.g. CoulombCore),
 use the pull-before-fix mode from any shell with the State Hub CLI:
 ```bash
-statehub fix-consistency --repo flex-auth --remote
+statehub fix-consistency --repo access-engine --remote
 ```
 **C-15** (DB task ahead of file) is normal in multi-machine workflows — writeback
 will sync the file to match DB.  **C-16** (repo behind remote) blocks all writes
diff --git a/.claude/rules/workplan-convention.md b/.claude/rules/workplan-convention.md
index d95028a..eb89d23 100644
--- a/.claude/rules/workplan-convention.md
+++ b/.claude/rules/workplan-convention.md
@@ -21,7 +21,7 @@ Small opportunistic tasks discovered during another session use **Ad Hoc Tasks**
 directly. Promote anything requiring analysis, design, approval, dependencies, or
 multiple planned phases into a normal workplan.
 
-Ecosystem todos from other agents arrive as `[repo:flex-auth]` hub tasks —
+Ecosystem todos from other agents arrive as `[repo:access-engine]` hub tasks —
 visible at session start. Pick one up by creating the workplan file, committing,
 and running `statehub fix-consistency` — C-06 registers the workplan in the hub.
 Never register by hand with `create_workplan` (legacy MCP alias: `create_workstream`).