Propose FLEX-WP-0035 for user-engine readback; record rename evidence and open secrets-engine residual

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 609675@bnt-lap001
Assistant-Session: 4987a36e-eb38-4b10-803c-15a29cd78212

workplans/FLEX-WP-0020-repository-identity-migration.md

@@ -524,3 +524,13 @@ window or success is invented; no checkout or alias is removed. Exact owner
 receipts and operator acceptance requirements are in
 `docs/blocked-task-dependencies-2026-10-04.md`. T11 and this workplan remain
 blocked until those returns and the still-open cleanup decision permit closure.
+
+2026-10-09 inbox review: secrets-engine closed SECRETS-IN-0002 (commit fda9708,
+message a56c27c5), but its re-survey searched for `~/flex-auth` only. The
+residual named above is a relative path and is still present:
+`secrets-engine/docs/exec-owner-binding.md:89` reads `--flex-auth-source ../flex-auth`.
+Returned to secrets-engine; the T11 residual stays open. Owner evidence also
+received and recorded at T04/T09: user-engine USER-WP-0034 (34cdcde),
+tenant-engine TEN-IN-0004 (6c137c1), railiance-platform RPF-IN-0001 (d32baa9),
+reuse-surface REUSE-WP-0023-T01 (71abb3c), net-kingdom NK-WP-0039-T03,
+ops-warden WARDEN-IN-0003 (e55fb8d).

workplans/FLEX-WP-0035-per-identity-application-readback.md

@@ -0,0 +1,102 @@
+---
+id: FLEX-WP-0035
+type: workplan
+title: "Per-identity application access readback and readable protected-system registry for user-engine"
+domain: infotech
+repo: access-engine
+status: proposed
+owner: claude
+topic_slug: netkingdom
+created: "2026-10-09"
+updated: "2026-10-09"
+related: [USER-WP-0026, USER-WP-0028]
+---
+
+user-engine (message `f1637c32`, 2026-10-09, routed by net-kingdom `19a0cbcd`)
+needs to show a signed-in person which applications they can use. Its
+`USER-WP-0026-T03` and `USER-WP-0028-T02` are `blocked_on` access-engine. The
+PEP stance is already fail-closed: no decision renders `unavailable`, and allow
+is never inferred from membership, platform role, registration, or a missing
+record.
+
+## What exists today (2026-10-09 review)
+
+- `POST /v1/batch_check` takes several resources in one call and returns one
+  decision per resource, each with a `lifetime` (`expires_at`) per the decision
+  envelope. Shape-wise this is close to request (1).
+- Caller auth authorizes the caller token against **every** `resource.system`
+  in the batch (`cmd/flex-auth/main.go`, `/v1/batch_check`). The
+  `flex-auth-user-engine` caller is bound to its own protected system, so a
+  readback across other systems is a 403 today. That is correct behaviour for
+  enforcement, and the reason this needs design rather than a config change.
+- There is no generic "may use this application" action. Each package has its
+  own action vocabulary, so "access to system X" has no defined meaning yet.
+- There is no registry read endpoint. The protected-system registry is loaded
+  from files and never served.
+
+## Define the readback contract
+
+```task
+id: FLEX-WP-0035-T01
+status: todo
+priority: high
+```
+
+Decide the action that a readback evaluates per system: a declared
+`application.access` action each consumer package must opt into, versus a
+per-system mapping held in the registry. A system that declares nothing is
+returned as `not_applicable`, never allow. State per input class the
+revocation-visibility deadline the readback carries (§9.7). Decide whether the
+readback is a decision for audit purposes (decision record, emission) or an
+explicitly non-enforcing advisory read. A displayed allow must not be usable as
+a PEP decision by another system.
+
+Gate: written contract in `docs/` plus an ADR or decision record; reviewed with
+user-engine before code.
+
+## Caller authorization for cross-system readback
+
+```task
+id: FLEX-WP-0035-T02
+status: todo
+priority: high
+depends_on: [FLEX-WP-0035-T01]
+```
+
+Add a distinct caller capability (readback scope) instead of widening the
+`flex-auth-user-engine` binding to other systems' check rights. The readback
+caller must not be able to obtain a decision that another system's PEP would
+accept, and its decisions must say so in the binding.
+
+Gate: tests prove a readback-scoped token gets 403 on `/v1/check` for a foreign
+system and is admitted only on the readback route.
+
+## Readable protected-system registry
+
+```task
+id: FLEX-WP-0035-T03
+status: todo
+priority: medium
+depends_on: [FLEX-WP-0035-T01]
+```
+
+Serve a read-only projection: system id, display name, key-cape client binding.
+Include the registry-snapshot digest so the catalogue is tied to the same
+snapshot that decisions record (G1, `FLEX-WP-0019`). Grants and revocations stay
+inside access-engine; user-domain admins get no grant surface from this work.
+
+Gate: endpoint plus schema, admitted only for the readback caller, tests.
+
+## Deploy to the user-engine pin
+
+```task
+id: FLEX-WP-0035-T04
+status: wait
+needs_human: true
+depends_on: [FLEX-WP-0035-T02, FLEX-WP-0035-T03]
+blocking_reason: "Live pin change on railiance01 needs founder go."
+priority: medium
+```
+
+Roll the readback route and its caller binding onto `flex-auth-user-engine`,
+then hand user-engine the evidence that unblocks `USER-WP-0026-T03`.