FLEX-WP-0035 T01-T03: application access readback pin

Contract accepted by user-engine; FLEX-DEC-2026-019 accepted.
- serve-readback: dedicated pin, no enforcement routes, own caller binding
- CheckRequest.purpose hashed into every digest when set; /v1/check refuses it
- POST /v1/readback/application_access and GET /v1/readback/systems
- optional client_binding on protected systems; readback schemas
- schemaguard implements maxItems
- T05 added: informed-decision needs an application.access rule over
  realm-level claims (its lifecycle rules read authentication_audience)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 609675@bnt-lap001
Assistant-Session: 4987a36e-eb38-4b10-803c-15a29cd78212

cmd/flex-auth/main.go

@@ -58,6 +58,8 @@ func run(args []string, stdout, stderr io.Writer) int {
 		return runExplain(args[1:], stdout, stderr)
 	case "serve":
 		return runServe(args[1:], stdout, stderr)
+	case "serve-readback":
+		return runServeReadback(args[1:], stdout, stderr)
 	case "help", "-h", "--help":
 		printUsage(stdout)
 		return 0
@@ -456,6 +458,12 @@ func newServeMuxWithCallerAuth(engine *decisioncore.Engine, authenticator *calle
 			http.Error(w, err.Error(), http.StatusBadRequest)
 			return
 		}
+		if request.Purpose != "" {
+			// Only the readback pin issues purpose-bearing decisions
+			// (FLEX-DEC-2026-019); an enforcement pin never does.
+			http.Error(w, "purpose is not accepted on /v1/check", http.StatusBadRequest)
+			return
+		}
 		identity, err := authenticator.Authorize(r.Context(), r.Header.Get("Authorization"), []string{request.Resource.System})
 		if err != nil {
 			writeCallerAuthError(w, err)
@@ -627,7 +635,7 @@ func fail(stderr io.Writer, err error) int {
 
 func printUsage(w io.Writer) {
 	fmt.Fprintln(w, "usage: flex-auth <command> [options]")
-	fmt.Fprintln(w, "commands: version, validate, load-registry, test-policy, check, batch-check, list-allowed, explain, serve")
+	fmt.Fprintln(w, "commands: version, validate, load-registry, test-policy, check, batch-check, list-allowed, explain, serve, serve-readback")
 }
 
 type keyValueFlags []string