Prepare renamed Access Engine runtime twins with exact reviewer scope

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

tools/gen_runtime_twins.py

@@ -0,0 +1,49 @@
+#!/usr/bin/env python3
+"""Prepare exact-content runtime twins. Local files only; never applies to Kubernetes.
+
+Namespace/release/chart/ServiceAccount and caller audience move to access-engine.
+Image repository+digest and policy/registry argv remain exact existing-twin values
+until publication/path migration is separately proven.
+"""
+from pathlib import Path
+import argparse
+import copy
+import re
+import yaml
+
+ROOT = Path(__file__).resolve().parents[1]
+PINS = ("ops-warden", "ops-warden-fetch", "secrets-engine", "user-engine", "tenant-engine", "informed-decision-lifecycle", "informed-decision-sitting", "informed-decision-t03", "application-readback")
+
+def twin(source):
+    result = copy.deepcopy(source)
+    if not re.fullmatch(r"sha256:[0-9a-f]{64}", source.get("image", {}).get("digest", "")):
+        raise ValueError("existing twin must have an immutable SHA256 digest")
+    name = source.get("name", "")
+    if not name.startswith("flex-auth-"):
+        raise ValueError("existing pin must have an exact flex-auth release name")
+    if source.get("callerAuth", {}).get("mode") != "enforce":
+        raise ValueError("new twin requires existing enforced caller authentication")
+    if source.get("outbox", {}).get("enabled") or source.get("auditDelivery", {}).get("enabled"):
+        raise ValueError("durable outbox/audit twins require independent source/custody; never share writer state")
+    result["name"] = "access-engine-" + name[len("flex-auth-"):]
+    result["namespace"] = "access-engine"
+    result["callerAuth"]["audience"] = "access-engine"
+    return result
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--check", action="store_true")
+    args = parser.parse_args()
+    for pin in PINS:
+        source = yaml.safe_load((ROOT / "values" / (pin + ".yaml")).read_text())
+        target = ROOT / "values" / "access-engine" / (pin + ".yaml")
+        result = twin(source)
+        if args.check:
+            if not target.exists() or yaml.safe_load(target.read_text()) != result:
+                raise SystemExit(f"runtime twin drift: {target}")
+        else:
+            target.parent.mkdir(parents=True, exist_ok=True)
+            target.write_text("# GENERATED by tools/gen_runtime_twins.py; same image/package as existing twin.\n" + yaml.safe_dump(result, sort_keys=False))
+
+if __name__ == "__main__":
+    main()