FLEX-WP-0036: Go module is github.com/netkingdom/access-engine; T02 consumer inventory

- module path renamed (no external importers); golangci local-prefixes
- ACCESS_ENGINE_RUN_TOPAZ_INTEGRATION replaces FLEX_AUTH_RUN_TOPAZ_INTEGRATION
- README title and identity paragraph reflect the landed renames
- docs/runtime-rename-inventory.md: per-consumer references by kind and order
- chart name, image package and /opt paths deliberately left for T05

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 735967@bnt-lap001
Assistant-Session: 5971967f-77f8-4ced-9e02-c6ef67040ffc

.golangci.yml

@@ -17,7 +17,7 @@ linters:
 
 linters-settings:
   goimports:
-    local-prefixes: github.com/netkingdom/flex-auth
+    local-prefixes: github.com/netkingdom/access-engine
 
 issues:
   exclude-rules:

README.md

@@ -1,14 +1,16 @@
-# flex-auth
+# access-engine
 
 Policy-as-code authorization registry and control plane for NetKingdom-aligned
 systems.
 
-The live Forge and State Hub coordinate is still `flex-auth` (repository UUID
-`fda8ad85-a7d7-4055-8f21-902a533e59df`, Forge ID `42`). `FLEX-WP-0020` will
-rename that coordinate to `access-engine` and keep the Go module, binary,
-`FLEX_AUTH_*` variables, Helm releases, container package
-`coulomb/flex-auth`, and policy/API vocabulary unchanged. Work-record
-frontmatter stays `repo: flex-auth` until State Hub rebind. Planned clone:
+The Forge and State Hub coordinate is `access-engine` (`FLEX-WP-0020`;
+repository UUID `fda8ad85-a7d7-4055-8f21-902a533e59df`, Forge ID `42`; hub alias
+`flex-auth`). The binary is `access-engine` (`FLEX-DEC-2026-020`; `flex-auth`
+is now only a stub that prints the rename), and the Go module is
+`github.com/netkingdom/access-engine`. The runtime still uses `flex-auth`: the
+namespace, Helm releases, Services, caller audience and container package
+`coulomb/flex-auth`. `FLEX-WP-0036` moves those to new pins that run alongside
+the old ones while consumers switch. Clone:
 `https://forgejo.coulomb.social/coulomb/access-engine.git`.
 
 Start with [INTENT.md](INTENT.md) for the project boundary and direction.

cmd/access-engine/main.go

@@ -16,13 +16,13 @@ import (
 
 	"gopkg.in/yaml.v3"
 
-	"github.com/netkingdom/flex-auth/internal/audit"
-	"github.com/netkingdom/flex-auth/internal/callerauth"
-	decisioncore "github.com/netkingdom/flex-auth/internal/decision"
-	"github.com/netkingdom/flex-auth/internal/emission"
-	"github.com/netkingdom/flex-auth/internal/policy"
-	"github.com/netkingdom/flex-auth/internal/registry"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/audit"
+	"github.com/netkingdom/access-engine/internal/callerauth"
+	decisioncore "github.com/netkingdom/access-engine/internal/decision"
+	"github.com/netkingdom/access-engine/internal/emission"
+	"github.com/netkingdom/access-engine/internal/policy"
+	"github.com/netkingdom/access-engine/internal/registry"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 // version is set at build time via -ldflags "-X main.version=...".

cmd/access-engine/main_test.go

@@ -11,8 +11,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/netkingdom/flex-auth/internal/callerauth"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/callerauth"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 func TestRunVersion(t *testing.T) {

cmd/access-engine/ops_warden_fetch_test.go

@@ -15,8 +15,8 @@ import (
 
 	"gopkg.in/yaml.v3"
 
-	"github.com/netkingdom/flex-auth/internal/callerauth"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/callerauth"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 // The ops-warden secret-read pin (CUST-WP-0075, bug b792c5d0): warden's

cmd/access-engine/readback.go

@@ -9,11 +9,11 @@ import (
 	"net/http"
 	"strings"
 
-	"github.com/netkingdom/flex-auth/internal/audit"
-	"github.com/netkingdom/flex-auth/internal/callerauth"
-	"github.com/netkingdom/flex-auth/internal/policy"
-	"github.com/netkingdom/flex-auth/internal/readback"
-	"github.com/netkingdom/flex-auth/internal/registry"
+	"github.com/netkingdom/access-engine/internal/audit"
+	"github.com/netkingdom/access-engine/internal/callerauth"
+	"github.com/netkingdom/access-engine/internal/policy"
+	"github.com/netkingdom/access-engine/internal/readback"
+	"github.com/netkingdom/access-engine/internal/registry"
 )
 
 // readbackBinding is the caller-binding key the readback routes authorize

cmd/access-engine/readback_test.go

@@ -14,11 +14,11 @@ import (
 	"testing"
 	"time"
 
-	"github.com/netkingdom/flex-auth/internal/audit"
-	"github.com/netkingdom/flex-auth/internal/callerauth"
-	"github.com/netkingdom/flex-auth/internal/readback"
-	"github.com/netkingdom/flex-auth/internal/schemaguard"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/audit"
+	"github.com/netkingdom/access-engine/internal/callerauth"
+	"github.com/netkingdom/access-engine/internal/readback"
+	"github.com/netkingdom/access-engine/internal/schemaguard"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 // FLEX-WP-0035: application access readback.

cmd/flex-auth/main_test.go

@@ -9,12 +9,12 @@ import (
 
 // The retired binary must fail and name its replacement, whatever it is asked.
 func TestRetiredBinaryNamesReplacement(t *testing.T) {
-	if os.Getenv("FLEX_AUTH_STUB_CHILD") == "1" {
+	if os.Getenv("ACCESS_ENGINE_STUB_CHILD") == "1" {
 		main()
 		return
 	}
 	cmd := exec.Command(os.Args[0], "-test.run=TestRetiredBinaryNamesReplacement", "serve", "--addr", "x")
-	cmd.Env = append(os.Environ(), "FLEX_AUTH_STUB_CHILD=1")
+	cmd.Env = append(os.Environ(), "ACCESS_ENGINE_STUB_CHILD=1")
 	out, err := cmd.CombinedOutput()
 	exit, ok := err.(*exec.ExitError)
 	if !ok || exit.ExitCode() != 2 {

docs/runtime-rename-inventory.md

@@ -0,0 +1,108 @@
+# Runtime rename inventory (FLEX-WP-0036-T02)
+
+Derived 2026-10-10 by searching each consumer checkout for `flex-auth` and
+`FLEX_AUTH` in code and config (`.py .go .yaml .yml .toml .json .sh .ts`).
+Git, venv, history and archived paths are excluded. Tests are listed only where
+they run the binary. Historical evidence and batch files under `docs/` are
+counted but are not to be rewritten: they record what was live at the time.
+
+Re-derive before T06 with the same search. This is a snapshot, not a register.
+
+## What a consumer has to change, by kind
+
+| Kind | Breaks if changed before the PDP accepts it? | Order |
+| --- | --- | --- |
+| Service URL `flex-auth-<c>.flex-auth.svc…` | Yes: the new name resolves only once T05 has run | T05, then the consumer |
+| Egress NetworkPolicy naming namespace `flex-auth` | Yes: drops traffic to the old pin | Add `access-engine`, switch, then remove `flex-auth` |
+| Projected-token audience `flex-auth` | Yes: 401 until T03 accepts `access-engine` | T03, then the consumer |
+| `resource.system` / `owner_repo` = `flex-auth` | Yes: `not_applicable`, i.e. deny (`FLEX-DEC-2026-015`) | T03, then the consumer |
+| Consumer-owned env var names (`<C>_FLEX_AUTH_URL` …) | No: the consumer's own vocabulary | Consumer's choice; not required |
+| Builds or runs our binary | Already changed (`FLEX-DEC-2026-020`): the stub exits 2 | Consumer builds `./cmd/access-engine` |
+
+## Per consumer
+
+### ops-warden
+
+Live pins: `flex-auth-ops-warden` (sign), `flex-auth-ops-warden-fetch`.
+
+- URLs: `examples/warden.production.example.yaml` (sign and fetch); live
+  config under the operator. Workstation tunnels
+  `flex-auth-ops-warden-railiance01` (:19090) and
+  `flex-auth-ops-warden-fetch-railiance01` (:19091) in ops-bridge
+  `tunnels.yaml` point at ClusterIPs, which change with the new Services.
+- Audience: `examples/warden.production.example.yaml`.
+- `resource.system`: lane `flex-auth-policy-check`, `owner_repo: flex-auth`
+  in `registry/routing/catalog.yaml`.
+- Binary: `scripts/policy_gate_production_smoke.sh` (`FLEX_AUTH_BIN`,
+  default `/tmp/flex-auth`).
+- Also: `scripts/build_flex_auth_registry.py`,
+  `scripts/check_flex_auth_manifest_coverage.py`, `pep-stance.yaml`,
+  `layer.yaml`, `tenancy.yaml`, and `src/warden/{policy,access,caller_identity}.py`.
+  These are names, not runtime addresses.
+
+### secrets-engine
+
+Live pin: `flex-auth-secrets-engine`.
+
+- URLs appear in docs and tests only. secrets-engine is a CLI, and its
+  operator access path is still open (`FLEX-WP-0023`).
+- Binary: `tools/exercise_approval_identity.py` builds `./cmd/flex-auth`
+  (notified 2026-10-10, message `ad4b1b3e`).
+- `pep-stance.yaml` names the PDP.
+
+### user-engine (deployment sources in net-kingdom)
+
+Live pins: `flex-auth-user-engine` (check), `flex-auth-application-readback`.
+
+- URL, audience and egress: `net-kingdom/sso-mfa/k8s/user-engine/runtime.yaml`
+  (`USER_ENGINE_FLEX_AUTH_URL`, token audience `flex-auth`, egress namespace
+  `flex-auth`), plus the readback URL promised on 2026-10-10 (message
+  `5460cee2`).
+- Env vars: `USER_ENGINE_FLEX_AUTH_{URL,TOKEN_FILE,TIMEOUT}` and
+  `USER_ENGINE_READBACK_TOKEN_FILE` in `src/user_engine/runtime.py` and
+  `adapters/local.py`. These are the consumer's own names.
+
+### tenant-engine
+
+Live pin: `flex-auth-tenant-engine`.
+
+- URL, audience and egress: `deploy/base/tenant-engine.yaml`, `railiance/app.toml`.
+- Env vars: `TENANT_ENGINE_FLEX_AUTH_{URL,TOKEN_FILE,TIMEOUT_SECONDS}` in
+  `src/tenant_engine/config.py`; `pep-stance.yaml`.
+
+### informed-decision
+
+Live pins: `flex-auth-informed-decision-lifecycle`, `-sitting`, `-t03`.
+
+- URLs and audience: `deploy/sitting-admission.json`, `deploy/t03-admission.json`,
+  `deploy/lifecycle/{admission,service}.candidate.json`, and
+  `tools/render_deployment.py`. The live egress policy `informed-decision-review`
+  names namespace `flex-auth`.
+- Binary: `tests/browser_fixture.py`, `tests/test_lifecycle_policy_component.py`,
+  `tests/test_review_component.py` and `tests/test_lifecycle_review.py` take
+  `INFD_FLEX_AUTH_BINARY` / `INFD_FLEX_AUTH_SOURCE`. A binary built from current
+  source must come from `./cmd/access-engine`. Doc
+  `docs/protected-browser-review.md` notified (message `9b15c762`).
+- `docs/batches/**` and `docs/evidence/**` are historical. Leave them.
+
+### net-kingdom
+
+- Owns user-engine's deployment source (above).
+- `runbooks/protected-system-flex-auth/pack.yaml` and
+  `docs/tutorials/protected-system-flex-auth.md` run `go run ./cmd/flex-auth`
+  (notified, message `e2f1aac9`).
+
+### Others with references, not consumers of a pin
+
+- `state-hub/repository_rename_workplan.py`: tooling from `FLEX-WP-0020`.
+- `railiance-platform/scripts/credential.py`: `FLEX_AUTH_{URL,PATH,SUBJECT_TYPES}`.
+  Check whether it calls a live pin before T06.
+- `the-custodian`: docs only.
+- Hub repo record `local_path` is `/home/worsch/flex-auth`, but the checkout is
+  `/home/worsch/access-engine` (`FLEX-WP-0020-T11` residual).
+
+## Owner handoffs
+
+Requested after T01 fixes the target names, so each owner gets one message
+with the exact new URL and audience: `ops-warden`, `secrets-engine`,
+`user-engine` with `net-kingdom`, `tenant-engine`, and `informed-decision`.

docs/topaz-adapter-operations.md

@@ -50,7 +50,7 @@ docker compose up --abort-on-container-exit --exit-code-from probe
 The Go integration test is present but skipped by default. Run it with:
 
 ```sh
-FLEX_AUTH_RUN_TOPAZ_INTEGRATION=1 go test ./internal/adapters/topaz
+ACCESS_ENGINE_RUN_TOPAZ_INTEGRATION=1 go test ./internal/adapters/topaz
 ```
 
 ## Directory Consistency

go.mod

@@ -1,4 +1,4 @@
-module github.com/netkingdom/flex-auth
+module github.com/netkingdom/access-engine
 
 go 1.26.7
 

internal/adapters/directory/enrichment.go

@@ -3,7 +3,7 @@ package directory
 import (
 	"sort"
 
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 // MergeResults combines resolver results while keeping source metadata.

internal/adapters/directory/resolvers.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 // GraphClient is the Microsoft Graph group lookup boundary.

internal/adapters/directory/resolvers_test.go

@@ -5,8 +5,8 @@ import (
 	"testing"
 	"time"
 
-	"github.com/netkingdom/flex-auth/internal/adapters/directory"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/adapters/directory"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 func TestGraphResolverDetectsTokenOverage(t *testing.T) {

internal/adapters/directory/types.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"time"
 
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 // Source identifies the external directory source.

internal/adapters/keycloak/adapter.go

@@ -7,7 +7,7 @@ import (
 	"encoding/json"
 	"fmt"
 
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 // Adapter maps flex-auth checks and resources to Keycloak Authorization

internal/adapters/keycloak/adapter_test.go

@@ -5,8 +5,8 @@ import (
 	"errors"
 	"testing"
 
-	"github.com/netkingdom/flex-auth/internal/adapters/keycloak"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/adapters/keycloak"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 func TestBuildAuthorizationRequestUsesUMAPermissionShape(t *testing.T) {

internal/adapters/keycloak/types.go

@@ -5,7 +5,7 @@ import (
 	"errors"
 	"fmt"
 
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 const (

internal/adapters/relationship/adapter.go

@@ -8,8 +8,8 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/netkingdom/flex-auth/internal/registry"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/registry"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 // Adapter wraps tuple-oriented PDP results into flex-auth decision envelopes.

internal/adapters/relationship/adapter_test.go

@@ -6,9 +6,9 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/netkingdom/flex-auth/internal/adapters/relationship"
-	"github.com/netkingdom/flex-auth/internal/registry"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/adapters/relationship"
+	"github.com/netkingdom/access-engine/internal/registry"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 func TestSnapshotToTuplesMapsCanonicalRegistry(t *testing.T) {

internal/adapters/relationship/translate.go

@@ -5,8 +5,8 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/netkingdom/flex-auth/internal/registry"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/registry"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 // SnapshotToTuples maps flex-auth registry data to relationship tuples.

internal/adapters/relationship/types.go

@@ -5,7 +5,7 @@ import (
 	"errors"
 	"fmt"
 
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 const (

internal/adapters/rule/adapter.go

@@ -8,8 +8,8 @@ import (
 	"fmt"
 	"reflect"
 
-	"github.com/netkingdom/flex-auth/internal/policy"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/policy"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 // Adapter wraps rule-PDP responses into flex-auth decision envelopes.

internal/adapters/rule/adapter_test.go

@@ -6,9 +6,9 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/netkingdom/flex-auth/internal/adapters/rule"
-	"github.com/netkingdom/flex-auth/internal/policy"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/adapters/rule"
+	"github.com/netkingdom/access-engine/internal/policy"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 func TestCanonicalInputFromCheck(t *testing.T) {

internal/adapters/rule/policy_artifact.go

@@ -1,8 +1,8 @@
 package rule
 
 import (
-	"github.com/netkingdom/flex-auth/internal/policy"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/policy"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 // PolicyArtifactFromPackage preserves the extracted Rego module and metadata

internal/adapters/rule/types.go

@@ -5,7 +5,7 @@ import (
 	"errors"
 	"fmt"
 
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 const (

internal/adapters/topaz/adapter.go

@@ -8,9 +8,9 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/netkingdom/flex-auth/internal/policy"
-	"github.com/netkingdom/flex-auth/internal/registry"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/policy"
+	"github.com/netkingdom/access-engine/internal/registry"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 // Adapter delegates checks, directory writes, and policy bundle publication to

internal/adapters/topaz/adapter_test.go

@@ -7,10 +7,10 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/netkingdom/flex-auth/internal/adapters/topaz"
-	"github.com/netkingdom/flex-auth/internal/policy"
-	"github.com/netkingdom/flex-auth/internal/registry"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/adapters/topaz"
+	"github.com/netkingdom/access-engine/internal/policy"
+	"github.com/netkingdom/access-engine/internal/registry"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 func TestSnapshotToDirectoryMapsCanonicalRegistry(t *testing.T) {

internal/adapters/topaz/http_client_test.go

@@ -7,7 +7,7 @@ import (
 	"net/http/httptest"
 	"testing"
 
-	"github.com/netkingdom/flex-auth/internal/adapters/topaz"
+	"github.com/netkingdom/access-engine/internal/adapters/topaz"
 )
 
 func TestHTTPClientUsesTopazDirectoryRESTShape(t *testing.T) {

internal/adapters/topaz/integration_test.go

@@ -8,8 +8,11 @@ import (
 )
 
 func TestTopazDockerComposeExample(t *testing.T) {
-	if os.Getenv("FLEX_AUTH_RUN_TOPAZ_INTEGRATION") != "1" {
-		t.Skip("set FLEX_AUTH_RUN_TOPAZ_INTEGRATION=1 to run the examples/topaz docker-compose integration")
+	if os.Getenv("FLEX_AUTH_RUN_TOPAZ_INTEGRATION") == "1" {
+		t.Skip("FLEX_AUTH_RUN_TOPAZ_INTEGRATION was renamed: set ACCESS_ENGINE_RUN_TOPAZ_INTEGRATION=1 (FLEX-WP-0036)")
+	}
+	if os.Getenv("ACCESS_ENGINE_RUN_TOPAZ_INTEGRATION") != "1" {
+		t.Skip("set ACCESS_ENGINE_RUN_TOPAZ_INTEGRATION=1 to run the examples/topaz docker-compose integration")
 	}
 
 	dir := filepath.Join("..", "..", "..", "examples", "topaz")

internal/adapters/topaz/policy_bundle.go

@@ -8,7 +8,7 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/netkingdom/flex-auth/internal/policy"
+	"github.com/netkingdom/access-engine/internal/policy"
 )
 
 // PolicyBundleFromPackage extracts the Rego module from a flex-auth

internal/adapters/topaz/translate.go

@@ -5,8 +5,8 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/netkingdom/flex-auth/internal/registry"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/registry"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 // SnapshotToDirectory converts flex-auth's canonical registry snapshot into

internal/adapters/topaz/types.go

@@ -5,7 +5,7 @@ import (
 	"errors"
 	"fmt"
 
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 const (

internal/audit/log.go

@@ -8,7 +8,7 @@ import (
 	"path/filepath"
 	"sync"
 
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 // JSONLDecisionLog persists compact decision envelopes for local development.

internal/audit/log_test.go

@@ -4,8 +4,8 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/netkingdom/flex-auth/internal/audit"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/audit"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 func TestJSONLDecisionLogRoundTripsDecisions(t *testing.T) {

internal/decision/attribute_context_test.go

@@ -6,10 +6,10 @@ import (
 	"testing"
 	"time"
 
-	"github.com/netkingdom/flex-auth/internal/decision"
-	"github.com/netkingdom/flex-auth/internal/policy"
-	"github.com/netkingdom/flex-auth/internal/registry"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/decision"
+	"github.com/netkingdom/access-engine/internal/policy"
+	"github.com/netkingdom/access-engine/internal/registry"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 func TestAttributeContextCarriedWithoutViewHash(t *testing.T) {

internal/decision/emission_atomicity_test.go

@@ -5,8 +5,8 @@ import (
 	"errors"
 	"testing"
 
-	"github.com/netkingdom/flex-auth/internal/decision"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/decision"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 // failingRecorder is an outbox whose commit always fails.

internal/decision/engine.go

@@ -15,10 +15,10 @@ import (
 	"sync"
 	"time"
 
-	"github.com/netkingdom/flex-auth/internal/callerauth"
-	"github.com/netkingdom/flex-auth/internal/policy"
-	"github.com/netkingdom/flex-auth/internal/registry"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/callerauth"
+	"github.com/netkingdom/access-engine/internal/policy"
+	"github.com/netkingdom/access-engine/internal/registry"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 // Engine evaluates deterministic standalone authorization checks against a

internal/decision/engine_test.go

@@ -10,12 +10,12 @@ import (
 
 	"gopkg.in/yaml.v3"
 
-	"github.com/netkingdom/flex-auth/internal/audit"
-	"github.com/netkingdom/flex-auth/internal/callerauth"
-	"github.com/netkingdom/flex-auth/internal/decision"
-	"github.com/netkingdom/flex-auth/internal/policy"
-	"github.com/netkingdom/flex-auth/internal/registry"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/audit"
+	"github.com/netkingdom/access-engine/internal/callerauth"
+	"github.com/netkingdom/access-engine/internal/decision"
+	"github.com/netkingdom/access-engine/internal/policy"
+	"github.com/netkingdom/access-engine/internal/registry"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 func TestCheckUsesExplicitCaringContext(t *testing.T) {

internal/decision/enrichment_precedence_test.go

@@ -6,7 +6,7 @@ import (
 	"encoding/json"
 	"testing"
 
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 // A registry fact is an authority statement; the same key on the request is the

internal/emission/delivery_test.go

@@ -11,8 +11,8 @@ import (
 	"testing"
 	"time"
 
-	"github.com/netkingdom/flex-auth/internal/emission"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/emission"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 func TestHeartbeatScheduleSurvivesRestart(t *testing.T) {

internal/emission/outbox.go

@@ -16,7 +16,7 @@ import (
 	"sync"
 	"time"
 
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 // ClassPrefix prefixes every decision event class; the suffix is the effect.

internal/emission/outbox_test.go

@@ -9,8 +9,8 @@ import (
 
 	"gopkg.in/yaml.v3"
 
-	"github.com/netkingdom/flex-auth/internal/emission"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/emission"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 func deny(id, tenant string) api.DecisionEnvelope {

internal/layer/conformance_test.go

@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/netkingdom/flex-auth/internal/layer"
+	"github.com/netkingdom/access-engine/internal/layer"
 	"gopkg.in/yaml.v3"
 )
 

internal/layer/survey_test.go

@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/netkingdom/flex-auth/internal/layer"
+	"github.com/netkingdom/access-engine/internal/layer"
 )
 
 func writeRepo(t *testing.T, root, name, intent, declFile string) {

internal/markitect/actions.go

@@ -1,6 +1,6 @@
 package markitect
 
-import "github.com/netkingdom/flex-auth/pkg/api"
+import "github.com/netkingdom/access-engine/pkg/api"
 
 const (
 	ActionRead            = "read"

internal/markitect/actions_test.go

@@ -4,8 +4,8 @@ import (
 	"slices"
 	"testing"
 
-	"github.com/netkingdom/flex-auth/internal/markitect"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/markitect"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 func TestActionVocabularySeparatesReadFromExport(t *testing.T) {

internal/markitect/check_fixtures_test.go

@@ -5,8 +5,8 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/netkingdom/flex-auth/internal/policy"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/policy"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 func TestMarkitectCheckFixturePackageValidates(t *testing.T) {

internal/markitect/decision.go

@@ -1,6 +1,6 @@
 package markitect
 
-import "github.com/netkingdom/flex-auth/pkg/api"
+import "github.com/netkingdom/access-engine/pkg/api"
 
 const (
 	GatewayEffectAllow       = "allow"

internal/markitect/decision_test.go

@@ -3,8 +3,8 @@ package markitect_test
 import (
 	"testing"
 
-	"github.com/netkingdom/flex-auth/internal/markitect"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/markitect"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 func TestGatewayDecisionAllowContract(t *testing.T) {

internal/markitect/importer.go

@@ -4,8 +4,8 @@ import (
 	"fmt"
 	"slices"
 
-	"github.com/netkingdom/flex-auth/internal/registry"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/registry"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 const (

internal/markitect/importer_test.go

@@ -7,9 +7,9 @@ import (
 
 	"gopkg.in/yaml.v3"
 
-	"github.com/netkingdom/flex-auth/internal/markitect"
-	"github.com/netkingdom/flex-auth/internal/registry"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/markitect"
+	"github.com/netkingdom/access-engine/internal/registry"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 func TestImportResourceManifestLoadsPinnedMarkitectShape(t *testing.T) {

internal/policy/attribute_reads.go

@@ -19,8 +19,8 @@ import (
 const undeclaredAttributeCode = "POLICY-ATTRIBUTE-UNDECLARED"
 
 var (
-	attrDot = regexp.MustCompile(`input\.(resource|subject)\.attributes\.([A-Za-z_][A-Za-z0-9_]*)`)
-	attrGet = regexp.MustCompile(`object\.get\(\s*input\.(resource|subject)\.attributes\s*,\s*"([A-Za-z_][A-Za-z0-9_]*)"`)
+	attrDot       = regexp.MustCompile(`input\.(resource|subject)\.attributes\.([A-Za-z_][A-Za-z0-9_]*)`)
+	attrGet       = regexp.MustCompile(`object\.get\(\s*input\.(resource|subject)\.attributes\s*,\s*"([A-Za-z_][A-Za-z0-9_]*)"`)
 	attrNestedGet = regexp.MustCompile(`object\.get\(\s*object\.get\(\s*input\.(resource|subject)\s*,\s*"attributes"\s*,\s*\{\}\s*\)\s*,\s*"([A-Za-z_][A-Za-z0-9_]*)"`)
 )
 

internal/policy/informed_decision_attribute_test.go

@@ -11,8 +11,8 @@ import (
 	"testing"
 	"time"
 
-	"github.com/netkingdom/flex-auth/internal/policy"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/policy"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 func TestInformedDecisionAttributeAdmission(t *testing.T) {

internal/policy/informed_decision_lifecycle_test.go

@@ -8,8 +8,8 @@ import (
 	"testing"
 	"time"
 
-	"github.com/netkingdom/flex-auth/internal/policy"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/policy"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 func TestInformedDecisionLifecycle(t *testing.T) {

internal/policy/informed_decision_t03_act_test.go

@@ -7,8 +7,8 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/netkingdom/flex-auth/internal/policy"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/policy"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 // v11 allows review acts on the three list-only T03 records at memo version 3.

internal/policy/informed_decision_wp0094_test.go

@@ -7,8 +7,8 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/netkingdom/flex-auth/internal/policy"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/policy"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 // v10 admits exactly the four STATE-WP-0094 sitting memos. Pins come from

internal/policy/package.go

@@ -14,7 +14,7 @@ import (
 	"github.com/open-policy-agent/opa/rego"
 	"gopkg.in/yaml.v3"
 
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 // Diagnostic is a validation message emitted while loading or evaluating a

internal/policy/package_test.go

@@ -10,8 +10,8 @@ import (
 
 	"gopkg.in/yaml.v3"
 
-	"github.com/netkingdom/flex-auth/internal/policy"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/policy"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 func TestLoadPolicyPackageMarkdownValidates(t *testing.T) {

internal/readback/readback.go

@@ -14,10 +14,10 @@ import (
 	"slices"
 	"strings"
 
-	decisioncore "github.com/netkingdom/flex-auth/internal/decision"
-	"github.com/netkingdom/flex-auth/internal/policy"
-	"github.com/netkingdom/flex-auth/internal/registry"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	decisioncore "github.com/netkingdom/access-engine/internal/decision"
+	"github.com/netkingdom/access-engine/internal/policy"
+	"github.com/netkingdom/access-engine/internal/registry"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 // ApplicationAccess is the only action the readback evaluates. A package takes

internal/registry/manifest_test.go

@@ -7,7 +7,7 @@ import (
 
 	"gopkg.in/yaml.v3"
 
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 func TestRegistryManifestsParse(t *testing.T) {

internal/registry/store.go

@@ -7,7 +7,7 @@ import (
 	"path/filepath"
 	"sort"
 
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 // Store is a deterministic local registry for standalone development and tests.

internal/registry/store_test.go

@@ -6,8 +6,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/netkingdom/flex-auth/internal/registry"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/registry"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 func TestStoreImportsManifests(t *testing.T) {

internal/sign/sign.go

@@ -9,7 +9,7 @@ import (
 	"encoding/json"
 	"fmt"
 
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 const AlgorithmEd25519 = "ed25519"

internal/sign/sign_test.go

@@ -7,8 +7,8 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/netkingdom/flex-auth/internal/sign"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/sign"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 // testdataSeed is a well-known non-production key. It exists so fixtures can

internal/sign/write_fixtures_test.go

@@ -6,8 +6,8 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/netkingdom/flex-auth/internal/sign"
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/internal/sign"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 func TestWriteReplaySignatureFixtures(t *testing.T) {

pkg/api/canonical_test.go

@@ -11,7 +11,7 @@ import (
 
 	"gopkg.in/yaml.v3"
 
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 func TestCaringAccessDescriptorExampleParses(t *testing.T) {

pkg/api/resource_manifest_test.go

@@ -7,7 +7,7 @@ import (
 
 	"gopkg.in/yaml.v3"
 
-	"github.com/netkingdom/flex-auth/pkg/api"
+	"github.com/netkingdom/access-engine/pkg/api"
 )
 
 // TestResourceManifestExampleParses is the golden test for the pinned

tools/check_layer_conformance.go

@@ -10,7 +10,7 @@ import (
 	"os"
 	"path/filepath"
 
-	"github.com/netkingdom/flex-auth/internal/layer"
+	"github.com/netkingdom/access-engine/internal/layer"
 )
 
 func main() {

tools/survey_layer_declarations.go

@@ -32,7 +32,7 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/netkingdom/flex-auth/internal/layer"
+	"github.com/netkingdom/access-engine/internal/layer"
 )
 
 // Security-relevant counterparts from docs/conformance/boundaries-review.md.

workplans/FLEX-WP-0036-runtime-rename-access-engine.md

@@ -86,7 +86,7 @@ names in the table still need the founder's acceptance.
 
 ```task
 id: FLEX-WP-0036-T02
-status: todo
+status: progress
 priority: high
 depends_on: [FLEX-WP-0036-T01]
 state_hub_task_id: "8f597899-677e-544b-ad58-26aab2614312"
@@ -105,6 +105,12 @@ from each owner.
 Gate: `docs/runtime-rename-inventory.md` with one row per reference and an
 owner handoff id per consumer.
 
+2026-10-10 inventory written. Handoff ids are not yet requested. They wait for
+T01, so each owner gets the exact new URL and audience in one message. Found
+that informed-decision's component tests and ops-warden's production smoke
+script run a binary whose path comes from an env var. A binary built from
+current source must now come from `./cmd/access-engine`.
+
 ## Make the PDP accept both names
 
 ```task
@@ -145,9 +151,16 @@ both resolve to the same digest.
 now `cmd/access-engine` and the image entrypoint is
 `/usr/local/bin/access-engine`. The image also ships the `flex-auth` stub.
 Updated: Makefile, CI, `tools/verify-posture.sh`, `tenancy.yaml` and the live
-docs. Workplans, decisions and ADRs are left as written. Still to do: the Go
-module, `FLEX_AUTH_*` env vars, the chart, the image package and the
-`/opt/flex-auth` paths.
+docs. Workplans, decisions and ADRs are left as written.
+
+2026-10-10 also done: Go module `github.com/netkingdom/access-engine`; no other
+repo imports it. `ACCESS_ENGINE_RUN_TOPAZ_INTEGRATION` replaces the only
+`FLEX_AUTH_*` variable, and the old name skips the test with a message naming
+the new one. README identity paragraph and title updated. Still to do, and
+deliberately left for T05: the chart name, because it changes selector labels,
+which are immutable on a `helm upgrade`, so it ships with the new releases.
+Also the image package and the `/opt/flex-auth` paths, which every live pin's
+args reference.
 
 ## Stand up the access-engine namespace next to flex-auth