FLEX-WP-0036: Go module is github.com/netkingdom/access-engine; T02 consumer inventory

- module path renamed (no external importers); golangci local-prefixes
- ACCESS_ENGINE_RUN_TOPAZ_INTEGRATION replaces FLEX_AUTH_RUN_TOPAZ_INTEGRATION
- README title and identity paragraph reflect the landed renames
- docs/runtime-rename-inventory.md: per-consumer references by kind and order
- chart name, image package and /opt paths deliberately left for T05

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 735967@bnt-lap001
Assistant-Session: 5971967f-77f8-4ced-9e02-c6ef67040ffc

docs/runtime-rename-inventory.md

@@ -0,0 +1,108 @@
+# Runtime rename inventory (FLEX-WP-0036-T02)
+
+Derived 2026-10-10 by searching each consumer checkout for `flex-auth` and
+`FLEX_AUTH` in code and config (`.py .go .yaml .yml .toml .json .sh .ts`).
+Git, venv, history and archived paths are excluded. Tests are listed only where
+they run the binary. Historical evidence and batch files under `docs/` are
+counted but are not to be rewritten: they record what was live at the time.
+
+Re-derive before T06 with the same search. This is a snapshot, not a register.
+
+## What a consumer has to change, by kind
+
+| Kind | Breaks if changed before the PDP accepts it? | Order |
+| --- | --- | --- |
+| Service URL `flex-auth-<c>.flex-auth.svc…` | Yes: the new name resolves only once T05 has run | T05, then the consumer |
+| Egress NetworkPolicy naming namespace `flex-auth` | Yes: drops traffic to the old pin | Add `access-engine`, switch, then remove `flex-auth` |
+| Projected-token audience `flex-auth` | Yes: 401 until T03 accepts `access-engine` | T03, then the consumer |
+| `resource.system` / `owner_repo` = `flex-auth` | Yes: `not_applicable`, i.e. deny (`FLEX-DEC-2026-015`) | T03, then the consumer |
+| Consumer-owned env var names (`<C>_FLEX_AUTH_URL` …) | No: the consumer's own vocabulary | Consumer's choice; not required |
+| Builds or runs our binary | Already changed (`FLEX-DEC-2026-020`): the stub exits 2 | Consumer builds `./cmd/access-engine` |
+
+## Per consumer
+
+### ops-warden
+
+Live pins: `flex-auth-ops-warden` (sign), `flex-auth-ops-warden-fetch`.
+
+- URLs: `examples/warden.production.example.yaml` (sign and fetch); live
+  config under the operator. Workstation tunnels
+  `flex-auth-ops-warden-railiance01` (:19090) and
+  `flex-auth-ops-warden-fetch-railiance01` (:19091) in ops-bridge
+  `tunnels.yaml` point at ClusterIPs, which change with the new Services.
+- Audience: `examples/warden.production.example.yaml`.
+- `resource.system`: lane `flex-auth-policy-check`, `owner_repo: flex-auth`
+  in `registry/routing/catalog.yaml`.
+- Binary: `scripts/policy_gate_production_smoke.sh` (`FLEX_AUTH_BIN`,
+  default `/tmp/flex-auth`).
+- Also: `scripts/build_flex_auth_registry.py`,
+  `scripts/check_flex_auth_manifest_coverage.py`, `pep-stance.yaml`,
+  `layer.yaml`, `tenancy.yaml`, and `src/warden/{policy,access,caller_identity}.py`.
+  These are names, not runtime addresses.
+
+### secrets-engine
+
+Live pin: `flex-auth-secrets-engine`.
+
+- URLs appear in docs and tests only. secrets-engine is a CLI, and its
+  operator access path is still open (`FLEX-WP-0023`).
+- Binary: `tools/exercise_approval_identity.py` builds `./cmd/flex-auth`
+  (notified 2026-10-10, message `ad4b1b3e`).
+- `pep-stance.yaml` names the PDP.
+
+### user-engine (deployment sources in net-kingdom)
+
+Live pins: `flex-auth-user-engine` (check), `flex-auth-application-readback`.
+
+- URL, audience and egress: `net-kingdom/sso-mfa/k8s/user-engine/runtime.yaml`
+  (`USER_ENGINE_FLEX_AUTH_URL`, token audience `flex-auth`, egress namespace
+  `flex-auth`), plus the readback URL promised on 2026-10-10 (message
+  `5460cee2`).
+- Env vars: `USER_ENGINE_FLEX_AUTH_{URL,TOKEN_FILE,TIMEOUT}` and
+  `USER_ENGINE_READBACK_TOKEN_FILE` in `src/user_engine/runtime.py` and
+  `adapters/local.py`. These are the consumer's own names.
+
+### tenant-engine
+
+Live pin: `flex-auth-tenant-engine`.
+
+- URL, audience and egress: `deploy/base/tenant-engine.yaml`, `railiance/app.toml`.
+- Env vars: `TENANT_ENGINE_FLEX_AUTH_{URL,TOKEN_FILE,TIMEOUT_SECONDS}` in
+  `src/tenant_engine/config.py`; `pep-stance.yaml`.
+
+### informed-decision
+
+Live pins: `flex-auth-informed-decision-lifecycle`, `-sitting`, `-t03`.
+
+- URLs and audience: `deploy/sitting-admission.json`, `deploy/t03-admission.json`,
+  `deploy/lifecycle/{admission,service}.candidate.json`, and
+  `tools/render_deployment.py`. The live egress policy `informed-decision-review`
+  names namespace `flex-auth`.
+- Binary: `tests/browser_fixture.py`, `tests/test_lifecycle_policy_component.py`,
+  `tests/test_review_component.py` and `tests/test_lifecycle_review.py` take
+  `INFD_FLEX_AUTH_BINARY` / `INFD_FLEX_AUTH_SOURCE`. A binary built from current
+  source must come from `./cmd/access-engine`. Doc
+  `docs/protected-browser-review.md` notified (message `9b15c762`).
+- `docs/batches/**` and `docs/evidence/**` are historical. Leave them.
+
+### net-kingdom
+
+- Owns user-engine's deployment source (above).
+- `runbooks/protected-system-flex-auth/pack.yaml` and
+  `docs/tutorials/protected-system-flex-auth.md` run `go run ./cmd/flex-auth`
+  (notified, message `e2f1aac9`).
+
+### Others with references, not consumers of a pin
+
+- `state-hub/repository_rename_workplan.py`: tooling from `FLEX-WP-0020`.
+- `railiance-platform/scripts/credential.py`: `FLEX_AUTH_{URL,PATH,SUBJECT_TYPES}`.
+  Check whether it calls a live pin before T06.
+- `the-custodian`: docs only.
+- Hub repo record `local_path` is `/home/worsch/flex-auth`, but the checkout is
+  `/home/worsch/access-engine` (`FLEX-WP-0020-T11` residual).
+
+## Owner handoffs
+
+Requested after T01 fixes the target names, so each owner gets one message
+with the exact new URL and audience: `ops-warden`, `secrets-engine`,
+`user-engine` with `net-kingdom`, `tenant-engine`, and `informed-decision`.

docs/topaz-adapter-operations.md

@@ -50,7 +50,7 @@ docker compose up --abort-on-container-exit --exit-code-from probe
 The Go integration test is present but skipped by default. Run it with:
 
 ```sh
-FLEX_AUTH_RUN_TOPAZ_INTEGRATION=1 go test ./internal/adapters/topaz
+ACCESS_ENGINE_RUN_TOPAZ_INTEGRATION=1 go test ./internal/adapters/topaz
 ```
 
 ## Directory Consistency