# Runtime rename inventory (FLEX-WP-0036-T02)

Derived 2026-10-10 by searching each consumer checkout for `flex-auth` and
`FLEX_AUTH` in code and config (`.py .go .yaml .yml .toml .json .sh .ts`).
Git, venv, history and archived paths are excluded. Tests are listed only where
they run the binary. Historical evidence and batch files under `docs/` are
counted but are not to be rewritten: they record what was live at the time.

Re-derive before T06 with the same search. This is a snapshot, not a register.

## What a consumer has to change, by kind

| Kind | Breaks if changed before the PDP accepts it? | Order |
| --- | --- | --- |
| Service URL `flex-auth-<c>.flex-auth.svc…` | Yes: the new name resolves only once T05 has run | T05, then the consumer |
| Egress NetworkPolicy naming namespace `flex-auth` | Yes: drops traffic to the old pin | Add `access-engine`, switch, then remove `flex-auth` |
| Projected-token audience `flex-auth` | Yes: 401 until T03 accepts `access-engine` | T03, then the consumer |
| `resource.system` / `owner_repo` = `flex-auth` | Yes: `not_applicable`, i.e. deny (`FLEX-DEC-2026-015`) | T03, then the consumer |
| Consumer-owned env var names (`<C>_FLEX_AUTH_URL` …) | No: the consumer's own vocabulary | Consumer's choice; not required |
| Builds or runs our binary | Already changed (`FLEX-DEC-2026-020`): the stub exits 2 | Consumer builds `./cmd/access-engine` |

## Per consumer

### ops-warden

Live pins: `flex-auth-ops-warden` (sign), `flex-auth-ops-warden-fetch`.

- URLs: `examples/warden.production.example.yaml` (sign and fetch); live
  config under the operator. Workstation tunnels
  `flex-auth-ops-warden-railiance01` (:19090) and
  `flex-auth-ops-warden-fetch-railiance01` (:19091) in ops-bridge
  `tunnels.yaml` point at ClusterIPs, which change with the new Services.
- Audience: `examples/warden.production.example.yaml`.
- `resource.system`: lane `flex-auth-policy-check`, `owner_repo: flex-auth`
  in `registry/routing/catalog.yaml`.
- Binary: `scripts/policy_gate_production_smoke.sh` (`FLEX_AUTH_BIN`,
  default `/tmp/flex-auth`).
- Also: `scripts/build_flex_auth_registry.py`,
  `scripts/check_flex_auth_manifest_coverage.py`, `pep-stance.yaml`,
  `layer.yaml`, `tenancy.yaml`, and `src/warden/{policy,access,caller_identity}.py`.
  These are names, not runtime addresses.

### secrets-engine

Live pin: `flex-auth-secrets-engine`.

- URLs appear in docs and tests only. secrets-engine is a CLI, and its
  operator access path is still open (`FLEX-WP-0023`).
- Binary: `tools/exercise_approval_identity.py` builds `./cmd/flex-auth`
  (notified 2026-10-10, message `ad4b1b3e`).
- `pep-stance.yaml` names the PDP.

### user-engine (deployment sources in net-kingdom)

Live pins: `flex-auth-user-engine` (check), `flex-auth-application-readback`.

- URL, audience and egress: `net-kingdom/sso-mfa/k8s/user-engine/runtime.yaml`
  (`USER_ENGINE_FLEX_AUTH_URL`, token audience `flex-auth`, egress namespace
  `flex-auth`), plus the readback URL promised on 2026-10-10 (message
  `5460cee2`).
- Env vars: `USER_ENGINE_FLEX_AUTH_{URL,TOKEN_FILE,TIMEOUT}` and
  `USER_ENGINE_READBACK_TOKEN_FILE` in `src/user_engine/runtime.py` and
  `adapters/local.py`. These are the consumer's own names.

### tenant-engine

Live pin: `flex-auth-tenant-engine`.

- URL, audience and egress: `deploy/base/tenant-engine.yaml`, `railiance/app.toml`.
- Env vars: `TENANT_ENGINE_FLEX_AUTH_{URL,TOKEN_FILE,TIMEOUT_SECONDS}` in
  `src/tenant_engine/config.py`; `pep-stance.yaml`.

### informed-decision

Live pins: `flex-auth-informed-decision-lifecycle`, `-sitting`, `-t03`.

- URLs and audience: `deploy/sitting-admission.json`, `deploy/t03-admission.json`,
  `deploy/lifecycle/{admission,service}.candidate.json`, and
  `tools/render_deployment.py`. The live egress policy `informed-decision-review`
  names namespace `flex-auth`.
- Binary: `tests/browser_fixture.py`, `tests/test_lifecycle_policy_component.py`,
  `tests/test_review_component.py` and `tests/test_lifecycle_review.py` take
  `INFD_FLEX_AUTH_BINARY` / `INFD_FLEX_AUTH_SOURCE`. A binary built from current
  source must come from `./cmd/access-engine`. Doc
  `docs/protected-browser-review.md` notified (message `9b15c762`).
- `docs/batches/**` and `docs/evidence/**` are historical. Leave them.

### net-kingdom

- Owns user-engine's deployment source (above).
- `runbooks/protected-system-flex-auth/pack.yaml` and
  `docs/tutorials/protected-system-flex-auth.md` run `go run ./cmd/flex-auth`
  (notified, message `e2f1aac9`).

### Others with references, not consumers of a pin

- `state-hub/repository_rename_workplan.py`: tooling from `FLEX-WP-0020`.
- `railiance-platform/scripts/credential.py`: `FLEX_AUTH_{URL,PATH,SUBJECT_TYPES}`.
  Check whether it calls a live pin before T06.
- `the-custodian`: docs only.
- Hub repo record `local_path` is `/home/worsch/flex-auth`, but the checkout is
  `/home/worsch/access-engine` (`FLEX-WP-0020-T11` residual).

## Owner handoffs

Requested after T01 fixes the target names, so each owner gets one message
with the exact new URL and audience: `ops-warden`, `secrets-engine`,
`user-engine` with `net-kingdom`, `tenant-engine`, and `informed-decision`.


## Deterministic consumer readiness check (2026-10-11, T06)

Run `python3 tools/verify_runtime_consumer_migration.py --estate-root /home/worsch`.
The class parses only the bounded public inventory source paths as YAML/JSON,
TOML or Python literal strings, excludes comments and records file SHA256s.
It emits exact old/new pin origins, source-owner handoff responsibilities and
source migration phases. It never marks native readiness or closes a task.
Unsigned completion flags, source URL strings and a missing log are not live
proof. Operator configuration, ops-bridge ClusterIP tunnels and Secrets CLI
runtime selection remain owner evidence requirements; no private operator
configuration or credentials are read by this tool.

The 2026-10-11 re-derivation found remaining owner source work for ops-warden,
secrets-engine, user-engine with net-kingdom, tenant-engine and informed-decision.
No new endpoint appeared in these bounded files. The five owner handoffs are
prepared by the report, not sent or claimed acknowledged. Source owners first
retain old egress while adding the new namespace, then change one consumer's
endpoint and projected audience after T02/T05 and ordered live prerequisites.
Each new pin needs authenticated allow/deny and exact deployed revision/digest
correspondence; old-twin logs need an explicit observation interval and
no-traffic/soak evidence before old egress removal or T07 retirement.

The earlier `flex-auth-policy-check` catalogue example is a policy routing lane,
not a secret-fetch package lane. Its naming migration does not authorize adding
PDP-self resource systems to packages that govern other protected consumers.
T05's nine new TokenReview ServiceAccount grants are a separate red daily-batch
item. This report does not authorize those grants or the consumer changes.