# Runtime rename inventory (FLEX-WP-0036-T02)

Derived 2026-10-10 by searching each consumer checkout for `flex-auth` and
`FLEX_AUTH` in code and config (`.py .go .yaml .yml .toml .json .sh .ts`).
Git, venv, history and archived paths are excluded. Tests are listed only where
they run the binary. Historical evidence and batch files under `docs/` are
counted but are not to be rewritten: they record what was live at the time.

Re-derive before T06 with the same search. This is a snapshot, not a register.

## What a consumer has to change, by kind

| Kind | Breaks if changed before the PDP accepts it? | Order |
| --- | --- | --- |
| Service URL `flex-auth-<c>.flex-auth.svc…` | Yes: the new name resolves only once T05 has run | T05, then the consumer |
| Egress NetworkPolicy naming namespace `flex-auth` | Yes: drops traffic to the old pin | Add `access-engine`, switch, then remove `flex-auth` |
| Projected-token audience `flex-auth` | Yes: 401 until T03 accepts `access-engine` | T03, then the consumer |
| `resource.system` / `owner_repo` = `flex-auth` | Yes: `not_applicable`, i.e. deny (`FLEX-DEC-2026-015`) | T03, then the consumer |
| Consumer-owned env var names (`<C>_FLEX_AUTH_URL` …) | No: the consumer's own vocabulary | Consumer's choice; not required |
| Builds or runs our binary | Already changed (`FLEX-DEC-2026-020`): the stub exits 2 | Consumer builds `./cmd/access-engine` |

## Per consumer

### ops-warden

Live pins: `flex-auth-ops-warden` (sign), `flex-auth-ops-warden-fetch`.

- URLs: `examples/warden.production.example.yaml` (sign and fetch); live
  config under the operator. Workstation tunnels
  `flex-auth-ops-warden-railiance01` (:19090) and
  `flex-auth-ops-warden-fetch-railiance01` (:19091) in ops-bridge
  `tunnels.yaml` point at ClusterIPs, which change with the new Services.
- Audience: `examples/warden.production.example.yaml`.
- `resource.system`: lane `flex-auth-policy-check`, `owner_repo: flex-auth`
  in `registry/routing/catalog.yaml`.
- Binary: `scripts/policy_gate_production_smoke.sh` (`FLEX_AUTH_BIN`,
  default `/tmp/flex-auth`).
- Also: `scripts/build_flex_auth_registry.py`,
  `scripts/check_flex_auth_manifest_coverage.py`, `pep-stance.yaml`,
  `layer.yaml`, `tenancy.yaml`, and `src/warden/{policy,access,caller_identity}.py`.
  These are names, not runtime addresses.

### secrets-engine

Live pin: `flex-auth-secrets-engine`.

- URLs appear in docs and tests only. secrets-engine is a CLI, and its
  operator access path is still open (`FLEX-WP-0023`).
- Binary: `tools/exercise_approval_identity.py` builds `./cmd/flex-auth`
  (notified 2026-10-10, message `ad4b1b3e`).
- `pep-stance.yaml` names the PDP.

### user-engine (deployment sources in net-kingdom)

Live pins: `flex-auth-user-engine` (check), `flex-auth-application-readback`.

- URL, audience and egress: `net-kingdom/sso-mfa/k8s/user-engine/runtime.yaml`
  (`USER_ENGINE_FLEX_AUTH_URL`, token audience `flex-auth`, egress namespace
  `flex-auth`), plus the readback URL promised on 2026-10-10 (message
  `5460cee2`).
- Env vars: `USER_ENGINE_FLEX_AUTH_{URL,TOKEN_FILE,TIMEOUT}` and
  `USER_ENGINE_READBACK_TOKEN_FILE` in `src/user_engine/runtime.py` and
  `adapters/local.py`. These are the consumer's own names.

### tenant-engine

Live pin: `flex-auth-tenant-engine`.

- URL, audience and egress: `deploy/base/tenant-engine.yaml`, `railiance/app.toml`.
- Env vars: `TENANT_ENGINE_FLEX_AUTH_{URL,TOKEN_FILE,TIMEOUT_SECONDS}` in
  `src/tenant_engine/config.py`; `pep-stance.yaml`.

### informed-decision

Live pins: `flex-auth-informed-decision-lifecycle`, `-sitting`, `-t03`.

- URLs and audience: `deploy/sitting-admission.json`, `deploy/t03-admission.json`,
  `deploy/lifecycle/{admission,service}.candidate.json`, and
  `tools/render_deployment.py`. The live egress policy `informed-decision-review`
  names namespace `flex-auth`.
- Binary: `tests/browser_fixture.py`, `tests/test_lifecycle_policy_component.py`,
  `tests/test_review_component.py` and `tests/test_lifecycle_review.py` take
  `INFD_FLEX_AUTH_BINARY` / `INFD_FLEX_AUTH_SOURCE`. A binary built from current
  source must come from `./cmd/access-engine`. Doc
  `docs/protected-browser-review.md` notified (message `9b15c762`).
- `docs/batches/**` and `docs/evidence/**` are historical. Leave them.

### net-kingdom

- Owns user-engine's deployment source (above).
- `runbooks/protected-system-flex-auth/pack.yaml` and
  `docs/tutorials/protected-system-flex-auth.md` run `go run ./cmd/flex-auth`
  (notified, message `e2f1aac9`).

### Others with references, not consumers of a pin

- `state-hub/repository_rename_workplan.py`: tooling from `FLEX-WP-0020`.
- `railiance-platform/scripts/credential.py`: `FLEX_AUTH_{URL,PATH,SUBJECT_TYPES}`.
  Check whether it calls a live pin before T06.
- `the-custodian`: docs only.
- Hub repo record `local_path` is `/home/worsch/flex-auth`, but the checkout is
  `/home/worsch/access-engine` (`FLEX-WP-0020-T11` residual).

## Owner handoffs

Requested after T01 fixes the target names, so each owner gets one message
with the exact new URL and audience: `ops-warden`, `secrets-engine`,
`user-engine` with `net-kingdom`, `tenant-engine`, and `informed-decision`.