--- id: FLEX-WP-0036 type: workplan title: "Runtime rename: flex-auth to access-engine, run side by side, consumers switch one at a time" domain: infotech repo: access-engine status: active owner: claude topic_slug: netkingdom created: "2026-10-10" updated: "2026-10-10" origin: demand origin_ref: founder 2026-10-10 ("the relicts are too disorienting") related: [FLEX-WP-0020] state_hub_workstream_id: "af0f8d77-af04-569b-8e79-6c47eb8f1087" --- `FLEX-WP-0020` renamed the repository only. `FLEX-DEC-2026-013` kept every runtime name as `flex-auth` and deferred a product/runtime rebrand to "a later workplan after soak". This is that workplan. The founder asked for it on 2026-10-10 because a repo called `access-engine` that deploys, builds, logs and authenticates as `flex-auth` disorients every agent that works on it. `FLEX-WP-0020-T11` (the soak) is still open. This plan does not wait for it to start drafting, but T06 onward must not apply until T11 closes. ## What is renamed | Surface | Today | Target | Who has to act | | --- | --- | --- | --- | | Kubernetes namespace | `flex-auth` | `access-engine` | operator | | Deployments, Services, SAs, NetworkPolicies, Helm releases | `flex-auth-` (9 pins) | `access-engine-` | operator | | TokenReview ClusterRoleBindings | `flex-auth-*-tokenreviewer` (9) | `access-engine-*-tokenreviewer` | operator | | Service DNS consumers call | `flex-auth-.flex-auth.svc.cluster.local.` | `access-engine-.access-engine.svc.cluster.local.` | each consumer | | Consumer egress NetworkPolicies | name namespace `flex-auth` | `access-engine` | `informed-decision`, `tenant-engine`, `user-engine` (net-kingdom `sso-mfa/k8s`) | | Caller token audience | `flex-auth` | `access-engine` | PDP first, then each consumer | | `resource.system` naming the PDP itself | `flex-auth` (ops-warden lane `flex-auth-policy-check`) | `access-engine` | PDP first, then ops-warden (`FLEX-DEC-2026-015`) | | Container package | `coulomb/flex-auth` | `coulomb/access-engine` | this repo + Forgejo operator | | Helm chart | `charts/flex-auth` | `charts/access-engine` | this repo | | Go module, `cmd/`, binary | `github.com/netkingdom/flex-auth`, `flex-auth` | `.../access-engine`, `access-engine` | this repo; external callers of the binary | | Env vars | `FLEX_AUTH_*` | `ACCESS_ENGINE_*` | this repo | | Prose: SCOPE, INTENT, docs, canon, routing catalog | `flex-auth` | `access-engine` | this repo, net-kingdom, ops-warden | Not renamed: the `FLEX-WP-`, `FLEX-DEC-` and `FLEX-IN-` id prefixes, all State Hub UUIDs, and historical records (decision logs, archived workplans, decision records already emitted). Each of those names what existed at the time it was written. ## Rules for every task 1. **Run side by side, never rename in place.** Renaming a namespace, Service or audience in place cuts off every consumer still using the old name. That is a fail-closed outage nobody decided on. Each new `access-engine-*` pin is started next to its `flex-auth-*` twin at the same image digest, and the twin is retired only after its consumer has switched. 2. **The PDP accepts the new value before any consumer sends it** (`FLEX-DEC-2026-015`): ship acceptance of both values first, then let consumers flip, then retire the old value. 3. **One consumer at a time.** Each consumer switches on its own schedule and under its own owner's work record. This plan records the handoff id and waits for evidence. It never closes a task owned by another repo. 4. **Every live step needs the founder's go**, per pin, as T04 of `FLEX-WP-0035` did. ## Decide the target names and supersede the retain table ```task id: FLEX-WP-0036-T01 status: progress priority: high state_hub_task_id: "4f9a796d-832f-5936-8a34-eb980f6e1b57" ``` Record `FLEX-DEC-2026-021`: runtime names move to `access-engine`, following the table above. It supersedes the runtime rows of `FLEX-DEC-2026-013`. Fix the namespace, release and DNS pattern, the audience value, and the `resource.system` value. Settle the binary question: rename it outright, or ship `access-engine` with a `flex-auth` alias for one release. Gate: decision accepted by the founder. 2026-10-10: binary settled by `FLEX-DEC-2026-020` (founder): renamed outright, `flex-auth` is a stub that prints the rename and exits 2. The other target names in the table still need the founder's acceptance. ## Inventory every consumer reference and open handoffs ```task id: FLEX-WP-0036-T02 status: progress priority: high depends_on: [FLEX-WP-0036-T01] state_hub_task_id: "8f597899-677e-544b-ad58-26aab2614312" ``` For each consumer, list every place that names the runtime: URL, audience, egress policy, routing catalog entries, scripts, tests, stance maps, and the `resource.system` value. Known consumers: `ops-warden` (two pins, plus `flex-auth-policy-check`, registry and manifest scripts), `secrets-engine`, `user-engine` (two pins: check and readback), `tenant-engine`, `informed-decision` (lifecycle, sitting and t03 pins), and `net-kingdom` (`sso-mfa/k8s/**`). Also check the State Hub, `state-hub` CLI and `railiance-fabric` discovery for runtime names. Request one work-record id from each owner. Gate: `docs/runtime-rename-inventory.md` with one row per reference and an owner handoff id per consumer. 2026-10-10 inventory written. Handoff ids are not yet requested. They wait for T01, so each owner gets the exact new URL and audience in one message. Found that informed-decision's component tests and ops-warden's production smoke script run a binary whose path comes from an env var. A binary built from current source must now come from `./cmd/access-engine`. ## Make the PDP accept both names ```task id: FLEX-WP-0036-T03 status: todo priority: high depends_on: [FLEX-WP-0036-T01] state_hub_task_id: "487525e5-c89e-586e-8e9b-54ac6da0804e" ``` Caller auth accepts `access-engine` and `flex-auth` audiences, and packages and caller bindings accept both `resource.system` values. Decision records must still state which value the request carried, so nothing is rewritten silently. Add tests for both values on every pin's package. Gate: tests; a new image rolled to the existing `flex-auth-*` pins with the founder's go. ## Rename the source ```task id: FLEX-WP-0036-T04 status: progress priority: medium depends_on: [FLEX-WP-0036-T01] state_hub_task_id: "ff7fd369-326f-5044-aaa4-96c5f45c80e9" ``` Go module, `cmd/access-engine`, binary, `ACCESS_ENGINE_*` env vars (read the old names for one release, with a warning), `charts/access-engine`, and CI publishing to `coulomb/access-engine`. Publish to `coulomb/flex-auth` too until T07 is done, so the old pins can still roll back. No runtime change. Gate: build, tests and stage-1 render green; CI publishes both packages, and both resolve to the same digest. 2026-10-10 binary part done ahead of the rest (`FLEX-DEC-2026-020`). The CLI is now `cmd/access-engine` and the image entrypoint is `/usr/local/bin/access-engine`. The image also ships the `flex-auth` stub. Updated: Makefile, CI, `tools/verify-posture.sh`, `tenancy.yaml` and the live docs. Workplans, decisions and ADRs are left as written. 2026-10-10 also done: Go module `github.com/netkingdom/access-engine`; no other repo imports it. `ACCESS_ENGINE_RUN_TOPAZ_INTEGRATION` replaces the only `FLEX_AUTH_*` variable, and the old name skips the test with a message naming the new one. README identity paragraph and title updated. Still to do, and deliberately left for T05: the chart name, because it changes selector labels, which are immutable on a `helm upgrade`, so it ships with the new releases. Also the image package and the `/opt/flex-auth` paths, which every live pin's args reference. ## Stand up the access-engine namespace next to flex-auth ```task id: FLEX-WP-0036-T05 status: todo priority: medium depends_on: [FLEX-WP-0036-T03, FLEX-WP-0036-T04] state_hub_task_id: "13b93d7a-8341-5c76-9ae8-0f36b45b10fc" ``` Create the `access-engine` namespace, then one `access-engine-` pin for each live `flex-auth-` pin. Each new pin runs the same image digest and package as its twin and gets its own TokenReview binding. Ingress admits the same consumer as the twin does. Extend `TestReadbackPinMatchesParticipantPins` to cover the new pins, and add a test that each twin pair runs the same digest. Gate: every new pin Ready, `/healthz` 200, anonymous requests 401; founder go. Blocked on `FLEX-WP-0020-T11` closing. ## Consumers switch over, one at a time ```task id: FLEX-WP-0036-T06 status: todo priority: medium depends_on: [FLEX-WP-0036-T02, FLEX-WP-0036-T05] state_hub_task_id: "f0470e5c-3ea7-506c-b8bb-3ade0b57ff88" ``` Each consumer changes its URL, its egress policy (add the new namespace before removing the old one), its audience and, for ops-warden, `owner_repo`. One row per consumer in the inventory, closed with that owner's evidence: a live allow and a live deny against the new pin, and no traffic left on the twin (from twin logs). Gate: every inventory row closed with owner evidence. ## Retire the flex-auth runtime ```task id: FLEX-WP-0036-T07 status: todo priority: medium depends_on: [FLEX-WP-0036-T06] state_hub_task_id: "e46c9c8e-a114-5c49-b035-22fdbd6a435b" ``` After a soak with no traffic on the old pins: uninstall each `flex-auth-*` release and its TokenReview binding, delete the `flex-auth` namespace, drop the old audience and `resource.system` from acceptance (`FLEX-DEC-2026-015` order), and stop publishing `coulomb/flex-auth`. Keep the flattened emergency manifests in `deploy/` only as rewritten for the new names. Gate: founder go; `kubectl get ns flex-auth` NotFound; every consumer's checks still allow and deny as expected. ## Prose, canon and layer declaration ```task id: FLEX-WP-0036-T08 status: todo priority: low depends_on: [FLEX-WP-0036-T06] state_hub_task_id: "be5440aa-4584-5e4f-9459-242ecf5c7199" ``` SCOPE, INTENT and its layer declaration, the conformance doc, the stance register reviews, `.claude/rules`, the `deploy/` and `railiance/` READMEs, `railiance/app.toml`, and `ops-warden`'s routing catalog and credential-routing canon. Raise the canon-naming item (`FLEX-WP-0030` B5) as closed. Historical records stay as written. Gate: `grep -rn flex-auth` over live docs returns only historical records and deliberate notes about the old name.