access-engine/workplans/FLEX-WP-0036-runtime-rename-access-engine.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	origin	origin_ref	related	state_hub_workstream_id
FLEX-WP-0036	workplan	Runtime rename: flex-auth to access-engine, run side by side, consumers switch one at a time	infotech	access-engine	active	claude	netkingdom	2026-10-10	2026-10-10	demand	founder 2026-10-10 ("the relicts are too disorienting")	FLEX-WP-0020	af0f8d77-af04-569b-8e79-6c47eb8f1087

FLEX-WP-0020 renamed the repository only. FLEX-DEC-2026-013 kept every runtime name as flex-auth and deferred a product/runtime rebrand to "a later workplan after soak". This is that workplan. The founder asked for it on 2026-10-10 because a repo called access-engine that deploys, builds, logs and authenticates as flex-auth disorients every agent that works on it. FLEX-WP-0020-T11 (the soak) is still open. This plan does not wait for it to start drafting, but T06 onward must not apply until T11 closes.

What is renamed

Surface	Today	Target	Who has to act
Kubernetes namespace	flex-auth	access-engine	operator
Deployments, Services, SAs, NetworkPolicies, Helm releases	flex-auth-<consumer> (9 pins)	access-engine-<consumer>	operator
TokenReview ClusterRoleBindings	flex-auth-*-tokenreviewer (9)	access-engine-*-tokenreviewer	operator
Service DNS consumers call	flex-auth-<c>.flex-auth.svc.cluster.local.	access-engine-<c>.access-engine.svc.cluster.local.	each consumer
Consumer egress NetworkPolicies	name namespace flex-auth	access-engine	informed-decision, tenant-engine, user-engine (net-kingdom sso-mfa/k8s)
Caller token audience	flex-auth	access-engine	PDP first, then each consumer
resource.system naming the PDP itself	flex-auth (ops-warden lane flex-auth-policy-check)	access-engine	PDP first, then ops-warden (FLEX-DEC-2026-015)
Container package	coulomb/flex-auth	coulomb/access-engine	this repo + Forgejo operator
Helm chart	charts/flex-auth	charts/access-engine	this repo
Go module, cmd/, binary	github.com/netkingdom/flex-auth, flex-auth	.../access-engine, access-engine	this repo; external callers of the binary
Env vars	FLEX_AUTH_*	ACCESS_ENGINE_*	this repo
Prose: SCOPE, INTENT, docs, canon, routing catalog	flex-auth	access-engine	this repo, net-kingdom, ops-warden

Not renamed: the FLEX-WP-, FLEX-DEC- and FLEX-IN- id prefixes, all State Hub UUIDs, and historical records (decision logs, archived workplans, decision records already emitted). Each of those names what existed at the time it was written.

Rules for every task

1. Run side by side, never rename in place. Renaming a namespace, Service or audience in place cuts off every consumer still using the old name. That is a fail-closed outage nobody decided on. Each new access-engine-* pin is started next to its flex-auth-* twin at the same image digest, and the twin is retired only after its consumer has switched.
2. The PDP accepts the new value before any consumer sends it (FLEX-DEC-2026-015): ship acceptance of both values first, then let consumers flip, then retire the old value.
3. One consumer at a time. Each consumer switches on its own schedule and under its own owner's work record. This plan records the handoff id and waits for evidence. It never closes a task owned by another repo.
4. Every live step needs the founder's go, per pin, as T04 of FLEX-WP-0035 did.

Decide the target names and supersede the retain table

id: FLEX-WP-0036-T01
status: progress
priority: high
state_hub_task_id: "4f9a796d-832f-5936-8a34-eb980f6e1b57"

Record FLEX-DEC-2026-021: runtime names move to access-engine, following the table above. It supersedes the runtime rows of FLEX-DEC-2026-013. Fix the namespace, release and DNS pattern, the audience value, and the resource.system value. Settle the binary question: rename it outright, or ship access-engine with a flex-auth alias for one release.

Gate: decision accepted by the founder.

2026-10-10: binary settled by FLEX-DEC-2026-020 (founder): renamed outright, flex-auth is a stub that prints the rename and exits 2. The other target names in the table still need the founder's acceptance.

Inventory every consumer reference and open handoffs

id: FLEX-WP-0036-T02
status: progress
priority: high
depends_on: [FLEX-WP-0036-T01]
state_hub_task_id: "8f597899-677e-544b-ad58-26aab2614312"

For each consumer, list every place that names the runtime: URL, audience, egress policy, routing catalog entries, scripts, tests, stance maps, and the resource.system value. Known consumers: ops-warden (two pins, plus flex-auth-policy-check, registry and manifest scripts), secrets-engine, user-engine (two pins: check and readback), tenant-engine, informed-decision (lifecycle, sitting and t03 pins), and net-kingdom (sso-mfa/k8s/**). Also check the State Hub, state-hub CLI and railiance-fabric discovery for runtime names. Request one work-record id from each owner.

Gate: docs/runtime-rename-inventory.md with one row per reference and an owner handoff id per consumer.

2026-10-10 inventory written. Handoff ids are not yet requested. They wait for T01, so each owner gets the exact new URL and audience in one message. Found that informed-decision's component tests and ops-warden's production smoke script run a binary whose path comes from an env var. A binary built from current source must now come from ./cmd/access-engine.

Make the PDP accept both names

id: FLEX-WP-0036-T03
status: todo
priority: high
depends_on: [FLEX-WP-0036-T01]
state_hub_task_id: "487525e5-c89e-586e-8e9b-54ac6da0804e"

Caller auth accepts access-engine and flex-auth audiences, and packages and caller bindings accept both resource.system values. Decision records must still state which value the request carried, so nothing is rewritten silently. Add tests for both values on every pin's package.

Gate: tests; a new image rolled to the existing flex-auth-* pins with the founder's go.

Rename the source

id: FLEX-WP-0036-T04
status: progress
priority: medium
depends_on: [FLEX-WP-0036-T01]
state_hub_task_id: "ff7fd369-326f-5044-aaa4-96c5f45c80e9"

Go module, cmd/access-engine, binary, ACCESS_ENGINE_* env vars (read the old names for one release, with a warning), charts/access-engine, and CI publishing to coulomb/access-engine. Publish to coulomb/flex-auth too until T07 is done, so the old pins can still roll back. No runtime change.

Gate: build, tests and stage-1 render green; CI publishes both packages, and both resolve to the same digest.

2026-10-10 binary part done ahead of the rest (FLEX-DEC-2026-020). The CLI is now cmd/access-engine and the image entrypoint is /usr/local/bin/access-engine. The image also ships the flex-auth stub. Updated: Makefile, CI, tools/verify-posture.sh, tenancy.yaml and the live docs. Workplans, decisions and ADRs are left as written.

2026-10-10 also done: Go module github.com/netkingdom/access-engine; no other repo imports it. ACCESS_ENGINE_RUN_TOPAZ_INTEGRATION replaces the only FLEX_AUTH_* variable, and the old name skips the test with a message naming the new one. README identity paragraph and title updated. Still to do, and deliberately left for T05: the chart name, because it changes selector labels, which are immutable on a helm upgrade, so it ships with the new releases. Also the image package and the /opt/flex-auth paths, which every live pin's args reference.

Stand up the access-engine namespace next to flex-auth

id: FLEX-WP-0036-T05
status: todo
priority: medium
depends_on: [FLEX-WP-0036-T03, FLEX-WP-0036-T04]
state_hub_task_id: "13b93d7a-8341-5c76-9ae8-0f36b45b10fc"

Create the access-engine namespace, then one access-engine-<consumer> pin for each live flex-auth-<consumer> pin. Each new pin runs the same image digest and package as its twin and gets its own TokenReview binding. Ingress admits the same consumer as the twin does. Extend TestReadbackPinMatchesParticipantPins to cover the new pins, and add a test that each twin pair runs the same digest.

Gate: every new pin Ready, /healthz 200, anonymous requests 401; founder go. Blocked on FLEX-WP-0020-T11 closing.

Consumers switch over, one at a time

id: FLEX-WP-0036-T06
status: todo
priority: medium
depends_on: [FLEX-WP-0036-T02, FLEX-WP-0036-T05]
state_hub_task_id: "f0470e5c-3ea7-506c-b8bb-3ade0b57ff88"

Each consumer changes its URL, its egress policy (add the new namespace before removing the old one), its audience and, for ops-warden, owner_repo. One row per consumer in the inventory, closed with that owner's evidence: a live allow and a live deny against the new pin, and no traffic left on the twin (from twin logs).

Gate: every inventory row closed with owner evidence.

Retire the flex-auth runtime

id: FLEX-WP-0036-T07
status: todo
priority: medium
depends_on: [FLEX-WP-0036-T06]
state_hub_task_id: "e46c9c8e-a114-5c49-b035-22fdbd6a435b"

After a soak with no traffic on the old pins: uninstall each flex-auth-* release and its TokenReview binding, delete the flex-auth namespace, drop the old audience and resource.system from acceptance (FLEX-DEC-2026-015 order), and stop publishing coulomb/flex-auth. Keep the flattened emergency manifests in deploy/ only as rewritten for the new names.

Gate: founder go; kubectl get ns flex-auth NotFound; every consumer's checks still allow and deny as expected.

Prose, canon and layer declaration

id: FLEX-WP-0036-T08
status: todo
priority: low
depends_on: [FLEX-WP-0036-T06]
state_hub_task_id: "be5440aa-4584-5e4f-9459-242ecf5c7199"

SCOPE, INTENT and its layer declaration, the conformance doc, the stance register reviews, .claude/rules, the deploy/ and railiance/ READMEs, railiance/app.toml, and ops-warden's routing catalog and credential-routing canon. Raise the canon-naming item (FLEX-WP-0030 B5) as closed. Historical records stay as written.

Gate: grep -rn flex-auth over live docs returns only historical records and deliberate notes about the old name.