access-engine/docs/runtime-rename-inventory.md

Runtime rename inventory (FLEX-WP-0036-T02)

Derived 2026-10-10 by searching each consumer checkout for flex-auth and FLEX_AUTH in code and config (.py .go .yaml .yml .toml .json .sh .ts). Git, venv, history and archived paths are excluded. Tests are listed only where they run the binary. Historical evidence and batch files under docs/ are counted but are not to be rewritten: they record what was live at the time.

Re-derive before T06 with the same search. This is a snapshot, not a register.

What a consumer has to change, by kind

Kind	Breaks if changed before the PDP accepts it?	Order
Service URL flex-auth-<c>.flex-auth.svc…	Yes: the new name resolves only once T05 has run	T05, then the consumer
Egress NetworkPolicy naming namespace flex-auth	Yes: drops traffic to the old pin	Add access-engine, switch, then remove flex-auth
Projected-token audience flex-auth	Yes: 401 until T03 accepts access-engine	T03, then the consumer
resource.system / owner_repo = flex-auth	Yes: not_applicable, i.e. deny (FLEX-DEC-2026-015)	T03, then the consumer
Consumer-owned env var names (<C>_FLEX_AUTH_URL …)	No: the consumer's own vocabulary	Consumer's choice; not required
Builds or runs our binary	Already changed (FLEX-DEC-2026-020): the stub exits 2	Consumer builds ./cmd/access-engine

Per consumer

ops-warden

Live pins: flex-auth-ops-warden (sign), flex-auth-ops-warden-fetch.

• URLs: examples/warden.production.example.yaml (sign and fetch); live config under the operator. Workstation tunnels flex-auth-ops-warden-railiance01 (:19090) and flex-auth-ops-warden-fetch-railiance01 (:19091) in ops-bridge tunnels.yaml point at ClusterIPs, which change with the new Services.
• Audience: examples/warden.production.example.yaml.
• resource.system: lane flex-auth-policy-check, owner_repo: flex-auth in registry/routing/catalog.yaml.
• Binary: scripts/policy_gate_production_smoke.sh (FLEX_AUTH_BIN, default /tmp/flex-auth).
• Also: scripts/build_flex_auth_registry.py, scripts/check_flex_auth_manifest_coverage.py, pep-stance.yaml, layer.yaml, tenancy.yaml, and src/warden/{policy,access,caller_identity}.py. These are names, not runtime addresses.

secrets-engine

Live pin: flex-auth-secrets-engine.

• URLs appear in docs and tests only. secrets-engine is a CLI, and its operator access path is still open (FLEX-WP-0023).
• Binary: tools/exercise_approval_identity.py builds ./cmd/flex-auth (notified 2026-10-10, message ad4b1b3e).
• pep-stance.yaml names the PDP.

user-engine (deployment sources in net-kingdom)

Live pins: flex-auth-user-engine (check), flex-auth-application-readback.

• URL, audience and egress: net-kingdom/sso-mfa/k8s/user-engine/runtime.yaml (USER_ENGINE_FLEX_AUTH_URL, token audience flex-auth, egress namespace flex-auth), plus the readback URL promised on 2026-10-10 (message 5460cee2).
• Env vars: USER_ENGINE_FLEX_AUTH_{URL,TOKEN_FILE,TIMEOUT} and USER_ENGINE_READBACK_TOKEN_FILE in src/user_engine/runtime.py and adapters/local.py. These are the consumer's own names.

tenant-engine

Live pin: flex-auth-tenant-engine.

• URL, audience and egress: deploy/base/tenant-engine.yaml, railiance/app.toml.
• Env vars: TENANT_ENGINE_FLEX_AUTH_{URL,TOKEN_FILE,TIMEOUT_SECONDS} in src/tenant_engine/config.py; pep-stance.yaml.

informed-decision

Live pins: flex-auth-informed-decision-lifecycle, -sitting, -t03.

• URLs and audience: deploy/sitting-admission.json, deploy/t03-admission.json, deploy/lifecycle/{admission,service}.candidate.json, and tools/render_deployment.py. The live egress policy informed-decision-review names namespace flex-auth.
• Binary: tests/browser_fixture.py, tests/test_lifecycle_policy_component.py, tests/test_review_component.py and tests/test_lifecycle_review.py take INFD_FLEX_AUTH_BINARY / INFD_FLEX_AUTH_SOURCE. A binary built from current source must come from ./cmd/access-engine. Doc docs/protected-browser-review.md notified (message 9b15c762).
• docs/batches/** and docs/evidence/** are historical. Leave them.

net-kingdom

• Owns user-engine's deployment source (above).
• runbooks/protected-system-flex-auth/pack.yaml and docs/tutorials/protected-system-flex-auth.md run go run ./cmd/flex-auth (notified, message e2f1aac9).

Others with references, not consumers of a pin

• state-hub/repository_rename_workplan.py: tooling from FLEX-WP-0020.
• railiance-platform/scripts/credential.py: FLEX_AUTH_{URL,PATH,SUBJECT_TYPES}. Check whether it calls a live pin before T06.
• the-custodian: docs only.
• Hub repo record local_path is /home/worsch/flex-auth, but the checkout is /home/worsch/access-engine (FLEX-WP-0020-T11 residual).

Owner handoffs

Requested after T01 fixes the target names, so each owner gets one message with the exact new URL and audience: ops-warden, secrets-engine, user-engine with net-kingdom, tenant-engine, and informed-decision.

Deterministic consumer readiness check (2026-10-11, T06)

Run python3 tools/verify_runtime_consumer_migration.py --estate-root /home/worsch. The class parses only the bounded public inventory source paths as YAML/JSON, TOML or Python literal strings, excludes comments and records file SHA256s. It emits exact old/new pin origins, source-owner handoff responsibilities and source migration phases. It never marks native readiness or closes a task. Unsigned completion flags, source URL strings and a missing log are not live proof. Operator configuration, ops-bridge ClusterIP tunnels and Secrets CLI runtime selection remain owner evidence requirements; no private operator configuration or credentials are read by this tool.

The 2026-10-11 re-derivation found remaining owner source work for ops-warden, secrets-engine, user-engine with net-kingdom, tenant-engine and informed-decision. No new endpoint appeared in these bounded files. The five owner handoffs are prepared by the report, not sent or claimed acknowledged. Source owners first retain old egress while adding the new namespace, then change one consumer's endpoint and projected audience after T02/T05 and ordered live prerequisites. Each new pin needs authenticated allow/deny and exact deployed revision/digest correspondence; old-twin logs need an explicit observation interval and no-traffic/soak evidence before old egress removal or T07 retirement.

The earlier flex-auth-policy-check catalogue example is a policy routing lane, not a secret-fetch package lane. Its naming migration does not authorize adding PDP-self resource systems to packages that govern other protected consumers. T05's nine new TokenReview ServiceAccount grants are a separate red daily-batch item. This report does not authorize those grants or the consumer changes.