Cover wrong-tenant denials in ops-warden and railiance-platform fixtures.

FLEX-WP-0022-T03: the rules already refused a foreign tenant; the fixture
suites never varied the field. No policy or version change. Asked
tenant-engine to name the CheckRequest tenant relation for T01/T02.

Assistant: grok
Assistant-Session: 01a0a6cb-0334-72c0-83b0-2df57474a0f6

workplans/FLEX-WP-0022-tenant-scope-coverage.md

@@ -4,8 +4,8 @@ type: workplan
 title: "Tenant scoping is unstated in tenant-engine and untested in two more packages"
 domain: infotech
 repo: flex-auth
-status: proposed
-flavor: planning
+status: active
+flavor: implementation
 depends_on:
   - FLEX-WP-0021
 owner: claude
@@ -18,7 +18,7 @@ related_workplans:
   - FLEX-WP-0010
   - FLEX-WP-0014
 created: "2026-09-06"
-updated: "2026-09-06"
+updated: "2026-09-15"
 state_hub_workstream_id: "804c588c-f47a-50c4-bdd7-51b24bbf9539"
 ---
 
@@ -60,7 +60,7 @@ look identical in the artifact. That is the same publishing-shape argument
 
 ```task
 id: FLEX-WP-0022-T01
-status: todo
+status: progress
 priority: high
 state_hub_task_id: "a84dcee5-9426-5b30-8dd3-f4c076d00174"
 ```
@@ -75,6 +75,11 @@ Owner: `flex-auth` to ask; `tenant-engine` owns the answer.
 Gate: the relation is named by `tenant-engine`, not inferred here. This is the
 `FLEX-WP-0021-T01` rule applied to a field rather than to an action list.
 
+2026-09-15: asked `tenant-engine` to name the relation
+(`e8ba6a53-0093-4dc0-ad70-01f6b8c8e76b`). Their live
+`FlexAuthWriteAuthorizer.authorize` copies `tenant_id` onto both
+`CheckRequest.tenant` and `resource.id`. That is observation, not admission.
+
 ## 2. Encode the relation, or record that there is none
 
 ```task
@@ -100,7 +105,7 @@ Either way the fixtures must vary `tenant`, so the suite reports on the field.
 
 ```task
 id: FLEX-WP-0022-T03
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "3058f171-99d2-526b-a1bb-bd7aed87d10a"
 ```
@@ -113,3 +118,9 @@ fixture suite covers what the rule claims. No policy change and no version bump:
 the behaviour is already correct, only the evidence is thin.
 
 Gate: no package's fixture suite holds `tenant` constant.
+
+2026-09-15: added `fixture:ops-warden-wrong-tenant-deny` and
+`fixture:credential-grant-wrong-tenant-deny` plus matching
+`check_request_deny_wrong_tenant.json` files. Both suites now vary `tenant`.
+`test-policy` and `flex-auth check` return `deny` / `wrong_tenant`. No policy
+or version change.