FLEX-WP-0008 T01-T02: tenant-engine resource/action vocabulary + policy package

docs/tenant-engine-{resource-namespace,action-vocabulary}.md: four actions
(tenant.create, tenant.role.grant, tenant.role.revoke, tenant.plan.assign)
matching tenant_engine/src/tenant_engine/authz.py's _RESOURCE_TYPES mapping
exactly. No resource_manifest.yaml -- tenant-engine's resources are created
dynamically, unlike ops-warden's fixed SSH-certificate inventory; documented
as a deliberate deviation.

examples/tenant-engine/: protected_system_manifest.yaml, subject_manifest.yaml
(one registered caller: tenant-engine's own service identity),
policy_package.md (Rego rules + embedded tests), policy_fixtures.yaml (8
allow/deny pairs), assembled registry_snapshot.json, two standalone
check_request examples, README.

Design decision made explicit in the workplan: operator/service-identity
authorization (one known subject, four known actions), not aal2+assurance +
tenant-capability-role checking -- CheckRequest carries no assurance claim
yet (TEN-WP-0003 already flagged actor as a plain request-body field, not a
real auth context), and a tenant's capability roles are the tenant's own
state, not a property of who may call tenant-engine's admin API. Revisit
once KEY-WP-0005 gives callers a real assurance-bearing identity.

Verified for real: built ./cmd/flex-auth, ran test-policy (6 tests + 8
fixtures, all pass), load-registry, check against both example requests.
Then ran a live flex-auth serve with this exact registry+policy and pointed
tenant-engine's real, unmodified FlexAuthCheckClient/FlexAuthWriteAuthorizer
at it over real HTTP: unknown subject -> 403, tenant-engine -> 201. go test
./... still green across the whole repo.

T03 (live-lookup context adapter for other protected systems) stays open --
new Go adapter package, tracked separately.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/tenant-engine-action-vocabulary.md

@@ -0,0 +1,36 @@
+# tenant-engine Action Vocabulary
+
+This document defines the action vocabulary for `tenant-engine` as a
+flex-auth protected system (`FLEX-WP-0008-T01`). Action names here match
+`tenant-engine`'s own `authz.FlexAuthWriteAuthorizer` mapping exactly
+(`tenant_engine/src/tenant_engine/authz.py`) — coordinated between the two
+repos, not independently invented.
+
+| Action | tenant-engine write endpoint | Resource type | Decision effects |
+| --- | --- | --- | --- |
+| `tenant.create` | `POST /tenants` | `tenant` | `allow`, `deny` |
+| `tenant.role.grant` | `POST /tenants/{id}/roles/grant` | `role-grant` | `allow`, `deny` |
+| `tenant.role.revoke` | `POST /tenants/{id}/roles/revoke` | `role-grant` | `allow`, `deny` |
+| `tenant.plan.assign` | `POST /tenants/{id}/plan` | `plan-assignment` | `allow`, `deny` |
+
+These are the only four actions `tenant-engine` sends to `POST /v1/check` —
+its `FlexAuthCheckClient` (`TEN-WP-0003`) never sends anything else, and
+`tenant-engine`'s reads (`/roles`, `/roles/live`) are never gated through
+flex-auth at all; they're `tenant-engine`'s own cache-read and live-lookup
+endpoints, consumed *by* `key-cape` and `flex-auth` respectively.
+
+## Not in scope for this vocabulary
+
+`tenant-engine`'s capability roles (`PLTF`/`IAM`/`VEN`/`CUS`, ADR-0014) are
+**tenant** state — what a tenant is allowed to do on the platform. This
+vocabulary governs a different question: which **operator/service
+subjects** are allowed to call `tenant-engine`'s admin API at all. The two
+must not be conflated — a policy package that checked a *caller's* action
+against a *tenant's* capability roles would be checking the wrong thing.
+See `examples/tenant-engine/policy_package.md`'s Rules section for how the
+distinction is enforced.
+
+## Related
+
+- `docs/tenant-engine-resource-namespace.md`
+- `examples/tenant-engine/`

docs/tenant-engine-resource-namespace.md

@@ -0,0 +1,45 @@
+# tenant-engine Resource Namespace
+
+This document defines the `tenant-engine` protected-system namespace
+consumed by flex-auth (`FLEX-WP-0008-T01`).
+
+Unlike Markitect's document hierarchy or ops-warden's fixed SSH-certificate
+inventory, `tenant-engine`'s resources (tenants, their role grants, their
+plan assignments) are created **dynamically** — there is no fixed,
+pre-registrable resource list to publish a `resource_manifest.yaml` for.
+Every `CheckRequest` carries the resource identity inline
+(`resource.id == tenant_id`), and the policy evaluates against `input`
+directly rather than looking up a registered resource by id. This is a
+deliberate, documented deviation from the ops-warden pattern, not an
+omission.
+
+## Resource Types
+
+```text
+tenant            -- a tenant record (existence, grouping)
+role-grant        -- a capability-role grant/revocation
+plan-assignment   -- a tenant's plan/subscription assignment
+```
+
+All three are `scope_level: Resource`, always accessed within
+`system: tenant-engine`.
+
+## Ownership Boundary
+
+`tenant-engine`'s own boundary contract
+(`net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md`)
+already defines these as `tenant-engine`'s owned resource kinds. This
+namespace only maps that ownership into flex-auth's protected-system
+vocabulary — it does not redefine ownership.
+
+## Related
+
+- `docs/tenant-engine-action-vocabulary.md` — the actions gated on these
+  resource types
+- `examples/tenant-engine/` — protected-system manifest, subject manifest,
+  policy package, and fixtures
+- `net-kingdom/docs/adr/ADR-0014-tenant-capability-roles-and-tenant-engine-ownership.md`
+  — the capability-role model (`PLTF`/`IAM`/`VEN`/`CUS`) these resources
+  carry as *tenant* state, distinct from the *operator* authorization this
+  namespace governs (who may call `tenant-engine`'s write API, not what a
+  tenant is allowed to do)