Prepare the access-engine repository coordinate without applying the rename.

FLEX-WP-0020 T01-T03: fresh preflight is zero-blocker, repository-only
scope is FLEX-DEC-2026-013, concurrent work is FLEX-DEC-2026-014.
T04 handoff requests are posted; owner work-records are still required.
T06 stays behind the exact human confirm string and a post-commit preflight.

Assistant: grok
Assistant-Session: 01a0a6cb-0334-72c0-83b0-2df57474a0f6

workplans/FLEX-WP-0020-repository-identity-migration.md

@@ -4,12 +4,12 @@ type: workplan
 title: "Repository identity migration from flex-auth to access-engine"
 domain: "infotech"
 repo: "flex-auth"
-status: proposed
+status: active
 flavor: planning
 owner: "codex"
 topic_slug: "netkingdom"
 created: "2026-08-29"
-updated: "2026-08-29"
+updated: "2026-09-15"
 reviewed_at: "2026-08-29"
 reviewed_by: codex
 reviewed_against_commit: "7d7b4531d15a2dde7aaa28b9360a13e77b28b2a9"
@@ -137,7 +137,7 @@ the two live workplans; it must not silently cancel or rewrite them.
 
 ```task
 id: FLEX-WP-0020-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "bb989019-50a7-5273-ba09-b2df2e2602a4"
 ```
@@ -156,11 +156,16 @@ Owner: `flex-auth`.
 Gate: repository UUID, Forge ID, branch, commit, and clean-state evidence are
 recorded and match a fresh State Hub preflight.
 
+2026-09-15: captured in `docs/evidence/2026-09-15-repository-rename-baseline.md`.
+Signing is no longer a blocker. `safe_to_apply=true`, zero blockers, warning
+`active_work_present` disposed by `FLEX-DEC-2026-014`. A later commit still
+needs a T05 preflight before `forge-renamed`.
+
 ## 2. Prepare repository metadata and work-record frontmatter
 
 ```task
 id: FLEX-WP-0020-T02
-status: todo
+status: done
 priority: high
 state_hub_task_id: "102e9dc7-4724-5e80-84c4-092e6ecfbb2b"
 ```
@@ -179,11 +184,14 @@ Owner: `flex-auth`.
 Gate: work-record parsing succeeds and no existing UUID field was removed,
 replaced, or invented.
 
+2026-09-15: README states the planned `access-engine` clone URL and that
+frontmatter stays `repo: flex-auth` until rebind. No UUID fields rewritten.
+
 ## 3. Decide product and runtime naming separately
 
 ```task
 id: FLEX-WP-0020-T03
-status: todo
+status: done
 priority: high
 state_hub_task_id: "5095ddbc-b69c-5a52-b97f-08fca9b610c3"
 ```
@@ -209,11 +217,13 @@ rollback limits are reviewed.
 Gate: every item has a decision record and independently deployable changes
 have their own workplan or residual handoff.
 
+2026-09-15: accepted as `FLEX-DEC-2026-013` / hub `9f2dd7a4-6437-4e59-8403-ae56d9cc1d09`.
+
 ## 4. Inventory consumers and create owned handoffs
 
 ```task
 id: FLEX-WP-0020-T04
-status: todo
+status: progress
 priority: high
 state_hub_task_id: "9bb138e1-5edb-5714-8d89-3b1b7039a7ce"
 ```
@@ -239,6 +249,10 @@ Owner: `flex-auth` for inventory and handoff creation only.
 Gate: every discovered external change has one named owning repository and
 durable handoff ID; unknown ownership blocks the live rename.
 
+2026-09-15: inventory in `docs/evidence/2026-09-15-repository-rename-handoffs.md`.
+Owner work-record IDs are requested, not invented. T06 stays blocked on those
+IDs plus the human confirm string.
+
 Reviewed inventory baseline:
 
 | Owner | Required source/verification surface |
@@ -259,7 +273,7 @@ Reviewed inventory baseline:
 
 ```task
 id: FLEX-WP-0020-T05
-status: todo
+status: wait
 priority: high
 state_hub_task_id: "86fecbb6-b008-5354-8d70-0f4ba5077a58"
 ```
@@ -280,6 +294,11 @@ window, rollback limits, and confirmation `rename:fda8ad85-a7d7-4055-8f21-902a53
 Gate: a current private preflight and explicit human approval exist. Never
 commit the private preflight file or its token.
 
+2026-09-15: signing is provisioned; a private preflight of `6fd3a0c` was
+zero-blocker. Re-run after this source commit. Human confirmation of
+`rename:fda8ad85-a7d7-4055-8f21-902a533e59df:flex-auth:access-engine` is still
+required before T06. Do not start the journal from this session.
+
 ## 6. Execute the Forgejo repository rename
 
 ```task