Record user-engine ack that USER-WP-0023-T03 will not probe warn

workplans/FLEX-WP-0015-tenancy-posture-conformance.md

@@ -136,15 +136,18 @@ would delay user-engine A2 evidence for no safety gain. Sequence:
    caller-auth disabled. Do not `kubectl apply` an enforce manifest.
 3. Confirm warn logs per consumer. `user-engine` is migrated and deployed
    as of 2026-08-18 (image `sha256:c501aeb2…`, token at
-   `/var/run/secrets/flex-auth-caller/token`). `tenant-engine` source and
-   desired manifests already project that token and send it; live digest
-   is still unconfirmed. Warn is safe either way. `ops-warden` adopts the
-   calling side on its own schedule.
+   `/var/run/secrets/flex-auth-caller/token`). On 2026-08-19 they confirmed
+   USER-WP-0023-T03 stays wait and they will not run the three assertions
+   against warn (message `f963906d`). `tenant-engine` source and desired
+   manifests already project that token and send it; live digest is still
+   unconfirmed. Warn is safe either way. `ops-warden` adopts the calling
+   side on its own schedule.
 4. Flip **user-engine only** to `enforce` (`callerAuth.mode: enforce` in
-   `values/user-engine.yaml`, same digest). Then capture the live negative
-   probe from a user-engine pod. The three assertions are already written
-   in user-engine `docs/flex-auth-caller-identity.md`; they must not run
-   against warn, because "no token returns 401" would still be a decision.
+   `values/user-engine.yaml`, same digest). Then they capture the live
+   negative probe from a user-engine pod. The three assertions are already
+   written in user-engine `docs/flex-auth-caller-identity.md`; they must
+   not run against warn, because "no token returns 401" would still be a
+   decision.
 5. Flip tenant-engine to enforce only after its warn logs are clean.
 6. Only then may `policy.enabled` flip anywhere — `ops-warden` names that
    the real deadline, and it is the same gate as FLEX-WP-0007.