Review NetKingdom Tenancy Posture v0.1 and declare flex-auth posture

Publishes tenancy.yaml (I1 A0 E2 P n/a R n/a, enables A3), the review
answering rapp-postgres's three asks, and FLEX-WP-0015 to close the gaps.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tenancy.yaml

@@ -0,0 +1,62 @@
+# flex-auth tenancy posture declaration
+# Framework: net-kingdom/canon/standards/tenancy-posture_v0.1.md (§5)
+# Conformance rule (§6): accuracy, not altitude. This file overclaims nothing.
+# Reasoning and evidence: docs/tenancy-posture-review.md
+
+service: flex-auth
+role: policy-decision-point
+
+tenancy:
+  current:
+    I: 1
+    A: 0
+    E: 2
+    P: "n/a"
+    R: "n/a"
+  target:
+    I: 1
+    A: 2
+    E: 2
+    P: "n/a"
+    R: "n/a"
+  reviewed: "2026-08-17"
+  service_class: latency-critical
+
+  # flex-auth is the PDP, not a PEP. The A ladder as written describes
+  # enforcement points delegating outward; flex-auth is the thing delegated to.
+  # Two numbers are therefore needed and only one has a slot (see review §3.1).
+  enables_for_consumers: 3
+
+  gap:
+    I: >-
+      Subject and tenant arrive in the CheckRequest body, asserted by the
+      calling PEP. flex-auth verifies no token and holds no session. This is
+      I1 by §4.1's literal rule and is structurally correct for a PDP: the
+      decision point judges asserted claims, it cannot be the verifier of its
+      own inputs. Not a defect and not a target for movement.
+    A: >-
+      POST /v1/check and /v1/batch_check authenticate no caller. Any workload
+      with network reach to the ClusterIP Service can assert any subject and
+      any tenant and receive an authoritative decision. Mitigated only by
+      cluster-internal exposure. Target A2 (single inbound choke point binding
+      caller identity) under FLEX-WP-0015-T02.
+    E: >-
+      No tenant data at rest. Tenant scoping in decisions runs through one
+      choke point (internal/decision/engine.go normalizeRequest and the
+      relationship tenant match). E2 evidence is adversarial per §13.2 and is
+      not yet produced; the claim rests on code review only, which §13
+      does not accept. Treat E2 as asserted-pending-evidence.
+    P: >-
+      No rung applies. flex-auth holds no datastore: registry snapshot and
+      policy package are baked into the image and mounted read-only, and the
+      production Deployment runs with no --log flag. P0 is the framework's
+      floor and presupposes a database. Declaring P0 would be a fabrication.
+    R: >-
+      No rung applies, same reason. No tenant data is persisted in production,
+      so there is nothing to retain or erase. R0 ("kept indefinitely by
+      default") would misdescribe a service that keeps nothing.
+
+evidence:
+  A: "None. A0 is a declared absence, not a claim; see review §3.5 on low-rung evidence."
+  E2: "Pending adversarial artifact. Code choke point: internal/decision/engine.go:188,248"
+  deployment: "deploy/flex-auth-user-engine.yaml, deploy/flex-auth-tenant-engine.yaml"