diff --git a/Makefile b/Makefile
index 315720b..700ab2b 100644
--- a/Makefile
+++ b/Makefile
@@ -4,7 +4,7 @@ PKG     := ./...
 VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo 0.0.0-dev)
 LDFLAGS := -X main.version=$(VERSION)
 
-.PHONY: all build test vet lint fmt tidy sbom clean ci overlay-render overlay-dry-run
+.PHONY: all build test vet lint fmt tidy sbom clean ci
 
 all: vet lint test build
 
@@ -56,15 +56,4 @@ sbom:
 clean:
 	rm -rf $(BIN_DIR)
 
-ci: vet lint test build overlay-render
-
-overlay-render:
-	@tests/stage1.sh
-
-overlay-dry-run:
-	@test -n "$$KUBECONFIG" || { echo "set KUBECONFIG to the railiance01 kubeconfig"; exit 1; }
-	@for values in values/stage2-canary.yaml values/user-engine.yaml values/tenant-engine.yaml; do \
-		echo "server-dry-run $$values"; \
-		helm template flex-auth charts/flex-auth -f "$$values" --namespace flex-auth \
-		  | kubectl apply --dry-run=server --server-side -f -; \
-	done
+ci: vet lint test build
diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 4405283..9cc9022 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -16,10 +16,9 @@
 | workplan | FLEX-WP-0006 | finished | — | workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md |
 | workplan | FLEX-WP-0007 | finished | — | workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md |
 | workplan | FLEX-WP-0008 | finished | — | workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md |
-| workplan | FLEX-WP-0009 | finished | — | workplans/FLEX-WP-0009-user-engine-production-policy-service.md |
+| workplan | FLEX-WP-0009 | active | — | workplans/FLEX-WP-0009-user-engine-production-policy-service.md |
 | workplan | FLEX-WP-0010 | finished | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md |
 | workplan | FLEX-WP-0011 | proposed | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md |
-| workplan | FLEX-WP-0012 | proposed | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
 | task | FLEX-WP-0001-T001 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
 | task | FLEX-WP-0001-T002 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
 | task | FLEX-WP-0001-T003 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
@@ -67,7 +66,7 @@
 | task | FLEX-WP-0009-T01 | done | — | workplans/FLEX-WP-0009-user-engine-production-policy-service.md |
 | task | FLEX-WP-0009-T02 | done | — | workplans/FLEX-WP-0009-user-engine-production-policy-service.md |
 | task | FLEX-WP-0009-T03 | done | — | workplans/FLEX-WP-0009-user-engine-production-policy-service.md |
-| task | FLEX-WP-0009-T04 | done | — | workplans/FLEX-WP-0009-user-engine-production-policy-service.md |
+| task | FLEX-WP-0009-T04 | progress | — | workplans/FLEX-WP-0009-user-engine-production-policy-service.md |
 | task | FLEX-WP-0010-T01 | done | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md |
 | task | FLEX-WP-0010-T02 | done | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md |
 | task | FLEX-WP-0010-T03 | done | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md |
@@ -75,7 +74,3 @@
 | task | FLEX-WP-0011-T01 | todo | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md |
 | task | FLEX-WP-0011-T02 | todo | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md |
 | task | FLEX-WP-0011-T03 | todo | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md |
-| task | FLEX-WP-0012-T01 | todo | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
-| task | FLEX-WP-0012-T02 | todo | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
-| task | FLEX-WP-0012-T03 | todo | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
-| task | FLEX-WP-0012-T04 | todo | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
diff --git a/charts/flex-auth/Chart.yaml b/charts/flex-auth/Chart.yaml
deleted file mode 100644
index f59be21..0000000
--- a/charts/flex-auth/Chart.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-apiVersion: v2
-name: flex-auth
-description: Independently rollable flex-auth policy-decision Deployment (one consumer per release).
-type: application
-version: 0.1.0
-appVersion: "0.1.0"
diff --git a/charts/flex-auth/templates/_helpers.tpl b/charts/flex-auth/templates/_helpers.tpl
deleted file mode 100644
index 4335226..0000000
--- a/charts/flex-auth/templates/_helpers.tpl
+++ /dev/null
@@ -1,20 +0,0 @@
-{{- define "flex-auth.image" -}}
-{{- if not .Values.image.digest }}
-{{- fail "image.digest is required (digest_policy=required); do not deploy by tag" }}
-{{- end }}
-{{- printf "%s@%s" .Values.image.repository .Values.image.digest -}}
-{{- end -}}
-
-{{- define "flex-auth.name" -}}
-{{- required "name is required" .Values.name -}}
-{{- end -}}
-
-{{- define "flex-auth.selectorLabels" -}}
-app.kubernetes.io/name: {{ include "flex-auth.name" . }}
-{{- end -}}
-
-{{- define "flex-auth.labels" -}}
-{{ include "flex-auth.selectorLabels" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: flex-auth
-{{- end -}}
diff --git a/charts/flex-auth/templates/deployment.yaml b/charts/flex-auth/templates/deployment.yaml
deleted file mode 100644
index b127df6..0000000
--- a/charts/flex-auth/templates/deployment.yaml
+++ /dev/null
@@ -1,48 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ include "flex-auth.name" . }}
-  labels:
-    {{- include "flex-auth.labels" . | nindent 4 }}
-spec:
-  replicas: {{ .Values.replicaCount }}
-  selector:
-    matchLabels:
-      {{- include "flex-auth.selectorLabels" . | nindent 6 }}
-  template:
-    metadata:
-      labels:
-        {{- include "flex-auth.labels" . | nindent 8 }}
-    spec:
-      automountServiceAccountToken: false
-      securityContext:
-        runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: flex-auth
-          image: {{ include "flex-auth.image" . }}
-          imagePullPolicy: {{ .Values.image.pullPolicy }}
-          args:
-            {{- toYaml .Values.args | nindent 12 }}
-          ports:
-            - name: http
-              containerPort: {{ .Values.service.port }}
-          livenessProbe:
-            httpGet:
-              path: {{ .Values.health.path }}
-              port: http
-            periodSeconds: 20
-          readinessProbe:
-            httpGet:
-              path: {{ .Values.health.path }}
-              port: http
-            periodSeconds: 5
-          resources:
-            {{- toYaml .Values.resources | nindent 12 }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-            readOnlyRootFilesystem: true
diff --git a/charts/flex-auth/templates/networkpolicy.yaml b/charts/flex-auth/templates/networkpolicy.yaml
deleted file mode 100644
index 6960030..0000000
--- a/charts/flex-auth/templates/networkpolicy.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: {{ include "flex-auth.name" . }}
-  labels:
-    {{- include "flex-auth.labels" . | nindent 4 }}
-spec:
-  podSelector:
-    matchLabels:
-      {{- include "flex-auth.selectorLabels" . | nindent 6 }}
-  policyTypes:
-    - Ingress
-    - Egress
-  egress: []
-  {{- if .Values.consumer.isolated }}
-  ingress: []
-  {{- else }}
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: {{ required "consumer.namespace is required when not isolated" .Values.consumer.namespace }}
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: {{ required "consumer.podName is required when not isolated" .Values.consumer.podName }}
-      ports:
-        - port: {{ .Values.service.port }}
-          protocol: TCP
-  {{- end }}
diff --git a/charts/flex-auth/templates/service.yaml b/charts/flex-auth/templates/service.yaml
deleted file mode 100644
index c7971a3..0000000
--- a/charts/flex-auth/templates/service.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "flex-auth.name" . }}
-  labels:
-    {{- include "flex-auth.labels" . | nindent 4 }}
-spec:
-  selector:
-    {{- include "flex-auth.selectorLabels" . | nindent 4 }}
-  ports:
-    - name: http
-      port: {{ .Values.service.port }}
-      targetPort: http
diff --git a/charts/flex-auth/values.yaml b/charts/flex-auth/values.yaml
deleted file mode 100644
index 7c3dd53..0000000
--- a/charts/flex-auth/values.yaml
+++ /dev/null
@@ -1,38 +0,0 @@
-# Default chart values. Real pins live in values/*.yaml — never promote a tag.
-name: flex-auth
-namespace: flex-auth
-
-image:
-  repository: forgejo.coulomb.social/coulomb/flex-auth
-  digest: ""
-  pullPolicy: IfNotPresent
-
-replicaCount: 1
-
-args:
-  - serve
-  - --addr
-  - 0.0.0.0:8080
-  - --registry
-  - /opt/flex-auth/examples/tenant-engine/registry_snapshot.json
-  - --policy
-  - /opt/flex-auth/examples/tenant-engine/policy_package.md
-
-service:
-  port: 8080
-
-health:
-  path: /healthz
-
-consumer:
-  isolated: false
-  namespace: ""
-  podName: ""
-
-resources:
-  requests:
-    cpu: 25m
-    memory: 32Mi
-  limits:
-    cpu: 300m
-    memory: 192Mi
diff --git a/deploy/README.md b/deploy/README.md
index d485509..e00614f 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -1,13 +1,10 @@
 # flex-auth production deployment
 
-The sanctioned promotion path is the Railiance overlay in
-[`../railiance/`](../railiance/README.md) (`railiance/app.toml`,
-`charts/flex-auth`, `values/*.yaml`). These flattened files are the
-emergency kubectl path recovered on 2026-08-11 from live
-`last-applied-configuration`, kept so a rollback does not depend on a
-cluster annotation or on Helm history.
-
 Manifests for the two cluster-local flex-auth policy-decision services.
+Both were previously applied with `kubectl apply` from a file that lived
+outside this repo; these were recovered from the live objects'
+`kubectl.kubernetes.io/last-applied-configuration` on 2026-08-11 and
+committed so that a rollback does not depend on a cluster annotation.
 
 | File | Deployment | Consumer | Service DNS |
 | --- | --- | --- | --- |
@@ -86,8 +83,8 @@ last-known-good digest below.
 
 | Deployment | Last-known-good digest | Policy state |
 | --- | --- | --- |
-| `flex-auth-tenant-engine` | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | **live 2026-08-16** — four-action policy; `tenant.retire`/`update`/`reactivate` deny `unknown_action` |
-| `flex-auth-tenant-engine` *(FLEX-WP-0010)* | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | seven-action policy, CI-built from `e9911eb`; ReplicaSet present but scaled to 0 |
+| `flex-auth-tenant-engine` | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | **current** — seven-action policy, FLEX-WP-0010, CI-built from `e9911eb`, live 2026-08-11 |
+| `flex-auth-tenant-engine` *(previous)* | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | four-action policy, pre-FLEX-WP-0010 (lifecycle actions deny `unknown_action`) |
 | `flex-auth-user-engine` | `sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4` | **current** — FLEX-WP-0009-T04, nine fixtures (incl. registration-applicant) verified live 2026-08-16 |
 | `flex-auth-user-engine` *(previous)* | `sha256:a31961c45215aa6baf3bc748c6741ab703c2c8325e61aa7983a355026195e51b` | FLEX-WP-0009-T03, six fixtures verified live 2026-08-10 |
 
diff --git a/deploy/flex-auth-tenant-engine.yaml b/deploy/flex-auth-tenant-engine.yaml
index e0a71ad..de25e54 100644
--- a/deploy/flex-auth-tenant-engine.yaml
+++ b/deploy/flex-auth-tenant-engine.yaml
@@ -23,7 +23,7 @@ spec:
         - /opt/flex-auth/examples/tenant-engine/registry_snapshot.json
         - --policy
         - /opt/flex-auth/examples/tenant-engine/policy_package.md
-        image: forgejo.coulomb.social/coulomb/flex-auth@sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa
+        image: forgejo.coulomb.social/coulomb/flex-auth@sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7
         livenessProbe:
           httpGet:
             path: /healthz
diff --git a/railiance/README.md b/railiance/README.md
deleted file mode 100644
index d3fda4d..0000000
--- a/railiance/README.md
+++ /dev/null
@@ -1,82 +0,0 @@
-# flex-auth Railiance overlay
-
-Canonical staged-promotion contract for flex-auth (`RAIL-BS-WP-0006`,
-`FLEX-WP-0011`). The recovered `deploy/*.yaml` files remain as an emergency
-kubectl path; this overlay is the sanctioned shape.
-
-## Layout
-
-| Path | Role |
-| --- | --- |
-| `railiance/app.toml` | `railiance.app.v1` contract |
-| `charts/flex-auth/` | One Deployment + Service + NetworkPolicy per release |
-| `values/tenant-engine.yaml` | Production pin for `flex-auth-tenant-engine` |
-| `values/user-engine.yaml` | Production pin for `flex-auth-user-engine` |
-| `values/stage2-canary.yaml` | Isolated canary `flex-auth-canary` (no consumer ingress) |
-| `values/stage3-production.yaml` | Stage 3 values for that same isolated canary release |
-| `tests/stage1.sh` | Local render of every values file |
-
-The two production consumers stay independently pinned and independently
-rollable. Do not collapse them into one Helm release. The official
-`bin/railiance deploy|observe|promote|rollback` cycle operates on the
-**isolated canary** so it cannot move a production pin by accident.
-
-## Stage 1
-
-```bash
-tests/stage1.sh
-# or
-/home/worsch/railiance-bootstrap/bin/railiance run . --pretty
-```
-
-## Stage 2 / Stage 3 (isolated canary)
-
-```bash
-RAILIANCE=/home/worsch/railiance-bootstrap/bin/railiance
-$RAILIANCE deploy --stage 2 . --plan
-$RAILIANCE deploy --stage 2 . --server-dry-run --pretty
-$RAILIANCE deploy --stage 2 . --apply --approval-id <state-hub-id>
-$RAILIANCE observe --stage 2 . --live --pretty
-$RAILIANCE promote . --plan
-$RAILIANCE promote . --apply --approval-id <state-hub-id>
-$RAILIANCE rollback . --apply --approval-id <state-hub-id> --revision <helm-rev>
-```
-
-The canary Service is `flex-auth-canary.flex-auth.svc.cluster.local:8080`.
-Production consumers keep calling their own Service names.
-
-## Rolling a production pin
-
-Policy is baked into the image. Do not build images on a workstation.
-`.forgejo/workflows/image.yaml` publishes `:latest` and `:main-<short-sha>`;
-deploy by digest.
-
-```bash
-# 1. Edit the digest in values/<consumer>.yaml
-# 2. Record the previous digest as the rollback target
-# 3. Apply only that release
-helm upgrade --install flex-auth-<consumer> charts/flex-auth \
-  --namespace flex-auth -f values/<consumer>.yaml --wait --timeout 2m
-
-# 4. Prove the new policy, not just that the pod started
-kubectl -n flex-auth port-forward svc/flex-auth-<consumer> 19099:8080
-curl -s -X POST http://127.0.0.1:19099/v1/check \
-  -H 'Content-Type: application/json' \
-  -d @examples/<consumer>/<request that exercises the change>.json
-```
-
-Emergency kubectl path (no Helm history): `kubectl apply -f deploy/flex-auth-<consumer>.yaml`.
-
-## Rollback
-
-Preferred: `helm rollback flex-auth-<consumer> <revision> -n flex-auth --wait`.
-
-If Helm history is missing: `kubectl -n flex-auth rollout undo deploy/flex-auth-<consumer>`,
-or re-apply the last-known-good digest in `deploy/README.md`.
-
-| Deployment | Last-known-good digest | Policy state |
-| --- | --- | --- |
-| `flex-auth-tenant-engine` | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | **live 2026-08-16** — four-action policy; lifecycle actions deny `unknown_action` |
-| `flex-auth-tenant-engine` *(FLEX-WP-0010 image, scaled to 0)* | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | seven-action policy, previously live 2026-08-11 |
-| `flex-auth-user-engine` | `sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4` | FLEX-WP-0009-T04, nine fixtures, live 2026-08-16 |
-| `flex-auth-user-engine` *(previous)* | `sha256:a31961c45215aa6baf3bc748c6741ab703c2c8325e61aa7983a355026195e51b` | FLEX-WP-0009-T03, six fixtures |
diff --git a/railiance/app.toml b/railiance/app.toml
deleted file mode 100644
index 8c64099..0000000
--- a/railiance/app.toml
+++ /dev/null
@@ -1,188 +0,0 @@
-schema_version = "railiance.app.v1"
-
-[app]
-id = "flex-auth"
-name = "flex-auth"
-repo = "flex-auth"
-owner = "platform-security"
-criticality = "high"
-description = "Policy-as-code authorization PDP. Two independently pinned production Deployments (tenant-engine, user-engine). Outage fails closed: consumers receive deny/403 rather than an unauthorized allow, but write paths block."
-
-[source]
-revision = "git:main"
-artifact = "image"
-digest_policy = "required"
-
-[rollback]
-strategy = "helm-revision"
-command = "helm rollback <release> <revision> --namespace flex-auth --wait"
-verification = "Both Services' /healthz return 200 and the rolled-back Deployment image digest matches the recorded previous_stable pin."
-
-[[platform.dependencies]]
-name = "railiance01-k3s"
-kind = "network"
-required = true
-stage = "stage2"
-evidence = "kubectl -n flex-auth get ns reports Active on railiance01."
-
-[[platform.dependencies]]
-name = "forgejo-oci"
-kind = "other"
-required = true
-stage = "stage2"
-evidence = "Image forgejo.coulomb.social/coulomb/flex-auth is pullable by digest."
-
-[secrets]
-references = []
-
-[[observability.health_endpoints]]
-name = "local-health"
-url = "http://127.0.0.1:8080/healthz"
-stage = "stage1"
-expected_status = 200
-
-[[observability.health_endpoints]]
-name = "tenant-engine-health"
-url = "http://flex-auth-tenant-engine.flex-auth.svc.cluster.local:8080/healthz"
-stage = "stage2"
-expected_status = 200
-
-[[observability.health_endpoints]]
-name = "user-engine-health"
-url = "http://flex-auth-user-engine.flex-auth.svc.cluster.local:8080/healthz"
-stage = "stage2"
-expected_status = 200
-
-[[observability.health_endpoints]]
-name = "canary-health"
-url = "http://flex-auth-canary.flex-auth.svc.cluster.local:8080/healthz"
-stage = "stage2"
-expected_status = 200
-
-[[observability.logs]]
-name = "canary-pods"
-reference = "kubectl -n flex-auth logs deploy/flex-auth-canary --tail=50"
-stage = "stage2"
-
-[stages.stage1]
-enabled = true
-namespace = "local"
-release = "flex-auth-local"
-commands = ["make test", "tests/stage1.sh"]
-checks = ["unit-tests", "helm-template", "contract-schema"]
-evidence = ["go test output", "helm template of tenant-engine, user-engine, and canary values", "app.toml schema validation"]
-requires_approval = false
-
-[stages.stage2]
-enabled = true
-namespace = "flex-auth"
-release = "flex-auth-canary"
-commands = ["bin/railiance deploy --stage 2 . --plan", "bin/railiance observe --stage 2 . --plan"]
-checks = ["server-dry-run", "canary-ready", "canary-health", "operator-approval"]
-evidence = ["isolated canary release name", "pod Available", "canary /healthz 200", "State Hub approval id"]
-requires_approval = true
-canary_mode = "isolated"
-observation_minutes = 15
-
-[stages.stage3]
-enabled = true
-namespace = "flex-auth"
-release = "flex-auth-canary"
-commands = ["bin/railiance promote . --plan", "bin/railiance rollback . --plan"]
-checks = ["stage2-accepted", "rollback-target", "operator-approval"]
-evidence = ["promotion command id", "recorded previous_stable digests", "post-promotion canary /healthz 200"]
-requires_approval = true
-promotion_mode = "release-replace"
-previous_stable = "flex-auth-user-engine@sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4;flex-auth-tenant-engine@sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa"
-
-[[checks]]
-id = "unit-tests"
-type = "command"
-stage = "stage1"
-description = "Run repository Go tests."
-required = true
-run = "make test"
-timeout_seconds = 600
-
-[[checks]]
-id = "helm-template"
-type = "helm"
-stage = "stage1"
-description = "Render the isolated canary chart locally."
-required = true
-chart = "charts/flex-auth"
-values = "values/stage2-canary.yaml"
-mode = "template"
-
-[[checks]]
-id = "contract-schema"
-type = "command"
-stage = "stage1"
-description = "Validate railiance/app.toml against railiance.app.v1."
-required = true
-run = "python3 tests/validate_app_toml.py"
-timeout_seconds = 60
-
-[[checks]]
-id = "local-health"
-type = "http"
-stage = "stage1"
-description = "Confirm a locally served flex-auth /healthz when one is running."
-required = false
-url = "http://127.0.0.1:8080/healthz"
-expected_status = 200
-timeout_seconds = 10
-
-[[checks]]
-id = "server-dry-run"
-type = "helm"
-stage = "stage2"
-description = "Server-side dry run of the isolated canary before apply."
-required = true
-chart = "charts/flex-auth"
-values = "values/stage2-canary.yaml"
-mode = "server-dry-run"
-
-[[checks]]
-id = "canary-ready"
-type = "kubernetes"
-stage = "stage2"
-description = "Isolated canary Deployment reaches Available."
-required = true
-namespace = "flex-auth"
-resource = "deploy/flex-auth-canary"
-condition = "Available"
-
-[[checks]]
-id = "canary-health"
-type = "http"
-stage = "stage2"
-description = "Isolated canary Service /healthz returns 200."
-required = true
-url = "http://flex-auth-canary.flex-auth.svc.cluster.local:8080/healthz"
-expected_status = 200
-timeout_seconds = 10
-
-[[checks]]
-id = "operator-approval"
-type = "manual"
-stage = "stage2"
-description = "Human approval recorded before the isolated canary is applied and before any production pin is moved."
-required = true
-evidence_required = "State Hub approval note id, candidate digest, rollback target (both production pins)."
-
-[[checks]]
-id = "stage2-accepted"
-type = "manual"
-stage = "stage3"
-description = "Stage 2 gates passed for the same candidate artifact."
-required = true
-evidence_required = "State Hub Stage 2 acceptance progress id."
-
-[[checks]]
-id = "rollback-target"
-type = "manual"
-stage = "stage3"
-description = "Previous stable digest of each independently rollable Deployment is recorded before promotion."
-required = true
-evidence_required = "flex-auth-user-engine and flex-auth-tenant-engine image digests."
diff --git a/tests/stage1.sh b/tests/stage1.sh
deleted file mode 100755
index 33234eb..0000000
--- a/tests/stage1.sh
+++ /dev/null
@@ -1,15 +0,0 @@
-#!/usr/bin/env bash
-# Stage 1 overlay render: contract + helm template of every independently
-# rollable values file. Does not contact the cluster.
-set -euo pipefail
-cd "$(dirname "${BASH_SOURCE[0]}")/.."
-
-python3 tests/validate_app_toml.py
-
-for values in values/stage1.yaml values/stage2-canary.yaml values/stage3-production.yaml \
-              values/user-engine.yaml values/tenant-engine.yaml; do
-  echo "helm template ${values}"
-  helm template flex-auth charts/flex-auth -f "${values}" --namespace flex-auth >/dev/null
-done
-
-echo "stage1 overlay render ok"
diff --git a/tests/validate_app_toml.py b/tests/validate_app_toml.py
deleted file mode 100755
index 4989e0e..0000000
--- a/tests/validate_app_toml.py
+++ /dev/null
@@ -1,38 +0,0 @@
-#!/usr/bin/env python3
-"""Validate railiance/app.toml against the railiance.app.v1 schema."""
-
-from __future__ import annotations
-
-import json
-import sys
-import tomllib
-from pathlib import Path
-
-ROOT = Path(__file__).resolve().parents[1]
-CONTRACT = ROOT / "railiance" / "app.toml"
-SCHEMA_CANDIDATES = [
-    Path.home() / "railiance-bootstrap" / "schemas" / "railiance-app.schema.json",
-    Path.home() / "railiance-cluster" / "schemas" / "railiance-app.schema.json",
-]
-
-
-def main() -> int:
-    schema_path = next((path for path in SCHEMA_CANDIDATES if path.exists()), None)
-    if schema_path is None:
-        print("railiance-app.schema.json not found in railiance-bootstrap or railiance-cluster", file=sys.stderr)
-        return 1
-    try:
-        import jsonschema
-    except ImportError:
-        print("python3-jsonschema is required to validate railiance/app.toml", file=sys.stderr)
-        return 1
-
-    document = tomllib.loads(CONTRACT.read_text())
-    schema = json.loads(schema_path.read_text())
-    jsonschema.validate(document, schema)
-    print(f"valid {CONTRACT.relative_to(ROOT)} against {schema_path}")
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
diff --git a/values/stage1.yaml b/values/stage1.yaml
deleted file mode 100644
index 006215e..0000000
--- a/values/stage1.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-# Local render-only values. Same isolated shape as the canary; no cluster apply.
-name: flex-auth-local
-image:
-  repository: forgejo.coulomb.social/coulomb/flex-auth
-  digest: sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4
-args:
-  - serve
-  - --addr
-  - 0.0.0.0:8080
-  - --registry
-  - /opt/flex-auth/examples/user-engine/registry_snapshot.json
-  - --policy
-  - /opt/flex-auth/examples/user-engine/policy_package.md
-consumer:
-  isolated: true
diff --git a/values/stage2-canary.yaml b/values/stage2-canary.yaml
deleted file mode 100644
index 9e75462..0000000
--- a/values/stage2-canary.yaml
+++ /dev/null
@@ -1,16 +0,0 @@
-# Isolated canary. Distinct Service name so production consumers never see it.
-# NetworkPolicy admits no ingress. Roll independently of the two production pins.
-name: flex-auth-canary
-image:
-  repository: forgejo.coulomb.social/coulomb/flex-auth
-  digest: sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4
-args:
-  - serve
-  - --addr
-  - 0.0.0.0:8080
-  - --registry
-  - /opt/flex-auth/examples/user-engine/registry_snapshot.json
-  - --policy
-  - /opt/flex-auth/examples/user-engine/policy_package.md
-consumer:
-  isolated: true
diff --git a/values/stage3-production.yaml b/values/stage3-production.yaml
deleted file mode 100644
index 6665da2..0000000
--- a/values/stage3-production.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-# Stage 3 values for the isolated canary release (flex-auth-canary).
-# Promoting this release does not move the production consumer pins.
-# Production pins live in values/user-engine.yaml and values/tenant-engine.yaml
-# and must be rolled independently.
-name: flex-auth-canary
-image:
-  repository: forgejo.coulomb.social/coulomb/flex-auth
-  digest: sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4
-args:
-  - serve
-  - --addr
-  - 0.0.0.0:8080
-  - --registry
-  - /opt/flex-auth/examples/user-engine/registry_snapshot.json
-  - --policy
-  - /opt/flex-auth/examples/user-engine/policy_package.md
-consumer:
-  isolated: true
diff --git a/values/tenant-engine.yaml b/values/tenant-engine.yaml
deleted file mode 100644
index a438289..0000000
--- a/values/tenant-engine.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# Production pin for the tenant-engine policy service. Independently rollable.
-name: flex-auth-tenant-engine
-image:
-  repository: forgejo.coulomb.social/coulomb/flex-auth
-  digest: sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa
-args:
-  - serve
-  - --addr
-  - 0.0.0.0:8080
-  - --registry
-  - /opt/flex-auth/examples/tenant-engine/registry_snapshot.json
-  - --policy
-  - /opt/flex-auth/examples/tenant-engine/policy_package.md
-consumer:
-  isolated: false
-  namespace: tenant-engine
-  podName: tenant-engine
diff --git a/values/user-engine.yaml b/values/user-engine.yaml
deleted file mode 100644
index 51b9c52..0000000
--- a/values/user-engine.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# Production pin for the user-engine policy service. Independently rollable.
-name: flex-auth-user-engine
-image:
-  repository: forgejo.coulomb.social/coulomb/flex-auth
-  digest: sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4
-args:
-  - serve
-  - --addr
-  - 0.0.0.0:8080
-  - --registry
-  - /opt/flex-auth/examples/user-engine/registry_snapshot.json
-  - --policy
-  - /opt/flex-auth/examples/user-engine/policy_package.md
-consumer:
-  isolated: false
-  namespace: user-engine
-  podName: user-engine
diff --git a/workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md b/workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md
index 0b299f4..bfdb16e 100644
--- a/workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md
+++ b/workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md
@@ -4,7 +4,7 @@ type: workplan
 title: "Bring flex-auth under the railiance staged-promotion contract"
 domain: infotech
 repo: flex-auth
-status: active
+status: proposed
 owner: codex
 topic_slug: netkingdom
 planning_priority: P2
@@ -14,7 +14,7 @@ depends_on_workplans:
 related_workplans:
   - RAIL-BS-WP-0006
 created: "2026-08-11"
-updated: "2026-08-16"
+updated: "2026-08-11"
 state_hub_workstream_id: "b17c3296-f8ae-4f61-bcf7-41ac80bacd47"
 ---
 
@@ -61,7 +61,7 @@ policy rollouts.
 
 ```task
 id: FLEX-WP-0011-T01
-status: done
+status: todo
 priority: medium
 state_hub_task_id: "edc7fee5-b78d-4a5c-a773-42c5b39d0019"
 ```
@@ -84,31 +84,11 @@ rollback runbook content rather than discarding it.
 Done when the overlay renders and a server-side dry run of the full manifest
 set is accepted.
 
-Done 2026-08-16: `railiance/app.toml` validates against `railiance.app.v1`
-(`criticality = high`, `digest_policy = required`, both production
-`/healthz` endpoints plus isolated canary). One chart, three independently
-rollable values files (`values/tenant-engine.yaml`,
-`values/user-engine.yaml`, `values/stage2-canary.yaml`).
-`tests/stage1.sh` renders all five values files. `bin/railiance run .`
-passed (stage1 result `/tmp/flex-auth-stage1-result.json`). Server-side
-dry run of canary + both production pins accepted (`kubectl apply
---dry-run=server --server-side` and `helm upgrade --dry-run=server` for
-the canary). `deploy/README.md` kept as the emergency kubectl path and
-points at the overlay.
-
-Live discovery while pinning values: `flex-auth-tenant-engine` is back on
-`sha256:c25fc34a…` (four-action policy). `tenant.retire` /
-`tenant.update` / `tenant.reactivate` deny `unknown_action`. The
-FLEX-WP-0010 image `sha256:9320df39…` is a ReplicaSet at desired=0.
-Overlay pins match live; tenant-engine was notified
-(`50a48026-a75b-4b1f-97f6-7c60063a30b8`). This workplan does not
-re-promote that image.
-
 ## T02 - Prove the stage commands
 
 ```task
 id: FLEX-WP-0011-T02
-status: done
+status: todo
 priority: medium
 state_hub_task_id: "5283bc1f-88c3-431b-a9ea-4a900a3e5885"
 ```
@@ -121,31 +101,11 @@ target before promoting.
 Done when a full promote-then-rollback cycle has been demonstrated and the
 evidence ids are recorded here.
 
-Done 2026-08-16 on railiance01, isolated release `flex-auth-canary` only.
-Production pins were not moved.
-
-| Step | Result | Evidence |
-| --- | --- | --- |
-| Approval | isolated-canary-only | progress `6b07bee3-0fd6-4b08-bb06-5dddac4130d9` |
-| `stage deploy` apply | Helm rev 1, deploy 1/1 | stage2-deploy-result status `applied` |
-| `stage observe` live | rollout/pods passed; metrics optional unavailable | stage2-observe-result status `passed` |
-| Canary `/healthz` | 200 `{"status":"ok"}` | port-forward 19101 |
-| Canary `me.read` | allow / `self_service` | `decision:27cbab2e5533508a` |
-| `stage promote` apply | Helm rev 2 | stage3-promote-result status `applied` |
-| `stage rollback` apply `--revision 1` | Helm rev 3 "Rollback to 1" | stage3-rollback-result status `applied` |
-| Cleanup | `helm uninstall flex-auth-canary` | production deploys unchanged |
-
-Previous stable recorded before promote:
-`flex-auth-user-engine@sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4`
-`flex-auth-tenant-engine@sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa`
-
-Candidate image: `sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4`.
-
 ## T03 - Correct the stale drain-plan row
 
 ```task
 id: FLEX-WP-0011-T03
-status: wait
+status: todo
 priority: low
 state_hub_task_id: "bebd6ed9-9145-4fc0-bdc8-cac669643c62"
 ```
@@ -162,9 +122,3 @@ whether wave 7 can be closed.
 
 Done when the row reflects reality or a custodian decision id explains why it
 stands.
-
-Raised 2026-08-16 with `the-custodian` (message
-`7219e675-fd39-42ca-a302-8722a895531d`). Confirmed the same day:
-railiance01 namespace `flex-auth` is Active (7d+); coulombcore has k3s
-but no `flex-auth` namespace and no flex-auth Deployments. Wave 7.3 has
-nothing left to drain. T03 waits on the canon edit or a decision id.
diff --git a/workplans/FLEX-WP-0012-credential-grant-authorization-surface.md b/workplans/FLEX-WP-0012-credential-grant-authorization-surface.md
index 2a8ec53..73eb283 100644
--- a/workplans/FLEX-WP-0012-credential-grant-authorization-surface.md
+++ b/workplans/FLEX-WP-0012-credential-grant-authorization-surface.md
@@ -13,7 +13,6 @@ related_workplans:
   - RAILIANCE-WP-0005
 created: "2026-08-11"
 updated: "2026-08-11"
-state_hub_workstream_id: "89ecdb1f-ceb0-4a50-b72d-c3dfd5fa7c73"
 ---
 
 # FLEX-WP-0012 - Authorize railiance-platform credential-grant requests
@@ -86,7 +85,6 @@ What is *actually* missing is narrower and worth stating precisely:
 id: FLEX-WP-0012-T01
 status: todo
 priority: medium
-state_hub_task_id: "a1c9ba0c-3413-4823-9f9e-ccee09cf5d74"
 ```
 
 Two honest options, and the choice is a charter question rather than a
@@ -128,7 +126,6 @@ something they own.
 id: FLEX-WP-0012-T02
 status: todo
 priority: medium
-state_hub_task_id: "7e9c4e59-e59c-4617-a87f-99142952fe78"
 ```
 
 Add `examples/railiance-platform/` with a protected-system manifest, subject
@@ -165,7 +162,6 @@ for an unregistered grant.
 id: FLEX-WP-0012-T03
 status: todo
 priority: medium
-state_hub_task_id: "3335b2b7-cf1a-411d-95b3-03c4b4c35659"
 ```
 
 Implement whichever shape T01 chose. If B, the adapter must reuse the
@@ -199,7 +195,6 @@ over real HTTP, `go test ./...` is green, and `gofmt`/`go vet` are clean.
 id: FLEX-WP-0012-T04
 status: todo
 priority: low
-state_hub_task_id: "40015a87-040c-4d48-b360-fd5566dbc552"
 ```
 
 Reply to capability request `893ff109` — it has been open since 2026-07-02