# FLEX-WP-0020-T01 — identity baseline (2026-09-15)

Private preflight file is `/tmp/flex-auth-rename-preflight-0020.json` (mode 0600).
It is not committed. Token material stays there.

| Field | Value |
| --- | --- |
| State Hub UUID | `fda8ad85-a7d7-4055-8f21-902a533e59df` |
| Forge repository ID | `42` |
| Forge full name | `coulomb/flex-auth` |
| Default branch | `main` |
| Local path | `/home/worsch/flex-auth` |
| Remote | `forgejo-remote:coulomb/flex-auth.git` |
| Clone URL | `https://forgejo.coulomb.social/coulomb/flex-auth.git` |
| Host paths | railiance01 `/home/tegwick/flex-auth`; `bnt-lap001` `/home/worsch/flex-auth` |
| Protected/current aliases | `flex-auth` (canonical) |
| Target slug | `access-engine` (Forge reports none yet; available) |
| Preflight `safe_to_apply` | `true` |
| Blockers | none |
| Queued edge writes | none |
| Warning | `active_work_present` (15 tasks / 8 workplans) |
| Report checksum (this capture) | `4b930464e0b92137902481d39cd89b1b2458a8ea88ad08c7ac0c86f2427e7c76` |
| Signing | no longer the August 29 `preflight_signing_unavailable` blocker |

Captured `HEAD` at inspection was `6fd3a0cbc400b9128132497fca69d0096259800c`.
A later commit on this workplan requires a fresh T05 preflight before
`forge-renamed`.

## Active-work disposition (FLEX-DEC-2026-014)

- `FLEX-WP-0017` and `FLEX-WP-0019` are finished (the August 29 snapshot is stale).
- `FLEX-WP-0027-T03` remains `wait` — human review, not a source-identity change.
- `FLEX-WP-0022` T01/T02 remain open; T03 is fixture-only. Coordinate rename
  must not cancel them.
- `FLEX-WP-0020` itself is the cutover plan.

Working tree at inspection: branch `main`, tracking `origin/main`, clean
before this workplan's source edits.

## Proposed mutations (from preflight)

1. Forgejo `name`: `flex-auth` → `access-engine` (`forge-renamed`)
2. State Hub `managed_repos.slug`: `flex-auth` → `access-engine` (`statehub-rebound`)
3. State Hub `managed_repos.remote_url`: `forgejo-remote:coulomb/flex-auth.git` → `https://forgejo.coulomb.social/coulomb/access-engine.git`
4. Slug registry: `flex-auth:canonical` → `flex-auth:alias, access-engine:canonical`

No runtime Deployment, image, or policy-package mutation is in this list.