NK-WP-0039-T04: retire runtime.yaml to owner pointers; finish NK-WP-0039

tenant-engine disposition TEN-DEC-2026-003.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 6969@bnt-lap001
Assistant-Session: e8ae73f2-8385-4c9c-b714-94c3c52cdbc0

sso-mfa/k8s/README.md

@@ -54,9 +54,8 @@ verification and recovery procedure for those claims.
 
 Start with the owning package's current declaration, immutable image and
 reviewed rollout/rollback procedure. Do not recursively apply this tree.
-`tenant-engine/runtime.yaml` remains **REFERENCE ONLY — DO NOT APPLY** while
-its owner decides the disposition of the five retained historical objects.
-Its obsolete flex-auth objects have been replaced with owner pointers.
+`tenant-engine/runtime.yaml` is retired (NK-WP-0039-T04) and holds owner pointers only, no
+objects; the Tenant Engine and flex-auth declarations live with their owners.
 
 The scripts and manifests elsewhere in this directory have individual scopes;
 their presence here does not make them current production repair commands.

sso-mfa/k8s/tenant-engine/README.md

@@ -1,13 +1,16 @@
 # Tenant Engine integration references
 
-`runtime.yaml` is **REFERENCE ONLY — DO NOT APPLY**. Its five remaining
-Tenant Engine objects are historical and differ from the live deployment in
-image, storage, strategy, environment and egress. Their disposition awaits the
-Tenant Engine owner under
-[NK-WP-0039-T04](../../../workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md).
+`runtime.yaml` is **retired** and now holds pointers only, no Kubernetes
+objects (NK-WP-0039-T04, 2026-10-01). NetKingdom does not own the Tenant Engine
+or flex-auth runtime (ADR-0015); do not recreate a copy here.
 
-The obsolete flex-auth objects were removed on 2026-09-28 with the owner's
-agreement. Use the owner's maintained declarations and deployment procedure:
+Tenant Engine: [`deploy/base/tenant-engine.yaml`](../../../../tenant-engine/deploy/base/tenant-engine.yaml)
+(`kubectl apply -k deploy/`) with the promotion contract in
+[`railiance/app.toml`](../../../../tenant-engine/railiance/app.toml)
+(TEN-DEC-2026-003).
+
+The flex-auth objects were removed on 2026-09-28 with the owner's
+agreement. For flex-auth consumers use the owner's maintained declarations and deployment procedure:
 
 | Consumer | Authoritative values in the flex-auth repository |
 | --- | --- |

sso-mfa/k8s/tenant-engine/runtime.yaml

@@ -1,68 +1,13 @@
-# REFERENCE ONLY - DO NOT APPLY. Not the runtime source of truth (ADR-0015).
-# Only historical tenant-engine objects remain, pending its owner's disposition.
-# Live tenant-engine differs in image, storage, strategy, environment and egress.
-# The obsolete flex-auth objects were removed under NK-WP-0039-T04.
-# Authoritative flex-auth declarations (repository: coulomb/access-engine, formerly flex-auth):
+# RETIRED - POINTERS ONLY. This file holds no Kubernetes objects. DO NOT APPLY.
+# NetKingdom does not own the tenant-engine or flex-auth runtime (ADR-0015).
+# Retired 2026-10-01 under NK-WP-0039-T04 with both owners' agreement.
+#
+# tenant-engine (TEN-DEC-2026-003, tenant-engine@6c137c1):
+#   declaration:        tenant-engine/deploy/base/tenant-engine.yaml
+#                       (kubectl apply -k deploy/, TEN-WP-0008)
+#   promotion contract: tenant-engine/railiance/app.toml
+# flex-auth consumers (repository: coulomb/access-engine, formerly flex-auth):
 #   values/tenant-engine.yaml
 #   values/user-engine.yaml
 # Rendered by that repository's charts/flex-auth, including caller enforcement.
-# See README.md for owner links, retained runtime names and the remaining gate.
-apiVersion: v1
-kind: Namespace
-metadata: {name: tenant-engine, labels: {net-kingdom/component: tenant-engine}}
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata: {name: tenant-engine-data, namespace: tenant-engine}
-spec: {accessModes: [ReadWriteOnce], resources: {requests: {storage: 1Gi}}}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata: {name: tenant-engine, namespace: tenant-engine}
-spec:
-  replicas: 1
-  strategy: {type: Recreate}
-  selector: {matchLabels: {app.kubernetes.io/name: tenant-engine}}
-  template:
-    metadata: {labels: {app.kubernetes.io/name: tenant-engine}}
-    spec:
-      automountServiceAccountToken: false
-      securityContext: {runAsNonRoot: true, fsGroup: 10001, seccompProfile: {type: RuntimeDefault}}
-      containers:
-        - name: tenant-engine
-          image: forgejo.coulomb.social/coulomb/tenant-engine@sha256:2249e8c6ee44ae36081cddc52daf9c3f63acd18a95a5d620ab4fa7ac85149207
-          ports: [{name: http, containerPort: 8090}]
-          env:
-            - {name: TENANT_ENGINE_DATABASE_PATH, value: /data/tenant-engine.db}
-            - {name: TENANT_ENGINE_FLEX_AUTH_URL, value: "http://flex-auth-tenant-engine.flex-auth.svc.cluster.local:8080"}
-          volumeMounts: [{name: data, mountPath: /data}]
-          securityContext: {allowPrivilegeEscalation: false, capabilities: {drop: ["ALL"]}, readOnlyRootFilesystem: true}
-          resources: {requests: {cpu: 25m, memory: 48Mi}, limits: {cpu: 300m, memory: 192Mi}}
-          readinessProbe: {httpGet: {path: /health, port: http}, periodSeconds: 5}
-          livenessProbe: {httpGet: {path: /health, port: http}, periodSeconds: 20}
-      volumes: [{name: data, persistentVolumeClaim: {claimName: tenant-engine-data}}]
----
-apiVersion: v1
-kind: Service
-metadata: {name: tenant-engine, namespace: tenant-engine}
-spec: {selector: {app.kubernetes.io/name: tenant-engine}, ports: [{name: http, port: 8090, targetPort: http}]}
----
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata: {name: tenant-engine, namespace: tenant-engine}
-spec:
-  podSelector: {matchLabels: {app.kubernetes.io/name: tenant-engine}}
-  policyTypes: [Ingress, Egress]
-  ingress:
-    - from:
-        - namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: user-engine}}
-          podSelector: {matchLabels: {app.kubernetes.io/name: user-engine}}
-      ports: [{protocol: TCP, port: 8090}]
-  egress:
-    - to:
-        - namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: flex-auth}}
-          podSelector: {matchLabels: {app.kubernetes.io/name: flex-auth-tenant-engine}}
-      ports: [{protocol: TCP, port: 8080}]
-    - to:
-        - namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: kube-system}}
-      ports: [{protocol: UDP, port: 53}, {protocol: TCP, port: 53}]
+# See README.md for owner links and retained runtime names.

workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md

@@ -4,12 +4,12 @@ type: workplan
 title: "Take in the flex-auth to access-engine repository-coordinate rename"
 domain: infotech
 repo: net-kingdom
-status: blocked
+status: finished
 flavor: implementation
 owner: claude-code
 topic_slug: netkingdom
 created: "2026-09-23"
-updated: "2026-09-28"
+updated: "2026-10-01"
 related: [FLEX-WP-0020, FLEX-DEC-2026-013, NK-WP-0026]
 state_hub_workstream_id: "284a8ac2-61dc-5bee-b74a-0a62d9808edb"
 ---
@@ -113,9 +113,7 @@ runtime/package names. NK-WP-0026 remains a historical record.
 
 ```task
 id: NK-WP-0039-T04
-status: wait
-blocked_on: message-from:flex-auth
-blocking_reason: "Retire-vs-reconcile answer routed to flex-auth (2c637dc9) and tenant-engine (9fc740da); act on whichever returns, do not pre-empt."
+status: done
 priority: high
 state_hub_task_id: "2541f523-e433-5900-b119-5825f0e71ef3"
 ```
@@ -197,3 +195,12 @@ pack reads resolve there. Runtime and package names are untouched (`flex-auth` n
 audience, `cmd/flex-auth`, chart, `coulomb/flex-auth` image); no rollout. Historical records keep
 the old name. The three owned workloads were ready 1/1 after the change. T04 still waits on
 tenant-engine.
+
+## tenant-engine disposition — 2026-10-01
+
+tenant-engine answered (`f074729d-41f8-4c5b-a9e0-5189aad78a8f`): retire, recorded as TEN-DEC-2026-003
+(tenant-engine@6c137c1). The five remaining tenant-engine objects are gone from
+`sso-mfa/k8s/tenant-engine/runtime.yaml`, which now holds pointers only (it parses as no documents):
+`tenant-engine/deploy/base/tenant-engine.yaml`, `tenant-engine/railiance/app.toml` and the access-engine
+values files. Nothing here consumed the file. The README and `sso-mfa/k8s/README.md` say so and every link
+resolves. No cluster change. T04 is closed and every task is done, so the plan is `finished`.