Follow the access-engine CLI rename: ./cmd/flex-auth -> ./cmd/access-engine

FLEX-DEC-2026-020; the old path is a stub that exits 2. Runtime names unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 736651@bnt-lap001
Assistant-Session: f6189624-fd64-4109-b53e-f8a59ca8a2d8

docs/tutorials/protected-system-flex-auth.md

@@ -19,7 +19,7 @@ back, and is refused when the caller is wrong.
 ## Prerequisites
 
 - **[owner: flex-auth]** A local checkout of `flex-auth` with Go, to run
-  `go run ./cmd/flex-auth`. Read `access-engine/docs/decision-record-contract.md`.
+  `go run ./cmd/access-engine`. Read `access-engine/docs/decision-record-contract.md`.
 - **[owner: your system's repo]** A system id and a list of the things it
   protects and the actions it performs on them.
 - **[owner: railiance-platform / package owner, ADR-0015]** A Kubernetes
@@ -53,10 +53,10 @@ consumer running with caller auth in `warn` mode is not protected.
    fixtures covering every allow and every denial branch, including wrong
    tenant, unknown subject and unknown action.
 4. **[owner: flex-auth]** Validate and load offline:
-   `go run ./cmd/flex-auth validate -kind policy -file <policy_package.md>`
+   `go run ./cmd/access-engine validate -kind policy -file <policy_package.md>`
-   then `go run ./cmd/flex-auth load-registry -file <registry_snapshot.json>`.
+   then `go run ./cmd/access-engine load-registry -file <registry_snapshot.json>`.
 5. **[owner: flex-auth]** Evaluate a check request locally:
-   `go run ./cmd/flex-auth check -registry <registry_snapshot.json> -policy <policy_package.md> -request <request.json>`.
+   `go run ./cmd/access-engine check -registry <registry_snapshot.json> -policy <policy_package.md> -request <request.json>`.
    A request is `tenant`, `subject`, `action`, `resource` and `context`. The
    result is a decision envelope (`flex-auth.decision-record.v1`) with
    `effect`, `reason`, and a deterministic decision `id`.

runbooks/protected-system-flex-auth/pack.yaml

@@ -82,7 +82,7 @@ stages:
         title: Confirm the prerequisites
         actor: operator
         owner: workstation
-        description: "A flex-auth checkout with Go, to run go run ./cmd/flex-auth (flex-auth); kubectl access to the cluster through the k3s-api tunnel (ops-bridge); the live pin runs with --caller-auth-mode enforce and its bound ServiceAccount exists (package owner, ADR-0015)."
+        description: "A flex-auth checkout with Go, to run go run ./cmd/access-engine (flex-auth); kubectl access to the cluster through the k3s-api tunnel (ops-bridge); the live pin runs with --caller-auth-mode enforce and its bound ServiceAccount exists (package owner, ADR-0015)."
         idempotent: idempotent
         verify:
           done_when: All three prerequisites hold
@@ -105,11 +105,11 @@ stages:
         owner: flex-auth
         requires: [read-manifest]
         uses: [flexauth_home, example]
-        command: cd {{flexauth_home}} && go run ./cmd/flex-auth validate -kind policy -file {{example}}/policy_package.md
+        command: cd {{flexauth_home}} && go run ./cmd/access-engine validate -kind policy -file {{example}}/policy_package.md
         idempotent: idempotent
         verify:
           done_when: validate exits 0
-          command: cd {{flexauth_home}} && go run ./cmd/flex-auth validate -kind policy -file {{example}}/policy_package.md
+          command: cd {{flexauth_home}} && go run ./cmd/access-engine validate -kind policy -file {{example}}/policy_package.md
           expect: exit-0
       - id: load-registry
         title: Load the registry snapshot offline
@@ -117,11 +117,11 @@ stages:
         owner: flex-auth
         requires: [validate-policy]
         uses: [flexauth_home, example]
-        command: cd {{flexauth_home}} && go run ./cmd/flex-auth load-registry -file {{example}}/registry_snapshot.json
+        command: cd {{flexauth_home}} && go run ./cmd/access-engine load-registry -file {{example}}/registry_snapshot.json
         idempotent: idempotent
         verify:
           done_when: load-registry exits 0
-          command: cd {{flexauth_home}} && go run ./cmd/flex-auth load-registry -file {{example}}/registry_snapshot.json
+          command: cd {{flexauth_home}} && go run ./cmd/access-engine load-registry -file {{example}}/registry_snapshot.json
           expect: exit-0
       - id: check-allow
         title: A permitted request is allowed
@@ -130,12 +130,12 @@ stages:
         requires: [load-registry]
         uses: [flexauth_home, example]
         command: |
-          cd {{flexauth_home}} && go run ./cmd/flex-auth check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_allow_rotate.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))"
+          cd {{flexauth_home}} && go run ./cmd/access-engine check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_allow_rotate.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))"
         idempotent: idempotent
         verify:
           done_when: The decision is allow with reason catalog_lane_policy_matched
           command: |
-            cd {{flexauth_home}} && go run ./cmd/flex-auth check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_allow_rotate.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))"
+            cd {{flexauth_home}} && go run ./cmd/access-engine check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_allow_rotate.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))"
           expect: output-contains
           contains: allow catalog_lane_policy_matched
       - id: check-wrong-tenant
@@ -145,12 +145,12 @@ stages:
         requires: [load-registry]
         uses: [flexauth_home, example]
         command: |
-          cd {{flexauth_home}} && go run ./cmd/flex-auth check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_wrong_tenant.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))"
+          cd {{flexauth_home}} && go run ./cmd/access-engine check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_wrong_tenant.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))"
         idempotent: idempotent
         verify:
           done_when: The decision is deny with reason wrong_tenant
           command: |
-            cd {{flexauth_home}} && go run ./cmd/flex-auth check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_wrong_tenant.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))"
+            cd {{flexauth_home}} && go run ./cmd/access-engine check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_wrong_tenant.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))"
           expect: output-contains
           contains: deny wrong_tenant
       - id: check-unknown-action
@@ -160,12 +160,12 @@ stages:
         requires: [load-registry]
         uses: [flexauth_home, example]
         command: |
-          cd {{flexauth_home}} && go run ./cmd/flex-auth check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_revoke_not_an_action.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))"
+          cd {{flexauth_home}} && go run ./cmd/access-engine check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_revoke_not_an_action.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))"
         idempotent: idempotent
         verify:
           done_when: The decision is deny with reason unknown_action
           command: |
-            cd {{flexauth_home}} && go run ./cmd/flex-auth check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_revoke_not_an_action.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))"
+            cd {{flexauth_home}} && go run ./cmd/access-engine check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_revoke_not_an_action.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))"
           expect: output-contains
           contains: deny unknown_action
       - id: check-unknown-subject
@@ -175,12 +175,12 @@ stages:
         requires: [load-registry]
         uses: [flexauth_home, example]
         command: |
-          cd {{flexauth_home}} && go run ./cmd/flex-auth check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_unknown_subject.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))"
+          cd {{flexauth_home}} && go run ./cmd/access-engine check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_unknown_subject.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))"
         idempotent: idempotent
         verify:
           done_when: The decision is deny with reason unknown_subject
           command: |
-            cd {{flexauth_home}} && go run ./cmd/flex-auth check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_unknown_subject.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))"
+            cd {{flexauth_home}} && go run ./cmd/access-engine check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_unknown_subject.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))"
           expect: output-contains
           contains: deny unknown_subject
     gates:
@@ -191,7 +191,7 @@ stages:
         downstream_risk: A policy that allows what it should deny, or denies for the wrong reason, makes the live caller tests meaningless.
         checks:
           - done_when: The policy package validates and the registry loads
-            command: cd {{flexauth_home}} && go run ./cmd/flex-auth validate -kind policy -file {{example}}/policy_package.md && go run ./cmd/flex-auth load-registry -file {{example}}/registry_snapshot.json
+            command: cd {{flexauth_home}} && go run ./cmd/access-engine validate -kind policy -file {{example}}/policy_package.md && go run ./cmd/access-engine load-registry -file {{example}}/registry_snapshot.json
             expect: exit-0
           - done_when: One allow and three denials (wrong tenant, unknown action, unknown subject) each gave the expected decision and reason
             expect: manual

sso-mfa/k8s/tenant-engine/README.md

@@ -26,8 +26,9 @@ owner; do not recreate a frozen deployment copy here.
 These links assume sibling checkouts. The repository is `coulomb/access-engine`
 (formerly `coulomb/flex-auth`; same Forge ID, renamed under FLEX-WP-0020). The
 product and runtime names stay `flex-auth`: the `flex-auth` namespace, Service
-DNS, caller-token audience, `cmd/flex-auth`, the chart name and the OCI package
+DNS, caller-token audience, the chart name and the OCI package coordinate
-coordinate `coulomb/flex-auth` are unchanged (FLEX-DEC-2026-013).
+`coulomb/flex-auth` are unchanged (FLEX-DEC-2026-013). The CLI is now
+`cmd/access-engine`; `cmd/flex-auth` is a stub that exits 2 (FLEX-DEC-2026-020).
 
 Ownership follows [ADR-0015](../../../docs/adr/ADR-0015-netkingdom-railiance-workload-packaging-and-relational-platform.md).
 Removing references requires no cluster apply or rollout. Do not use the

workplans/ADHOC-2026-10-10.md

@@ -0,0 +1,28 @@
+---
+id: NK-WP-ADHOC-2026-10-10
+type: workplan
+title: "Follow the access-engine CLI rename"
+domain: infotech
+repo: net-kingdom
+status: finished
+owner: claude-code
+topic_slug: net-kingdom
+created: "2026-10-10"
+updated: "2026-10-10"
+---
+
+## Replace `./cmd/flex-auth` with `./cmd/access-engine`
+
+```task
+id: NK-WP-ADHOC-2026-10-10-T01
+status: done
+priority: medium
+```
+
+access-engine renamed its CLI (FLEX-DEC-2026-020, access-engine 0ced299,
+message `e2f1aac9`): `./cmd/flex-auth` is now a stub that exits 2. The
+protected-system runbook pack and tutorial now call `go run ./cmd/access-engine`
+(subcommands and flags unchanged), and the tenant-engine README no longer lists
+`cmd/flex-auth` among the unchanged runtime names. Runtime names (namespace,
+Service DNS, audience, chart, OCI package) stay `flex-auth` until FLEX-WP-0036.
+`make runbooks-validate` passes; historical records are left as they were.