NK-WP-0039-T03: point repository coordinates at access-engine

Runtime and package names stay flex-auth (FLEX-DEC-2026-013).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 6969@bnt-lap001
Assistant-Session: e8ae73f2-8385-4c9c-b714-94c3c52cdbc0

docs/tutorials/protected-system-flex-auth.md

@@ -19,7 +19,7 @@ back, and is refused when the caller is wrong.
 ## Prerequisites
 
 - **[owner: flex-auth]** A local checkout of `flex-auth` with Go, to run
-  `go run ./cmd/flex-auth`. Read `flex-auth/docs/decision-record-contract.md`.
+  `go run ./cmd/flex-auth`. Read `access-engine/docs/decision-record-contract.md`.
 - **[owner: your system's repo]** A system id and a list of the things it
   protects and the actions it performs on them.
 - **[owner: railiance-platform / package owner, ADR-0015]** A Kubernetes
@@ -67,7 +67,7 @@ consumer running with caller auth in `warn` mode is not protected.
    `Authorization: Bearer`. Use the in-cluster trailing-dot FQDN of the pin, never
    a bare service name.
 7. **[owner: flex-auth]** Set caller authentication to `enforce` and run the
-   four negative tests from `flex-auth/docs/operator-caller-access-path.md`
+   four negative tests from `access-engine/docs/operator-caller-access-path.md`
    (no header, wrong ServiceAccount, wrong audience, expired token).
 8. **[owner: your system's repo]** Enforce the envelope: `allow` proceeds;
    `deny` blocks; `redact` and `audit_only` apply their obligations; any

runbooks/protected-system-flex-auth/pack.yaml

@@ -22,9 +22,9 @@ actors:
     privileges: [enforce-decisions]
 datapoints:
   - id: flexauth_home
-    label: flex-auth checkout
+    label: access-engine checkout (repository formerly flex-auth)
     type: path
-    default: ~/flex-auth
+    default: ~/access-engine
     dimensions: {actor: operator, kind: location, subsystem: flex-auth}
     ask_in: offline
   - id: example
@@ -76,7 +76,7 @@ stages:
     title: "Offline: the policy is sound"
     goal: The protected system's manifest, policy and registry validate, and the policy gives the decisions the vocabulary promises.
     framing:
-      - Read flex-auth/docs/decision-record-contract.md and flex-auth/docs/operator-caller-access-path.md first.
+      - Read access-engine/docs/decision-record-contract.md and access-engine/docs/operator-caller-access-path.md first.
     steps:
       - id: prerequisites
         title: Confirm the prerequisites

sso-mfa/k8s/tenant-engine/README.md

@@ -11,20 +11,20 @@ agreement. Use the owner's maintained declarations and deployment procedure:
 
 | Consumer | Authoritative values in the flex-auth repository |
 | --- | --- |
-| Tenant Engine | [values/tenant-engine.yaml](../../../../flex-auth/values/tenant-engine.yaml) |
-| User Engine | [values/user-engine.yaml](../../../../flex-auth/values/user-engine.yaml) |
+| Tenant Engine | [values/tenant-engine.yaml](../../../../access-engine/values/tenant-engine.yaml) |
+| User Engine | [values/user-engine.yaml](../../../../access-engine/values/user-engine.yaml) |
 
-The [owner Helm chart](../../../../flex-auth/charts/flex-auth) renders the
+The [owner Helm chart](../../../../access-engine/charts/flex-auth) renders the
 consumer Deployment, Service and NetworkPolicy, including caller-auth
 configuration. Both reviewed value files select enforcement and bind the
 consumer to its own Kubernetes ServiceAccount. Keep those settings at their
 owner; do not recreate a frozen deployment copy here.
 
-These links assume sibling checkouts. The current repository coordinate is
-`coulomb/flex-auth`; its proposed rename to `coulomb/access-engine` remains
-gated by FLEX-WP-0020. NK-WP-0039-T03 will update these repository pointers
-when the owner confirms the new coordinate. The `flex-auth` namespace,
-Service DNS, caller-token audience and OCI package coordinate remain unchanged.
+These links assume sibling checkouts. The repository is `coulomb/access-engine`
+(formerly `coulomb/flex-auth`; same Forge ID, renamed under FLEX-WP-0020). The
+product and runtime names stay `flex-auth`: the `flex-auth` namespace, Service
+DNS, caller-token audience, `cmd/flex-auth`, the chart name and the OCI package
+coordinate `coulomb/flex-auth` are unchanged (FLEX-DEC-2026-013).
 
 Ownership follows [ADR-0015](../../../docs/adr/ADR-0015-netkingdom-railiance-workload-packaging-and-relational-platform.md).
 Removing references requires no cluster apply or rollout. Do not use the

sso-mfa/k8s/tenant-engine/runtime.yaml

@@ -2,7 +2,7 @@
 # Only historical tenant-engine objects remain, pending its owner's disposition.
 # Live tenant-engine differs in image, storage, strategy, environment and egress.
 # The obsolete flex-auth objects were removed under NK-WP-0039-T04.
-# Authoritative flex-auth declarations (repository: coulomb/flex-auth):
+# Authoritative flex-auth declarations (repository: coulomb/access-engine, formerly flex-auth):
 #   values/tenant-engine.yaml
 #   values/user-engine.yaml
 # Rendered by that repository's charts/flex-auth, including caller enforcement.

workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md

@@ -93,9 +93,7 @@ pulls after the rename. The image pins do not change because of the rename.
 
 ```task
 id: NK-WP-0039-T03
-status: wait
-depends_on: [FLEX-WP-0020]
-blocking_reason: "Await the flex-auth announcement that coulomb/access-engine resolves (FLEX-WP-0020), then verify repository-coordinate references."
+status: done
 priority: medium
 state_hub_task_id: "6e62919d-117d-57ab-b55b-1b437a105402"
 ```
@@ -188,3 +186,14 @@ flex-auth's T04 waited on a net-kingdom reply naming the owner work-record. Sent
 unchanged runtime names and image coordinates, digests matching flex-auth's
 `values/<consumer>.yaml`. T03 still waits on flex-auth's rename-landed notice
 (their T06); T04 still waits on tenant-engine. No cluster change was made.
+
+## Rename landed — 2026-09-30
+
+access-engine announced (`2e406bee-8515-4623-a74f-3d17e20a3ea7`) that `coulomb/access-engine`
+serves Forge ID 42 and `~/access-engine` is canonical. T03 done: the tenant-engine README links, the
+`runtime.yaml` header, the `nk.protected-system-flex-auth` pack default (`~/access-engine`) and the
+matching tutorial text now name `access-engine`. Both value files, the chart and the two docs the
+pack reads resolve there. Runtime and package names are untouched (`flex-auth` namespace, Service DNS,
+audience, `cmd/flex-auth`, chart, `coulomb/flex-auth` image); no rollout. Historical records keep
+the old name. The three owned workloads were ready 1/1 after the change. T04 still waits on
+tenant-engine.