Add REUSE-WP-0023 for the access-engine source rename

Residual handoff from FLEX-WP-0020 (flex-auth -> access-engine). Forge ID 42
and the repo UUID are unchanged, and runtime names stay flex-auth per
FLEX-DEC-2026-013, so this is a federation-source-coordinate change only.

Both tasks start in wait: the forge rename has not landed (access-engine
raw index returns 404, flex-auth still resolves), and flipping the URL early
would drop an enabled publish-passing source from the composed index.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4609@bnt-lap001
Assistant-Session: 085df492-f02a-4fe6-acad-2aa52789fe1b

workplans/REUSE-WP-0023-access-engine-source-rename.md

@@ -0,0 +1,87 @@
+---
+id: REUSE-WP-0023
+type: workplan
+title: "Follow the access-engine repository rename in federation sources"
+domain: infotech
+repo: reuse-surface
+status: active
+flavor: residual
+owner: claude
+origin: residual
+origin_ref: FLEX-WP-0020
+created: "2026-09-20"
+updated: "2026-09-20"
+---
+
+# access-engine source-coordinate handoff
+
+flex-auth is being renamed to access-engine under FLEX-WP-0020. Forge
+repository ID 42 is unchanged and the State Hub repo UUID
+`fda8ad85-a7d7-4055-8f21-902a533e59df` stays. **Runtime names stay
+`flex-auth`** per FLEX-DEC-2026-013 — this is a repository-coordinate rename
+only, not a service or capability rename.
+
+This repository owns the federation-source side: the URL, cache path, and
+roster entry that point at the renamed repository, plus evidence that the
+published capability survives the move unchanged.
+
+This is the same shape as **REUSE-WP-0021** (identity-canon → commerce-canon,
+finished 2026-09-20); reuse that workplan's approach and evidence format.
+
+## Status at registration — 2026-09-20
+
+**The rename has not landed yet.** Probed on 2026-09-20:
+
+- `https://forgejo.coulomb.social/coulomb/access-engine/raw/main/registry/indexes/capabilities.yaml` → **404**
+- `https://forgejo.coulomb.social/coulomb/flex-auth/raw/main/registry/indexes/capabilities.yaml` → **303** (still resolves)
+
+T01 therefore starts in `wait`. Do not pre-emptively rewrite the source
+coordinates: flipping the URL before the forge rename lands would break an
+enabled, publish-passing source and drop its capability from the composed
+index. Start T01 when `access-engine` serves the raw index.
+
+## Update source coordinates and verify federation
+
+```task
+id: REUSE-WP-0023-T01
+status: wait
+flavor: residual
+priority: medium
+```
+
+Blocked until the forge rename lands (see above).
+
+Update `registry/federation/sources.yaml` and
+`registry/federation/local-repo-roster.yaml` to the canonical access-engine
+URL and path. Refresh that source's cache and recompose
+`registry/indexes/federated.yaml` through the repository's federation tooling.
+
+Preserve the capability identifier published by flex-auth — a repository
+rename alone does not redefine a capability, and runtime names are explicitly
+unchanged by FLEX-DEC-2026-013. Source owner/URL/cache metadata should match
+the newly published access-engine registry.
+
+Verify the capability entry remains discoverable with canonical source links,
+confirm the composed row count does not drop, record commands and results,
+commit, and hand evidence back to FLEX-WP-0020. Leave historical
+workplan/completion provenance intact. No credential, runtime service, or
+capability-semantic migration is authorized by this task.
+
+## Reconcile the hosted hub registration
+
+```task
+id: REUSE-WP-0023-T02
+status: wait
+flavor: residual
+priority: medium
+```
+
+Blocked on T01.
+
+The production hub at `https://reuse.coulomb.social` carries its own repo
+registrations independent of the checked-in manifest. Register the
+access-engine coordinates there and retire the flex-auth registration the same
+way commerce-canon was handled under REUSE-WP-0021: keep the superseded
+registration disabled with a replacement note rather than deleting it, so the
+rename stays auditable. Confirm the hub's composed index serves the capability
+from the canonical URL with no target warnings.