feat: adopt the owner-documented PDP access path, and prove it live

Adoption asked for by flex-auth (FLEX-WP-0021-T05) and glas-harness
(GLAS-WP-0015), plus the first real decision this engine has obtained from
the deployed pin -- which found a defect the fixtures could not.

ACCESS PATH. require_supported_pdp_address refuses in-cluster Service names
and any non-loopback host. This is no longer a unilateral call: the owner
path is documented as loopback kubectl port-forward over the authenticated
Kubernetes API, which is what authenticates the responder transitively
(FLEX-DEC-2026-010). A Service name from a workstation does not fail, it
resolves through the DNS search suffix to an unrelated public host, and
since decision records carry no signature, a responder knowing the
published package and version can return an allow that passes every check
we make. Fail-closed protects against a PDP that is absent, not one that
lies. The guard runs before the token is read, so a misdirected request
cannot leak it; a test pins that ordering.

LIVE PROOF. Minted a 10-minute TokenRequest token (audience flex-auth, SA
secrets-engine/secrets-engine, mode 0600 outside the worktree, shredded
after), forwarded to the named pod, and sent a real CheckRequest for
glas-claude-agent-dev-anthropic. Result: allow, catalog_lane_policy_matched,
served by v2 (sha256:bd11c5fe...) -- so the redeploy flex-auth flagged as
outstanding has landed and the pin no longer serves the tenant-blind v1.
Our tenant fix is confirmed against the real service: binding.tenant is
tenant:platform.

THE DEFECT IT FOUND. The evaluator enriches from its registry before
hashing -- subject gains attributes and tenant, resource gains tenant --
so binding.request_digest is over material we never sent and cannot
reproduce. validate_decision_envelope rejects every real allow.

Every replay test passes because _request_from() rebuilds the request out
of the binding, i.e. the enriched form: a self-consistent fake agreeing
with itself, which hid this through three rounds of digest work. Third
time a real artifact has beaten a fake in this integration.

NOT FIXED, DELIBERATELY. Rejecting a valid allow is wrong in the safe
direction. Which fields may be enriched is flex-auth's contract to publish;
inferring it means accepting a binding that differs from our proposal in a
way we decided was benign -- the fail-open shape GH-DEC-2026-008 rejected
for vocabularies and FLEX-DEC-2026-007 for digests. Raised with them.

Tenant question closed by operator decision 5ed3fb35: tenant:platform
exactly, and service_auth.TENANT stays tenant:coulomb because the two
identity layers are to remain distinct. Declining to author that mapping
was right -- the answer was neither reading offered.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E4tNMAYcSQmZWUE4wqP4ij

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 715726@bnt-lap001
Assistant-Session: 80a42b32-cba6-4b23-8be0-68819b1a6092

docs/pdp-access-path.md

@@ -0,0 +1,96 @@
+# Reaching the access-engine pin
+
+The supported way for this engine to reach `flex-auth-secrets-engine`, and the
+reason the address is enforced in code rather than left to configuration.
+
+## Never the Service DNS name
+
+```
+SECRETS_ENGINE_PDP_URL=http://flex-auth-secrets-engine.flex-auth.svc.cluster.local:8080
+```
+
+is refused by `decision_check.require_supported_pdp_address`. From a workstation
+that name does not fail — it **resolves, to the wrong host**:
+
+```text
+$ getent hosts flex-auth-secrets-engine.flex-auth.svc.cluster.local
+80.158.43.29   ...svc.cluster.local.ad.binect.de
+$ getent hosts this-service-does-not-exist.flex-auth.svc.cluster.local
+80.158.43.29   (identical — proves suffix expansion, not a record)
+```
+
+`resolv.conf` carries `search ad.binect.de`, a wildcard zone, so every
+`*.svc.cluster.local` name answers with one unrelated public address. Sending
+there ships the CheckRequest body and our bearer token to a third party.
+
+`flex-auth.decision-record.v1` carries **no signature**, and every digest in it
+is either sent by us or published in flex-auth's repo, so a forger reproduces
+all three exactly. Digests establish integrity of the binding, never
+authenticity of the source. As flex-auth put it in `FLEX-DEC-2026-010`:
+
+> Fail-closed protects against a PDP that is ABSENT, not against one that LIES.
+
+Until detached signatures ship (`FLEX-WP-0024`), the address shape is the only
+thing standing in for responder authenticity. That is why it is enforced.
+
+## The supported path
+
+Loopback `kubectl port-forward` to the named pod. It resolves no DNS name,
+targets one pod explicitly, and rides the Kubernetes API server's TLS with our
+cluster credentials — so it authenticates the responder transitively. Note this
+is the exact reverse of the caller direction, where port-forward bypasses the
+NetworkPolicy (`FLEX-WP-0023`); the two properties point opposite ways and
+summarising either as "the network protects it" gets one backwards.
+
+```bash
+# 1. Target the pod by name, not the Service.
+POD=$(kubectl -n flex-auth get pods \
+        -l app.kubernetes.io/name=flex-auth-secrets-engine \
+        -o jsonpath='{.items[0].metadata.name}')
+kubectl -n flex-auth port-forward "pod/$POD" 18080:8080 --address 127.0.0.1 &
+
+# 2. Fresh bounded caller token per session. Audience MUST be flex-auth;
+#    caller auth is `enforce` as of Helm revision 3.
+umask 077
+kubectl -n secrets-engine create token secrets-engine \
+        --audience flex-auth --duration 10m > "$PDP_TOKEN"
+chmod 600 "$PDP_TOKEN"          # outside any Git worktree
+
+# 3. Point the engine at the forward.
+export SECRETS_ENGINE_PDP_URL=http://127.0.0.1:18080
+export SECRETS_ENGINE_PDP_TOKEN_FILE="$PDP_TOKEN"
+export SECRETS_ENGINE_AUTHORIZATION_POLICY_PACKAGE=secrets-engine.catalog-lane.lifecycle
+export SECRETS_ENGINE_AUTHORIZATION_POLICY_VERSION=v2
+```
+
+Shred the token file and stop the forward when the session ends. The token is
+ten minutes; it is a caller credential, not an authorization.
+
+`ServiceAccount secrets-engine/secrets-engine` has `automountServiceAccountToken:
+false` and no role bindings — it exists to be a caller identity and nothing else.
+
+## Pin v2, never v1
+
+v1 shipped and was deployed with no `input.tenant` rule at all; a `rotate` under
+`tenant:coulomb` returned **allow**. v2 supersedes rather than amends it so the
+change is visible in the version string, and this engine refuses a v1 decision
+outright. See `docs/tenant-alignment.md`.
+
+## Known gap: the digest join does not hold against a real request
+
+Proved live on 2026-09-07 and **not yet fixed**; the engine currently rejects
+every real allow, which is fail-closed and therefore safe to leave standing
+while the rule is published.
+
+The evaluator enriches the request from its registry before hashing — `subject`
+gains `attributes` and `tenant`, `resource` gains `tenant` — so
+`binding.request_digest` is a digest of material we did not send and cannot
+reproduce. `validate_decision_envelope` compares the binding against our
+unenriched request and fails with *"decision binding does not match request"*.
+
+Which fields the evaluator may enrich is flex-auth's contract to publish, not
+ours to infer. Guessing it would mean accepting a binding that differs from what
+we proposed in some way we decided was benign — the same fail-open shape as a
+guessed digest exclusion or a guessed vocabulary mapping. Raised with flex-auth;
+staying fail-closed and naming the missing rule is the correct posture until
+they answer.

docs/tenant-alignment.md

@@ -112,9 +112,13 @@ alone.
 
 - The owner-reviewed JWT/store/CheckRequest mapping, with a decision reference.
   Until it exists, no live client or policy subject changes here.
-- A supported owner access path to `flex-auth-secrets-engine` for a workstation
-  CLI. Service DNS is not workstation connectivity, so the tenant fix above is
-  necessary but not sufficient for activation (`FLEX-WP-0021-T05`).
+- ~~A supported owner access path~~ — **delivered**. Loopback `kubectl
+  port-forward` plus a bounded `TokenRequest` token; see
+  `docs/pdp-access-path.md`. Adopted and enforced in
+  `decision_check.require_supported_pdp_address`.
+- The evaluator's **enrichment rule**: `binding` carries registry-enriched
+  `subject.attributes`, `subject.tenant` and `resource.tenant` that we did not
+  send, so the digest join fails against a real request. flex-auth's to publish.
 
 ## Hazard: the Service DNS name resolves here, to the wrong host