fix: send the tenant the policy package scopes us to, and adopt v2

build_action_request emitted no tenant field at all. The deployed
secrets-engine.catalog-lane.lifecycle v2 package reads

  known_tenant   := "tenant:platform"
  request_tenant := object.get(input, "tenant", "")

so an absent tenant is not an ignored field, it matches the wrong_tenant
first-denial branch. Every gated action this engine sent would have been
denied -- and the omission also produced a request_digest that could match
no correctly issued decision, since tenant is hashed material. That is the
same class of defect as hashing excluded fields, arriving from the other
direction, and again only a real artifact exposed it.

Found by answering the GLAS-WP-0015 tenant-alignment question instead of
assuming the values lined up.

- REQUEST_TENANT is pinned against the vendored allow envelopes, so a
  package retenanting fails a test rather than denying production.
- An empty tenant is refused at build time.
- Accepted policy version moves v1 -> v2. v1 had no tenant rule and failed
  open: a rotate under tenant:coulomb returned allow against the deployed
  package. flex-auth superseded rather than amended it, because a fail-open
  correction has to be visible as a version change. A test pins that a v1
  decision is refused.
- Vendored decision_wrong_tenant_deny.json as the denial evidence glas
  asked for, with tests that we refuse it on effect before anything else
  and that a deny legally carries no lifetime.

docs/tenant-alignment.md states the three tenant values as this repo holds
them. It does not resolve the JWT/store mapping: service_auth.TENANT is
tenant:coulomb, which is exactly the value the package denies. That is
either two layers sharing a namespace format or one wrong constant, and
picking between them without an owner ruling is the fail-open shape
GH-DEC-2026-008 rejected for action vocabularies. Both constants stay as
they are, deliberately not unified.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E4tNMAYcSQmZWUE4wqP4ij

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 715726@bnt-lap001
Assistant-Session: 80a42b32-cba6-4b23-8be0-68819b1a6092

src/secrets_engine/authorization.py

@@ -19,6 +19,27 @@ from secrets_engine.errors import DecisionError
 
 DIGEST_RE = re.compile(r"^sha256:[0-9a-f]{64}$")
 
+#: The single tenant the published policy package scopes this engine to.
+#:
+#: `secrets-engine.catalog-lane.lifecycle` v2 reads
+#: ``request_tenant := object.get(input, "tenant", "")`` and allows only
+#: ``known_tenant := "tenant:platform"``; anything else, **an absent tenant
+#: included**, matches its ``wrong_tenant`` first-denial branch. Sending no
+#: tenant is therefore not a neutral omission, it is a denial.
+#:
+#: v1 had no tenant rule at all and failed open -- a `rotate` sent under
+#: ``tenant:coulomb`` returned allow against the deployed package. That is why
+#: v1 is superseded rather than amended, and why this value is pinned against
+#: the vendored replay fixtures in ``tests/test_decision_replay.py`` instead of
+#: being left to a deployment to supply correctly.
+#:
+#: This is not the KeyCape JWT tenant. ``service_auth.TENANT`` is
+#: ``tenant:coulomb``, which is the exact value this package denies. Whether
+#: those name one tenant or two layers is an open owner question -- see
+#: ``docs/tenant-alignment.md`` -- and is deliberately not resolved by reusing
+#: one constant for both.
+REQUEST_TENANT = "tenant:platform"
+
 SCHEMA_VERSION = "0.1"
 CONTRACT_VERSION = "flex-auth.decision-record.v1"
 
@@ -42,17 +63,30 @@ def build_action_request(
     policy_targets: list[str] | tuple[str, ...] = (),
     auth_targets: list[str] | tuple[str, ...] = (),
     request_id: str = "",
+    tenant: str = REQUEST_TENANT,
 ) -> dict[str, Any]:
-    """Build the exact normalized secrets-engine profile for flex-auth."""
+    """Build the exact normalized secrets-engine profile for flex-auth.
+
+    ``tenant`` is required and defaults to the package's published
+    ``known_tenant``. It is hashed into the request digest and compared by the
+    package's ``wrong_tenant`` branch, so an omitted tenant is a denial rather
+    than a field the evaluator ignores.
+    """
     if not action or not subject_id or not subject_type or not purpose:
         raise DecisionError(
             "action request requires action, subject id/type, and purpose"
         )
+    if not tenant:
+        raise DecisionError(
+            "action request requires a tenant; the policy package denies an "
+            "absent tenant as wrong_tenant rather than ignoring it"
+        )
     request: dict[str, Any] = {}
     if request_id:
         request["id"] = request_id
     request.update(
         {
+            "tenant": tenant,
             "subject": {"id": subject_id, "type": subject_type},
             "action": action,
             "resource": {