TEN-IN-0004 closed: repoint access-engine paths; TEN-DEC-2026-003 answers NK-WP-0039-T04

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 101414@bnt-lap001
Assistant-Session: 60b5a221-d435-42b9-b778-983c90c7eed6

decisions/decisions.md

@@ -192,3 +192,48 @@ tenant-engine's own words.
   revisited — but it would be a *new* field, not a change of meaning for this
   one.
 - Unblocks `FLEX-WP-0022-T02`.
+
+---
+
+## TEN-DEC-2026-003 — net-kingdom's combined runtime.yaml reference copy of tenant-engine is retired in favour of pointers
+
+```yaml
+id: TEN-DEC-2026-003
+kind: decision
+title: "net-kingdom's combined runtime.yaml reference copy of tenant-engine is retired in favour of pointers"
+status: resolved
+disposition: approved
+origin: cross-repo
+origin_ref: NK-WP-0039-T04
+owner: tenant-engine
+affects:
+  - tenant-engine
+  - net-kingdom
+requested_by: net-kingdom
+created: "2026-09-30"
+updated: "2026-09-30"
+decided_by: tenant-engine (the owner of its own deployment declaration)
+decided_at: "2026-09-30"
+```
+
+**Question (net-kingdom message 2c637dc9 / 9fc740da):** does net-kingdom keep a
+reference copy of tenant-engine's objects in `sso-mfa/k8s/tenant-engine/runtime.yaml`,
+or retire it?
+
+**Decision: retire it.** The authoritative declaration is this repository:
+`deploy/base/tenant-engine.yaml` (applied by `kubectl apply -k deploy/`, TEN-WP-0008),
+with the staged-promotion contract in `railiance/app.toml`. net-kingdom's copy
+already differs from live in image digest, storage, strategy, environment and egress
+(its own 2026-09-23 `kubectl diff`), and no script or workflow consumes it (net-kingdom
+searched; the file carries a DO-NOT-APPLY header). A second hand-kept copy can only
+drift further. ADR-0015 of net-kingdom already prefers pointers to owner declarations,
+and net-kingdom applied that to the flex-auth objects on 2026-09-28.
+
+**What tenant-engine asks of net-kingdom:** replace the five remaining tenant-engine
+objects (Namespace, PVC, Deployment, Service, NetworkPolicy) with links to
+`tenant-engine/deploy/base/tenant-engine.yaml` and `tenant-engine/railiance/app.toml`,
+keeping the DO-NOT-APPLY guard until the file holds no objects. Nothing in this repo
+depends on the copy; no cluster change follows from the retirement.
+
+**Not changed:** `deploy/`, `railiance/`, and all runtime names.
+

docs/flex-auth-integration.md

@@ -8,7 +8,7 @@ without a decision record or a recorded fail-closed stance
 
 ## What tenant-engine sends
 
-A `CheckRequest` per `flex-auth/schemas/check_request.schema.json`:
+A `CheckRequest` per `access-engine/schemas/check_request.schema.json`:
 
 ```json
 {
@@ -82,7 +82,7 @@ Action → resource-type mapping (must match `flex-auth`'s
 
 ## What tenant-engine expects back
 
-A `DecisionEnvelope` per `flex-auth/schemas/decision_envelope.schema.json`.
+A `DecisionEnvelope` per `access-engine/schemas/decision_envelope.schema.json`.
 Only `effect: "allow"` authorizes the action. Every other `effect`, a
 non-200 response, a malformed body, or a transport failure/timeout all
 resolve to **deny**. `FlexAuthCheckClient.check()` never raises past its
@@ -104,13 +104,13 @@ reads the store. That check does **not** re-enter tenant-engine:
 2. `FlexAuthCheckClient` POSTs only `/v1/check`. Proven by
    `tests/test_pip_claims.py::test_live_lookup_check_does_not_reenter_tenant_engine`.
 3. flex-auth's tenant-engine policy package
-   (`flex-auth/examples/tenant-engine/policy_package.md`) matches
+   (`access-engine/examples/tenant-engine/policy_package.md`) matches
    `subject.id` and `action` only. It does not consult tenant capability
    roles. The package's own scope note says those roles are tenant state
    a *different* protected system might consult via live-lookup;
    conflating the two would authorize the wrong thing.
 4. flex-auth's live-roles adapter is built and unwired
-   (`FLEX-WP-0015`, `flex-auth/docs/tenancy-posture-review.md`): no
+   (`FLEX-WP-0015`, `access-engine/docs/tenancy-posture-review.md`): no
    non-test caller, no current policy consumes `tenant_roles` for a
    privileged path.
 
@@ -141,17 +141,17 @@ Tests assert the file equals shipped behaviour.
 
 ## Repository coordinate vs runtime name (TEN-IN-0004)
 
-The `flex-auth` repository is renaming to `access-engine` (`FLEX-WP-0020`).
+The `flex-auth` repository was renamed to `access-engine` (`FLEX-WP-0020`).
 **Runtime names stay `flex-auth`** per `FLEX-DEC-2026-013`: the cluster
 namespace, the `flex-auth-tenant-engine` Service, the token audience, and this
 engine's `TENANT_ENGINE_FLEX_AUTH_*` settings are all unchanged by the rename.
-Only the `flex-auth/...` repository paths cited below and above change, and
-only once the rename lands.
+Only the `flex-auth/...` repository paths cited below and above changed to
+`access-engine/...` when the rename landed (2026-09-30, FLEX-WP-0020).
 
 ## Related
 
 - `pep-stance.yaml` — published fail-closed map
 - `pip-claims.yaml` — input-class freshness
-- `flex-auth/workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md`
+- `access-engine/workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md`
 - `key-cape/workplans/KEY-WP-0005-iam-profile-core-claims.md`
 - `net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md`

intakes/intakes.md

@@ -67,14 +67,14 @@ state_hub_intake_id: "01a04cf8-c135-70cb-a24c-33219a9f2985"
 id: TEN-IN-0004
 kind: intake
 title: "flex-auth → access-engine repository rename: verify the retained runtime contract"
-status: open
+status: closed
 origin: cross-repo
 origin_ref: FLEX-WP-0020
 priority: low
 owner: tenant-engine
 requested_by: flex-auth
 created: "2026-09-21"
-updated: "2026-09-21"
+updated: "2026-09-30"
 state_hub_intake_id: "01a0c14b-b2f7-78f1-8f6c-e36c952fe004"
 description: >-
   flex-auth is preparing a repository-coordinate rename to access-engine.
@@ -114,6 +114,13 @@ notes:
     the five documentation coordinates are repointed.
   author: tenant-engine
   created: "2026-09-21"
+- content: >-
+    2026-09-30: rename landed. The five documentation coordinates in
+    docs/flex-auth-integration.md now read access-engine/ and every target
+    resolves in ~/access-engine. Runtime and client config unchanged. Closed.
+    Separately answered net-kingdom NK-WP-0039-T04 in TEN-DEC-2026-003.
+  author: tenant-engine
+  created: "2026-09-30"
 ```
 
 ---