Name what CheckRequest.tenant denotes; record the access-engine rename intake

TEN-DEC-2026-002 answers flex-auth's FLEX-WP-0022-T01, open since
2026-09-15: `tenant` denotes the target tenant record, equals
`resource.id` by intent, and the write API is cross-tenant by design —
no action is refused on the subject/tenant relationship, and
tenant.guardrail.read must not differ because flex-auth itself calls it
across tenants. docs/flex-auth-integration.md states the relation in
this repo's voice.

TEN-IN-0004 is the live record flex-auth asked for on FLEX-WP-0020.
Runtime names stay flex-auth (FLEX-DEC-2026-013) and all deploy, cluster
and settings coordinates verify as retained; only five documentation
repository paths change when the rename lands.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

intakes/intakes.md

@@ -58,3 +58,60 @@ notes:
   created: '2026-08-29T12:00:00.000000Z'
 state_hub_intake_id: "01a04cf8-c135-70cb-a24c-33219a9f2985"
 ```
+
+---
+
+## TEN-IN-0004 — flex-auth → access-engine repository rename: verify the retained runtime contract
+
+```yaml
+id: TEN-IN-0004
+kind: intake
+title: "flex-auth → access-engine repository rename: verify the retained runtime contract"
+status: open
+origin: cross-repo
+origin_ref: FLEX-WP-0020
+priority: low
+owner: tenant-engine
+requested_by: flex-auth
+created: "2026-09-21"
+updated: "2026-09-21"
+state_hub_intake_id: "01a0c14b-b2f7-78f1-8f6c-e36c952fe004"
+description: >-
+  flex-auth is preparing a repository-coordinate rename to access-engine.
+  UUID fda8ad85-a7d7-4055-8f21-902a533e59df and Forge ID 42 are unchanged, and
+  runtime names stay flex-auth per FLEX-DEC-2026-013. tenant-engine was asked to
+  create a live record and reply with its id, and to verify that documentation
+  and client configuration continue to use the retained product/runtime contract.
+verification:
+  date: "2026-09-21"
+  runtime_contract_intact: true
+  checked:
+    - "deploy/base/tenant-engine.yaml — TENANT_ENGINE_FLEX_AUTH_URL points at
+       http://flex-auth-tenant-engine.flex-auth.svc.cluster.local:8080; token
+       projection audience flex-auth; NetworkPolicy egress selects namespace
+       flex-auth / app flex-auth-tenant-engine. All runtime names — retained."
+    - "railiance/app.toml — dependency named flex-auth-tenant-engine with a
+       healthz evidence URL on the same cluster DNS name. Runtime — retained."
+    - "src/tenant_engine/flex_auth.py, authz.FlexAuthWriteAuthorizer, the
+       TENANT_ENGINE_FLEX_AUTH_* settings — module, class and env-var names are
+       part of tenant-engine's own surface and track the runtime name. Retained."
+    - "pep-stance.yaml, pip-claims.yaml, layer.yaml — layer.yaml already records
+       target: 'access-engine (flex-auth)', which is the correct dual form."
+  followup_on_rename: >-
+    The only coordinates that change are five repository-path references in
+    docs/flex-auth-integration.md (flex-auth/schemas/check_request.schema.json,
+    flex-auth/schemas/decision_envelope.schema.json,
+    flex-auth/examples/tenant-engine/policy_package.md,
+    flex-auth/docs/tenancy-posture-review.md, and
+    flex-auth/workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md).
+    They are documentation cross-references, not client configuration. This
+    intake stays open until the rename lands, then they are repointed at
+    access-engine/ and the intake closes. No runtime change accompanies it.
+notes:
+- content: >-
+    This record is not completion evidence for FLEX-WP-0020. It is the live
+    record flex-auth asked for, and it closes only after the rename lands and
+    the five documentation coordinates are repointed.
+  author: tenant-engine
+  created: "2026-09-21"
+```