Adapt USER-WP-0021 and USER-WP-0023 to published policy-nexus contracts

IAM Profile v0.3 and Tenancy Posture v0.1 are now live on
policy.coulomb.social. Close the portal expansion workplan against those
documents, keep the flex-auth live A2 probe waiting, and forward optional
tenant_roles to flex-auth without authorizing from them locally.

docs/canon-interface-card.yaml

@@ -4,7 +4,7 @@ description: >
   tenant, membership, profile, lifecycle, and evidence-facing context.
 status: candidate
 owner: codex
-updated: "2026-06-05"
+updated: "2026-08-19"
 
 implements:
   - identity-canon conceptual model as an implementation-facing domain facade
@@ -25,9 +25,10 @@ produces:
   - Access Grant or grant-like membership fact
 
 consumes:
-  - NetKingdom IAM Profile claims
+  - NetKingdom IAM Profile v0.3 claims
   - verified issuer and subject identifiers
   - assurance and principal type claims
+  - optional tenant_roles forwarded to flex-auth only
   - authorization decisions and obligations
   - policy, control, review, exception, and evidence references
   - lifecycle task references from downstream task systems

docs/flex-auth-caller-identity.md

@@ -2,6 +2,14 @@
 
 Status: caller side implemented and deployed; live proof pending flex-auth A2 promotion (FLEX-WP-0015-T02).
 
+Governing published policy (2026-08-19):
+
+- IAM Profile v0.3 Service Account Flow — audience-scoped, rotating
+  workload identity:
+  `https://policy.coulomb.social/standards/iam-profile/v0.3/`
+- Tenancy Posture v0.1 A2 — inbound caller choke point:
+  `https://policy.coulomb.social/standards/tenancy-posture/v0.1/`
+
 user-engine calls `flex-auth-user-engine` with a projected Kubernetes
 ServiceAccount token whose audience is exactly `flex-auth`. The adapter reads
 the token file for every decision so hourly projection rotation requires no
@@ -77,7 +85,9 @@ BODY='{"actor":{"issuer":"https://kc.coulomb.social","subject":"probe",
 3. **user-engine cannot represent another protected system.** Re-run step 1
    with `resource.system` set to `tenant-engine`. Expect a refusal from the
    binding, not an allow: the token binds `user-engine` to
-   `system:serviceaccount:user-engine:user-engine` only.
+   `system:serviceaccount:user-engine:user-engine` only. That binding is the
+   A2 choke point named by Tenancy Posture v0.1; publication does not change
+   the remaining operator sequence.
 
 Record all three results, the flex-auth digest they ran against, and the
 user-engine digest, in USER-WP-0023-T03 before marking it done. A pass on

docs/interfaces/netkingdom-integration.md

@@ -13,6 +13,16 @@ See also the cross-repo assessment in the net-kingdom repo:
 `/home/worsch/net-kingdom/docs/user-engine-netkingdom-integration-assessment.md`
 (for current intent/scope fit, gaps, and recommendations as of 2026-06-03).
 
+Published governing contracts (policy-nexus, 2026-08-19):
+
+- IAM Profile v0.3: `https://policy.coulomb.social/standards/iam-profile/v0.3/`
+- Tenancy Posture v0.1: `https://policy.coulomb.social/standards/tenancy-posture/v0.1/`
+- NetKingdom architecture: `https://policy.coulomb.social/architecture/net-kingdom/v0.1/`
+
+The user-engine boundary contract remains accepted in net-kingdom
+(`canon/standards/user-engine-boundary-contract_v0.1.md`) and is marked
+`publish` in the policy-nexus ledger, but it is not yet on the site.
+
 ## Required Ports
 
 | Port | Direction | Purpose |
@@ -55,6 +65,7 @@ actor:
   tenant: string
   principal_type: human | service | agent
   roles: [string]
+  tenant_roles: [string]
   groups: [string]
   scopes: [string]
   assurance: object

docs/portal-threat-model.md

@@ -46,4 +46,7 @@ as externally complete. Compensation is idempotent and operator-visible.
 Enterprise SAML/OIDC federation, SCIM and corporate directory synchronization
 remain provider adapters. Their external ownership metadata and identity links
 must fit the existing neutral boundaries rather than becoming user-engine
-domain dependencies.
+domain dependencies. The published target is IAM Profile v0.3 Keycloak
+expanded mode
+(`https://policy.coulomb.social/standards/iam-profile/v0.3/`); a dedicated
+workplan is created only when a tenant demands those integrations.