Adapt USER-WP-0021 and USER-WP-0023 to published policy-nexus contracts

IAM Profile v0.3 and Tenancy Posture v0.1 are now live on
policy.coulomb.social. Close the portal expansion workplan against those
documents, keep the flex-auth live A2 probe waiting, and forward optional
tenant_roles to flex-auth without authorizing from them locally.

workplans/USER-WP-0023-flex-auth-caller-identity.md

@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: netkingdom
 created: "2026-08-18"
-updated: "2026-08-18"
+updated: "2026-08-19"
 state_hub_workstream_id: "014d0886-b690-4860-8337-c718e440f678"
 ---
 
@@ -80,4 +80,26 @@ This task stays `wait` on FLEX-WP-0015-T02 promotion through FLEX-WP-0011,
 and on an operator shell with cluster credentials, which agent sessions in
 this repo do not hold.
 
+2026-08-19 policy-nexus adaptation: the published contracts now name the
+same split this workplan already implemented.
+
+- IAM Profile v0.3 Service Account Flow
+  (`https://policy.coulomb.social/standards/iam-profile/v0.3/`) requires
+  audience-scoped, rotating workload credentials delivered through the
+  credential-management standard — that is the projected ServiceAccount
+  token we already send. The optional `tenant_roles` claim is forwarded
+  to flex-auth as a subject attribute and is never used as a local
+  authorization decision.
+- Tenancy Posture v0.1
+  (`https://policy.coulomb.social/standards/tenancy-posture/v0.1/`) is the
+  public A2 target T03 is waiting to prove: a single inbound choke point
+  that refuses an unbound caller. Our half of that vector is deployed;
+  flex-auth's running digest is still A0.
+- NetKingdom architecture draft-2
+  (`https://policy.coulomb.social/architecture/net-kingdom/v0.1/`) lists
+  both documents in chapter 9.
+
+The workplan stays `active` because T03's live proof is still owed. That
+proof is not unblocked by publication.
+
 Contract: `docs/flex-auth-caller-identity.md`.