Land foundations: assessment, ADR-001/002/003, FLEX-WP-0005, Go skeleton

Pre-implementation assessment and boundary review
(docs/pre-implementation-assessment.md) lead to three ADRs:
- ADR-001 Go + repo skeleton
- ADR-002 Rego-in-Markdown policy package format
- ADR-003 Topaz-aligned MVP (Topaz spike moves into foundations)

New workplan FLEX-WP-0005 (Foundations and Topaz Alignment) is inserted
between WP-0001 (done) and WP-0002 (core). WP-0002 pins Rego-in-Markdown
for P2.3; WP-0004 P4.1 refocused from Topaz evaluation to Topaz adapter.

Go skeleton at repo root: cmd/flex-auth + internal/{registry,policy,
decision,audit,adapters} + pkg/api + Makefile + .golangci.yml + GitHub
Actions CI. make ci green locally; bin/flex-auth --version works.

INTENT/SCOPE cite the NetKingdom IAM Profile and add the ops-warden /
ops-bridge disjoint-surface clarifications.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md

@@ -13,7 +13,7 @@ depends_on_workplans:
 related_workplans:
   - FLEX-WP-0003
 created: "2026-05-04"
-updated: "2026-05-04"
+updated: "2026-05-15"
 state_hub_workstream_id: "99a82976-d376-42b0-89cc-c44e01c0bec6"
 ---
 
@@ -28,7 +28,14 @@ The standalone core must work first. This workplan adds delegated backends and
 provider examples after flex-auth's own request, decision, registry, and audit
 vocabulary are stable.
 
-## P4.1 - Evaluate Topaz as MVP delegated backend
+> **Scope change (2026-05-15).** Per ADR-003 and the pre-implementation
+> assessment, the Topaz *evaluation* moved to `FLEX-WP-0005 T04` so its
+> output can shape the standalone core. This workplan now implements the
+> Topaz *adapter* against that mapping; the standalone evaluator already
+> speaks Rego, so adapter work focuses on directory delegation, wire
+> protocol, and consistency metadata rather than re-deciding fit.
+
+## P4.1 - Implement Topaz adapter
 
 ```task
 id: FLEX-WP-0004-T001
@@ -37,10 +44,28 @@ priority: high
 state_hub_task_id: "9046418c-2b78-42c6-8bfa-76d6ed0050dd"
 ```
 
-Evaluate Topaz because it combines a local directory, relation modeling, and
-OPA/Rego policy evaluation.
+Implement the Topaz adapter behind flex-auth's stable PDP and directory
+contracts. Consumes `docs/topaz-mapping-spike.md` produced in
+`FLEX-WP-0005 T04`.
 
-Output: spike notes, mapping examples, pros/cons, and recommendation.
+Scope:
+
+- Wire-protocol selection (gRPC vs HTTP vs embedded library) with
+  rationale recorded.
+- Directory delegation: flex-auth registry writes flow into Topaz
+  directory objects/relations; reads can be served from either side
+  with documented consistency semantics.
+- Policy delegation: a flex-auth package (Rego-in-Markdown) is
+  decomposed and pushed to Topaz unchanged; decisions returned carry
+  the same envelope shape as standalone evaluation.
+- Failure modes: Topaz unavailable, stale directory, partial result —
+  each produces a decision envelope that the standalone code path
+  could also have produced.
+
+Output: adapter package under `internal/adapters/topaz/`, end-to-end
+integration test using the `examples/topaz/` docker-compose from the
+spike, and an operations note covering startup, health checks, and
+fail-closed defaults.
 
 ## P4.2 - Add relationship PDP adapter boundary