From 4f59845f51f83deb2876743c885e9e3f7aa5dca4 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 21 Aug 2026 09:06:36 +0200 Subject: [PATCH] docs(wp-0031): record verified OpenRouter diagnosis MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Tested rather than relayed: OpenRouter answers 'User not found' for the delivered key, which means no account resolves it — an existing-account key reissue, not a new account. Ruled out credits (402), model permissions (403), provider config, and pod health. Also records a latent delivery defect: the secret carries a trailing newline, harmless today only because llm_connect/config.py:53 strips it. Co-Authored-By: Claude Opus 5 --- WORK-RECORDS.md | 6 +++++ ...roduction-execution-reliability-cleanup.md | 27 +++++++++++++++++++ 2 files changed, 33 insertions(+) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 676e007..5805b64 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -35,6 +35,7 @@ | workplan | ACTIVITY-WP-0029 | active | — | workplans/ACTIVITY-WP-0029-hub-port-alignment.md | | workplan | ACTIVITY-WP-0030 | active | — | workplans/ACTIVITY-WP-0030-daily-sbom-catchup.md | | workplan | ACTIVITY-WP-0031 | active | — | workplans/ACTIVITY-WP-0031-production-execution-reliability-cleanup.md | +| workplan | ACTIVITY-WP-0032 | proposed | — | workplans/ACTIVITY-WP-0032-glas-profile-execution-contract.md | | workplan | ADHOC-2026-06-01 | finished | — | workplans/ADHOC-2026-06-01.md | | workplan | ADHOC-2026-08-20 | finished | — | workplans/ADHOC-2026-08-20.md | | workplan | custodian-WP-0001 | done | — | workplans/custodian-WP-0001-temporal-backbone.md | @@ -193,6 +194,11 @@ | task | ACTIVITY-WP-0031-T03 | done | — | workplans/ACTIVITY-WP-0031-production-execution-reliability-cleanup.md | | task | ACTIVITY-WP-0031-T04 | done | — | workplans/ACTIVITY-WP-0031-production-execution-reliability-cleanup.md | | task | ACTIVITY-WP-0031-T05 | wait | — | workplans/ACTIVITY-WP-0031-production-execution-reliability-cleanup.md | +| task | ACTIVITY-WP-0032-T01 | wait | — | workplans/ACTIVITY-WP-0032-glas-profile-execution-contract.md | +| task | ACTIVITY-WP-0032-T02 | wait | — | workplans/ACTIVITY-WP-0032-glas-profile-execution-contract.md | +| task | ACTIVITY-WP-0032-T03 | wait | — | workplans/ACTIVITY-WP-0032-glas-profile-execution-contract.md | +| task | ACTIVITY-WP-0032-T04 | wait | — | workplans/ACTIVITY-WP-0032-glas-profile-execution-contract.md | +| task | ACTIVITY-WP-0032-T05 | wait | — | workplans/ACTIVITY-WP-0032-glas-profile-execution-contract.md | | task | ADHOC-2026-06-01-T01 | done | — | workplans/ADHOC-2026-06-01.md | | task | ADHOC-2026-06-01-T02 | done | — | workplans/ADHOC-2026-06-01.md | | task | ADHOC-2026-06-01-T03 | done | — | workplans/ADHOC-2026-06-01.md | diff --git a/workplans/ACTIVITY-WP-0031-production-execution-reliability-cleanup.md b/workplans/ACTIVITY-WP-0031-production-execution-reliability-cleanup.md index b285af0..347ec5c 100644 --- a/workplans/ACTIVITY-WP-0031-production-execution-reliability-cleanup.md +++ b/workplans/ACTIVITY-WP-0031-production-execution-reliability-cleanup.md @@ -75,6 +75,33 @@ T01 still `wait`: the key rotation itself remains attended and railiance-platform-owned. What changed is that the next failure will name its own cause. +Diagnosis verified 2026-08-21 (previously relayed, now tested). Direct probe +from the llm-connect pod, no secret read or printed: + +- `POST /execute` → `502 {"error":"provider_api_error","provider_status":401, + "message":"HTTP 401 from https://openrouter.ai/api/v1/chat/completions"}` +- `GET https://openrouter.ai/api/v1/key` with the delivered key → + **`401 {"error":{"message":"User not found.","code":401}}`** + +"User not found" is OpenRouter's wording for a key that resolves to **no +account**. It is not insufficient credits (402) and not a model-permission +problem (403), so **no new OpenRouter account is required** — the existing +account needs a new key issued, because this key value is dead. +Key fingerprint for identification: `sha256[:12] = ab938241a2ec`, length 73 +(+1, see below), prefix `sk-or-v1-`. + +Ruled out along the way: provider/model config is correct +(`LLM_CONNECT_PROVIDER=openrouter`, `google/gemini-2.5-flash`); the Service and +pod are healthy; the ExternalSecret delivers exactly one key under the expected +name. + +**Separate latent defect, railiance-platform lane:** the delivered secret has a +trailing newline (74 bytes for a 73-char key; `urllib` refuses it as a header +value outright). It is currently harmless only because +`llm_connect/config.py:53` calls `.strip()` on the env value. Any consumer that +does not strip would fail on a perfectly valid key. Worth fixing in the +OpenBao→ESO lane while the key is being replaced. + ## Emergency-pause weekly SBOM fan-out ```task