flex-auth/workplans/FLEX-WP-0026-openrouter-native-contract.md

50 lines
1.6 KiB
Markdown
Raw Normal View History

---
id: FLEX-WP-0026
type: workplan
title: "Resolve OpenRouter access contract and update native PDP"
domain: infotech
repo: flex-auth
status: finished
owner: codex
topic_slug: netkingdom
created: "2026-09-14"
updated: "2026-09-14"
related_workplans:
- WARDEN-WP-0039
- IR-WP-0004
- SECRETS-WP-0010
---
## Resolve the caller versus credential-owner contract
```task
id: FLEX-WP-0026-T01
status: done
priority: high
```
`docs/openrouter-native-access.md` resolves the inbox requests using the existing
native lifecycle resource. No admitted delegated-read contract exists in the
caller binding. Added concrete caller-boundary regressions for native success,
warden owner/engine impersonation, radar subject and mixed-owner batch refusal.
Full Go race suite passed. No ops-warden binding or credential-owner rename.
## Promote and verify the current native PDP contract
```task
id: FLEX-WP-0026-T02
status: done
priority: high
```
Dedicated release revision 4 now uses published dd8dd517 image
sha256:05a03a8790c2210c48ea92391441c77ddf640d0cd32f5ec09838f5393171fcbd.
Policy package stays v2; enforce binding retained. Image policy tests/fixtures,
Helm lint/server dry-run and 11 live checks passed. Other PDP Deployment specs
unchanged. Named-pod forward removed; bounded tokens held only in memory.
Receipt: docs/evidence/2026-09-14-openrouter-live-pdp.json.
Live residual handed off before closure: SECRETS-WP-0010-T03 holds approval-service,
client-reader, attended authority and exact recipient admission plus real native
verification. WARDEN-WP-0039-T03 and IR-WP-0004-T02 are not closed by this work.