Resolve OpenRouter native contract and promote secrets-engine PDP

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

workplans/FLEX-WP-0026-openrouter-native-contract.md

@@ -0,0 +1,49 @@
+---
+id: FLEX-WP-0026
+type: workplan
+title: "Resolve OpenRouter access contract and update native PDP"
+domain: infotech
+repo: flex-auth
+status: finished
+owner: codex
+topic_slug: netkingdom
+created: "2026-09-14"
+updated: "2026-09-14"
+related_workplans:
+  - WARDEN-WP-0039
+  - IR-WP-0004
+  - SECRETS-WP-0010
+---
+
+## Resolve the caller versus credential-owner contract
+
+```task
+id: FLEX-WP-0026-T01
+status: done
+priority: high
+```
+
+`docs/openrouter-native-access.md` resolves the inbox requests using the existing
+native lifecycle resource. No admitted delegated-read contract exists in the
+caller binding. Added concrete caller-boundary regressions for native success,
+warden owner/engine impersonation, radar subject and mixed-owner batch refusal.
+Full Go race suite passed. No ops-warden binding or credential-owner rename.
+
+## Promote and verify the current native PDP contract
+
+```task
+id: FLEX-WP-0026-T02
+status: done
+priority: high
+```
+
+Dedicated release revision 4 now uses published dd8dd517 image
+sha256:05a03a8790c2210c48ea92391441c77ddf640d0cd32f5ec09838f5393171fcbd.
+Policy package stays v2; enforce binding retained. Image policy tests/fixtures,
+Helm lint/server dry-run and 11 live checks passed. Other PDP Deployment specs
+unchanged. Named-pod forward removed; bounded tokens held only in memory.
+Receipt: docs/evidence/2026-09-14-openrouter-live-pdp.json.
+
+Live residual handed off before closure: SECRETS-WP-0010-T03 holds approval-service,
+client-reader, attended authority and exact recipient admission plus real native
+verification. WARDEN-WP-0039-T03 and IR-WP-0004-T02 are not closed by this work.