flex-auth/docs/openrouter-native-access.md

OpenRouter native access contract — 2026-09-14

FLEX-WP-0026 answers intelligence-radar message a4a4f455-bacd-4172-a45c-2c375a58db12 and ops-warden question a90672e4-4f5f-4ab8-ac43-455f4da351a7 (WARDEN-WP-0039-T03).

The existing caller binding admits representation of a protected system. It contains no delegated credential-read contract for ops-warden to represent railiance-platform. The resolution for this use case is the native secrets-engine lifecycle path. Do not widen ops-warden's binding, rename the credential owner, or treat its planner's autonomous verdict as runtime admission.

The native CheckRequest addresses catalog:openrouter-llm-connect, type secret-catalog-lane, system secrets-engine, tenant tenant:platform, subject secrets-engine / service. This is the lifecycle resource actually enforced by secrets-engine, not a relabelled railiance-platform credential read. OpenBao custody remains railiance-platform's; llm-connect remains the existing workload owner. Radar is a proposed delivery recipient, not a PDP caller or lifecycle subject.

context.catalog_target carries the actual non-secret mount/path, owner repo, fields, consumers, delivery/auth specification and workload delivery. Exec also carries the existing exact recipient digest. The evaluator binds this submitted context through FLEX-DEC-2026-012; it does not independently admit an arbitrary KV path. The consumer must join the issuer's exact-action approval to approval_binding_digest and CAS-consume before OpenBao. A changed path or owner can produce a new policy allow, but cannot reuse the old approval. Claim validity and declared human control remain the issuer/consumer responsibilities.

Dedicated pin correction

Helm release flex-auth-secrets-engine, revision 4, now uses the existing CI-published source dd8dd517438b876fdadf27770e3f7e7f55ea69cf image sha256:05a03a8790c2210c48ea92391441c77ddf640d0cd32f5ec09838f5393171fcbd. The old September 6 image lacked the consumer's current replay contract. Policy stays secrets-engine.catalog-lane.lifecycle / v2; caller enforcement and the existing ServiceAccount binding remain in force. The policy rules did not change. Loopback forwarding to the named pod authenticates the responder through the Kubernetes API; plain workstation Service DNS remains unsupported.

Validation: full Go race suite, image policy validation (28 tests / 32 fixtures), Helm lint and server dry-run, then 11 live checks. Correct native caller succeeds; missing/wrong callers, foreign system, wrong tenant and recipient-as-subject refuse. Submitted context and approval digest pairing survive the real evaluator; changed path/mount/owner produces a different approval binding. All other PDP Deployment specs were compared before/after and are identical. Ten-minute caller tokens stayed in memory; the temporary named-pod forward was stopped.

Receipt: docs/evidence/2026-09-14-openrouter-live-pdp.json. It is evaluation-only with a synthetic claim, not real approval or OpenBao evidence. If this pin cannot serve the current contract, stop native execution; rolling back to the prior image restores the replay incompatibility and cannot unblock credential delivery.

Live handoff

SECRETS-WP-0010-T03 holds the unresolved native admission and delivery work, linked to SECRETS-WP-0007-T04/T07 and SECRETS-WP-0006-T05/T06. Approval Engine has no StatefulSet, pod or Service in its declared namespace at inspection. Its production identity/audit and client-reader gates must be completed before native apply. No credential read, AppRole/policy write, ESO change or model spend was performed here. WARDEN-WP-0039-T03 and IR-WP-0004-T02 remain waiting on the native verification; publishing this contract does not retire the proxy.