flex-auth/workplans/FLEX-WP-0026-openrouter-native-contract.md
tegwick 41f359f2dc
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 3s
Build and Publish Container Image / build-and-push (push) Successful in 1m8s
Resolve OpenRouter native contract and promote secrets-engine PDP
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
2026-09-14 00:54:56 +02:00

1.6 KiB

id type title domain repo status owner topic_slug created updated related_workplans
FLEX-WP-0026 workplan Resolve OpenRouter access contract and update native PDP infotech flex-auth finished codex netkingdom 2026-09-14 2026-09-14
WARDEN-WP-0039
IR-WP-0004
SECRETS-WP-0010

Resolve the caller versus credential-owner contract

id: FLEX-WP-0026-T01
status: done
priority: high

docs/openrouter-native-access.md resolves the inbox requests using the existing native lifecycle resource. No admitted delegated-read contract exists in the caller binding. Added concrete caller-boundary regressions for native success, warden owner/engine impersonation, radar subject and mixed-owner batch refusal. Full Go race suite passed. No ops-warden binding or credential-owner rename.

Promote and verify the current native PDP contract

id: FLEX-WP-0026-T02
status: done
priority: high

Dedicated release revision 4 now uses published dd8dd517 image sha256:05a03a8790c2210c48ea92391441c77ddf640d0cd32f5ec09838f5393171fcbd. Policy package stays v2; enforce binding retained. Image policy tests/fixtures, Helm lint/server dry-run and 11 live checks passed. Other PDP Deployment specs unchanged. Named-pod forward removed; bounded tokens held only in memory. Receipt: docs/evidence/2026-09-14-openrouter-live-pdp.json.

Live residual handed off before closure: SECRETS-WP-0010-T03 holds approval-service, client-reader, attended authority and exact recipient admission plus real native verification. WARDEN-WP-0039-T03 and IR-WP-0004-T02 are not closed by this work.