informed-decision/tools/prepare_t03_memos.py

"""Prepare the three T03 review packets for an explicitly named human recipient."""
import argparse,json,hashlib
from pathlib import Path
from informed_decision.memo import Memo,BindingSlice,Principal,Scope,BindingLevel,StepKind,PacketItem,Highlight
from informed_decision.records import dumps

TEXT={
'apply':('Establish the bounded OpenRouter access role?', 'Create only the reviewed OpenBao policy and AppRole for the existing llm-connect OpenRouter credential. Tokens last 15 minutes, with a 30-minute maximum; Secret IDs last 15 minutes and can be used once. A token permits at most eight uses. This action does not call OpenRouter or rotate the credential.'),
'verify':('Verify the bounded OpenRouter access role?', 'Check the new reader, credential field availability, limits, denial behavior and session revocation. The existing llm-connect delivery remains in place. This action does not run inference or display credential values.'),
'exec':('Run the read-only OpenRouter key check?', 'Deliver the credential only to the installed, hash-pinned checker. It sends one GET to https://openrouter.ai/api/v1/key with redirects, proxies and retries disabled. Output is restricted to a fixed result and HTTP status. No inference request or paid campaign trial is authorized.'),
}

def prepare(principal, receipt, request_root):
    if not principal or any(c.isspace() for c in principal) or len(principal)>256:raise ValueError('exact human subject required')
    if receipt['status']!='created' or len(receipt['requests'])!=3:raise ValueError('three native requests required')
    documents=[];memos=[]
    for row in receipt['requests']:
        action=row['action']; approval=row['approval']
        if action not in TEXT or approval['status']!='requested' or approval['entries'] or approval['binding']['human_control'] is not True:raise ValueError('unapproved human-control request required')
        question,brief=TEXT[action]
        request=json.loads((request_root/f'2026-09-14-openrouter-final-{action}-request.json').read_text())
        packet=json.dumps({'task':'SECRETS-WP-0010-T03','question':question,'consequences':brief,'approval':approval,'exact_execution_request':request},indent=2,ensure_ascii=False)+'\n'
        digest='sha256:'+hashlib.sha256(packet.encode()).hexdigest()
        memo=Memo(id=row['memo_id'],version=row.get('memo_version',1),question=question,requested_act='approve',binding_level=BindingLevel.ORGANIZATIONAL,brief=brief,binding=BindingSlice(principal=Principal(id=principal,kind='person',display_name=principal,role='T03 reviewer'),target=Scope(kind='secret-catalog-lane',id='catalog:openrouter-llm-connect',label='Existing llm-connect OpenRouter credential',environment='prod')),step_kind=StepKind.APPROVE,packet=(PacketItem('t03-'+action,'Exact action and consequences',digest),),highlights=(Highlight('scope-'+action,'t03-'+action,brief,required_ack=True,severity='critical'),),approval_id=approval['id'],approval_binding_digest=approval['binding']['digest'])
        documents.append({'hash':digest,'media_type':'text/plain','content':packet});memos.append(json.loads(dumps(memo)))
    if {r['action'] for r in receipt['requests']}!={'apply','verify','exec'}:raise ValueError('exact action set required')
    return {'kind':'t03-review-packets','principal':principal,'documents':documents,'memos':memos}

if __name__=='__main__':
    p=argparse.ArgumentParser(description=__doc__);p.add_argument('--principal',required=True);p.add_argument('--output',type=Path,required=True);p.add_argument('--receipt',type=Path,required=True);a=p.parse_args()
    receipt=json.loads(a.receipt.read_text())
    output=prepare(a.principal,receipt,Path('/home/worsch/secrets-engine/docs/evidence'))
    with a.output.open('x') as f:json.dump(output,f,indent=2);f.write('\n')
    print('Prepared three packets; no presentations, dispositions or approval entries created.')