Deploy verified-group T03 review surface and packet preparation

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

tools/prepare_t03_memos.py

@@ -0,0 +1,34 @@
+"""Prepare the three T03 review packets for an explicitly named human recipient."""
+import argparse,json,hashlib
+from pathlib import Path
+from informed_decision.memo import Memo,BindingSlice,Principal,Scope,BindingLevel,StepKind,PacketItem,Highlight
+from informed_decision.records import dumps
+
+TEXT={
+'apply':('Establish the bounded OpenRouter access role?', 'Create only the reviewed OpenBao policy and AppRole for the existing llm-connect OpenRouter credential. Tokens last 15 minutes, with a 30-minute maximum; Secret IDs last 15 minutes and can be used once. A token permits at most eight uses. This action does not call OpenRouter or rotate the credential.'),
+'verify':('Verify the bounded OpenRouter access role?', 'Check the new reader, credential field availability, limits, denial behavior and session revocation. The existing llm-connect delivery remains in place. This action does not run inference or display credential values.'),
+'exec':('Run the read-only OpenRouter key check?', 'Deliver the credential only to the installed, hash-pinned checker. It sends one GET to https://openrouter.ai/api/v1/key with redirects, proxies and retries disabled. Output is restricted to a fixed result and HTTP status. No inference request or paid campaign trial is authorized.'),
+}
+
+def prepare(principal, receipt, request_root):
+    if not principal or any(c.isspace() for c in principal) or len(principal)>256:raise ValueError('exact human subject required')
+    if receipt['status']!='created' or len(receipt['requests'])!=3:raise ValueError('three native requests required')
+    documents=[];memos=[]
+    for row in receipt['requests']:
+        action=row['action']; approval=row['approval']
+        if action not in TEXT or approval['status']!='requested' or approval['entries'] or approval['binding']['human_control'] is not True:raise ValueError('unapproved human-control request required')
+        question,brief=TEXT[action]
+        request=json.loads((request_root/f'2026-09-14-openrouter-final-{action}-request.json').read_text())
+        packet=json.dumps({'task':'SECRETS-WP-0010-T03','question':question,'consequences':brief,'approval':approval,'exact_execution_request':request},indent=2,ensure_ascii=False)+'\n'
+        digest='sha256:'+hashlib.sha256(packet.encode()).hexdigest()
+        memo=Memo(id=row['memo_id'],version=1,question=question,requested_act='approve',binding_level=BindingLevel.ORGANIZATIONAL,brief=brief,binding=BindingSlice(principal=Principal(id=principal,kind='person',display_name=principal,role='T03 reviewer'),target=Scope(kind='secret-catalog-lane',id='catalog:openrouter-llm-connect',label='Existing llm-connect OpenRouter credential',environment='prod')),step_kind=StepKind.APPROVE,packet=(PacketItem('t03-'+action,'Exact action and consequences',digest),),highlights=(Highlight('scope-'+action,'t03-'+action,brief,required_ack=True,severity='critical'),),approval_id=approval['id'],approval_binding_digest=approval['binding']['digest'])
+        documents.append({'hash':digest,'media_type':'text/plain','content':packet});memos.append(json.loads(dumps(memo)))
+    if {r['action'] for r in receipt['requests']}!={'apply','verify','exec'}:raise ValueError('exact action set required')
+    return {'kind':'t03-review-packets','principal':principal,'documents':documents,'memos':memos}
+
+if __name__=='__main__':
+    p=argparse.ArgumentParser(description=__doc__);p.add_argument('--principal',required=True);p.add_argument('--output',type=Path,required=True);a=p.parse_args()
+    receipt=json.loads(Path('/home/worsch/railiance-platform/docs/evidence/2026-09-14-t03-native-approval-requests.json').read_text())
+    output=prepare(a.principal,receipt,Path('/home/worsch/secrets-engine/docs/evidence'))
+    with a.output.open('x') as f:json.dump(output,f,indent=2);f.write('\n')
+    print('Prepared three packets; no presentations, dispositions or approval entries created.')

tools/render_deployment.py

@@ -65,7 +65,7 @@ def render(inputs):
             # application gates acceptance on /readyz internally; monitoring
             # must scrape it separately. An outage must not restart the writer.
             'readinessProbe':probe('/healthz'),'livenessProbe':probe('/healthz'),
-            'resources':{'requests':{'cpu':'50m','memory':'64Mi'},'limits':{'cpu':'500m','memory':'256Mi'}},
+            'resources':{'requests':{'cpu':'20m','memory':'64Mi'},'limits':{'cpu':'500m','memory':'256Mi'}},
             'volumeMounts':[mount('data','/data'),mount('runtime','/run/informed-decision'),mount('tmp','/tmp'),
                 readonly('configuration','/configuration'),readonly('caller','/var/run/secrets/informed-decision/policy'),
                 readonly('audit','/var/run/secrets/informed-decision/audit')]}],