Trace OpenRouter access to owner contract and record native repair packet

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbc-910e-77a0-b336-3130194350b3

.custodian-brief.md

@@ -24,3 +24,7 @@ Resume checkpoint: docs/evidence/2026-09-13-resume.md. Portable bundles and the
 USD 10 OpenRouter trial runner pass 32 tests. First inference and subsequent
 key check returned HTTP 401; no completed real trials. USD 0.023712 remains
 reserved pending reconciliation. Credential delivery blocks T02; T01/T03 continue.
+
+2026-09-14: Existing Bao key confirmed by user. Access is blocked by the known
+WARDEN-WP-0039-T03 caller/owner contract, not a request for a replacement key.
+Native repair packet and dependencies: docs/evidence/2026-09-14-openrouter-access.md.

docs/evidence/2026-09-14-openrouter-access.md

@@ -0,0 +1,66 @@
+# OpenRouter access repair packet — 2026-09-14
+
+## Finding
+
+The user confirmed that the existing OpenRouter key should be obtained through
+ops-warden/OpenBao and asked to continue resolving access. No replacement key is
+requested. The previous process-environment key returned HTTP 401, but the Bao
+key has not been fetched or tested.
+
+`warden plan openrouter-llm-connect --json` reports `autonomous` from catalog
+metadata. Actual `warden access --exec` returned HTTP 403 before secret retrieval.
+The planner's verdict is not runtime admission.
+
+The exact cause is already tracked by WARDEN-WP-0039-T03: the ops-warden caller
+is bound to system ops-warden, while the request's resource.system is the actual
+owner railiance-platform. Its owners explicitly reject widening the binding or
+renaming the owner as repairs. This is a missing admitted delegated-read contract,
+not evidence of an expired caller token or a missing provider key.
+
+## Existing owner work
+
+- WARDEN-WP-0039-T03: resolve the admitted credential proxy contract. The question
+  sent to flex-auth on September 9 remains in its unread inbox; no new answer
+  was found in the reviewed owner workplans or relevant unread messages.
+- SECRETS-WP-0007-T04: finish the production exact-action authorization path.
+- SECRETS-WP-0007-T07 and SECRETS-WP-0006-T05: activate and prove native lanes.
+  OpenRouter is already the first planned candidate. These records remain wait.
+- SECRETS-WP-0006-T06: update routing only after native verification.
+
+Owner sources: ops-warden/workplans/WARDEN-WP-0039-explicit-policy-refusal.md;
+secrets-engine/docs/native-lane-cutover.md;
+secrets-engine/workplans/SECRETS-WP-0007-production-lifecycle-hardening.md.
+
+## Bounded repair to review
+
+Prefer completing the existing native OpenRouter lane, subject to owner review,
+over introducing a new delegated-read protocol merely for these trials.
+
+Retain the existing KV location:
+`platform/workloads/activity-core/llm-connect/llm-connect-provider-secrets`,
+field `OPENROUTER_API_KEY`. Do not rotate the key or change existing ESO delivery.
+
+The documented native apply adds only the exact-path read policy and bounded
+AppRole `se-prod-openrouter-llm-connect`: 15-minute token TTL, 30-minute maximum,
+15-minute single-use secret ID, eight token uses. Before apply, obtain the real
+exact-action authorization/consume and scoped attended platform authority through
+the owner's production path. Existing CCR-2026-0003 is provenance, not that approval.
+
+First delivery target is a value-safe read-only OpenRouter key check. Trial exec
+must separately bind the reviewed local recipient, the authorized USD 10 campaign,
+and the declared field. Verify correct-reader success and wrong-caller, wrong-owner,
+wrong-tenant and unrelated-path refusal; confirm existing llm-connect delivery health
+and native session revocation. Keep the current refusal until those gates pass.
+
+Native rollback removes only the new policy/AppRole and preserves KV and ESO.
+No production auth, policy, key, or delivery changes were made in this investigation.
+No alternate credential route was used after the refusal; no new messages were sent.
+
+## Radar return condition
+
+IR-WP-0004-T02 remains waiting on the owner access contract. Once an admitted
+route is ready, validate the Bao key without printing it, reconcile the existing
+USD 0.023712 reservation against the failed HTTP 401 request, then resume the
+existing campaign within the total USD 10 authorization. Do not create a new
+campaign to evade the pending reservation or claim production calibration from
+controlled samples.

workplans/IR-WP-0004-evidence-coverage-and-field-calibration.md

@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: custodian
 created: "2026-09-13"
-updated: "2026-09-13"
+updated: "2026-09-14"
 state_hub_workstream_id: "9df17f9e-40b5-5df2-b3d2-a236d3915d71"
 ---
 
@@ -60,6 +60,13 @@ valid OpenRouter credential delivered to the local environment. The discovered
 `openrouter-llm-connect` route is scoped to a separate service and is not a
 generic client credential. See docs/evidence/2026-09-13-resume.md.
 
+2026-09-14 correction: User confirms an existing OpenBao key. The actual blocker
+is the admitted access contract, tracked in WARDEN-WP-0039-T03; the native
+replacement is waiting in SECRETS-WP-0007-T04/T07 and SECRETS-WP-0006-T05.
+Do not request another key. Concrete native repair and acceptance packet:
+[OpenRouter access](../docs/evidence/2026-09-14-openrouter-access.md).
+The Bao key remains untested; no secret or policy changes were made.
+
 ## Extend publication and hosted operation
 
 ```task