intelligence-radar/docs/evidence/2026-09-14-openrouter-access.md

OpenRouter access repair packet — 2026-09-14

Finding

The user confirmed that the existing OpenRouter key should be obtained through ops-warden/OpenBao and asked to continue resolving access. No replacement key is requested. The previous process-environment key returned HTTP 401, but the Bao key has not been fetched or tested.

warden plan openrouter-llm-connect --json reports autonomous from catalog metadata. Actual warden access --exec returned HTTP 403 before secret retrieval. The planner's verdict is not runtime admission.

The exact cause is already tracked by WARDEN-WP-0039-T03: the ops-warden caller is bound to system ops-warden, while the request's resource.system is the actual owner railiance-platform. Its owners explicitly reject widening the binding or renaming the owner as repairs. This is a missing admitted delegated-read contract, not evidence of an expired caller token or a missing provider key.

Existing owner work

• WARDEN-WP-0039-T03: resolve the admitted credential proxy contract. The question sent to flex-auth on September 9 remains in its unread inbox; no new answer was found in the reviewed owner workplans or relevant unread messages.
• SECRETS-WP-0007-T04: finish the production exact-action authorization path.
• SECRETS-WP-0007-T07 and SECRETS-WP-0006-T05: activate and prove native lanes. OpenRouter is already the first planned candidate. These records remain wait.
• SECRETS-WP-0006-T06: update routing only after native verification.

Owner sources: ops-warden/workplans/WARDEN-WP-0039-explicit-policy-refusal.md; secrets-engine/docs/native-lane-cutover.md; secrets-engine/workplans/SECRETS-WP-0007-production-lifecycle-hardening.md.

Bounded repair to review

Prefer completing the existing native OpenRouter lane, subject to owner review, over introducing a new delegated-read protocol merely for these trials.

Retain the existing KV location: platform/workloads/activity-core/llm-connect/llm-connect-provider-secrets, field OPENROUTER_API_KEY. Do not rotate the key or change existing ESO delivery.

The documented native apply adds only the exact-path read policy and bounded AppRole se-prod-openrouter-llm-connect: 15-minute token TTL, 30-minute maximum, 15-minute single-use secret ID, eight token uses. Before apply, obtain the real exact-action authorization/consume and scoped attended platform authority through the owner's production path. Existing CCR-2026-0003 is provenance, not that approval.

First delivery target is a value-safe read-only OpenRouter key check. Trial exec must separately bind the reviewed local recipient, the authorized USD 10 campaign, and the declared field. Verify correct-reader success and wrong-caller, wrong-owner, wrong-tenant and unrelated-path refusal; confirm existing llm-connect delivery health and native session revocation. Keep the current refusal until those gates pass.

Native rollback removes only the new policy/AppRole and preserves KV and ESO. No production auth, policy, key, or delivery changes were made in this investigation. No alternate credential route was used after the refusal; no new messages were sent.

Radar return condition

IR-WP-0004-T02 remains waiting on the owner access contract. Once an admitted route is ready, validate the Bao key without printing it, reconcile the existing USD 0.023712 reservation against the failed HTTP 401 request, then resume the existing campaign within the total USD 10 authorization. Do not create a new campaign to evade the pending reservation or claim production calibration from controlled samples.