2026-09-14 01:08:50 +02:00
|
|
|
# Configured local recipient proposal; not active catalog or credential admission.
|
2026-09-14 00:54:55 +02:00
|
|
|
id: openrouter-llm-connect
|
|
|
|
|
kind: kv
|
|
|
|
|
org: coulomb
|
|
|
|
|
repo: llm-connect
|
|
|
|
|
stage: prod
|
2026-09-14 01:08:50 +02:00
|
|
|
description: OpenRouter provider credential used by llm-connect for activity-core.
|
|
|
|
|
The proposed native recipient checks key authentication only; trial delivery requires
|
|
|
|
|
a separate reviewed recipient and exact-action approval.
|
2026-09-14 00:54:55 +02:00
|
|
|
mount: platform
|
|
|
|
|
path: workloads/activity-core/llm-connect/llm-connect-provider-secrets
|
|
|
|
|
mount_management: existing
|
|
|
|
|
fields:
|
2026-09-14 01:08:50 +02:00
|
|
|
- OPENROUTER_API_KEY
|
2026-09-14 00:54:55 +02:00
|
|
|
consumers:
|
2026-09-14 01:08:50 +02:00
|
|
|
- name: llm-connect-activity-core
|
|
|
|
|
auth: kubernetes
|
|
|
|
|
claim: serviceaccount:external-secrets/external-secrets
|
|
|
|
|
purpose: sync llm-connect-provider-secrets for the activity-core deployment
|
|
|
|
|
- name: intelligence-radar-key-check
|
|
|
|
|
auth: approle
|
|
|
|
|
claim: catalog:openrouter-llm-connect
|
|
|
|
|
purpose: IR-WP-0004 read-only OpenRouter key authentication check; no inference
|
2026-09-14 00:54:55 +02:00
|
|
|
workload_delivery:
|
2026-09-14 01:08:50 +02:00
|
|
|
- mode: external-secrets
|
|
|
|
|
owner: railiance-platform + llm-connect
|
|
|
|
|
delivery_modes:
|
|
|
|
|
- exec-env
|
|
|
|
|
- read-check
|
2026-09-14 00:54:55 +02:00
|
|
|
delivery_auth:
|
|
|
|
|
method: approle
|
|
|
|
|
management: engine
|
|
|
|
|
policy_name: se-prod-openrouter-llm-connect
|
|
|
|
|
role_name: se-prod-openrouter-llm-connect
|
|
|
|
|
token_ttl: 15m
|
|
|
|
|
token_max_ttl: 30m
|
|
|
|
|
secret_id_ttl: 15m
|
|
|
|
|
secret_id_num_uses: 1
|
|
|
|
|
token_num_uses: 8
|
|
|
|
|
approval:
|
|
|
|
|
model: ccr
|
|
|
|
|
human_control: true
|
|
|
|
|
purpose: IR-WP-0004 read-only OpenRouter key authentication check; no inference
|
|
|
|
|
decision_ref: CCR-2026-0003
|
2026-09-14 01:08:50 +02:00
|
|
|
notes: CCR-2026-0003 approves the existing workload lane. A live native AppRole
|
|
|
|
|
apply remains gated by SECRETS-WP-0006-T05 review and operator approval. First
|
|
|
|
|
native-cutover candidate (docs/native-lane-cutover.md); not an authorization to
|
|
|
|
|
apply.
|
2026-09-14 00:54:55 +02:00
|
|
|
verification:
|
2026-09-14 01:08:50 +02:00
|
|
|
positive: approved delivery AppRole can read OPENROUTER_API_KEY without printing
|
|
|
|
|
it
|
2026-09-14 00:54:55 +02:00
|
|
|
negative: unrelated token is denied on platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets
|
|
|
|
|
risk:
|
|
|
|
|
classification: high
|
2026-09-14 01:08:50 +02:00
|
|
|
notes: provider key can incur spend and remains valid outside OpenBao until revoked
|
|
|
|
|
at OpenRouter
|
2026-09-14 00:54:55 +02:00
|
|
|
rotation:
|
|
|
|
|
owner: railiance-platform + llm-connect provider operator
|
2026-09-14 01:08:50 +02:00
|
|
|
expectation: Mint a replacement at OpenRouter, update every live cluster copy, wait
|
|
|
|
|
for ESO refresh, restart llm-connect, verify, and revoke the old provider key.
|
2026-09-14 00:54:55 +02:00
|
|
|
ttl: provider-defined
|
|
|
|
|
deactivation:
|
|
|
|
|
owner: railiance-platform + llm-connect
|
2026-09-14 01:08:50 +02:00
|
|
|
expectation: Disable the front door and workload read path, remove materialized
|
|
|
|
|
Secrets, stop consumers, and revoke the provider key at OpenRouter.
|
2026-09-14 00:54:55 +02:00
|
|
|
audit:
|
2026-09-14 01:08:50 +02:00
|
|
|
evidence: CCR id, actor, exact path, field name, provider key identifier if non-secret,
|
|
|
|
|
timestamps, and pass/fail only
|
2026-09-14 00:54:55 +02:00
|
|
|
delivery_config:
|
|
|
|
|
exec_owner:
|
2026-09-14 01:08:50 +02:00
|
|
|
status: configured
|
2026-09-14 00:54:55 +02:00
|
|
|
owner: intelligence-radar-key-check
|
2026-09-14 01:08:50 +02:00
|
|
|
command:
|
|
|
|
|
- /usr/bin/python3.12
|
|
|
|
|
- -I
|
|
|
|
|
- -B
|
|
|
|
|
- /home/worsch/.local/share/secrets-engine/recipients/openrouter-key-check-dc1569f63ef7/openrouter_key_check.py
|
|
|
|
|
cwd: /run/user/1000/secrets-engine-openrouter-check
|
|
|
|
|
environment:
|
|
|
|
|
LANG: C.UTF-8
|
|
|
|
|
files:
|
|
|
|
|
/usr/bin/python3.12:
|
|
|
|
|
sha256: e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f
|
|
|
|
|
private: false
|
|
|
|
|
/home/worsch/.local/share/secrets-engine/recipients/openrouter-key-check-dc1569f63ef7/openrouter_key_check.py:
|
|
|
|
|
sha256: dc1569f63ef74d73f0a735548c0573db2a1493f7ffc86945f52d0be9b27a3253
|
|
|
|
|
private: true
|
