From 09422db079cc5aee5128c1a04242f6b3eb63dece Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 14 Sep 2026 02:54:54 +0200 Subject: [PATCH] Fix missing live Informed Decision browser registration Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6 --- .../SECRETS-WP-0010-openrouter-native-access.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/workplans/SECRETS-WP-0010-openrouter-native-access.md b/workplans/SECRETS-WP-0010-openrouter-native-access.md index c747c3e..483f821 100644 --- a/workplans/SECRETS-WP-0010-openrouter-native-access.md +++ b/workplans/SECRETS-WP-0010-openrouter-native-access.md @@ -164,3 +164,19 @@ verify and exec using scoped attended authority, and capture native denial, revocation, workload health and key-check evidence. No OpenRouter credential has been read and no inference or spend was performed. T03 remains waiting; this entry supersedes earlier statements that requester or group admission is missing. + + +### Live browser registration correction — 2026-09-14 + +The user's login exposed `invalid_profile_usage: unknown client_id`: the public +`informed-decision-approver` registration existed in the source example but was +absent from live KeyCape. Applied exactly the existing admitted registration, +with UID/resourceVersion guards and byte-preserving insertion; unrelated clients, +configuration, signing key and pinned image were preserved. KeyCape is ready. +The actual review-site `/auth/start` now redirects through KeyCape to +`auth.coulomb.social`. Wrong redirect, consume scope and absent PKCE are refused. +Receipt: key-cape/docs/evidence/2026-09-14-informed-decision-browser-registration.json. +Repeatable contained helper: key-cape/tools/register-informed-decision.py +(default preflight; --apply mutates only a missing exact registration). +Human callback/MFA/token proof and T03 approval entries remain pending. The +previous ready check established service health, not browser login acceptance.