From 13ecd420773c5a7e82fed27a105e4d6cc4c85db0 Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 14 Sep 2026 02:47:32 +0200 Subject: [PATCH] Record native T03 review deployment and remaining human gate Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6 --- .../2026-09-14-t03-native-pdp-inputs.json | 596 ++++++++++++++++++ ...ECRETS-WP-0010-openrouter-native-access.md | 35 + 2 files changed, 631 insertions(+) create mode 100644 docs/evidence/2026-09-14-t03-native-pdp-inputs.json diff --git a/docs/evidence/2026-09-14-t03-native-pdp-inputs.json b/docs/evidence/2026-09-14-t03-native-pdp-inputs.json new file mode 100644 index 0000000..ebb0779 --- /dev/null +++ b/docs/evidence/2026-09-14-t03-native-pdp-inputs.json @@ -0,0 +1,596 @@ +{ + "apply": { + "id": "decision:36b30ad115bc46ba", + "contract_version": "flex-auth.decision-record.v1", + "effect": "allow", + "reason": "catalog_lane_policy_matched", + "matched_policy_version": "v2", + "matched_rule": "catalog_lane_policy_matched", + "resource": { + "id": "catalog:openrouter-llm-connect", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "attributes": { + "auth_targets": [ + "se-prod-openrouter-llm-connect" + ], + "fields": [], + "policy_targets": [ + "se-prod-openrouter-llm-connect" + ], + "stage": "prod" + } + }, + "subject": { + "id": "secrets-engine", + "type": "service", + "tenant": "tenant:platform", + "attributes": { + "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.", + "display_name": "secrets-engine service principal", + "groups": [ + "group:secrets-engine-lane-operators" + ], + "organization_relation": "ServiceProvider", + "roles": [ + "Operator" + ] + } + }, + "binding": { + "tenant": "tenant:platform", + "subject": { + "id": "secrets-engine", + "type": "service", + "tenant": "tenant:platform", + "attributes": { + "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.", + "display_name": "secrets-engine service principal", + "groups": [ + "group:secrets-engine-lane-operators" + ], + "organization_relation": "ServiceProvider", + "roles": [ + "Operator" + ] + } + }, + "action": "apply", + "resource": { + "id": "catalog:openrouter-llm-connect", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "attributes": { + "auth_targets": [ + "se-prod-openrouter-llm-connect" + ], + "fields": [], + "policy_targets": [ + "se-prod-openrouter-llm-connect" + ], + "stage": "prod" + } + }, + "context": { + "catalog_target": { + "auth_capability": {}, + "consumers": [ + { + "auth": "kubernetes", + "claim": "serviceaccount:external-secrets/external-secrets", + "name": "llm-connect-activity-core", + "purpose": "sync llm-connect-provider-secrets for the activity-core deployment" + }, + { + "auth": "approle", + "claim": "catalog:openrouter-llm-connect", + "name": "intelligence-radar-key-check", + "purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference" + } + ], + "delivery_auth": { + "management": "engine", + "method": "approle", + "policy_name": "se-prod-openrouter-llm-connect", + "role_name": "se-prod-openrouter-llm-connect", + "secret_id_num_uses": 1, + "secret_id_ttl": "15m", + "token_max_ttl": "30m", + "token_num_uses": 8, + "token_ttl": "15m" + }, + "delivery_config": { + "exec_owner": { + "command": [ + "/usr/bin/python3.12", + "-I", + "-B", + "/home/worsch/.local/share/secrets-engine/recipients/openrouter-key-check-dc1569f63ef7/openrouter_key_check.py" + ], + "cwd": "/run/user/1000/secrets-engine-openrouter-check", + "environment": { + "LANG": "C.UTF-8" + }, + "files": { + "/home/worsch/.local/share/secrets-engine/recipients/openrouter-key-check-dc1569f63ef7/openrouter_key_check.py": { + "private": true, + "sha256": "dc1569f63ef74d73f0a735548c0573db2a1493f7ffc86945f52d0be9b27a3253" + }, + "/usr/bin/python3.12": { + "private": false, + "sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f" + } + }, + "owner": "intelligence-radar-key-check", + "status": "configured" + } + }, + "delivery_modes": [ + "exec-env", + "read-check" + ], + "fields": [ + "OPENROUTER_API_KEY" + ], + "kind": "kv", + "mount": "platform", + "mount_management": "existing", + "org": "coulomb", + "path": "workloads/activity-core/llm-connect/llm-connect-provider-secrets", + "repo": "llm-connect", + "workload_delivery": [ + { + "mode": "external-secrets", + "owner": "railiance-platform + llm-connect" + } + ] + }, + "human_control": true, + "purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference" + }, + "request_digest": "sha256:933427642c58c54f65dd4781b8e4c8e2f358eb96497ae35870fff4bd593d2b84", + "submitted_request_digest": "sha256:c2f6dcfd5c03a3b0288837b6a54579d9ee84ae853bb0884220cc22af46ad0a12" + }, + "lifetime": { + "kind": "ttl", + "ttl": "15m", + "not_before": "2026-09-14T00:24:35Z", + "expires_at": "2026-09-14T00:39:35Z" + }, + "diagnostics": { + "action": "apply", + "matched_relationship": "", + "policy_package": "secrets-engine.catalog-lane.lifecycle", + "policy_status": "ready", + "registry_overrode": [], + "registry_resource": false, + "registry_subject": true + }, + "provenance": { + "evaluator": "flex-auth/local", + "mode": "standalone", + "policy_package": "secrets-engine.catalog-lane.lifecycle", + "policy_version": "v2", + "policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4", + "registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb", + "input_claim_digests": { + "context": "sha256:29e8c6101ff870dad53f1bcd1eab86b27c5f6cd5eb25a91af14ae1781abb3b32" + }, + "decision_time": "2026-09-14T00:24:35Z" + }, + "caring": { + "profile": "caring-0.4.0-rc2", + "conformance_findings": [ + { + "code": "CARING-DESCRIPTOR-MISSING", + "severity": "warning", + "message": "no CARING descriptor matched the request", + "fields": [ + "caring_context" + ] + } + ] + } + }, + "verify": { + "id": "decision:d28c93cde5260374", + "contract_version": "flex-auth.decision-record.v1", + "effect": "allow", + "reason": "catalog_lane_policy_matched", + "matched_policy_version": "v2", + "matched_rule": "catalog_lane_policy_matched", + "resource": { + "id": "catalog:openrouter-llm-connect", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "attributes": { + "auth_targets": [ + "se-prod-openrouter-llm-connect" + ], + "fields": [ + "OPENROUTER_API_KEY" + ], + "policy_targets": [ + "se-prod-openrouter-llm-connect" + ], + "stage": "prod" + } + }, + "subject": { + "id": "secrets-engine", + "type": "service", + "tenant": "tenant:platform", + "attributes": { + "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.", + "display_name": "secrets-engine service principal", + "groups": [ + "group:secrets-engine-lane-operators" + ], + "organization_relation": "ServiceProvider", + "roles": [ + "Operator" + ] + } + }, + "binding": { + "tenant": "tenant:platform", + "subject": { + "id": "secrets-engine", + "type": "service", + "tenant": "tenant:platform", + "attributes": { + "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.", + "display_name": "secrets-engine service principal", + "groups": [ + "group:secrets-engine-lane-operators" + ], + "organization_relation": "ServiceProvider", + "roles": [ + "Operator" + ] + } + }, + "action": "verify", + "resource": { + "id": "catalog:openrouter-llm-connect", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "attributes": { + "auth_targets": [ + "se-prod-openrouter-llm-connect" + ], + "fields": [ + "OPENROUTER_API_KEY" + ], + "policy_targets": [ + "se-prod-openrouter-llm-connect" + ], + "stage": "prod" + } + }, + "context": { + "catalog_target": { + "auth_capability": {}, + "consumers": [ + { + "auth": "kubernetes", + "claim": "serviceaccount:external-secrets/external-secrets", + "name": "llm-connect-activity-core", + "purpose": "sync llm-connect-provider-secrets for the activity-core deployment" + }, + { + "auth": "approle", + "claim": "catalog:openrouter-llm-connect", + "name": "intelligence-radar-key-check", + "purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference" + } + ], + "delivery_auth": { + "management": "engine", + "method": "approle", + "policy_name": "se-prod-openrouter-llm-connect", + "role_name": "se-prod-openrouter-llm-connect", + "secret_id_num_uses": 1, + "secret_id_ttl": "15m", + "token_max_ttl": "30m", + "token_num_uses": 8, + "token_ttl": "15m" + }, + "delivery_config": { + "exec_owner": { + "command": [ + "/usr/bin/python3.12", + "-I", + "-B", + "/home/worsch/.local/share/secrets-engine/recipients/openrouter-key-check-dc1569f63ef7/openrouter_key_check.py" + ], + "cwd": "/run/user/1000/secrets-engine-openrouter-check", + "environment": { + "LANG": "C.UTF-8" + }, + "files": { + "/home/worsch/.local/share/secrets-engine/recipients/openrouter-key-check-dc1569f63ef7/openrouter_key_check.py": { + "private": true, + "sha256": "dc1569f63ef74d73f0a735548c0573db2a1493f7ffc86945f52d0be9b27a3253" + }, + "/usr/bin/python3.12": { + "private": false, + "sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f" + } + }, + "owner": "intelligence-radar-key-check", + "status": "configured" + } + }, + "delivery_modes": [ + "exec-env", + "read-check" + ], + "fields": [ + "OPENROUTER_API_KEY" + ], + "kind": "kv", + "mount": "platform", + "mount_management": "existing", + "org": "coulomb", + "path": "workloads/activity-core/llm-connect/llm-connect-provider-secrets", + "repo": "llm-connect", + "workload_delivery": [ + { + "mode": "external-secrets", + "owner": "railiance-platform + llm-connect" + } + ] + }, + "human_control": true, + "purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference" + }, + "request_digest": "sha256:9e36cdbf3890cc5a7e550fd57191f9c0f2a6b2180909aac302aa3b999e7e6b25", + "submitted_request_digest": "sha256:2509fb7f53caad32ba92e3cdc89cf965fc761b78707c9efee6beb4a59353c289" + }, + "lifetime": { + "kind": "ttl", + "ttl": "15m", + "not_before": "2026-09-14T00:24:35Z", + "expires_at": "2026-09-14T00:39:35Z" + }, + "diagnostics": { + "action": "verify", + "matched_relationship": "", + "policy_package": "secrets-engine.catalog-lane.lifecycle", + "policy_status": "ready", + "registry_overrode": [], + "registry_resource": false, + "registry_subject": true + }, + "provenance": { + "evaluator": "flex-auth/local", + "mode": "standalone", + "policy_package": "secrets-engine.catalog-lane.lifecycle", + "policy_version": "v2", + "policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4", + "registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb", + "input_claim_digests": { + "context": "sha256:29e8c6101ff870dad53f1bcd1eab86b27c5f6cd5eb25a91af14ae1781abb3b32" + }, + "decision_time": "2026-09-14T00:24:35Z" + }, + "caring": { + "profile": "caring-0.4.0-rc2", + "conformance_findings": [ + { + "code": "CARING-DESCRIPTOR-MISSING", + "severity": "warning", + "message": "no CARING descriptor matched the request", + "fields": [ + "caring_context" + ] + } + ] + } + }, + "exec": { + "id": "decision:2671f0f24ab8a2e4", + "contract_version": "flex-auth.decision-record.v1", + "effect": "allow", + "reason": "catalog_lane_policy_matched", + "matched_policy_version": "v2", + "matched_rule": "catalog_lane_policy_matched", + "resource": { + "id": "catalog:openrouter-llm-connect", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "attributes": { + "auth_targets": [ + "se-prod-openrouter-llm-connect" + ], + "fields": [ + "OPENROUTER_API_KEY" + ], + "policy_targets": [ + "se-prod-openrouter-llm-connect" + ], + "stage": "prod" + } + }, + "subject": { + "id": "secrets-engine", + "type": "service", + "tenant": "tenant:platform", + "attributes": { + "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.", + "display_name": "secrets-engine service principal", + "groups": [ + "group:secrets-engine-lane-operators" + ], + "organization_relation": "ServiceProvider", + "roles": [ + "Operator" + ] + } + }, + "binding": { + "tenant": "tenant:platform", + "subject": { + "id": "secrets-engine", + "type": "service", + "tenant": "tenant:platform", + "attributes": { + "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.", + "display_name": "secrets-engine service principal", + "groups": [ + "group:secrets-engine-lane-operators" + ], + "organization_relation": "ServiceProvider", + "roles": [ + "Operator" + ] + } + }, + "action": "exec", + "resource": { + "id": "catalog:openrouter-llm-connect", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "attributes": { + "auth_targets": [ + "se-prod-openrouter-llm-connect" + ], + "fields": [ + "OPENROUTER_API_KEY" + ], + "policy_targets": [ + "se-prod-openrouter-llm-connect" + ], + "stage": "prod" + } + }, + "context": { + "catalog_target": { + "auth_capability": {}, + "consumers": [ + { + "auth": "kubernetes", + "claim": "serviceaccount:external-secrets/external-secrets", + "name": "llm-connect-activity-core", + "purpose": "sync llm-connect-provider-secrets for the activity-core deployment" + }, + { + "auth": "approle", + "claim": "catalog:openrouter-llm-connect", + "name": "intelligence-radar-key-check", + "purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference" + } + ], + "delivery_auth": { + "management": "engine", + "method": "approle", + "policy_name": "se-prod-openrouter-llm-connect", + "role_name": "se-prod-openrouter-llm-connect", + "secret_id_num_uses": 1, + "secret_id_ttl": "15m", + "token_max_ttl": "30m", + "token_num_uses": 8, + "token_ttl": "15m" + }, + "delivery_config": { + "exec_owner": { + "command": [ + "/usr/bin/python3.12", + "-I", + "-B", + "/home/worsch/.local/share/secrets-engine/recipients/openrouter-key-check-dc1569f63ef7/openrouter_key_check.py" + ], + "cwd": "/run/user/1000/secrets-engine-openrouter-check", + "environment": { + "LANG": "C.UTF-8" + }, + "files": { + "/home/worsch/.local/share/secrets-engine/recipients/openrouter-key-check-dc1569f63ef7/openrouter_key_check.py": { + "private": true, + "sha256": "dc1569f63ef74d73f0a735548c0573db2a1493f7ffc86945f52d0be9b27a3253" + }, + "/usr/bin/python3.12": { + "private": false, + "sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f" + } + }, + "owner": "intelligence-radar-key-check", + "status": "configured" + } + }, + "delivery_modes": [ + "exec-env", + "read-check" + ], + "fields": [ + "OPENROUTER_API_KEY" + ], + "kind": "kv", + "mount": "platform", + "mount_management": "existing", + "org": "coulomb", + "path": "workloads/activity-core/llm-connect/llm-connect-provider-secrets", + "repo": "llm-connect", + "workload_delivery": [ + { + "mode": "external-secrets", + "owner": "railiance-platform + llm-connect" + } + ] + }, + "exec_owner_sha256": "22393c7e751e458fa64bb24305ee66a26bbe3993c5aba03ae1fc1a488e777b42", + "human_control": true, + "purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference" + }, + "request_digest": "sha256:9f17812750fc8962b0fc58fc09df136850c9935a864fafa998a1c030dfb75bd9", + "submitted_request_digest": "sha256:d6f3855a6b3f30914f0140e4542a9dbea27da47e105907080ea423a10e241371" + }, + "lifetime": { + "kind": "ttl", + "ttl": "15m", + "not_before": "2026-09-14T00:24:35Z", + "expires_at": "2026-09-14T00:39:35Z" + }, + "diagnostics": { + "action": "exec", + "matched_relationship": "", + "policy_package": "secrets-engine.catalog-lane.lifecycle", + "policy_status": "ready", + "registry_overrode": [], + "registry_resource": false, + "registry_subject": true + }, + "provenance": { + "evaluator": "flex-auth/local", + "mode": "standalone", + "policy_package": "secrets-engine.catalog-lane.lifecycle", + "policy_version": "v2", + "policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4", + "registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb", + "input_claim_digests": { + "context": "sha256:7c05dd7cf44c8df67bcdddd4db8a8bf3026f899c28e35594b72f96c9b0ca8501" + }, + "decision_time": "2026-09-14T00:24:35Z" + }, + "caring": { + "profile": "caring-0.4.0-rc2", + "conformance_findings": [ + { + "code": "CARING-DESCRIPTOR-MISSING", + "severity": "warning", + "message": "no CARING descriptor matched the request", + "fields": [ + "caring_context" + ] + } + ] + } + } +} diff --git a/workplans/SECRETS-WP-0010-openrouter-native-access.md b/workplans/SECRETS-WP-0010-openrouter-native-access.md index d7dd148..c747c3e 100644 --- a/workplans/SECRETS-WP-0010-openrouter-native-access.md +++ b/workplans/SECRETS-WP-0010-openrouter-native-access.md @@ -129,3 +129,38 @@ Remaining: an actual nonmember login refusal, real approval claim/consume, separate narrow requester admission and deployed Informed Decision review with an explicitly admitted human mandate. The reader group alone grants no review mandate. T03 and CCR delivery activation remain open; no OpenRouter key was read. + + +### T03 scoped review deployment — 2026-09-14 + +The operator explicitly admitted `net-kingdom-admins` as the human review group +for only the T03 apply, verify and read-only key-check records, separately from +its credential-reader membership. The review service is live and ready at +https://decisions.coulomb.social with verified KeyCape groups, fresh MFA and a +dedicated caller-bound Flex Auth policy. Its mandate does not grant consumption. + +The new `secrets-engine-requester` client has subject `secrets-engine`, tenant +`tenant:platform`, role `secrets-engine-requester`, and only `approval:create`. +CCR-2026-0024 and CCR-2026-0025 provide distinct verifier and attended reader +custody. Native signature, subject, scope and TTL checks passed; excess scopes +and a wrong secret were refused. Existing consumer identity is unchanged. +Three real requested approvals were created with human control, required count +one, and zero entries. Platform evidence is +`docs/evidence/2026-09-14-t03-native-approval-requests.json`. + +Review image: sha256:8f55bcecf37a8d65f96e073510b1ffb4636c0a91d75e1ee7d582ad4bce8b953a. +Policy image: sha256:c9f028b49dfcede930a9cc48757ec8371ecc71d20b1bfee2733e55298dffcc7c. +Review tests: 339 passed, 39 optional integration tests skipped; 11 container +checks and HIGH/CRITICAL image scan passed. Policy checks: 57 local and 6 native +caller checks passed, using synthetic subjects, not human binding evidence. +Approval Engine CPU request was reduced from 25m to 10m after observing 1m use; +review requests 20m and its PDP 5m. Limits are unchanged. Native services ready. + +Remaining T03 gate: the operator's exact signed-in account is needed to address +three prepared immutable memos, followed by real acknowledgements and acceptance +in Informed Decision. No human entry or consume has been generated by an agent. +Then execute claim -> validated PDP Check -> CAS consume separately for apply, +verify and exec using scoped attended authority, and capture native denial, +revocation, workload health and key-check evidence. No OpenRouter credential has +been read and no inference or spend was performed. T03 remains waiting; this +entry supersedes earlier statements that requester or group admission is missing.