Record native T03 review deployment and remaining human gate
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
parent
755e2871a3
commit
13ecd42077
2 changed files with 631 additions and 0 deletions
596
docs/evidence/2026-09-14-t03-native-pdp-inputs.json
Normal file
596
docs/evidence/2026-09-14-t03-native-pdp-inputs.json
Normal file
|
|
@ -0,0 +1,596 @@
|
||||||
|
{
|
||||||
|
"apply": {
|
||||||
|
"id": "decision:36b30ad115bc46ba",
|
||||||
|
"contract_version": "flex-auth.decision-record.v1",
|
||||||
|
"effect": "allow",
|
||||||
|
"reason": "catalog_lane_policy_matched",
|
||||||
|
"matched_policy_version": "v2",
|
||||||
|
"matched_rule": "catalog_lane_policy_matched",
|
||||||
|
"resource": {
|
||||||
|
"id": "catalog:openrouter-llm-connect",
|
||||||
|
"type": "secret-catalog-lane",
|
||||||
|
"system": "secrets-engine",
|
||||||
|
"tenant": "tenant:platform",
|
||||||
|
"attributes": {
|
||||||
|
"auth_targets": [
|
||||||
|
"se-prod-openrouter-llm-connect"
|
||||||
|
],
|
||||||
|
"fields": [],
|
||||||
|
"policy_targets": [
|
||||||
|
"se-prod-openrouter-llm-connect"
|
||||||
|
],
|
||||||
|
"stage": "prod"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"subject": {
|
||||||
|
"id": "secrets-engine",
|
||||||
|
"type": "service",
|
||||||
|
"tenant": "tenant:platform",
|
||||||
|
"attributes": {
|
||||||
|
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
||||||
|
"display_name": "secrets-engine service principal",
|
||||||
|
"groups": [
|
||||||
|
"group:secrets-engine-lane-operators"
|
||||||
|
],
|
||||||
|
"organization_relation": "ServiceProvider",
|
||||||
|
"roles": [
|
||||||
|
"Operator"
|
||||||
|
]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"binding": {
|
||||||
|
"tenant": "tenant:platform",
|
||||||
|
"subject": {
|
||||||
|
"id": "secrets-engine",
|
||||||
|
"type": "service",
|
||||||
|
"tenant": "tenant:platform",
|
||||||
|
"attributes": {
|
||||||
|
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
||||||
|
"display_name": "secrets-engine service principal",
|
||||||
|
"groups": [
|
||||||
|
"group:secrets-engine-lane-operators"
|
||||||
|
],
|
||||||
|
"organization_relation": "ServiceProvider",
|
||||||
|
"roles": [
|
||||||
|
"Operator"
|
||||||
|
]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"action": "apply",
|
||||||
|
"resource": {
|
||||||
|
"id": "catalog:openrouter-llm-connect",
|
||||||
|
"type": "secret-catalog-lane",
|
||||||
|
"system": "secrets-engine",
|
||||||
|
"tenant": "tenant:platform",
|
||||||
|
"attributes": {
|
||||||
|
"auth_targets": [
|
||||||
|
"se-prod-openrouter-llm-connect"
|
||||||
|
],
|
||||||
|
"fields": [],
|
||||||
|
"policy_targets": [
|
||||||
|
"se-prod-openrouter-llm-connect"
|
||||||
|
],
|
||||||
|
"stage": "prod"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"context": {
|
||||||
|
"catalog_target": {
|
||||||
|
"auth_capability": {},
|
||||||
|
"consumers": [
|
||||||
|
{
|
||||||
|
"auth": "kubernetes",
|
||||||
|
"claim": "serviceaccount:external-secrets/external-secrets",
|
||||||
|
"name": "llm-connect-activity-core",
|
||||||
|
"purpose": "sync llm-connect-provider-secrets for the activity-core deployment"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"auth": "approle",
|
||||||
|
"claim": "catalog:openrouter-llm-connect",
|
||||||
|
"name": "intelligence-radar-key-check",
|
||||||
|
"purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"delivery_auth": {
|
||||||
|
"management": "engine",
|
||||||
|
"method": "approle",
|
||||||
|
"policy_name": "se-prod-openrouter-llm-connect",
|
||||||
|
"role_name": "se-prod-openrouter-llm-connect",
|
||||||
|
"secret_id_num_uses": 1,
|
||||||
|
"secret_id_ttl": "15m",
|
||||||
|
"token_max_ttl": "30m",
|
||||||
|
"token_num_uses": 8,
|
||||||
|
"token_ttl": "15m"
|
||||||
|
},
|
||||||
|
"delivery_config": {
|
||||||
|
"exec_owner": {
|
||||||
|
"command": [
|
||||||
|
"/usr/bin/python3.12",
|
||||||
|
"-I",
|
||||||
|
"-B",
|
||||||
|
"/home/worsch/.local/share/secrets-engine/recipients/openrouter-key-check-dc1569f63ef7/openrouter_key_check.py"
|
||||||
|
],
|
||||||
|
"cwd": "/run/user/1000/secrets-engine-openrouter-check",
|
||||||
|
"environment": {
|
||||||
|
"LANG": "C.UTF-8"
|
||||||
|
},
|
||||||
|
"files": {
|
||||||
|
"/home/worsch/.local/share/secrets-engine/recipients/openrouter-key-check-dc1569f63ef7/openrouter_key_check.py": {
|
||||||
|
"private": true,
|
||||||
|
"sha256": "dc1569f63ef74d73f0a735548c0573db2a1493f7ffc86945f52d0be9b27a3253"
|
||||||
|
},
|
||||||
|
"/usr/bin/python3.12": {
|
||||||
|
"private": false,
|
||||||
|
"sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"owner": "intelligence-radar-key-check",
|
||||||
|
"status": "configured"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"delivery_modes": [
|
||||||
|
"exec-env",
|
||||||
|
"read-check"
|
||||||
|
],
|
||||||
|
"fields": [
|
||||||
|
"OPENROUTER_API_KEY"
|
||||||
|
],
|
||||||
|
"kind": "kv",
|
||||||
|
"mount": "platform",
|
||||||
|
"mount_management": "existing",
|
||||||
|
"org": "coulomb",
|
||||||
|
"path": "workloads/activity-core/llm-connect/llm-connect-provider-secrets",
|
||||||
|
"repo": "llm-connect",
|
||||||
|
"workload_delivery": [
|
||||||
|
{
|
||||||
|
"mode": "external-secrets",
|
||||||
|
"owner": "railiance-platform + llm-connect"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"human_control": true,
|
||||||
|
"purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference"
|
||||||
|
},
|
||||||
|
"request_digest": "sha256:933427642c58c54f65dd4781b8e4c8e2f358eb96497ae35870fff4bd593d2b84",
|
||||||
|
"submitted_request_digest": "sha256:c2f6dcfd5c03a3b0288837b6a54579d9ee84ae853bb0884220cc22af46ad0a12"
|
||||||
|
},
|
||||||
|
"lifetime": {
|
||||||
|
"kind": "ttl",
|
||||||
|
"ttl": "15m",
|
||||||
|
"not_before": "2026-09-14T00:24:35Z",
|
||||||
|
"expires_at": "2026-09-14T00:39:35Z"
|
||||||
|
},
|
||||||
|
"diagnostics": {
|
||||||
|
"action": "apply",
|
||||||
|
"matched_relationship": "",
|
||||||
|
"policy_package": "secrets-engine.catalog-lane.lifecycle",
|
||||||
|
"policy_status": "ready",
|
||||||
|
"registry_overrode": [],
|
||||||
|
"registry_resource": false,
|
||||||
|
"registry_subject": true
|
||||||
|
},
|
||||||
|
"provenance": {
|
||||||
|
"evaluator": "flex-auth/local",
|
||||||
|
"mode": "standalone",
|
||||||
|
"policy_package": "secrets-engine.catalog-lane.lifecycle",
|
||||||
|
"policy_version": "v2",
|
||||||
|
"policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4",
|
||||||
|
"registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
|
||||||
|
"input_claim_digests": {
|
||||||
|
"context": "sha256:29e8c6101ff870dad53f1bcd1eab86b27c5f6cd5eb25a91af14ae1781abb3b32"
|
||||||
|
},
|
||||||
|
"decision_time": "2026-09-14T00:24:35Z"
|
||||||
|
},
|
||||||
|
"caring": {
|
||||||
|
"profile": "caring-0.4.0-rc2",
|
||||||
|
"conformance_findings": [
|
||||||
|
{
|
||||||
|
"code": "CARING-DESCRIPTOR-MISSING",
|
||||||
|
"severity": "warning",
|
||||||
|
"message": "no CARING descriptor matched the request",
|
||||||
|
"fields": [
|
||||||
|
"caring_context"
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"verify": {
|
||||||
|
"id": "decision:d28c93cde5260374",
|
||||||
|
"contract_version": "flex-auth.decision-record.v1",
|
||||||
|
"effect": "allow",
|
||||||
|
"reason": "catalog_lane_policy_matched",
|
||||||
|
"matched_policy_version": "v2",
|
||||||
|
"matched_rule": "catalog_lane_policy_matched",
|
||||||
|
"resource": {
|
||||||
|
"id": "catalog:openrouter-llm-connect",
|
||||||
|
"type": "secret-catalog-lane",
|
||||||
|
"system": "secrets-engine",
|
||||||
|
"tenant": "tenant:platform",
|
||||||
|
"attributes": {
|
||||||
|
"auth_targets": [
|
||||||
|
"se-prod-openrouter-llm-connect"
|
||||||
|
],
|
||||||
|
"fields": [
|
||||||
|
"OPENROUTER_API_KEY"
|
||||||
|
],
|
||||||
|
"policy_targets": [
|
||||||
|
"se-prod-openrouter-llm-connect"
|
||||||
|
],
|
||||||
|
"stage": "prod"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"subject": {
|
||||||
|
"id": "secrets-engine",
|
||||||
|
"type": "service",
|
||||||
|
"tenant": "tenant:platform",
|
||||||
|
"attributes": {
|
||||||
|
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
||||||
|
"display_name": "secrets-engine service principal",
|
||||||
|
"groups": [
|
||||||
|
"group:secrets-engine-lane-operators"
|
||||||
|
],
|
||||||
|
"organization_relation": "ServiceProvider",
|
||||||
|
"roles": [
|
||||||
|
"Operator"
|
||||||
|
]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"binding": {
|
||||||
|
"tenant": "tenant:platform",
|
||||||
|
"subject": {
|
||||||
|
"id": "secrets-engine",
|
||||||
|
"type": "service",
|
||||||
|
"tenant": "tenant:platform",
|
||||||
|
"attributes": {
|
||||||
|
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
||||||
|
"display_name": "secrets-engine service principal",
|
||||||
|
"groups": [
|
||||||
|
"group:secrets-engine-lane-operators"
|
||||||
|
],
|
||||||
|
"organization_relation": "ServiceProvider",
|
||||||
|
"roles": [
|
||||||
|
"Operator"
|
||||||
|
]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"action": "verify",
|
||||||
|
"resource": {
|
||||||
|
"id": "catalog:openrouter-llm-connect",
|
||||||
|
"type": "secret-catalog-lane",
|
||||||
|
"system": "secrets-engine",
|
||||||
|
"tenant": "tenant:platform",
|
||||||
|
"attributes": {
|
||||||
|
"auth_targets": [
|
||||||
|
"se-prod-openrouter-llm-connect"
|
||||||
|
],
|
||||||
|
"fields": [
|
||||||
|
"OPENROUTER_API_KEY"
|
||||||
|
],
|
||||||
|
"policy_targets": [
|
||||||
|
"se-prod-openrouter-llm-connect"
|
||||||
|
],
|
||||||
|
"stage": "prod"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"context": {
|
||||||
|
"catalog_target": {
|
||||||
|
"auth_capability": {},
|
||||||
|
"consumers": [
|
||||||
|
{
|
||||||
|
"auth": "kubernetes",
|
||||||
|
"claim": "serviceaccount:external-secrets/external-secrets",
|
||||||
|
"name": "llm-connect-activity-core",
|
||||||
|
"purpose": "sync llm-connect-provider-secrets for the activity-core deployment"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"auth": "approle",
|
||||||
|
"claim": "catalog:openrouter-llm-connect",
|
||||||
|
"name": "intelligence-radar-key-check",
|
||||||
|
"purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"delivery_auth": {
|
||||||
|
"management": "engine",
|
||||||
|
"method": "approle",
|
||||||
|
"policy_name": "se-prod-openrouter-llm-connect",
|
||||||
|
"role_name": "se-prod-openrouter-llm-connect",
|
||||||
|
"secret_id_num_uses": 1,
|
||||||
|
"secret_id_ttl": "15m",
|
||||||
|
"token_max_ttl": "30m",
|
||||||
|
"token_num_uses": 8,
|
||||||
|
"token_ttl": "15m"
|
||||||
|
},
|
||||||
|
"delivery_config": {
|
||||||
|
"exec_owner": {
|
||||||
|
"command": [
|
||||||
|
"/usr/bin/python3.12",
|
||||||
|
"-I",
|
||||||
|
"-B",
|
||||||
|
"/home/worsch/.local/share/secrets-engine/recipients/openrouter-key-check-dc1569f63ef7/openrouter_key_check.py"
|
||||||
|
],
|
||||||
|
"cwd": "/run/user/1000/secrets-engine-openrouter-check",
|
||||||
|
"environment": {
|
||||||
|
"LANG": "C.UTF-8"
|
||||||
|
},
|
||||||
|
"files": {
|
||||||
|
"/home/worsch/.local/share/secrets-engine/recipients/openrouter-key-check-dc1569f63ef7/openrouter_key_check.py": {
|
||||||
|
"private": true,
|
||||||
|
"sha256": "dc1569f63ef74d73f0a735548c0573db2a1493f7ffc86945f52d0be9b27a3253"
|
||||||
|
},
|
||||||
|
"/usr/bin/python3.12": {
|
||||||
|
"private": false,
|
||||||
|
"sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"owner": "intelligence-radar-key-check",
|
||||||
|
"status": "configured"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"delivery_modes": [
|
||||||
|
"exec-env",
|
||||||
|
"read-check"
|
||||||
|
],
|
||||||
|
"fields": [
|
||||||
|
"OPENROUTER_API_KEY"
|
||||||
|
],
|
||||||
|
"kind": "kv",
|
||||||
|
"mount": "platform",
|
||||||
|
"mount_management": "existing",
|
||||||
|
"org": "coulomb",
|
||||||
|
"path": "workloads/activity-core/llm-connect/llm-connect-provider-secrets",
|
||||||
|
"repo": "llm-connect",
|
||||||
|
"workload_delivery": [
|
||||||
|
{
|
||||||
|
"mode": "external-secrets",
|
||||||
|
"owner": "railiance-platform + llm-connect"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"human_control": true,
|
||||||
|
"purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference"
|
||||||
|
},
|
||||||
|
"request_digest": "sha256:9e36cdbf3890cc5a7e550fd57191f9c0f2a6b2180909aac302aa3b999e7e6b25",
|
||||||
|
"submitted_request_digest": "sha256:2509fb7f53caad32ba92e3cdc89cf965fc761b78707c9efee6beb4a59353c289"
|
||||||
|
},
|
||||||
|
"lifetime": {
|
||||||
|
"kind": "ttl",
|
||||||
|
"ttl": "15m",
|
||||||
|
"not_before": "2026-09-14T00:24:35Z",
|
||||||
|
"expires_at": "2026-09-14T00:39:35Z"
|
||||||
|
},
|
||||||
|
"diagnostics": {
|
||||||
|
"action": "verify",
|
||||||
|
"matched_relationship": "",
|
||||||
|
"policy_package": "secrets-engine.catalog-lane.lifecycle",
|
||||||
|
"policy_status": "ready",
|
||||||
|
"registry_overrode": [],
|
||||||
|
"registry_resource": false,
|
||||||
|
"registry_subject": true
|
||||||
|
},
|
||||||
|
"provenance": {
|
||||||
|
"evaluator": "flex-auth/local",
|
||||||
|
"mode": "standalone",
|
||||||
|
"policy_package": "secrets-engine.catalog-lane.lifecycle",
|
||||||
|
"policy_version": "v2",
|
||||||
|
"policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4",
|
||||||
|
"registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
|
||||||
|
"input_claim_digests": {
|
||||||
|
"context": "sha256:29e8c6101ff870dad53f1bcd1eab86b27c5f6cd5eb25a91af14ae1781abb3b32"
|
||||||
|
},
|
||||||
|
"decision_time": "2026-09-14T00:24:35Z"
|
||||||
|
},
|
||||||
|
"caring": {
|
||||||
|
"profile": "caring-0.4.0-rc2",
|
||||||
|
"conformance_findings": [
|
||||||
|
{
|
||||||
|
"code": "CARING-DESCRIPTOR-MISSING",
|
||||||
|
"severity": "warning",
|
||||||
|
"message": "no CARING descriptor matched the request",
|
||||||
|
"fields": [
|
||||||
|
"caring_context"
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"exec": {
|
||||||
|
"id": "decision:2671f0f24ab8a2e4",
|
||||||
|
"contract_version": "flex-auth.decision-record.v1",
|
||||||
|
"effect": "allow",
|
||||||
|
"reason": "catalog_lane_policy_matched",
|
||||||
|
"matched_policy_version": "v2",
|
||||||
|
"matched_rule": "catalog_lane_policy_matched",
|
||||||
|
"resource": {
|
||||||
|
"id": "catalog:openrouter-llm-connect",
|
||||||
|
"type": "secret-catalog-lane",
|
||||||
|
"system": "secrets-engine",
|
||||||
|
"tenant": "tenant:platform",
|
||||||
|
"attributes": {
|
||||||
|
"auth_targets": [
|
||||||
|
"se-prod-openrouter-llm-connect"
|
||||||
|
],
|
||||||
|
"fields": [
|
||||||
|
"OPENROUTER_API_KEY"
|
||||||
|
],
|
||||||
|
"policy_targets": [
|
||||||
|
"se-prod-openrouter-llm-connect"
|
||||||
|
],
|
||||||
|
"stage": "prod"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"subject": {
|
||||||
|
"id": "secrets-engine",
|
||||||
|
"type": "service",
|
||||||
|
"tenant": "tenant:platform",
|
||||||
|
"attributes": {
|
||||||
|
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
||||||
|
"display_name": "secrets-engine service principal",
|
||||||
|
"groups": [
|
||||||
|
"group:secrets-engine-lane-operators"
|
||||||
|
],
|
||||||
|
"organization_relation": "ServiceProvider",
|
||||||
|
"roles": [
|
||||||
|
"Operator"
|
||||||
|
]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"binding": {
|
||||||
|
"tenant": "tenant:platform",
|
||||||
|
"subject": {
|
||||||
|
"id": "secrets-engine",
|
||||||
|
"type": "service",
|
||||||
|
"tenant": "tenant:platform",
|
||||||
|
"attributes": {
|
||||||
|
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
||||||
|
"display_name": "secrets-engine service principal",
|
||||||
|
"groups": [
|
||||||
|
"group:secrets-engine-lane-operators"
|
||||||
|
],
|
||||||
|
"organization_relation": "ServiceProvider",
|
||||||
|
"roles": [
|
||||||
|
"Operator"
|
||||||
|
]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"action": "exec",
|
||||||
|
"resource": {
|
||||||
|
"id": "catalog:openrouter-llm-connect",
|
||||||
|
"type": "secret-catalog-lane",
|
||||||
|
"system": "secrets-engine",
|
||||||
|
"tenant": "tenant:platform",
|
||||||
|
"attributes": {
|
||||||
|
"auth_targets": [
|
||||||
|
"se-prod-openrouter-llm-connect"
|
||||||
|
],
|
||||||
|
"fields": [
|
||||||
|
"OPENROUTER_API_KEY"
|
||||||
|
],
|
||||||
|
"policy_targets": [
|
||||||
|
"se-prod-openrouter-llm-connect"
|
||||||
|
],
|
||||||
|
"stage": "prod"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"context": {
|
||||||
|
"catalog_target": {
|
||||||
|
"auth_capability": {},
|
||||||
|
"consumers": [
|
||||||
|
{
|
||||||
|
"auth": "kubernetes",
|
||||||
|
"claim": "serviceaccount:external-secrets/external-secrets",
|
||||||
|
"name": "llm-connect-activity-core",
|
||||||
|
"purpose": "sync llm-connect-provider-secrets for the activity-core deployment"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"auth": "approle",
|
||||||
|
"claim": "catalog:openrouter-llm-connect",
|
||||||
|
"name": "intelligence-radar-key-check",
|
||||||
|
"purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"delivery_auth": {
|
||||||
|
"management": "engine",
|
||||||
|
"method": "approle",
|
||||||
|
"policy_name": "se-prod-openrouter-llm-connect",
|
||||||
|
"role_name": "se-prod-openrouter-llm-connect",
|
||||||
|
"secret_id_num_uses": 1,
|
||||||
|
"secret_id_ttl": "15m",
|
||||||
|
"token_max_ttl": "30m",
|
||||||
|
"token_num_uses": 8,
|
||||||
|
"token_ttl": "15m"
|
||||||
|
},
|
||||||
|
"delivery_config": {
|
||||||
|
"exec_owner": {
|
||||||
|
"command": [
|
||||||
|
"/usr/bin/python3.12",
|
||||||
|
"-I",
|
||||||
|
"-B",
|
||||||
|
"/home/worsch/.local/share/secrets-engine/recipients/openrouter-key-check-dc1569f63ef7/openrouter_key_check.py"
|
||||||
|
],
|
||||||
|
"cwd": "/run/user/1000/secrets-engine-openrouter-check",
|
||||||
|
"environment": {
|
||||||
|
"LANG": "C.UTF-8"
|
||||||
|
},
|
||||||
|
"files": {
|
||||||
|
"/home/worsch/.local/share/secrets-engine/recipients/openrouter-key-check-dc1569f63ef7/openrouter_key_check.py": {
|
||||||
|
"private": true,
|
||||||
|
"sha256": "dc1569f63ef74d73f0a735548c0573db2a1493f7ffc86945f52d0be9b27a3253"
|
||||||
|
},
|
||||||
|
"/usr/bin/python3.12": {
|
||||||
|
"private": false,
|
||||||
|
"sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"owner": "intelligence-radar-key-check",
|
||||||
|
"status": "configured"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"delivery_modes": [
|
||||||
|
"exec-env",
|
||||||
|
"read-check"
|
||||||
|
],
|
||||||
|
"fields": [
|
||||||
|
"OPENROUTER_API_KEY"
|
||||||
|
],
|
||||||
|
"kind": "kv",
|
||||||
|
"mount": "platform",
|
||||||
|
"mount_management": "existing",
|
||||||
|
"org": "coulomb",
|
||||||
|
"path": "workloads/activity-core/llm-connect/llm-connect-provider-secrets",
|
||||||
|
"repo": "llm-connect",
|
||||||
|
"workload_delivery": [
|
||||||
|
{
|
||||||
|
"mode": "external-secrets",
|
||||||
|
"owner": "railiance-platform + llm-connect"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"exec_owner_sha256": "22393c7e751e458fa64bb24305ee66a26bbe3993c5aba03ae1fc1a488e777b42",
|
||||||
|
"human_control": true,
|
||||||
|
"purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference"
|
||||||
|
},
|
||||||
|
"request_digest": "sha256:9f17812750fc8962b0fc58fc09df136850c9935a864fafa998a1c030dfb75bd9",
|
||||||
|
"submitted_request_digest": "sha256:d6f3855a6b3f30914f0140e4542a9dbea27da47e105907080ea423a10e241371"
|
||||||
|
},
|
||||||
|
"lifetime": {
|
||||||
|
"kind": "ttl",
|
||||||
|
"ttl": "15m",
|
||||||
|
"not_before": "2026-09-14T00:24:35Z",
|
||||||
|
"expires_at": "2026-09-14T00:39:35Z"
|
||||||
|
},
|
||||||
|
"diagnostics": {
|
||||||
|
"action": "exec",
|
||||||
|
"matched_relationship": "",
|
||||||
|
"policy_package": "secrets-engine.catalog-lane.lifecycle",
|
||||||
|
"policy_status": "ready",
|
||||||
|
"registry_overrode": [],
|
||||||
|
"registry_resource": false,
|
||||||
|
"registry_subject": true
|
||||||
|
},
|
||||||
|
"provenance": {
|
||||||
|
"evaluator": "flex-auth/local",
|
||||||
|
"mode": "standalone",
|
||||||
|
"policy_package": "secrets-engine.catalog-lane.lifecycle",
|
||||||
|
"policy_version": "v2",
|
||||||
|
"policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4",
|
||||||
|
"registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
|
||||||
|
"input_claim_digests": {
|
||||||
|
"context": "sha256:7c05dd7cf44c8df67bcdddd4db8a8bf3026f899c28e35594b72f96c9b0ca8501"
|
||||||
|
},
|
||||||
|
"decision_time": "2026-09-14T00:24:35Z"
|
||||||
|
},
|
||||||
|
"caring": {
|
||||||
|
"profile": "caring-0.4.0-rc2",
|
||||||
|
"conformance_findings": [
|
||||||
|
{
|
||||||
|
"code": "CARING-DESCRIPTOR-MISSING",
|
||||||
|
"severity": "warning",
|
||||||
|
"message": "no CARING descriptor matched the request",
|
||||||
|
"fields": [
|
||||||
|
"caring_context"
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -129,3 +129,38 @@ Remaining: an actual nonmember login refusal, real approval claim/consume,
|
||||||
separate narrow requester admission and deployed Informed Decision review with
|
separate narrow requester admission and deployed Informed Decision review with
|
||||||
an explicitly admitted human mandate. The reader group alone grants no review
|
an explicitly admitted human mandate. The reader group alone grants no review
|
||||||
mandate. T03 and CCR delivery activation remain open; no OpenRouter key was read.
|
mandate. T03 and CCR delivery activation remain open; no OpenRouter key was read.
|
||||||
|
|
||||||
|
|
||||||
|
### T03 scoped review deployment — 2026-09-14
|
||||||
|
|
||||||
|
The operator explicitly admitted `net-kingdom-admins` as the human review group
|
||||||
|
for only the T03 apply, verify and read-only key-check records, separately from
|
||||||
|
its credential-reader membership. The review service is live and ready at
|
||||||
|
https://decisions.coulomb.social with verified KeyCape groups, fresh MFA and a
|
||||||
|
dedicated caller-bound Flex Auth policy. Its mandate does not grant consumption.
|
||||||
|
|
||||||
|
The new `secrets-engine-requester` client has subject `secrets-engine`, tenant
|
||||||
|
`tenant:platform`, role `secrets-engine-requester`, and only `approval:create`.
|
||||||
|
CCR-2026-0024 and CCR-2026-0025 provide distinct verifier and attended reader
|
||||||
|
custody. Native signature, subject, scope and TTL checks passed; excess scopes
|
||||||
|
and a wrong secret were refused. Existing consumer identity is unchanged.
|
||||||
|
Three real requested approvals were created with human control, required count
|
||||||
|
one, and zero entries. Platform evidence is
|
||||||
|
`docs/evidence/2026-09-14-t03-native-approval-requests.json`.
|
||||||
|
|
||||||
|
Review image: sha256:8f55bcecf37a8d65f96e073510b1ffb4636c0a91d75e1ee7d582ad4bce8b953a.
|
||||||
|
Policy image: sha256:c9f028b49dfcede930a9cc48757ec8371ecc71d20b1bfee2733e55298dffcc7c.
|
||||||
|
Review tests: 339 passed, 39 optional integration tests skipped; 11 container
|
||||||
|
checks and HIGH/CRITICAL image scan passed. Policy checks: 57 local and 6 native
|
||||||
|
caller checks passed, using synthetic subjects, not human binding evidence.
|
||||||
|
Approval Engine CPU request was reduced from 25m to 10m after observing 1m use;
|
||||||
|
review requests 20m and its PDP 5m. Limits are unchanged. Native services ready.
|
||||||
|
|
||||||
|
Remaining T03 gate: the operator's exact signed-in account is needed to address
|
||||||
|
three prepared immutable memos, followed by real acknowledgements and acceptance
|
||||||
|
in Informed Decision. No human entry or consume has been generated by an agent.
|
||||||
|
Then execute claim -> validated PDP Check -> CAS consume separately for apply,
|
||||||
|
verify and exec using scoped attended authority, and capture native denial,
|
||||||
|
revocation, workload health and key-check evidence. No OpenRouter credential has
|
||||||
|
been read and no inference or spend was performed. T03 remains waiting; this
|
||||||
|
entry supersedes earlier statements that requester or group admission is missing.
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue