Prepare exact native recipient and record approval service activation
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
parent
992f20f79d
commit
1f7f42b277
9 changed files with 514 additions and 62 deletions
84
docs/evidence/2026-09-14-approval-engine-deployment.json
Normal file
84
docs/evidence/2026-09-14-approval-engine-deployment.json
Normal file
|
|
@ -0,0 +1,84 @@
|
|||
{
|
||||
"storage": {
|
||||
"schema_version": 5,
|
||||
"expected_schema_version": 5,
|
||||
"schema_current": true,
|
||||
"persistent": true,
|
||||
"required_tables": {
|
||||
"approvals": true,
|
||||
"entries": true,
|
||||
"outbox": true
|
||||
},
|
||||
"integrity": [
|
||||
"ok"
|
||||
],
|
||||
"foreign_key_violations": 0,
|
||||
"ok": true
|
||||
},
|
||||
"outbox": {
|
||||
"total": 1,
|
||||
"pending": 0,
|
||||
"max_age_seconds": 0,
|
||||
"attempts": 1,
|
||||
"failed_pending": 0,
|
||||
"counts": {
|
||||
"issuance": 0,
|
||||
"use": 0,
|
||||
"supersession": 0,
|
||||
"revocation": 0,
|
||||
"heartbeat": 1
|
||||
}
|
||||
},
|
||||
"restored": {
|
||||
"schema_version": 5,
|
||||
"expected_schema_version": 5,
|
||||
"schema_current": true,
|
||||
"persistent": true,
|
||||
"required_tables": {
|
||||
"approvals": true,
|
||||
"entries": true,
|
||||
"outbox": true
|
||||
},
|
||||
"integrity": [
|
||||
"ok"
|
||||
],
|
||||
"foreign_key_violations": 0,
|
||||
"ok": true
|
||||
},
|
||||
"readiness": 200,
|
||||
"anonymous_refusal": 401,
|
||||
"invalid_bearer_refusal": 401,
|
||||
"jwks_reachable": true,
|
||||
"timestamp": "2026-09-13T23:06:37.566144+00:00",
|
||||
"status": "deployed_and_restart_restore_verified",
|
||||
"cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786",
|
||||
"pod_uid_before_restart": "95215659-3b17-4ccf-ab8c-98418439cdbe",
|
||||
"pod_uid_after_restart": "7b8c05d9-f1d5-403d-abb3-2250bff9db5e",
|
||||
"image": "forgejo.coulomb.social/coulomb/approval-engine@sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49",
|
||||
"resources": {
|
||||
"limits": {
|
||||
"cpu": "500m",
|
||||
"memory": "256Mi"
|
||||
},
|
||||
"requests": {
|
||||
"cpu": "25m",
|
||||
"memory": "64Mi"
|
||||
}
|
||||
},
|
||||
"caller_token_automount": false,
|
||||
"tests": {
|
||||
"repository": 156,
|
||||
"changed_manifest": 6
|
||||
},
|
||||
"backup": {
|
||||
"persistent_path": "/data/t03-initial-backup-20260914.sqlite",
|
||||
"independent_local_copy": "/tmp/t03-approval-backup/restored.sqlite",
|
||||
"restore_exercise": "isolated copy opened with actual engine; live database was not overwritten",
|
||||
"retention": "initial test backups only; long-term backup schedule/retention not established"
|
||||
},
|
||||
"limitations": [
|
||||
"No real approval created, human entry supplied, or credential consumed.",
|
||||
"Consumer client-side reader and requesting identity remain unadmitted.",
|
||||
"Heartbeat acknowledgment/outbox persistence proved; independent audit archive retrieval remains Audit Core owner work."
|
||||
]
|
||||
}
|
||||
100
docs/evidence/2026-09-14-openrouter-final-apply-request.json
Normal file
100
docs/evidence/2026-09-14-openrouter-final-apply-request.json
Normal file
|
|
@ -0,0 +1,100 @@
|
|||
{
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service"
|
||||
},
|
||||
"action": "apply",
|
||||
"resource": {
|
||||
"id": "catalog:openrouter-llm-connect",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"attributes": {
|
||||
"stage": "prod",
|
||||
"fields": [],
|
||||
"policy_targets": [
|
||||
"se-prod-openrouter-llm-connect"
|
||||
],
|
||||
"auth_targets": [
|
||||
"se-prod-openrouter-llm-connect"
|
||||
]
|
||||
}
|
||||
},
|
||||
"context": {
|
||||
"purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference",
|
||||
"catalog_target": {
|
||||
"kind": "kv",
|
||||
"org": "coulomb",
|
||||
"repo": "llm-connect",
|
||||
"mount": "platform",
|
||||
"path": "workloads/activity-core/llm-connect/llm-connect-provider-secrets",
|
||||
"fields": [
|
||||
"OPENROUTER_API_KEY"
|
||||
],
|
||||
"mount_management": "existing",
|
||||
"consumers": [
|
||||
{
|
||||
"name": "llm-connect-activity-core",
|
||||
"auth": "kubernetes",
|
||||
"claim": "serviceaccount:external-secrets/external-secrets",
|
||||
"purpose": "sync llm-connect-provider-secrets for the activity-core deployment"
|
||||
},
|
||||
{
|
||||
"name": "intelligence-radar-key-check",
|
||||
"auth": "approle",
|
||||
"claim": "catalog:openrouter-llm-connect",
|
||||
"purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference"
|
||||
}
|
||||
],
|
||||
"delivery_modes": [
|
||||
"exec-env",
|
||||
"read-check"
|
||||
],
|
||||
"delivery_auth": {
|
||||
"method": "approle",
|
||||
"management": "engine",
|
||||
"policy_name": "se-prod-openrouter-llm-connect",
|
||||
"role_name": "se-prod-openrouter-llm-connect",
|
||||
"token_ttl": "15m",
|
||||
"token_max_ttl": "30m",
|
||||
"secret_id_ttl": "15m",
|
||||
"secret_id_num_uses": 1,
|
||||
"token_num_uses": 8
|
||||
},
|
||||
"delivery_config": {
|
||||
"exec_owner": {
|
||||
"status": "configured",
|
||||
"owner": "intelligence-radar-key-check",
|
||||
"command": [
|
||||
"/usr/bin/python3.12",
|
||||
"-I",
|
||||
"-B",
|
||||
"/home/worsch/.local/share/secrets-engine/recipients/openrouter-key-check-dc1569f63ef7/openrouter_key_check.py"
|
||||
],
|
||||
"cwd": "/run/user/1000/secrets-engine-openrouter-check",
|
||||
"environment": {
|
||||
"LANG": "C.UTF-8"
|
||||
},
|
||||
"files": {
|
||||
"/usr/bin/python3.12": {
|
||||
"sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f",
|
||||
"private": false
|
||||
},
|
||||
"/home/worsch/.local/share/secrets-engine/recipients/openrouter-key-check-dc1569f63ef7/openrouter_key_check.py": {
|
||||
"sha256": "dc1569f63ef74d73f0a735548c0573db2a1493f7ffc86945f52d0be9b27a3253",
|
||||
"private": true
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"auth_capability": {},
|
||||
"workload_delivery": [
|
||||
{
|
||||
"mode": "external-secrets",
|
||||
"owner": "railiance-platform + llm-connect"
|
||||
}
|
||||
]
|
||||
},
|
||||
"human_control": true
|
||||
}
|
||||
}
|
||||
103
docs/evidence/2026-09-14-openrouter-final-exec-request.json
Normal file
103
docs/evidence/2026-09-14-openrouter-final-exec-request.json
Normal file
|
|
@ -0,0 +1,103 @@
|
|||
{
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service"
|
||||
},
|
||||
"action": "exec",
|
||||
"resource": {
|
||||
"id": "catalog:openrouter-llm-connect",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"attributes": {
|
||||
"stage": "prod",
|
||||
"fields": [
|
||||
"OPENROUTER_API_KEY"
|
||||
],
|
||||
"policy_targets": [
|
||||
"se-prod-openrouter-llm-connect"
|
||||
],
|
||||
"auth_targets": [
|
||||
"se-prod-openrouter-llm-connect"
|
||||
]
|
||||
}
|
||||
},
|
||||
"context": {
|
||||
"purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference",
|
||||
"catalog_target": {
|
||||
"kind": "kv",
|
||||
"org": "coulomb",
|
||||
"repo": "llm-connect",
|
||||
"mount": "platform",
|
||||
"path": "workloads/activity-core/llm-connect/llm-connect-provider-secrets",
|
||||
"fields": [
|
||||
"OPENROUTER_API_KEY"
|
||||
],
|
||||
"mount_management": "existing",
|
||||
"consumers": [
|
||||
{
|
||||
"name": "llm-connect-activity-core",
|
||||
"auth": "kubernetes",
|
||||
"claim": "serviceaccount:external-secrets/external-secrets",
|
||||
"purpose": "sync llm-connect-provider-secrets for the activity-core deployment"
|
||||
},
|
||||
{
|
||||
"name": "intelligence-radar-key-check",
|
||||
"auth": "approle",
|
||||
"claim": "catalog:openrouter-llm-connect",
|
||||
"purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference"
|
||||
}
|
||||
],
|
||||
"delivery_modes": [
|
||||
"exec-env",
|
||||
"read-check"
|
||||
],
|
||||
"delivery_auth": {
|
||||
"method": "approle",
|
||||
"management": "engine",
|
||||
"policy_name": "se-prod-openrouter-llm-connect",
|
||||
"role_name": "se-prod-openrouter-llm-connect",
|
||||
"token_ttl": "15m",
|
||||
"token_max_ttl": "30m",
|
||||
"secret_id_ttl": "15m",
|
||||
"secret_id_num_uses": 1,
|
||||
"token_num_uses": 8
|
||||
},
|
||||
"delivery_config": {
|
||||
"exec_owner": {
|
||||
"status": "configured",
|
||||
"owner": "intelligence-radar-key-check",
|
||||
"command": [
|
||||
"/usr/bin/python3.12",
|
||||
"-I",
|
||||
"-B",
|
||||
"/home/worsch/.local/share/secrets-engine/recipients/openrouter-key-check-dc1569f63ef7/openrouter_key_check.py"
|
||||
],
|
||||
"cwd": "/run/user/1000/secrets-engine-openrouter-check",
|
||||
"environment": {
|
||||
"LANG": "C.UTF-8"
|
||||
},
|
||||
"files": {
|
||||
"/usr/bin/python3.12": {
|
||||
"sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f",
|
||||
"private": false
|
||||
},
|
||||
"/home/worsch/.local/share/secrets-engine/recipients/openrouter-key-check-dc1569f63ef7/openrouter_key_check.py": {
|
||||
"sha256": "dc1569f63ef74d73f0a735548c0573db2a1493f7ffc86945f52d0be9b27a3253",
|
||||
"private": true
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"auth_capability": {},
|
||||
"workload_delivery": [
|
||||
{
|
||||
"mode": "external-secrets",
|
||||
"owner": "railiance-platform + llm-connect"
|
||||
}
|
||||
]
|
||||
},
|
||||
"human_control": true,
|
||||
"exec_owner_sha256": "22393c7e751e458fa64bb24305ee66a26bbe3993c5aba03ae1fc1a488e777b42"
|
||||
}
|
||||
}
|
||||
102
docs/evidence/2026-09-14-openrouter-final-verify-request.json
Normal file
102
docs/evidence/2026-09-14-openrouter-final-verify-request.json
Normal file
|
|
@ -0,0 +1,102 @@
|
|||
{
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service"
|
||||
},
|
||||
"action": "verify",
|
||||
"resource": {
|
||||
"id": "catalog:openrouter-llm-connect",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"attributes": {
|
||||
"stage": "prod",
|
||||
"fields": [
|
||||
"OPENROUTER_API_KEY"
|
||||
],
|
||||
"policy_targets": [
|
||||
"se-prod-openrouter-llm-connect"
|
||||
],
|
||||
"auth_targets": [
|
||||
"se-prod-openrouter-llm-connect"
|
||||
]
|
||||
}
|
||||
},
|
||||
"context": {
|
||||
"purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference",
|
||||
"catalog_target": {
|
||||
"kind": "kv",
|
||||
"org": "coulomb",
|
||||
"repo": "llm-connect",
|
||||
"mount": "platform",
|
||||
"path": "workloads/activity-core/llm-connect/llm-connect-provider-secrets",
|
||||
"fields": [
|
||||
"OPENROUTER_API_KEY"
|
||||
],
|
||||
"mount_management": "existing",
|
||||
"consumers": [
|
||||
{
|
||||
"name": "llm-connect-activity-core",
|
||||
"auth": "kubernetes",
|
||||
"claim": "serviceaccount:external-secrets/external-secrets",
|
||||
"purpose": "sync llm-connect-provider-secrets for the activity-core deployment"
|
||||
},
|
||||
{
|
||||
"name": "intelligence-radar-key-check",
|
||||
"auth": "approle",
|
||||
"claim": "catalog:openrouter-llm-connect",
|
||||
"purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference"
|
||||
}
|
||||
],
|
||||
"delivery_modes": [
|
||||
"exec-env",
|
||||
"read-check"
|
||||
],
|
||||
"delivery_auth": {
|
||||
"method": "approle",
|
||||
"management": "engine",
|
||||
"policy_name": "se-prod-openrouter-llm-connect",
|
||||
"role_name": "se-prod-openrouter-llm-connect",
|
||||
"token_ttl": "15m",
|
||||
"token_max_ttl": "30m",
|
||||
"secret_id_ttl": "15m",
|
||||
"secret_id_num_uses": 1,
|
||||
"token_num_uses": 8
|
||||
},
|
||||
"delivery_config": {
|
||||
"exec_owner": {
|
||||
"status": "configured",
|
||||
"owner": "intelligence-radar-key-check",
|
||||
"command": [
|
||||
"/usr/bin/python3.12",
|
||||
"-I",
|
||||
"-B",
|
||||
"/home/worsch/.local/share/secrets-engine/recipients/openrouter-key-check-dc1569f63ef7/openrouter_key_check.py"
|
||||
],
|
||||
"cwd": "/run/user/1000/secrets-engine-openrouter-check",
|
||||
"environment": {
|
||||
"LANG": "C.UTF-8"
|
||||
},
|
||||
"files": {
|
||||
"/usr/bin/python3.12": {
|
||||
"sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f",
|
||||
"private": false
|
||||
},
|
||||
"/home/worsch/.local/share/secrets-engine/recipients/openrouter-key-check-dc1569f63ef7/openrouter_key_check.py": {
|
||||
"sha256": "dc1569f63ef74d73f0a735548c0573db2a1493f7ffc86945f52d0be9b27a3253",
|
||||
"private": true
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"auth_capability": {},
|
||||
"workload_delivery": [
|
||||
{
|
||||
"mode": "external-secrets",
|
||||
"owner": "railiance-platform + llm-connect"
|
||||
}
|
||||
]
|
||||
},
|
||||
"human_control": true
|
||||
}
|
||||
}
|
||||
32
docs/evidence/2026-09-14-openrouter-recipient-install.json
Normal file
32
docs/evidence/2026-09-14-openrouter-recipient-install.json
Normal file
|
|
@ -0,0 +1,32 @@
|
|||
{
|
||||
"status": "recipient_installed_pending_admission",
|
||||
"owner_digest": "22393c7e751e458fa64bb24305ee66a26bbe3993c5aba03ae1fc1a488e777b42",
|
||||
"script_sha256": "dc1569f63ef74d73f0a735548c0573db2a1493f7ffc86945f52d0be9b27a3253",
|
||||
"binding": {
|
||||
"status": "configured",
|
||||
"owner": "intelligence-radar-key-check",
|
||||
"command": [
|
||||
"/usr/bin/python3.12",
|
||||
"-I",
|
||||
"-B",
|
||||
"/home/worsch/.local/share/secrets-engine/recipients/openrouter-key-check-dc1569f63ef7/openrouter_key_check.py"
|
||||
],
|
||||
"cwd": "/run/user/1000/secrets-engine-openrouter-check",
|
||||
"environment": {
|
||||
"LANG": "C.UTF-8"
|
||||
},
|
||||
"files": {
|
||||
"/usr/bin/python3.12": {
|
||||
"sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f",
|
||||
"private": false
|
||||
},
|
||||
"/home/worsch/.local/share/secrets-engine/recipients/openrouter-key-check-dc1569f63ef7/openrouter_key_check.py": {
|
||||
"sha256": "dc1569f63ef74d73f0a735548c0573db2a1493f7ffc86945f52d0be9b27a3253",
|
||||
"private": true
|
||||
}
|
||||
}
|
||||
},
|
||||
"credential_values_read": false,
|
||||
"active_catalog_changed": false,
|
||||
"runtime_trust": "system Python/stdlib maintained by root; executable and script pinned; -I -B isolates Python configuration"
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue