Prepare exact native recipient and record approval service activation

Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
2026-09-14 01:08:50 +02:00 · 2026-09-14 01:08:50 +02:00 · 1f7f42b277
commit 1f7f42b277
parent 992f20f79d
9 changed files with 514 additions and 62 deletions
--- a/docs/evidence/2026-09-14-openrouter-final-exec-request.json
+++ b/docs/evidence/2026-09-14-openrouter-final-exec-request.json
@ -0,0 +1,103 @@
+{
+  "tenant": "tenant:platform",
+  "subject": {
+    "id": "secrets-engine",
+    "type": "service"
+  },
+  "action": "exec",
+  "resource": {
+    "id": "catalog:openrouter-llm-connect",
+    "type": "secret-catalog-lane",
+    "system": "secrets-engine",
+    "attributes": {
+      "stage": "prod",
+      "fields": [
+        "OPENROUTER_API_KEY"
+      ],
+      "policy_targets": [
+        "se-prod-openrouter-llm-connect"
+      ],
+      "auth_targets": [
+        "se-prod-openrouter-llm-connect"
+      ]
+    }
+  },
+  "context": {
+    "purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference",
+    "catalog_target": {
+      "kind": "kv",
+      "org": "coulomb",
+      "repo": "llm-connect",
+      "mount": "platform",
+      "path": "workloads/activity-core/llm-connect/llm-connect-provider-secrets",
+      "fields": [
+        "OPENROUTER_API_KEY"
+      ],
+      "mount_management": "existing",
+      "consumers": [
+        {
+          "name": "llm-connect-activity-core",
+          "auth": "kubernetes",
+          "claim": "serviceaccount:external-secrets/external-secrets",
+          "purpose": "sync llm-connect-provider-secrets for the activity-core deployment"
+        },
+        {
+          "name": "intelligence-radar-key-check",
+          "auth": "approle",
+          "claim": "catalog:openrouter-llm-connect",
+          "purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference"
+        }
+      ],
+      "delivery_modes": [
+        "exec-env",
+        "read-check"
+      ],
+      "delivery_auth": {
+        "method": "approle",
+        "management": "engine",
+        "policy_name": "se-prod-openrouter-llm-connect",
+        "role_name": "se-prod-openrouter-llm-connect",
+        "token_ttl": "15m",
+        "token_max_ttl": "30m",
+        "secret_id_ttl": "15m",
+        "secret_id_num_uses": 1,
+        "token_num_uses": 8
+      },
+      "delivery_config": {
+        "exec_owner": {
+          "status": "configured",
+          "owner": "intelligence-radar-key-check",
+          "command": [
+            "/usr/bin/python3.12",
+            "-I",
+            "-B",
+            "/home/worsch/.local/share/secrets-engine/recipients/openrouter-key-check-dc1569f63ef7/openrouter_key_check.py"
+          ],
+          "cwd": "/run/user/1000/secrets-engine-openrouter-check",
+          "environment": {
+            "LANG": "C.UTF-8"
+          },
+          "files": {
+            "/usr/bin/python3.12": {
+              "sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f",
+              "private": false
+            },
+            "/home/worsch/.local/share/secrets-engine/recipients/openrouter-key-check-dc1569f63ef7/openrouter_key_check.py": {
+              "sha256": "dc1569f63ef74d73f0a735548c0573db2a1493f7ffc86945f52d0be9b27a3253",
+              "private": true
+            }
+          }
+        }
+      },
+      "auth_capability": {},
+      "workload_delivery": [
+        {
+          "mode": "external-secrets",
+          "owner": "railiance-platform + llm-connect"
+        }
+      ]
+    },
+    "human_control": true,
+    "exec_owner_sha256": "22393c7e751e458fa64bb24305ee66a26bbe3993c5aba03ae1fc1a488e777b42"
+  }
+}