coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare exact native recipient and record approval service activation
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
tegwick 2026-09-14 01:08:50 +02:00
parent 992f20f79d
commit 1f7f42b277
9 changed files with 514 additions and 62 deletions
Download patch file Download diff file Expand all files Collapse all files

28
workplans/SECRETS-WP-0010-openrouter-native-access.md
View file

@ -70,3 +70,31 @@ SECRETS-WP-0007-T04/T07 and SECRETS-WP-0006-T05/T06 remain wait; this workplan
must not close them from synthetic evidence. Keep WARDEN-WP-0039-T03 and
IR-WP-0004-T02 waiting until the native route passes. Trials require a separately
bound recipient and the existing campaign/budget reconciliation.
### T03 continuation — 2026-09-14
User explicitly requested execution of T03. Completed the independently runnable
prerequisites: Approval Engine is now deployed and restart/backup/restore verified
(APPROVAL-WP-0002-T03 done). Existing audit sender custody/ESO and KeyCape
consumer registration were already complete; neither was reprovisioned. Live
JWKS/readiness/anonymous and invalid-bearer refusal plus durable heartbeat/outbox
checks pass. See `docs/evidence/2026-09-14-approval-engine-deployment.json`.
Installed the read-only checker in the owner-private versioned local directory,
using pinned `/usr/bin/python3.12 -I -B <script>`, fixed environment and private
runtime cwd. `docs/proposals/openrouter-key-check.yaml` now has a configured
recipient; it remains outside the active catalog and does not admit key use.
Runtime trust is the system-owned Python standard library plus pinned executable
and script. The install receipt and finalized apply/verify/exec request JSONs are
under docs/evidence. No provider request or credential read was made.
Current wait: user input naming the exact authorized KeyCape operator group for
CCR-2026-0019 (asked during this continuation; not inferred from unrelated admin
roles). Then complete the scoped OIDC reader and admitted native delivery.
A separately admitted approval:create requester and real human approver flow
also remain necessary: the withdrawn approval-engine-operator convenience client
must not be restored or used to create and approve its own requests. Informed
Decision's native review flow and requester admission are dependencies, not
replaced by a service token or a seeded live approval. T03 remains open until
real approval/consume, attended OpenBao apply, key check, positive/negative
native delivery and revocation are evidenced.