Bind native OpenRouter approval to custody and delivery inputs

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

docs/evidence/2026-09-14-openrouter-apply-request.json

@@ -0,0 +1,81 @@
+{
+  "tenant": "tenant:platform",
+  "subject": {
+    "id": "secrets-engine",
+    "type": "service"
+  },
+  "action": "apply",
+  "resource": {
+    "id": "catalog:openrouter-llm-connect",
+    "type": "secret-catalog-lane",
+    "system": "secrets-engine",
+    "attributes": {
+      "stage": "prod",
+      "fields": [],
+      "policy_targets": [
+        "se-prod-openrouter-llm-connect"
+      ],
+      "auth_targets": [
+        "se-prod-openrouter-llm-connect"
+      ]
+    }
+  },
+  "context": {
+    "purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference",
+    "catalog_target": {
+      "kind": "kv",
+      "org": "coulomb",
+      "repo": "llm-connect",
+      "mount": "platform",
+      "path": "workloads/activity-core/llm-connect/llm-connect-provider-secrets",
+      "fields": [
+        "OPENROUTER_API_KEY"
+      ],
+      "mount_management": "existing",
+      "consumers": [
+        {
+          "name": "llm-connect-activity-core",
+          "auth": "kubernetes",
+          "claim": "serviceaccount:external-secrets/external-secrets",
+          "purpose": "sync llm-connect-provider-secrets for the activity-core deployment"
+        },
+        {
+          "name": "intelligence-radar-key-check",
+          "auth": "approle",
+          "claim": "catalog:openrouter-llm-connect",
+          "purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference"
+        }
+      ],
+      "delivery_modes": [
+        "exec-env",
+        "read-check"
+      ],
+      "delivery_auth": {
+        "method": "approle",
+        "management": "engine",
+        "policy_name": "se-prod-openrouter-llm-connect",
+        "role_name": "se-prod-openrouter-llm-connect",
+        "token_ttl": "15m",
+        "token_max_ttl": "30m",
+        "secret_id_ttl": "15m",
+        "secret_id_num_uses": 1,
+        "token_num_uses": 8
+      },
+      "delivery_config": {
+        "exec_owner": {
+          "status": "pending",
+          "owner": "intelligence-radar-key-check",
+          "reason": "Pin tools/openrouter_key_check.py and its protected Python runtime, exact argv, private cwd and fixed environment after custody-owner admission. The pending binding refuses exec before consume or secret retrieval."
+        }
+      },
+      "auth_capability": {},
+      "workload_delivery": [
+        {
+          "mode": "external-secrets",
+          "owner": "railiance-platform + llm-connect"
+        }
+      ]
+    },
+    "human_control": true
+  }
+}