Bind native OpenRouter approval to custody and delivery inputs

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

src/secrets_engine/authorization.py

@@ -6,6 +6,7 @@ policy, lifetime and approval correspondence before consumption.
 """
 from __future__ import annotations
 
+import copy
 import hashlib
 import json
 import re
@@ -102,7 +103,22 @@ def build_action_request(
                     "auth_targets": sorted(set(auth_targets)),
                 },
             },
-            "context": {"purpose": purpose},
+            "context": {
+                "purpose": purpose,
+                # Bind the actual non-secret custody/delivery specification, not
+                # just names which can be reused for a different backend target.
+                # Approval identifiers are excluded: adding the newly issued
+                # approval must not change its own approval-free binding.
+                "catalog_target": copy.deepcopy({
+                    name: getattr(entry, name)
+                    for name in (
+                        "kind", "org", "repo", "mount", "path", "fields",
+                        "mount_management", "consumers", "delivery_modes",
+                        "delivery_auth", "delivery_config", "auth_capability",
+                        "workload_delivery",
+                    )
+                }),
+            },
         }
     )
     if human_control_required(entry):

src/secrets_engine/plan.py

@@ -79,6 +79,9 @@ def build_plan(entry: CatalogEntry, stage: str, *, decision_id: str = "") -> Pla
                     "token_policies": policy_name,
                     "auth": "approle",
                     "token_ttl": entry.token_ttl,
+                    "token_max_ttl": entry.token_max_ttl,
+                    "secret_id_ttl": entry.secret_id_ttl,
+                    "token_num_uses": entry.token_num_uses,
                     "secret_id_num_uses": entry.secret_id_num_uses,
                 },
             ),
@@ -114,6 +117,8 @@ def build_plan(entry: CatalogEntry, stage: str, *, decision_id: str = "") -> Pla
                             "token_ttl": entry.delivery_token_ttl,
                             "token_max_ttl": entry.delivery_token_max_ttl,
                             "token_num_uses": entry.delivery_token_num_uses,
+                            "secret_id_ttl": entry.delivery_secret_id_ttl,
+                            "secret_id_num_uses": entry.delivery_secret_id_num_uses,
                         },
                     ),
                 ]