Bind native OpenRouter approval to custody and delivery inputs

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

tests/test_decision_replay.py

@@ -3,7 +3,8 @@ import copy
 import json
 from datetime import datetime, timezone
 from pathlib import Path
-from types import SimpleNamespace
+from secrets_engine.catalog import validate_entry
+from tests.test_catalog import VALID
 
 import pytest
 
@@ -122,7 +123,7 @@ def test_real_expired_allow_refused():
 
 
 def test_request_builder_tenant_boundary():
-    entry = SimpleNamespace(id="glas-primary", stage="prod")
+    entry = validate_entry({**VALID, "id": "glas-primary", "stage": "prod"})
     args = dict(subject_id="secrets-engine", subject_type="service", purpose="rotation")
     request = build_action_request(entry, "rotate", **args)
     assert request["tenant"] == REQUEST_TENANT