Bind native OpenRouter approval to custody and delivery inputs

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

tools/exercise_approval_identity.py

@@ -430,6 +430,21 @@ def exercise(args):
                             assert not engine.claim("synthetic-owner-delivery")["consumed"] and not backend_calls
                         else:
                             raise AssertionError("substitute recipient accepted")
+                        from dataclasses import replace
+                        for name, changed_entry in {
+                            "path": replace(owner_entry, path=owner_entry.path + "-unrelated"),
+                            "mount": replace(owner_entry, mount=owner_entry.mount + "-unrelated"),
+                            "owner": replace(owner_entry, repo=owner_entry.repo + "-unrelated"),
+                            "limits": replace(owner_entry, delivery_auth={**owner_entry.delivery_auth, "token_max_ttl": "24h"}),
+                        }.items():
+                            with patch.object(cli, "get_entry", return_value=changed_entry):
+                                try:
+                                    cli.cmd_exec(cfg, cli_args)
+                                except DecisionError:
+                                    assert not engine.claim("synthetic-owner-delivery")["consumed"] and not backend_calls
+                                else:
+                                    raise AssertionError("changed catalog target replay accepted: " + name)
+                            receipt["checks"]["catalog_" + name + "_change_refused_before_consume_backend"] = True
                         original_env = raw["delivery_config"]["exec_owner"]["environment"]["LANG"]
                         raw["delivery_config"]["exec_owner"]["environment"]["LANG"] = "C"
                         try:

tools/openrouter_key_check.py

@@ -0,0 +1,53 @@
+#!/usr/bin/env python3
+"""Pinned read-only recipient for native delivery; no model inference or retries.
+
+Review and pin this script AND its Python runtime with delivery_config.exec_owner.
+The custody owner must admit this recipient before a real key is delivered.
+"""
+import http.client
+import json
+import os
+import sys
+
+HOST = "openrouter.ai"
+PATH = "/api/v1/key"
+MAX_BODY = 65536
+
+
+def check(key, *, connection_factory=http.client.HTTPSConnection):
+    if not key or not key.isascii() or any(ord(c) <= 32 or ord(c) == 127 for c in key):
+        return {"result": "invalid_input"}
+    connection = None
+    try:
+        # HTTPSConnection verifies TLS, ignores proxy env, and follows no redirects.
+        connection = connection_factory(HOST, timeout=10)
+        connection.request("GET", PATH, headers={"Authorization": "Bearer " + key, "Accept": "application/json"})
+        response = connection.getresponse()
+        if response.status != 200:
+            return {"result": "refused", "http_status": response.status}
+        body = response.read(MAX_BODY + 1)
+        if len(body) > MAX_BODY:
+            return {"result": "invalid_response"}
+        payload = json.loads(body)
+        if not isinstance(payload, dict) or not isinstance(payload.get("data"), dict):
+            return {"result": "invalid_response"}
+        # Do not serialize any provider field: labels can contain key prefixes,
+        # error bodies can reflect credentials, and aggregate usage is not a
+        # reconciliation receipt for radar's existing campaign reservation.
+        return {"result": "authenticated", "http_status": 200}
+    except (OSError, http.client.HTTPException, ValueError):
+        return {"result": "check_failed"}
+    finally:
+        if connection is not None:
+            connection.close()
+
+
+def main():
+    key = os.environ.pop("OPENROUTER_API_KEY", "")
+    result = {"result": "invalid_arguments"} if len(sys.argv) != 1 else check(key)
+    print(json.dumps(result, sort_keys=True))
+    return 0 if result["result"] == "authenticated" else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())