From be8fab03325c92e3a3df7fc5b388376344fcaec1 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Sun, 4 Oct 2026 17:13:00 +0200
Subject: [PATCH] Record the passed IR-WP-0005 key-check delivery.

Assistant: grok
Assistant-Session: 01a106a5-fc07-78c2-b64f-8e04cea25daf
---
 .../2026-09-27-t03-native-execution.json      | 68 +++++++++++++++++++
 ...0-04-t03-native-execution-cwd-missing.json |  9 +++
 ...ECRETS-WP-0010-openrouter-native-access.md | 17 ++++-
 3 files changed, 93 insertions(+), 1 deletion(-)
 create mode 100644 docs/evidence/2026-09-27-t03-native-execution.json
 create mode 100644 docs/evidence/2026-10-04-t03-native-execution-cwd-missing.json

diff --git a/docs/evidence/2026-09-27-t03-native-execution.json b/docs/evidence/2026-09-27-t03-native-execution.json
new file mode 100644
index 0000000..2a0a788
--- /dev/null
+++ b/docs/evidence/2026-09-27-t03-native-execution.json
@@ -0,0 +1,68 @@
+{
+  "status": "passed",
+  "phase": "all_actions_completed",
+  "observed_at": "2026-10-04T15:10:05.976288+00:00",
+  "actions": [
+    {
+      "action": "apply",
+      "already_satisfied": true,
+      "limits": {
+        "token_ttl": 900,
+        "token_max_ttl": 1800,
+        "secret_id_ttl": 900,
+        "secret_id_num_uses": 1,
+        "token_num_uses": 8
+      }
+    },
+    {
+      "action": "verify",
+      "approval_id": "4e9ff881-d59f-4143-9155-929afbe8dd43",
+      "exit_code": 0,
+      "unrelated_path_denied": true,
+      "session_revocation_verified": true,
+      "revoked_token_lookup_status": 403
+    },
+    {
+      "action": "exec",
+      "approval_id": "a24e0898-b3c5-4e50-85a8-18a2c2aa229e",
+      "exit_code": 0,
+      "key_check": {
+        "http_status": 200,
+        "result": "authenticated"
+      }
+    }
+  ],
+  "health_before": {
+    "deployment": [
+      {
+        "namespace": "activity-core",
+        "name": "llm-connect",
+        "ready": 1
+      }
+    ],
+    "externalsecret": [
+      {
+        "namespace": "activity-core",
+        "name": "llm-connect-provider-secrets",
+        "ready": true
+      }
+    ]
+  },
+  "health_after": {
+    "deployment": [
+      {
+        "namespace": "activity-core",
+        "name": "llm-connect",
+        "ready": 1
+      }
+    ],
+    "externalsecret": [
+      {
+        "namespace": "activity-core",
+        "name": "llm-connect-provider-secrets",
+        "ready": true
+      }
+    ]
+  },
+  "owner_forwards_closed": true
+}
diff --git a/docs/evidence/2026-10-04-t03-native-execution-cwd-missing.json b/docs/evidence/2026-10-04-t03-native-execution-cwd-missing.json
new file mode 100644
index 0000000..c71b412
--- /dev/null
+++ b/docs/evidence/2026-10-04-t03-native-execution-cwd-missing.json
@@ -0,0 +1,9 @@
+{
+  "status": "failed",
+  "phase": "preflight",
+  "observed_at": "2026-10-04T15:00:30.907091+00:00",
+  "actions": [],
+  "failure_type": "DeliveryError",
+  "failure_location": "/home/worsch/secrets-engine/src/secrets_engine/exec_owner.py:184",
+  "owner_forwards_closed": true
+}
diff --git a/workplans/SECRETS-WP-0010-openrouter-native-access.md b/workplans/SECRETS-WP-0010-openrouter-native-access.md
index 9b745fa..85506ef 100644
--- a/workplans/SECRETS-WP-0010-openrouter-native-access.md
+++ b/workplans/SECRETS-WP-0010-openrouter-native-access.md
@@ -9,7 +9,7 @@ flavor: implementation
 owner: codex
 topic_slug: netkingdom
 created: "2026-09-14"
-updated: "2026-09-27"
+updated: "2026-10-04"
 related_workplans:
   - IR-WP-0004
   - FLEX-WP-0026
@@ -305,3 +305,18 @@ Binding digests are unchanged. Receipt paths for the new run are
 `railiance-platform/docs/evidence/2026-09-27-t03-attended-delivery.json`.
 The 2026-09-15 and 2026-09-16 receipts stay in place. flex-auth still has to
 deploy the review package before a human accept. No request was created.
+
+## Next cycle delivered — 2026-10-04
+
+The founder accepted memo version 3. The first attended delivery failed in
+preflight because `/run/user/1000/secrets-engine-openrouter-check` was absent.
+That receipt is `docs/evidence/2026-10-04-t03-native-execution-cwd-missing.json`.
+The retry passed at 2026-10-04T15:10:05Z. Canonical receipt:
+`docs/evidence/2026-09-27-t03-native-execution.json`. Apply was already
+satisfied. Verify `4e9ff881-d59f-4143-9155-929afbe8dd43` exited 0, denied the
+unrelated path, and saw revoked-token lookup HTTP 403. Exec
+`a24e0898-b3c5-4e50-85a8-18a2c2aa229e` exited 0 and the pinned key check
+returned `authenticated` with HTTP 200. `llm-connect` and its ExternalSecret
+stayed ready. No credential value is in the receipt. No provider key rotation,
+inference, or campaign reconciliation was part of this run. Apply approval
+`b5fcbfcc-ad56-456f-bc36-c823052e9917` was not consumed.