{
  "apply": {
    "id": "decision:36b30ad115bc46ba",
    "contract_version": "flex-auth.decision-record.v1",
    "effect": "allow",
    "reason": "catalog_lane_policy_matched",
    "matched_policy_version": "v2",
    "matched_rule": "catalog_lane_policy_matched",
    "resource": {
      "id": "catalog:openrouter-llm-connect",
      "type": "secret-catalog-lane",
      "system": "secrets-engine",
      "tenant": "tenant:platform",
      "attributes": {
        "auth_targets": [
          "se-prod-openrouter-llm-connect"
        ],
        "fields": [],
        "policy_targets": [
          "se-prod-openrouter-llm-connect"
        ],
        "stage": "prod"
      }
    },
    "subject": {
      "id": "secrets-engine",
      "type": "service",
      "tenant": "tenant:platform",
      "attributes": {
        "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
        "display_name": "secrets-engine service principal",
        "groups": [
          "group:secrets-engine-lane-operators"
        ],
        "organization_relation": "ServiceProvider",
        "roles": [
          "Operator"
        ]
      }
    },
    "binding": {
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service",
        "tenant": "tenant:platform",
        "attributes": {
          "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
          "display_name": "secrets-engine service principal",
          "groups": [
            "group:secrets-engine-lane-operators"
          ],
          "organization_relation": "ServiceProvider",
          "roles": [
            "Operator"
          ]
        }
      },
      "action": "apply",
      "resource": {
        "id": "catalog:openrouter-llm-connect",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "tenant": "tenant:platform",
        "attributes": {
          "auth_targets": [
            "se-prod-openrouter-llm-connect"
          ],
          "fields": [],
          "policy_targets": [
            "se-prod-openrouter-llm-connect"
          ],
          "stage": "prod"
        }
      },
      "context": {
        "catalog_target": {
          "auth_capability": {},
          "consumers": [
            {
              "auth": "kubernetes",
              "claim": "serviceaccount:external-secrets/external-secrets",
              "name": "llm-connect-activity-core",
              "purpose": "sync llm-connect-provider-secrets for the activity-core deployment"
            },
            {
              "auth": "approle",
              "claim": "catalog:openrouter-llm-connect",
              "name": "intelligence-radar-key-check",
              "purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference"
            }
          ],
          "delivery_auth": {
            "management": "engine",
            "method": "approle",
            "policy_name": "se-prod-openrouter-llm-connect",
            "role_name": "se-prod-openrouter-llm-connect",
            "secret_id_num_uses": 1,
            "secret_id_ttl": "15m",
            "token_max_ttl": "30m",
            "token_num_uses": 8,
            "token_ttl": "15m"
          },
          "delivery_config": {
            "exec_owner": {
              "command": [
                "/usr/bin/python3.12",
                "-I",
                "-B",
                "/home/worsch/.local/share/secrets-engine/recipients/openrouter-key-check-dc1569f63ef7/openrouter_key_check.py"
              ],
              "cwd": "/run/user/1000/secrets-engine-openrouter-check",
              "environment": {
                "LANG": "C.UTF-8"
              },
              "files": {
                "/home/worsch/.local/share/secrets-engine/recipients/openrouter-key-check-dc1569f63ef7/openrouter_key_check.py": {
                  "private": true,
                  "sha256": "dc1569f63ef74d73f0a735548c0573db2a1493f7ffc86945f52d0be9b27a3253"
                },
                "/usr/bin/python3.12": {
                  "private": false,
                  "sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f"
                }
              },
              "owner": "intelligence-radar-key-check",
              "status": "configured"
            }
          },
          "delivery_modes": [
            "exec-env",
            "read-check"
          ],
          "fields": [
            "OPENROUTER_API_KEY"
          ],
          "kind": "kv",
          "mount": "platform",
          "mount_management": "existing",
          "org": "coulomb",
          "path": "workloads/activity-core/llm-connect/llm-connect-provider-secrets",
          "repo": "llm-connect",
          "workload_delivery": [
            {
              "mode": "external-secrets",
              "owner": "railiance-platform + llm-connect"
            }
          ]
        },
        "human_control": true,
        "purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference"
      },
      "request_digest": "sha256:933427642c58c54f65dd4781b8e4c8e2f358eb96497ae35870fff4bd593d2b84",
      "submitted_request_digest": "sha256:c2f6dcfd5c03a3b0288837b6a54579d9ee84ae853bb0884220cc22af46ad0a12"
    },
    "lifetime": {
      "kind": "ttl",
      "ttl": "15m",
      "not_before": "2026-09-14T00:24:35Z",
      "expires_at": "2026-09-14T00:39:35Z"
    },
    "diagnostics": {
      "action": "apply",
      "matched_relationship": "",
      "policy_package": "secrets-engine.catalog-lane.lifecycle",
      "policy_status": "ready",
      "registry_overrode": [],
      "registry_resource": false,
      "registry_subject": true
    },
    "provenance": {
      "evaluator": "flex-auth/local",
      "mode": "standalone",
      "policy_package": "secrets-engine.catalog-lane.lifecycle",
      "policy_version": "v2",
      "policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4",
      "registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
      "input_claim_digests": {
        "context": "sha256:29e8c6101ff870dad53f1bcd1eab86b27c5f6cd5eb25a91af14ae1781abb3b32"
      },
      "decision_time": "2026-09-14T00:24:35Z"
    },
    "caring": {
      "profile": "caring-0.4.0-rc2",
      "conformance_findings": [
        {
          "code": "CARING-DESCRIPTOR-MISSING",
          "severity": "warning",
          "message": "no CARING descriptor matched the request",
          "fields": [
            "caring_context"
          ]
        }
      ]
    }
  },
  "verify": {
    "id": "decision:d28c93cde5260374",
    "contract_version": "flex-auth.decision-record.v1",
    "effect": "allow",
    "reason": "catalog_lane_policy_matched",
    "matched_policy_version": "v2",
    "matched_rule": "catalog_lane_policy_matched",
    "resource": {
      "id": "catalog:openrouter-llm-connect",
      "type": "secret-catalog-lane",
      "system": "secrets-engine",
      "tenant": "tenant:platform",
      "attributes": {
        "auth_targets": [
          "se-prod-openrouter-llm-connect"
        ],
        "fields": [
          "OPENROUTER_API_KEY"
        ],
        "policy_targets": [
          "se-prod-openrouter-llm-connect"
        ],
        "stage": "prod"
      }
    },
    "subject": {
      "id": "secrets-engine",
      "type": "service",
      "tenant": "tenant:platform",
      "attributes": {
        "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
        "display_name": "secrets-engine service principal",
        "groups": [
          "group:secrets-engine-lane-operators"
        ],
        "organization_relation": "ServiceProvider",
        "roles": [
          "Operator"
        ]
      }
    },
    "binding": {
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service",
        "tenant": "tenant:platform",
        "attributes": {
          "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
          "display_name": "secrets-engine service principal",
          "groups": [
            "group:secrets-engine-lane-operators"
          ],
          "organization_relation": "ServiceProvider",
          "roles": [
            "Operator"
          ]
        }
      },
      "action": "verify",
      "resource": {
        "id": "catalog:openrouter-llm-connect",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "tenant": "tenant:platform",
        "attributes": {
          "auth_targets": [
            "se-prod-openrouter-llm-connect"
          ],
          "fields": [
            "OPENROUTER_API_KEY"
          ],
          "policy_targets": [
            "se-prod-openrouter-llm-connect"
          ],
          "stage": "prod"
        }
      },
      "context": {
        "catalog_target": {
          "auth_capability": {},
          "consumers": [
            {
              "auth": "kubernetes",
              "claim": "serviceaccount:external-secrets/external-secrets",
              "name": "llm-connect-activity-core",
              "purpose": "sync llm-connect-provider-secrets for the activity-core deployment"
            },
            {
              "auth": "approle",
              "claim": "catalog:openrouter-llm-connect",
              "name": "intelligence-radar-key-check",
              "purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference"
            }
          ],
          "delivery_auth": {
            "management": "engine",
            "method": "approle",
            "policy_name": "se-prod-openrouter-llm-connect",
            "role_name": "se-prod-openrouter-llm-connect",
            "secret_id_num_uses": 1,
            "secret_id_ttl": "15m",
            "token_max_ttl": "30m",
            "token_num_uses": 8,
            "token_ttl": "15m"
          },
          "delivery_config": {
            "exec_owner": {
              "command": [
                "/usr/bin/python3.12",
                "-I",
                "-B",
                "/home/worsch/.local/share/secrets-engine/recipients/openrouter-key-check-dc1569f63ef7/openrouter_key_check.py"
              ],
              "cwd": "/run/user/1000/secrets-engine-openrouter-check",
              "environment": {
                "LANG": "C.UTF-8"
              },
              "files": {
                "/home/worsch/.local/share/secrets-engine/recipients/openrouter-key-check-dc1569f63ef7/openrouter_key_check.py": {
                  "private": true,
                  "sha256": "dc1569f63ef74d73f0a735548c0573db2a1493f7ffc86945f52d0be9b27a3253"
                },
                "/usr/bin/python3.12": {
                  "private": false,
                  "sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f"
                }
              },
              "owner": "intelligence-radar-key-check",
              "status": "configured"
            }
          },
          "delivery_modes": [
            "exec-env",
            "read-check"
          ],
          "fields": [
            "OPENROUTER_API_KEY"
          ],
          "kind": "kv",
          "mount": "platform",
          "mount_management": "existing",
          "org": "coulomb",
          "path": "workloads/activity-core/llm-connect/llm-connect-provider-secrets",
          "repo": "llm-connect",
          "workload_delivery": [
            {
              "mode": "external-secrets",
              "owner": "railiance-platform + llm-connect"
            }
          ]
        },
        "human_control": true,
        "purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference"
      },
      "request_digest": "sha256:9e36cdbf3890cc5a7e550fd57191f9c0f2a6b2180909aac302aa3b999e7e6b25",
      "submitted_request_digest": "sha256:2509fb7f53caad32ba92e3cdc89cf965fc761b78707c9efee6beb4a59353c289"
    },
    "lifetime": {
      "kind": "ttl",
      "ttl": "15m",
      "not_before": "2026-09-14T00:24:35Z",
      "expires_at": "2026-09-14T00:39:35Z"
    },
    "diagnostics": {
      "action": "verify",
      "matched_relationship": "",
      "policy_package": "secrets-engine.catalog-lane.lifecycle",
      "policy_status": "ready",
      "registry_overrode": [],
      "registry_resource": false,
      "registry_subject": true
    },
    "provenance": {
      "evaluator": "flex-auth/local",
      "mode": "standalone",
      "policy_package": "secrets-engine.catalog-lane.lifecycle",
      "policy_version": "v2",
      "policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4",
      "registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
      "input_claim_digests": {
        "context": "sha256:29e8c6101ff870dad53f1bcd1eab86b27c5f6cd5eb25a91af14ae1781abb3b32"
      },
      "decision_time": "2026-09-14T00:24:35Z"
    },
    "caring": {
      "profile": "caring-0.4.0-rc2",
      "conformance_findings": [
        {
          "code": "CARING-DESCRIPTOR-MISSING",
          "severity": "warning",
          "message": "no CARING descriptor matched the request",
          "fields": [
            "caring_context"
          ]
        }
      ]
    }
  },
  "exec": {
    "id": "decision:2671f0f24ab8a2e4",
    "contract_version": "flex-auth.decision-record.v1",
    "effect": "allow",
    "reason": "catalog_lane_policy_matched",
    "matched_policy_version": "v2",
    "matched_rule": "catalog_lane_policy_matched",
    "resource": {
      "id": "catalog:openrouter-llm-connect",
      "type": "secret-catalog-lane",
      "system": "secrets-engine",
      "tenant": "tenant:platform",
      "attributes": {
        "auth_targets": [
          "se-prod-openrouter-llm-connect"
        ],
        "fields": [
          "OPENROUTER_API_KEY"
        ],
        "policy_targets": [
          "se-prod-openrouter-llm-connect"
        ],
        "stage": "prod"
      }
    },
    "subject": {
      "id": "secrets-engine",
      "type": "service",
      "tenant": "tenant:platform",
      "attributes": {
        "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
        "display_name": "secrets-engine service principal",
        "groups": [
          "group:secrets-engine-lane-operators"
        ],
        "organization_relation": "ServiceProvider",
        "roles": [
          "Operator"
        ]
      }
    },
    "binding": {
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service",
        "tenant": "tenant:platform",
        "attributes": {
          "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
          "display_name": "secrets-engine service principal",
          "groups": [
            "group:secrets-engine-lane-operators"
          ],
          "organization_relation": "ServiceProvider",
          "roles": [
            "Operator"
          ]
        }
      },
      "action": "exec",
      "resource": {
        "id": "catalog:openrouter-llm-connect",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "tenant": "tenant:platform",
        "attributes": {
          "auth_targets": [
            "se-prod-openrouter-llm-connect"
          ],
          "fields": [
            "OPENROUTER_API_KEY"
          ],
          "policy_targets": [
            "se-prod-openrouter-llm-connect"
          ],
          "stage": "prod"
        }
      },
      "context": {
        "catalog_target": {
          "auth_capability": {},
          "consumers": [
            {
              "auth": "kubernetes",
              "claim": "serviceaccount:external-secrets/external-secrets",
              "name": "llm-connect-activity-core",
              "purpose": "sync llm-connect-provider-secrets for the activity-core deployment"
            },
            {
              "auth": "approle",
              "claim": "catalog:openrouter-llm-connect",
              "name": "intelligence-radar-key-check",
              "purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference"
            }
          ],
          "delivery_auth": {
            "management": "engine",
            "method": "approle",
            "policy_name": "se-prod-openrouter-llm-connect",
            "role_name": "se-prod-openrouter-llm-connect",
            "secret_id_num_uses": 1,
            "secret_id_ttl": "15m",
            "token_max_ttl": "30m",
            "token_num_uses": 8,
            "token_ttl": "15m"
          },
          "delivery_config": {
            "exec_owner": {
              "command": [
                "/usr/bin/python3.12",
                "-I",
                "-B",
                "/home/worsch/.local/share/secrets-engine/recipients/openrouter-key-check-dc1569f63ef7/openrouter_key_check.py"
              ],
              "cwd": "/run/user/1000/secrets-engine-openrouter-check",
              "environment": {
                "LANG": "C.UTF-8"
              },
              "files": {
                "/home/worsch/.local/share/secrets-engine/recipients/openrouter-key-check-dc1569f63ef7/openrouter_key_check.py": {
                  "private": true,
                  "sha256": "dc1569f63ef74d73f0a735548c0573db2a1493f7ffc86945f52d0be9b27a3253"
                },
                "/usr/bin/python3.12": {
                  "private": false,
                  "sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f"
                }
              },
              "owner": "intelligence-radar-key-check",
              "status": "configured"
            }
          },
          "delivery_modes": [
            "exec-env",
            "read-check"
          ],
          "fields": [
            "OPENROUTER_API_KEY"
          ],
          "kind": "kv",
          "mount": "platform",
          "mount_management": "existing",
          "org": "coulomb",
          "path": "workloads/activity-core/llm-connect/llm-connect-provider-secrets",
          "repo": "llm-connect",
          "workload_delivery": [
            {
              "mode": "external-secrets",
              "owner": "railiance-platform + llm-connect"
            }
          ]
        },
        "exec_owner_sha256": "22393c7e751e458fa64bb24305ee66a26bbe3993c5aba03ae1fc1a488e777b42",
        "human_control": true,
        "purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference"
      },
      "request_digest": "sha256:9f17812750fc8962b0fc58fc09df136850c9935a864fafa998a1c030dfb75bd9",
      "submitted_request_digest": "sha256:d6f3855a6b3f30914f0140e4542a9dbea27da47e105907080ea423a10e241371"
    },
    "lifetime": {
      "kind": "ttl",
      "ttl": "15m",
      "not_before": "2026-09-14T00:24:35Z",
      "expires_at": "2026-09-14T00:39:35Z"
    },
    "diagnostics": {
      "action": "exec",
      "matched_relationship": "",
      "policy_package": "secrets-engine.catalog-lane.lifecycle",
      "policy_status": "ready",
      "registry_overrode": [],
      "registry_resource": false,
      "registry_subject": true
    },
    "provenance": {
      "evaluator": "flex-auth/local",
      "mode": "standalone",
      "policy_package": "secrets-engine.catalog-lane.lifecycle",
      "policy_version": "v2",
      "policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4",
      "registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
      "input_claim_digests": {
        "context": "sha256:7c05dd7cf44c8df67bcdddd4db8a8bf3026f899c28e35594b72f96c9b0ca8501"
      },
      "decision_time": "2026-09-14T00:24:35Z"
    },
    "caring": {
      "profile": "caring-0.4.0-rc2",
      "conformance_findings": [
        {
          "code": "CARING-DESCRIPTOR-MISSING",
          "severity": "warning",
          "message": "no CARING descriptor matched the request",
          "fields": [
            "caring_context"
          ]
        }
      ]
    }
  }
}