# NON-SECRET catalog metadata derived from railiance-platform CCR-2026-0003.
id: openrouter-llm-connect
kind: kv
org: coulomb
repo: llm-connect
stage: prod
description: >-
  OpenRouter provider credential used by llm-connect for activity-core. The
  catalog does not generalize this key to other OpenRouter consumers.

mount: platform
path: workloads/activity-core/llm-connect/llm-connect-provider-secrets
mount_management: existing
fields:
  - OPENROUTER_API_KEY

consumers:
  - name: llm-connect-activity-core
    auth: kubernetes
    claim: serviceaccount:external-secrets/external-secrets
    purpose: sync llm-connect-provider-secrets for the activity-core deployment
  - name: secrets-engine-operator-exec
    auth: approle
    claim: catalog:openrouter-llm-connect
    purpose: approved llm-connect smoke in a child process and non-secret verification

workload_delivery:
  - mode: external-secrets
    owner: railiance-platform + llm-connect

delivery_modes: [exec-env, read-check]
delivery_auth:
  method: approle
  management: engine
  policy_name: se-prod-openrouter-llm-connect
  role_name: se-prod-openrouter-llm-connect
  token_ttl: 15m
  token_max_ttl: 30m
  secret_id_ttl: 15m
  secret_id_num_uses: 1
  token_num_uses: 8

approval:
  model: ccr
  decision_ref: CCR-2026-0003
  notes: >-
    CCR-2026-0003 approves the existing workload lane. A live native AppRole
    apply remains gated by SECRETS-WP-0006-T05 review and operator approval.

verification:
  positive: approved delivery AppRole can read OPENROUTER_API_KEY without printing it
  negative: unrelated token is denied on platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets

risk:
  classification: high
  notes: provider key can incur spend and remains valid outside OpenBao until revoked at OpenRouter

rotation:
  owner: railiance-platform + llm-connect provider operator
  expectation: >-
    Mint a replacement at OpenRouter, update every live cluster copy, wait for
    ESO refresh, restart llm-connect, verify, and revoke the old provider key.
  ttl: provider-defined

deactivation:
  owner: railiance-platform + llm-connect
  expectation: >-
    Disable the front door and workload read path, remove materialized Secrets,
    stop consumers, and revoke the provider key at OpenRouter.

audit:
  evidence: CCR id, actor, exact path, field name, provider key identifier if non-secret, timestamps, and pass/fail only