secrets-engine/workplans/SECRETS-WP-0010-openrouter-native-access.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	related_workplans
SECRETS-WP-0010	workplan	Native OpenRouter access for intelligence-radar	infotech	secrets-engine	blocked	codex	netkingdom	2026-09-14	2026-09-14	IR-WP-0004 FLEX-WP-0026 SECRETS-WP-0007 SECRETS-WP-0006

Source request: intelligence-radar message cfab5355-b0f9-4868-b4e6-61ea42c54b0f. Implementation and execution procedure: docs/openrouter-native-access.md.

Bind approval to actual native custody and delivery inputs

id: SECRETS-WP-0010-T01
status: done
priority: high

Implemented context.catalog_target and complete plan limits. Changed paths, mounts, owners and token limits refuse replay before consume/backend against real local components. Existing exec-owner and human-control contracts retained. 410 repository tests and 26 component checks passed. Receipts in docs/evidence.

Prepare value-safe first recipient and exact native plan

id: SECRETS-WP-0010-T02
status: done
priority: high

Implemented the fixed read-only OpenRouter key-check script and synthetic tests. Inactive proposed overlay declares human control and a pending exact recipient; active llm-connect catalog admission is not broadened. Non-secret apply request and bounded plan are review artifacts, not runtime grants.

Admit and verify real native delivery

id: SECRETS-WP-0010-T03
status: wait
priority: high

Live residual from FLEX-WP-0026: the dedicated PDP is now current (revision 4, 11 live checks). Actual delivery still requires APPROVAL-WP-0002-T01/T03/T05 (identity/audit/service deployment), RPF-WP-0035-T06 / CCR-2026-0019 client-reader admission, exact installed recipient admission, real human approval/consume and scoped attended platform authority. No Approval Engine StatefulSet/pod/Service was present in its declared namespace at the 2026-09-14 inspection.

Then execute docs/openrouter-native-access.md steps: bounded native apply, positive/negative checks, ESO/app health, value-safe key check and session revoke. SECRETS-WP-0007-T04/T07 and SECRETS-WP-0006-T05/T06 remain wait; this workplan must not close them from synthetic evidence. Keep WARDEN-WP-0039-T03 and IR-WP-0004-T02 waiting until the native route passes. Trials require a separately bound recipient and the existing campaign/budget reconciliation.