tegwick
7ba1b6223e
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
81 lines
2.4 KiB
JSON
81 lines
2.4 KiB
JSON
{
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "apply",
|
|
"resource": {
|
|
"id": "catalog:openrouter-llm-connect",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [
|
|
"se-prod-openrouter-llm-connect"
|
|
],
|
|
"auth_targets": [
|
|
"se-prod-openrouter-llm-connect"
|
|
]
|
|
}
|
|
},
|
|
"context": {
|
|
"purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference",
|
|
"catalog_target": {
|
|
"kind": "kv",
|
|
"org": "coulomb",
|
|
"repo": "llm-connect",
|
|
"mount": "platform",
|
|
"path": "workloads/activity-core/llm-connect/llm-connect-provider-secrets",
|
|
"fields": [
|
|
"OPENROUTER_API_KEY"
|
|
],
|
|
"mount_management": "existing",
|
|
"consumers": [
|
|
{
|
|
"name": "llm-connect-activity-core",
|
|
"auth": "kubernetes",
|
|
"claim": "serviceaccount:external-secrets/external-secrets",
|
|
"purpose": "sync llm-connect-provider-secrets for the activity-core deployment"
|
|
},
|
|
{
|
|
"name": "intelligence-radar-key-check",
|
|
"auth": "approle",
|
|
"claim": "catalog:openrouter-llm-connect",
|
|
"purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference"
|
|
}
|
|
],
|
|
"delivery_modes": [
|
|
"exec-env",
|
|
"read-check"
|
|
],
|
|
"delivery_auth": {
|
|
"method": "approle",
|
|
"management": "engine",
|
|
"policy_name": "se-prod-openrouter-llm-connect",
|
|
"role_name": "se-prod-openrouter-llm-connect",
|
|
"token_ttl": "15m",
|
|
"token_max_ttl": "30m",
|
|
"secret_id_ttl": "15m",
|
|
"secret_id_num_uses": 1,
|
|
"token_num_uses": 8
|
|
},
|
|
"delivery_config": {
|
|
"exec_owner": {
|
|
"status": "pending",
|
|
"owner": "intelligence-radar-key-check",
|
|
"reason": "Pin tools/openrouter_key_check.py and its protected Python runtime, exact argv, private cwd and fixed environment after custody-owner admission. The pending binding refuses exec before consume or secret retrieval."
|
|
}
|
|
},
|
|
"auth_capability": {},
|
|
"workload_delivery": [
|
|
{
|
|
"mode": "external-secrets",
|
|
"owner": "railiance-platform + llm-connect"
|
|
}
|
|
]
|
|
},
|
|
"human_control": true
|
|
}
|
|
}
|