coulomb/ops-warden
Archived
2
0
Fork 0
generated from coulomb/repo-seed
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Promote issue-core-ingestion-api-key and openrouter-llm-connect lanes to active

Browse Source 
RAILIANCE-WP-0009 T06 / RAILIANCE-WP-0010 T06 (CCR-2026-0002, CCR-2026-0003):
both OpenBao KV paths are live, ESO delivers the Secrets in cluster, and
positive/negative access verification is audit-logged. Catalog entries gain
concrete zero-placeholder handoffs (exec_capable, resolvable); draft tables
and playbook gates updated; routing tests repointed to still-draft lanes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Bernd Worsch
2026-07-02 20:48:39 +02:00
parent 833c36e20a
commit 364eb7dfe1
6 changed files with 86 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
wiki/playbooks/openrouter-llm-connect.md
View File

@@ -1,8 +1,8 @@
# OpenRouter API Key — llm-connect in activity-core
Date: 2026-06-24
Workplan: WARDEN-WP-0012 T4
Catalog: `openrouter-llm-connect` (draft until OpenBao path ships)
Date: 2026-06-24 (promoted active 2026-07-02)
Workplan: WARDEN-WP-0012 T4 · RAILIANCE-WP-0010 / CCR-2026-0003
Catalog: `openrouter-llm-connect` (**active** — OpenBao path live, ESO delivering)
Pointer playbook for LLM provider credentials consumed by `llm-connect` in the
`activity-core` namespace. ops-warden issues SSH certs only — API keys are an
@@ -25,16 +25,14 @@ OpenBao → Kubernetes Secret action owned by `railiance-platform` and
```bash
warden route show openbao-api-key --json
warden route show openrouter-llm-connect --json # after promotion
warden route show openrouter-llm-connect --json
```
`OPENROUTER_API_KEY` must not appear in Git, State Hub, workplans, logs, or chat.
---
## Expected custody shape
Documented platform path convention (coordinate before writing secrets):
## Custody shape (live since 2026-07-02)
```text
platform/workloads/activity-core/llm-connect/llm-connect-provider-secrets
@@ -42,12 +40,19 @@ platform/workloads/activity-core/llm-connect/llm-connect-provider-secrets
Property name: `OPENROUTER_API_KEY`
Until the OpenBao path is provisioned, operators may create the K8s Secret
directly for pilot smoke (`llm-connect` README) — that is a bootstrap bridge,
not the long-term custody model.
Delivery: `ExternalSecret activity-core/llm-connect-provider-secrets`
(ClusterSecretStore `openbao-activity-core`, read policy
`workload-kv-read-llm-connect-provider-secrets`, k8s auth role
`external-secrets-activity-core`) syncs to Secret
`llm-connect-provider-secrets`; the llm-connect Deployment consumes it.
Positive + negative access verified with OpenBao audit evidence
(RAILIANCE-WP-0010 T05). Lifecycle (deactivate/rotate/compromise):
`railiance-platform/docs/credential-lane-lifecycle-runbook.md`.
**Promotion gate:** catalog entry stays `status: draft` until the OpenBao path
exists and ESO (or approved equivalent) delivers the Secret in cluster.
**Promotion gate (met 2026-07-02):** the OpenBao path exists and ESO delivers
the Secret in cluster. The earlier manually created bootstrap Secret has been
taken over by ESO on the CoulombCore cluster; the railiance01 k3s llm-connect
instance still uses its bootstrap Secret (separate migration, not this lane).
---