Align OpenRouter lane selector

credential-change-requests/CCR-2026-0003-llm-connect-openrouter-api-key.yaml

@@ -5,7 +5,7 @@ request_type: workload-kv-read
 title: llm-connect OpenRouter provider key lane
 status: proposed
 created: '2026-06-27'
-updated: '2026-06-30'
+updated: '2026-07-01'
 requester:
   agent: ops-warden
   message_id: fe5b1696-8956-4bd5-9d6f-dbde1901a076
@@ -17,6 +17,13 @@ review:
   - platform-operator
   - activity-core-owner
   comments:
+  - at: '2026-07-01T22:12:00+00:00'
+    reviewer: codex
+    decision: selector_aligned_to_ops_warden_catalog
+    comment: ops-warden registry/routing/catalog.yaml and wiki/playbooks/openrouter-llm-connect.md
+      define openrouter-llm-connect as the draft OpenRouter/llm-connect route.
+      Updated CCR access_frontdoor metadata to use that canonical selector; approval
+      and live apply remain pending.
   - at: '2026-06-29T22:53:03+00:00'
     reviewer: codex
     decision: metadata_review_binding_confirmed_pending_owner_approval
@@ -56,9 +63,9 @@ openbao:
     ttl: 15m
 access_frontdoor:
   type: ops-warden
-  catalog_id: llm-connect-openrouter-api-key
+  catalog_id: openrouter-llm-connect
   selector: llm-connect OpenRouter API key
-  command: warden access llm-connect-openrouter-api-key --fetch OPENROUTER_API_KEY
+  command: warden access openrouter-llm-connect --fetch OPENROUTER_API_KEY
   resolvable: false
   readiness: template
   activation: draft-until-ccr-verified

workplans/RAILIANCE-WP-0010-llm-connect-openrouter-provider-key-lane.md

@@ -10,7 +10,7 @@ topic_slug: railiance
 planning_priority: high
 planning_order: 10
 created: "2026-06-29"
-updated: "2026-06-30"
+updated: "2026-07-01"
 depends_on_workplans:
   - RAIL-PL-WP-0002
   - RAILIANCE-WP-0004
@@ -48,9 +48,10 @@ non-secret CCR:
 
 - `credential-change-requests/CCR-2026-0003-llm-connect-openrouter-api-key.yaml`
 
-The message called the sibling lane `openrouter-llm-connect`; the CCR uses
-catalog id `llm-connect-openrouter-api-key`. Resolve that naming with
-ops-warden before activation so automated callers have one stable selector.
+Ops-warden already uses `openrouter-llm-connect` as the canonical draft
+catalog id in its routing catalog and playbook. This workplan and
+`CCR-2026-0003` now align to that selector so automated callers have
+one stable route name before activation.
 
 ## INTENT Fit
 
@@ -75,7 +76,7 @@ The plan supports these `INTENT.md` principles:
 | Item | Proposed value |
 | --- | --- |
 | CCR | `CCR-2026-0003` |
-| ops-warden catalog id | `llm-connect-openrouter-api-key` pending naming confirmation |
+| ops-warden catalog id | `openrouter-llm-connect` |
 | Tenant/org | `activity-core` |
 | Workload/project | `llm-connect` |
 | KV mount | `platform` |
@@ -88,7 +89,7 @@ The plan supports these `INTENT.md` principles:
 | OpenBao auth service account | `external-secrets` |
 | OpenBao auth namespace | `external-secrets` |
 | Delivery surface | Future activity-core ExternalSecret to Secret `llm-connect-provider-secrets` |
-| ops-warden command | `warden access llm-connect-openrouter-api-key --fetch OPENROUTER_API_KEY` |
+| ops-warden command | `warden access openrouter-llm-connect --fetch OPENROUTER_API_KEY` |
 
 ## Tasks
 
@@ -108,9 +109,8 @@ Acceptance:
 
 - The activity-core owner confirms that llm-connect should receive
   `OPENROUTER_API_KEY` through this platform lane.
-- ops-warden and railiance-platform agree on one stable catalog id/selector,
-  reconciling `openrouter-llm-connect` with
-  `llm-connect-openrouter-api-key`.
+- ops-warden and railiance-platform agree on one stable catalog id/selector:
+  `openrouter-llm-connect`.
 - Review comments and approval state are recorded in the CCR without secret
   values.
 - The lane remains clearly platform-owned secret custody, not llm-connect model
@@ -124,6 +124,13 @@ Acceptance:
 `progress`. OpenBao public seal status now reports `sealed=false`; the prior
 sealed message is no longer the active blocker.
 
+**2026-07-01:** Resolved the selector naming ambiguity in favor of ops-warden
+canon. The local ops-warden routing catalog and playbook define
+`openrouter-llm-connect` as the draft OpenRouter/llm-connect route, so
+`CCR-2026-0003` and this workplan now use that catalog id and command
+shape. T01 remains `progress` until activity-core/platform approval moves
+the CCR out of `proposed`.
+
 ## T02 - Confirm Kubernetes auth and External Secrets binding
 
 ```task