docs(ticket-007): plan OpenRouter env repair

TODO.md

@@ -12,12 +12,16 @@
   `publish-only`, and `pull-request` modes.
 - [x] Review [ticket-005](project/ticket-005/README.md): enable the governed
   delivery policy in Goal configuration and install the local pre-push guard.
+- [ ] Review [ticket-007](project/ticket-007/README.md): repair the existing
+  OpenRouter environment-validation NameError. State: `IN_PROGRESS /
+  VALIDATION`; classification: `SERVICE / health`.
 - [ ] After governance bootstrap, execute the sequential phases defined in
   [the refactoring plan](docs/GOAL_KORU_SUBACTOR_REFACTORING_PLAN.md), with one
   narrowly scoped ticket active at a time.
 
 > Current workflow state: `ticket-001 DONE`; `ticket-002 DONE`;
 > `ticket-003 DONE`; `ticket-004 DONE`; `ticket-005 DONE`.
+> `ticket-007 IN_PROGRESS / VALIDATION`.
 
 > **Recently shipped (manual note):** `goal all [PATHS...]` monorepo sweep —
 > runs `goal -a` in every git repo with uncommitted changes under the given

goal/project_bootstrap.py

@@ -1169,7 +1169,7 @@ def _validate_pfix_env(project_dir: Path) -> bool:
         return False
 
     # Check if key looks valid (starts with sk-or-v1-)
-    if not api_key.startswith("sk-or-v1-"):
+    if not credential.startswith("sk-or-v1-"):
         click.echo(
             click.style(
                 "\n  ⚠️ OPENROUTER_API_KEY format appears invalid!", fg="red", bold=True

project/TICKETS.md

@@ -11,4 +11,5 @@ This file indexes governance tickets without taking ownership of
 | **ticket-003** | [`README.md`](./ticket-003/README.md) | [`preprompt.md`](./ticket-003/preprompt.md) | - | [`ai-codex.md`](./ticket-003/ai-codex.md) | [`ai-codex-logs.txt`](./ticket-003/ai-codex-logs.txt) | [`changelog.md`](./ticket-003/changelog.md) |
 | **ticket-004** | [`README.md`](./ticket-004/README.md) | [`preprompt.md`](./ticket-004/preprompt.md) | - | [`ai-codex.md`](./ticket-004/ai-codex.md) | [`ai-codex-logs.txt`](./ticket-004/ai-codex-logs.txt) | [`changelog.md`](./ticket-004/changelog.md) |
 | **ticket-005** | [`README.md`](./ticket-005/README.md) | [`preprompt.md`](./ticket-005/preprompt.md) | - | [`ai-codex.md`](./ticket-005/ai-codex.md) | [`ai-codex-logs.txt`](./ticket-005/ai-codex-logs.txt) | [`changelog.md`](./ticket-005/changelog.md) |
+| **ticket-007** | [`README.md`](./ticket-007/README.md) | [`preprompt.md`](./ticket-007/preprompt.md) | - | [`ai-codex.md`](./ticket-007/ai-codex.md) | [`ai-codex-logs.txt`](./ticket-007/ai-codex-logs.txt) | [`changelog.md`](./ticket-007/changelog.md) |
 <!-- AUTO:TICKET_INDEX:END -->

project/ticket-007/README.md

@@ -0,0 +1,45 @@
+# Ticket 007: Repair OpenRouter environment validation
+
+- **ID**: ticket-007
+- **Owner**: unresolved:human
+- **Status**: IN_PROGRESS
+- **Workflow state**: VALIDATION
+- **Created**: 2026-08-05
+- **Work classification**: `SERVICE / health`
+
+## Goal and scope
+
+Repair the current-main `NameError` in `_validate_pfix_env` by validating the
+already resolved `credential` value instead of the undefined legacy
+`api_key` name. Preserve parent `.env` discovery and all credential boundaries.
+
+## Acceptance criteria
+
+- [x] AC-01: Human approves this two-file SERVICE repair.
+- [x] AC-02: `_validate_pfix_env` checks the resolved credential without logging
+  or copying its value.
+- [x] AC-03: Existing parent/blank-local environment tests pass on Python
+  3.12 and 3.13.
+- [x] AC-04: Full Goal tests have no `api_key` NameError regression.
+
+## Validation evidence
+
+- Focused `tests/test_project_bootstrap.py`: 71 passed.
+- Full local suite: 477 passed, 2 skipped, 0 failed.
+- `git diff --check`: PASS.
+
+## Participants
+
+- Human participant: unresolved; no `user-*` file was created.
+- Agent participant: [ai-codex.md](ai-codex.md).
+
+## Boundary
+
+This ticket does not change OpenRouter models, secret storage, provider calls,
+governance adoption or delivery policy. It is the minimal prerequisite for the
+already open governance adoption PR #16 to obtain a green baseline.
+
+## Session authorization
+
+The user approved ticket-007 and autonomous continuation on 2026-08-05. Merge
+still requires exact-head publication evidence.

project/ticket-007/ai-codex-logs.txt

@@ -0,0 +1,13 @@
+2026-08-05 plan preflight
+main: b84d40a36d9a2e8e5a0e6e99e10c27263ab1a049
+failure: NameError name 'api_key' is not defined in goal/project_bootstrap.py:_validate_pfix_env
+classification: SERVICE / health
+planned application files: 1
+existing regression test: tests/test_project_bootstrap.py::TestOpenRouterEnvDiscovery::test_finds_parent_env_over_blank_local_env
+implementation tests: NOT RUN; WAIT_FOR_APPROVAL
+2026-08-05 APPROVAL: user requested autonomous continuation and final branch/worktree cleanup
+transition: PLAN / WAIT_FOR_APPROVAL -> IN_PROGRESS / EDIT
+2026-08-05 tests/test_project_bootstrap.py: PASS (71 passed)
+2026-08-05 full pytest: PASS (477 passed, 2 skipped, 0 failed)
+2026-08-05 git diff --check: PASS
+transition: EDIT -> VALIDATION

project/ticket-007/ai-codex.md

@@ -0,0 +1,31 @@
+---
+participant-id: agent:codex
+participant: codex
+role: agent
+ticket: ticket-007
+---
+# Participant: codex (AI agent)
+
+## Understanding
+
+`_find_openrouter_api_key` returns `(env_file, credential)`, but
+`_validate_pfix_env` later calls `api_key.startswith`, where `api_key` is not
+defined. The existing test already proves the intended parent `.env` behavior.
+
+## Execution plan
+
+1. After approval, transition to `IN_PROGRESS / EDIT`.
+2. Replace the undefined reference with the resolved credential variable.
+3. Run the focused environment-discovery tests and the full suite.
+4. Publish a ticket-scoped PR, merge it, then refresh adoption PR #16.
+
+## Actual changes
+
+- Human approval received; ticket transitioned to `IN_PROGRESS / EDIT`.
+- Replaced the undefined legacy name with the credential already returned by
+  the existing resolver; no value is printed or persisted.
+- Focused and full test suites pass without failures.
+
+## Blockers
+
+- None during implementation.

project/ticket-007/changelog.md

@@ -0,0 +1,8 @@
+# Ticket Changelog (ticket-007)
+
+## [0.1.0] - 2026-08-05
+
+- Planned the minimal SERVICE/health repair for the current-main OpenRouter
+  environment-validation NameError.
+- Repaired the undefined-name reference without changing credential discovery.
+- Passed 71 focused and 477 full-suite tests.

project/ticket-007/intent.json

@@ -0,0 +1,25 @@
+{
+  "schema": "new-project.intent/v2",
+  "ticket": "ticket-007",
+  "summary": "Repair the OpenRouter environment validator undefined-name baseline failure",
+  "workstream": "application",
+  "allowedPaths": [
+    "goal/project_bootstrap.py",
+    "tests/test_project_bootstrap.py",
+    "project/ticket-007/**",
+    "TODO.md",
+    "project/TICKETS.md"
+  ],
+  "forbiddenPaths": [
+    ".env",
+    ".env.*",
+    ".governance/**",
+    "project/ticket-*/user-*.md",
+    "goal.yaml",
+    ".github/**"
+  ],
+  "stacks": ["python"],
+  "dependsOn": [],
+  "conflictsWith": [],
+  "integrationTicket": null
+}

project/ticket-007/preprompt.md

@@ -0,0 +1,5 @@
+# Preprompt — ticket-007
+
+Fix only the undefined-name defect in `goal/project_bootstrap.py` and retain the
+existing regression coverage in `tests/test_project_bootstrap.py`. Never print,
+persist or fabricate an OpenRouter credential. Run focused and full pytest.