Close GLAS-WP-0002-T02: live OpenBao verification succeeded for real

ops-mason built the real AppRole/policy/KV path infrastructure, the
founder completed provisioning, and a real task ran through
rein-openweights with OPENROUTER_API_KEY explicitly unset -- real
AppRole login, real KV v2 read, real OpenRouter call, real commit. Full
build record (including two real bugs found and fixed along the way)
in ops-mason/plans/rein-openweights-openrouter-approle.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

workplans/GLAS-WP-0002-observability-and-composability-followups.md

@@ -60,17 +60,39 @@ vault round trip actually works end to end. Coordinate with
 `rein-openweights` directly; this task's outcome should be recorded in
 both repos.
 
-**Blocked (checked 2026-07-26):** `bao token lookup` from this
+**Done (2026-07-27).** The blocker got its own builder: `ops-mason`
-workstation returns `403 permission denied` — no usable vault session
+(chartered specifically for this class of problem — see its `INTENT.md`)
-here. Provisioning a new AppRole (`auth/approle/role/...`) and a KV
+ran the full construction-plan → review → executive-summary → approval →
-secret for `rein-openweights`, mirroring `rein-aharness`'s `binky-mail`
+build pipeline for real (`ops-mason/plans/rein-openweights-openrouter-approle.md`),
-lane, needs vault-admin access this session doesn't have. Needs the
+against real OpenBao (founder logged in via `bao login -method=oidc
-operator to provision the AppRole (or provide an ambient token with
+-path=netkingdom role=platform-admin`, after the bare `-method=oidc`
-enough privilege) before this can be exercised for real.
+default 403'd against the wrong mount path).
+
+Real infrastructure now live: `reins/` KV v2 mount, policy
+`workload-kv-read-rein-openweights-openrouter`, AppRole
+`rein-openweights`, role_id/secret_id delivered to
+`~/.local/rein-openweights/approle/`. Founder completed
+`paste_once_provision` through ops-warden's desk. Catalog entry
+`rein-openweights-openrouter-approle` is `active` in `ops-warden`.
+
+**Live verification, for real:** ran a task through `rein-openweights`
+with `OPENROUTER_API_KEY` explicitly unset and
+`REIN_OPENWEIGHTS_APPROLE_DIR` pointed at the delivered credential —
+real AppRole login, real KV v2 read, real OpenRouter API call, real
+2-turn tool-calling loop, real commit
+(`e30d520c79a3493aeea5e8ea4d5ec331512b781d`). The vault round trip is
+what ran, not the env-var short-circuit.
+
+Two real bugs surfaced and were fixed at the root cause along the way
+(not this repo's code — `ops-mason`'s and `ops-warden`'s): a KV v2
+policy path shape bug (`ops_mason/executor.py::_policy_hcl` was writing
+the bare KV-v1-shaped path, which silently denies everything on a v2
+mount) and a missing `platform-admin` policy entry for the brand-new
+`reins/` mount. Full account in `ops-mason`'s plan file section 7.
 
 ```task
 id: GLAS-WP-0002-T02
-status: wait
+status: done
 priority: medium
 state_hub_task_id: "74b4f35b-9cdd-4228-aeed-e0eec458c0bf"
 ```