diff --git a/plans/rein-openweights-openrouter-approle.md b/plans/rein-openweights-openrouter-approle.md
index 7fb74aa..7889c84 100644
--- a/plans/rein-openweights-openrouter-approle.md
+++ b/plans/rein-openweights-openrouter-approle.md
@@ -3,9 +3,9 @@ id: rein-openweights-openrouter-approle
 demand_source: glas-harness/workplans/GLAS-WP-0002-T02
 consumer_repo: rein-openweights
 credential_type: openbao-approle-kv
-status: reviewed
-approved_by: null
-approved_at: null
+status: approved
+approved_by: "Bernd Worsch"
+approved_at: "2026-07-27"
 created: "2026-07-27"
 updated: "2026-07-27"
 ---
@@ -150,6 +150,11 @@ reuse in §2).
 with feedback (e.g. different TTL, different path name, or "actually
 reuse the shared lane instead").
 
+**Decision: approved as proposed** (Bernd Worsch, 2026-07-27). Ready for
+phase 4 — still blocked on a real OpenBao session existing in whatever
+environment executes the build (`bao token lookup` from this workstation
+returns `403`; unchanged since `GLAS-WP-0002-T02` first flagged it).
+
 ## 6. Build result (phase 4)
 
 <!-- Appended once MASON-WP-0001-T04/T05 execute this plan after approval. -->
diff --git a/workplans/MASON-WP-0001-foundation.md b/workplans/MASON-WP-0001-foundation.md
index 669b598..5407e6b 100644
--- a/workplans/MASON-WP-0001-foundation.md
+++ b/workplans/MASON-WP-0001-foundation.md
@@ -150,9 +150,20 @@ value exists outside OpenBao. Once done, notify `glas-harness`/
 `rein-openweights` so `GLAS-WP-0002-T02`'s live OpenBao verification can
 proceed.
 
+**Phases 1-3 done, approved (2026-07-27):**
+`plans/rein-openweights-openrouter-approle.md` is now `status: approved`
+(Bernd Worsch, 2026-07-27) — `ConstructionPlan.load(...).is_approved()`
+confirmed `True` against the real file. **Blocked on phase 4 execution
+only:** no valid OpenBao session from this workstation (`bao token
+lookup` still `403`) to actually run
+`build_approle_kv_lane`/`bao policy write`/`bao write auth/approle/...`.
+Whoever has (or provisions) real `bao` access can run phase 4 directly
+against this approved plan — the gate is cleared, only the environment
+is missing.
+
 ```task
 id: MASON-WP-0001-T05
-status: todo
+status: wait
 priority: high
 state_hub_task_id: "01782608-aa5a-4f9b-a1fb-9a64f6d9c299"
 ```