diff --git a/plans/fluid-telegram-operator-credential-lane.md b/plans/fluid-telegram-operator-credential-lane.md
index dc1605d..64084d0 100644
--- a/plans/fluid-telegram-operator-credential-lane.md
+++ b/plans/fluid-telegram-operator-credential-lane.md
@@ -3,11 +3,31 @@ id: fluid-telegram-operator-credential-lane
 demand_source: fluid-telegram/workplans/FT-WP-0002 and State Hub message 287cf897-7f47-4bcc-87d6-085f43d5f03e
 consumer_repo: fluid-telegram
 credential_type: openbao-oidc-kv-read-write
-status: reviewed
-approved_by: null
-approved_at: null
+status: approved
+approved_by: "Bernd Worsch"
+approved_at: "2026-10-09"
+approved_spec_sha256: "41a0ca2746aa93b6ee9d1ca631517d680ade95c56e7a38b75a55209ef2316b73"
 created: "2026-09-04"
 updated: "2026-10-09"
+build_spec:
+  engine: openbao-oidc-kv-read-write
+  policy_name: workload-kv-fluid-telegram-hall-of-helix-operator
+  role_name: fluid-telegram-hall-of-helix-workload-kv
+  campaign_path: platform/workloads/coulomb/fluid-telegram/hall-of-helix
+  bound_group: fluid-telegram-operators
+  allowed_redirect_uris:
+  - http://localhost:8250/oidc/callback
+  - http://127.0.0.1:8250/oidc/callback
+  - http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback
+  identity_confirmation_ref: key-cape message b2ed890f (key-cape e0b5fae); LLDAP group
+    fluid-telegram-operators exists, member tegwick (founder 2026-10-09)
+  platform_matrix_review_ref: railiance-platform docs/credential-lane-designs/fluid-telegram-operator-kv.md
+    (matrix identical, checked 2026-10-09)
+  auth_mount: netkingdom
+  token_ttl: 15m
+  token_max_ttl: 30m
+  bao_bin: bao
+  audit_log_path: /home/worsch/ops-mason/audit/build-log.jsonl
 ---
 
 # Construction plan: fluid-telegram operator credential lane
diff --git a/workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md b/workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md
index 811743c..d14276c 100644
--- a/workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md
+++ b/workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md
@@ -152,11 +152,8 @@ review (message `79570eb8-2107-4f75-b463-a45c2a70b7bf`):
 
 ```task
 id: MASON-WP-0005-T03
-status: wait
-needs_human: true
+status: done
 decision_id: e9f44beb-ad15-4285-8996-1e66d312fe59
-depends_on: [MASON-WP-0005-T01, MASON-WP-0005-T02]
-blocking_reason: "Explicit human approval of the plan (status: approved, approved_by, approved_at) after the live survey."
 priority: high
 state_hub_task_id: "48a2b4ec-8e66-5b98-b039-c17fd8d820ab"
 ```
@@ -171,13 +168,21 @@ adapter separation for explicit human approval. Only the plan's
 
 2026-10-03: human gate routed to hub decision e9f44beb-ad15-4285-8996-1e66d312fe59 (D8: ops-mason plan approvals: unclear metadata paths and the live-survey plan) by CUST-WP-0075; resolving that decision raises C-40 here.
 
+2026-10-09 done: founder approved in this session ("APPROVE
+fluid-telegram-operator-credential-lane"). The plan carries `status:
+approved`, `approved_by: "Bernd Worsch"`, `approved_at: "2026-10-09"`, the full
+`build_spec` and `approved_spec_sha256` `41a0ca27...`; the executor's approval
+gate accepts it (checked by loading the plan, no bao call). Hub decision
+`e9f44beb` also gates WP-0004-T01 and stays open until that half is answered.
+
 ## Build the approved operator lane
 
 ```task
 id: MASON-WP-0005-T04
 status: wait
 depends_on: [MASON-WP-0005-T03]
-blocking_reason: "After T03 approval."
+blocked_on: human
+blocking_reason: "Plan approved 2026-10-09. Writes are founder-applied through railiance-platform's per-path applier (RPF-WP-0035-T03, attended provisioning decision 62aa95e4), including the agent read-boundary denies; ops-mason verifies afterwards."
 priority: high
 state_hub_task_id: "0e3d1333-ffc3-5f67-8528-50a9551c4949"
 ```