Record verified Qonto AppRole bridge

plans/rapp-qonto-openbao-approle-bridge.md

@@ -3,9 +3,9 @@ id: rapp-qonto-openbao-approle-bridge
 demand_source: reef-railiance/workplans/REEF-RAILIANCE-WP-0003-T01
 consumer_repo: rapp-qonto
 credential_type: openbao-approle-kv
-status: reviewed
-approved_by: null
-approved_at: null
+status: approved
+approved_by: Bernd Worsch
+approved_at: "2026-07-27"
 created: "2026-07-27"
 updated: "2026-07-27"
 ---
@@ -143,5 +143,29 @@ object from the failed build remains.
 
 The revised phase-2 recommendation is alternative 2: use the dedicated
 AppRole bridge described above until the OpenBao/cluster boundary is unified.
-The plan is reviewed but unapproved; phase 4 must not begin without a new
-explicit approval.
+The revised plan was explicitly approved by Bernd Worsch on 2026-07-27
+(`go on`). Phase 4 may proceed.
+
+## 7. Revised build result
+
+Built and verified on 2026-07-27 through
+`ops_mason.executor.build_approle_kv_lane`:
+
+- reused policy `workload-kv-read-binky-qonto-api`, scoped to exactly
+  `tenants/binky/qonto-api`;
+- created AppRole `external-secrets-rapp-qonto` with 15-minute token TTL,
+  30-minute maximum TTL, eight token uses, and a revocable secret ID;
+- delivered the role ID and secret ID directly into Kubernetes Secret
+  `external-secrets/openbao-rapp-qonto-approle`; temporary local and remote
+  delivery files were removed;
+- created namespace-restricted
+  `ClusterSecretStore/openbao-rapp-qonto`;
+- synchronized `ExternalSecret/rapp-qonto` into
+  `Secret/rapp-qonto-runtime`.
+
+Metadata-only live verification reported the store `Valid`, the
+ExternalSecret `SecretSynced`, and exactly two keys in the derived Secret. No
+credential value was read, printed, committed, or recorded.
+
+The bridge remains transitional. Replace it with same-cluster Kubernetes
+authentication when OpenBao custody and workload placement are unified.