Real build executed for real (MASON-WP-0001-T05, MASON-WP-0001 done 5/5)

Ran the whole approved pipeline against real OpenBao: created the reins/
KV v2 mount (after pausing for explicit founder confirmation -- a bigger
action than the executive summary's blast-radius framing disclosed),
the read-only policy, the AppRole, delivered role_id/secret_id. Caught
and fixed a real bug in the same pass: built with token_num_uses=0
(OpenBao's default = unlimited) instead of the plan's own stated 8;
fixed live and removed the executor's silently-permissive default so it
can't recur. Catalog entry proposed and merged in ops-warden (c0a50bc).

Corrected a real misreading in this repo's own INTENT.md along the way:
pointer fields (auth_method/fetch_command/rotation.steps) are normal on
non-SSH catalog entries; only a bare top-level steps:+cert_command:
pair is SSH-only -- verified against ops-warden's real entries and its
full test suite (326 tests, green).

Plan status: built. Catalog entry status: draft until the founder's
paste-once-provision and glas-harness/GLAS-WP-0002-T02's live
verification succeed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

plans/rein-openweights-openrouter-approle.md

@@ -3,7 +3,7 @@ id: rein-openweights-openrouter-approle
 demand_source: glas-harness/workplans/GLAS-WP-0002-T02
 consumer_repo: rein-openweights
 credential_type: openbao-approle-kv
-status: approved
+status: built
 approved_by: "Bernd Worsch"
 approved_at: "2026-07-27"
 created: "2026-07-27"
@@ -157,4 +157,45 @@ returns `403`; unchanged since `GLAS-WP-0002-T02` first flagged it).
 
 ## 6. Build result (phase 4)
 
-<!-- Appended once MASON-WP-0001-T04/T05 execute this plan after approval. -->
+**Built 2026-07-27**, executed via `ops_mason.executor.build_approle_kv_lane`
+against real OpenBao (`bao login -method=oidc -path=netkingdom
+role=platform-admin`, `platform-admin` policy, ~1h token). Object names only
+below — no secret material.
+
+- **Mount created:** `reins/` (KV v2) — did not exist; `bao secrets list`
+  showed only `platform/`, `secret/`, `tenants/` at execution time. Per §2's
+  own caveat ("survey current as of what's on disk, not live OpenBao
+  ACL state"), this was a real, live discrepancy from what the approved
+  plan assumed. **Confirmed with the founder before mounting** (a new
+  top-level secrets engine is a bigger action than "one KV path" implied
+  in the executive summary's blast-radius framing) — approved to proceed
+  exactly as originally planned rather than substitute an existing mount.
+- **Policy created:** `workload-kv-read-rein-openweights-openrouter` —
+  read-only, scoped to exactly `reins/rein-openweights/openrouter`.
+- **AppRole created:** `rein-openweights` — `token_ttl=15m`,
+  `token_max_ttl=30m`, `secret_id_ttl=0`.
+- **Correction made post-build:** `token_num_uses` was built as `0`
+  (OpenBao's own default) instead of the plan's own stated `8`
+  (mirroring `agent-harness-binky-mail`) — `0` means *unlimited* in
+  OpenBao, the opposite of "bounded." Caught by checking the live
+  AppRole config against the reference lane immediately after building,
+  fixed with `bao write auth/approle/role/rein-openweights
+  token_num_uses=8` (verified). **Root cause fixed in code, not just
+  patched live:** `AppRoleKVSpec.token_num_uses` no longer has a default
+  in `ops_mason/executor.py` — it must be passed explicitly every time,
+  so this specific mistake can't recur silently on a future plan.
+- **role_id/secret_id delivered** to `~/.local/rein-openweights/approle/`
+  (mode `0600`), matching `credentials.py`'s existing
+  `REIN_OPENWEIGHTS_APPROLE_DIR` default.
+- **Catalog entry proposed and merged:** `ops-warden` commit `c0a50bc`,
+  `rein-openweights-openrouter-approle`, `status: draft` (promotes to
+  `active` once the founder completes paste-once-provision and
+  `GLAS-WP-0002-T02`'s live verification succeeds). Playbook:
+  `ops-warden/wiki/playbooks/rein-openweights-openrouter-approle.md`.
+  `ops-warden`'s full test suite (326 tests) verified green after the
+  addition.
+
+**Remaining, not part of this build:** the founder still needs to paste
+the real OpenRouter API key into `reins/rein-openweights/openrouter`
+(field `api_key`) through ops-warden's `paste_once_provision` desk —
+ops-mason built structure only, per `INTENT.md`.