Real build executed for real (MASON-WP-0001-T05, MASON-WP-0001 done 5/5)

Ran the whole approved pipeline against real OpenBao: created the reins/
KV v2 mount (after pausing for explicit founder confirmation -- a bigger
action than the executive summary's blast-radius framing disclosed),
the read-only policy, the AppRole, delivered role_id/secret_id. Caught
and fixed a real bug in the same pass: built with token_num_uses=0
(OpenBao's default = unlimited) instead of the plan's own stated 8;
fixed live and removed the executor's silently-permissive default so it
can't recur. Catalog entry proposed and merged in ops-warden (c0a50bc).

Corrected a real misreading in this repo's own INTENT.md along the way:
pointer fields (auth_method/fetch_command/rotation.steps) are normal on
non-SSH catalog entries; only a bare top-level steps:+cert_command:
pair is SSH-only -- verified against ops-warden's real entries and its
full test suite (326 tests, green).

Plan status: built. Catalog entry status: draft until the founder's
paste-once-provision and glas-harness/GLAS-WP-0002-T02's live
verification succeed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

workplans/MASON-WP-0001-foundation.md

@@ -150,20 +150,43 @@ value exists outside OpenBao. Once done, notify `glas-harness`/
 `rein-openweights` so `GLAS-WP-0002-T02`'s live OpenBao verification can
 proceed.
 
-**Phases 1-3 done, approved (2026-07-27):**
-`plans/rein-openweights-openrouter-approle.md` is now `status: approved`
-(Bernd Worsch, 2026-07-27) — `ConstructionPlan.load(...).is_approved()`
-confirmed `True` against the real file. **Blocked on phase 4 execution
-only:** no valid OpenBao session from this workstation (`bao token
-lookup` still `403`) to actually run
-`build_approle_kv_lane`/`bao policy write`/`bao write auth/approle/...`.
-Whoever has (or provisions) real `bao` access can run phase 4 directly
-against this approved plan — the gate is cleared, only the environment
-is missing.
+**Done (2026-07-27), all four phases run for real.** Founder logged in
+(`bao login -method=oidc -path=netkingdom role=platform-admin` — the
+initial bare `-method=oidc` 403'd against the wrong default mount path;
+`netkingdom` + an explicit `role=` was required, found via
+`ops-warden`'s own catalog/wiki conventions). Executed
+`build_approle_kv_lane` for real:
+
+- **Live-state discrepancy found and handled correctly, not silently:**
+  no `reins/` KV mount existed (`bao secrets list` showed only
+  `platform/`/`secret/`/`tenants/`) — a bigger action (new secrets
+  engine) than the executive summary's blast-radius framing disclosed.
+  Paused and got explicit founder confirmation before mounting, rather
+  than substituting a different path or proceeding unilaterally.
+- **Built:** `reins/` KV v2 mount, policy
+  `workload-kv-read-rein-openweights-openrouter`, AppRole
+  `rein-openweights`, role_id/secret_id delivered to
+  `~/.local/rein-openweights/approle/` (`0600`).
+- **Real bug caught and fixed, root cause and all:** built with
+  `token_num_uses=0` (OpenBao's own default = *unlimited*) instead of the
+  plan's own stated `8` — caught by comparing the live AppRole config
+  against `agent-harness-binky-mail`'s immediately after building, fixed
+  live (`bao write ... token_num_uses=8`) and in code
+  (`AppRoleKVSpec.token_num_uses` now has no default — must be passed
+  explicitly, so this can't recur silently).
+- **Catalog entry landed:** `ops-warden` commit `c0a50bc` — and while
+  writing it, corrected a real misreading in this repo's own `INTENT.md`
+  of the no-double-source rule (pointer *fields* like `auth_method`/
+  `fetch_command`/`rotation.steps` are normal on non-SSH entries; only a
+  bare top-level `steps:`+`cert_command:` pair is SSH-only) — verified
+  against `ops-warden`'s full 326-test suite, green.
+- Plan file `status: built`; catalog entry `status: draft` until the
+  founder's paste-once-provision + `GLAS-WP-0002-T02`'s live
+  verification succeed.
 
 ```task
 id: MASON-WP-0001-T05
-status: wait
+status: done
 priority: high
 state_hub_task_id: "01782608-aa5a-4f9b-a1fb-9a64f6d9c299"
 ```