Build audit-core AppRole lane after founder approval

reuse_policy leaves external-secrets-audit-core intact so database
leases keep working. AppRole delivered to Kubernetes; interim static
ESO token retired.

plans/audit-core-openbao-runtime-custody.md

@@ -3,9 +3,9 @@ id: audit-core-openbao-runtime-custody
 demand_source: audit-core/workplans/AUDIT-WP-0005-T02
 consumer_repo: audit-core
 credential_type: openbao-approle-kv
-status: reviewed
-approved_by: null
-approved_at: null
+status: built
+approved_by: "Bernd Worsch"
+approved_at: "2026-08-13"
 created: "2026-08-13"
 updated: "2026-08-13"
 ---
@@ -118,3 +118,29 @@ is on this identity.
 **Decision:** approve, reject, or send back to phase 1.
 Approval authorizes Mason build of structure and in-cluster sender
 minting. It does not authorize printing any secret value.
+
+## 6. Build result
+
+Built 2026-08-13 after founder approve, via
+`ops_mason.executor.build_approle_kv_lane` with `reuse_policy=True` so
+the existing `external-secrets-audit-core` policy (database creds +
+senders read) was not rewritten.
+
+- reused policy `external-secrets-audit-core`;
+- created AppRole `external-secrets-audit-core` (15m / 30m / 8 uses);
+- delivered role-id/secret-id into Secret
+  `external-secrets/openbao-audit-core-approle`; local delivery dir shredded;
+- switched ClusterSecretStores `openbao-audit-core` and
+  `openbao-audit-core-database` to AppRole auth; both `Valid`;
+- ExternalSecrets remain `SecretSynced`; receiver `/readyz` still
+  `custody_class=archive`;
+- deleted interim Secret `external-secrets/openbao-audit-core-eso-token`;
+- catalog entry `audit-core-senders` already drafted in ops-warden
+  (`warden route find "audit-core senders" --all`).
+
+Empty KV path `platform/workloads/audit-core/senders` was not written:
+mason does not put values, and senders already live in-cluster. A later
+wrap-migrate can create that path without a founder paste.
+
+No secret value was printed, committed, or logged. The 15-minute
+platform-admin child used for the build was revoked.