coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

Promote rein-openweights-openrouter-approle: draft -> active
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Founder completed paste-once-provision; glas-harness/GLAS-WP-0002-T02's
live verification succeeded for real (AppRole login, KV v2 read, real
OpenRouter call, real commit, OPENROUTER_API_KEY unset throughout).

Two real fixes recorded along the way: platform-admin's policy needed
a new reins/* entry (every other KV mount was already listed there),
and the consumer policy itself needed the KV v2 data/+metadata/ path
shape instead of the bare KV v1 path it was originally written against.
Full account in ops-mason/plans/rein-openweights-openrouter-approle.md
section 7.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-07-27 01:51:57 +02:00
parent c0a50bc1bf
commit d961da1ef2
2 changed files with 35 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

17
registry/routing/catalog.yaml
View file

@ -544,16 +544,23 @@ entries:
wiki_ref: wiki/playbooks/rein-openweights-openrouter-approle.md#worker-checklist
canon_ref: ops-mason/plans/rein-openweights-openrouter-approle.md
reviewed: "2026-07-27"
status: draft
status: active
risk: standard
# Built 2026-07-27 by ops-mason (MASON-WP-0001-T05), approved by Bernd
# Worsch 2026-07-27. Policy + AppRole live; reins/ KV v2 mount created
# (no existing mount fit without widening scope beyond what was
# approved). token_num_uses corrected from OpenBao's own default (0 =
# unlimited) to 8, matching agent-harness-binky-mail, after the live
# config was checked post-build. Status stays draft until the founder
# completes paste-once-provision and GLAS-WP-0002-T02's live
# verification succeeds -- then promote to active.
# unlimited) to 8, matching agent-harness-binky-mail. Policy path shape
# also corrected post-build: originally written against the bare KV
# path (KV v1 shape), which silently denies everything on a v2 mount --
# fixed to grant on <mount>/data/<path> + <mount>/metadata/<path>.
# platform-admin's own policy also needed a new "reins/*" entry before
# the founder's paste-once-provision could write the value (every
# other KV mount was already listed there; this one predated the fix).
# Promoted draft -> active: founder completed paste-once-provision and
# glas-harness/GLAS-WP-0002-T02's live verification succeeded --
# real AppRole login, real KV v2 read, real OpenRouter call, real
# commit, with OPENROUTER_API_KEY unset throughout.
auth_method: "AppRole login role=rein-openweights (role_id+secret_id via REIN_OPENWEIGHTS_APPROLE_DIR)"
path_template: "reins/rein-openweights/openrouter"
fetch_command: "bao write -field=token auth/approle/login role_id=$ROLE_ID secret_id=$SECRET_ID # then bao kv get -field=api_key reins/rein-openweights/openrouter"