From 864ff4c12471eed2c9f8ff68740b2f49ef01a53e Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 27 Jul 2026 01:53:31 +0200 Subject: [PATCH] Record live-verified OpenBao path (GLAS-WP-0002-T02 closed) Real AppRole login, real KV v2 read, real OpenRouter call, real commit, with OPENROUTER_API_KEY explicitly unset. Full build record in ops-mason/plans/rein-openweights-openrouter-approle.md. Co-Authored-By: Claude Sonnet 5 --- INTENT.md | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/INTENT.md b/INTENT.md index 0b994d5..23b2a74 100644 --- a/INTENT.md +++ b/INTENT.md @@ -65,8 +65,14 @@ The glas-harness adapter (`glas_harness/reins/rein_openweights.py`, mirroring `reins/rein_aharness.py`) now exists and is what performed this run. -**Follow-up tracked in glas-harness:** `GLAS-WP-0002-T02` — the OpenBao -AppRole/vault credential path (`credentials.py`'s `_acquire_token`/`bao -kv get` branch) is only unit-tested against mocked `bao` calls; it needs -a real (or realistic sandboxed) AppRole and a live run with -`OPENROUTER_API_KEY` unset to prove the vault round trip actually works. +**`GLAS-WP-0002-T02` closed (2026-07-27):** the OpenBao AppRole/vault +credential path (`credentials.py`'s `_acquire_token`/`bao kv get` +branch) is now live-verified, not just unit-tested against mocks. +`ops-mason` built the real infrastructure (AppRole `rein-openweights`, +policy, `reins/rein-openweights/openrouter` KV v2 path); the founder +completed provisioning; a real task ran with `OPENROUTER_API_KEY` +explicitly unset — real AppRole login, real KV v2 read, real OpenRouter +call, real commit. See `ops-mason/plans/rein-openweights-openrouter-approle.md` +for the full build record, including two real bugs (a KV v2 policy path +shape mistake, a missing admin-policy entry for the new mount) found and +fixed by actually running this end to end rather than stopping at mocks.