feat: support governed Glas execution

README.md

@@ -26,12 +26,28 @@ python3 -m venv .venv && source .venv/bin/activate
 pip install -e .
 
 # Credential: either export OPENROUTER_API_KEY directly, or set
-# REIN_OPENWEIGHTS_APPROLE_DIR / REIN_OPENWEIGHTS_OPENROUTER_KV_PATH for
-# OpenBao-based acquisition (see src/rein_openweights/credentials.py).
+# OpenBao-based acquisition defaults to role_id/secret_id under
+# ~/.local/rein-openweights/approle and KV path reins/rein-openweights/openrouter.
+# REIN_OPENWEIGHTS_APPROLE_DIR / REIN_OPENWEIGHTS_OPENROUTER_KV_PATH override them.
 export OPENROUTER_API_KEY=sk-...
 
-rein-openweights run --task-file examples/task-hello-sandbox.json --no-hub
+rein-openweights run \
+  --task-file examples/task-hello-sandbox.json \
+  --model qwen/qwen-2.5-72b-instruct \
+  --tool-profile green-commit-only \
+  --budget-tokens 60000 \
+  --max-turns 20 \
+  --no-hub
 ```
 
-Tests: `python3 -m pytest tests/ -q` (26 tests, no network/OpenBao calls —
+`green-commit-only` is currently the sole supported tool profile. Unknown tool
+profiles fail before credential lookup. In governed use these flags are supplied
+by a versioned `glas-harness` profile; workforce/activity consumers should
+reference Glas rather than this CLI directly.
+
+An explicitly exported `OPENROUTER_API_KEY` has highest precedence for local
+development. Unset or refresh it when validating the OpenBao/AppRole lane; an
+old inherited value will otherwise mask a newly rotated workload key.
+
+Tests: `python3 -m pytest tests/ -q` (27 tests, no network/OpenBao calls —
 everything mocked at the `httpx`/`bao` subprocess boundary).