Why would `mysql_root_password` not be defined here? As far as I can tell, I'm following the ansible var discovery rules

error.txt

ansible-playbook  -i inventories/production ./playbooks/wordpress.yml                            ⏎ witan-jupyter ✖ ✱ ◼

PLAY [wordpress] **************************************************************

GATHERING FACTS ***************************************************************
ok: [ricotta-prod-01]

TASK: [productscience.common | install editors and shells] ********************
ok: [ricotta-prod-01] => (item=vim,zsh,htop,iotop,git,subversion)

TASK: [wordpress | install php] ***********************************************
ok: [ricotta-prod-01] => (item=php5-cli,php5-mysql,php5-fpm,mysql-client,mysql-server)

TASK: [wordpress | start php] *************************************************
changed: [ricotta-prod-01]

TASK: [wordpress | make sure we have the databases present] *******************
fatal: [ricotta-prod-01] => One or more undefined variables: 'mysql_root_password' is undefined

FATAL: all hosts have already failed -- aborting

PLAY RECAP ********************************************************************
           to retry, use: --limit @/Users/chrisadams/wordpress.retry

ricotta-prod-01            : ok=4    changed=1    unreachable=1    failed=0

gistfile1.txt

[local]
localhost ansible_python_interpreter=/usr/local/bin/python


[google-wordpress]
ricotta-prod-01 ansible_ssh_host=8.8.8.8 ansible_ssh_user=chris

[google:children]
google-wordpress

[wordpress:children]
google-wordpress

vars.yml

# group_vars/wordpress/vars.yml
# group_vars/wordpress/vault.yml has the actual password
mysql_root_password: {{ vault_mysql_root_password }}

wordpress.yml

# playbooks/wordpress.yml
---
- hosts: wordpress
  remote_user: chris
  sudo: yes
  vars:
    app: wp
  roles:
    - productscience.common
    - wordpress