From 7c0f270b4442d5385e0a549afaa780d90836f757 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Tue, 15 Sep 2026 21:42:01 +0200
Subject: [PATCH] Export BAO_ADDR in the parent before attended sender mint

warden access runs OIDC from the caller environment. Putting BAO_ADDR
only on the child env argv leaves bao login talking to the wrong
address, which fails before command handoff.

Assistant: grok
Assistant-Session: 01a0a182-bab7-7f11-b32b-d06f3af52082
---
 scripts/attended-mint-tenant-engine-sender.sh | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)
 create mode 100755 scripts/attended-mint-tenant-engine-sender.sh

diff --git a/scripts/attended-mint-tenant-engine-sender.sh b/scripts/attended-mint-tenant-engine-sender.sh
new file mode 100755
index 0000000..28c9586
--- /dev/null
+++ b/scripts/attended-mint-tenant-engine-sender.sh
@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Parent-env wrapper for the attended tenant-engine sender mint.
+#
+# `warden access` runs OIDC from the *caller* environment, not from the
+# `env ...` child argv. BAO_ADDR must be set here or bao login talks to
+# the wrong address and fails before the mint script starts.
+set -euo pipefail
+export BAO_ADDR="${BAO_ADDR:-https://bao.coulomb.social}"
+export VAULT_ADDR="${VAULT_ADDR:-$BAO_ADDR}"
+export RAILIANCE01_KUBECONFIG="${RAILIANCE01_KUBECONFIG:-$HOME/.kube/config-railiance01}"
+export WARDEN_ROUTING_CATALOG="${WARDEN_ROUTING_CATALOG:-$HOME/ops-warden/registry/routing/catalog.yaml}"
+cd "$(dirname "$0")/.."
+exec warden access openbao-platform-admin-login --exec -- \
+  env RAILIANCE01_KUBECONFIG="$RAILIANCE01_KUBECONFIG" \
+      BAO_ADDR="$BAO_ADDR" \
+      VAULT_ADDR="$VAULT_ADDR" \
+  "$PWD/scripts/mint-tenant-engine-sender.py"