Pin attended sender mint to the operator OpenBao tunnel

Public bao.coulomb.social was retracted today and now presents
Traefik's default certificate. Login must use http://127.0.0.1:18200
via openbao-attended-exec.py, matching the sitting-requester path.

Assistant: grok
Assistant-Session: 01a0a182-bab7-7f11-b32b-d06f3af52082

scripts/attended-mint-tenant-engine-sender.sh

@@ -1,17 +1,12 @@
 #!/usr/bin/env bash
 # Parent-env wrapper for the attended tenant-engine sender mint.
 #
-# `warden access` runs OIDC from the *caller* environment, not from the
-# `env ...` child argv. BAO_ADDR must be set here or bao login talks to
-# the wrong address and fails before the mint script starts.
+# Public https://bao.coulomb.social was retracted 2026-09-15
+# (RMASTER-WP-0020-T09). Operator login is the named tunnel
+# openbao-ui-railiance01 → http://127.0.0.1:18200. railiance-platform's
+# openbao-attended-exec.py pins that address for both OIDC and the child.
 set -euo pipefail
-export BAO_ADDR="${BAO_ADDR:-https://bao.coulomb.social}"
-export VAULT_ADDR="${VAULT_ADDR:-$BAO_ADDR}"
 export RAILIANCE01_KUBECONFIG="${RAILIANCE01_KUBECONFIG:-$HOME/.kube/config-railiance01}"
-export WARDEN_ROUTING_CATALOG="${WARDEN_ROUTING_CATALOG:-$HOME/ops-warden/registry/routing/catalog.yaml}"
 cd "$(dirname "$0")/.."
-exec warden access openbao-platform-admin-login --exec -- \
-  env RAILIANCE01_KUBECONFIG="$RAILIANCE01_KUBECONFIG" \
-      BAO_ADDR="$BAO_ADDR" \
-      VAULT_ADDR="$VAULT_ADDR" \
+exec python3 /home/worsch/railiance-platform/scripts/openbao-attended-exec.py -- \
   "$PWD/scripts/mint-tenant-engine-sender.py"

scripts/diagnose-platform-admin-login.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# Interactive diagnosis of the contained platform-admin OIDC login.
+# Shows bao's own messages (Warden swallows them). Stores the token only in a
+# throwaway helper, revokes it, and prints metadata — never the token.
+set -euo pipefail
+export BAO_ADDR="${BAO_ADDR:-http://127.0.0.1:18200}"
+export VAULT_ADDR="${VAULT_ADDR:-$BAO_ADDR}"
+mkdir -p "${HOME}/.warden-attended-login"
+chmod 700 "${HOME}/.warden-attended-login"
+ROOT="$(mktemp -d "${HOME}/.warden-attended-login/diag-XXXXXX")"
+chmod 700 "$ROOT"
+helper="$ROOT/.vault-token"
+cleanup() {
+  if [[ -s "$helper" ]]; then
+    HOME="$ROOT" bao token revoke -self >/dev/null 2>&1 || true
+  fi
+  rm -rf "$ROOT"
+}
+trap cleanup EXIT
+touch "$helper"
+chmod 600 "$helper"
+echo "BAO_ADDR=$BAO_ADDR"
+echo "NTPSynchronized=$(timedatectl show -p NTPSynchronized --value 2>/dev/null || echo unknown)"
+echo "isolated_home=$ROOT"
+echo "starting bao login -no-print -method=oidc -path=netkingdom role=platform-admin"
+echo "(complete the browser flow; this process must stay running for the callback)"
+set +e
+HOME="$ROOT" bao login -no-print -method=oidc -path=netkingdom role=platform-admin
+rc=$?
+set -e
+mode=$(stat -c '%a' "$helper" 2>/dev/null || echo missing)
+size=$(stat -c '%s' "$helper" 2>/dev/null || echo 0)
+echo "login_exit=$rc helper_mode=$mode helper_bytes=$size"
+if [[ "$rc" -eq 0 && "$size" -gt 0 ]]; then
+  echo "login_ok_helper_populated"
+else
+  echo "login_failed_or_helper_empty"
+fi

scripts/mint-tenant-engine-sender.py

@@ -4,10 +4,7 @@
 Silent: warden access --exec fails closed on any child stdout/stderr.
 Never prints token values. Persist metadata evidence only.
 
-  warden access openbao-platform-admin-login --exec -- \
-    env RAILIANCE01_KUBECONFIG="$HOME/.kube/config-railiance01" \
-        BAO_ADDR="${BAO_ADDR:-https://bao.coulomb.social}" \
-    /home/worsch/audit-core/scripts/mint-tenant-engine-sender.py
+  ./scripts/attended-mint-tenant-engine-sender.sh
 """
 from __future__ import annotations