One cluster route (NK_KUBECONFIG, default ~/.kube/config-railiance01) and
server-side apply throughout. Fixes the Makefile dry-run defaulting to the
coulombcore kubeconfig. Lane-run scripts take no default and fail closed when
NK_KUBECONFIG is unset. net-kingdom convention lint: 14 findings -> 0.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 73091@bnt-lap001
Assistant-Session: 9f48906c-6737-449f-8b97-fb86877ca59a
Public bao.coulomb.social was retracted today and now presents
Traefik's default certificate. Login must use http://127.0.0.1:18200
via openbao-attended-exec.py, matching the sitting-requester path.
Assistant: grok
Assistant-Session: 01a0a182-bab7-7f11-b32b-d06f3af52082
AUDIT-WP-0010-T02. Contained platform-admin login writes tenant-engine
into the OpenBao senders registry with CAS, force-syncs the
ExternalSecret, and recreates the receiver so it re-reads identities.
No token value is printed; metadata evidence only.
Assistant: grok
Assistant-Session: 01a0a182-bab7-7f11-b32b-d06f3af52082
