Use canonical workplan ID for callback admission

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e3f-7301-7622-9be1-12e5f352881c

workplans/KEY-WP-0010-openbao-operator-loopback-callback.md

@@ -0,0 +1,31 @@
+---
+id: KEY-WP-0010
+type: workplan
+title: "Admit the operator-tunneled OpenBao callback"
+domain: infotech
+repo: key-cape
+status: finished
+owner: codex
+topic_slug: netkingdom
+created: "2026-08-23"
+updated: "2026-08-23"
+depends_on:
+  - RAILIANCE-WP-0027
+---
+
+# KEY-WP-0010 — OpenBao operator loopback callback
+
+## Admit and validate the exact callback
+
+```task
+id: KEY-WP-0010-T01
+status: done
+priority: high
+```
+
+Added the exact operator-only callback
+`http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback` to the
+source-owned `openbao-admin` static client in `config/dev-config.yaml`. The
+registration retains exact-match redirects and does not authorize a login,
+change the OpenBao role, broaden a listener, or handle a credential. A config
+test pins the exact URI and proves the complete source config validates.