net-kingdom/workplans/NK-WP-0032-openbao-operator-loopback-callback.md

---
id: NK-WP-0032
type: workplan
title: "Admit the operator-tunneled OpenBao browser callback"
domain: infotech
repo: net-kingdom
status: blocked
owner: codex
topic_slug: net-kingdom
created: "2026-08-23"
updated: "2026-08-23"
related:
  - RMASTER-WP-0020-T09
  - RAILIANCE-WP-0027-T03
origin: routed
origin_ref: "State Hub message 5e56b413-d8ec-4718-b432-2debc40498ca"
state_hub_workstream_id: "516ee5b9-685b-5986-88d2-bde66c2ba96c"
---

# NK-WP-0032 — OpenBao operator loopback callback

## Goal

Admit the exact callback derived by the ClusterIP-only OpenBao UI gateway when
operators reach it through the named `openbao-ui-railiance01` tunnel, without
weakening MFA or broadening the OpenBao policy.

## T01 — Update and validate the code-defined callback contract

```task
id: NK-WP-0032-T01
status: done
priority: high
state_hub_task_id: "f231077e-7440-5f20-9045-afab90fa8286"
```

Add `http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback` to the
KeyCape `openbao-admin` public-PKCE client, the OpenBao `platform-admin` role
template, bootstrap validation, live authorization verifier, and operator
documentation. Preserve the former public callbacks only for the bounded
listener rollback window.

Completed 2026-08-23. Three focused regression tests, Python compilation, Bash
syntax validation, and `git diff --check` pass.

## T02 — Apply and prove the live KeyCape client addition

```task
id: NK-WP-0032-T02
status: done
priority: high
state_hub_task_id: "360bc410-d7ed-53b6-b5fc-2ce8b37b653f"
```

Patch only the code-defined non-secret client configuration, restart KeyCape,
and prove both the live Secret contract and public authorize endpoint accept
the exact loopback URI. Do not record the Secret contents or an authorization
code.

Completed 2026-08-23 on Railiance01. `sso/keycape-config` was patched without
printing decoded data, `deployment/keycape` rolled out successfully, and the
value-safe verifier proved the live client contract, exact loopback redirect,
legacy rollback redirects, and OIDC discovery endpoint. No authorization code
or Secret value was observed.

## T03 — Apply and prove the live OpenBao role addition

```task
id: NK-WP-0032-T03
status: wait
priority: high
state_hub_task_id: "73b77110-2d4f-527e-98eb-2ec33897681e"
```

An attended platform-admin/root-sudo authority must apply the updated role
template to `auth/netkingdom/role/platform-admin`. Record only that the exact
URI is admitted. Do not record a token, accessor, authorization code, callback
query, browser storage, or role response body.

## T04 — Return attended-login evidence to Railiance Platform

```task
id: NK-WP-0032-T04
status: wait
priority: high
state_hub_task_id: "f62bda4a-7607-5c50-9e04-664cc1b829ac"
```

After T02 and T03 pass, perform one attended MFA login through
`http://127.0.0.1:18200` and return only the success/failure outcome. This task
does not authorize public Ingress retraction; Railiance Platform retains that
separate guarded hold point.