feat(NK-WP-0032): admit OpenBao operator loopback callback

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02b90-83bf-75c2-81c8-aa705414e4d4

workplans/NK-WP-0032-openbao-operator-loopback-callback.md

@@ -0,0 +1,87 @@
+---
+id: NK-WP-0032
+type: workplan
+title: "Admit the operator-tunneled OpenBao browser callback"
+domain: infotech
+repo: net-kingdom
+status: blocked
+owner: codex
+topic_slug: net-kingdom
+created: "2026-08-23"
+updated: "2026-08-23"
+related:
+  - RMASTER-WP-0020-T09
+  - RAILIANCE-WP-0027-T03
+origin: routed
+origin_ref: "State Hub message 5e56b413-d8ec-4718-b432-2debc40498ca"
+---
+
+# NK-WP-0032 — OpenBao operator loopback callback
+
+## Goal
+
+Admit the exact callback derived by the ClusterIP-only OpenBao UI gateway when
+operators reach it through the named `openbao-ui-railiance01` tunnel, without
+weakening MFA or broadening the OpenBao policy.
+
+## T01 — Update and validate the code-defined callback contract
+
+```task
+id: NK-WP-0032-T01
+status: done
+priority: high
+```
+
+Add `http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback` to the
+KeyCape `openbao-admin` public-PKCE client, the OpenBao `platform-admin` role
+template, bootstrap validation, live authorization verifier, and operator
+documentation. Preserve the former public callbacks only for the bounded
+listener rollback window.
+
+Completed 2026-08-23. Three focused regression tests, Python compilation, Bash
+syntax validation, and `git diff --check` pass.
+
+## T02 — Apply and prove the live KeyCape client addition
+
+```task
+id: NK-WP-0032-T02
+status: done
+priority: high
+```
+
+Patch only the code-defined non-secret client configuration, restart KeyCape,
+and prove both the live Secret contract and public authorize endpoint accept
+the exact loopback URI. Do not record the Secret contents or an authorization
+code.
+
+Completed 2026-08-23 on Railiance01. `sso/keycape-config` was patched without
+printing decoded data, `deployment/keycape` rolled out successfully, and the
+value-safe verifier proved the live client contract, exact loopback redirect,
+legacy rollback redirects, and OIDC discovery endpoint. No authorization code
+or Secret value was observed.
+
+## T03 — Apply and prove the live OpenBao role addition
+
+```task
+id: NK-WP-0032-T03
+status: wait
+priority: high
+```
+
+An attended platform-admin/root-sudo authority must apply the updated role
+template to `auth/netkingdom/role/platform-admin`. Record only that the exact
+URI is admitted. Do not record a token, accessor, authorization code, callback
+query, browser storage, or role response body.
+
+## T04 — Return attended-login evidence to Railiance Platform
+
+```task
+id: NK-WP-0032-T04
+status: wait
+priority: high
+```
+
+After T02 and T03 pass, perform one attended MFA login through
+`http://127.0.0.1:18200` and return only the success/failure outcome. This task
+does not authorize public Ingress retraction; Railiance Platform retains that
+separate guarded hold point.