ops-warden/wiki/playbooks/openbao-platform-admin-login.md

# OpenBao platform-admin login

## Worker checklist

Use this lane only for an attended OpenBao control-plane operation whose
reviewed procedure requires `platform-admin`, such as configuring a database
secrets-engine connection, policies, auth roles, or token roles. It is not a
workload KV-read lane and it does not provision a secret value.

1. Plan the exact administration need before drafting any operator step:

   ```bash
   warden plan "attended OpenBao platform administration for <reviewed operation>" --json
   ```

   The result must select `openbao-platform-admin-login`, return
   `founder_required`, and name one `oidc_login` act. If it selects
   `openbao-api-key`, a workload role, paste-once provisioning, or root, stop and
   report a routing defect.

2. The operator performs the identity act and the separately reviewed owner
   command through one contained envelope:

   ```bash
   warden access openbao-platform-admin-login --exec -- <reviewed-owner-command>
   ```

   Warden refuses a login-only `--fetch`. Before OIDC it proves the caller's
   default home is usable, creates a caller-owned `0700` isolated home and a
   `0600` token helper, and then runs `bao login -no-print` with both stdout and
   stderr captured. The reviewed command runs in the same contained home with
   both streams captured; it must persist any permitted metadata evidence itself
   and remain silent. Warden self-revokes the session and removes the helper on
   every success or failure path.

   Safety does not rely on `-no-print`. Login output stays contained and is
   accepted only after successful helper persistence. Any child output (including
   whitespace), persistence defect, non-zero exit, or revocation/cleanup defect
   fails closed.
   Captured bytes are never returned, logged, excerpted, hashed, or fingerprinted.
   Do not paste a token into chat, State Hub, a shell argument, or a handoff file.
   Root is offline break-glass authority, not a fallback for failure.

3. Verify authority using metadata or capabilities only, never by reading a
   secret value. Then run only the separately reviewed owner procedure. For the
   database engine this procedure lives in `rapp-postgres`; the login does not
   itself approve configuration changes.

4. Confirm the contained command exits successfully. Warden performs and checks
   `bao token revoke -self` inside the contained environment before cleanup; do
   not retain or reuse the helper.

If browser login fails before authentication, confirm the `netkingdom` auth
mount, `platform-admin` role, and allowed callback with `railiance-platform` and
`key-cape`. Do not retry with a workload-specific OIDC role: it is intentionally
incapable of OpenBao control-plane administration.

## Exit status and audit

After argument/configuration validation, the contained envelope returns:

| Exit | Audit outcome | Meaning |
| --- | --- | --- |
| 0 | `ok` | Login, silent child, self-revocation and cleanup succeeded. |
| 10 | `login_failed` | Login or private-home preflight failed; child did not run. |
| 11 | `child_failed` | Child could not start or exited non-zero. |
| 12 | `child_output` | Child emitted stdout/stderr, even whitespace; takes precedence over child exit failure. |
| 13 | `revoke_unconfirmed` | Child succeeded silently, but self-revocation was not confirmed. |
| 14 | `cleanup_failed` | Private storage cleanup failed; overrides the prior phase. |

Both `access-audit.log` and `audit.jsonl` record the Warden exit code and phase
outcome, never captured bytes. Revocation warnings accompany child failures too.
Codes 11–14 do not establish that the child made no changes: check its permitted
metadata receipt before retrying. A zero exit from `bao token revoke -self` is
Warden's revocation confirmation; no post-revoke lookup is used. An arbitrary
lookup failure would not prove revocation.

On the WSL workstation, use the ops-bridge `openbao-ui-railiance01` tunnel at
`http://127.0.0.1:18200` for `BAO_ADDR` and `VAULT_ADDR`, with the founder's TTY
and a working browser opener (`xdg-open`, or the configured OpenBao browser).
`bao.coulomb.social` serves a public notice, not OpenBao. The captured OIDC output
is not a browser fallback. Check the opener before starting an attended login.
The reviewed child must redirect both streams if its tools normally print success
messages; it should write only approved, value-free evidence to its own receipt.

## Authority

- OpenBao policy and role owner: `railiance-platform/docs/openbao.md`
- Human identity and MFA provider: key-cape / Keycloak
- Database-engine procedure owner: `rapp-postgres`
- Routing decision and founder-act surface: WARDEN-WP-0029