fix: route OpenBao platform administration login

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0290b-3241-74c3-b868-6049545af836

registry/generated/high-risk-data-paths.yaml

@@ -10,12 +10,12 @@
 # declares it, and is null where the field set has not been established --
 # null means unknown, never 'one field'.
 
-generated_at: "2026-08-22T13:37:27Z"
+generated_at: "2026-08-22T16:46:29Z"
 source: ops-warden/registry/routing/catalog.yaml
 catalog_revision: "7ce58ae638b89ef07340a4dd72c80ec34fc35c78"
 catalog_revision_date: "2026-08-22T15:36:37+02:00"
-catalog_dirty: false
-high_risk_lane_count: 19
+catalog_dirty: true
+high_risk_lane_count: 20
 concrete_path_count: 14
 
 # Graded high but not a single KV address -- a routing pattern, a broker
@@ -25,6 +25,7 @@ no_concrete_path:
   - inter-hub-bootstrap-ssh
   - object-storage-sts
   - openbao-api-key
+  - openbao-platform-admin-login
   - ops-warden-warden-sign-token
 
 paths:

registry/routing/catalog.yaml

@@ -144,6 +144,33 @@ entries:
         - "For dynamic-lease secrets, revoke the old lease (`bao lease revoke`) instead of a KV put."
         - "Verify capabilities-safe (`bao token capabilities` on the data path); notify consumers to re-fetch."
 
+  - id: openbao-platform-admin-login
+    title: Attended OpenBao platform administration login
+    # This is an identity bootstrap, not a secret value lane. The authority it
+    # establishes is high-risk, but the command prints no token and writes only
+    # to the caller's normal OpenBao token helper.
+    risk: high
+    workload_ref:
+      applicability: not-applicable
+      reason: "Attended human operator identity act; the governed admin operation supplies its own resource identity."
+    need_keywords: [openbao, platform-admin, platform, admin, administrator, first-time, bootstrap, database-engine, database/config, policy, policies, token-role, token-roles, mount, auth-role]
+    owner_repo: railiance-platform
+    subsystem: OpenBao operator OIDC via key-cape
+    warden_executes: false
+    wiki_ref: wiki/playbooks/openbao-platform-admin-login.md#worker-checklist
+    canon_ref: railiance-platform/docs/openbao.md
+    reviewed: "2026-08-22"
+    status: active
+    delegation:
+      mode: native
+      intended_owner: railiance-platform
+      reviewed: "2026-08-22"
+      verified: source-read
+    auth_method: "attended KeyCape OIDC/MFA at OpenBao auth mount netkingdom, role platform-admin"
+    fetch_command: "bao login -no-print -method=oidc -path=netkingdom role=platform-admin"
+    exec_capable: true
+    lane: login
+
   - id: whynot-design-npm-publish
     title: whynot-design npm publish token (@whynot/design → coulomb Gitea registry)
     # Publish rights to the package registry — a leaked token is a supply-chain write, not a read (WARDEN-WP-0032-T05).