fix: route OpenBao platform administration login

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0290b-3241-74c3-b868-6049545af836

tests/test_plan.py

@@ -53,6 +53,33 @@ def test_plan_login_founder_required():
     assert plan.founder_act.kind == "oidc_login"
 
 
+def test_plan_first_time_openbao_database_admin_uses_platform_admin_login():
+    plan = build_plan(
+        "first-time OpenBao database engine administration for "
+        "database/config/platform-pg-2 dynamic roles policies and token roles; "
+        "requires attended platform-admin handoff"
+    )
+    assert plan.verdict == "founder_required"
+    assert plan.lane_id == "openbao-platform-admin-login"
+    assert plan.founder_act is not None
+    assert plan.founder_act.kind == "oidc_login"
+    command = plan.founder_act.details["fetch_command"]
+    assert command == (
+        "bao login -no-print -method=oidc -path=netkingdom role=platform-admin"
+    )
+    assert "financials" not in command
+    assert "paste_once" not in plan.founder_act.details["desk_hint"]
+    assert any(
+        item == "warden access openbao-platform-admin-login --fetch"
+        for item in plan.commands
+    )
+    assert not any(
+        flag in item
+        for item in plan.commands
+        for flag in ("--exec", "--out", "--wrap")
+    )
+
+
 def test_plan_unroutable():
     # Zero keyword overlap with catalog (avoid tokens like secret/key/token)
     plan = build_plan("xyzzy-plugh-fnord-qqq-zzzz")

tests/test_routing.py

@@ -160,6 +160,16 @@ def test_generic_and_template_lanes_not_resolvable():
     assert catalog.get("key-cape-oidc-login").resolvable is False
 
 
+def test_platform_admin_login_lane_is_exact_and_non_value_bearing():
+    entry = load_catalog(_repo_catalog()).get("openbao-platform-admin-login")
+    assert entry.lane == "login"
+    assert entry.risk == "high"
+    assert entry.fetch_command == (
+        "bao login -no-print -method=oidc -path=netkingdom role=platform-admin"
+    )
+    assert entry.workload_ref.resolution == "not-applicable"
+
+
 def test_find_exact_id_wins_over_keyword_collision():
     catalog = load_catalog(_repo_catalog())
     # "npm" alone collides with openbao-api-key; the exact id must resolve uniquely.

tests/test_workload_join.py

@@ -14,7 +14,7 @@ def test_repo_catalog_uses_only_explicit_workload_references():
     assert report["ok"] is True
     assert len(report["resolved"]) == 3
     assert len(report["unknown"]) == 17
-    assert len(report["not_applicable"]) == 7
+    assert len(report["not_applicable"]) == 8
     assert {row["lane"] for row in report["resolved"]} == {
         "ops-warden-warden-sign-token",
         "issue-core-ingestion-api-key",