fix: route OpenBao platform administration login

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0290b-3241-74c3-b868-6049545af836

workplans/WARDEN-WP-0033-native-lane-handoff.md

@@ -11,7 +11,7 @@ planning_priority: P1
 depends_on_workplans:
   - WARDEN-WP-0030
 created: "2026-08-21"
-updated: "2026-08-21"
+updated: "2026-08-22"
 ---
 
 # WARDEN-WP-0033 — Native lane handoff
@@ -248,6 +248,46 @@ no code change, punishing whoever commits next rather than whoever owns the
 blocker. The CI test is structural instead — every interim lane must record
 *how* it was verified, which fails on the commit that introduces the omission.
 
+```task
+id: WARDEN-WP-0033-T06
+status: done
+priority: high
+```
+
+**Correct first-time OpenBao administration routing.** `rapp-postgres` reported
+on 2026-08-22 that `warden plan` mapped first-time
+`database/config/platform-pg-2` administration to the generic
+`openbao-api-key` template. It consequently proposed paste-once KV provisioning
+and a workload OIDC role, neither of which can configure database connections,
+policies, auth roles, or token roles. Their Desk session stopped without an
+approval or secret action.
+
+The authoritative platform runbook and rapp-postgres's live T04 evidence agree
+on the missing distinction: this is one attended KeyCape-backed OpenBao identity
+act at auth mount `netkingdom`, role `platform-admin`. It is not a credential
+value handoff. Root stays offline break-glass authority and a workload role must
+never be widened to make the operation pass.
+
+Add an exact `openbao-platform-admin-login` lane, an operator playbook, and a
+regression that makes the reported request resolve to `founder_required` with
+`oidc_login` — never `paste_once_provision`. Verify the route, then return the
+corrected non-secret command to rapp-postgres.
+
+**Done 2026-08-22.** The new active lane resolves the exact reported request at
+score 20, ahead of the generic KV template at 11, and returns one
+`founder_required` act:
+`bao login -no-print -method=oidc -path=netkingdom role=platform-admin`.
+Planner output offers only `warden access openbao-platform-admin-login --fetch`
+and the exact owner command; login lanes no longer inherit secret-value
+transports (`--exec`, `--out`, `--wrap`). The lane is explicitly a high-risk,
+non-workload human identity act, so the generated boundary artifact lists it as
+having no KV address rather than inventing one.
+
+Verification: 384 tests pass, Ruff passes, workload accounting resolves all 28
+lanes (3 resolved, 17 unknown, 8 not-applicable), and the boundary invariant
+reports 20 high-risk lanes, 14 concrete paths covered, 6 non-KV/pattern lanes,
+0 uncovered. No login or credential action was performed.
+
 ## Related
 
 - `secrets-engine` `SECRETS-WP-0006` — catalog admission, decision `ae676382`