fix: contain attended login diagnostics and OpenBao recovery

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684

docs/evidence/2026-10-15-cust81-attended-dependency-repair-r1.json

@@ -0,0 +1,78 @@
+{
+  "id": "WARDEN-CUST81-ATTENDED-DEPENDENCY-REPAIR-R1",
+  "revision": 1,
+  "status": "source_preparation_verified_not_live",
+  "reviewed_at": "2026-10-15T02:18:02.246091+00:00",
+  "base_commit": "1baeb0821cb6304464fab78932d8c6501f8c4cc6",
+  "scope": "Existing WARDEN-WP-0036 contained attended login; CUST-WP-0081-T02 dependency. No credential scope or live change approval expansion.",
+  "failed_attempts": [
+    {
+      "at": "2026-10-15T02:07:41.774194+00:00",
+      "exit_code": 10,
+      "outcome": "login_failed"
+    },
+    {
+      "at": "2026-10-15T02:10:58.943441+00:00",
+      "exit_code": 10,
+      "outcome": "login_failed"
+    }
+  ],
+  "browser_evidence": {
+    "profile_count": 2,
+    "initialization_mtimes_utc": [
+      "2026-10-15T02:08:19.576345+00:00",
+      "2026-10-15T02:09:28.109549+00:00"
+    ],
+    "prefs_file_presence_only": true,
+    "profile_contents_read": false
+  },
+  "cleanup_evidence": {
+    "custody_receipt_exists": false,
+    "bootstrap_receipt_exists": false,
+    "new_session_directory_present": false,
+    "preexisting_session_directory_mtime": "2026-10-14T22:41:38.098938+00:00",
+    "private_helper_read": false,
+    "server_revocation": "unconfirmed"
+  },
+  "findings": [
+    "The reviewed owner child never ran: Warden exit10 and absent child receipts.",
+    "Actual failure cause is unknown because captured login bytes were discarded. A 121-second duration is consistent with the Bao callback timeout, not proof.",
+    "Bao 2.5.5 internal helper uses .vault-token; Warden helper name is correct.",
+    "Standard flag parsing stops at auth data, but Bao setupEnv scans global format across argv. Trailing -format=json already chooses JSON output. Moving before role is defensive argv normalization, not a proven timeout fix.",
+    "Warden recovery matcher omitted s. tokens supported by this estate. This fix affects only existing in-memory emergency self-revocation after helper persistence failure."
+  ],
+  "changes": [
+    "Insert synthesized -format=json immediately after bao login, before auth data.",
+    "Recognize s. in existing recovery-token matcher; preserve exact revoke-self-only use.",
+    "Expose only fixed diagnostic categories, numeric returncode, helper-present and output-shape booleans. Captured content is never surfaced."
+  ],
+  "strict_output_allowlist_unchanged": true,
+  "focused_tests": {
+    "passed": 84,
+    "command": "python -m pytest -q tests/test_proxy.py",
+    "ruff": "passed"
+  },
+  "preserved_fixture_failures": [
+    "Initial task fixture omitted registry:50failed31passed; fixed by copying public registry.",
+    "Whole-suite attempt omitted scripts:5 collection errors; actual owner full suite required after integration."
+  ],
+  "knowledge_orientation": {
+    "package_version": "0.2.6",
+    "digest": "8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02",
+    "status": "withheld; reviewed current NetKingdom SECURITY-COMPANION, gate-house INTENT, ops-warden AGENTS/INTENT and current Custodian environment source directly"
+  },
+  "source_references": [
+    "https://raw.githubusercontent.com/openbao/openbao/v2.5.5/command/main.go",
+    "https://raw.githubusercontent.com/openbao/openbao/v2.5.5/command/base.go",
+    "https://raw.githubusercontent.com/openbao/openbao/v2.5.5/command/login.go",
+    "https://raw.githubusercontent.com/openbao/openbao/v2.5.5/command/token/helper_internal.go"
+  ],
+  "no_login_or_credentials": true,
+  "whole_suite": {
+    "status": "unverified_terminal_output_unavailable",
+    "handle": 39705,
+    "last_observed": "54 percent with six failures; no terminal result consumed by owner worker",
+    "terminal_handle_after_user_abort": "root poll reported Unknown process id",
+    "claim": "No full-suite pass is claimed; 84 focused proxy tests and Ruff passed."
+  }
+}