Route explicit attended OpenBao administration to governed login

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

workplans/WARDEN-WP-0038-plan-mutation-intent.md

@@ -11,7 +11,7 @@ planning_priority: P1
 depends_on_workplans:
   - WARDEN-WP-0029
 created: "2026-09-08"
-updated: "2026-09-09"
+updated: "2026-10-16"
 state_hub_workstream_id: "751ad530-e44b-52c4-b70e-cb47568a0179"
 ---
 
@@ -119,6 +119,29 @@ anything undeclared — is not built. It is a catalog schema change that would f
 closed on the majority of lanes, which say nothing today, and it needs its own
 argument rather than arriving as a side effect of this fix.
 
+## Recognize explicit attended OpenBao platform administration
+
+```task
+id: WARDEN-WP-0038-T01
+status: done
+priority: high
+```
+
+2026-10-16 source follow-up: the exact request "attended OpenBao platform
+administration for reviewed flex-auth signer custody CAS0 and fixed KV metadata"
+fell through to keyword ranking and selected `openbao-structure-survey` /
+`approve`. The configuration override required policy/auth-role nouns even
+though the caller explicitly named attended platform administration. Recognize
+that explicit intent before keyword ranking. The plan now selects
+`openbao-platform-admin-login` / `founder_required` / `oidc_login`; the governed
+reviewed-command transport and identity gate are unchanged. Survey requests
+remain metadata-only, and a missing administration lane stays unroutable.
+
+Prepared and tested in an isolated checkout for independent review. This task
+records source repair only; it neither authorizes nor claims installation,
+attended login, signer provisioning or full16TSA native acceptance. Integration
+and the existing platform custody work retain those next actions.
+
 ### Not claimed
 
 This narrows what `warden plan` will assert; it does not make the tool an