Route attended approval-client login to scoped OpenBao reader

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

registry/routing/catalog.yaml

@@ -190,6 +190,30 @@ entries:
     exec_capable: true
     lane: login
 
+  - id: secrets-engine-approval-client-login
+    title: Attended secrets-engine approval client reader login
+    risk: high
+    workload_ref:
+      applicability: not-applicable
+      reason: "Attended operator identity for the exact CCR-2026-0019 reader."
+    need_keywords: [secrets-engine, approval-client, reader, login, ccr-2026-0019]
+    owner_repo: railiance-platform
+    subsystem: OpenBao scoped operator OIDC via KeyCape
+    warden_executes: false
+    wiki_ref: wiki/playbooks/secrets-engine-approval-client-login.md
+    canon_ref: railiance-platform/credential-change-requests/CCR-2026-0019-secrets-engine-approval-client-read.yaml
+    reviewed: "2026-09-14"
+    status: active
+    delegation:
+      mode: native
+      intended_owner: railiance-platform
+      reviewed: "2026-09-14"
+      verified: source-read
+    auth_method: "attended KeyCape OIDC, netkingdom role secrets-engine-approval-client-workload-kv-read"
+    fetch_command: "bao login -no-print -method=oidc -path=netkingdom role=secrets-engine-approval-client-workload-kv-read"
+    exec_capable: true
+    lane: login
+
   - id: openbao-shamir-recovery-ceremony
     title: Attended OpenBao Shamir seal and unseal recovery ceremony
     # A ceremony pointer, not a credential-value lane. Approval coordinates

wiki/playbooks/secrets-engine-approval-client-login.md

@@ -0,0 +1,29 @@
+# Scoped approval-client reader login
+
+CCR-2026-0019 names the operator-confirmed `net-kingdom-admins` group and
+live OIDC role `secrets-engine-approval-client-workload-kv-read`. This login
+lane establishes only that reader session. Warden applies its normal policy
+gate, contained OIDC helper, silent child and self-revocation/cleanup.
+
+Before delivery, run the platform metadata-only preflight:
+
+```sh
+warden access secrets-engine-approval-client-login --exec -- python3 /home/worsch/railiance-platform/scripts/approval-client-reader-preflight.py
+```
+
+The command verifies effective exact-path read and sibling/parent/write denial.
+It reads no KV value. Login readiness does not activate credential delivery.
+CCR-2026-0019 retains its separate pending native delivery acceptance. No raw
+fetch, retained token, admin fallback or verifier Kubernetes Secret substitution.
+
+Origin: operator-authorized SECRETS-WP-0010-T03 continuation, 2026-09-14.
+
+Live reader preflight and protected file/token-exchange checks passed on
+2026-09-14. Platform evidence names this session's scope and its remaining
+wrong-group and real claim/consume checks. The acceptance command is
+`/home/worsch/secrets-engine/.venv/bin/python -B /home/worsch/railiance-platform/scripts/approval-client-delivery-check.py`.
+It requires the owner-bound Approval Engine tunnel on 127.0.0.1:18281, removes
+its private runtime file, and never creates/binds/consumes an approval.
+
+When the installed package uses its older bundled catalog, explicitly select
+`WARDEN_ROUTING_CATALOG=/home/worsch/ops-warden/registry/routing/catalog.yaml`.