---
id: WARDEN-WP-0034
type: workplan
title: "Accept contained OpenBao login output only after helper persistence"
domain: infotech
repo: ops-warden
status: active
owner: codex
topic_slug: attended-login-openbao-output
created: "2026-09-01"
updated: "2026-09-01"
---

## Repair attended-login handoff

```task
id: WARDEN-WP-0034-T01
status: done
priority: high
```

Allow a successful OpenBao login to proceed when its output is fully contained
and the private mode-0600 token helper is populated. Continue failing closed on
non-zero login, missing persistence, child output, revocation failure, or cleanup
failure.

## Verify live contained operation

```task
id: WARDEN-WP-0034-T02
status: progress
priority: high
```

Run the proxy regression suite, reinstall the CLI, and complete one governed
OpenBao platform-admin operation with deterministic self-revocation.