tegwick
b4c1d3900a
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663
36 lines
867 B
Markdown
36 lines
867 B
Markdown
---
|
|
id: WARDEN-WP-0034
|
|
type: workplan
|
|
title: "Accept contained OpenBao login output only after helper persistence"
|
|
domain: infotech
|
|
repo: ops-warden
|
|
status: active
|
|
owner: codex
|
|
topic_slug: attended-login-openbao-output
|
|
created: "2026-09-01"
|
|
updated: "2026-09-01"
|
|
---
|
|
|
|
## Repair attended-login handoff
|
|
|
|
```task
|
|
id: WARDEN-WP-0034-T01
|
|
status: done
|
|
priority: high
|
|
```
|
|
|
|
Allow a successful OpenBao login to proceed when its output is fully contained
|
|
and the private mode-0600 token helper is populated. Continue failing closed on
|
|
non-zero login, missing persistence, child output, revocation failure, or cleanup
|
|
failure.
|
|
|
|
## Verify live contained operation
|
|
|
|
```task
|
|
id: WARDEN-WP-0034-T02
|
|
status: progress
|
|
priority: high
|
|
```
|
|
|
|
Run the proxy regression suite, reinstall the CLI, and complete one governed
|
|
OpenBao platform-admin operation with deterministic self-revocation.
|