529feeac49
source: repo-manager reason: deterministic projection registration Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663
43 lines
1.2 KiB
Markdown
43 lines
1.2 KiB
Markdown
---
|
|
id: WARDEN-WP-0036
|
|
type: workplan
|
|
title: "Accept contained OpenBao login output only after helper persistence"
|
|
domain: infotech
|
|
repo: ops-warden
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: attended-login-openbao-output
|
|
created: "2026-09-01"
|
|
updated: "2026-09-01"
|
|
state_hub_workstream_id: "d844c96e-152d-53fa-bff6-e072125ef66c"
|
|
---
|
|
|
|
## Repair attended-login handoff
|
|
|
|
```task
|
|
id: WARDEN-WP-0036-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "7eb8b9c9-1285-5ada-a17b-1d5bfbb8ba59"
|
|
```
|
|
|
|
Allow a successful OpenBao login to proceed when its output is fully contained
|
|
and the private mode-0600 token helper is populated. Continue failing closed on
|
|
non-zero login, missing persistence, child output, revocation failure, or cleanup
|
|
failure.
|
|
|
|
## Verify live contained operation
|
|
|
|
```task
|
|
id: WARDEN-WP-0036-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "d22bab05-c38b-561f-95de-6c146ce7c6cf"
|
|
```
|
|
|
|
Run the proxy regression suite, reinstall the CLI, and complete one governed
|
|
OpenBao platform-admin operation with deterministic self-revocation.
|
|
|
|
Completed 2026-09-01. The installed CLI completed the governed Policy Nexus
|
|
Forgejo source bootstrap with all child output contained, then revoked and
|
|
removed its isolated helper session.
|