tegwick
4fee839b11
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663
40 lines
1 KiB
Markdown
40 lines
1 KiB
Markdown
---
|
|
id: WARDEN-WP-0034
|
|
type: workplan
|
|
title: "Accept contained OpenBao login output only after helper persistence"
|
|
domain: infotech
|
|
repo: ops-warden
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: attended-login-openbao-output
|
|
created: "2026-09-01"
|
|
updated: "2026-09-01"
|
|
---
|
|
|
|
## Repair attended-login handoff
|
|
|
|
```task
|
|
id: WARDEN-WP-0034-T01
|
|
status: done
|
|
priority: high
|
|
```
|
|
|
|
Allow a successful OpenBao login to proceed when its output is fully contained
|
|
and the private mode-0600 token helper is populated. Continue failing closed on
|
|
non-zero login, missing persistence, child output, revocation failure, or cleanup
|
|
failure.
|
|
|
|
## Verify live contained operation
|
|
|
|
```task
|
|
id: WARDEN-WP-0034-T02
|
|
status: done
|
|
priority: high
|
|
```
|
|
|
|
Run the proxy regression suite, reinstall the CLI, and complete one governed
|
|
OpenBao platform-admin operation with deterministic self-revocation.
|
|
|
|
Completed 2026-09-01. The installed CLI completed the governed Policy Nexus
|
|
Forgejo source bootstrap with all child output contained, then revoked and
|
|
removed its isolated helper session.
|