Review attended login containment fix

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018

reviews/RAILIANCE-WP-0026-T01-railiance-infra-review.json

@@ -0,0 +1,62 @@
+{
+  "interface": "railiance.attended-login-containment-review",
+  "version": 1,
+  "task_id": "RAILIANCE-WP-0026-T01",
+  "reviewer": "railiance-infra",
+  "disposition": "approve",
+  "reviewed_source_repo": "ops-warden",
+  "reviewed_source_revision": "0fae0904ce8d8694338dd53a8a79abec5fec788d",
+  "artifact_hashes": {
+    "ops-warden:docs/evidence/RAILIANCE-WP-0026-T01-ops-warden-receipt.json": "d2ba444ed16989590325697e69d25283dc75a9432c29a72e627e80bf9fd987e4",
+    "railiance-platform:workplans/RAILIANCE-WP-0026-attended-login-output-containment.md": "f5c30f50366688a7c7fc08f67e9a286a06b6cb5fa21ca25cfc00402968a9f417"
+  },
+  "checks": [
+    {
+      "id": "private-helper-created-before-auth",
+      "passed": true,
+      "read_only": true
+    },
+    {
+      "id": "read-only-home-refused-before-oidc",
+      "passed": true,
+      "read_only": true
+    },
+    {
+      "id": "login-child-and-revocation-stdio-contained",
+      "passed": true,
+      "read_only": true
+    },
+    {
+      "id": "unexpected-output-fails-closed-and-revokes",
+      "passed": true,
+      "read_only": true
+    },
+    {
+      "id": "deterministic-helper-cleanup",
+      "passed": true,
+      "read_only": true
+    },
+    {
+      "id": "focused-tests",
+      "passed": true,
+      "read_only": true,
+      "evidence": "42 passed in 12.05s"
+    },
+    {
+      "id": "lint",
+      "passed": true,
+      "read_only": true,
+      "evidence": "All checks passed"
+    },
+    {
+      "id": "metadata-only-boundary",
+      "passed": true,
+      "read_only": true
+    }
+  ],
+  "live_oidc_performed": false,
+  "live_drill_authorized": false,
+  "secret_values_observed": false,
+  "sensitive_material_recorded": false,
+  "note": "railiance-infra accepts the exact non-live containment implementation at ops-warden revision 0fae0904ce8d8694338dd53a8a79abec5fec788d. This review does not authorize OIDC, credential issuance, reuse of the terminal scenario or decisions, or a live seal/unseal drill. A future attempt requires platform acceptance, a new scenario id, fresh owner receipts, a fresh preflight, and a new human decision."
+}