railiance-platform/workplans/RPF-WP-0025-openbao-operator-only-access.md

---
id: RPF-WP-0025
type: workplan
title: "Retract public OpenBao listener behind operator-only access"
domain: financials
repo: railiance-platform
status: blocked
owner: codex
topic_slug: railiance
created: "2026-08-23"
updated: "2026-08-23"
related:
  - RMASTER-WP-0020-T09
  - RAPP-OPENBAO-WP-0002
state_hub_workstream_id: "6dda6039-295e-5cac-aef6-3183c3218649"
---

# RPF-WP-0025 — OpenBao operator-only access

## Goal

Implement the S3-owner half of RMASTER-WP-0020-T09 without coupling it to
destructive CoulombCore cleanup.

## T01 — Align the retained compatibility source

```task
id: RPF-WP-0025-T01
status: done
priority: high
state_hub_task_id: "80f9638f-707f-5038-bc77-5962b535949e"
```

The retained platform manifest now matches the canonical package posture:
Deployment plus ClusterIP Service only. Ordinary deploy no longer applies the
public-only middleware. The old Ingress remains solely in an explicitly named
rollback artifact.

## T02 — Add guarded retraction and rollback

```task
id: RPF-WP-0025-T02
status: done
priority: high
state_hub_task_id: "685aba0f-2594-5b99-903a-8c9cd16f6539"
```

`scripts/openbao-public-listener-transition.sh` pins the cluster UID, verifies
source and runtime packet posture, requires a lifecycle-healthy named tunnel,
and gates live deletion on exact confirmation plus attended-login verification.
It deletes only the Ingress and provides an exact rollback path.

## T03 — Complete the attended operator cutover

```task
id: RPF-WP-0025-T03
status: wait
priority: high
state_hub_task_id: "8850d742-7cd7-5a1b-ba52-4dbc4bdeba7e"
```

KeyCape revision `d150be1` now admits exactly
`http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback` in the
source-owned `openbao-admin` client and pins it in configuration tests. The
OpenBao `auth/netkingdom/role/platform-admin` role must still independently
admit that exact callback, and an attended MFA login must pass. The
host-namespace preflight already proves `openbao-ui-railiance01`
lifecycle-healthy and reaches the expected overlay. Then execute the guarded
retraction, coordinate public DNS withdrawal with railiance-infra, and return
non-secret acceptance evidence to Railiance Master.

Net Kingdom revision `61aeafe` additionally applied the exact KeyCape callback
live and proved the public authorization endpoint accepts it. Railiance
Platform now carries the silent, narrowly scoped
`scripts/openbao-apply-operator-loopback-callback.sh` owner command for the
governed `openbao-platform-admin-login` lane. The remaining hold is one
attended OIDC/MFA execution of that command followed by one loopback UI login.

An attended attempt on 2026-08-23 failed closed before command handoff. Warden
contained all login output and did not execute the role update; its cleanup
could not confirm self-revocation, so the attempt is terminal NO-GO and must
not be treated as callback evidence. No public-listener or OpenBao role change
was made. T03 remains `wait` for a fresh attended execution after the operator
is ready to complete the browser/MFA act.

This workplan authorizes no OpenBao seal/unseal, policy broadening, PVC or
Secret mutation, reboot, restore, or RMASTER-WP-0020-T08 cleanup.