railiance-platform/scripts/openbao-platform-admin-aal2.sh

#!/usr/bin/env bash
# Silent child for the governed attended login (RPF-WP-0065-T04); results go to the receipt only.
set -euo pipefail
exec python3 "$(dirname "$0")/openbao_platform_admin_aal2.py" "$@" >/dev/null 2>&1
RPF-WP-0065-T04: rebuild founder runbook for the silent warden lane The warden openbao-platform-admin-login lane runs one silent child per login, fails closed on any output and self-revokes; the old runbook printed output and rolled back from a standing session that cannot exist. - scripts/openbao-platform-admin-aal2.sh (+ .py): prepare (backup + assurance claim mapping), apply (gated on this login's assurance_level=aal2, readback of bound_claims), verify, rollback from the backup receipt via a fresh lane login, rollback-body for the docs/openbao.md break-glass path. 0600 O_EXCL receipts, value-free; no stdout/stderr. - Role declaration maps /assurance/level to token metadata assurance_level. - tests/test_openbao_platform_admin_aal2.py: fake bao end-to-end. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 4515@bnt-lap001 Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354 2026-10-27 22:46:31 +01:00			`#!/usr/bin/env bash`
			`# Silent child for the governed attended login (RPF-WP-0065-T04); results go to the receipt only.`
			`set -euo pipefail`
			`exec python3 "$(dirname "$0")/openbao_platform_admin_aal2.py" "$@" >/dev/null 2>&1`