Add attended login containment workplan

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa

WORK-RECORDS.md

@@ -24,6 +24,7 @@
 | workplan | RAILIANCE-WP-0023 | finished | — | workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md |
 | workplan | RAILIANCE-WP-0024 | active | — | workplans/RAILIANCE-WP-0024-audit-core-custody-and-recovery-coordination.md |
 | workplan | RAILIANCE-WP-0025 | finished | — | workplans/RAILIANCE-WP-0025-versioned-ephemeral-custody-lifecycle.md |
+| workplan | RAILIANCE-WP-0026 | ready | — | workplans/RAILIANCE-WP-0026-attended-login-output-containment.md |
 | workplan | RPF-WP-0018 | finished | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
 | workplan | RPF-WP-0019 | finished | — | workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md |
 | workplan | RPF-WP-0020 | finished | — | workplans/RPF-WP-0020-ccr-schema-drift.md |
@@ -108,6 +109,7 @@
 | task | RAILIANCE-WP-0025-T04 | done | — | workplans/RAILIANCE-WP-0025-versioned-ephemeral-custody-lifecycle.md |
 | task | RAILIANCE-WP-0025-T05 | done | — | workplans/RAILIANCE-WP-0025-versioned-ephemeral-custody-lifecycle.md |
 | task | RAILIANCE-WP-0025-T06 | done | — | workplans/RAILIANCE-WP-0025-versioned-ephemeral-custody-lifecycle.md |
+| task | RAILIANCE-WP-0026-T01 | todo | — | workplans/RAILIANCE-WP-0026-attended-login-output-containment.md |
 | task | RPF-WP-0018-T01 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
 | task | RPF-WP-0018-T02 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
 | task | RPF-WP-0018-T03 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md |

workplans/RAILIANCE-WP-0026-attended-login-output-containment.md

@@ -0,0 +1,99 @@
+---
+id: RAILIANCE-WP-0026
+type: workplan
+title: "Contain attended OpenBao login output before authentication"
+domain: financials
+repo: railiance-platform
+status: ready
+owner: codex
+topic_slug: railiance
+created: "2026-08-23"
+updated: "2026-08-23"
+related:
+  - RAILIANCE-WP-0024
+  - WARDEN-WP-0027
+  - WARDEN-WP-0027-T02-DRILL-20260822-01
+origin: routed
+origin_ref: "State Hub message b3f34c2d-941f-4ddd-b15d-e28075446021"
+---
+
+# RAILIANCE-WP-0026 — attended OpenBao login output containment
+
+## Goal
+
+Make the governed `openbao-platform-admin-login` path fail before OIDC unless
+it can guarantee isolated private token-helper storage and contain every byte
+emitted by the underlying client. A persistence or output-contract failure must
+revoke any issued credential without placing its value, accessor, fingerprint,
+or derived material in agent-visible output, Git, State Hub, evidence, or logs.
+
+This workplan records the direct fix interface requested by `railiance-infra`.
+It does not authorize OIDC authentication, minting, OpenBao administration, a
+seal/unseal ceremony, or reuse of the terminal drill scenario.
+
+## Ownership and fixed boundaries
+
+- `railiance-platform` owns the login lane, acceptance contract, and any future
+  production rehearsal.
+- `ops-warden` owns the current proxy implementation in `src/warden/cli.py`,
+  `src/warden/proxy.py`, and its focused tests.
+- key-cape remains the OIDC/MFA identity provider; this task does not weaken or
+  replace MFA, change the OpenBao role, or introduce root/workload fallback.
+- `railiance-infra` is the requesting reviewer and independent abort owner.
+- Risk Nexus owns grading of State Hub filing request
+  `5a344f53-14e9-4230-8874-2f01b0a85700`.
+- State Hub GO decision `449a697a-5303-4582-aa9e-b0bc8b35ab2d` was consumed by
+  NO-GO decision `85724c0c-e70f-4e2f-a8c6-a9cb1ea6331b`. Neither decision nor
+  scenario `WARDEN-WP-0027-T02-DRILL-20260822-01` may be reused.
+
+## T01 — Harden the attended-login adapter and prove failure containment
+
+```task
+id: RAILIANCE-WP-0026-T01
+status: todo
+priority: high
+```
+
+Implement the fix in `ops-warden` and return one value-safe owner receipt to
+`railiance-platform` and `railiance-infra` naming the source revision, focused
+test command/result, and the five acceptance outcomes below. The receipt must
+contain no credential, accessor, fingerprint, output excerpt, callback code,
+or token-helper contents.
+
+Acceptance is all of the following:
+
+1. An isolated writable token-helper location is created before authentication,
+   has mode `0600` (with private parent directories), and is removed or revoked
+   through a deterministic cleanup path.
+2. A read-only or otherwise unusable default home fails before OIDC begins; the
+   adapter never discovers persistence failure only after credential issuance.
+3. Adapter-owned stdout and stderr containment guarantees that no credential
+   reaches agent-visible output even if the underlying CLI violates
+   `-no-print`. Inherited agent-visible stdio is not permitted for this lane.
+4. Unexpected credential-bearing or otherwise non-allowlisted output fails
+   closed and, whenever issuance may have occurred, triggers immediate
+   self-revocation through the contained process without logging, returning,
+   hashing, or fingerprinting the value.
+5. Focused tests cover successful attended-login handoff, unwritable/default
+   home refusal before authentication, helper persistence failure, unexpected
+   stdout, unexpected stderr, immediate revocation, cleanup, and value absence
+   from captured test and audit output.
+
+The implementation must also update the `openbao-platform-admin-login` worker
+playbook and catalog comment so they no longer claim safety from `-no-print`
+alone. A non-production test double must prove the complete failure path before
+any new live OIDC rehearsal is proposed.
+
+Done when the implementation is committed and pushed in `ops-warden`, the
+focused suite passes, the value-safe owner receipt is delivered directly to
+both reviewers, and `railiance-platform` accepts the exact revision. Completion
+of this task still does not authorize a live drill; that requires fresh owner
+receipts, current preflight, and a new human decision under a new scenario id.
+
+## Acceptance
+
+- [ ] The adapter refuses unsafe storage before OIDC.
+- [ ] No underlying login output can reach the agent transcript.
+- [ ] Any issued credential is contained and revoked on failure.
+- [ ] Focused success and failure-path tests pass without credential material.
+- [ ] Both direct reviewers receive and accept the value-safe fix receipt.