Declare live platform-admin role and policies; add attended admin check

Answers the-custodian 641673a4. An attended read-only check (receipt
docs/evidence/2026-09-23-openbao-platform-admin-check.json) found:
- live platform-admin policy = repo file + reins/* (ops-mason, 2026-07-27);
  repo now matches live (sha256 0ca5b821...). No live write.
- role also attaches operator-custody (undeclared); declared here.
- role declared as openbao/auth/netkingdom-platform-admin-role.json.
- default policy is attached and grants revoke-self/lookup-self, so the
  suspected missing grant is not the cause of warden's unconfirmed revocation.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 150322@bnt-lap001
Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4

docs/evidence/2026-09-23-openbao-platform-admin-check.json

@@ -0,0 +1,97 @@
+{
+  "applied": false,
+  "attached_policy_sha256": {
+    "default": "cf5e073df536011f977880d58be6a32acb04cfcd195364241f2d99f6601c2e3f",
+    "operator-custody": "84eeabeeb11c15e2f8940ed23d6ecc434a3299405fd70ea9c05d959f925970f7",
+    "platform-admin": "0ca5b821666bdf262bb0742a0031a4f0f9f3d315ef85e951d6b9ce20e7563394"
+  },
+  "changed": false,
+  "credential_values_emitted": false,
+  "observed_at": "2026-09-23T17:25:18.820429+00:00",
+  "policy": {
+    "declared_sha256": "43a53b00fab59fc62ad586d81f89f36293669c2f8ccedbfb1e3d70618d9af767",
+    "live_sha256": "0ca5b821666bdf262bb0742a0031a4f0f9f3d315ef85e951d6b9ce20e7563394",
+    "matches_declared": false
+  },
+  "policy_name": "platform-admin",
+  "role": {
+    "allowed_redirect_uris": [
+      "http://localhost:8250/oidc/callback",
+      "http://127.0.0.1:8250/oidc/callback",
+      "https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback",
+      "https://bao.coulomb.social/ui/vault/auth/keycape/oidc/callback",
+      "http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback"
+    ],
+    "bound_audiences": [],
+    "bound_claims": {
+      "groups": [
+        "net-kingdom-admins"
+      ]
+    },
+    "bound_claims_type": "string",
+    "bound_subject": "",
+    "claim_mappings": {
+      "email": "email",
+      "preferred_username": "username"
+    },
+    "groups_claim": "groups",
+    "oidc_scopes": [
+      "openid",
+      "profile",
+      "email",
+      "groups"
+    ],
+    "policies": [
+      "platform-admin",
+      "operator-custody"
+    ],
+    "role_type": "oidc",
+    "token_bound_cidrs": [],
+    "token_explicit_max_ttl": 0,
+    "token_max_ttl": 0,
+    "token_no_default_policy": false,
+    "token_num_uses": 0,
+    "token_period": 0,
+    "token_policies": [
+      "platform-admin",
+      "operator-custody"
+    ],
+    "token_ttl": 3600,
+    "token_type": "default",
+    "ttl": 3600,
+    "user_claim": "sub"
+  },
+  "role_path": "auth/netkingdom/role/platform-admin",
+  "schema": "railiance-platform.openbao-platform-admin-check.v1",
+  "self_capabilities": {
+    "auth/token/lookup-self": [
+      "read"
+    ],
+    "auth/token/revoke-self": [
+      "update"
+    ]
+  },
+  "status": "partial",
+  "steps": {
+    "capabilities_self": {
+      "ok": true
+    },
+    "read_attached_rules": {
+      "ok": true
+    },
+    "read_policy": {
+      "ok": true
+    },
+    "read_role": {
+      "ok": true
+    },
+    "token_lookup_self": {
+      "detail": [
+        "Usage: bao token <subcommand> [options] [args]"
+      ],
+      "error": "exit_1",
+      "ok": false
+    }
+  },
+  "token": null
+}

docs/openbao.md

@@ -395,6 +395,21 @@ The browser callback URI must be present in both:
 - KeyCape `openbao-admin` client redirect URIs; and
 - OpenBao `auth/netkingdom/role/platform-admin` `allowed_redirect_uris`.
 
+Declared state of the administrator login (verified live 2026-09-23,
+`docs/evidence/2026-09-23-openbao-platform-admin-check.json`):
+
+- role `auth/netkingdom/role/platform-admin`:
+  `openbao/auth/netkingdom-platform-admin-role.json`. It is written by
+  net-kingdom `sso-mfa/k8s/keycape/configure-openbao-oidc.sh`, which lacks
+  `operator-custody` and still lists retired `bao.coulomb.social` callbacks.
+- policies `openbao/policies/platform-admin.hcl` and
+  `openbao/policies/operator-custody.hcl`, plus the built-in `default`
+  (`token_no_default_policy: false`). `default` grants `auth/token/revoke-self`
+  and `lookup-self`, so an attended session can always revoke itself.
+- Re-check with the silent attended helper
+  `scripts/openbao-platform-admin-check.sh --receipt <new-file>`. Run it through
+  `scripts/openbao-attended-exec.py`. It only reads.
+
 If the compatibility alias is kept enabled, also keep
 `http://127.0.0.1:18200/ui/vault/auth/keycape/oidc/callback` in the
 KeyCape client and `auth/keycape/role/platform-admin`.