Declare live platform-admin role and policies; add attended admin check

Answers the-custodian 641673a4. An attended read-only check (receipt
docs/evidence/2026-09-23-openbao-platform-admin-check.json) found:
- live platform-admin policy = repo file + reins/* (ops-mason, 2026-07-27);
  repo now matches live (sha256 0ca5b821...). No live write.
- role also attaches operator-custody (undeclared); declared here.
- role declared as openbao/auth/netkingdom-platform-admin-role.json.
- default policy is attached and grants revoke-self/lookup-self, so the
  suspected missing grant is not the cause of warden's unconfirmed revocation.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 150322@bnt-lap001
Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4

openbao/auth/netkingdom-platform-admin-role.json

@@ -0,0 +1,47 @@
+{
+  "allowed_redirect_uris": [
+    "http://localhost:8250/oidc/callback",
+    "http://127.0.0.1:8250/oidc/callback",
+    "https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback",
+    "https://bao.coulomb.social/ui/vault/auth/keycape/oidc/callback",
+    "http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback"
+  ],
+  "bound_audiences": [],
+  "bound_claims": {
+    "groups": [
+      "net-kingdom-admins"
+    ]
+  },
+  "bound_claims_type": "string",
+  "bound_subject": "",
+  "claim_mappings": {
+    "email": "email",
+    "preferred_username": "username"
+  },
+  "groups_claim": "groups",
+  "oidc_scopes": [
+    "openid",
+    "profile",
+    "email",
+    "groups"
+  ],
+  "policies": [
+    "platform-admin",
+    "operator-custody"
+  ],
+  "role_type": "oidc",
+  "token_bound_cidrs": [],
+  "token_explicit_max_ttl": 0,
+  "token_max_ttl": 0,
+  "token_no_default_policy": false,
+  "token_num_uses": 0,
+  "token_period": 0,
+  "token_policies": [
+    "platform-admin",
+    "operator-custody"
+  ],
+  "token_ttl": 3600,
+  "token_type": "default",
+  "ttl": 3600,
+  "user_claim": "sub"
+}

openbao/policies/operator-custody.hcl

@@ -0,0 +1,30 @@
+# operator-custody — human operators' own credentials.
+#
+# Distinct from platform-admin on purpose. platform-admin lists the mounts an
+# administrator operates *on*; this is the one mount an administrator keeps
+# things *in*. Separating them means custody can move independently of
+# administration — which is exactly what the S6 trust stage (two-of-three
+# independent recovery control) requires, and it cannot be done later if the
+# grant is buried inside platform-admin.
+#
+# Holds: service account passwords, provider PATs, LLDAP admin bind,
+# privacyIDEA pi-admin, machine identities. See
+# net-kingdom/docs/platform-root-custody.md, "Operator Credential Custody".
+#
+# Does NOT hold, and must never: platform-root's own password, unseal shares,
+# the break-glass password. Those live in the offline packet — putting them
+# here is a circular dependency, since you would need this store to reach the
+# credential that opens it.
+
+path "operators/data/*" {
+  capabilities = ["create", "read", "update", "list"]
+}
+
+path "operators/metadata/*" {
+  capabilities = ["read", "list"]
+}
+
+# Delete is deliberately absent. A credential is retired by writing its
+# successor — KV v2 keeps the prior version, which is the history that did not
+# exist when the LLDAP predecessor was overwritten on 2026-08-27 and lost.
+# Destroying a version is a separate, deliberate act under a broader identity.

openbao/policies/platform-admin.hcl

@@ -45,3 +45,11 @@ path "secret/*" {
 path "tenants/*" {
   capabilities = ["create", "read", "update", "delete", "list"]
 }
+
+# reins/ -- per-rein credential secrets (glas-harness family), mount added
+# 2026-07-27 by ops-mason (MASON-WP-0001-T05). Added here so platform-admin
+# can complete paste-once-provision into any rein's path, matching every
+# other KV mount already listed in this policy.
+path "reins/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}