Advance blocked assurance and operator callback work

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

workplans/RPF-WP-0025-openbao-operator-only-access.md

@@ -8,7 +8,7 @@ status: blocked
 owner: codex
 topic_slug: railiance
 created: "2026-08-23"
-updated: "2026-09-05"
+updated: "2026-09-06"
 related:
   - RMASTER-WP-0020-T09
   - RAPP-OPENBAO-WP-0002
@@ -96,3 +96,14 @@ issuer callback, ops-bridge the tunnel, and S1/S2 DNS/network primitives.
 Unblock with a fresh attended OIDC/MFA callback update and loopback login,
 then the guarded retraction and owner-specific DNS handoff. Existing source
 readiness is not evidence of a completed live cutover.
+
+## Callback preservation repair — 2026-09-06
+
+T03 advanced locally: the attended callback helper now reads and preserves the
+existing platform-admin role, appends only the exact loopback callback, skips
+writes when already present, detects observed drift before writing, and verifies
+all settings on readback. `--check-only` is silent and returns 3 if absent.
+The role endpoint has no CAS; exclusive attended administration is still needed.
+Tests cover settings preservation, idempotence, drift, readback failure and
+unexpected roles. No live role update or ingress retraction was performed in
+this follow-up; attended loopback UI login remains the cutover gate.