feat(RAILIANCE-WP-0027): prepare operator-only OpenBao access

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02b90-83bf-75c2-81c8-aa705414e4d4

workplans/RAILIANCE-WP-0026-attended-login-output-containment.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Contain attended OpenBao login output before authentication"
 domain: financials
 repo: railiance-platform
-status: ready
+status: finished
 owner: codex
 topic_slug: railiance
 created: "2026-08-23"
@@ -50,7 +50,7 @@ seal/unseal ceremony, or reuse of the terminal drill scenario.
 
 ```task
 id: RAILIANCE-WP-0026-T01
-status: todo
+status: done
 priority: high
 ```
 
@@ -90,10 +90,19 @@ both reviewers, and `railiance-platform` accepts the exact revision. Completion
 of this task still does not authorize a live drill; that requires fresh owner
 receipts, current preflight, and a new human decision under a new scenario id.
 
+Completed 2026-08-23. Railiance Platform accepts ops-warden revision
+`0fae0904ce8d8694338dd53a8a79abec5fec788d`. The committed owner receipt at
+ops-warden revision `bc1966da825fbeaa4d83947a4f942b5d5f085408` has SHA-256
+`d2ba444ed16989590325697e69d25283dc75a9432c29a72e627e80bf9fd987e4`,
+reports 42 focused tests and 390 repository tests passing, and records all
+seven containment outcomes without sensitive material. Independent
+railiance-infra review at revision `186b030` approves the same implementation.
+This is source acceptance only and authorizes no live OIDC or drill.
+
 ## Acceptance
 
-- [ ] The adapter refuses unsafe storage before OIDC.
-- [ ] No underlying login output can reach the agent transcript.
-- [ ] Any issued credential is contained and revoked on failure.
-- [ ] Focused success and failure-path tests pass without credential material.
-- [ ] Both direct reviewers receive and accept the value-safe fix receipt.
+- [x] The adapter refuses unsafe storage before OIDC.
+- [x] No underlying login output can reach the agent transcript.
+- [x] Any issued credential is contained and revoked on failure.
+- [x] Focused success and failure-path tests pass without credential material.
+- [x] Both direct reviewers receive and accept the value-safe fix receipt.

workplans/RAILIANCE-WP-0027-openbao-operator-only-access.md

@@ -0,0 +1,66 @@
+---
+id: RAILIANCE-WP-0027
+type: workplan
+title: "Retract public OpenBao listener behind operator-only access"
+domain: financials
+repo: railiance-platform
+status: blocked
+owner: codex
+topic_slug: railiance
+created: "2026-08-23"
+updated: "2026-08-23"
+related:
+  - RMASTER-WP-0020-T09
+  - RAPP-OPENBAO-WP-0002
+---
+
+# RAILIANCE-WP-0027 — OpenBao operator-only access
+
+## Goal
+
+Implement the S3-owner half of RMASTER-WP-0020-T09 without coupling it to
+destructive CoulombCore cleanup.
+
+## T01 — Align the retained compatibility source
+
+```task
+id: RAILIANCE-WP-0027-T01
+status: done
+priority: high
+```
+
+The retained platform manifest now matches the canonical package posture:
+Deployment plus ClusterIP Service only. Ordinary deploy no longer applies the
+public-only middleware. The old Ingress remains solely in an explicitly named
+rollback artifact.
+
+## T02 — Add guarded retraction and rollback
+
+```task
+id: RAILIANCE-WP-0027-T02
+status: done
+priority: high
+```
+
+`scripts/openbao-public-listener-transition.sh` pins the cluster UID, verifies
+source and runtime packet posture, requires a lifecycle-healthy named tunnel,
+and gates live deletion on exact confirmation plus attended-login verification.
+It deletes only the Ingress and provides an exact rollback path.
+
+## T03 — Complete the attended operator cutover
+
+```task
+id: RAILIANCE-WP-0027-T03
+status: wait
+priority: high
+```
+
+Blocked on two facts: KeyCape and the OpenBao role must accept the exact
+loopback callback, and an attended MFA login must pass. The host-namespace
+preflight already proves `openbao-ui-railiance01` lifecycle-healthy and reaches
+the expected overlay. Then execute the guarded retraction, coordinate public
+DNS withdrawal with railiance-infra, and return non-secret acceptance evidence
+to Railiance Master.
+
+This workplan authorizes no OpenBao seal/unseal, policy broadening, PVC or
+Secret mutation, reboot, restore, or RMASTER-WP-0020-T08 cleanup.