feat(RAILIANCE-WP-0027): prepare operator-only OpenBao access

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02b90-83bf-75c2-81c8-aa705414e4d4

workplans/RAILIANCE-WP-0027-openbao-operator-only-access.md

@@ -0,0 +1,66 @@
+---
+id: RAILIANCE-WP-0027
+type: workplan
+title: "Retract public OpenBao listener behind operator-only access"
+domain: financials
+repo: railiance-platform
+status: blocked
+owner: codex
+topic_slug: railiance
+created: "2026-08-23"
+updated: "2026-08-23"
+related:
+  - RMASTER-WP-0020-T09
+  - RAPP-OPENBAO-WP-0002
+---
+
+# RAILIANCE-WP-0027 — OpenBao operator-only access
+
+## Goal
+
+Implement the S3-owner half of RMASTER-WP-0020-T09 without coupling it to
+destructive CoulombCore cleanup.
+
+## T01 — Align the retained compatibility source
+
+```task
+id: RAILIANCE-WP-0027-T01
+status: done
+priority: high
+```
+
+The retained platform manifest now matches the canonical package posture:
+Deployment plus ClusterIP Service only. Ordinary deploy no longer applies the
+public-only middleware. The old Ingress remains solely in an explicitly named
+rollback artifact.
+
+## T02 — Add guarded retraction and rollback
+
+```task
+id: RAILIANCE-WP-0027-T02
+status: done
+priority: high
+```
+
+`scripts/openbao-public-listener-transition.sh` pins the cluster UID, verifies
+source and runtime packet posture, requires a lifecycle-healthy named tunnel,
+and gates live deletion on exact confirmation plus attended-login verification.
+It deletes only the Ingress and provides an exact rollback path.
+
+## T03 — Complete the attended operator cutover
+
+```task
+id: RAILIANCE-WP-0027-T03
+status: wait
+priority: high
+```
+
+Blocked on two facts: KeyCape and the OpenBao role must accept the exact
+loopback callback, and an attended MFA login must pass. The host-namespace
+preflight already proves `openbao-ui-railiance01` lifecycle-healthy and reaches
+the expected overlay. Then execute the guarded retraction, coordinate public
+DNS withdrawal with railiance-infra, and return non-secret acceptance evidence
+to Railiance Master.
+
+This workplan authorizes no OpenBao seal/unseal, policy broadening, PVC or
+Secret mutation, reboot, restore, or RMASTER-WP-0020-T08 cleanup.