Refuse OpenBao deploys from the retained copy and point operators to rapp-openbao.

openbao-deploy and openbao-overlay-apply now exit 2 without calling kubectl
or helm. The two copies had drifted in both directions, so a deploy from
either one reverted the other's changes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 236506@bnt-lap001
Assistant-Session: 09087018-91e1-48c5-ab2f-acfbb62c92e4

Makefile

@@ -199,24 +199,23 @@ openbao-dry-run: openbao-repo ## Render the OpenBao Helm release without applyin
 		-f $(OPENBAO_VALUES) \
 		--dry-run
 
-openbao-overlay-apply: ## Apply KeyCape login overlay gateway and assets
-	OPENBAO_UI_OVERLAY_DIR=$(OPENBAO_UI_OVERLAY_DIR) \
-	  OPENBAO_UI_OVERLAY_K8S=$(OPENBAO_UI_OVERLAY_K8S) \
-	  KUBECTL='$(KUBECTL)' OPENBAO_NAMESPACE=$(OPENBAO_NAMESPACE) \
-	  scripts/openbao-ui-overlay-apply.sh
+# The OpenBao package (Helm values, UI overlay, gateway) is owned by
+# rapp-openbao. The copies here are retained for reference only; two deployable
+# copies drifted apart and one deploy undid the other's changes (RPF-WP-0057).
+# These targets refuse.
+RAPP_OPENBAO_REFUSAL = echo '$@ is owned by rapp-openbao; the copy in railiance-platform is retained only and must not be applied.' >&2; \
+	echo 'Run it from the canonical repo instead:  cd ~/rapp-openbao && make $@' >&2; \
+	echo 'See docs/rapp-openbao-compatibility-handoff.md.' >&2; exit 2
+
+openbao-overlay-apply: ## Refuses: the overlay is applied from rapp-openbao
+	@$(RAPP_OPENBAO_REFUSAL)
 
 openbao-verify-login-overlay: ## Verify public KeyCape login overlay is active
 	OPENBAO_UI_OVERLAY_DIR=$(OPENBAO_UI_OVERLAY_DIR) \
 	  scripts/openbao-verify-login-overlay.sh $(OPENBAO_VERIFY_LOGIN_OVERLAY_ARGS)
 
-openbao-deploy: openbao-repo ## Deploy / upgrade OpenBao to the openbao namespace
-	$(KUBECTL) create namespace $(OPENBAO_NAMESPACE) --dry-run=client -o yaml | $(KUBECTL) apply -f -
-	$(HELM) upgrade --install $(OPENBAO_RELEASE) openbao/openbao \
-		--version $(OPENBAO_CHART_VERSION) \
-		--namespace $(OPENBAO_NAMESPACE) \
-		-f $(OPENBAO_VALUES) \
-		--wait --timeout 5m
-	$(MAKE) openbao-overlay-apply
+openbao-deploy: ## Refuses: OpenBao is deployed from rapp-openbao
+	@$(RAPP_OPENBAO_REFUSAL)
 
 .PHONY: openbao-public-listener-dry-run openbao-public-listener-status openbao-public-listener-retract openbao-public-listener-rollback
 

WORK-RECORDS.md

@@ -179,6 +179,7 @@
 | task | RPF-WP-0057-T02 | done | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md |
 | task | RPF-WP-0057-T03 | done | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md |
 | task | RPF-WP-0057-T04 | progress | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md |
+| task | RPF-WP-0057-T05 | done | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md |
 | task | RPF-WP-0058-T01 | done | — | workplans/RPF-WP-0058-reuse-private-source-reader.md |
 | task | RPF-WP-0058-T02 | done | — | workplans/RPF-WP-0058-reuse-private-source-reader.md |
 | task | RPF-WP-0058-T03 | done | — | workplans/RPF-WP-0058-reuse-private-source-reader.md |

assurance/ownership-handoffs.json

@@ -54,11 +54,11 @@
         },
         {
           "path": "scripts/openbao-verify-login-overlay.sh",
-          "sha256": "57438714f1b7aac0c37b8bdf525c5387f812a6d30532bb98b395e5db5208ad6d"
+          "sha256": "44435af01da60f08228a07d547a5dc8941f848eaf2a1baf9b79a83845b6defdc"
         },
         {
           "path": "docs/rapp-openbao-compatibility-handoff.md",
-          "sha256": "65ff0b39ee7312c8a242d24cf3434f9d0636a830e841f1a70de560c96cd8d57f"
+          "sha256": "415f08f111b98ebb4a0cdd3906acf915a0f1c9854bd364d078aac151dd9d354f"
         }
       ],
       "acceptance": "Owner names canonical replacements; update all callers and prove dry-run/smoke and rollback before source removal. No external acceptance asserted."

docs/openbao.md

@@ -55,9 +55,14 @@ Platform operators with approved admin identity
 The official OpenBao project recommends the Helm chart for Kubernetes
 deployments and warns to run Helm with `--dry-run` before install or upgrade.
 
-From a host with kubeconfig access:
+The OpenBao package is deployed from `rapp-openbao`, its canonical owner.
+In this repo `make openbao-deploy` and `make openbao-overlay-apply` refuse,
+because the retained copies here have fallen behind (see
+`docs/rapp-openbao-compatibility-handoff.md`). From a host with operator
+kubeconfig access:
 
 ```bash
+cd ~/rapp-openbao
 make openbao-dry-run
 make openbao-deploy
 make openbao-status
@@ -72,7 +77,7 @@ retraction and rollback are separate guarded commands documented in
 On Railiance01 directly:
 
 ```bash
-cd ~/railiance-platform
+cd ~/rapp-openbao
 sudo env KUBECONFIG=/etc/rancher/k3s/k3s.yaml make openbao-dry-run
 sudo env KUBECONFIG=/etc/rancher/k3s/k3s.yaml make openbao-deploy
 sudo env KUBECONFIG=/etc/rancher/k3s/k3s.yaml make openbao-status
@@ -607,9 +612,11 @@ mount path: netkingdom
 role: platform-admin
 ```
 
-Deploy or refresh the overlay:
+Deploy or refresh the overlay from `rapp-openbao`; the copy here is retained
+only:
 
 ```bash
+cd ~/rapp-openbao
 make openbao-overlay-apply
 make openbao-verify-login-overlay
 make openbao-verify-login-overlay OPENBAO_VERIFY_LOGIN_OVERLAY_ARGS=--check-upstream-drift
@@ -866,7 +873,7 @@ existing env/file reference contract.
 2. Update `OPENBAO_CHART_VERSION` in `Makefile`.
 3. Run `make openbao-dry-run`.
 4. Confirm current backup and audit log posture.
-5. Run `make openbao-deploy`.
+5. Run `make openbao-deploy` from `rapp-openbao`.
 6. Run `make openbao-status`.
 
 For rollback, run `helm rollback openbao <REVISION> -n openbao` on Railiance01

docs/rapp-openbao-compatibility-handoff.md

@@ -52,6 +52,16 @@ If package-owned behavior changes:
    operators or automation still depend on it; and
 3. avoid evolving the platform copy independently.
 
+Since 2026-11-03 the write targets `openbao-deploy` and
+`openbao-overlay-apply` in `railiance-platform` refuse and point to
+`rapp-openbao`. Two changes had landed only in the platform copy: the
+RPF-WP-0057 workload-role login choice and the RPF-WP-0063 gateway CPU
+request. Meanwhile the package copy gained the RAPP-OPENBAO-WP-0003
+break-glass listener. A package deploy then reverted the live UI, and a
+platform deploy would have removed the listener. Both changes are now in
+`rapp-openbao` (RAPP-OPENBAO-WP-ADHOC-2026-11-03). Read-only targets, such as
+`openbao-verify-login-overlay`, still run here.
+
 ## What Stays In `railiance-platform`
 
 The handoff does not expand the package boundary.

helm/openbao-ui-overlay/README.md

@@ -1,5 +1,11 @@
 # OpenBao KeyCape login overlay
 
+> **Retained copy.** The canonical overlay is in `rapp-openbao`
+> (`helm/openbao-ui-overlay/`). Change it there first. This repo's
+> `make openbao-overlay-apply` and `make openbao-deploy` refuse. Two
+> deployable copies drifted apart, and on 2026-10-27 a deploy of the other
+> copy removed this one's workload-role choice from the live UI (RPF-WP-0057).
+
 Streamlines the browser login mask reached through the named
 `openbao-ui-railiance01` operator tunnel at `http://127.0.0.1:18200` to a
 single **Sign in with KeyCape** action. Namespace, auth method, mount path, and
@@ -47,7 +53,7 @@ behaviour.
 
 ## Deploy
 
-From `railiance-platform`:
+From `rapp-openbao` (the targets here refuse):
 
 ```bash
 make openbao-overlay-apply   # overlay only

layer.yaml

@@ -111,7 +111,7 @@ tooling_contacts:
 
   - id: openbao-service-operation
     shape: "5.3"
-    module: Makefile (openbao-deploy, openbao-overlay-apply), helm/openbao-values.yaml
+    module: rapp-openbao Makefile (openbao-deploy, openbao-overlay-apply), rapp-openbao helm/openbao-values.yaml; the railiance-platform targets refuse
     tooling: OpenBao
     operation: "helm upgrade of the OpenBao release; unseal and snapshot procedures"
     write: true

tests/test_openbao_retained_guard.py

@@ -0,0 +1,34 @@
+"""The retained OpenBao package copy must not be applied from this repo.
+
+rapp-openbao owns the package. Two deployable copies drifted apart, and a
+deploy of one undid the other's changes (RPF-WP-0057). The write targets here
+refuse before running kubectl or helm.
+"""
+import os
+import pathlib
+import subprocess
+
+import pytest
+
+ROOT = pathlib.Path(__file__).resolve().parents[1]
+
+
+@pytest.mark.parametrize("target", ["openbao-overlay-apply", "openbao-deploy"])
+def test_write_target_refuses_without_touching_cluster(target, tmp_path):
+    marker = tmp_path / "called"
+    fake = tmp_path / "fake"
+    fake.write_text(f"#!/bin/sh\ntouch {marker}\n")
+    fake.chmod(0o755)
+    env = dict(os.environ, KUBECTL_BIN=str(fake), HELM=str(fake), KUBECONFIG=str(tmp_path / "none"))
+    result = subprocess.run(["make", "-s", target], cwd=ROOT, env=env, capture_output=True, text=True)
+    assert result.returncode != 0
+    assert "owned by rapp-openbao" in result.stderr
+    assert f"cd ~/rapp-openbao && make {target}" in result.stderr
+    assert not marker.exists()
+
+
+def test_dry_run_and_prerequisites_do_not_reach_the_write_path():
+    text = (ROOT / "Makefile").read_text()
+    for target in ("openbao-overlay-apply", "openbao-deploy"):
+        line = next(l for l in text.splitlines() if l.startswith(target + ":"))
+        assert line.split(":", 1)[1].split("##")[0].strip() == "", line

workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md

@@ -123,3 +123,33 @@ the older copy. The change is now ported there (`rapp-openbao` `32d6e92`,
 RAPP-OPENBAO-WP-ADHOC-2026-11-03). Future overlay changes must land in
 `rapp-openbao` first. T04 still needs the overlay applied from `rapp-openbao`,
 a passing verifier, and the attended clickthrough of both role controls.
+
+2026-11-03: the founder applied the overlay from `rapp-openbao` with the
+operator kubeconfig. `make openbao-verify-login-overlay` passes again, and the
+live login assets match `rapp-openbao`. The attended clickthrough of both role
+controls is still open.
+
+## Stop the retained OpenBao copy from deploying
+
+```task
+id: RPF-WP-0057-T05
+status: done
+priority: high
+```
+
+`make openbao-deploy` and `make openbao-overlay-apply` in this repo now
+refuse with exit 2 and point to `cd ~/rapp-openbao && make <target>`; they
+call no kubectl or helm. They have no prerequisites, so `openbao-repo` does
+not run either. Test: `tests/test_openbao_retained_guard.py`. Each copy had
+changes the other lacked:
+- here: the 0057 overlay and the RPF-WP-0063 10m gateway CPU request;
+- `rapp-openbao`: the RAPP-OPENBAO-WP-0003 break-glass listener.
+A deploy from here would therefore have removed the listener. Both
+platform-only changes are now ported (`rapp-openbao` `32d6e92`, `004ca55`). The live
+gateway is back at 25m until the founder re-applies from `rapp-openbao`
+(RAPP-OPENBAO-WP-ADHOC-2026-11-03-T03). `docs/openbao.md`, the overlay README,
+`docs/rapp-openbao-compatibility-handoff.md` and `layer.yaml` now name
+`rapp-openbao`, and the `openbao-package` pins in
+`assurance/ownership-handoffs.json` are refreshed. Read-only targets still run
+here. Retained files are not deleted. Automating the attended apply is
+deferred by founder decision; the founder deploys.