Record platform-admin loopback callback already present.

Attended helper returned already_present and Warden exited 0. Public
Ingress is unchanged; UI login at 127.0.0.1:18200 still gates retraction.

Assistant: grok
Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a

docs/evidence/2026-09-15-openbao-loopback-callback-already-present.json

@@ -0,0 +1,12 @@
+{
+  "schema": "railiance-platform.openbao-loopback-callback.v1",
+  "observed_at": "2026-09-15T00:25:52.017810+00:00",
+  "role": "auth/netkingdom/role/platform-admin",
+  "callback": "http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback",
+  "status": "already_present",
+  "changed": false,
+  "credential_values_emitted": false,
+  "warden_exit": 0,
+  "session_revoked_by_envelope": true,
+  "ingress_mutated": false
+}

workplans/RPF-WP-0025-openbao-operator-only-access.md

@@ -131,3 +131,12 @@ required exact dict equality; that path was never live-proven and can fail on
 read-only/normalized fields. No retained helper. Retry uses the same envelope
 with `--receipt` and a field-preserving write. Do not retract Ingress from this
 failed attempt.
+
+Third attended attempt, 2026-09-15T00:25:52Z: Warden exit 0. Receipt status
+`already_present` for
+`http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback` on
+`auth/netkingdom/role/platform-admin`. No role write. Session revoked by the
+envelope. Public Ingress still present. CLI `bao login` used the contained
+OIDC callback, not the UI loopback origin. T03 still needs one MFA login at
+`http://127.0.0.1:18200` before guarded retraction. Evidence:
+`docs/evidence/2026-09-15-openbao-loopback-callback-already-present.json`.