From 66277450e334ab705a45cb4b2124a83fa3ab9f09 Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Tue, 15 Sep 2026 02:27:09 +0200
Subject: [PATCH] Record platform-admin loopback callback already present.

Attended helper returned already_present and Warden exited 0. Public
Ingress is unchanged; UI login at 127.0.0.1:18200 still gates retraction.

Assistant: grok
Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a
---
 ...15-openbao-loopback-callback-already-present.json | 12 ++++++++++++
 .../RPF-WP-0025-openbao-operator-only-access.md      |  9 +++++++++
 2 files changed, 21 insertions(+)
 create mode 100644 docs/evidence/2026-09-15-openbao-loopback-callback-already-present.json

diff --git a/docs/evidence/2026-09-15-openbao-loopback-callback-already-present.json b/docs/evidence/2026-09-15-openbao-loopback-callback-already-present.json
new file mode 100644
index 0000000..d051928
--- /dev/null
+++ b/docs/evidence/2026-09-15-openbao-loopback-callback-already-present.json
@@ -0,0 +1,12 @@
+{
+  "schema": "railiance-platform.openbao-loopback-callback.v1",
+  "observed_at": "2026-09-15T00:25:52.017810+00:00",
+  "role": "auth/netkingdom/role/platform-admin",
+  "callback": "http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback",
+  "status": "already_present",
+  "changed": false,
+  "credential_values_emitted": false,
+  "warden_exit": 0,
+  "session_revoked_by_envelope": true,
+  "ingress_mutated": false
+}
diff --git a/workplans/RPF-WP-0025-openbao-operator-only-access.md b/workplans/RPF-WP-0025-openbao-operator-only-access.md
index 9c8bad1..294f528 100644
--- a/workplans/RPF-WP-0025-openbao-operator-only-access.md
+++ b/workplans/RPF-WP-0025-openbao-operator-only-access.md
@@ -131,3 +131,12 @@ required exact dict equality; that path was never live-proven and can fail on
 read-only/normalized fields. No retained helper. Retry uses the same envelope
 with `--receipt` and a field-preserving write. Do not retract Ingress from this
 failed attempt.
+
+Third attended attempt, 2026-09-15T00:25:52Z: Warden exit 0. Receipt status
+`already_present` for
+`http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback` on
+`auth/netkingdom/role/platform-admin`. No role write. Session revoked by the
+envelope. Public Ingress still present. CLI `bao login` used the contained
+OIDC callback, not the UI loopback origin. T03 still needs one MFA login at
+`http://127.0.0.1:18200` before guarded retraction. Evidence:
+`docs/evidence/2026-09-15-openbao-loopback-callback-already-present.json`.