Add sitting-requester create-only token-exchange proof.

Reader lane login, sibling-path denial, and KeyCape exchange checks.
No sitting POST. Attended wrapper selects the exact OIDC reader role.

Assistant: grok
Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a

scripts/openbao-attended-exec.py

@@ -6,6 +6,12 @@ import shutil
 import sys
 
 
+LANES = (
+    'openbao-platform-admin-login',
+    'informed-decision-sitting-requester-login',
+)
+
+
 def reviewed_command(args):
     if args and args[0] == '--':
         args = args[1:]
@@ -23,6 +29,20 @@ def reviewed_command(args):
     return [str(command), *args[1:]]
 
 
+def parse_argv(argv):
+    args = list(argv)
+    lane = 'openbao-platform-admin-login'
+    if args[:1] == ['--lane']:
+        if len(args) < 2:
+            raise SystemExit('lane required')
+        lane, args = args[1], args[2:]
+    elif args and args[0].startswith('--lane='):
+        lane, args = args[0].split('=', 1)[1], args[1:]
+    if lane not in LANES:
+        raise SystemExit('unsupported attended login lane')
+    return lane, reviewed_command(args)
+
+
 TUNNEL = 'http://127.0.0.1:18200'
 
 
@@ -32,6 +52,7 @@ def contained_env():
     env['VAULT_ADDR'] = TUNNEL
     env.pop('BAO_TOKEN', None)
     env.pop('VAULT_TOKEN', None)
+    env['WARDEN_ROUTING_CATALOG'] = '/home/worsch/ops-warden/registry/routing/catalog.yaml'
     if not any(shutil.which(x) for x in ('xdg-open', 'x-www-browser', 'www-browser')):
         if not Path('/mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe').is_file():
             raise SystemExit('No supported attended browser launcher is available')
@@ -40,8 +61,8 @@ def contained_env():
 
 
 def main():
-    args = reviewed_command(sys.argv[1:])
-    os.execvpe('warden', ['warden', 'access', 'openbao-platform-admin-login', '--exec', '--', *args], contained_env())
+    lane, args = parse_argv(sys.argv[1:])
+    os.execvpe('warden', ['warden', 'access', lane, '--exec', '--', *args], contained_env())
 
 
 if __name__ == '__main__':