Require an absolute owner command after attended OpenBao login.

A relative scripts path can fail to spawn after a successful contained
OIDC session, which Warden then revokes. The wrapper now resolves the
command first; T03 records that this attempt did not write the role.

Assistant: grok
Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a

workplans/RPF-WP-0025-openbao-operator-only-access.md

@@ -9,7 +9,7 @@ flavor: implementation
 owner: codex
 topic_slug: railiance
 created: "2026-08-23"
-updated: "2026-09-06"
+updated: "2026-09-15"
 related:
   - RMASTER-WP-0020-T09
   - RAPP-OPENBAO-WP-0002
@@ -108,3 +108,16 @@ The role endpoint has no CAS; exclusive attended administration is still needed.
 Tests cover settings preservation, idempotence, drift, readback failure and
 unexpected roles. No live role update or ingress retraction was performed in
 this follow-up; attended loopback UI login remains the cutover gate.
+
+## Attended retry — 2026-09-15
+
+Plan selected `openbao-platform-admin-login` / `founder_required` / `oidc_login`.
+Contained login reached a helper-backed session, then
+`warden access ... --exec -- scripts/openbao-apply-operator-loopback-callback.sh`
+failed with `attended command could not start; the login session was revoked`.
+That Warden string is OSError spawning the child after successful login, not an
+OIDC or MFA refusal. Relative `scripts/...` is missing unless cwd is this repo;
+the session was revoked and private storage cleaned. No role write, Ingress
+change, or retained helper. Retry only through
+`python3 scripts/openbao-attended-exec.py --` and the absolute owner command.
+Do not reuse the failed relative-path attempt as callback evidence.