Close RPF-WP-0025, WP-0043 T01/T05, WP-0045 T05; retire bao.coulomb.social defaults

- WP-0025-T03 done: public listener retracted 2026-09-15; bao.coulomb.social
  is retired, tunnel is the operator path; DNS withdrawal handed to S1.
- WP-0043-T01 done: ArgoCD Core reconciles railiance01 at main (evidence).
- WP-0043-T05 done: direct-apply gap inventory and founder proposal.
- WP-0045-T05 cancelled (no rollback needed); T06 preconditions recorded.
- Operator scripts default BAO_ADDR to the openbao-ui-railiance01 tunnel.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 150322@bnt-lap001
Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4

scripts/approval-client-delivery-check.py

@@ -52,7 +52,7 @@ def main():
         helper = Path.home()/'.vault-token'
         private(helper, 0o600)
         token = helper.read_text().strip()
-        req = Request('https://bao.coulomb.social/v1/platform/data/workloads/secrets-engine/approval-client?version=1',headers={'X-Vault-Token':token})
+        req = Request(os.environ.get('BAO_ADDR','http://127.0.0.1:18200')+'/v1/platform/data/workloads/secrets-engine/approval-client?version=1',headers={'X-Vault-Token':token})
         with transport(req,timeout=20) as response:
             data = response.read(65537)
         if len(data)>65536:

scripts/audit-core-whitehat-e2-credentials-02.py

@@ -103,7 +103,7 @@ class Operator:
         if not token:
             raise ProcedureError("OpenBao token file is empty")
         self.remote = remote
-        self.bao_env = dict(os.environ, BAO_ADDR="https://bao.coulomb.social", BAO_TOKEN=token)
+        self.bao_env = dict(os.environ, BAO_ADDR=os.environ.get("BAO_ADDR", "http://127.0.0.1:18200"), BAO_TOKEN=token)
 
     def bao(self, args: list[str], *, label: str, input_text: str | None = None, allow_missing: bool = False) -> subprocess.CompletedProcess[str]:
         return safe_run(["bao", *args], label=label, env=self.bao_env, input_text=input_text, allow_missing=allow_missing)

scripts/audit-core-whitehat-e2-credentials.py

@@ -102,7 +102,7 @@ class Operator:
         if not token:
             raise ProcedureError("OpenBao token file is empty")
         self.remote = remote
-        self.bao_env = dict(os.environ, BAO_ADDR="https://bao.coulomb.social", BAO_TOKEN=token)
+        self.bao_env = dict(os.environ, BAO_ADDR=os.environ.get("BAO_ADDR", "http://127.0.0.1:18200"), BAO_TOKEN=token)
 
     def bao(self, args: list[str], *, label: str, input_text: str | None = None, allow_missing: bool = False) -> subprocess.CompletedProcess[str]:
         return safe_run(["bao", *args], label=label, env=self.bao_env, input_text=input_text, allow_missing=allow_missing)

scripts/custody-projection.py

@@ -123,7 +123,7 @@ class Operator:
         self.remote = contract["authority"]["remote"]
         self.bao_env = dict(
             os.environ,
-            BAO_ADDR=os.environ.get("BAO_ADDR", "https://bao.coulomb.social"),
+            BAO_ADDR=os.environ.get("BAO_ADDR", "http://127.0.0.1:18200"),
             BAO_TOKEN=token,
         )
 

scripts/openbao-tune-auth-listing.sh

@@ -46,4 +46,4 @@ for mount in $MOUNTS; do
 done
 
 printf '\nVerify unauthenticated UI mount listing:\n'
-curl -fsS "https://bao.coulomb.social/v1/sys/internal/ui/mounts" | python3 -m json.tool
+curl -fsS "${BAO_ADDR:-http://127.0.0.1:18200}/v1/sys/internal/ui/mounts" | python3 -m json.tool

scripts/verify_coding_agent_approle.py

@@ -13,7 +13,7 @@ import urllib.request
 from typing import Any
 
 
-DEFAULT_ADDR = "https://bao.coulomb.social"
+DEFAULT_ADDR = "http://127.0.0.1:18200"  # openbao-ui-railiance01 tunnel
 DATA_PATH = "platform/data/workloads/issue-core/issue-core/issue-core-runtime"
 METADATA_PATH = (
     "platform/metadata/workloads/issue-core/issue-core/issue-core-runtime"