Close RPF-WP-0025, WP-0043 T01/T05, WP-0045 T05; retire bao.coulomb.social defaults

- WP-0025-T03 done: public listener retracted 2026-09-15; bao.coulomb.social
  is retired, tunnel is the operator path; DNS withdrawal handed to S1.
- WP-0043-T01 done: ArgoCD Core reconciles railiance01 at main (evidence).
- WP-0043-T05 done: direct-apply gap inventory and founder proposal.
- WP-0045-T05 cancelled (no rollback needed); T06 preconditions recorded.
- Operator scripts default BAO_ADDR to the openbao-ui-railiance01 tunnel.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 150322@bnt-lap001
Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4

workplans/RPF-WP-0025-openbao-operator-only-access.md

@@ -4,12 +4,12 @@ type: workplan
 title: "Retract public OpenBao listener behind operator-only access"
 domain: financials
 repo: railiance-platform
-status: active
+status: finished
 flavor: implementation
 owner: codex
 topic_slug: railiance
 created: "2026-08-23"
-updated: "2026-09-15"
+updated: "2026-09-22"
 related:
   - RMASTER-WP-0020-T09
   - RAPP-OPENBAO-WP-0002
@@ -55,7 +55,7 @@ It deletes only the Ingress and provides an exact rollback path.
 
 ```task
 id: RPF-WP-0025-T03
-status: progress
+status: done
 priority: high
 state_hub_task_id: "8850d742-7cd7-5a1b-ba52-4dbc4bdeba7e"
 ```
@@ -152,3 +152,21 @@ HTTP 404. Evidence:
 Remaining T03: public DNS withdrawal with railiance-infra and non-secret
 acceptance to Railiance Master. Rollback phrase remains available during the
 observation window.
+
+## Closure — 2026-09-22
+
+T03 done. The operator-only cutover is complete on the platform side:
+loopback MFA login passed, and the public Ingress was retracted on 2026-09-15
+(`docs/evidence/2026-09-15-openbao-public-listener-retract.json`). **Intended
+end state: `bao.coulomb.social` is retired.** The named tunnel
+`openbao-ui-railiance01` (`http://127.0.0.1:18200`) is the only operator path,
+and workloads use `openbao.openbao.svc:8200`. No certificate or route will be
+restored for the public name. The dangling DNS record (it still resolves to
+92.205.62.239, where Traefik serves its default certificate and returns 404)
+was handed to its S1 publisher, railiance-infra, for withdrawal. Non-secret
+acceptance went to railiance-master for RMASTER-WP-0020-T09, and the end
+state was sent to user-engine (hub message `e8ccbc2f`). Operator scripts no
+longer default `BAO_ADDR` to the public name. The one exception is
+`scripts/audit-core-database-lease-recovery.py`: the WP-0024 owner-review
+contract pins its digest, so it keeps the old literal until the next owner
+review.