Prune retired bao.coulomb.social callbacks from platform-admin; declare OIDC mount config

Attended run 2026-09-23T23:11Z: status pruned, tunnel callback kept, all
other role settings preserved and verified on readback. Declarations now
match live; railiance-platform owns the mount config.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 150322@bnt-lap001
Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4

docs/evidence/2026-09-24-platform-admin-callback-prune.json

@@ -0,0 +1,41 @@
+{
+  "allowed_redirect_uris": [
+    "http://localhost:8250/oidc/callback",
+    "http://127.0.0.1:8250/oidc/callback",
+    "http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback"
+  ],
+  "changed": true,
+  "credential_values_emitted": false,
+  "mount_configs": {
+    "keycape": {
+      "bound_issuer": "",
+      "default_role": "platform-admin",
+      "jwt_supported_algs": [],
+      "namespace_in_state": true,
+      "oidc_client_id": "openbao-admin",
+      "oidc_discovery_url": "https://kc.coulomb.social",
+      "oidc_response_mode": "",
+      "oidc_response_types": [],
+      "provider_config": {}
+    },
+    "netkingdom": {
+      "bound_issuer": "",
+      "default_role": "platform-admin",
+      "jwt_supported_algs": [],
+      "namespace_in_state": true,
+      "oidc_client_id": "openbao-admin",
+      "oidc_discovery_url": "https://kc.coulomb.social",
+      "oidc_response_mode": "",
+      "oidc_response_types": [],
+      "provider_config": {}
+    }
+  },
+  "observed_at": "2026-09-23T23:11:14.580944+00:00",
+  "retired": [
+    "https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback",
+    "https://bao.coulomb.social/ui/vault/auth/keycape/oidc/callback"
+  ],
+  "role": "auth/netkingdom/role/platform-admin",
+  "schema": "railiance-platform.openbao-callback-prune.v1",
+  "status": "pruned"
+}

docs/openbao.md

@@ -400,8 +400,13 @@ Declared state of the administrator login (verified live 2026-09-23,
 
 - role `auth/netkingdom/role/platform-admin`:
   `openbao/auth/netkingdom-platform-admin-role.json`. It is written by
-  net-kingdom `sso-mfa/k8s/keycape/configure-openbao-oidc.sh`, which lacks
-  `operator-custody` and still lists retired `bao.coulomb.social` callbacks.
+  railiance-platform only. Since net-kingdom `a356f64`, its
+  `configure-openbao-oidc.sh` no longer writes the role. The retired
+  `bao.coulomb.social` callbacks were pruned on 2026-09-23
+  (`docs/evidence/2026-09-24-platform-admin-callback-prune.json`).
+- OIDC mount config: `openbao/auth/netkingdom-oidc-config.json` and
+  `openbao/auth/keycape-oidc-config.json`, owned by railiance-platform. The
+  compatibility `oidc_client_secret` is not declared.
 - policies `openbao/policies/platform-admin.hcl` and
   `openbao/policies/operator-custody.hcl`, plus the built-in `default`
   (`token_no_default_policy: false`). `default` grants `auth/token/revoke-self`