From e415da97f353615068fbcf6b29ae7319a68a4fd3 Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Tue, 20 Oct 2026 20:34:47 +0200
Subject: [PATCH] OpenBao agt-role: allow permit-pty extension for
 agt-custodian (CUST-WP-0073-T02, WARDEN-WP-0045)

Without allowed_extensions, OpenBao refuses warden's explicit
extensions={permit-pty} request for the supervised agent profile.
Applied later through scripts/openbao-apply-ssh-engine.sh (attended).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 605711@bnt-lap001
Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61
---
 openbao/ssh/roles-spec.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/openbao/ssh/roles-spec.yaml b/openbao/ssh/roles-spec.yaml
index 1ccb34f..0523143 100644
--- a/openbao/ssh/roles-spec.yaml
+++ b/openbao/ssh/roles-spec.yaml
@@ -18,6 +18,8 @@ roles:
     allow_user_certificates: true
     allow_user_key_ids: true
     default_user: agt
+    # CUST-WP-0073 / WARDEN-WP-0045: agt-custodian requests permit-pty explicitly.
+    allowed_extensions: "permit-pty"
     ttl: 24h
     max_ttl: 24h
   atm-role: