Retract the public OpenBao Ingress after exact operator confirm.

Delete only openbao/openbao-ui-gateway. Private ClusterIP gateway and
named tunnel stay healthy; public hostname returns 404. DNS withdrawal
is handed to railiance-infra.

Assistant: grok
Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a

docs/evidence/2026-09-15-openbao-public-listener-retract.json

@@ -0,0 +1,16 @@
+{
+  "schema": "railiance-platform.openbao-public-listener-retract.v1",
+  "observed_at": "2026-09-15T00:35:25.995371+00:00",
+  "confirm_phrase_used": "RETRACT RMASTER-WP-0020-T09 PUBLIC OPENBAO LISTENER",
+  "operator_login_verified": true,
+  "ingress_name": "openbao/openbao-ui-gateway",
+  "ingress_present_after": false,
+  "public_url": "https://bao.coulomb.social/",
+  "public_http_code": "404",
+  "private_presets_http_code": "200",
+  "gateway_ready_replicas": "1/1",
+  "gateway_service_type": "ClusterIP",
+  "named_tunnel": "openbao-ui-railiance01",
+  "status_ok": true,
+  "credential_values_emitted": false
+}

docs/openbao-public-listener-transition.md

@@ -1,6 +1,8 @@
 # OpenBao public-listener transition
 
-Status: source implementation complete; live retraction held.
+Status: live retraction applied 2026-09-15. Public Ingress absent; private
+ClusterIP gateway and `openbao-ui-railiance01` remain. DNS withdrawal is a
+separate railiance-infra handoff.
 
 This is the S3-owner procedure for `RMASTER-WP-0020-T09`. It preserves the
 OpenBao Deployment, the `openbao-ui-gateway` Deployment, and its ClusterIP