Phase A restored and verified, break-glass drill done. Phase B source
preparation (former T09, cancelled here) moves to RPF-WP-0073 as backlog,
parked against net-kingdom NK-WP-0049-T44 per founder decision 2026-10-27.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 509845@bnt-lap001
Assistant-Session: ed7a7d95-d8eb-455c-b594-963fb1830f76
Networkless disposable Docker target (--network none, read-only, tmpfs only,
no volumes/ports/kubeconfig), metadata-only preflight before any prompt,
SSH-signed admission in namespace railiance-openbao-restore-attempt, hidden
custody prompts with sealed memfds, throwaway init + forced Raft restore from
stdin, original-share unseal, generate-root readback credential (revoked),
metadata-only readback against committed sources, reaper for parent loss and
hard deadline. Original material refuses until T06 sets the image digest pin.
Fix stale v2.5.3 app version in docs/openbao.md.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4384@bnt-lap001
Assistant-Session: 80d1f3da-7a91-4519-9737-9ba128b4da64
