---
id: RAILIANCE-WP-0026
type: workplan
title: "Contain attended OpenBao login output before authentication"
domain: financials
repo: railiance-platform
status: finished
owner: codex
topic_slug: railiance
created: "2026-08-23"
updated: "2026-08-23"
related:
  - RAILIANCE-WP-0024
  - WARDEN-WP-0027
  - WARDEN-WP-0027-T02-DRILL-20260822-01
origin: routed
origin_ref: "State Hub message b3f34c2d-941f-4ddd-b15d-e28075446021"
---

# RAILIANCE-WP-0026 — attended OpenBao login output containment

## Goal

Make the governed `openbao-platform-admin-login` path fail before OIDC unless
it can guarantee isolated private token-helper storage and contain every byte
emitted by the underlying client. A persistence or output-contract failure must
revoke any issued credential without placing its value, accessor, fingerprint,
or derived material in agent-visible output, Git, State Hub, evidence, or logs.

This workplan records the direct fix interface requested by `railiance-infra`.
It does not authorize OIDC authentication, minting, OpenBao administration, a
seal/unseal ceremony, or reuse of the terminal drill scenario.

## Ownership and fixed boundaries

- `railiance-platform` owns the login lane, acceptance contract, and any future
  production rehearsal.
- `ops-warden` owns the current proxy implementation in `src/warden/cli.py`,
  `src/warden/proxy.py`, and its focused tests.
- key-cape remains the OIDC/MFA identity provider; this task does not weaken or
  replace MFA, change the OpenBao role, or introduce root/workload fallback.
- `railiance-infra` is the requesting reviewer and independent abort owner.
- Risk Nexus owns grading of State Hub filing request
  `5a344f53-14e9-4230-8874-2f01b0a85700`.
- State Hub GO decision `449a697a-5303-4582-aa9e-b0bc8b35ab2d` was consumed by
  NO-GO decision `85724c0c-e70f-4e2f-a8c6-a9cb1ea6331b`. Neither decision nor
  scenario `WARDEN-WP-0027-T02-DRILL-20260822-01` may be reused.

## T01 — Harden the attended-login adapter and prove failure containment

```task
id: RAILIANCE-WP-0026-T01
status: done
priority: high
```

Implement the fix in `ops-warden` and return one value-safe owner receipt to
`railiance-platform` and `railiance-infra` naming the source revision, focused
test command/result, and the five acceptance outcomes below. The receipt must
contain no credential, accessor, fingerprint, output excerpt, callback code,
or token-helper contents.

Acceptance is all of the following:

1. An isolated writable token-helper location is created before authentication,
   has mode `0600` (with private parent directories), and is removed or revoked
   through a deterministic cleanup path.
2. A read-only or otherwise unusable default home fails before OIDC begins; the
   adapter never discovers persistence failure only after credential issuance.
3. Adapter-owned stdout and stderr containment guarantees that no credential
   reaches agent-visible output even if the underlying CLI violates
   `-no-print`. Inherited agent-visible stdio is not permitted for this lane.
4. Unexpected credential-bearing or otherwise non-allowlisted output fails
   closed and, whenever issuance may have occurred, triggers immediate
   self-revocation through the contained process without logging, returning,
   hashing, or fingerprinting the value.
5. Focused tests cover successful attended-login handoff, unwritable/default
   home refusal before authentication, helper persistence failure, unexpected
   stdout, unexpected stderr, immediate revocation, cleanup, and value absence
   from captured test and audit output.

The implementation must also update the `openbao-platform-admin-login` worker
playbook and catalog comment so they no longer claim safety from `-no-print`
alone. A non-production test double must prove the complete failure path before
any new live OIDC rehearsal is proposed.

Done when the implementation is committed and pushed in `ops-warden`, the
focused suite passes, the value-safe owner receipt is delivered directly to
both reviewers, and `railiance-platform` accepts the exact revision. Completion
of this task still does not authorize a live drill; that requires fresh owner
receipts, current preflight, and a new human decision under a new scenario id.

Completed 2026-08-23. Railiance Platform accepts ops-warden revision
`0fae0904ce8d8694338dd53a8a79abec5fec788d`. The committed owner receipt at
ops-warden revision `bc1966da825fbeaa4d83947a4f942b5d5f085408` has SHA-256
`d2ba444ed16989590325697e69d25283dc75a9432c29a72e627e80bf9fd987e4`,
reports 42 focused tests and 390 repository tests passing, and records all
seven containment outcomes without sensitive material. Independent
railiance-infra review at revision `186b030` approves the same implementation.
This is source acceptance only and authorizes no live OIDC or drill.

## Acceptance

- [x] The adapter refuses unsafe storage before OIDC.
- [x] No underlying login output can reach the agent transcript.
- [x] Any issued credential is contained and revoked on failure.
- [x] Focused success and failure-path tests pass without credential material.
- [x] Both direct reviewers receive and accept the value-safe fix receipt.