---
id: RAILIANCE-WP-0027
type: workplan
title: "Retract public OpenBao listener behind operator-only access"
domain: financials
repo: railiance-platform
status: blocked
owner: codex
topic_slug: railiance
created: "2026-08-23"
updated: "2026-08-23"
related:
  - RMASTER-WP-0020-T09
  - RAPP-OPENBAO-WP-0002
state_hub_workstream_id: "6f8a6cbc-c076-5f0a-ade2-281a7ec71360"
---

# RAILIANCE-WP-0027 — OpenBao operator-only access

## Goal

Implement the S3-owner half of RMASTER-WP-0020-T09 without coupling it to
destructive CoulombCore cleanup.

## T01 — Align the retained compatibility source

```task
id: RAILIANCE-WP-0027-T01
status: done
priority: high
state_hub_task_id: "d84fb3fd-2166-58a0-81d9-2141ca55a67d"
```

The retained platform manifest now matches the canonical package posture:
Deployment plus ClusterIP Service only. Ordinary deploy no longer applies the
public-only middleware. The old Ingress remains solely in an explicitly named
rollback artifact.

## T02 — Add guarded retraction and rollback

```task
id: RAILIANCE-WP-0027-T02
status: done
priority: high
state_hub_task_id: "149fdec9-6735-514e-aad1-0c2daf72d27a"
```

`scripts/openbao-public-listener-transition.sh` pins the cluster UID, verifies
source and runtime packet posture, requires a lifecycle-healthy named tunnel,
and gates live deletion on exact confirmation plus attended-login verification.
It deletes only the Ingress and provides an exact rollback path.

## T03 — Complete the attended operator cutover

```task
id: RAILIANCE-WP-0027-T03
status: wait
priority: high
state_hub_task_id: "99f8b41f-e9db-579d-a6fb-b71337048afc"
```

Blocked on two facts: KeyCape and the OpenBao role must accept the exact
loopback callback, and an attended MFA login must pass. The host-namespace
preflight already proves `openbao-ui-railiance01` lifecycle-healthy and reaches
the expected overlay. Then execute the guarded retraction, coordinate public
DNS withdrawal with railiance-infra, and return non-secret acceptance evidence
to Railiance Master.

This workplan authorizes no OpenBao seal/unseal, policy broadening, PVC or
Secret mutation, reboot, restore, or RMASTER-WP-0020-T08 cleanup.