railiance-platform/workplans/RAILIANCE-WP-0026-attended-login-output-containment.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	related	origin	origin_ref
RAILIANCE-WP-0026	workplan	Contain attended OpenBao login output before authentication	financials	railiance-platform	ready	codex	railiance	2026-08-23	2026-08-23	RAILIANCE-WP-0024 WARDEN-WP-0027 WARDEN-WP-0027-T02-DRILL-20260822-01	routed	State Hub message b3f34c2d-941f-4ddd-b15d-e28075446021

RAILIANCE-WP-0026 — attended OpenBao login output containment

Goal

Make the governed openbao-platform-admin-login path fail before OIDC unless it can guarantee isolated private token-helper storage and contain every byte emitted by the underlying client. A persistence or output-contract failure must revoke any issued credential without placing its value, accessor, fingerprint, or derived material in agent-visible output, Git, State Hub, evidence, or logs.

This workplan records the direct fix interface requested by railiance-infra. It does not authorize OIDC authentication, minting, OpenBao administration, a seal/unseal ceremony, or reuse of the terminal drill scenario.

Ownership and fixed boundaries

• railiance-platform owns the login lane, acceptance contract, and any future production rehearsal.
• ops-warden owns the current proxy implementation in src/warden/cli.py, src/warden/proxy.py, and its focused tests.
• key-cape remains the OIDC/MFA identity provider; this task does not weaken or replace MFA, change the OpenBao role, or introduce root/workload fallback.
• railiance-infra is the requesting reviewer and independent abort owner.
• Risk Nexus owns grading of State Hub filing request 5a344f53-14e9-4230-8874-2f01b0a85700.
• State Hub GO decision 449a697a-5303-4582-aa9e-b0bc8b35ab2d was consumed by NO-GO decision 85724c0c-e70f-4e2f-a8c6-a9cb1ea6331b. Neither decision nor scenario WARDEN-WP-0027-T02-DRILL-20260822-01 may be reused.

T01 — Harden the attended-login adapter and prove failure containment

id: RAILIANCE-WP-0026-T01
status: todo
priority: high

Implement the fix in ops-warden and return one value-safe owner receipt to railiance-platform and railiance-infra naming the source revision, focused test command/result, and the five acceptance outcomes below. The receipt must contain no credential, accessor, fingerprint, output excerpt, callback code, or token-helper contents.

Acceptance is all of the following:

1. An isolated writable token-helper location is created before authentication, has mode 0600 (with private parent directories), and is removed or revoked through a deterministic cleanup path.
2. A read-only or otherwise unusable default home fails before OIDC begins; the adapter never discovers persistence failure only after credential issuance.
3. Adapter-owned stdout and stderr containment guarantees that no credential reaches agent-visible output even if the underlying CLI violates -no-print. Inherited agent-visible stdio is not permitted for this lane.
4. Unexpected credential-bearing or otherwise non-allowlisted output fails closed and, whenever issuance may have occurred, triggers immediate self-revocation through the contained process without logging, returning, hashing, or fingerprinting the value.
5. Focused tests cover successful attended-login handoff, unwritable/default home refusal before authentication, helper persistence failure, unexpected stdout, unexpected stderr, immediate revocation, cleanup, and value absence from captured test and audit output.

The implementation must also update the openbao-platform-admin-login worker playbook and catalog comment so they no longer claim safety from -no-print alone. A non-production test double must prove the complete failure path before any new live OIDC rehearsal is proposed.

Done when the implementation is committed and pushed in ops-warden, the focused suite passes, the value-safe owner receipt is delivered directly to both reviewers, and railiance-platform accepts the exact revision. Completion of this task still does not authorize a live drill; that requires fresh owner receipts, current preflight, and a new human decision under a new scenario id.

Acceptance

• The adapter refuses unsafe storage before OIDC.
• No underlying login output can reach the agent transcript.
• Any issued credential is contained and revoked on failure.
• Focused success and failure-path tests pass without credential material.
• Both direct reviewers receive and accept the value-safe fix receipt.