codex 3fbb610d1f Declare live platform-admin role and policies; add attended admin check ... Answers the-custodian 641673a4. An attended read-only check (receipt docs/evidence/2026-09-23-openbao-platform-admin-check.json) found: - live platform-admin policy = repo file + reins/* (ops-mason, 2026-07-27); repo now matches live (sha256 0ca5b821...). No live write. - role also attaches operator-custody (undeclared); declared here. - role declared as openbao/auth/netkingdom-platform-admin-role.json. - default policy is attached and grants revoke-self/lookup-self, so the suspected missing grant is not the cause of warden's unconfirmed revocation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 150322@bnt-lap001 Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4		2026-09-23 19:27:25 +02:00
..
coding-agent-approle.json	Finish coding-agent high-risk boundary coverage	2026-08-22 10:03:54 +02:00
coding-agent-jwt-role.json	Finish coding-agent high-risk boundary coverage	2026-08-22 10:03:54 +02:00
netkingdom-platform-admin-role.json	Declare live platform-admin role and policies; add attended admin check	2026-09-23 19:27:25 +02:00