---
id: HARNESS-WP-ADHOC-2026-09-04
type: workplan
title: "Restore Binky mail-scan OpenBao runtime discovery"
domain: infotech
repo: rein-aharness
status: finished
owner: codex
topic_slug: activity-core
created: "2026-09-04"
updated: "2026-09-04"
state_hub_workstream_id: "50b8f702-8095-5172-9787-29c49221779c"
---

# Restore Binky mail-scan OpenBao runtime discovery

## Repair and verify the claim-loop runtime

```task
id: HARNESS-WP-ADHOC-2026-09-04-T01
status: done
priority: high
state_hub_task_id: "264b9177-f4b7-5bf7-8118-e2a71af1ddc8"
```

Make the railiance01 claim-loop discover the existing host-installed OpenBao
client and the already-provisioned Binky mail AppRole directory. Preserve
explicit environment overrides, install the corrected launcher/unit, and prove
an AppRole login plus allowlisted IMAP field presence without exposing values.

Completed 2026-09-04. The launcher now supplies non-secret defaults for
`BAO_ADDR`, `VAULT_ADDR`, and `EXECUTOR_APPROLE_DIR`, and ensures
`~/.local/bin` is present in `PATH`; explicit overrides remain authoritative.
The corrected wrapper and unit were installed on railiance01 and the claim loop
restarted cleanly. Its child environment resolves OpenBao v2.5.4 at the
expected address and the existing mode-0600 AppRole files. A capabilities-safe
smoke proved `read` on `tenants/data/binky/company-email/imap`, `deny` on the
sibling Qonto path, and field presence for `IMAP_USERNAME` and `IMAP_PASSWORD`
without printing either value. Focused launcher and mail-scan tests passed
5 tests. Pre-change live launcher and unit backups carry suffix
`.pre-bao-fix-20260904`.