Read the secrets-engine-openbao client secret in memory from OpenBao

Founder direction 2026-10-06 and ops-mason plan
keycape-secrets-engine-openbao-client-custody (658cdbc): no workstation copy.
service-jwt now gets CLIENT_SECRET from platform/workloads/keycape/
secrets-engine-openbao through one attended OIDC login on
keycape-secrets-engine-openbao-operator-workload-kv-read (-no-store, token from
a pipe, header-only GET, unconditional revoke-self). The consumer file is
refused for this profile and kept for the approval client.
service-auth probe-openbao prints value-free first-use evidence.

SECRETS-WP-0012: T02 cancelled (D1-D4 superseded), T04 done, T03 is the
founder-run first live use. Synthetic tests only; 524 passed, 1 skipped.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b

src/secrets_engine/cli.py

@@ -41,7 +41,7 @@ from secrets_engine.approval_consume import (
 from secrets_engine.catalog import get_entry, load_catalog
 from secrets_engine.config import Config, repo_root
 from secrets_engine.decisions import require_approved, resolve_decision
-from secrets_engine.errors import DecisionError, SecretsEngineError
+from secrets_engine.errors import BackendError, DecisionError, SecretsEngineError
 from secrets_engine.evidence import EvidenceWriter, PrivilegedActionEvidence
 from secrets_engine.engine_auth import login_service_jwt, select_engine_auth
 from secrets_engine.lane_state import (
@@ -172,6 +172,8 @@ def _open_backend(cfg: Config, args, evidence: PrivilegedActionEvidence | None =
         try:
             if evidence is not None:
                 evidence.detail["auth_session_handle"] = session.accessor_fingerprint
+                for key, value in session.source_evidence.items():
+                    evidence.detail[f"auth_{key}"] = value
             yield session.client
         finally:
             try:
@@ -957,18 +959,46 @@ def cmd_evidence_classify(cfg: Config, args) -> int:
 # -- parser ----------------------------------------------------------------
 
 
+def cmd_service_auth_probe_openbao(cfg: Config, args) -> int:
+    """First-use proof for the secrets-engine-openbao profile. Value-free."""
+    import json as _json
+
+    try:
+        session = login_service_jwt(cfg)
+    except BackendError as exc:
+        print(f"error: {exc}", file=sys.stderr)
+        return 1
+    try:
+        session.close()
+    except BackendError:
+        pass
+    payload = {"auth_provider": "service-jwt", **session.evidence()}
+    ok = bool(
+        payload.get("operator_revocation_succeeded") and payload.get("revocation_succeeded")
+    )
+    payload["ok"] = ok
+    if args.json:
+        print(_json.dumps(payload, sort_keys=True))
+    else:
+        for key in sorted(payload):
+            print(f"{key}: {payload[key]}")
+    return 0 if ok else 1
+
+
 def cmd_service_auth_check_secret_file(cfg: Config, args) -> int:
     """Value-free acceptance check of the KeyCape consumer secret file."""
     import json as _json
 
     from secrets_engine.service_auth import check_client_secret_file
 
+    # The secrets-engine-openbao profile has no consumer file (founder
+    # direction 2026-10-06); this check serves the approval-client file.
     raw = args.path or (
-        str(cfg.keycape_client_secret_file) if cfg.keycape_client_secret_file else ""
+        str(cfg.approval_client_secret_file) if cfg.approval_client_secret_file else ""
     )
     if not raw:
         print(
-            "error: no path; pass --path or set SECRETS_ENGINE_KEYCAPE_CLIENT_SECRET_FILE",
+            "error: no path; pass --path or set SECRETS_ENGINE_APPROVAL_CLIENT_SECRET_FILE",
             file=sys.stderr,
         )
         return 2
@@ -1218,6 +1248,14 @@ def build_parser() -> argparse.ArgumentParser:
     sacheck.add_argument("--json", action="store_true")
     sacheck.set_defaults(func=cmd_service_auth_check_secret_file)
 
+    saprobe = sasub.add_parser(
+        "probe-openbao",
+        help="attended in-memory secret read, KeyCape exchange and OpenBao JWT "
+        "login, then self-revoke; prints value-free evidence only",
+    )
+    saprobe.add_argument("--json", action="store_true")
+    saprobe.set_defaults(func=cmd_service_auth_probe_openbao)
+
     return p