# OpenBao JWT login contract (engine consumer)

Steady-state engine authentication is the reviewed KeyCape
`secrets-engine-openbao` identity plus a **platform-owned** OpenBao JWT auth
mount and exact-bound role. This repository does not invent that mount.

Point `SECRETS_ENGINE_OPENBAO_JWT_LOGIN` at a mode-normal YAML file outside
the need to hold a standing OpenBao token:

```yaml
mount: jwt
role: secrets-engine
bound_issuer: https://<keycape-issuer>
```

`bound_issuer` must equal `SECRETS_ENGINE_KEYCAPE_ISSUER`. The JWT is sent
through a temporary JSON file, never argv. The resulting OpenBao token is
revoked at the end of the command (`token revoke -self`). Evidence records
the provider name and an accessor fingerprint only.

Until railiance-platform publishes that file, `--auth auto` keeps the named
bootstrap-file and `BAO_TOKEN` providers. `--auth service-jwt` fail-closes.
A service-jwt selection never reads `--bootstrap-token-file` or `BAO_TOKEN`.