# OpenBao JWT login contract (engine consumer)

Steady-state engine authentication is the reviewed KeyCape
`secrets-engine-openbao` identity plus a **platform-owned** OpenBao JWT auth
mount and exact-bound role. This repository does not invent that mount.

Point `SECRETS_ENGINE_OPENBAO_JWT_LOGIN` at a mode-normal YAML file outside
the need to hold a standing OpenBao token:

```yaml
mount: jwt
role: secrets-engine
bound_issuer: https://<keycape-issuer>
```

`bound_issuer` must equal `SECRETS_ENGINE_KEYCAPE_ISSUER`. The JWT is sent
through a temporary JSON file, never argv. The resulting OpenBao token is
revoked at the end of the command (`token revoke -self`). Evidence records
the provider name and an accessor fingerprint only.

railiance-platform published the exact consumer file on 2026-10-10 at
`docs/contracts/secrets-engine-openbao-jwt-login.yaml` (mount `keycape-services`,
role `secrets-engine-openbao`, issuer `https://kc.coulomb.social`). When configured,
`--auth auto` selects service-jwt; without a contract it keeps named bootstrap/env
providers. Explicit service-jwt fails closed when configuration is missing.
The current service token is login-self-only and cannot perform protected lane
operations. T06 also requires a reviewed task-scoped execution entitlement and
functional steady-state adoption; see [final acceptance](service-jwt-final-acceptance.md).
A service-jwt selection never reads `--bootstrap-token-file` or `BAO_TOKEN`.