{
  "status": "passed",
  "phase": "first_live_attended_use",
  "task": "SECRETS-WP-0012-T03",
  "observed_at": "2026-10-10",
  "operator": "founder (attended, KeyCape OIDC login with MFA)",
  "command": "secrets-engine service-auth probe-openbao --json",
  "bao_addr": "http://127.0.0.1:18200",
  "login_contract": {
    "file": "~/.secrets-engine/keycape/openbao-jwt-login.yaml",
    "mount": "keycape-services",
    "role": "secrets-engine-openbao",
    "bound_issuer": "https://kc.coulomb.social",
    "authority": "probe input per CCR-2026-0038 as amended (railiance-platform 93a4bc2)"
  },
  "result": {
    "auth_provider": "service-jwt",
    "established": true,
    "ok": true,
    "operator_revocation_attempted": true,
    "operator_revocation_succeeded": true,
    "operator_session_handle": "4e9c487b6206",
    "revocation_attempted": true,
    "revocation_succeeded": true,
    "secret_source": "openbao-oidc-in-memory",
    "session_handle": "0204e60340d2"
  },
  "notes": [
    "Session handles are 12-hex-character SHA-256 fingerprints of accessors, not tokens or full accessors.",
    "The client secret was read in memory from OpenBao through the operator OIDC session; no consumer file was used.",
    "The bao CLI note that the token was not stored in the token helper is expected: the operator token stays in memory and was self-revoked.",
    "This is the positive login proof only. The negative checks listed in CCR-2026-0038 remain with railiance-platform under RPF-WP-0035-T02."
  ],
  "closes": ["SECRETS-WP-0012-T03"],
  "evidence_for": ["KEY-WP-0037-T04", "RPF-WP-0035-T02", "ops-mason plan verification item 6", "SECRETS-WP-0008-T06"]
}