Prepare the existing contained Forgejo API login and silent read check

docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/README.md

@@ -36,6 +36,11 @@ changes were preserved. The two postimage files retain exact published sources.
   credentialed path remains unverified because the owner transport refused.
 - `measurements.json`: bounded samples, command counts and explicit unknowns.
   No cold-onboarding or comparative performance claim is made.
+- `attended-api-preparation.json`: exact existing-owner login/role and silent
+  invocation of the existing Tea probe. Installed Warden source pins and shell
+  syntax are checked; no new runner or credential-policy change is introduced.
+  This prepares the founder-run attempt and does not prove interactive login,
+  session revocation or authenticated API success.
 
 T33/T37 remain in progress until the actual Forgejo paths are accepted.
 T42 still waits on decision `ad88edeb-7c7c-486f-a695-1a7abae5b20c`; no source

docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/attended-api-login-advisory.json

@@ -0,0 +1,14 @@
+{
+  "id": "key-cape-oidc-login",
+  "domain": "forgejo-admin-workload-kv-read",
+  "handoff": {
+    "auth_method": "browser OIDC via key-cape / Keycloak at auth/netkingdom",
+    "path_template": null,
+    "fetch_command": "bao login -no-print -method=oidc -path=netkingdom role=forgejo-admin-workload-kv-read",
+    "policy_ref": null,
+    "exec_capable": true
+  },
+  "next_action": "Run the attended login and reviewed operation only inside the contained envelope: `warden access <need> --exec -- <reviewed-command>`. The private helper is preflighted, all output is suppressed, and the session is revoked and removed afterward.",
+  "advisory_exit_code": 0,
+  "login_or_fetch_executed": false
+}

docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/attended-api-preparation.json

@@ -0,0 +1,45 @@
+{
+  "prepared": true,
+  "executed": false,
+  "api_success_proven": false,
+  "command_recipe": "wp80_api_receipt_dir=$(mktemp -d /tmp/wp80-forgejo-api.XXXXXX)\nBAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 warden access key-cape-oidc-login --domain forgejo-admin-workload-kv-read --exec -- sh -c 'umask 077; exec warden access forgejo-admin-api-token --exec --field API_TOKEN -- python3 /home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/check_forgejo_cli.py > \"$1\" 2>/dev/null' sh \"$wp80_api_receipt_dir/report.json\"\npython3 -m json.tool \"$wp80_api_receipt_dir/report.json\"\n",
+  "shell_syntax_check_exit_code": 0,
+  "login_lane": "key-cape-oidc-login",
+  "role": "forgejo-admin-workload-kv-read",
+  "resolved_login_command": "bao login -no-print -method=oidc -path=netkingdom role=forgejo-admin-workload-kv-read",
+  "role_source": "/home/worsch/ops-warden/wiki/playbooks/forgejo-admin-api-token.md",
+  "login_semantics_source": "Installed warden.proxy.proxy_attended_login_exec; captured login, silent child, self-revocation and helper removal",
+  "login_role_current_runtime_verification": "Not yet executed; current role functionality and actual API reads remain unverified",
+  "new_runner_created": false,
+  "new_credential_policy_or_grant": false,
+  "source_pins": [
+    {
+      "path": "/home/worsch/.local/share/uv/tools/ops-warden/lib/python3.12/site-packages/warden/cli.py",
+      "sha256": "196cd829d3dbfbd2333598a983687bde1f9bcdfadef95b2fd1d237c4a5f060a9",
+      "matches_owner_checkout": true
+    },
+    {
+      "path": "/home/worsch/.local/share/uv/tools/ops-warden/lib/python3.12/site-packages/warden/proxy.py",
+      "sha256": "69649bcf8979e4ed7f9104e927b458827a355c4846143367f4cd49c8b89b96da",
+      "matches_owner_checkout": true
+    },
+    {
+      "path": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/check_forgejo_cli.py",
+      "sha256": "2e56da76fbebd2601e07b2da3842aacc5236b67b969252265514d6b4a3af8ca8"
+    }
+  ],
+  "expected_receipt": {
+    "passed": true,
+    "whoami_exit_code": 0,
+    "repository_read_exit_code": 0,
+    "returned_identity_matches": true,
+    "expected_repository_returned": true,
+    "temporary_configuration_removed": true
+  },
+  "separate_outer_requirements": [
+    "Contained OIDC login handed off to child",
+    "Outer session self-revocation confirmed",
+    "Outer helper cleanup confirmed"
+  ],
+  "on_failure": "Keep the closed failure result. Empty report is not API evidence; do not broaden role or claim success."
+}