From ebb12b00c7eb97f50d3286a714a42ea59184cef4 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Wed, 23 Sep 2026 17:56:31 +0200
Subject: [PATCH] WP-0039-T03: add non-secret status trace to the seeding
 script

warden discards child output, so the first attended run's failure gave no
cause. Record the step, exit code, and bao error text to an optional status
file, never the token value. Tested against a stub bao: silent and a no-op on
rerun.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 151606@bnt-lap001
Assistant-Session: 3c0a4ad5-bb8b-4bf7-b9f0-fa5f29204e48
---
 scripts/wp0039-seed-worker-tokens.sh | 37 +++++++++++++++++++++++-----
 1 file changed, 31 insertions(+), 6 deletions(-)

diff --git a/scripts/wp0039-seed-worker-tokens.sh b/scripts/wp0039-seed-worker-tokens.sh
index efa6764..9f2fe23 100755
--- a/scripts/wp0039-seed-worker-tokens.sh
+++ b/scripts/wp0039-seed-worker-tokens.sh
@@ -4,6 +4,7 @@
 # Founder-attended only, through the silent admin lane (orientation section 5):
 #
 #   BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 \
+#     WP0039_STATUS=$HOME/.local/state/wp0039-seed.status \
 #     warden access openbao-platform-admin-login --exec -- \
 #     sh scripts/wp0039-seed-worker-tokens.sh
 #
@@ -12,29 +13,53 @@
 # argv, output, Git, or the hub. Idempotent: an existing path is never
 # overwritten. Rerunning after success is a no-op that re-verifies.
 #
+# WP0039_STATUS (optional, absolute path outside warden's temporary HOME)
+# receives a non-secret trace: step, exit code, and bao's error text for
+# metadata/put calls. The token-read step records only its stderr and length;
+# its stdout (the value) is never written anywhere.
+#
 # Exit codes: 0 both paths present and verified · 3 a path exists without a
-# usable token field (left untouched) · 4 write failed · 5 verification failed.
+# usable token field (left untouched) · 4 write failed · 5 verification failed
+# · 6 a required tool is missing.
 exec >/dev/null 2>&1
 set -u
 
 MOUNT=platform
 BASE=workloads/activity-core/ops-run-workers
 PATHS="rein-aharness-railiance01 rein-aharness-metered-railiance01"
+STATUS="${WP0039_STATUS:-/dev/null}"
+ERR="$(mktemp)"
+trap 'rm -f "$ERR"' EXIT
+: >"$STATUS"
+
+note() { printf '%s\n' "$*" >>"$STATUS"; }
+fail() { note "exit $1 at $2"; sed 's/^/  bao: /' "$ERR" >>"$STATUS"; exit "$1"; }
+
+for tool in bao openssl; do
+  command -v "$tool" || { note "missing tool: $tool"; exit 6; }
+done
+note "BAO_ADDR=${BAO_ADDR:-unset}"
 
 token_len() {
-  bao kv get -mount="$MOUNT" -field=token "$BASE/$1" 2>/dev/null | tr -d '\n' | wc -c
+  bao kv get -mount="$MOUNT" -field=token "$BASE/$1" 2>"$ERR" | tr -d '\n' | wc -c | tr -d ' '
 }
 
 for slug in $PATHS; do
-  if bao kv metadata get -mount="$MOUNT" "$BASE/$slug"; then
-    [ "$(token_len "$slug")" -eq 64 ] || exit 3
+  if bao kv metadata get -mount="$MOUNT" "$BASE/$slug" 2>"$ERR"; then
+    note "$slug: exists"
+    [ "$(token_len "$slug")" -eq 64 ] || fail 3 "verify-existing $slug"
     continue
   fi
+  note "$slug: metadata lookup failed (treated as absent):"
+  sed 's/^/  bao: /' "$ERR" >>"$STATUS"
   openssl rand -hex 32 | tr -d '\n' \
-    | bao kv put -mount="$MOUNT" "$BASE/$slug" token=- || exit 4
+    | bao kv put -mount="$MOUNT" "$BASE/$slug" token=- 2>"$ERR" || fail 4 "put $slug"
+  note "$slug: written"
 done
 
 for slug in $PATHS; do
-  [ "$(token_len "$slug")" -eq 64 ] || exit 5
+  [ "$(token_len "$slug")" -eq 64 ] || fail 5 "verify $slug"
+  note "$slug: verified"
 done
+note "exit 0"
 exit 0