scripts/wp0039-seed-worker-tokens.sh

@@ -4,7 +4,6 @@
 # Founder-attended only, through the silent admin lane (orientation section 5):
 #
 #   BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 \
-#     WP0039_STATUS=$HOME/.local/state/wp0039-seed.status \
 #     warden access openbao-platform-admin-login --exec -- \
 #     sh scripts/wp0039-seed-worker-tokens.sh
 #
@@ -13,53 +12,29 @@
 # argv, output, Git, or the hub. Idempotent: an existing path is never
 # overwritten. Rerunning after success is a no-op that re-verifies.
 #
-# WP0039_STATUS (optional, absolute path outside warden's temporary HOME)
-# receives a non-secret trace: step, exit code, and bao's error text for
-# metadata/put calls. The token-read step records only its stderr and length;
-# its stdout (the value) is never written anywhere.
-#
 # Exit codes: 0 both paths present and verified · 3 a path exists without a
-# usable token field (left untouched) · 4 write failed · 5 verification failed
-# · 6 a required tool is missing.
+# usable token field (left untouched) · 4 write failed · 5 verification failed.
 exec >/dev/null 2>&1
 set -u
 
 MOUNT=platform
 BASE=workloads/activity-core/ops-run-workers
 PATHS="rein-aharness-railiance01 rein-aharness-metered-railiance01"
-STATUS="${WP0039_STATUS:-/dev/null}"
-ERR="$(mktemp)"
-trap 'rm -f "$ERR"' EXIT
-: >"$STATUS"
-
-note() { printf '%s\n' "$*" >>"$STATUS"; }
-fail() { note "exit $1 at $2"; sed 's/^/  bao: /' "$ERR" >>"$STATUS"; exit "$1"; }
-
-for tool in bao openssl; do
-  command -v "$tool" || { note "missing tool: $tool"; exit 6; }
-done
-note "BAO_ADDR=${BAO_ADDR:-unset}"
 
 token_len() {
-  bao kv get -mount="$MOUNT" -field=token "$BASE/$1" 2>"$ERR" | tr -d '\n' | wc -c | tr -d ' '
+  bao kv get -mount="$MOUNT" -field=token "$BASE/$1" 2>/dev/null | tr -d '\n' | wc -c
 }
 
 for slug in $PATHS; do
-  if bao kv metadata get -mount="$MOUNT" "$BASE/$slug" 2>"$ERR"; then
-    note "$slug: exists"
-    [ "$(token_len "$slug")" -eq 64 ] || fail 3 "verify-existing $slug"
+  if bao kv metadata get -mount="$MOUNT" "$BASE/$slug"; then
+    [ "$(token_len "$slug")" -eq 64 ] || exit 3
     continue
   fi
-  note "$slug: metadata lookup failed (treated as absent):"
-  sed 's/^/  bao: /' "$ERR" >>"$STATUS"
   openssl rand -hex 32 | tr -d '\n' \
-    | bao kv put -mount="$MOUNT" "$BASE/$slug" token=- 2>"$ERR" || fail 4 "put $slug"
-  note "$slug: written"
+    | bao kv put -mount="$MOUNT" "$BASE/$slug" token=- || exit 4
 done
 
 for slug in $PATHS; do
-  [ "$(token_len "$slug")" -eq 64 ] || fail 5 "verify $slug"
-  note "$slug: verified"
+  [ "$(token_len "$slug")" -eq 64 ] || exit 5
 done
-note "exit 0"
 exit 0

workplans/ACTIVITY-WP-0039-multi-worker-identity-and-token-custody.md

@@ -133,17 +133,10 @@ on stdin. The founder runs it in their own terminal:
 
 ```bash
 BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 \
-  WP0039_STATUS=$HOME/.local/state/wp0039-seed.status \
   warden access openbao-platform-admin-login --exec -- \
   sh scripts/wp0039-seed-worker-tokens.sh
 ```
 
-The first founder run on 2026-09-23 failed closed ("returned a failure or
-unexpected output"). warden discards the child's output, so the script now
-writes a non-secret step trace to `WP0039_STATUS`. The trace holds the failing
-step, the exit code, and bao's error text, never the value. The script was
-tested against a stub `bao`: silent, and a no-op on rerun.
-
 Read warden's printed line rather than its exit code (orientation section 5).
 Minting does not depend on T02, but ESO cannot read the paths until the policy
 lands.