WP-0039-T03: document status trace and first failed run

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 151606@bnt-lap001
Assistant-Session: 3c0a4ad5-bb8b-4bf7-b9f0-fa5f29204e48

scripts/wp0039-seed-worker-tokens.sh

@@ -4,6 +4,7 @@
 # Founder-attended only, through the silent admin lane (orientation section 5):
 #
 #   BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 \
+#     WP0039_STATUS=$HOME/.local/state/wp0039-seed.status \
 #     warden access openbao-platform-admin-login --exec -- \
 #     sh scripts/wp0039-seed-worker-tokens.sh
 #
@@ -12,29 +13,53 @@
 # argv, output, Git, or the hub. Idempotent: an existing path is never
 # overwritten. Rerunning after success is a no-op that re-verifies.
 #
+# WP0039_STATUS (optional, absolute path outside warden's temporary HOME)
+# receives a non-secret trace: step, exit code, and bao's error text for
+# metadata/put calls. The token-read step records only its stderr and length;
+# its stdout (the value) is never written anywhere.
+#
 # Exit codes: 0 both paths present and verified · 3 a path exists without a
-# usable token field (left untouched) · 4 write failed · 5 verification failed.
+# usable token field (left untouched) · 4 write failed · 5 verification failed
+# · 6 a required tool is missing.
 exec >/dev/null 2>&1
 set -u
 
 MOUNT=platform
 BASE=workloads/activity-core/ops-run-workers
 PATHS="rein-aharness-railiance01 rein-aharness-metered-railiance01"
+STATUS="${WP0039_STATUS:-/dev/null}"
+ERR="$(mktemp)"
+trap 'rm -f "$ERR"' EXIT
+: >"$STATUS"
+
+note() { printf '%s\n' "$*" >>"$STATUS"; }
+fail() { note "exit $1 at $2"; sed 's/^/  bao: /' "$ERR" >>"$STATUS"; exit "$1"; }
+
+for tool in bao openssl; do
+  command -v "$tool" || { note "missing tool: $tool"; exit 6; }
+done
+note "BAO_ADDR=${BAO_ADDR:-unset}"
 
 token_len() {
-  bao kv get -mount="$MOUNT" -field=token "$BASE/$1" 2>/dev/null | tr -d '\n' | wc -c
+  bao kv get -mount="$MOUNT" -field=token "$BASE/$1" 2>"$ERR" | tr -d '\n' | wc -c | tr -d ' '
 }
 
 for slug in $PATHS; do
-  if bao kv metadata get -mount="$MOUNT" "$BASE/$slug"; then
-    [ "$(token_len "$slug")" -eq 64 ] || exit 3
+  if bao kv metadata get -mount="$MOUNT" "$BASE/$slug" 2>"$ERR"; then
+    note "$slug: exists"
+    [ "$(token_len "$slug")" -eq 64 ] || fail 3 "verify-existing $slug"
     continue
   fi
+  note "$slug: metadata lookup failed (treated as absent):"
+  sed 's/^/  bao: /' "$ERR" >>"$STATUS"
   openssl rand -hex 32 | tr -d '\n' \
-    | bao kv put -mount="$MOUNT" "$BASE/$slug" token=- || exit 4
+    | bao kv put -mount="$MOUNT" "$BASE/$slug" token=- 2>"$ERR" || fail 4 "put $slug"
+  note "$slug: written"
 done
 
 for slug in $PATHS; do
-  [ "$(token_len "$slug")" -eq 64 ] || exit 5
+  [ "$(token_len "$slug")" -eq 64 ] || fail 5 "verify $slug"
+  note "$slug: verified"
 done
+note "exit 0"
 exit 0

workplans/ACTIVITY-WP-0039-multi-worker-identity-and-token-custody.md

@@ -133,10 +133,17 @@ on stdin. The founder runs it in their own terminal:
 
 ```bash
 BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 \
+  WP0039_STATUS=$HOME/.local/state/wp0039-seed.status \
   warden access openbao-platform-admin-login --exec -- \
   sh scripts/wp0039-seed-worker-tokens.sh
 ```
 
+The first founder run on 2026-09-23 failed closed ("returned a failure or
+unexpected output"). warden discards the child's output, so the script now
+writes a non-secret step trace to `WP0039_STATUS`. The trace holds the failing
+step, the exit code, and bao's error text, never the value. The script was
+tested against a stub `bao`: silent, and a no-op on rerun.
+
 Read warden's printed line rather than its exit code (orientation section 5).
 Minting does not depend on T02, but ESO cannot read the paths until the policy
 lands.