kubectl auth can-i exits 1 when the answer is no. verify() was sending that
query through _run, which raised PlaneError and stopped apply under the
scoped builder. A denial with stdout no is now the negative proof. Any other
non-zero exit still fails.
Assistant: grok
Assistant-Session: 01a16071-5425-78d3-80b4-20fe2ee30f0a
The default path is user ops-mason-builder. Token mint, pod create, and
serviceaccount impersonation are no. Admin stays on the attended warden lane.
Negative-scope verify treats a denied get as the proof, and the CCR test
interpreter can import the platform generator.
Assistant: grok
Assistant-Session: 01a16071-5425-78d3-80b4-20fe2ee30f0a
