Harden secret provisioning and lifecycle controls

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306

tests/test_auth_capability.py

@@ -1,6 +1,8 @@
 import copy
 import os
+from contextlib import contextmanager
 from pathlib import Path
+from types import SimpleNamespace
 
 import pytest
 
@@ -172,9 +174,17 @@ def test_apply_auth_capability_bypasses_kv_and_writes_ttl_options():
 
 
 class FakeVerifyClient:
-    def approle_login_token(self, role_name):
+    def __init__(self):
+        self.token = "test-token"
+        self.sessions_closed = 0
+
+    @contextmanager
+    def approle_session(self, role_name):
         assert role_name == "warden-sign"
-        return "test-token"
+        try:
+            yield SimpleNamespace(client=self)
+        finally:
+            self.sessions_closed += 1
 
     def token_capabilities(self, path, *, token):
         assert token == "test-token"
@@ -184,10 +194,12 @@ class FakeVerifyClient:
 
 
 def test_auth_capability_verification_uses_capability_probes():
+    client = FakeVerifyClient()
     results = run_verification(
-        FakeVerifyClient(), _auth_entry(), "", positive=True, negative=True
+        client, _auth_entry(), "", positive=True, negative=True
     )
     assert [result.passed for result in results] == [True, True]
+    assert client.sessions_closed == 2
 
 
 class FakeHandoffClient: