feat: admit existing OpenBao catalog lanes

src/secrets_engine/verify.py

@@ -29,6 +29,12 @@ class VerifyResult:
 
 def verify_positive(client: OpenBaoClient, entry: CatalogEntry, field: str) -> VerifyResult:
     """Approved consumer token must be able to read the field."""
+    if entry.delivery_auth_method != "approle" or not entry.has_delivery_auth:
+        return VerifyResult(
+            "positive",
+            False,
+            {"reason": "lane has no AppRole delivery auth", "path": entry.path},
+        )
     try:
         token = client.approle_login_token(entry.role_name)
     except Exception as e:  # backend errors -> failed verification, not a value leak
@@ -145,6 +151,10 @@ def verify_auth_capability_negative(client: OpenBaoClient, entry: CatalogEntry)
 def run_verification(
     client: OpenBaoClient, entry: CatalogEntry, field: str, *, positive: bool, negative: bool
 ) -> list[VerifyResult]:
+    if entry.kind == "kv" and field not in entry.fields:
+        raise VerificationError(
+            f"field '{field}' not declared in lane '{entry.id}' fields {entry.fields}"
+        )
     results: list[VerifyResult] = []
     if entry.kind == "auth-capability":
         if positive: