Add value-safe verification and audit reporting

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306

src/secrets_engine/verify.py

@@ -74,10 +74,25 @@ def verify_positive(client: OpenBaoClient, entry: CatalogEntry, field: str) -> V
     )
 
 
-def verify_negative(client: OpenBaoClient, entry: CatalogEntry) -> VerifyResult:
-    """An unrelated token must be denied. Uses an empty (invalid) token."""
-    # An empty/garbage token stands in for an unrelated consumer.
-    denied = not client.kv_can_read(entry.mount, entry.path, token="se-unrelated-denied")
+def verify_negative(
+    client: OpenBaoClient,
+    entry: CatalogEntry,
+    *,
+    unrelated_token: str | None,
+) -> VerifyResult:
+    """A real unrelated token must be denied the cataloged path."""
+    if not unrelated_token:
+        return VerifyResult(
+            "negative",
+            False,
+            {
+                "reason": "no real unrelated token supplied; denial not proven",
+                "path": entry.path,
+            },
+        )
+    denied = not client.kv_can_read(
+        entry.mount, entry.path, token=unrelated_token
+    )
     return VerifyResult(
         "negative",
         denied,
@@ -167,7 +182,13 @@ def verify_auth_capability_negative(client: OpenBaoClient, entry: CatalogEntry)
 
 
 def run_verification(
-    client: OpenBaoClient, entry: CatalogEntry, field: str, *, positive: bool, negative: bool
+    client: OpenBaoClient,
+    entry: CatalogEntry,
+    field: str,
+    *,
+    positive: bool,
+    negative: bool,
+    unrelated_token: str | None = None,
 ) -> list[VerifyResult]:
     if entry.kind == "kv" and field not in entry.fields:
         raise VerificationError(
@@ -183,7 +204,9 @@ def run_verification(
         if positive:
             results.append(verify_positive(client, entry, field))
         if negative:
-            results.append(verify_negative(client, entry))
+            results.append(
+                verify_negative(client, entry, unrelated_token=unrelated_token)
+            )
     if not results:
         raise VerificationError("no verification check selected (use --positive/--negative)")
     return results