Add value-safe verification and audit reporting

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306

tests/test_integration_bao.py

@@ -90,9 +90,32 @@ def test_full_chain(bao_dev, tmp_path):
 
     pos = verify_positive(client, entry, "npm_token")
     assert pos.passed, pos.detail
-    neg = verify_negative(client, entry)
+    client.write_policy(
+        "se-unrelated-denied",
+        f'path "{entry.mount}/data/{entry.path}" {{ capabilities = ["deny"] }}\n',
+    )
+    unrelated = json.loads(
+        client._run_ok(
+            ["token", "create", "-format=json", "-policy=se-unrelated-denied"]
+        )
+    )["auth"]["client_token"]
+    neg = verify_negative(client, entry, unrelated_token=unrelated)
     assert neg.passed, neg.detail
 
+    # A real unrelated identity with accidental policy overlap must make the
+    # negative check fail; an invalid/garbage token could not detect this.
+    client.write_policy(
+        "se-unrelated-overlap",
+        f'path "{entry.mount}/data/{entry.path}" {{ capabilities = ["read"] }}\n',
+    )
+    overlapping = json.loads(
+        client._run_ok(
+            ["token", "create", "-format=json", "-policy=se-unrelated-overlap"]
+        )
+    )["auth"]["client_token"]
+    leaked = verify_negative(client, entry, unrelated_token=overlapping)
+    assert not leaked.passed, leaked.detail
+
     # exec delivery: child can resolve token via npmrc; assert via a probe script
     probe = tmp_path / "probe.sh"
     probe.write_text(