Add value-safe verification and audit reporting

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306

tests/test_verification_negative.py

@@ -0,0 +1,61 @@
+import copy
+import os
+
+import pytest
+
+from secrets_engine.catalog import validate_entry
+from secrets_engine.errors import ProvisioningError
+from secrets_engine.openbao import read_strict_token_file
+from secrets_engine.verify import verify_negative
+from tests.test_catalog import VALID
+
+
+def _entry():
+    return validate_entry(copy.deepcopy(VALID))
+
+
+class NegativeClient:
+    def __init__(self, can_read):
+        self.can_read = can_read
+        self.tokens = []
+
+    def kv_can_read(self, _mount, _path, *, token):
+        self.tokens.append(token)
+        return self.can_read
+
+
+def test_negative_check_fails_closed_without_real_unrelated_token():
+    client = NegativeClient(can_read=False)
+    result = verify_negative(client, _entry(), unrelated_token=None)
+    assert result.passed is False
+    assert "not proven" in result.detail["reason"]
+    assert client.tokens == []
+
+
+def test_negative_check_uses_real_token_and_detects_policy_overlap():
+    denied = NegativeClient(can_read=False)
+    assert verify_negative(
+        denied, _entry(), unrelated_token="test-unrelated-token"
+    ).passed
+    assert denied.tokens == ["test-unrelated-token"]
+
+    overlapping = NegativeClient(can_read=True)
+    result = verify_negative(
+        overlapping, _entry(), unrelated_token="test-overlapping-token"
+    )
+    assert result.passed is False
+    assert "LEAK RISK" in result.detail["reason"]
+
+
+def test_negative_token_file_requires_mode_0600(tmp_path):
+    path = tmp_path / "unrelated.token"
+    path.write_text("test-unrelated-token", encoding="utf-8")
+    os.chmod(path, 0o644)
+    with pytest.raises(ProvisioningError, match="must be 0600"):
+        read_strict_token_file(path, purpose="negative verification token")
+
+    os.chmod(path, 0o600)
+    assert (
+        read_strict_token_file(path, purpose="negative verification token")
+        == "test-unrelated-token"
+    )