{
  "status": "passed",
  "check": "CCR-2026-0038 negative: a failed login never falls back to bootstrap/env providers",
  "design_ref": "railiance-platform docs/credential-lane-designs/secrets-engine-service-jwt.md (separately prove a failed login never consults bootstrap/env providers)",
  "observed_at": "2026-10-10",
  "scope": "secrets-engine consumer side; OpenBao claim refusals stay with railiance-platform and key-cape (KEY-WP-0039)",
  "finding_fixed": "Before this change the anonymous JWT login inherited BAO_TOKEN/VAULT_TOKEN from the parent environment, and the CLI token helper, and sent that token as X-Vault-Token alongside the JWT. The founder probe on 2026-10-10 was clean only because its command unset those variables.",
  "proofs": [
    {"kind": "unit", "test": "tests/test_engine_auth.py::test_service_jwt_refuses_bootstrap_file_and_does_not_read_env", "result": "passed", "shows": "selection refuses a bootstrap file with service-jwt"},
    {"kind": "unit", "test": "tests/test_engine_auth.py::test_jwt_login_failure_does_not_fall_back_to_env", "result": "passed", "shows": "an exchange failure raises without resolving an env/bootstrap client"},
    {"kind": "unit", "test": "tests/test_engine_auth.py::test_login_jwt_presents_no_ambient_env_or_helper_token", "result": "passed", "shows": "the login subprocess has no BAO_TOKEN/VAULT_TOKEN and a token helper that yields none"},
    {"kind": "real-cli", "binary": "OpenBao v2.5.5 bao CLI", "target": "local loopback listener recording X-Vault-Token", "result": "passed",
     "observations": {
       "env_token_previous_path_sent": true,
       "env_token_login_jwt_sent": false,
       "helper_token_previous_path_sent": true,
       "helper_token_login_jwt_sent": false
     },
     "note": "Sentinel strings only; no real token, JWT or OpenBao server was used."}
  ],
  "full_suite": "passed"
}