---
id: w1/m10/t006
title: Test coverage — meaningful tests for the prod-wiring behavior this milestone shipped
worker: worker1
status: done
estimate: 30m
depends_on: [w1/m10/t004]
---

## Objective

Add meaningful checks for what shipped: the idempotent-unseal contract (already-unsealed → no-op success; sealed → unsealed), the k8s-auth re-apply, and the verify script's prod mode failure modes (sealed store ⇒ 503 surfaced, not swallowed). Prefer script-level checks (bash + kind) where Go tests don't apply; never tautological.

## Acceptance criteria

- [ ] Sealed-store and already-unsealed paths both exercised (mock cluster) with asserted outcomes.
- [ ] `secrets-verify.sh` fails loudly (non-zero) when OpenBao is sealed/unreachable.
