---
id: w4/m5/t008
title: "Test coverage — meaningful tests for the behavior this milestone shipped"
worker: worker4
status: done
estimate: 30m
depends_on: [w4/m5/t006]
---

## Objective

Add meaningful tests for what m5 shipped. The substrate is mostly YAML + shell, so coverage means behavioral checks, not Go unit tests: ensure `bao-verify.sh` covers every DoD clause (init idempotency, unseal-after-restart, scope deny, sealed fail-closed) and add any missing negative cases. Tests must assert real behavior and failure modes — never trivial or tautological checks.

## Context

- Standing closing task; the verify script is the test vehicle (same role `auth-verify.sh` played for m1).

## Steps

1. Diff the DoD against `bao-verify.sh`'s checks; add missing cases (e.g. wrong unseal key fails cleanly, re-init refused when already initialized).
2. Run the full script green on the mock cluster.

## Files

- `scripts/bao-verify.sh`, possibly `scripts/bao-init.sh`

## Acceptance criteria

- [ ] Every DoD clause maps to an executed check; script exits 0 locally.

## Out of scope

- m6 product-code tests.
