---
id: w4/m5/t005
title: "scripts/bao-verify.sh — KV write/read, scoped SA login, restart durability, sealed-state behavior"
worker: worker4
status: done
estimate: 35m
depends_on: [w4/m5/t004]
---

## Objective

The milestone's behavioral test in the mold of `scripts/auth-verify.sh` (exit 0 = pass): prove on the mock cluster that OpenBao stores and scopes secrets correctly and that state survives the pod.

## Context

- Pattern: `scripts/auth-verify.sh` — positive, negative, and durability checks via port-forwards to cluster-internal services; used as the milestone gate in docs/ADR012-auth.md §Verification.
- Checks to cover: (1) KV v2 write + read-back under `tenants/`; (2) SA-login token succeeds inside `tenants/*`, denied outside; (3) `kubectl rollout restart` of OpenBao → re-unseal via `bao-init.sh` → the secret still reads back (state is in the storage backend, not the pod); (4) sealed state: before unseal, reads fail closed.

## Steps

1. Write `scripts/bao-verify.sh` with the four check groups; exit non-zero on any failure; never print secret values.
2. Run end-to-end on the mock cluster from a clean sync: `mock-cluster.sh` → Argo sync → `bao-init.sh` → `bao-verify.sh` exits 0.

## Files

- `scripts/bao-verify.sh` (new)

## Acceptance criteria

- [ ] Exit 0 on the mock cluster covering write/read, scope allow+deny, restart durability, sealed fail-closed.
- [ ] No secret values in output.

## Out of scope

- CI wiring (t006).
