hyperhive/nix/module-eval/bao-grants.nix

# `checks.module-eval-bao-grants` — see ./lib.nix for the shared
# rationale (why this suite exists, naming convention, "evaluates
# not executes").
{
  pkgs,
  lib,
  self,
  nixosSystem,
  shared,
}:
let
  inherit
    (import ./lib.nix {
      inherit
        pkgs
        lib
        self
        nixosSystem
        ;
    })
    hive
    hiveWithController
    runGroup
    ;

  # The store, plus a placed bootstrap token: the only shape in which the
  # granter's own role can be written at all.
  baoGrantHere = hiveWithController {
    deploy.bao.enable = true;
    deploy.bao.bootstrapTokenFile = "/run/secrets/bao-bootstrap.token";
  };

  # The credential without the store. Writing the first grant is a store-side
  # operation, so a host holding only the token has nothing to do — and this
  # is the arm that separates "an operator placed a token" from "this box can
  # act on it".
  baoGrantNoStore = hive {
    deploy.bao.bootstrapTokenFile = "/run/secrets/bao-bootstrap.token";
  };

  # The store with no bootstrap token: the steady state once the granter is set
  # up, and the state of a store host that has never named one.
  baoGranterNoToken = shared.baoOnly;

  # The store with the granter's pair taken away: the deployment that writes
  # its grants some other way.
  baoGranterOptOut = hive {
    deploy.bao.enable = true;
    deploy.bao.bootstrapTokenFile = "/run/secrets/bao-bootstrap.token";
    deploy.bao.granterClientCertFile = lib.mkForce null;
    deploy.bao.granterClientKeyFile = lib.mkForce null;
  };

  # A pki role the granter's `roles/swarm-*` does not reach.
  baoGranterOddPkiRole = hive {
    deploy.bao.enable = true;
    deploy.bao.natsPkiRoleName = "queue";
  };

  # An agent pki role the granter's `roles/swarm-*` does not reach.
  baoGranterOddAgentRole = hive {
    deploy.bao.enable = true;
    deploy.bao.agentPkiRoleName = "agent";
  };

  # A gateway-leaf role prefix the granter's `roles/swarm-*` does not reach.
  baoGranterOddHiveLeafRole = hive {
    deploy.bao.enable = true;
    deploy.bao.hiveLeafPkiRolePrefix = "hive-leaf";
  };

  # The store with a second hive in its directory, at a domain that is not
  # `<name>.<swarm.domain>`, so each hive's gateway-leaf grant can be told
  # apart from the other's.
  baoGrantTwoHives = hive {
    deploy.bao.enable = true;
    deploy.bao.bootstrapTokenFile = "/run/secrets/bao-bootstrap.token";
    swarm.hives.h2.domain = "h2.example.org";
  };

  # The store and the token, with no CA to trust. `mkForce` because the PKI
  # glue supplies one by default here — this is the deployment that brings its
  # own certificates and has not named the authority yet, in which nothing can
  # log in as the granter.
  baoGrantNoClientCa = hive {
    deploy.bao.enable = true;
    deploy.bao.bootstrapTokenFile = "/run/secrets/bao-bootstrap.token";
    deploy.bao.clientCaFile = lib.mkForce null;
  };
  # The store plus every reader that used to log in as the hive. One fixture
  # rather than one per reader: the claim they are *separate* principals is
  # only testable where all of them render at once — that is the deployment in
  # which two of them sharing a leaf would be invisible.
  baoGrantWithConsumers = hiveWithController {
    deploy.bao.enable = true;
    deploy.bao.bootstrapTokenFile = "/run/secrets/bao-bootstrap.token";
    deploy.grafana.enable = true;
    deploy.swarm-otel.enable = true;
  };

  # The store and the homeserver on one host: the fetch of the homeserver's
  # OIDC secret logs in under matrix-ctl's leaf, whose role this host writes.
  baoGrantWithHomeserver = hive {
    deploy.bao.enable = true;
    deploy.bao.bootstrapTokenFile = "/run/secrets/bao-bootstrap.token";
    deploy.matrix.enable = true;
  };

  # The store with none of the readers beside it. Grafana and the collector are
  # simply off; the queue reader renders on any host holding
  # its leaf, which ./glue-bao-tls.nix mints here, so that leaf is taken away.
  baoGrantNoReaders = hiveWithController {
    deploy.bao.enable = true;
    deploy.bao.bootstrapTokenFile = "/run/secrets/bao-bootstrap.token";
    deploy.bao.queueAgentClientCertFile = lib.mkForce null;
    deploy.bao.queueAgentClientKeyFile = lib.mkForce null;
  };

  # The store with the forwarder's own pair taken away. The forwarder renders
  # wherever the store does, so this is the deployment the assertion refuses.
  baoNoForwarderIdentity = hive {
    deploy.bao.enable = true;
    deploy.bao.forwarderOidcClientCertFile = lib.mkForce null;
    deploy.bao.forwarderOidcClientKeyFile = lib.mkForce null;
  };

  # Every reader against a store it does not run, each with a leaf placed by
  # hand. The deployment in which there is no local policy unit to wait for.
  baoRemoteReaders = hiveWithController {
    deploy.grafana.enable = true;
    deploy.swarm-otel.enable = true;
    deploy.bao.clientCertFile = "/etc/pki/bao-client.pem";
    deploy.bao.clientKeyFile = "/etc/pki/bao-client-key.pem";
    deploy.bao.queueAgentClientCertFile = "/etc/pki/bao-queue-agent.pem";
    deploy.bao.queueAgentClientKeyFile = "/etc/pki/bao-queue-agent-key.pem";
    deploy.bao.grafanaOidcClientCertFile = "/etc/pki/bao-grafana-oidc.pem";
    deploy.bao.grafanaOidcClientKeyFile = "/etc/pki/bao-grafana-oidc-key.pem";
    deploy.bao.otelOidcClientCertFile = "/etc/pki/bao-otel-oidc.pem";
    deploy.bao.otelOidcClientKeyFile = "/etc/pki/bao-otel-oidc-key.pem";
  };

  # The readers ./glue-bao-readers-policy-order.nix orders after their policy
  # units.
  policyReaders = [
    "swarm-bao-queue-agent"
    "swarm-bao-grafana-oidc"
    "swarm-bao-otel-oidc"
  ];

  # Two credentials write grants, and each is checked against what the units
  # holding it actually call. The bootstrap token's policy is read from the
  # file the operator writes it from (../../docs/getting-started/setup.md
  # points there); the granter's from the unit that writes it. Units are found
  # by the credential they read rather than by name, so a new one is checked
  # without anyone listing it here.
  bootstrapTokenFile = "/run/secrets/bao-bootstrap.token";

  # The READ, not the path: every granting unit prints the path in the
  # one-time step it shows when the granter is refused.
  bootstrapUnits = lib.filterAttrs (
    _: u: lib.hasInfix "cat ${lib.escapeShellArg bootstrapTokenFile}" u.script
  ) baoGrantWithConsumers.systemd.services;

  # The pair ./glue-bao-tls.nix defaults on a store host.
  granterCertFile = "/var/lib/swarm-bao-pki/granter.pem";
  granterKeyFile = "/var/lib/swarm-bao-pki/granter-key.pem";

  granterUnits = lib.filterAttrs (
    _: u: (u.environment.BAO_CLIENT_CERT or null) == granterCertFile
  ) baoGrantWithConsumers.systemd.services;

  # The eighteen units that write a `swarm-*` grant, by name, for the discovery
  # control below.
  grantingUnitNames = [
    "swarm-bao-controller-policy"
    "swarm-bao-secret-publisher-policy"
    "swarm-bao-matrix-ctl-policy"
    "swarm-bao-queue-agent-policy"
    "swarm-bao-grafana-oidc-policy"
    "swarm-bao-otel-oidc-policy"
    "swarm-bao-forwarder-oidc-policy"
    "swarm-bao-services-issuer-policy"
    "swarm-bao-nats-tls-policy"
    "swarm-bao-agent-pki"
    "swarm-bao-nats-auth-policy"
    "swarm-bao-operator-viewer-policy"
    "swarm-bao-hive-leaf-policy"
    "swarm-bao-ci-runner-policy"
    "swarm-bao-logs-auth-policy"
    "swarm-bao-forge-publisher-policy"
    "swarm-bao-review-classifier-policy"
    "swarm-bao-builder-policy"
  ];

  # Comment lines dropped first: both the HCL and the scripts explain
  # themselves in prose that names paths and `bao` commands.
  codeLines =
    text: lib.filter (l: builtins.match "[[:space:]]*#.*" l == null) (lib.splitString "\n" text);

  bootstrapPolicyText = lib.concatStringsSep "\n" (
    codeLines (builtins.readFile ../host-modules/bao-bootstrap-policy.hcl)
  );

  # The granter's HCL is the only policy text in the unit that writes it.
  granterPolicyText = baoGrantHere.systemd.services.swarm-bao-granter-role.script;

  matches = re: text: lib.filter lib.isList (builtins.split re text);

  grantsIn =
    text:
    map
      (m: {
        path = lib.elemAt m 0;
        caps = map lib.head (matches ''"([a-z]+)"'' (lib.elemAt m 1));
      })
      (
        matches ''path "([^"]+)"[[:space:]]*[{][[:space:]]*capabilities[[:space:]]*=[[:space:]]*[[]([a-z", ]*)'' text
      );

  bootstrapGrants = grantsIn bootstrapPolicyText;
  granterGrants = grantsIn granterPolicyText;

  # One `bao …` invocation → the path and capabilities it needs, as
  # `bao <cmd> -output-policy` reports them. Path-specific `sudo` (bao's
  # root-protected paths, e.g. `pki/root` for a delete) does not follow from
  # the verb, so only `auth enable`/`auth disable` are checked for it. A verb
  # not listed here needs a path no grant has, so it fails the case until it
  # is taught.
  baoCallNeeds =
    words:
    let
      flags = lib.filter (lib.hasPrefix "-") words;
      args = lib.filter (w: !(lib.hasPrefix "-" w) && w != "\\") words;
      a = i: if i < lib.length args then lib.elemAt args i else "";
      need = path: caps: {
        inherit path caps;
        call = lib.concatStringsSep " " words;
      };
      cu = [
        "create"
        "update"
      ];
    in
    # A login and a seal-status check are unauthenticated: no policy grants them.
    # A token's own capabilities are `sys/capabilities-self`, which the
    # `default` policy grants every token.
    if a 0 == "login" || a 0 == "status" || (a 0 == "token" && a 1 == "capabilities") then
      null
    else if a 0 == "policy" && a 1 == "write" then
      need "sys/policies/acl/${a 2}" cu
    else if a 0 == "secrets" && a 1 == "list" then
      need "sys/mounts" [ "read" ]
    else if a 0 == "secrets" && a 1 == "enable" then
      need "sys/mounts/${lib.removePrefix "-path=" (lib.findFirst (lib.hasPrefix "-path=") "-path=${a 2}" flags)}" cu
    else if a 0 == "secrets" && a 1 == "tune" then
      need "sys/mounts/${a 2}/tune" cu
    else if a 0 == "auth" && a 1 == "list" then
      need "sys/auth" [ "read" ]
    else if a 0 == "auth" && a 1 == "enable" then
      need "sys/auth/${a 2}" (cu ++ [ "sudo" ])
    else if a 0 == "auth" && a 1 == "disable" then
      need "sys/auth/${a 2}" [
        "delete"
        "sudo"
      ]
    else if a 0 == "write" then
      need (a 1) cu
    else if a 0 == "read" then
      need (a 1) [ "read" ]
    # KV v2 inserts `data/` after the mount, the first segment.
    else if a 0 == "kv" && a 1 == "get" then
      let
        segs = lib.splitString "/" (a 2);
      in
      need (lib.concatStringsSep "/" (
        [
          (lib.head segs)
          "data"
        ]
        ++ lib.tail segs
      )) [ "read" ]
    else if a 0 == "list" then
      need (a 1) [ "list" ]
    else if a 0 == "delete" then
      need (a 1) [ "delete" ]
    else
      need "unrecognised call" [ ];

  baoCalls =
    script:
    lib.filter (n: n != null) (
      map
        (
          inv:
          baoCallNeeds (lib.filter (w: w != "") (lib.splitString " " (lib.replaceStrings [ "'" ] [ "" ] inv)))
        )
        (
          lib.concatMap (l: map (m: lib.elemAt m 1) (matches "(^[[:space:]]*|[$][(]|[)] )bao ([^|;)]*)" l)) (
            codeLines script
          )
        )
    );

  # bao's own rule (vault/policy/acl.go): an exact path wins, otherwise the
  # longest glob prefix, and a trailing `*` is a plain string prefix.
  grantFor =
    grants: path:
    let
      exact = lib.filter (g: g.path == path) grants;
      globs = lib.filter (
        g: lib.hasSuffix "*" g.path && lib.hasPrefix (lib.removeSuffix "*" g.path) path
      ) grants;
    in
    if exact != [ ] then
      lib.head exact
    else
      lib.foldl' (
        best: g: if best == null || lib.stringLength g.path > lib.stringLength best.path then g else best
      ) null globs;

  ungranted =
    grants: units:
    lib.concatLists (
      lib.mapAttrsToList (
        unit: u:
        map (n: "${unit}: `bao ${n.call}` needs ${n.path} [${toString n.caps}]") (
          lib.filter (
            n:
            let
              g = grantFor grants n.path;
            in
            g == null || !(lib.all (c: lib.elem c g.caps) n.caps)
          ) (baoCalls u.script)
        )
      ) units
    );

  bootstrapUngranted = ungranted bootstrapGrants bootstrapUnits;
  granterUngranted = ungranted granterGrants granterUnits;

  cases = [
    {
      # Reads the rendered unit on the HOST, which is where the write happens:
      # every API listener but the loopback UI one demands a client
      # certificate, and the host is the side that has one.
      name = "a store host renders the granting unit on the host, logging in as the granter";
      ok =
        let
          u = baoGrantHere.systemd.services.swarm-bao-controller-policy;
        in
        u.environment.BAO_CLIENT_CERT == granterCertFile
        && u.environment.BAO_CLIENT_KEY == granterKeyFile
        && lib.hasInfix "bao login -method=cert -token-only" u.script
        && !(u.unitConfig ? ConditionPathExists);
    }
    {
      # The move is the fix, so pin the side it landed on: in the container it
      # had no identity to open a connection with, and no address that resolved
      # to the store from its own netns.
      name = "the granting unit is not rendered inside the store's container";
      ok = !(baoGrantHere.containers.swarm-bao.config.systemd.services ? swarm-bao-controller-policy);
    }
    {
      # `StartLimit*` are `[Unit]` settings that systemd ignores under
      # `[Service]`, so a bound written into `serviceConfig` renders, deploys
      # and does nothing. Asserted where nixpkgs puts it rather than where it
      # was written. The values are pinned because they are the bound: under
      # `shamir` a human unseals by hand, and anything shorter than a day gives
      # up first — `start-limit-hit` does not self-heal.
      name = "the granting unit's start limit lands in [Unit], not [Service]";
      ok =
        let
          u = baoGrantHere.systemd.services.swarm-bao-controller-policy;
        in
        toString u.unitConfig.StartLimitBurst == "2880"
        && toString u.unitConfig.StartLimitIntervalSec == "90000"
        && !(u.serviceConfig ? StartLimitBurst);
    }
    {
      # The grants themselves, and the `hive-` prefix is the whole point:
      # without it the controller can rewrite the policy that constrains it,
      # which is a privilege escalation that renders, deploys and looks fine.
      # Readable here only because the HCL is piped as an argument rather than
      # written to a store path.
      name = "the controller's bao grants cannot reach the policy that constrains it";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-controller-policy.script;
        in
        lib.hasInfix "sys/policies/acl/hive-*" s && !(lib.hasInfix "sys/policies/acl/*" s);
    }
    {
      # Same host-side reasoning as the controller's granting unit above: the
      # write needs a client certificate and the host is the side that has one.
      name = "a store host renders the publisher's granting unit too, logging in as the granter";
      ok =
        let
          u = baoGrantHere.systemd.services.swarm-bao-secret-publisher-policy;
        in
        u.environment.BAO_CLIENT_CERT == granterCertFile && lib.hasInfix "swarm-secret-publisher" u.script;
    }
    {
      # The control for the case above, and the same one the controller's unit
      # has: rendered on the host means NOT rendered in the container, where it
      # would have neither an identity nor a route to the store.
      name = "the publisher's granting unit is not rendered inside the store's container";
      ok =
        !(baoGrantHere.containers.swarm-bao.config.systemd.services ? swarm-bao-secret-publisher-policy);
    }
    {
      # The whole point of a second principal. The two prefixes and one leaf it
      # publishes to and not `swarm/`, so it cannot touch an agent's
      # credentials or the appservice token beside the controller's client;
      # and no `read`, so a unit whose job is copying a file cannot recover
      # what is already there. Pinned as the full capability list per path,
      # because an added capability is exactly what a presence check misses.
      name = "the publisher's grant is write-only and reaches the hive and service prefixes and the controller's client alone";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-secret-publisher-policy.script;
        in
        lib.hasInfix "path \"secret/data/swarm/hives/*\" {\n  capabilities = [\"create\", \"update\"]" s
        && lib.hasInfix "path \"secret/data/swarm/services/*\" {\n  capabilities = [\"create\", \"update\"]" s
        && lib.hasInfix "path \"secret/data/swarm/controller/swarm-controller/oidc/client\" {\n  capabilities = [\"create\", \"update\"]\n}" s
        && !(lib.hasInfix "secret/data/swarm/controller/*" s)
        && !(lib.hasInfix "appservice-token" s)
        && !(lib.hasInfix "secret/data/swarm/agents" s)
        && !(lib.hasInfix "secret/data/swarm/*" s)
        && !(lib.hasInfix "sys/policies/acl" s);
    }
    {
      # The publisher's `services/*` write covers the callout xkey's seed, and
      # only the exact-path denial, which outranks the prefix, keeps it from
      # replacing the key. The control is an OIDC leaf beside it, which the
      # prefix still grants.
      name = "the publisher may not write the callout xkey's seed";
      ok =
        let
          grants = grantsIn baoGrantHere.systemd.services.swarm-bao-secret-publisher-policy.script;
        in
        (grantFor grants "secret/data/swarm/services/swarm-nats/callout/xkey-seed").caps == [ "deny" ]
        &&
          (grantFor grants "secret/data/swarm/services/swarm-nats/oidc/client").caps == [
            "create"
            "update"
          ];
    }
    {
      # The same denial for the callout's two nkey seeds: a planted issuer
      # seed admits anyone to the queue, and a planted user seed is the one
      # identity callout does not check. Each is its own exact path, so the
      # OIDC leaf beside them is still the prefix's.
      name = "the publisher may not write the callout issuer or user seed";
      ok =
        let
          grants = grantsIn baoGrantHere.systemd.services.swarm-bao-secret-publisher-policy.script;
        in
        (grantFor grants "secret/data/swarm/services/swarm-nats/callout/issuer-seed").caps == [ "deny" ]
        && (grantFor grants "secret/data/swarm/services/swarm-nats/callout/user-seed").caps == [ "deny" ]
        &&
          (grantFor grants "secret/data/swarm/services/swarm-nats/oidc/client").caps == [
            "create"
            "update"
          ];
    }
    {
      # Grafana's admin password sits under the publisher's `services/*` write
      # too, and a planted value is the password the next Grafana start applies
      # to the server-admin account. The OIDC leaf beside it is the control:
      # still the prefix's.
      name = "the publisher may not write Grafana's admin password";
      ok =
        let
          grants = grantsIn baoGrantHere.systemd.services.swarm-bao-secret-publisher-policy.script;
        in
        (grantFor grants "secret/data/swarm/services/swarm-grafana/admin/password").caps == [ "deny" ]
        &&
          (grantFor grants "secret/data/swarm/services/swarm-grafana/oidc/client").caps == [
            "create"
            "update"
          ];
    }
    {
      # The review classifier's forge token sits under the publisher's
      # `services/*` write too, and the controller posts the classifier's
      # reviews with whatever token is there. The classifier's OIDC leaf is the
      # control: still the prefix's.
      name = "the publisher may not write the review classifier's forge token";
      ok =
        let
          grants = grantsIn baoGrantHere.systemd.services.swarm-bao-secret-publisher-policy.script;
        in
        (grantFor grants "secret/data/swarm/services/review-classifier/forge/token").caps == [ "deny" ]
        &&
          (grantFor grants "secret/data/swarm/services/swarm-review-classifier/oidc/client").caps == [
            "create"
            "update"
          ];
    }
    {
      # The ordering is load-bearing and invisible at runtime: the controller's
      # unit creates the KV and cert-auth mounts this one writes into, so
      # without it a cold boot races and fails with "route entry not found",
      # which names neither unit.
      name = "the publisher's granting unit is ordered after the one that creates the mounts";
      ok = lib.elem "swarm-bao-controller-policy.service" (
        baoGrantHere.systemd.services.swarm-bao-secret-publisher-policy.after
      );
    }
    {
      # The third principal's grant: two paths, each spelled to the leaf. The
      # negative arms are the property — a homeserver is not entitled to
      # overwrite Grafana's OIDC client, so widening this to the `services/`
      # prefix the publisher holds would be a real loss even though it would
      # read as tidier.
      #
      # The first leaf is the swarm appservice token, which matrix-ctl mints
      # and publishes for the controller; the second is the homeserver's own
      # OIDC client secret, read-only. Counted, so a third stanza fails rather
      # than riding along beside correct ones.
      name = "matrix-ctl's grant is the swarm appservice token and the homeserver's OIDC secret, nothing else";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-matrix-ctl-policy.script;
        in
        lib.hasInfix "path \"secret/data/swarm/controller/swarm-controller/matrix/appservice-token\" {\n  capabilities = [\"create\", \"update\", \"read\"]\n}" s
        && lib.hasInfix "path \"secret/data/swarm/services/tuwunel/oidc/client\" {\n  capabilities = [\"read\"]\n}" s
        && lib.length (lib.splitString "path \"" s) == 3
        && !(lib.hasInfix "secret/data/swarm/services/*" s)
        && !(lib.hasInfix "swarm-grafana" s)
        && !(lib.hasInfix "secret/data/swarm/agents" s)
        && !(lib.hasInfix "secret/data/swarm/hives" s)
        && !(lib.hasInfix "sys/policies/acl" s);
    }
    {
      # 🩸 `read` is load-bearing here, unlike on the publisher: matrix-ctl's
      # `appservice publish` reads the swarm appservice token back and writes
      # only when the store's copy differs.
      name = "matrix-ctl may read back what it writes";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-matrix-ctl-policy.script;
        in
        lib.hasInfix "capabilities = [\"create\", \"update\", \"read\"]" s
        && lib.hasInfix "auth/cert/certs/swarm-matrix-ctl" s
        && lib.hasInfix "allowed_common_names=swarm-matrix-ctl" s;
    }
    {
      # Same two controls its siblings carry: ordered after the unit that makes
      # the mounts it writes into, and rendered on the HOST rather than inside
      # the store's container, where it would have neither an identity nor a
      # route to the store.
      name = "matrix-ctl's granting unit is ordered after the mounts and rendered on the host";
      ok =
        lib.elem "swarm-bao-controller-policy.service" (
          baoGrantHere.systemd.services.swarm-bao-matrix-ctl-policy.after
        )
        && !(baoGrantHere.containers.swarm-bao.config.systemd.services ? swarm-bao-matrix-ctl-policy);
    }

    # ── the readers that used to share the hive's own leaf ───────────────────
    #
    # 🩸 Until this split all of them presented `deploy.bao.clientCertFile`,
    # whose policy granted read on `swarm/agents/*`, `swarm/hives/<hive>/*` AND
    # `swarm/services/*`. Principals behind one certificate are one
    # principal to bao, so the only expressible grant was the union: the unit
    # fetching Grafana's OIDC secret could fetch every agent credential in the
    # swarm.
    #
    # Every one of these cases carries the same three negative arms, and they
    # are the deliverable rather than decoration — a positive arm alone passes
    # just as well when the other two stanzas are still there beside it. The
    # arms pin what each principal must NOT reach, so a later widening fails
    # here instead of being noticed in a store.
    {
      name = "the queue-credential reader's grant is one hive's queue credential and nothing else";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-queue-agent-policy.script;
        in
        lib.hasInfix "path \"secret/data/swarm/hives/h1/queue/agent\" {" s
        && lib.hasInfix "capabilities = [\"read\"]" s
        && !(lib.hasInfix "secret/data/swarm/agents" s)
        && !(lib.hasInfix "secret/data/swarm/services" s)
        && !(lib.hasInfix "secret/data/swarm/hives/h1/*" s)
        && !(lib.hasInfix "secret/data/swarm/hives/h1/matrix" s)
        && !(lib.hasInfix "secret/data/swarm/hives/*" s)
        && !(lib.hasInfix "sys/policies/acl" s);
    }
    {
      # ⚠️ The client id is the path segment, so the negative arm that matters
      # for this one is the OTHER service's: `services/*` would have granted
      # both, and the two are separate principals precisely because a
      # dashboard is not entitled to a collector's credential.
      #
      # The admin password is the one leaf it may create, and without `update`:
      # a grant that could replace it would let a second run rotate the
      # password Grafana's database already holds.
      name = "the Grafana reader reads its own client secret and creates its admin password, and nothing else";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-grafana-oidc-policy.script;
        in
        grantsIn s == [
          {
            path = "secret/data/swarm/services/swarm-grafana/oidc/client";
            caps = [ "read" ];
          }
          {
            path = "secret/data/swarm/services/swarm-grafana/admin/password";
            caps = [
              "create"
              "read"
            ];
          }
        ]
        && !(lib.hasInfix "secret/data/swarm/agents" s)
        && !(lib.hasInfix "secret/data/swarm/hives" s)
        && !(lib.hasInfix "secret/data/swarm/services/*" s)
        && !(lib.hasInfix "swarm-collector" s)
        && !(lib.hasInfix "sys/policies/acl" s);
    }
    {
      # The mirror of the case above, and the arm naming `swarm-grafana` is why
      # these are two principals rather than one `services/*` grant shared.
      name = "the collector OIDC reader's grant is the collector's own client secret and nothing else";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-otel-oidc-policy.script;
        in
        lib.hasInfix "path \"secret/data/swarm/services/swarm-collector/oidc/client\" {" s
        && lib.hasInfix "capabilities = [\"read\"]" s
        && !(lib.hasInfix "secret/data/swarm/agents" s)
        && !(lib.hasInfix "secret/data/swarm/hives" s)
        && !(lib.hasInfix "secret/data/swarm/services/*" s)
        && !(lib.hasInfix "swarm-grafana" s)
        && !(lib.hasInfix "sys/policies/acl" s);
    }
    {
      # The fifth, and the one that stayed on the hive's leaf longest: the
      # store's own forwarder. Its client id is `swarm-bao-collector`, so the
      # arm naming `swarm-collector/` is the swarm collector's secret, which
      # this principal is not entitled to.
      name = "the store forwarder's OIDC reader's grant is its own client secret and nothing else";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-forwarder-oidc-policy.script;
        in
        lib.hasInfix "path \"secret/data/swarm/services/swarm-bao-collector/oidc/client\" {" s
        && lib.hasInfix "capabilities = [\"read\"]" s
        && lib.length (lib.filter lib.isList (builtins.split "path \"" s)) == 1
        && !(lib.hasInfix "secret/data/swarm/agents" s)
        && !(lib.hasInfix "secret/data/swarm/hives" s)
        && !(lib.hasInfix "secret/data/swarm/services/*" s)
        && !(lib.hasInfix "services/swarm-collector/" s)
        && !(lib.hasInfix "swarm-grafana" s)
        && !(lib.hasInfix "sys/policies/acl" s);
    }
    {
      # `+` is one path segment, so this reaches `swarm/agents/<agent>/queue`
      # and no other credential an agent holds; `swarm/agents/*` would reach
      # all of them. The responder's own OIDC client secret is the one
      # `services/` leaf beside it. Its only creates are the two leaves of
      # each callout key, and nothing it holds may update or delete one.
      name = "the queue responder reads agent queue credentials and its OIDC secret, and may create only the callout keys' leaves";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-nats-auth-policy.script;
          grants = grantsIn s;
          creates = map (g: g.path) (lib.filter (g: lib.elem "create" g.caps) grants);
        in
        lib.hasInfix "path \"secret/data/swarm/agents/+/queue\" {" s
        && lib.hasInfix "path \"secret/data/swarm/services/swarm-nats/oidc/client\" {" s
        && lib.length (lib.filter lib.isList (builtins.split "capabilities = \\[\"read\"]" s)) == 2
        &&
          lib.sort lib.lessThan creates == [
            "secret/data/swarm/public/swarm-nats/callout-issuer"
            "secret/data/swarm/public/swarm-nats/callout-user"
            "secret/data/swarm/public/swarm-nats/callout-xkey"
            "secret/data/swarm/services/swarm-nats/callout/issuer-seed"
            "secret/data/swarm/services/swarm-nats/callout/user-seed"
            "secret/data/swarm/services/swarm-nats/callout/xkey-seed"
          ]
        && lib.all (
          g:
          g.caps == [ "read" ]
          ||
            g.caps == [
              "create"
              "read"
            ]
        ) grants
        && lib.length (lib.filter lib.isList (builtins.split "path \"" s)) == 8
        && !(lib.hasInfix "secret/data/swarm/agents/*" s)
        && !(lib.hasInfix "secret/data/swarm/hives" s)
        && !(lib.hasInfix "secret/data/swarm/services/*" s)
        && lib.hasInfix "auth/cert/certs/swarm-nats-auth" s
        && lib.hasInfix "allowed_common_names=swarm-nats-auth" s
        && lib.hasInfix "token_policies=swarm-nats-auth" s;
    }
    {
      name = "the PKI unit signs the queue responder's leaf under its own subject";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-pki.script;
        in
        lib.hasInfix "/nats-auth.pem ]" s && lib.hasInfix "swarm-nats-auth \"\" clientAuth" s;
    }
    {
      # The same `+` leaf as the queue responder, read-only, and nothing else:
      # this principal checks a presented secret and does nothing with it.
      name = "the log store responder's grant is every agent's queue secret, read-only, and nothing else";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-logs-auth-policy.script;
        in
        lib.hasInfix "path \"secret/data/swarm/agents/+/queue\" {\n  capabilities = [\"read\"]\n}" s
        && lib.length (lib.filter lib.isList (builtins.split "path \"" s)) == 1
        && !(lib.hasInfix "secret/data/swarm/agents/*" s)
        && !(lib.hasInfix "secret/data/swarm/hives" s)
        && !(lib.hasInfix "secret/data/swarm/services" s)
        && lib.hasInfix "auth/cert/certs/swarm-logs-auth" s
        && lib.hasInfix "allowed_common_names=swarm-logs-auth" s
        && lib.hasInfix "token_policies=swarm-logs-auth" s;
    }
    {
      name = "the PKI unit signs the log store responder's leaf under its own subject";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-pki.script;
        in
        lib.hasInfix "/logs-auth.pem ]" s && lib.hasInfix "swarm-logs-auth \"\" clientAuth" s;
    }
    {
      # 🩸 The half that makes the policies above bind: a policy grants only
      # through a token that carries it, and a token is minted by a cert-auth
      # role matching a CN. Distinct subjects is the whole mechanism — one
      # subject for every reader is one principal however the policies read.
      #
      # The per-hive subject carries the hive name because its path does; the
      # service subjects do not, because an OIDC client is registered once
      # per swarm. Pinned so neither shape is tidied into the other.
      name = "each of the four readers logs in under a subject of its own";
      ok =
        let
          subjectOf =
            unit: role: cn:
            let
              s = baoGrantHere.systemd.services.${unit}.script;
            in
            lib.hasInfix "auth/cert/certs/${role}" s
            && lib.hasInfix "allowed_common_names=${cn}" s
            && lib.hasInfix "token_policies=${role}" s
            # Outside the `hive-*` namespace the controller may rewrite, for
            # the reason the three service principals above state.
            && !(lib.hasInfix "auth/cert/certs/hive-" s);
        in
        subjectOf "swarm-bao-queue-agent-policy" "swarm-queue-agent-h1" "swarm-bao-queue-agent-h1"
        && subjectOf "swarm-bao-grafana-oidc-policy" "swarm-grafana-oidc" "swarm-bao-grafana-oidc"
        && subjectOf "swarm-bao-otel-oidc-policy" "swarm-otel-oidc" "swarm-bao-otel-oidc"
        && subjectOf "swarm-bao-forwarder-oidc-policy" "swarm-forwarder-oidc" "swarm-bao-forwarder-oidc";
    }
    {
      # 🩸 The consuming side, and the arm that would catch the regression that
      # costs the most: a unit repointed back at `deploy.bao.clientCertFile`
      # evaluates, deploys and logs in — and silently restores the union grant,
      # because bao would again see one principal. Nothing about the policies
      # above would look wrong.
      #
      # Each pair is asserted whole: a certificate with no key authenticates
      # nothing, so a half-set pair is a reader that does not render.
      name = "each of the four readers presents its own leaf, never the hive's";
      ok =
        let
          b = baoGrantWithConsumers.services.hyperhive.deploy.bao;
          hiveLeaf = [
            b.clientCertFile
            b.clientKeyFile
          ];
          own = [
            b.queueAgentClientCertFile
            b.queueAgentClientKeyFile
            b.grafanaOidcClientCertFile
            b.grafanaOidcClientKeyFile
            b.otelOidcClientCertFile
            b.otelOidcClientKeyFile
            b.forwarderOidcClientCertFile
            b.forwarderOidcClientKeyFile
          ];
          envOf = unit: baoGrantWithConsumers.systemd.services.${unit}.environment;
          presents =
            unit: cert: key:
            (envOf unit).BAO_CLIENT_CERT == cert && (envOf unit).BAO_CLIENT_KEY == key;
        in
        lib.all (p: p != null) own
        && !(lib.any (p: lib.elem p hiveLeaf) own)
        && lib.length (lib.unique own) == lib.length own
        && presents "swarm-bao-queue-agent" b.queueAgentClientCertFile b.queueAgentClientKeyFile
        && presents "swarm-bao-grafana-oidc" b.grafanaOidcClientCertFile b.grafanaOidcClientKeyFile
        && presents "swarm-bao-otel-oidc" b.otelOidcClientCertFile b.otelOidcClientKeyFile
        && presents "swarm-bao-forwarder-oidc" b.forwarderOidcClientCertFile b.forwarderOidcClientKeyFile;
    }
    {
      # The minting side of the same claim. A role matching a subject nothing
      # signs is a reader that cannot log in, so the leaves and the roles have
      # to be asserted against each other — and the per-hive leaf carries
      # THIS host's hive name, which is what makes one hive's leaf useless
      # against another hive's role.
      name = "the PKI unit signs a leaf per reader, each under that reader's own subject";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-pki.script;
        in
        # The basename and the subject are matched separately: `signLeaf` takes
        # them as consecutive arguments across a `\` continuation, so one
        # literal spanning both would pin this file's line wrapping rather than
        # the pairing it means to.
        lib.all (lib.flip lib.hasInfix s) [
          "/queue-agent.pem ]"
          "swarm-bao-queue-agent-h1 \"\" clientAuth"
          "/grafana-oidc.pem ]"
          "swarm-bao-grafana-oidc \"\" clientAuth"
          "/otel-oidc.pem ]"
          "swarm-bao-otel-oidc \"\" clientAuth"
          "/forwarder-oidc.pem ]"
          "swarm-bao-forwarder-oidc \"\" clientAuth"
        ];
    }
    {
      # The absence arm: with no client CA there is no trust anchor, so no
      # role can be written and nothing can log in as the granter. The units
      # are gone, so the deployment has to say so itself.
      name = "with no client CA no granting unit renders, and the deployment warns";
      ok =
        let
          s = baoGrantNoClientCa.systemd.services;
        in
        lib.all (unit: !(s ? ${unit})) (grantingUnitNames ++ [ "swarm-bao-granter-role" ])
        && lib.any (lib.hasInfix "services.hyperhive.deploy.bao.clientCaFile is null") baoGrantNoClientCa.warnings
        # The control: a store with a CA does not warn.
        && !(lib.any (lib.hasInfix "clientCaFile is null") baoGrantHere.warnings);
    }
    {
      # Same control the three service principals carry: the write needs a
      # client certificate and the host is the side that has one, so a unit
      # rendered inside the store's container would have neither an identity
      # nor a route. Plus the ordering that makes the mounts exist first.
      name = "the four readers' granting units are ordered after the mounts and rendered on the host";
      ok =
        let
          units = [
            "swarm-bao-queue-agent-policy"
            "swarm-bao-grafana-oidc-policy"
            "swarm-bao-otel-oidc-policy"
            "swarm-bao-forwarder-oidc-policy"
          ];
        in
        lib.all (
          unit:
          lib.elem "swarm-bao-controller-policy.service" baoGrantHere.systemd.services.${unit}.after
          && !(baoGrantHere.containers.swarm-bao.config.systemd.services ? ${unit})
        ) units;
    }
    {
      # The other end of those units: each reader logs in against the role its
      # own policy unit writes, so it has to wait for that unit. Ordering and
      # never a requirement: a failed policy unit still counts as done, and the
      # reader's own retries carry it past that.
      #
      # The forwarder is listed apart from `policyReaders`: it renders wherever
      # the store does, so it is never absent on a store host and never present
      # on a remote one, and the two cases below would fail on it for that.
      name = "each of the four readers is ordered after the unit writing its role";
      ok =
        let
          s = baoGrantWithConsumers.systemd.services;
          waitsFor =
            reader:
            let
              policy = "${reader}-policy.service";
            in
            lib.elem policy s.${reader}.after
            && lib.elem policy s.${reader}.wants
            && !(lib.elem policy s.${reader}.requires);
        in
        lib.all waitsFor (policyReaders ++ [ "swarm-bao-forwarder-oidc" ]);
    }
    {
      # The homeserver's OIDC secret is read under matrix-ctl's leaf, so its
      # reader waits for the unit writing matrix-ctl's role, not one named
      # after itself. The second arm is the absence control: on the store's
      # host without a homeserver or queue, the ordering defines no reader.
      name = "the homeserver's OIDC secret reader is ordered after matrix-ctl's policy unit";
      ok =
        let
          u = baoGrantWithHomeserver.systemd.services.swarm-bao-matrix-oidc;
          noReaders = baoGrantNoReaders.systemd.services;
        in
        lib.elem "swarm-bao-matrix-ctl-policy.service" u.after
        && lib.elem "swarm-bao-matrix-ctl-policy.service" u.wants
        && !(lib.elem "swarm-bao-matrix-ctl-policy.service" u.requires)
        && !(noReaders ? swarm-bao-matrix-oidc)
        && !(noReaders ? swarm-bao-nats-callout-xkey);
    }
    {
      # The admin password is created under Grafana's leaf, so its unit waits
      # for the unit writing that leaf's role and policy; before it, the create
      # is refused. The second arm is the absence control.
      name = "grafana's admin password unit is ordered after grafana's policy unit";
      ok =
        let
          u = baoGrantWithConsumers.systemd.services.swarm-bao-grafana-admin;
        in
        lib.elem "swarm-bao-grafana-oidc-policy.service" u.after
        && lib.elem "swarm-bao-grafana-oidc-policy.service" u.wants
        && !(lib.elem "swarm-bao-grafana-oidc-policy.service" u.requires)
        && !(baoGrantNoReaders.systemd.services ? swarm-bao-grafana-admin);
    }
    {
      # The ordering is set apart from each reader's own definition, so it can
      # define a reader by itself: `after` on a unit nothing else declares is a
      # unit with no ExecStart. On the store's host without the readers, none
      # of them may exist.
      name = "a store host without the readers gains no reader unit from their ordering";
      ok = lib.all (reader: !(baoGrantNoReaders.systemd.services ? ${reader})) policyReaders;
    }
    {
      # Where the store is remote there is no policy unit here to wait for, so
      # the readers render as they did before the ordering existed.
      name = "a reader whose store is remote is not ordered after a policy unit";
      ok =
        let
          s = baoRemoteReaders.systemd.services;
          unordered =
            reader:
            let
              policy = "${reader}-policy.service";
            in
            s ? ${reader} && !(lib.elem policy s.${reader}.after) && !(lib.elem policy s.${reader}.wants);
        in
        lib.all unordered policyReaders;
    }
    {
      # A store host without the granter's pair writes its grants some other
      # way, so none of the eighteen units may exist. Without this arm
      # `lib.mkIf haveGranter` could be dropped from any of them and every other
      # case here would still pass.
      name = "without the granter's pair none of the eighteen granting units render";
      ok =
        let
          s = baoGranterOptOut.systemd.services;
        in
        lib.all (unit: !(s ? ${unit})) (grantingUnitNames ++ [ "swarm-bao-granter-role" ])
        # The control: the same store with the pair renders all eighteen.
        && lib.all (unit: baoGrantHere.systemd.services ? ${unit}) grantingUnitNames;
    }
    {
      # 🩸 What replaced the silent skip. With no bootstrap token the eighteen still
      # render, and a refused granter fails them with the step that fixes it.
      # A store host that never named a token is told to name one, since the
      # unit that sets the granter up renders only where it has.
      name = "a store host without a bootstrap token renders the eighteen, each failing loudly with the one-time step";
      ok =
        let
          s = baoGranterNoToken.systemd.services;
          loud =
            unit:
            s ? ${unit}
            &&
              lib.hasInfix "bao policy write bao-bootstrap /etc/hyperhive/bao-bootstrap-policy.hcl"
                s.${unit}.script
            && lib.hasInfix "set services.hyperhive.deploy.bao.bootstrapTokenFile" s.${unit}.script
            && lib.hasInfix "exit 1" s.${unit}.script;
        in
        lib.all loud grantingUnitNames && !(s ? swarm-bao-granter-role);
    }
    {
      # Where the token is named, the step names the file to put it in and the
      # unit to restart.
      name = "with a bootstrap token named, the one-time step places it and restarts the granter's unit";
      ok = lib.all (
        unit:
        let
          sc = baoGrantHere.systemd.services.${unit}.script;
        in
        lib.hasInfix "install -D -m 0600 /dev/stdin /run/secrets/bao-bootstrap.token" sc
        && lib.hasInfix "systemctl restart swarm-bao-granter-role" sc
      ) grantingUnitNames;
    }
    {
      # A token the store refuses gets the same step, under an exit status of
      # its own. Both store checks run with a HOME: without one `bao status`
      # exits 1 on a healthy store and every refusal reads as "sealed".
      name = "a refused bootstrap token prints the one-time step and exits 4, and every store check has a HOME";
      ok =
        let
          s = baoGrantHere.systemd.services;
          g = s.swarm-bao-granter-role.script;
        in
        lib.hasInfix "refused the bootstrap token in /run/secrets/bao-bootstrap.token" g
        && lib.hasInfix "bao policy write bao-bootstrap /etc/hyperhive/bao-bootstrap-policy.hcl" g
        && lib.hasInfix "exit 4" g
        && lib.all (unit: lib.hasInfix "HOME=/var/empty bao status" s.${unit}.script) (
          [ "swarm-bao-granter-role" ] ++ grantingUnitNames
        );
    }
    {
      # Every granting unit retries a sealed or late store for a day, in the
      # `[Unit]` section systemd reads it from, and waits for the unit that
      # mints the granter's leaf.
      name = "each granting unit requires the PKI unit and retries 2880 times at 30s";
      ok = lib.all (
        unit:
        let
          u = baoGrantHere.systemd.services.${unit};
        in
        lib.elem "swarm-bao-pki.service" u.requires
        && lib.elem "swarm-bao-pki.service" u.after
        && lib.elem "swarm-bao-granter-role.service" u.after
        && !(lib.elem "swarm-bao-granter-role.service" (u.requires ++ u.wants))
        && toString u.unitConfig.StartLimitBurst == "2880"
        && toString u.unitConfig.StartLimitIntervalSec == "90000"
        && toString u.serviceConfig.RestartSec == "30"
        && u.serviceConfig.Restart == "on-failure"
      ) grantingUnitNames;
    }
    {
      # A fetch from the store outlives a store or gateway that is down or
      # sealed for hours: `start-limit-hit` does not clear when the store comes
      # back, so a shorter budget leaves the credential missing until someone
      # starts the unit by hand.
      name = "every unit fetching a credential or certificate from the store retries 2880 times at 30s";
      ok =
        lib.all
          (
            unit:
            let
              s = baoGrantWithConsumers.systemd.services;
              u = s.${unit};
            in
            s ? ${unit}
            && toString u.unitConfig.StartLimitBurst == "2880"
            && toString u.unitConfig.StartLimitIntervalSec == "90000"
            && toString u.serviceConfig.RestartSec == "30"
            && u.serviceConfig.Restart == "on-failure"
          )
          (
            [
              "swarm-services-cert"
              "swarm-bao-forwarder-oidc"
              "swarm-bao-grafana-admin"
            ]
            ++ policyReaders
          );
    }
    {
      # The only unit left acting with the token, so the only one that may
      # skip on it.
      name = "no unit but the granter's role reads the bootstrap token or skips on it";
      ok =
        lib.attrNames bootstrapUnits == [ "swarm-bao-granter-role" ]
        && lib.all (u: !(u.unitConfig ? ConditionPathExists)) (lib.attrValues granterUnits)
        &&
          baoGrantHere.systemd.services.swarm-bao-granter-role.unitConfig.ConditionPathExists
          == bootstrapTokenFile;
    }
    {
      # The granter's grants, whole. Pinned as the full list, because an added
      # path or capability is exactly what a presence check misses.
      name = "the granter's policy is exactly these twenty stanzas";
      ok =
        let
          cu = [
            "create"
            "update"
          ];
        in
        granterGrants == [
          {
            path = "sys/policies/acl/swarm-*";
            caps = cu;
          }
          {
            path = "auth/cert/certs/swarm-*";
            caps = cu;
          }
          {
            path = "pki/roles/swarm-*";
            caps = cu;
          }
          {
            path = "sys/mounts";
            caps = [ "read" ];
          }
          {
            path = "sys/mounts/secret";
            caps = cu;
          }
          {
            path = "sys/mounts/pki";
            caps = cu;
          }
          {
            path = "sys/mounts/pki/tune";
            caps = cu;
          }
          {
            path = "pki/issuers";
            caps = [ "list" ];
          }
          {
            path = "pki/cert/ca";
            caps = [ "read" ];
          }
          {
            path = "pki/root";
            caps = [
              "delete"
              "sudo"
            ];
          }
          {
            path = "pki/root/generate/internal";
            caps = cu;
          }
          {
            path = "sys/mounts/pki-agents";
            caps = cu;
          }
          {
            path = "sys/mounts/pki-agents/tune";
            caps = cu;
          }
          {
            path = "pki-agents/issuers";
            caps = [ "list" ];
          }
          {
            path = "pki-agents/cert/ca";
            caps = [ "read" ];
          }
          {
            path = "pki-agents/root/generate/internal";
            caps = cu;
          }
          {
            path = "pki-agents/roles/swarm-*";
            caps = cu;
          }
          {
            path = "auth/oidc/config";
            caps = cu;
          }
          {
            path = "auth/oidc/role/swarm-*";
            caps = cu;
          }
          {
            path = "secret/data/swarm/services/swarm-bao-ui/oidc/client";
            caps = [ "read" ];
          }
        ];
    }
    {
      # Neither its own policy and role nor the bootstrap policy may be
      # reachable, or the granter could rewrite what constrains it and what the
      # next bootstrap token carries.
      name = "the granter cannot reach the policy or role that constrains it, nor the bootstrap policy";
      ok = lib.all (p: grantFor granterGrants p == null) [
        "sys/policies/acl/bao-granter"
        "auth/cert/certs/bao-granter"
        "sys/policies/acl/bao-bootstrap"
      ];
    }
    {
      # Outside `swarm-*` and the store's own mounts it holds nothing: no
      # hive's policy or role, no auth mount, no token, no secret.
      name = "the granter grants nothing outside swarm-* and the store's own mounts";
      ok =
        lib.all (p: grantFor granterGrants p == null) [
          "sys/policies/acl/hive-x"
          "auth/cert/certs/hive-x"
          "sys/auth"
          "sys/auth/cert"
          "sys/auth/oidc"
          "sys/auth/oidc/tune"
          "sys/auth/x"
          "auth/oidc/role/x"
          "secret/data/swarm/services/x/oidc/client"
          "auth/token/create"
          "auth/token/create-orphan"
          "secret/data/x"
          "secret/data/swarm/agents/x/queue"
          "sys/policies/acl/x"
          "sys/policies/acl/root"
          "pki/issue/swarm-services"
          "pki/sign/swarm-services"
          "pki-agents/root"
          "pki-agents/issue/swarm-agent"
          "pki-agents/sign/swarm-agent"
          "pki-agents/sign-verbatim"
          "*"
        ]
        && !(lib.any (
          g:
          lib.elem g.path [
            "*"
            "sys/policies/acl/*"
            "auth/cert/certs/*"
            "pki/roles/*"
            "pki-agents/roles/*"
          ]
        ) granterGrants);
    }
    {
      # Its names sit outside both globs that write grants — its own
      # `swarm-*` and the controller's `hive-*`.
      name = "the granter's own names are outside swarm-* and hive-*";
      ok =
        let
          sc = baoGrantHere.systemd.services.swarm-bao-granter-role.script;
          cn = baoGrantHere.services.hyperhive.deploy.bao.granterCommonName;
        in
        lib.hasInfix "bao policy write bao-granter -" sc
        && lib.hasInfix "auth/cert/certs/bao-granter" sc
        && lib.hasInfix "token_policies=bao-granter" sc
        && lib.hasInfix "token_ttl=15m" sc
        && !(lib.hasPrefix "swarm-" cn)
        && !(lib.hasPrefix "hive-" cn);
    }
    {
      # The other principals are what they were: no unit but the granter's own
      # hands its policy to a role, and none of them logs in as it.
      name = "no other principal gains the granter's policy";
      ok =
        lib.all (u: !(lib.hasInfix "token_policies=bao-granter" u.script)) (
          lib.attrValues (lib.removeAttrs baoGrantWithConsumers.systemd.services [ "swarm-bao-granter-role" ])
        )
        && lib.all (u: (u.environment.BAO_CLIENT_CERT or null) != granterCertFile) (
          lib.attrValues (lib.removeAttrs baoGrantWithConsumers.systemd.services grantingUnitNames)
        );
    }
    {
      # The minting side: a role matching a subject nothing signs is a
      # granter that cannot log in.
      name = "the PKI unit signs the granter's leaf under its own subject";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-pki.script;
        in
        lib.hasInfix "/granter.pem ]" s && lib.hasInfix "bao-granter \"\" clientAuth" s;
    }
    {
      # One role, policy and login role per hive in the directory, each
      # naming only its own hive: the policy text in the unit is exactly the
      # two `update` grants, and each hive's block names neither the other's
      # role nor its subject.
      name = "each hive's gateway-leaf identity may issue from its own role alone, for its own domain";
      ok =
        let
          s = baoGrantTwoHives.systemd.services.swarm-bao-hive-leaf-policy.script;
          blockOf =
            h: next:
            lib.head (
              lib.splitString "pki/roles/swarm-hive-leaf-${next}" (
                lib.last (lib.splitString "pki/roles/swarm-hive-leaf-${h}" s)
              )
            );
          h1 = blockOf "h1" "h2";
          h2 = blockOf "h2" "h1";
          issues =
            h: dom: blk:
            lib.hasInfix "allowed_domains='${dom},*.${dom}'" blk
            && lib.hasInfix "allow_ip_sans=false" blk
            && lib.hasInfix "allow_localhost=false" blk
            && lib.hasInfix "allow_any_name=false" blk
            && lib.hasInfix "max_ttl=720h" blk
            && lib.hasInfix "bao policy write swarm-hive-leaf-${h} -" blk
            && lib.hasInfix "auth/cert/certs/swarm-hive-leaf-${h}" blk
            && lib.hasInfix "allowed_common_names=swarm-bao-hive-leaf-${h}" blk
            && lib.hasInfix "token_policies=swarm-hive-leaf-${h}" blk;
        in
        grantsIn s == [
          {
            path = "pki/issue/swarm-hive-leaf-h1";
            caps = [ "update" ];
          }
          {
            path = "pki/issue/swarm-hive-leaf-h2";
            caps = [ "update" ];
          }
        ]
        && issues "h1" "h1.t.local" h1
        && issues "h2" "h2.example.org" h2
        && !(lib.hasInfix "h2" h1)
        && !(lib.hasInfix "h1" h2);
    }
    {
      # The minting side, and the hive's own path to it: the store host signs
      # its hive's leaf under the composed subject and points the gateway-leaf
      # unit at it.
      name = "the PKI unit signs this hive's gateway-leaf identity, and the hive presents it";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-pki.script;
          t = baoGrantHere.services.hyperhive.deploy.hive-controller.tls;
        in
        lib.hasInfix "/hive-leaf.pem ]" s
        && lib.hasInfix "swarm-bao-hive-leaf-h1 \"\" clientAuth" s
        && t.baoHiveIdentityCertFile == "/var/lib/swarm-bao-pki/hive-leaf.pem"
        && t.baoHiveIdentityKeyFile == "/var/lib/swarm-bao-pki/hive-leaf-key.pem"
        # Its own leaf, not the reader's or the services issuer's.
        && t.baoHiveIdentityCertFile != baoGrantHere.services.hyperhive.deploy.bao.clientCertFile
        &&
          t.baoHiveIdentityCertFile
          != baoGrantHere.services.hyperhive.deploy.bao.servicesIssuerClientCertFile;
    }
    {
      # The other hives' side: every hive in the directory but this one gets
      # the same three leaves, under its own name, in a directory of its own
      # that the operator copies to its host.
      name = "the PKI unit signs every other hive's reader, queue-agent and gateway-leaf identities";
      ok =
        let
          s = baoGrantTwoHives.systemd.services.swarm-bao-pki.script;
          b = baoGrantTwoHives.services.hyperhive.deploy.bao;
          signs =
            file: cn: lib.hasInfix "/hives/h2/${file}.pem ]" s && lib.hasInfix " ${cn} \"\" clientAuth" s;
        in
        signs "client" "h2"
        && signs "queue-agent" "${b.queueAgentCommonNamePrefix}-h2"
        && signs "hive-leaf" "${b.hiveLeafCommonNamePrefix}-h2"
        # This hive's own leaves stay at the top of the directory.
        && !(lib.hasInfix "/hives/h1/" s);
    }
    {
      # What makes the one above mean something: a hive outside the directory
      # gets nothing, so a store with only its own hive signs no other set.
      name = "the PKI unit signs no other hive's leaves when the directory holds only its own";
      ok = !(lib.hasInfix "swarm-bao-pki/hives/" baoGrantHere.systemd.services.swarm-bao-pki.script);
    }
    {
      name = "a gateway-leaf role prefix outside swarm-* is refused, naming the option";
      ok =
        let
          names = a: lib.hasInfix "services.hyperhive.deploy.bao.hiveLeafPkiRolePrefix" a.message;
        in
        lib.any (a: !a.assertion && names a) baoGranterOddHiveLeafRole.assertions
        && !(lib.any (a: !a.assertion && names a) baoGrantHere.assertions);
    }
    {
      # The granter writes pki roles through `roles/swarm-*` only, so a role
      # named otherwise is refused at eval rather than 403'd at deploy.
      name = "a pki role name outside swarm-* is refused, naming both options";
      ok =
        let
          names =
            a:
            lib.hasInfix "services.hyperhive.deploy.bao.servicesPkiRoleName" a.message
            && lib.hasInfix "services.hyperhive.deploy.bao.natsPkiRoleName" a.message;
        in
        lib.any (a: !a.assertion && names a) baoGranterOddPkiRole.assertions
        && !(lib.any (a: !a.assertion && names a) baoGrantHere.assertions);
    }
    {
      # 🩸 The refusal half of the forwarder's own leaf. It renders wherever the
      # store does and has no mode without a secret, so a null pair has one
      # fallback left — the hive's leaf and its union grant. Refused at eval,
      # with both options named.
      name = "a store host without the forwarder's own pair is refused, naming both options";
      ok =
        let
          refused = lib.filter (a: !a.assertion) baoNoForwarderIdentity.assertions;
          names =
            a:
            lib.hasInfix "services.hyperhive.deploy.bao.forwarderOidcClientCertFile" a.message
            && lib.hasInfix "services.hyperhive.deploy.bao.forwarderOidcClientKeyFile" a.message;
        in
        lib.any names refused
        # The control: the same store with the pair in place trips no such
        # assertion, so the arm above is not firing on every store host.
        && !(lib.any (a: !a.assertion && names a) baoGrantHere.assertions);
    }
    {
      # The policy authorising this route lives in another file, and nothing
      # else relates the grants to the paths the code actually writes.
      #
      # `secret/data/` is KV v2's ACL prefix; `swarm` is
      # `swarm_secret_client::path::ROOT` and `agents` is
      # `Kind::Agent.as_str()`, both of which that crate pins in its own test.
      #
      # The only other kind it writes is one leaf per hive, pinned below. A
      # grant widens when a path gains a writer, not when a kind is declared.
      name = "the controller may write agent credentials, and no whole tree beyond them";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-controller-policy.script;
        in
        lib.hasInfix "secret/data/swarm/agents/*" s
        && !(lib.hasInfix "secret/data/*" s)
        && !(lib.hasInfix "path \"secret/*\"" s);
    }
    {
      # The exact list is the property, not an accident of how it was typed.
      # `read` is in it because `mint_and_verify` reads a queue credential back
      # before rewriting it; `list` is not, so the controller can fetch a
      # credential only for an agent it was handed the name of, never enumerate
      # the tree. Pinned as the whole capability list, because an added
      # capability is exactly what a presence check misses.
      name = "the controller's grant on agent credentials is create/read/update and nothing else";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-controller-policy.script;
        in
        lib.hasInfix "path \"secret/data/swarm/agents/*\" {\n  capabilities = [\"create\", \"read\", \"update\"]" s;
    }
    {
      # `matrix_account::hive_sender` writes every hive's sender token and
      # `forge::hive_token` every hive's forge token, and nothing else under
      # `hives/`, where each hive's queue credential also lives. `+` is one
      # segment, which keeps each stanza to its one leaf; a `*` is a glob only
      # at the end of a path. Pinned as whole stanzas, so an added capability
      # fails.
      name = "the controller writes each hive's sender and forge tokens and nothing else under hives";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-controller-policy.script;
        in
        lib.hasInfix "path \"secret/data/swarm/hives/+/matrix/sender-token\" {\n  capabilities = [\"create\", \"read\", \"update\"]\n}" s
        && lib.hasInfix "path \"secret/data/swarm/hives/+/forge/token\" {\n  capabilities = [\"create\", \"read\", \"update\"]\n}" s
        && !(lib.hasInfix "secret/data/swarm/hives/*" s)
        && !(lib.hasInfix "secret/metadata/swarm/hives" s);
    }
    {
      # `forge::runner_token` writes the runner's registration token and keeps
      # the last value in memory, so its stanza has no `read`. Pinned as the
      # whole stanza, so an added capability fails, and spelled to the leaf:
      # `services/*` would reach every swarm service's OIDC client secret.
      name = "the controller writes the CI runner's registration token and cannot read it back";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-controller-policy.script;
        in
        lib.hasInfix "path \"secret/data/swarm/services/ci-runner/registration-token\" {\n  capabilities = [\"create\", \"update\"]\n}" s
        && !(lib.hasInfix "secret/data/swarm/services/*" s);
    }
    {
      # `forge::classifier_account` mints the review classifier's forge token
      # and reads it back to decide on a re-mint and to post reviews. Pinned
      # as the whole stanza, and spelled to the leaf, for the reason above.
      name = "the controller's grant on the review classifier is its forge token alone";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-controller-policy.script;
        in
        lib.hasInfix "path \"secret/data/swarm/services/review-classifier/forge/token\" {\n  capabilities = [\"create\", \"read\", \"update\"]\n}" s
        && !(lib.hasInfix "secret/data/swarm/services/review-classifier/*" s)
        && !(lib.hasInfix "secret/data/swarm/services/review-classifier/anthropic-api-key" s)
        && !(lib.hasInfix "secret/data/swarm/services/review-classifier/acp-provider" s);
    }
    {
      # The runner's role is the token's only reader. Its policy is the one
      # leaf, read-only, under the runner's own subject.
      name = "the CI runner's grant is its registration token and nothing else";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-ci-runner-policy.script;
        in
        lib.hasInfix "path \"secret/data/swarm/services/ci-runner/registration-token\" {" s
        && lib.hasInfix "capabilities = [\"read\"]" s
        && lib.length (lib.filter lib.isList (builtins.split "path \"" s)) == 1
        && !(lib.hasInfix "secret/data/swarm/services/*" s)
        && !(lib.hasInfix "secret/data/swarm/agents" s)
        && !(lib.hasInfix "secret/data/swarm/hives" s)
        && lib.hasInfix "auth/cert/certs/swarm-ci-runner" s
        && lib.hasInfix "allowed_common_names=swarm-ci-runner" s
        && lib.hasInfix "token_policies=swarm-ci-runner" s;
    }
    {
      # Read access to the token is a grant on its path, so the policy units
      # that name it are the whole list of who reaches it: the controller,
      # which writes it, and the runner. The publisher's `services/*` write
      # also covers it and holds no read.
      name = "no granting unit but the controller's and the CI runner's names the runner's token";
      ok =
        let
          naming = lib.filter (
            u: lib.hasInfix "ci-runner/registration-token" baoGrantHere.systemd.services.${u}.script
          ) grantingUnitNames;
        in
        lib.sort lib.lessThan naming == [
          "swarm-bao-ci-runner-policy"
          "swarm-bao-controller-policy"
        ];
    }
    {
      # The builder reads its forge token and its own queue client secret,
      # each read-only and spelled to the leaf: `services/*` would reach every
      # swarm service's secret.
      name = "the swarm builder's grant is its forge token and its queue client secret, and nothing else";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-builder-policy.script;
        in
        lib.hasInfix "path \"secret/data/swarm/services/builder/forge/token\" {\n  capabilities = [\"read\"]\n}" s
        && lib.hasInfix "path \"secret/data/swarm/services/swarm-builder/oidc/client\" {\n  capabilities = [\"read\"]\n}" s
        && lib.length (lib.filter lib.isList (builtins.split "path \"" s)) == 2
        && !(lib.hasInfix "secret/data/swarm/services/*" s)
        && lib.hasInfix "auth/cert/certs/swarm-builder" s
        && lib.hasInfix "allowed_common_names=swarm-builder" s
        && lib.hasInfix "token_policies=swarm-builder" s;
    }
    {
      # `forge::builder_account` mints the token and reads it back to decide
      # on a re-mint. Pinned as the whole stanza, and spelled to the leaf.
      name = "the controller's grant on the swarm builder is its forge token alone";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-controller-policy.script;
        in
        lib.hasInfix "path \"secret/data/swarm/services/builder/forge/token\" {\n  capabilities = [\"create\", \"read\", \"update\"]\n}" s
        && !(lib.hasInfix "secret/data/swarm/services/builder/*" s);
    }
    {
      # The token sits under the publisher's `services/*` write, and the
      # builder fetches config repos with whatever is there. Its OIDC leaf is
      # the control: still the prefix's.
      name = "the publisher may not write the swarm builder's forge token";
      ok =
        let
          grants = grantsIn baoGrantHere.systemd.services.swarm-bao-secret-publisher-policy.script;
        in
        (grantFor grants "secret/data/swarm/services/builder/forge/token").caps == [ "deny" ]
        &&
          (grantFor grants "secret/data/swarm/services/swarm-builder/oidc/client").caps == [
            "create"
            "update"
          ];
    }
    {
      name = "the PKI unit signs the swarm builder's leaf under its own subject";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-pki.script;
        in
        lib.hasInfix "/builder.pem ]" s && lib.hasInfix "swarm-builder \"\" clientAuth" s;
    }
    {
      name = "the PKI unit signs the CI runner's leaf under its own subject";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-pki.script;
        in
        lib.hasInfix "/ci-runner.pem ]" s && lib.hasInfix "swarm-ci-runner \"\" clientAuth" s;
    }
    {
      # The classifier reads the keys the operator writes and its own queue
      # client secret, each read-only and spelled to the leaf: `services/*`
      # would reach every swarm service's secret.
      name = "the review classifier's grant is its API key, its ACP provider key and its queue client secret, and nothing else";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-review-classifier-policy.script;
        in
        lib.hasInfix "path \"secret/data/swarm/services/review-classifier/anthropic-api-key\" {\n  capabilities = [\"read\"]\n}" s
        && lib.hasInfix "path \"secret/data/swarm/services/review-classifier/acp-provider\" {\n  capabilities = [\"read\"]\n}" s
        && lib.hasInfix "path \"secret/data/swarm/services/swarm-review-classifier/oidc/client\" {\n  capabilities = [\"read\"]\n}" s
        && lib.length (lib.filter lib.isList (builtins.split "path \"" s)) == 3
        && !(lib.hasInfix "secret/data/swarm/services/*" s)
        && !(lib.hasInfix "secret/data/swarm/agents" s)
        && !(lib.hasInfix "secret/data/swarm/hives" s)
        && lib.hasInfix "auth/cert/certs/swarm-review-classifier" s
        && lib.hasInfix "allowed_common_names=swarm-review-classifier" s
        && lib.hasInfix "token_policies=swarm-review-classifier" s;
    }
    {
      name = "the PKI unit signs the review classifier's leaf under its own subject";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-pki.script;
        in
        lib.hasInfix "/review-classifier.pem ]" s
        && lib.hasInfix "swarm-review-classifier \"\" clientAuth" s;
    }
    {
      # The forge's host is the one writer of the controller's forge token,
      # and reads the forge's own OIDC client secret under the same leaf.
      # Pinned as two whole stanzas, so an added `read` on the token or a
      # write or wildcard on the secret fails.
      name = "the forge publisher's grant is writing the controller's forge token and reading the forge's OIDC secret, and nothing else";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-forge-publisher-policy.script;
        in
        lib.hasInfix "path \"secret/data/swarm/controller/swarm-controller/forge/token\" {\n  capabilities = [\"create\", \"update\"]\n}" s
        && lib.hasInfix "path \"secret/data/swarm/services/forgejo/oidc/client\" {\n  capabilities = [\"read\"]\n}" s
        && lib.length (lib.filter lib.isList (builtins.split "path \"" s)) == 2
        && !(lib.hasInfix "secret/data/swarm/services/*" s)
        && lib.hasInfix "auth/cert/certs/swarm-forge-publisher" s
        && lib.hasInfix "allowed_common_names=swarm-forge-publisher" s
        && lib.hasInfix "token_policies=swarm-forge-publisher" s;
    }
    {
      # The controller's side: read on the one leaf, pinned as the whole
      # stanza so an added write fails.
      name = "the controller reads its own forge token and cannot write it";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-controller-policy.script;
        in
        lib.hasInfix "path \"secret/data/swarm/controller/swarm-controller/forge/token\" {\n  capabilities = [\"read\"]\n}" s
        && !(lib.hasInfix "secret/data/swarm/controller/*" s);
    }
    {
      # The policy units that name the path are the whole list of who reaches
      # it: the publisher, which writes it, and the controller, which reads it.
      name = "no granting unit but the controller's and the forge publisher's names the controller's forge token";
      ok =
        let
          naming = lib.filter (
            u: lib.hasInfix "swarm-controller/forge/token" baoGrantHere.systemd.services.${u}.script
          ) grantingUnitNames;
        in
        lib.sort lib.lessThan naming == [
          "swarm-bao-controller-policy"
          "swarm-bao-forge-publisher-policy"
        ];
    }
    {
      # The forge's OIDC client secret by name: the forge publisher reads it,
      # and the secret publisher writes it under its `swarm/services/*` grant,
      # which names no service.
      name = "no granting unit but the forge publisher's names the forge's OIDC secret";
      ok =
        lib.filter (
          u: lib.hasInfix "swarm/services/forgejo/oidc/client" baoGrantHere.systemd.services.${u}.script
        ) grantingUnitNames == [ "swarm-bao-forge-publisher-policy" ];
    }
    {
      name = "the PKI unit signs the forge publisher's leaf under its own subject";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-pki.script;
        in
        lib.hasInfix "/forge-publisher.pem ]" s && lib.hasInfix "swarm-forge-publisher \"\" clientAuth" s;
    }
    {
      # Revocation, and the reason it is a stanza of its own: `delete` on the
      # `data/` path soft-deletes the newest version and leaves earlier ones
      # readable, so a credential the mint had ever rewritten would survive it.
      # `metadata/` is the path that removes every version, and the store ACLs
      # it separately — without this grant the revocation is a 403 and a
      # destroyed agent's credential stays valid.
      #
      # `+` is one path segment, so this reaches `swarm/agents/<agent>/queue`
      # and nothing else an agent holds; `agents/*` would reach every object
      # under the prefix, which `revoke_queue_credential` never asks the store
      # to delete. Pinned as the whole capability list too: `read` or `list`
      # here would let the controller read back the queue-secret version
      # history it is meant only to delete.
      name = "the controller may revoke an agent's queue credential, and only that one";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-controller-policy.script;
        in
        lib.hasInfix "path \"secret/metadata/swarm/agents/+/queue\" {\n  capabilities = [\"delete\"]" s
        && !(lib.hasInfix "secret/metadata/swarm/agents/*" s)
        && !(lib.hasInfix "secret/metadata/*" s);
    }
    {
      # `linked_accounts` names an agent's matrix accounts and forge labels by
      # listing their two directories. bao checks a LIST against the directory
      # with a trailing slash, so each stanza names that slashed path and
      # reaches that one directory: not the agent's other keys, not `agents/`
      # itself, not anything below. Pinned as whole
      # stanzas, and as the only metadata stanzas under `agents/` beside the
      # queue revocation and the account deletes, so a widened path or an added
      # capability fails.
      name = "the controller may list each agent's matrix and forge accounts, and nothing else under agents";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-controller-policy.script;
          stanzas = lib.length (lib.splitString "path \"secret/metadata/swarm/agents/" s) - 1;
        in
        lib.hasInfix "path \"secret/metadata/swarm/agents/+/matrix/\" {\n  capabilities = [\"list\"]\n}" s
        && lib.hasInfix "path \"secret/metadata/swarm/agents/+/forge/\" {\n  capabilities = [\"list\"]\n}" s
        && stanzas == 6;
    }
    {
      # `linked_accounts` deletes one matrix account, forge account or GitHub
      # token through `delete_all_versions`, which addresses its metadata path.
      # A trailing `+` is one segment, so each stanza reaches the accounts
      # directly in that directory and nothing deeper. Pinned as whole stanzas,
      # so `list` or `read` here, which would expose version history, fails.
      name = "the controller may delete each agent's linked accounts, and nothing else of theirs";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-controller-policy.script;
        in
        lib.hasInfix "path \"secret/metadata/swarm/agents/+/matrix/+\" {\n  capabilities = [\"delete\"]\n}" s
        && lib.hasInfix "path \"secret/metadata/swarm/agents/+/forge/+\" {\n  capabilities = [\"delete\"]\n}" s
        && lib.hasInfix "path \"secret/metadata/swarm/agents/+/github-token\" {\n  capabilities = [\"delete\"]\n}" s;
    }
    {
      # The swarm appservice token is a homeserver-admin credential. The
      # controller mints agents' accounts with it and has no business replacing
      # it: matrix-ctl is its one writer. Pinned as the whole stanza, so an
      # added capability fails.
      name = "the controller reads the swarm appservice token and cannot write it";
      ok = lib.hasInfix "path \"secret/data/swarm/controller/swarm-controller/matrix/appservice-token\" {\n  capabilities = [\"read\"]\n}" baoGrantHere.systemd.services.swarm-bao-controller-policy.script;
    }
    {
      # The controller's own OIDC client secret, which the publisher writes and
      # the controller reads at start. Pinned as the whole stanza, so an added
      # capability fails.
      name = "the controller reads its own client secret and cannot write it";
      ok = lib.hasInfix "path \"secret/data/swarm/controller/swarm-controller/oidc/client\" {\n  capabilities = [\"read\"]\n}" baoGrantHere.systemd.services.swarm-bao-controller-policy.script;
    }
    {
      # Every role lives under a mount nothing else creates, and the granter
      # holds no `sys/auth`, so the token-holding unit creates it — otherwise
      # every certificate login fails against a path that is not there.
      name = "the granter's role unit creates the cert auth mount, and the controller's unit writes its role";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-controller-policy.script;
          g = baoGrantHere.systemd.services.swarm-bao-granter-role.script;
        in
        lib.hasInfix "bao auth enable cert" g
        && !(lib.hasInfix "bao auth enable" s)
        && lib.hasInfix "auth/cert/certs/swarm-controller" s
        && lib.hasInfix "/var/lib/swarm-bao-tls/client-ca.pem" s;
    }
    {
      # Same shape as the cert mount above, for the engine the controller
      # writes credentials through: a fresh store has no `secret/`, so the
      # grant would name a mount nobody created and the first write would 404.
      #
      # ⚠️ Matched on the COMMAND, for the reason the no-client-CA case below
      # spells out: the policy text is embedded in this same script and grants
      # `secret/data/...`, so any arm keyed on the *path* is satisfied either
      # way and could never fail.
      name = "the granting unit creates the KV mount the controller writes through";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-controller-policy.script;
        in
        lib.hasInfix "bao secrets enable -path=secret kv-v2" s;
    }
    {
      # What makes the granting-unit cases mean something, and the property
      # the host-side half depends on: no store here, so no bind mount and no
      # unit. Without it a hive that merely names a token would drag the
      # store's container config into its evaluation.
      name = "a bootstrap token on a host that runs no store grants nothing";
      ok = !(baoGrantNoStore.systemd.services ? swarm-bao-bootstrap-dir);
    }
    {
      # The operator writes this policy by hand, so a call the token-holding
      # unit makes and the file does not grant is a one-time step that fails.
      # Failing names every ungranted call.
      name =
        "every bao call the bootstrap-token unit makes is granted by bao-bootstrap-policy.hcl"
        + lib.optionalString (bootstrapUngranted != [ ]) (
          ": " + lib.concatStringsSep "; " bootstrapUngranted
        );
      ok = bootstrapUngranted == [ ];
    }
    {
      # The same check for the granter: a grant a unit writes outside its
      # globs is a 403 on deploy. Failing names every ungranted call.
      name =
        "every bao call a granting unit makes is granted by the granter's policy"
        + lib.optionalString (granterUngranted != [ ]) (": " + lib.concatStringsSep "; " granterUngranted);
      ok = granterUngranted == [ ];
    }
    {
      # What makes the case above mean something: discovery by the granter's
      # certificate reaches all eighteen units, and each yields calls.
      name = "the granter-policy check sees all eighteen granting units, and parses calls from each";
      ok =
        lib.sort lib.lessThan (lib.attrNames granterUnits) == lib.sort lib.lessThan grantingUnitNames
        && lib.all (u: baoCalls u.script != [ ]) (lib.attrValues granterUnits)
        && lib.all (u: baoCalls u.script != [ ]) (lib.attrValues bootstrapUnits);
    }
    {
      # setup.md's restart after the one-time step: a granting unit it misses
      # stays failed once its start limit is hit.
      name = "setup.md's reset-failed and restart after the one-time step reach every granting unit";
      ok =
        let
          lines = lib.splitString "\n" (builtins.readFile ../../docs/getting-started/setup.md);
          # The unit patterns on the one `systemctl <verb> 'swarm-bao-…` line.
          argsOf =
            verb:
            map (l: map (lib.replaceStrings [ "'" ] [ "" ]) (lib.drop 2 (lib.splitString " " l))) (
              lib.filter (lib.hasPrefix "systemctl ${verb} 'swarm-bao-") lines
            );
          covers =
            pats:
            lib.all (
              unit:
              lib.any (
                p: builtins.match (lib.replaceStrings [ "." "*" ] [ "[.]" ".*" ] p) "${unit}.service" != null
              ) pats
            ) (lib.attrNames granterUnits);
        in
        lib.length (argsOf "restart") == 1
        && argsOf "reset-failed" == argsOf "restart"
        && covers (lib.head (argsOf "restart"))
        # The control: the policy glob alone misses one.
        && !(covers [ "swarm-bao-*-policy.service" ]);
    }
    {
      # And the grants side: a stanza the parser skipped would read as a
      # grant that is not there.
      name = "every path stanza in bao-bootstrap-policy.hcl and the granter's policy parses";
      ok =
        lib.all
          (
            t:
            let
              grants = grantsIn t;
            in
            grants != [ ]
            && lib.length grants == lib.length (matches ''path "'' t)
            && lib.all (g: g.caps != [ ]) grants
          )
          [
            bootstrapPolicyText
            granterPolicyText
          ];
    }
    {
      # The bootstrap policy, whole: the auth mounts and the granter's own two
      # objects, and nothing a `swarm-*` grant lives at.
      name = "the bootstrap policy is exactly the auth mounts and the granter's policy and role";
      ok =
        lib.map (g: g.path) bootstrapGrants == [
          "sys/auth"
          "sys/auth/cert"
          "sys/auth/approle"
          "sys/auth/oidc"
          "sys/policies/acl/bao-granter"
          "auth/cert/certs/bao-granter"
        ]
        && grantFor bootstrapGrants "sys/policies/acl/swarm-controller" == null;
    }
    {
      # Nothing mints a secret_id, so the bootstrap policy's approle grant is
      # for tearing the mount down, not standing it up: `delete`+`sudo`
      # (verified against `bao auth disable -output-policy`), not
      # `create`/`update`. The granter's unit disables an existing mount and
      # never enables one.
      name = "the bootstrap policy may disable approle, and the granter's unit never enables it";
      ok =
        let
          g = baoGrantHere.systemd.services.swarm-bao-granter-role.script;
        in
        (grantFor bootstrapGrants "sys/auth/approle").caps == [
          "delete"
          "sudo"
        ]
        && lib.hasInfix "bao auth disable approle" g
        && !(lib.hasInfix "bao auth enable approle" g);
    }
    {
      # The controller's whole reach on any PKI mount: one role's issue
      # endpoint. It cannot rewrite the role, sign a CSR of its choosing or
      # touch the issuer, so the role's narrowing is the narrowing.
      name = "the controller's only PKI grant is update on the agent role's issue path";
      ok =
        let
          cg = grantsIn baoGrantHere.systemd.services.swarm-bao-controller-policy.script;
        in
        lib.filter (g: lib.hasInfix "pki" g.path) cg == [
          {
            path = "pki-agents/issue/swarm-agent";
            caps = [ "update" ];
          }
        ]
        && lib.all (p: grantFor cg p == null) [
          "pki-agents/roles/swarm-agent"
          "pki-agents/sign/swarm-agent"
          "pki-agents/sign-verbatim/swarm-agent"
          "pki-agents/issue/swarm-other"
          "pki-agents/root/generate/internal"
          "pki-agents/issuer/default"
          "pki-agents/config/urls"
          "pki-agents/keys"
          "pki/issue/swarm-services"
          "sys/mounts/pki-agents"
        ];
    }
    {
      # The engine refuses any name outside the glob, which is what keeps a
      # host CN out of the controller's reach. Exactly one unit writes a role
      # on the agent mount, so no second role widens it.
      name = "the agent PKI role issues client certificates named hive-agent-* and nothing else";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-agent-pki.script;
          roleWriters = lib.filter (u: matches "bao write '?pki-agents/roles/" (u.script or "") != [ ]) (
            lib.attrValues baoGrantHere.systemd.services
          );
        in
        lib.all (t: lib.hasInfix t s) [
          "allowed_domains='hive-agent-*'"
          "allow_glob_domains=true"
          "allow_bare_domains=false"
          "allow_subdomains=false"
          "allow_wildcard_certificates=false"
          "allow_localhost=false"
          "allow_any_name=false"
          "allow_ip_sans=false"
          "server_flag=false"
          "client_flag=true"
          "code_signing_flag=false"
          "email_protection_flag=false"
          "ttl=2160h"
          "max_ttl=2160h"
        ]
        && lib.length roleWriters == 1;
    }
    {
      # Every agent's role pins this root by value: generated once, after the
      # tune that stops bao clamping it, and never deleted.
      name = "the agent root is generated once, after the tune, as a leaf-only CA, and nothing deletes it";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-agent-pki.script;
          tune = "bao secrets tune -max-lease-ttl=262800h pki-agents";
          generate = "pki-agents/root/generate/internal";
          before =
            a: b:
            lib.stringLength (lib.head (lib.splitString b s))
            > lib.stringLength (lib.head (lib.splitString a s));
        in
        lib.length (lib.splitString generate s) == 2
        && lib.hasInfix tune s
        && before tune generate
        && lib.hasInfix "max_path_length=0" s
        && lib.hasInfix "elif [ \"$issuers\" = '{}' ]; then" s
        && !(lib.hasInfix "bao delete" s)
        && grantFor granterGrants "pki-agents/root" == null;
    }
    {
      # The granter writes pki roles through `roles/swarm-*` only.
      name = "an agent pki role name outside swarm-* is refused, naming the option";
      ok =
        let
          names = a: lib.hasInfix "services.hyperhive.deploy.bao.agentPkiRoleName" a.message;
        in
        lib.any (a: !a.assertion && names a) baoGranterOddAgentRole.assertions
        && !(lib.any (a: !a.assertion && names a) baoGrantHere.assertions);
    }

    # ── the UI's OIDC login ─────────────────────────────────────────────────
    {
      # What an `admins` login through the UI holds: the key tree, KV
      # metadata, and a write on the leaves the operator fills by hand.
      # A `read` under `data/` would hand a browser session a secret's
      # value, and any `sys/` path more than the UI needs.
      name = "the operator viewer policy is list and read on KV metadata, a write on the classifier's two keys, and no data/ read or sys/";
      ok =
        let
          viewer = grantsIn baoGrantHere.systemd.services.swarm-bao-operator-viewer-policy.script;
        in
        viewer == [
          {
            path = "secret/metadata/*";
            caps = [
              "list"
              "read"
            ];
          }
          {
            path = "secret/data/swarm/services/review-classifier/anthropic-api-key";
            caps = [
              "create"
              "update"
            ];
          }
          {
            path = "secret/data/swarm/services/review-classifier/acp-provider";
            caps = [
              "create"
              "update"
            ];
          }
        ]
        && grantFor viewer "secret/data/swarm/agents/x/queue" == null
        && grantFor viewer "secret/metadata/swarm/agents/x/queue" != null
        && !(lib.any (g: lib.hasPrefix "secret/data" g.path && lib.elem "read" g.caps) viewer)
        && !(lib.any (g: lib.hasPrefix "sys/" g.path) viewer);
    }
    {
      # Route (a): enabling an auth method stays a bootstrap-token act. The
      # granter configures the `oidc` mount; it never creates or tunes one.
      name = "the granter's policy has no sys/auth path, and the bootstrap policy holds sys/auth/oidc";
      ok =
        !(lib.any (g: lib.hasPrefix "sys/auth" g.path) granterGrants)
        && grantFor bootstrapGrants "sys/auth/oidc" != null;
    }
    {
      # Asked before attempted, like the cert mount, so re-running the step
      # on a store that has the mount is a no-op; listed, or the UI's login
      # page shows no OIDC tab.
      name = "the granter's role unit enables the oidc mount once, listed on the UI's login page";
      ok =
        let
          g = baoGrantHere.systemd.services.swarm-bao-granter-role.script;
        in
        lib.hasInfix "*'\"oidc/\"'*) ;;" g
        && lib.hasInfix "bao auth enable -listing-visibility=unauth oidc" g;
    }
    {
      # Before the step the granter lacks `auth/oidc/*`: the unit writes the
      # policy, says what to run, and exits 0 rather than retrying for a day.
      # The policy write comes first so it lands either way; the capability
      # check comes before the secret read and the config write it guards.
      name = "the viewer unit writes its policy, then stops with exit 0 while the granter may not configure oidc";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-operator-viewer-policy.script;
          at = needle: lib.stringLength (lib.head (lib.splitString needle s));
          probe = "caps=\"$(bao token capabilities auth/oidc/config)\"";
        in
        lib.hasInfix probe s
        && at "bao policy write swarm-operator-viewer -" < at probe
        && at probe < at "exit 0"
        && at "exit 0" < at "bao kv get"
        && at "bao kv get" < at "bao write auth/oidc/config"
        && lib.hasInfix "swarm-bao-granter-role re-runs this unit once it succeeds." s
        && !(lib.hasInfix "systemctl restart swarm-bao-operator-viewer-policy" s);
    }
    {
      # The granter step is what lets the viewer unit configure oidc, so its
      # success restarts that unit: a restart since the unit is
      # `RemainAfterExit`, `--no-block` since it is ordered after the granter.
      # The ordering is one-way, so the viewer's retries never reach back.
      # `ExecStartPost` directly, not `postStart` (which can't carry a
      # leading `-`), and the `-` is load-bearing: a failed enqueue must not
      # mark the granter itself failed.
      name = "a successful granter step restarts the viewer unit without blocking, and the enqueue can't fail the granter";
      ok =
        let
          s = baoGrantHere.systemd.services;
          g = s.swarm-bao-granter-role;
          v = s.swarm-bao-operator-viewer-policy;
        in
        lib.hasPrefix "-" g.serviceConfig.ExecStartPost
        && lib.hasInfix "systemctl restart --no-block swarm-bao-operator-viewer-policy.service" g.serviceConfig.ExecStartPost
        && lib.elem "swarm-bao-granter-role.service" v.after
        && !(lib.elem "swarm-bao-operator-viewer-policy.service" g.after)
        && !(v ? postStart && lib.hasInfix "swarm-bao-granter-role" v.postStart);
    }
    {
      # The client secret is on stdin, never an argument in /proc; the rest is
      # the swarm's authelia and the UI's own client id.
      name = "the oidc config names authelia and the UI's client, with the secret on stdin";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-operator-viewer-policy.script;
        in
        lib.hasInfix "printf '%s' \"$secret\" |\n  bao write auth/oidc/config" s
        && lib.hasInfix "'oidc_client_secret=-'" s
        && lib.hasInfix "'oidc_discovery_url=https://auth.t.local'" s
        && lib.hasInfix "'oidc_client_id=swarm-bao-ui'" s
        && lib.hasInfix "'default_role=swarm-operator-viewer'" s
        && lib.hasInfix "bao kv get -field=value secret/swarm/services/swarm-bao-ui/oidc/client" s
        &&
          (lib.hasInfix "oidc_discovery_ca_pem=@" s) == baoGrantHere.services.hyperhive.gateway.useSelfSigned;
    }
    {
      # `admins` → the viewer policy, and only at the UI's own callback.
      name = "the oidc role binds authelia's admins group to the viewer policy at the UI's callback";
      ok =
        let
          s = baoGrantHere.systemd.services.swarm-bao-operator-viewer-policy.script;
        in
        lib.hasInfix "bao write auth/oidc/role/swarm-operator-viewer -" s
        && lib.hasInfix ''"bound_claims":{"groups":["admins"]}'' s
        && lib.hasInfix ''"groups_claim":"groups"'' s
        && lib.hasInfix ''"token_policies":["swarm-operator-viewer"]'' s
        && lib.hasInfix ''"allowed_redirect_uris":["https://bao-ui.t.local/ui/vault/auth/oidc/oidc/callback"]'' s;
    }
  ]
  # A consumer that loads its credential at start never sees one a later
  # attempt lands, so the fetch restarts it when the file is newer than the
  # consumer's last start. The file is written only when the value differs,
  # so its mtime moves only on a real change, and the decision is re-read on
  # every run instead of carried in a variable a failed run would lose.
  ++
    map
      (
        {
          fetch,
          machine,
          consumer,
        }:
        {
          name = "${fetch} restarts ${consumer} in ${machine} when its file is newer than the consumer's start";
          ok =
            let
              # Text only: the script refers to store paths, and a string cut from it
              # keeps that context, which `splitString` refuses as a separator.
              s = builtins.unsafeDiscardStringContext baoGrantWithConsumers.systemd.services.${fetch}.script;
              call = "refresh_consumer ${lib.escapeShellArg machine} ${consumer} ";
              # The path the refresh is keyed on, as rendered.
              path = lib.head (lib.splitString "\n" (lib.last (lib.splitString call s)));
              # Everything from the gate on that path to the end of its `if`.
              gated = lib.head (
                lib.splitString "fi\n" (lib.last (lib.splitString "if secret_differs ${path} " s))
              );
            in
            lib.hasInfix call s
            && lib.hasInfix "atomic_write_secret " gated
            && lib.hasInfix path gated
            && lib.hasInfix "ActiveEnterTimestamp" s
            && lib.hasInfix ''if [ "$written_us" -le "$started_us" ]; then'' s
            && !(lib.hasInfix "$changed" s);
        }
      )
      [
        {
          fetch = "swarm-bao-otel-oidc";
          machine = baoGrantWithConsumers.services.hyperhive.swarm.otel.machine;
          consumer = "opentelemetry-collector.service";
        }
        {
          fetch = "swarm-bao-grafana-oidc";
          machine = baoGrantWithConsumers.services.hyperhive.swarm.grafana.machine;
          consumer = "grafana.service";
        }
        {
          fetch = "swarm-bao-forwarder-oidc";
          machine = baoGrantWithConsumers.services.hyperhive.swarm.bao.machine;
          consumer = "opentelemetry-collector.service";
        }
      ];
in
runGroup "bao-grants" cases