test(assurance): surface GitHub API status on AF-02 authority failure

Closed
TH
8d ago
+43-2

Linked issue

#192. The Linux rust job on #191's hardened test head reached authority_baseline_v2_matches_canonical_snapshot and failed on an anonymous GitHub API HTTP 403 for pinned run 31916124080.

Change

  • In the unprotected integration test crates/commandf-pkg/tests/af02_authority_reconstruction.rs only, add curl's reported HTTP status as a diagnostic marker on stderr for both immutable-content and live API reads.
  • On any unsuccessful curl, preserve the original fail-closed assertion (no retry, fallback, skip, or fabricated authority) while including HTTP status, curl exit code, and existing stderr in the failure message.
  • Add a deterministic, offline parser regression test for status 403, 200, missing status and 000/transport-only response.
  • Do not modify pinned content identities, canonical expected outcomes, verifier base code, protected workflows, rulesets, oracle pins or donor evidence.

Truth and gates

This is diagnostic hardening, not a resolution of the original HTTP 403, and does not make external availability or historical artifact bytes reliable. Issue #100 remains open. To claim a complete root-cause repair, further qualify a secure authoritative GitHub API access strategy under G51 before any workflow credential change. This PR is intended to make the next genuine CI failure discriminable; it must remain red when mandatory authority cannot be fetched.

Use exact-head CI and genuine Code Owner review before normal merge; do not treat a neutral bot or delegated OCR preview as approval. V2 remains execution authority.

Base observed f82565cca917d119e1c774b2c470e2ac20e0d6dd, head ccc55016fd3b38e42e856193870e9c7c232340c6.

Summary by cubic

Surfaces the GitHub API HTTP status and curl exit code in AF-02 authority fetch failures so 403s like the one in issue #192 are distinguishable from real verifier failures. The assertion still fails closed; no retry, fallback, or fabricated authority is introduced, and pinned content identities and verifier logic are unchanged.

  • Adds the COMMANDF_GITHUB_HTTP_STATUS= marker via curl --write-out to stderr for immutable-content and live API reads.
  • Adds an offline parser regression test covering 403, 200, missing status, and transport-only responses.