test(audit): classify child command and receipt failure locations

Co-authored-by: Medulla <medulla@tinyhumans.ai>

Author: senamakel

crates/tinysecurity-audit/src/sink_windows_negative_tests.rs

@@ -352,7 +352,7 @@ exit 0
     $file = Join-Path $PSHOME 'powershell.exe'
     $start = [Diagnostics.ProcessStartInfo]::new()
     $start.FileName = $file
-    $start.Arguments = '-NoProfile -NonInteractive -Command "try { [Console]::InputEncoding=[Text.UTF8Encoding]::new($false); $s=[Console]::In.ReadToEnd(); if(-not $s.StartsWith(''$ErrorActionPreference'')){exit 89}; [Console]::WriteLine(''audit-account-stage=94 utf8-prefix=1''); $b=[ScriptBlock]::Create($s); [Console]::WriteLine(''audit-account-stage=94 parsed=1''); & $b } catch { $n=$_.Exception.GetType().Name; $k=0; switch($n){ParseException{$k=1} CommandNotFoundException{$k=2} MethodInvocationException{$k=3} RuntimeException{$k=4} UnauthorizedAccessException{$k=5}}; [Console]::WriteLine((''audit-account-stage=95 kind={0} category={1} hresult={2}'' -f $k,[int]$_.CategoryInfo.Category,$_.Exception.HResult)); exit 89 }"'
+    $start.Arguments = '-NoProfile -NonInteractive -Command "try { [Console]::InputEncoding=[Text.UTF8Encoding]::new($false); $s=[Console]::In.ReadToEnd(); if(-not $s.StartsWith(''$ErrorActionPreference'')){exit 89}; $b=[ScriptBlock]::Create($s); $a=$b.Ast.EndBlock.Statements; [Console]::WriteLine((''audit-account-stage=94 parsed=1 prefix=1 block={0} first={1} count={2} length={3}'' -f [int]($b -is [ScriptBlock]),[int]($a[0].Extent.Text -ceq ''$ErrorActionPreference = ''''Stop''''''),$a.Count,$s.Length)); & $b } catch { $i=$_.InvocationInfo; $n=[Array]::IndexOf(@(''$ErrorActionPreference'',''Write-Output'',''Join-Path'',''&'',''$b''),$_.TargetObject)+1; [Console]::WriteLine((''audit-account-stage=95 command={0} length={1} line={2} offset={3} category={4} hresult={5}'' -f $n,([string]$_.TargetObject).Length,$i.ScriptLineNumber,$i.OffsetInLine,[int]$_.CategoryInfo.Category,$_.Exception.HResult)); exit 89 }"'
     $start.UseShellExecute = $false
     $start.UserName = $network.UserName
     $start.Domain = $network.Domain
@@ -386,7 +386,7 @@ exit 0
     $requiredPhases = @('audit-account-stage=90 foreign-identity=1 nonadmin=1', 'audit-account-stage=91 exact-control-read=1', 'audit-account-stage=92 private-file-denials=6', 'audit-account-stage=93 namespace-denial=1')
     $allLines = @($stdout.Result.Split([char]10) | ForEach-Object { $_.TrimEnd([char]13) } | Where-Object { $_.Length -gt 0 })
     $lines = @($allLines | Where-Object { $requiredPhases -ccontains $_ })
-    $diagnostics = @($allLines | Where-Object { $_ -cmatch '^audit-account-stage=94 (utf8-prefix|parsed)=1$|^audit-account-stage=95 kind=[0-5] category=[0-9]+ hresult=-?[0-9]+$|^audit-account-stage=96 (child-entry|identity-read)=1$' })
+    $diagnostics = @($allLines | Where-Object { $_ -cmatch '^audit-account-stage=94 parsed=1 prefix=1 block=[01] first=[01] count=[0-9]+ length=[0-9]+$|^audit-account-stage=95 command=[0-5] length=[0-9]+ line=-?[0-9]+ offset=-?[0-9]+ category=[0-9]+ hresult=-?[0-9]+$|^audit-account-stage=96 (child-entry|identity-read)=1$' })
     foreach ($line in $allLines) {
         if (($requiredPhases -ccontains $line) -or ($diagnostics -ccontains $line)) { Write-Output $line }
     }

crates/tinysecurity-module/src/callbacks_tests.rs

@@ -350,7 +350,14 @@ async fn native_storage_returns_exact_receipts_and_capacity_denies_without_phant
         registry.clone(),
     )?;
     let first = client.append(batch()).await;
-    assert!(first.committed && first.permitted);
+    assert!(
+        first.committed && first.permitted,
+        "native receipt committed={} permitted={} health={:?} receipt-present={}",
+        first.committed,
+        first.permitted,
+        first.health,
+        first.receipt.is_some()
+    );
     assert_eq!(first.health, AuditHealth2::Healthy);
     assert_eq!(client.append(batch()).await, first);
     let stored = std::fs::read(&path)?;