test: expose bounded native audit initialization diagnostics

Co-authored-by: Medulla <medulla@tinyhumans.ai>

Author: senamakel

.github/workflows/ci.yml

@@ -116,6 +116,10 @@ jobs:
 
           $verifiedModule = Join-Path $verifyRoot "$libraryName.dll"
           Copy-Item -LiteralPath $module -Destination $verifiedModule
+          # Diagnose the engine's real pinned ancestor/ACL checks before native
+          # discovery can hide an asynchronous setup failure behind a timeout.
+          cargo test --locked -p tinysecurity-audit windows_protected_preprovisioned_namespace_commits_exact_retry -- --nocapture
+          if ($LASTEXITCODE -ne 0) { throw 'native audit engine initialization diagnostic failed' }
           cargo test --locked --package tinysecurity-module --example audit_native_contract -- --nocapture
           if ($LASTEXITCODE -ne 0) { throw 'native audit installer regression failed' }
           cargo run --locked --package tinysecurity-module --example verify_module -- $verifiedModule

crates/tinysecurity-module/examples/audit_native_contract/native.rs

@@ -7,7 +7,12 @@ use std::{
     path::{Path, PathBuf},
     time::Duration,
 };
-use tinybus::{Connection, broker::Broker, module::ModuleHost, transport::memory::MemoryBus};
+use tinybus::{
+    Connection,
+    broker::Broker,
+    module::{ModuleHost, ModuleState},
+    transport::memory::MemoryBus,
+};
 use tinysecurity_bus::{
     AccessTier, AuditCorrelation2, AuditedRequest2, CallerContext, Check, CheckAuditedResponse2,
     CheckRequest, ModuleConfig, Verdict, names,
@@ -235,6 +240,36 @@ fn request(tail: u64) -> AuditedRequest2<CheckRequest> {
     }
 }
 
+// Diagnostic categories contain no SDK reason strings or serialized identities.
+fn init_category(state: &ModuleState) -> u8 {
+    match state {
+        ModuleState::Discovered => 1,
+        ModuleState::Rejected { .. } => 2,
+        ModuleState::Unresolved { .. } => 3,
+        ModuleState::Resolved => 4,
+        ModuleState::Initializing => 5,
+        ModuleState::Ready => 6,
+        ModuleState::Serving => 7,
+        ModuleState::Faulted { .. } => 8,
+        ModuleState::Failed { .. } => 9,
+        ModuleState::Stopped => 10,
+        ModuleState::Disabled => 11,
+    }
+}
+
+#[cfg(all(windows, test))]
+fn engine_category(error: tinysecurity::audit::Error) -> u8 {
+    use tinysecurity::audit::Error;
+    match error {
+        Error::Sanitation => 1,
+        Error::Conflict => 2,
+        Error::Permissions => 3,
+        Error::Busy => 4,
+        Error::Storage => 5,
+        Error::Unsupported => 6,
+    }
+}
+
 pub(super) async fn verify(library: &Path) -> std::result::Result<(), Box<dyn std::error::Error>> {
     let (_directory, path) = namespace()?;
     let bus = MemoryBus::new();
@@ -256,7 +291,20 @@ pub(super) async fn verify(library: &Path) -> std::result::Result<(), Box<dyn st
             ..Default::default()
         })?,
     )?;
-    let module = module_peer(&client).await?;
+    let module = match module_peer(&client).await {
+        Ok(module) => module,
+        Err(error) => {
+            // The SDK faults asynchronously when setup fails. Observe only its
+            // typed state; never print the associated reason or module identity.
+            for module in host.list() {
+                println!(
+                    "audit-native-init stage=1 category={}",
+                    init_category(&module.state)
+                );
+            }
+            return Err(error);
+        }
+    };
     let proxy = client.proxy(module.as_str(), names::OBJECT_PATH, names::INTERFACE)?;
     assert!(proxy.attestation().await?.is_some());
     let first: CheckAuditedResponse2 = proxy

crates/tinysecurity-module/examples/audit_native_contract/native_tests.rs

@@ -48,3 +48,57 @@ fn namespace_installer_succeeds_when_set_acl_cmdlet_is_unavailable() {
     );
     provision_with_script(directory.path(), &script).unwrap();
 }
+
+#[test]
+fn initialization_diagnostics_discard_reason_strings() {
+    let reason = "private path or identity".to_owned();
+    let states = [
+        ModuleState::Discovered,
+        ModuleState::Rejected {
+            reason: reason.clone(),
+        },
+        ModuleState::Unresolved {
+            reason: reason.clone(),
+        },
+        ModuleState::Resolved,
+        ModuleState::Initializing,
+        ModuleState::Ready,
+        ModuleState::Serving,
+        ModuleState::Faulted {
+            reason: reason.clone(),
+        },
+        ModuleState::Failed { reason },
+        ModuleState::Stopped,
+        ModuleState::Disabled,
+    ];
+    for (index, state) in states.iter().enumerate() {
+        assert_eq!(usize::from(init_category(state)), index + 1);
+    }
+}
+
+#[cfg(windows)]
+#[test]
+fn installed_namespace_passes_actual_restricted_engine_open() {
+    use tinysecurity::audit::{Error, JsonlSink};
+    for (index, error) in [
+        Error::Sanitation,
+        Error::Conflict,
+        Error::Permissions,
+        Error::Busy,
+        Error::Storage,
+        Error::Unsupported,
+    ]
+    .into_iter()
+    .enumerate()
+    {
+        assert_eq!(usize::from(engine_category(error)), index + 1);
+    }
+    let (_directory, path) = namespace().unwrap();
+    let result = JsonlSink::open(&path, 2048, 3);
+    let category = result.as_ref().err().copied().map_or(0, engine_category);
+    println!("audit-native-init stage=2 category={category}");
+    assert!(
+        result.is_ok(),
+        "installed namespace must pass actual restricted engine open"
+    );
+}