Record first authority investigation and preserve failed live-run evidence

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0cffe-206f-7323-89d3-b20ca4cf4bf9

tests/test_research_bench.py

@@ -95,6 +95,29 @@ def test_failure_is_recorded_and_cannot_be_silently_retried(tmp_path):
         bench.execute(root, adapter())
 
 
+def test_provider_diagnostic_keeps_status_but_not_sensitive_detail(tmp_path):
+    from infospace_bench.errors import InfospaceError
+
+    root = initialize(tmp_path)
+
+    class Denied:
+        model = "example/model"
+
+        def generate(self, request):
+            raise InfospaceError("provider_failed", "Request rejected", {
+                "error": "HTTP Error 401: Unauthorized",
+                "headers": {"Authorization": "Bearer TEST-SECRET-MUST-NOT-PERSIST"},
+            })
+
+    with pytest.raises(InfospaceError):
+        bench.execute(root, Denied())
+    text = (root / "reports/research-run.json").read_text()
+    result = json.loads(text)
+    assert result["http_status"] == 401
+    assert result["model"] == "example/model"
+    assert "TEST-SECRET" not in text
+
+
 def test_unidentifiable_source_is_rejected_before_creating_workspace(tmp_path):
     source = tmp_path / "unidentified.md"
     source.write_text("# No bibliography")