Record privileged action failure evidence

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306

tests/test_redact_evidence.py

@@ -2,7 +2,10 @@ import json
 import urllib.error
 from types import SimpleNamespace
 
-from secrets_engine.evidence import EvidenceWriter, _scrub
+import pytest
+
+from secrets_engine.evidence import EvidenceWriter, PrivilegedActionEvidence, _scrub
+from secrets_engine.errors import BackendError, DecisionError
 from secrets_engine.redact import looks_secret, redact_text
 
 
@@ -86,3 +89,53 @@ def test_evidence_records_hub_failure_without_raising(tmp_path, monkeypatch):
     ]
     assert lines[-1]["action"] == "evidence-delivery"
     assert lines[-1]["result"] == "failed"
+
+
+def test_privileged_evidence_records_approval_and_backend_failure(tmp_path):
+    writer = EvidenceWriter(evidence_dir=tmp_path, hub_url="")
+    evidence = PrivilegedActionEvidence(
+        writer,
+        "provision",
+        "lane",
+        "prod",
+        decision_ref="CCR-2026-0001",
+        approval_required=True,
+    )
+
+    with pytest.raises(BackendError, match="fake backend failure"):
+        with evidence:
+            evidence.mark_approved(SimpleNamespace(id="e6381a56-3e55-4fac-b22c-63ee1c152ce8"))
+            raise BackendError("fake backend failure")
+
+    lines = [
+        json.loads(line)
+        for line in next(tmp_path.glob("evidence-*.jsonl")).read_text().splitlines()
+    ]
+    assert [line["result"] for line in lines] == ["attempt", "failed-BackendError"]
+    assert lines[-1]["detail"]["approval_status"] == "approved"
+    assert lines[-1]["detail"]["error_type"] == "BackendError"
+    assert "fake backend failure" not in json.dumps(lines)
+
+
+def test_privileged_evidence_records_rejected_decision_without_message(tmp_path):
+    writer = EvidenceWriter(evidence_dir=tmp_path, hub_url="")
+    evidence = PrivilegedActionEvidence(
+        writer,
+        "apply",
+        "lane",
+        "prod",
+        decision_ref="CCR-2026-0001",
+        approval_required=True,
+    )
+
+    with pytest.raises(DecisionError):
+        with evidence:
+            raise DecisionError("operator prose must not enter evidence")
+
+    lines = [
+        json.loads(line)
+        for line in next(tmp_path.glob("evidence-*.jsonl")).read_text().splitlines()
+    ]
+    assert lines[-1]["result"] == "failed-DecisionError"
+    assert lines[-1]["detail"]["approval_status"] == "rejected"
+    assert "operator prose" not in json.dumps(lines)