Report engagement denials without tracebacks

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0260c-4067-7052-9647-ad000d576e38

src/whitehat_security/cli.py

@@ -9,7 +9,7 @@ from pathlib import Path
 from .capacity import CapacitySample, characterize
 from .differential import execute
 from .e3 import CADENCE, PROBES
-from .engagement import Engagement
+from .engagement import AuthorizationError, Engagement
 from .fixtures import FixtureService, probe_suite
 from .model import RunReport, utc_now
 from .reporting import risk_nexus_message
@@ -93,7 +93,11 @@ def main(argv: list[str] | None = None) -> None:
             print(rendered, end="")
         raise SystemExit(0 if result["outcome"] == "pass" else 1)
     if args.command == "validate-engagement":
-        record = Engagement.load(args.path)
+        try:
+            record = Engagement.load(args.path)
+        except (AuthorizationError, OSError, ValueError, json.JSONDecodeError) as error:
+            print(f"not authorized: {error}", file=sys.stderr)
+            raise SystemExit(2) from None
         print(f"authorized: {record.raw['engagement_id']}")
         return
     if args.command == "validate-packs":
@@ -120,4 +124,3 @@ def main(argv: list[str] | None = None) -> None:
 
 if __name__ == "__main__":
     main(sys.argv[1:])
-

tests/test_cli.py

@@ -0,0 +1,14 @@
+import json
+
+import pytest
+
+from whitehat_security.cli import main
+
+
+def test_validate_engagement_reports_clean_denial(tmp_path, capsys):
+    path = tmp_path / "pending.json"
+    path.write_text(json.dumps({}), encoding="utf-8")
+    with pytest.raises(SystemExit) as stopped:
+        main(["validate-engagement", str(path)])
+    assert stopped.value.code == 2
+    assert capsys.readouterr().err.startswith("not authorized:")