From 070c3cdb1711081db1995f0274de2324e9395a7b Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Sat, 22 Aug 2026 00:09:13 +0200
Subject: [PATCH] Report engagement denials without tracebacks

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0260c-4067-7052-9647-ad000d576e38
---
 src/whitehat_security/cli.py |  9 ++++++---
 tests/test_cli.py            | 14 ++++++++++++++
 2 files changed, 20 insertions(+), 3 deletions(-)
 create mode 100644 tests/test_cli.py

diff --git a/src/whitehat_security/cli.py b/src/whitehat_security/cli.py
index ddf7a37..0914591 100644
--- a/src/whitehat_security/cli.py
+++ b/src/whitehat_security/cli.py
@@ -9,7 +9,7 @@ from pathlib import Path
 from .capacity import CapacitySample, characterize
 from .differential import execute
 from .e3 import CADENCE, PROBES
-from .engagement import Engagement
+from .engagement import AuthorizationError, Engagement
 from .fixtures import FixtureService, probe_suite
 from .model import RunReport, utc_now
 from .reporting import risk_nexus_message
@@ -93,7 +93,11 @@ def main(argv: list[str] | None = None) -> None:
             print(rendered, end="")
         raise SystemExit(0 if result["outcome"] == "pass" else 1)
     if args.command == "validate-engagement":
-        record = Engagement.load(args.path)
+        try:
+            record = Engagement.load(args.path)
+        except (AuthorizationError, OSError, ValueError, json.JSONDecodeError) as error:
+            print(f"not authorized: {error}", file=sys.stderr)
+            raise SystemExit(2) from None
         print(f"authorized: {record.raw['engagement_id']}")
         return
     if args.command == "validate-packs":
@@ -120,4 +124,3 @@ def main(argv: list[str] | None = None) -> None:
 
 if __name__ == "__main__":
     main(sys.argv[1:])
-
diff --git a/tests/test_cli.py b/tests/test_cli.py
new file mode 100644
index 0000000..e12c876
--- /dev/null
+++ b/tests/test_cli.py
@@ -0,0 +1,14 @@
+import json
+
+import pytest
+
+from whitehat_security.cli import main
+
+
+def test_validate_engagement_reports_clean_denial(tmp_path, capsys):
+    path = tmp_path / "pending.json"
+    path.write_text(json.dumps({}), encoding="utf-8")
+    with pytest.raises(SystemExit) as stopped:
+        main(["validate-engagement", str(path)])
+    assert stopped.value.code == 2
+    assert capsys.readouterr().err.startswith("not authorized:")