Improve error handling and diagnostics for the audita subprocess

internal/adapters/audita/subprocess.go

@@ -157,14 +157,16 @@ func (r *SubprocessRunner) Run(ctx context.Context, req PolishRequest) (PolishRe
 	}
 	args := r.buildArgs(req, reqModules)
 
+	credentialEnvVar := strings.TrimSpace(r.llmAPIKeyEnv)
 	credentialPresent := false
 	env := map[string]string{}
-	if strings.TrimSpace(r.llmAPIKeyEnv) != "" {
-		credential, ok := os.LookupEnv(r.llmAPIKeyEnv)
-		if ok && strings.TrimSpace(credential) != "" {
-			env["AUDITA_LLM_API_KEY"] = credential
-			credentialPresent = true
+	if credentialEnvVar != "" {
+		credential, ok := os.LookupEnv(credentialEnvVar)
+		if !ok || strings.TrimSpace(credential) == "" {
+			return PolishResult{}, fmt.Errorf("audita: required credential environment variable %s is not set", credentialEnvVar)
 		}
+		env["AUDITA_LLM_API_KEY"] = credential
+		credentialPresent = true
 	}
 	primaryConcurrencyViaEnv := false
 	if r.llmConcurrency != nil {
@@ -187,7 +189,13 @@ func (r *SubprocessRunner) Run(ctx context.Context, req PolishRequest) (PolishRe
 		StderrLogPath: req.StderrLogPath,
 	})
 	if err != nil {
-		return r.failureResult(req, reqModules, runRes, credentialPresent, primaryConcurrencyViaEnv), fmt.Errorf("run audita process (binary=%q): %w", r.binary, err)
+		return r.failureResult(req, reqModules, runRes, credentialPresent, primaryConcurrencyViaEnv), fmt.Errorf(
+			"run audita process (binary=%q, stdout_log=%q, stderr_log=%q): %w",
+			r.binary,
+			req.StdoutLogPath,
+			req.StderrLogPath,
+			err,
+		)
 	}
 
 	if err := validateProcessedOutput(req.OutputProcessedPath); err != nil {

internal/adapters/audita/subprocess_test.go

@@ -120,7 +120,33 @@ func TestSubprocessRunnerSuccessArgsEnvAndValidation(t *testing.T) {
 	}
 }
 
-func TestSubprocessRunnerMissingCredentialEnvOmitsCredential(t *testing.T) {
+func TestSubprocessRunnerMissingConfiguredCredentialFails(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("helper wrapper script uses /bin/sh")
+	}
+	llmConcurrency := 1
+	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
+		Binary:         writeAuditaHelperWrapper(t),
+		Timeout:        mustParseAuditaDuration(t, "2s"),
+		LLMAPIKeyEnv:   "MISSING_AUDITA_KEY",
+		Modules:        []string{"glossary"},
+		BaseURL:        "https://openrouter.ai/api/v1",
+		Model:          "openrouter/google/gemma-4-31b-it",
+		LLMConcurrency: &llmConcurrency,
+		Report:         false,
+	})
+	req := auditaReqForTest(t, false)
+
+	_, err := runner.Run(context.Background(), req)
+	if err == nil {
+		t.Fatal("expected error, got nil")
+	}
+	if !strings.Contains(err.Error(), "required credential environment variable MISSING_AUDITA_KEY is not set") {
+		t.Fatalf("error = %q, want missing credential guidance", err.Error())
+	}
+}
+
+func TestSubprocessRunnerUnconfiguredCredentialEnvOmitsCredential(t *testing.T) {
 	if runtime.GOOS == "windows" {
 		t.Skip("helper wrapper script uses /bin/sh")
 	}
@@ -133,7 +159,7 @@ func TestSubprocessRunnerMissingCredentialEnvOmitsCredential(t *testing.T) {
 	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
 		Binary:         writeAuditaHelperWrapper(t),
 		Timeout:        mustParseAuditaDuration(t, "2s"),
-		LLMAPIKeyEnv:   "MISSING_AUDITA_KEY",
+		LLMAPIKeyEnv:   "",
 		Modules:        []string{"glossary"},
 		BaseURL:        "https://openrouter.ai/api/v1",
 		Model:          "openrouter/google/gemma-4-31b-it",
@@ -186,6 +212,9 @@ func TestSubprocessRunnerSubprocessFailure(t *testing.T) {
 	if !strings.Contains(err.Error(), "exit code") {
 		t.Fatalf("error = %q, want exit code context", err.Error())
 	}
+	if !strings.Contains(err.Error(), req.StdoutLogPath) || !strings.Contains(err.Error(), req.StderrLogPath) {
+		t.Fatalf("error = %q, want stdout/stderr log paths", err.Error())
+	}
 }
 
 func TestSubprocessRunnerMissingOutputFails(t *testing.T) {