Confine publish archive reads

internal/app/commands_test.go

@@ -476,9 +476,6 @@ func writeValidConfigFiles(t *testing.T, workspaceRoot string, transcribeURL ...
 	seriatimBinary := writeSeriatimAppTestWrapper(t)
 	scriptoriumBinary := writeScriptoriumAppTestWrapper(t)
 	auditaBinary := writeAuditaAppTestWrapper(t)
-	t.Setenv("GO_WANT_APP_SERIATIM_HELPER", "1")
-	t.Setenv("GO_WANT_APP_SCRIPTORIUM_HELPER", "1")
-	t.Setenv("GO_WANT_APP_AUDITA_HELPER", "1")
 	t.Setenv("AUDITA_LLM_API_KEY", "test-audita-key")
 	t.Setenv("PATH", filepath.Dir(scriptoriumBinary)+string(os.PathListSeparator)+os.Getenv("PATH"))
 
@@ -623,7 +620,7 @@ func writeScriptoriumAppTestWrapper(t *testing.T) string {
 }
 
 func TestScriptoriumAppHelper(t *testing.T) {
-	if os.Getenv("GO_WANT_APP_SCRIPTORIUM_HELPER") != "1" {
+	if !appHelperInvocation() {
 		return
 	}
 
@@ -663,7 +660,7 @@ func TestScriptoriumAppHelper(t *testing.T) {
 }
 
 func TestSeriatimAppHelper(t *testing.T) {
-	if os.Getenv("GO_WANT_APP_SERIATIM_HELPER") != "1" {
+	if !appHelperInvocation() {
 		return
 	}
 
@@ -725,7 +722,7 @@ func writeAuditaAppTestWrapper(t *testing.T) string {
 }
 
 func TestAuditaAppHelper(t *testing.T) {
-	if os.Getenv("GO_WANT_APP_AUDITA_HELPER") != "1" {
+	if !appHelperInvocation() {
 		return
 	}
 
@@ -779,6 +776,15 @@ func TestAuditaAppHelper(t *testing.T) {
 	os.Exit(0)
 }
 
+func appHelperInvocation() bool {
+	for _, arg := range os.Args {
+		if arg == "--" {
+			return true
+		}
+	}
+	return false
+}
+
 func appSeriatimFlagValue(args []string, name string) string {
 	for i := 0; i < len(args)-1; i++ {
 		if args[i] == name {

internal/app/post_publish_cleanup_test.go

@@ -3,6 +3,7 @@ package app
 import (
 	"context"
 	"errors"
+	"io"
 	"os"
 	"path/filepath"
 	"strings"
@@ -402,6 +403,13 @@ func (s *failKeyStore) Upload(ctx context.Context, localPath, key string, opts s
 	return s.delegate.Upload(ctx, localPath, key, opts)
 }
 
+func (s *failKeyStore) UploadReader(ctx context.Context, source io.Reader, key string, opts storage.UploadOptions) (storage.ObjectInfo, error) {
+	if strings.TrimSpace(key) == strings.TrimSpace(s.failKey) {
+		return storage.ObjectInfo{}, errors.New("forced upload failure")
+	}
+	return s.delegate.UploadReader(ctx, source, key, opts)
+}
+
 func (s *failKeyStore) Exists(ctx context.Context, key string) (bool, error) {
 	return s.delegate.Exists(ctx, key)
 }

internal/app/runner.go

@@ -483,6 +483,7 @@ func mapResultOutputs(stageName string, result *stage.StageResult, runID string)
 			Kind:               kind,
 			SourceID:           sourceID,
 			LocalPath:          localPath,
+			ArchivePath:        ref.ArchivePath,
 			Contract:           cloneContractMetadata(ref.Contract),
 			ExternalProvenance: cloneExternalProvenance(ref.ExternalProvenance),
 			ProducerRunID:      runID,