fix(smoke): report sanitized operation failure diagnostics

scripts/authenticated-product-smoke.py

@@ -21,10 +21,17 @@ class SmokeError(RuntimeError):
     pass
 
 
-def safe_error(stage: str, code: str, status: int | None = None) -> SmokeError:
+def safe_error(
+    stage: str,
+    code: str,
+    status: int | None = None,
+    trace_id: str | None = None,
+) -> SmokeError:
     message = f"stage={stage[:64]} code={code[:96]}"
     if status is not None:
         message += f" status={status}"
+    if trace_id is not None:
+        message += f" trace_id={trace_id}"
     return SmokeError(message[:256])
 
 
@@ -286,6 +293,29 @@ def create_operation(
         raise safe_error("operation_create", "invalid_response") from error
 
 
+def is_safe_diagnostic_identifier(value: Any) -> bool:
+    return (
+        isinstance(value, str)
+        and 1 <= len(value) <= 64
+        and value[0].islower()
+        and value[0].isascii()
+        and all(
+            character.isascii()
+            and (character.islower() or character.isdigit() or character == "_")
+            for character in value
+        )
+    )
+
+
+def is_safe_trace_id(value: Any) -> bool:
+    return (
+        isinstance(value, str)
+        and len(value) == 32
+        and value != "0" * 32
+        and all(character in "0123456789abcdef" for character in value)
+    )
+
+
 def run_operation_test(
     client: Client,
     workspace_id: str,
@@ -297,9 +327,24 @@ def run_operation_test(
         admin_path(workspace_id, f"/operations/{operation_id}/test-runs"),
         {"version": operation_version, "input": {"probe": "ok"}},
     ).body
-    if not isinstance(result, dict) or result.get("ok") is not True:
+    if isinstance(result, dict) and result.get("ok") is True:
+        return
+    if not isinstance(result, dict) or result.get("ok") is not False:
         raise safe_error("operation_test", "outcome_not_ok")
 
+    errors = result.get("errors")
+    failure = errors[0] if isinstance(errors, list) and errors else None
+    code = failure.get("code") if isinstance(failure, dict) else None
+    stage = failure.get("stage") if isinstance(failure, dict) else None
+    trace_id = result.get("trace_id")
+    if (
+        is_safe_diagnostic_identifier(code)
+        and is_safe_diagnostic_identifier(stage)
+        and is_safe_trace_id(trace_id)
+    ):
+        raise safe_error(stage, code, trace_id=trace_id)
+    raise safe_error("operation_test", "outcome_not_ok")
+
 
 def operation_etag(client: Client, workspace_id: str, operation_id: str) -> str:
     response = client.request_json(