From 4766811350972664bf78d1dd20d27aed5459b095 Mon Sep 17 00:00:00 2001
From: Public Source Publisher <public-source@itworx.tech>
Date: Wed, 14 Oct 2026 04:04:20 +0000
Subject: [PATCH] Publish curated ITWorx_MCP_Hub source from
 8823cc4d95756a93815c82b8ab62215be3d63862

---
 PUBLIC_SOURCE_EXPORT.md              |  2 +-
 PUBLIC_SOURCE_MANIFEST.json          |  6 +--
 tests/test_mcp_hub_release_images.py | 64 ++++++++++++++++++++++++++++
 3 files changed, 68 insertions(+), 4 deletions(-)

diff --git a/PUBLIC_SOURCE_EXPORT.md b/PUBLIC_SOURCE_EXPORT.md
index 4eec050..8c4b1fa 100644
--- a/PUBLIC_SOURCE_EXPORT.md
+++ b/PUBLIC_SOURCE_EXPORT.md
@@ -1,3 +1,3 @@
 # Public source export
 
-This source snapshot was generated from the private canonical repository at revision `0e2f0e88b0359a4ed82515b4b04c0f80069e5e0a`. It contains no private Git history or operational evidence. Changes are published from the canonical repository.
+This source snapshot was generated from the private canonical repository at revision `8823cc4d95756a93815c82b8ab62215be3d63862`. It contains no private Git history or operational evidence. Changes are published from the canonical repository.
diff --git a/PUBLIC_SOURCE_MANIFEST.json b/PUBLIC_SOURCE_MANIFEST.json
index b48ad52..1f4be85 100644
--- a/PUBLIC_SOURCE_MANIFEST.json
+++ b/PUBLIC_SOURCE_MANIFEST.json
@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "sourceRevision": "0e2f0e88b0359a4ed82515b4b04c0f80069e5e0a",
+  "sourceRevision": "8823cc4d95756a93815c82b8ab62215be3d63862",
   "files": [
     {
       "path": ".dockerignore",
@@ -3359,8 +3359,8 @@
     },
     {
       "path": "tests/test_mcp_hub_release_images.py",
-      "sha256": "fcf3a377e47f3e6a4b4410cfcb8f91e5bd9eee090de3ed52e2b581e5ed6417b7",
-      "bytes": 21914
+      "sha256": "c44fb08a07c73164769f97b70f42b5fc412de0ef85ee4a9af62a28b0bfccfd82",
+      "bytes": 24244
     },
     {
       "path": "tests/test_mcp_workflow_prompts.py",
diff --git a/tests/test_mcp_hub_release_images.py b/tests/test_mcp_hub_release_images.py
index b20e1cc..f7e5cf1 100644
--- a/tests/test_mcp_hub_release_images.py
+++ b/tests/test_mcp_hub_release_images.py
@@ -18,6 +18,70 @@ ROOT = Path(__file__).resolve().parents[1]
 SCRIPT = ROOT / "scripts" / "build_mcp_hub_release_images.py"
 
 
+@pytest.mark.parametrize(
+    "failure,category,code",
+    [("exit", "nonzero_exit", 7), ("timeout", "timeout", None), ("os", "exec_error", None)],
+)
+def test_fixed_stage_failure_reports_only_closed_phase_and_category(
+    tmp_path, capsys, failure, category, code
+):
+    marker = "fixture-sensitive-output-must-not-escape"
+
+    def runner(command, **kwargs):
+        assert kwargs["stdout"] == subprocess.DEVNULL
+        assert kwargs["stderr"] == subprocess.DEVNULL
+        if failure == "timeout":
+            raise subprocess.TimeoutExpired([marker], 1, output=marker, stderr=marker)
+        if failure == "os":
+            raise OSError(marker)
+        return subprocess.CompletedProcess(command, code, stdout=marker, stderr=marker)
+
+    env = {
+        name: "fixture"
+        for name in (
+            "GITEA_COMMIT_SHA",
+            "APPOPS_SOURCE_TREE",
+            "APPOPS_BUILD_ID",
+            "APPOPS_BUILD_DATE",
+            "SOURCE_DATE_EPOCH",
+        )
+    }
+    with pytest.raises(producer.BuildRejected) as error:
+        producer._build_contextforge(tmp_path, env, runner=runner)
+    message = str(error.value)
+    assert "stage=contextforge_build" in message
+    assert f"category={category}" in message
+    assert (f"exitCode={code}" in message) if code is not None else "exitCode=" not in message
+    assert marker not in message
+    assert marker not in "".join(capsys.readouterr())
+
+
+def test_unknown_stage_is_rejected_without_running_or_echoing_it(tmp_path):
+    def runner(*args, **kwargs):
+        pytest.fail("unknown stage must not execute")
+
+    with pytest.raises(producer.BuildRejected, match="^fixed release stage identifier is invalid$"):
+        producer._execute(
+            ["fixture"],
+            env={},
+            cwd=tmp_path,
+            timeout=1,
+            stage="fixture-sensitive-stage",
+            runner=runner,
+        )
+
+
+@pytest.mark.parametrize("code", [True, "fixture-sensitive-exit", 2**40])
+def test_invalid_exit_code_is_not_echoed(tmp_path, code):
+    def runner(command, **kwargs):
+        return subprocess.CompletedProcess(command, code)
+
+    with pytest.raises(producer.BuildRejected, match="category=invalid_exit_code$"):
+        producer._execute(
+            ["fixture"], env={}, cwd=tmp_path, timeout=1, stage="compose_local_build", runner=runner
+        )
+
+
 def test_protected_metadata_uses_fixed_https_without_redirecting_credentials(monkeypatch):
     class Opener:
         def open(self, request, timeout):