ci(runner): identify guardian admission failures

packages/paperclip-runner/runner/crates/runner-core/src/acpx_sidecar_transport.rs

@@ -651,6 +651,23 @@ fn response_error_classification(error: &ResponseError) -> &'static str {
         "ERR_ACPX_UNVERIFIED_MODULE" => return "diagnostic_unverified_module",
         "ETIMEDOUT" => return "diagnostic_timed_out",
         "acpx_sidecar_command_failed" => return "diagnostic_uncoded_sidecar_failure",
+        "DIAGNOSTIC_ACPX_GUARDIAN_OWNERSHIP_TIMEOUT" => {
+            return "diagnostic_guardian_ownership_timeout"
+        }
+        "DIAGNOSTIC_ACPX_GUARDIAN_EXITED_BEFORE_OWNERSHIP" => {
+            return "diagnostic_guardian_exited_before_ownership"
+        }
+        "DIAGNOSTIC_ACPX_GUARDIAN_START_FAILED" => return "diagnostic_guardian_start_failed",
+        "DIAGNOSTIC_ACPX_GUARDIAN_OWNERSHIP_PIPE_MISSING" => {
+            return "diagnostic_guardian_ownership_pipe_missing"
+        }
+        "DIAGNOSTIC_ACPX_CREDENTIAL_OWNERSHIP_LOST" => {
+            return "diagnostic_credential_ownership_lost"
+        }
+        "DIAGNOSTIC_ACPX_CREDENTIAL_OWNER_INVALID" => return "diagnostic_credential_owner_invalid",
+        "DIAGNOSTIC_ACPX_PROVIDER_EXIT_PROOF_MISSING" => {
+            return "diagnostic_provider_exit_proof_missing"
+        }
         "ACPX_RUNTIME_ADMISSION_VERIFICATION_TIMEOUT" => {
             return "runtime_admission_verification_timeout"
         }

packages/paperclip-runner/src/cli/acpx-sidecar-input.ts

@@ -70,6 +70,8 @@ function directAcpxSidecarErrorCode(error: Error): string | null {
       ? detailCode
       : (outputCode ?? detailCode);
   if (code === null) {
+    const guardianDiagnostic = diagnosticGuardianErrorCode(error.message);
+    if (guardianDiagnostic !== null) return guardianDiagnostic;
     return error.name === "AcpxSessionHandshakeTimeoutError" ||
       error.message === "ACPX session handshake exceeded its admission deadline"
       ? "ACPX_SESSION_HANDSHAKE_TIMEOUT"
@@ -112,6 +114,36 @@ function directAcpxSidecarErrorCode(error: Error): string | null {
   return "AGENT_STARTUP_FAILED.OTHER";
 }
 
+function diagnosticGuardianErrorCode(message: string): string | null {
+  if (message === "ACPX provider lifetime guardian ownership timed out") {
+    return "DIAGNOSTIC_ACPX_GUARDIAN_OWNERSHIP_TIMEOUT";
+  }
+  if (
+    message ===
+    "ACPX provider lifetime guardian exited before ownership transfer"
+  ) {
+    return "DIAGNOSTIC_ACPX_GUARDIAN_EXITED_BEFORE_OWNERSHIP";
+  }
+  if (message === "ACPX provider lifetime guardian failed to start") {
+    return "DIAGNOSTIC_ACPX_GUARDIAN_START_FAILED";
+  }
+  if (
+    message === "ACPX provider lifetime guardian omitted its ownership pipe"
+  ) {
+    return "DIAGNOSTIC_ACPX_GUARDIAN_OWNERSHIP_PIPE_MISSING";
+  }
+  if (message === "Managed Codex credential ownership was lost") {
+    return "DIAGNOSTIC_ACPX_CREDENTIAL_OWNERSHIP_LOST";
+  }
+  if (message === "Managed Codex credential lifetime owner is invalid") {
+    return "DIAGNOSTIC_ACPX_CREDENTIAL_OWNER_INVALID";
+  }
+  if (message === "ACPX provider exit proof is unavailable") {
+    return "DIAGNOSTIC_ACPX_PROVIDER_EXIT_PROOF_MISSING";
+  }
+  return null;
+}
+
 const GENERIC_ACPX_OUTPUT_CODES = new Set([
   "NO_SESSION",
   "TIMEOUT",
@@ -153,5 +185,12 @@ const STABLE_ACPX_SIDECAR_CODES = new Set([
   "ACPX_SESSION_ENSURE_TYPE_ERROR",
   "ACPX_SESSION_HANDSHAKE_TIMEOUT",
   "ACPX_SIDECAR_STATUS_READ_TIMEOUT",
+  "DIAGNOSTIC_ACPX_CREDENTIAL_OWNER_INVALID",
+  "DIAGNOSTIC_ACPX_CREDENTIAL_OWNERSHIP_LOST",
+  "DIAGNOSTIC_ACPX_GUARDIAN_EXITED_BEFORE_OWNERSHIP",
+  "DIAGNOSTIC_ACPX_GUARDIAN_OWNERSHIP_PIPE_MISSING",
+  "DIAGNOSTIC_ACPX_GUARDIAN_OWNERSHIP_TIMEOUT",
+  "DIAGNOSTIC_ACPX_GUARDIAN_START_FAILED",
+  "DIAGNOSTIC_ACPX_PROVIDER_EXIT_PROOF_MISSING",
   ...GENERIC_ACPX_OUTPUT_CODES,
 ]);