mlspace-plugin 0.3.3__tar.gz → 0.3.4__tar.gz

{mlspace_plugin-0.3.3 → mlspace_plugin-0.3.4}/INSTALL.md

@@ -21,7 +21,7 @@ mlspace-plugin setup
 ```
 
 Если пакет уже установлен: `uv tool install --force .`.
-При установке из wheel: `uv tool install /путь/к/mlspace_plugin-0.3.3-py3-none-any.whl`.
+При установке из wheel: `uv tool install /путь/к/mlspace_plugin-0.3.4-py3-none-any.whl`.
 Не используйте editable-установку из `/tmp` для постоянной работы.
 Далее команды показаны для PyPI. После установки исходников или wheel через
 `uv tool install` заменяйте `uvx mlspace-plugin@latest` на `mlspace-plugin`,

{mlspace_plugin-0.3.3 → mlspace_plugin-0.3.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: mlspace-plugin
-Version: 0.3.3
+Version: 0.3.4
 Summary: Cloud.ru MLSpace plugin: MCP server, agent skills and setup
 Project-URL: Repository, https://github.com/noesskeetit/mlspace-plugin
 Project-URL: Issues, https://github.com/noesskeetit/mlspace-plugin/issues

{mlspace_plugin-0.3.3 → mlspace_plugin-0.3.4}/RELEASE.md

@@ -7,11 +7,11 @@
    `uv lock` и `uv run python scripts/gen_plugin.py`. Обновите примеры имён wheel/ZIP
    в инструкциях, если версия присутствует в имени файла.
 2. Выполните проверки из `CONTRIBUTING.md` на Linux и macOS.
-3. Соберите пакет (в командах ниже замените 0.3.3 на выпускаемую версию):
+3. Соберите пакет (в командах ниже замените 0.3.4 на выпускаемую версию):
 
 ```sh
-uv build --out-dir dist/release-0.3.3
-uv run python scripts/build_plugin.py --output dist/plugin-release-0.3.3
+uv build --out-dir dist/release-0.3.4
+uv run python scripts/build_plugin.py --output dist/plugin-release-0.3.4
 ```
 
 4. Просмотрите содержимое wheel, sdist и ZIP. В них не должно быть credentials,
@@ -23,11 +23,11 @@ uv run python scripts/build_plugin.py --output dist/plugin-release-0.3.3
    `UV_PUBLISH_TOKEN` средствами вашего хранилища секретов, не аргументом команды:
 
 ```sh
-uv publish --trusted-publishing never dist/release-0.3.3/mlspace_plugin-0.3.3-py3-none-any.whl dist/release-0.3.3/mlspace_plugin-0.3.3.tar.gz
+uv publish --trusted-publishing never dist/release-0.3.4/mlspace_plugin-0.3.4-py3-none-any.whl dist/release-0.3.4/mlspace_plugin-0.3.4.tar.gz
 ```
 
 6. Проверьте версию и SHA256 обоих файлов через PyPI JSON API; проверьте установку
-   `uvx --from mlspace-plugin==0.3.3 mlspace-plugin --version` из нового кеша.
+   `uvx --from mlspace-plugin==0.3.4 mlspace-plugin --version` из нового кеша.
 7. Только после проверки точной версии в PyPI обновите рабочую ветку GitHub
    marketplace и создайте тег релиза. До этого проверяйте изменения на отдельной
    release-ветке или локальном Git marketplace: main не должен ссылаться на

{mlspace_plugin-0.3.3 → mlspace_plugin-0.3.4}/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mlspace",
-  "version": "0.3.3",
+  "version": "0.3.4",
   "description": "Cloud.ru MLSpace: training jobs, inference, notebooks, data transfer, registry and compute catalog — an MCP server plus skills.",
   "author": {
     "name": "Cloud.ru"

{mlspace_plugin-0.3.3 → mlspace_plugin-0.3.4}/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mlspace",
-  "version": "0.3.3",
+  "version": "0.3.4",
   "description": "Cloud.ru MLSpace: training jobs, inference, notebooks, data transfer, registry and compute catalog — an MCP server plus skills.",
   "author": {
     "name": "Cloud.ru"

{mlspace_plugin-0.3.3 → mlspace_plugin-0.3.4}/plugin/.mcp.json

@@ -5,7 +5,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "mlspace-plugin==0.3.3",
+        "mlspace-plugin==0.3.4",
         "mlspace-plugin",
         "--transport",
         "stdio"

{mlspace_plugin-0.3.3 → mlspace_plugin-0.3.4}/plugin/mcp.json

@@ -6,7 +6,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "mlspace-plugin==0.3.3",
+        "mlspace-plugin==0.3.4",
         "mlspace-plugin",
         "--transport",
         "stdio"

{mlspace_plugin-0.3.3 → mlspace_plugin-0.3.4}/plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "mlspace",
-  "version": "0.3.3",
+  "version": "0.3.4",
   "description": "Cloud.ru MLSpace: training jobs, inference, notebooks, data transfer, registry and compute catalog — an MCP server plus skills.",
   "author": {
     "name": "Cloud.ru"

{mlspace_plugin-0.3.3 → mlspace_plugin-0.3.4}/plugin/skills/mlspace-diagnose-data-transfer/SKILL.md

@@ -23,6 +23,18 @@ carried out any other way.
 
 ## Procedure
 
+Final-answer contract:
+- **Status and reported counters**: observations returned by the API.
+- **Failure cause and phase**: use explicit matching log evidence; otherwise unknown.
+- **Data impact**: unknown until an independent source/destination contents check
+  establishes it. Even a known cause such as AccessDenied at PutObject does not
+  establish whether other writes in the run already happened. A known cause and
+  unknown data impact can both be true. Zero counters are not that contents check.
+
+The tool's `_mcp_evidence` describes the limits of those observations, not an API
+defect or a separate user-facing warning. Never translate zero counters into
+"the run failed before transfer started" or "nothing was read/written".
+
 Goal: determine whether a data transfer truly failed / was partial, and why.
 1. Resolve the transfer: if transfer_id given use it, else data_transfer list_transfers
    and match transfer_name.

{mlspace_plugin-0.3.3 → mlspace_plugin-0.3.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "mlspace-plugin"
-version = "0.3.3"
+version = "0.3.4"
 description = "Cloud.ru MLSpace plugin: MCP server, agent skills and setup"
 keywords = ["mlspace", "mcp", "agent-skills", "cloudru"]
 classifiers = [

{mlspace_plugin-0.3.3 → mlspace_plugin-0.3.4}/src/mlspace_mcp/__init__.py

@@ -1,4 +1,4 @@
 """mlspace_mcp — MCP server for the Cloud.ru MLSpace public API v2."""
 
-__version__ = "0.3.3"
+__version__ = "0.3.4"
 USER_AGENT = f"mlspace-plugin/{__version__}"

mlspace_plugin-0.3.4/src/mlspace_mcp/data_transfer_hooks.py

@@ -0,0 +1,68 @@
+"""Evidence boundaries alongside Data Transfer observations, without new API calls."""
+from __future__ import annotations
+
+from typing import Any
+
+_DATA_IMPACT_GUIDANCE = (
+    'In the final diagnosis explicitly state: Data impact is unverified. '
+    'Do not claim that the source was read, nothing was written, or destination '
+    'data is unchanged without an independent contents check. A failed PutObject '
+    'describes that request, not other objects or earlier attempts in the run.'
+)
+
+
+def _unknown_evidence() -> dict[str, str]:
+    return {
+        'failure_cause': 'unknown',
+        'failure_phase': 'unknown',
+        'data_impact': 'unknown',
+        'reporting_requirement': _DATA_IMPACT_GUIDANCE,
+        'basis': 'Counters/empty logs alone; independent evidence may establish more.',
+        'interpretation': (
+            'Reported counters (including zero) and absent logs do not prove that '
+            'the run stopped before reading/writing or left destination data unchanged.'
+        ),
+    }
+
+
+def history_evidence(data: Any, values: dict[str, Any]) -> Any:
+    """Preserve history shape and counters; failed/cancelled entries lack a diagnosis."""
+    if isinstance(data, list):
+        return [history_evidence(row, values) for row in data]
+    if isinstance(data, dict):
+        if isinstance(data.get('data'), list):
+            return {**data, 'data': history_evidence(data['data'], values)}
+        if data.get('status') in ('failed', 'cancelled'):
+            return {**data, '_mcp_evidence': _unknown_evidence()}
+    return data
+
+
+def log_evidence(data: Any, values: dict[str, Any]) -> Any:
+    """Keep log evidence intact; individual events are not a destination-data audit."""
+    empty = data is None or data == [] or data == {} or data == ''
+    recognized = isinstance(data, list)
+    if isinstance(data, dict) and data:
+        collections = {'items', 'data', 'events', 'logs'}
+        metadata = {'count', 'total_count', 'offset', 'limit', 'page', 'page_size', 'status'}
+        present = collections & data.keys()
+        recognized = any(isinstance(data[key], list) for key in present)
+        empty = bool(present) and all(data[key] == [] for key in present) and (
+            not (data.keys() - collections - metadata)
+        ) and all(not data.get(key) for key in ('count', 'total_count'))
+    if empty:
+        return {'result': data, '_mcp_evidence': _unknown_evidence()}
+    if recognized:
+        evidence = {
+            'data_impact': 'unknown',
+            'reporting_requirement': _DATA_IMPACT_GUIDANCE,
+            'basis': 'Logs describe individual events, not a complete source/destination audit.',
+            'interpretation': (
+                'Use explicit log messages to identify cause and failure phase. '
+                'Report data impact separately as unknown until source/destination contents '
+                'are independently checked. Even AccessDenied and all-zero counters do not '
+                'establish that this entire run left destination data unchanged.'
+            ),
+        }
+        result = data if isinstance(data, dict) else {'result': data}
+        return {**result, '_mcp_evidence': evidence}
+    return data

{mlspace_plugin-0.3.3 → mlspace_plugin-0.3.4}/src/mlspace_mcp/init_cli.py

@@ -9,6 +9,7 @@ import re
 import stat
 import sys
 import tempfile
+from contextlib import nullcontext
 from pathlib import Path
 from typing import Any
 from urllib.parse import urlsplit
@@ -35,7 +36,7 @@ from .config import (
     user_config_file,
 )
 from .setup_conflicts import Resolutions, choose_resolutions
-from .setup_ui import choose_workspaces, display, masked_prompt
+from .setup_ui import choose_workspaces, display, hidden_input, masked_prompt
 from .setup_verification import verify_client
 from .tls import safe_error as _safe_error
 from .tls import tls_context
@@ -44,14 +45,15 @@ HEADER = f'# MLSpace credentials, written by mlspace-plugin setup.\n{LITERAL_DOT
 
 
 def _ask(label: str, secret: bool = True, hidden: bool = True) -> str:
-    while True:
-        value = masked_prompt(f'  {label}: ') if hidden else input(f'  {label}: ')
-        if re.match(r'^\s*(?:export\s+)?MLSPACE_\w+\s*=', value):
-            print('Вставьте только значение ключа: без MLSPACE_...=, export и кавычек вокруг значения.', file=sys.stderr)
-        elif value.strip():
-            return value if secret else value.strip()
-        else:
-            print('Поле обязательно. Вставьте значение ключа; звёздочки подтверждают ввод и скрывают его содержимое.', file=sys.stderr)
+    with hidden_input() if hidden else nullcontext():
+        while True:
+            value = masked_prompt(f'  {label}: ') if hidden else input(f'  {label}: ')
+            if re.match(r'^\s*(?:export\s+)?MLSPACE_\w+\s*=', value):
+                print('Вставьте только значение ключа: без MLSPACE_...=, export и кавычек вокруг значения.', file=sys.stderr)
+            elif value.strip():
+                return value if secret else value.strip()
+            else:
+                print('Поле обязательно. Вставьте значение ключа; звёздочки подтверждают ввод и скрывают его содержимое.', file=sys.stderr)
 
 
 def _resolve_base_url(target: Path, override: str | None) -> str:
@@ -315,14 +317,15 @@ def _run_init(path: Path | None, **options: Any) -> int:
     else:
         source = {}
     keys = {}
-    for name, label in [('CLIENT_ID', 'Cloud.ru Key ID'), ('CLIENT_SECRET', 'Cloud.ru Key Secret')]:
-        value = source.get('MLSPACE_' + name)
-        if not value or not value.strip():
-            if non_interactive or options['credentials_file'] or options['from_env']:
-                raise ValueError('Для этого адреса API отсутствуют ключи. Введите их через setup в терминале '
-                                 'либо явно укажите --from-env или --credentials-file.')
-            value = _ask(label, secret=name == 'CLIENT_SECRET')
-        keys[name] = value
+    with hidden_input():
+        for name, label in [('CLIENT_ID', 'Cloud.ru Key ID'), ('CLIENT_SECRET', 'Cloud.ru Key Secret')]:
+            value = source.get('MLSPACE_' + name)
+            if not value or not value.strip():
+                if non_interactive or options['credentials_file'] or options['from_env']:
+                    raise ValueError('Для этого адреса API отсутствуют ключи. Введите их через setup в терминале '
+                                     'либо явно укажите --from-env или --credentials-file.')
+                value = _ask(label, secret=name == 'CLIENT_SECRET')
+            keys[name] = value
     ca = str(options['ca_file'] or saved.get('MLSPACE_CA_FILE') or os.environ.get('SSL_CERT_FILE') or '')
     ca = str(Path(ca).expanduser().absolute()) if ca else ''
     if not listing:

{mlspace_plugin-0.3.3 → mlspace_plugin-0.3.4}/src/mlspace_mcp/registry.py

@@ -25,6 +25,7 @@ from pydantic import Field
 
 from . import bodyspec, formatting
 from .config import Settings
+from .data_transfer_hooks import history_evidence, log_evidence
 from .errors import MLSpaceError
 from .job_hooks import (
     guard_job_delete,
@@ -322,6 +323,10 @@ PREFLIGHT[("POST", "/public/v2/jobs")] = preflight_job_run
 PREFLIGHT[("GET", "/public/v2/jobs")] = preflight_jobs_list
 GUARDS[("DELETE", "/public/v2/jobs/{job_name}")] = guard_job_delete
 POSTPROCESS[("DELETE", "/public/v2/jobs/{job_name}")] = postprocess_job_delete
+POSTPROCESS[("GET", "/public/v2/data_transfer/v3/history")] = history_evidence
+POSTPROCESS[("GET", "/public/v2/data_transfer/v3/history/status/stream")] = history_evidence
+POSTPROCESS[("GET", "/public/v2/data_transfer/v2/events/list")] = log_evidence
+POSTPROCESS[("GET", "/public/v2/data_transfer/v3/connectors/{connector_type}/{id_}/try/logs")] = log_evidence
 
 
 def _postprocess_delete_connectors(data: Any, values: dict[str, Any]) -> Any:

{mlspace_plugin-0.3.3 → mlspace_plugin-0.3.4}/src/mlspace_mcp/setup_ui.py

@@ -2,10 +2,13 @@
 from __future__ import annotations
 
 import sys
+from collections.abc import Iterator
+from contextlib import closing, contextmanager
 from dataclasses import dataclass, field
 from typing import Any
 
 from prompt_toolkit import Application, PromptSession
+from prompt_toolkit.input import create_input
 from prompt_toolkit.key_binding import KeyBindings
 from prompt_toolkit.layout import HSplit, Layout, Window
 from prompt_toolkit.layout.controls import FormattedTextControl
@@ -24,6 +27,21 @@ def masked_prompt(label: str, **kwargs: Any) -> str:
                       **kwargs).prompt(label))
 
 
+@contextmanager
+def hidden_input() -> Iterator[None]:
+    """Keep type-ahead hidden between credential prompts, restoring the TTY on exit.
+
+    PromptSession restores its caller's terminal mode after each prompt. Keep an
+    outer raw mode across validation/retries and both credentials so it restores
+    to a non-echoing mode, not the shell's echoing mode. Nested scopes are safe.
+    """
+    if not sys.stdin.isatty():
+        yield
+        return
+    with closing(create_input()) as terminal, terminal.raw_mode():
+        yield
+
+
 @dataclass
 class WorkspaceSelection:
     rows: list[dict[str, str]]

{mlspace_plugin-0.3.3 → mlspace_plugin-0.3.4}/src/mlspace_mcp/tools/data_transfer.py

@@ -184,6 +184,9 @@ ACTIONS: dict[str, Op] = {
         required=("offset", "limit"),
         kind="list",
         help="Get transfer event logs (needs offset+limit and either history_id or transfer_id). "
+             "In a diagnosis, report cause and data impact separately. Explicitly state "
+             "that data impact is unverified unless source/destination contents were checked; "
+             "AccessDenied or zero counters cannot prove that nothing was written. "
              "If empty, cross-check run status and connector logs; do not infer success "
              "or a specific cause from absent events. Rerunning changes state; never "
              "recommend a rerun as a read-only diagnostic check.",
@@ -271,8 +274,13 @@ DOMAIN = DomainTool(
     name="mlspace_data_transfer",
     title="MLSpace Data Transfer",
     summary=(
-        "Manage MLSpace data-transfer connectors, transfers, and migration history "
-        "(create/update/try connectors, run/cancel/rerun transfers, inspect logs). "
+        "Inspect connectors, transfers, run history and logs; manage transfers and user connectors. "
+        "Capability boundary: creating connectors is supported ONLY for postgresql, mssql, mysql, "
+        "clickhouse, oracledb, s3amazon, s3custom, s3google. Existing system connectors "
+        "(NFS, S3 MLSpace/Evolution/DataHub, HDFS) can be inspected and used by transfers, "
+        "but this tool cannot create them. Do not describe source discovery as creation support. "
+        "For a service overview, briefly describe connectors, transfer configurations, and "
+        "run history/logs. Diagnostic caveats belong in an actual investigation. "
         "For failed-run diagnosis, use the mlspace-diagnose-data-transfer skill when available."
     ),
     actions=ACTIONS,

mlspace_plugin-0.3.4/tests/test_acceptance_regressions.py

@@ -0,0 +1,177 @@
+"""User-visible regressions found by the OpenCode acceptance journey."""
+from __future__ import annotations
+
+import json
+import os
+import select
+import subprocess
+import sys
+import time
+
+import httpx
+import pytest
+import respx
+from conftest import AUTH_URL, BASE_URL, make_settings, runtime_ctx
+
+from mlspace_mcp.registry import _build_handler, available_actions
+from mlspace_mcp.tools.data_transfer import DOMAIN
+
+
+@pytest.mark.parametrize('invalid', [b'\r', b'MLSPACE_CLIENT_SECRET=wrong\r'])
+@pytest.mark.parametrize('cancel', [False, True])
+def test_early_secret_input_is_masked_during_retry_and_echo_is_restored(invalid, cancel):
+    master, slave = os.openpty()
+    code = '''
+import termios
+from mlspace_mcp.init_cli import _ask
+before = termios.tcgetattr(0)
+try:
+    assert _ask('Secret') == 'SYNTHETIC-EARLY-PASTE'
+    print('ACCEPTED')
+except KeyboardInterrupt:
+    print('CANCELLED')
+finally:
+    after = termios.tcgetattr(0)
+    # macOS sets PENDIN itself when canonical input is restored.
+    before[3] &= ~getattr(termios, 'PENDIN', 0)
+    after[3] &= ~getattr(termios, 'PENDIN', 0)
+    assert after == before
+    print('TTY_RESTORED')
+'''
+    process = subprocess.Popen([sys.executable, '-c', code], stdin=slave, stdout=slave,
+                               stderr=slave, env=dict(os.environ, TERM='xterm',
+                                                     PROMPT_TOOLKIT_NO_CPR='1'))
+    os.close(slave)
+    transcript = b''
+    stage = 0
+    try:
+        deadline = time.monotonic() + 12
+        while time.monotonic() < deadline:
+            if select.select([master], [], [], 0.05)[0]:
+                try:
+                    chunk = os.read(master, 65536)
+                except OSError:
+                    break
+                transcript += chunk
+                if stage == 0 and b'Secret:' in transcript:
+                    os.write(master, invalid)
+                    stage = 1
+                if stage == 1 and any(x.encode() in transcript for x in
+                                     ('Поле обязательно', 'Вставьте только значение')):
+                    # Type ahead immediately, before the next PromptSession is ready.
+                    os.write(master, b'\x03' if cancel else
+                             b'\x1b[200~SYNTHETIC-EARLY-PASTE\x1b[201~\r')
+                    stage = 2
+            if process.poll() is not None:
+                break
+        assert process.wait(timeout=2) == 0, transcript.decode(errors="replace")
+        assert b'TTY_RESTORED' in transcript
+        assert (b'CANCELLED' if cancel else b'ACCEPTED') in transcript
+        assert b'SYNTHETIC-EARLY-PASTE' not in transcript
+    finally:
+        if process.poll() is None:
+            process.kill()
+            process.wait()
+        os.close(master)
+
+
+@pytest.mark.parametrize('action,body,kwargs', [
+    ('list_history', {'data': [{'history_id': 'h', 'status': 'failed', 'size_bytes': 0,
+                               'rows_count': 0, 'progress': 0}], 'total_count': 1}, {}),
+    ('list_history', {'data': [{'history_id': 'h', 'status': 'failed', 'size_bytes': 512}],
+                      'total_count': 1}, {}),
+    ('get_history_status', [{'history_id': 'h', 'status': 'cancelled'}], {'ids': ['h']}),
+])
+async def test_failed_run_returns_explicit_evidence_limits_without_changing_observations(action, body, kwargs):
+    handler = _build_handler(DOMAIN, available_actions(DOMAIN, True), make_settings())
+    with respx.mock as mock:
+        mock.post(AUTH_URL).respond(200, json={'token': {'access_token': 't'}})
+        mock.get(BASE_URL + DOMAIN.actions[action].path).respond(200, json=body)
+        async with httpx.AsyncClient() as http:
+            result = json.loads(await handler(action=action, ctx=runtime_ctx(http), **kwargs))
+    original_row = body['data'][0] if isinstance(body, dict) else body[0]
+    row = result['data'][0] if isinstance(result, dict) else result[0]
+    assert {k: row[k] for k in original_row} == original_row
+    assert row['_mcp_evidence']['data_impact'] == 'unknown'
+    assert row['_mcp_evidence']['failure_phase'] == 'unknown'
+    assert 'Counters/empty logs alone' in row['_mcp_evidence']['basis']
+    if isinstance(body, dict):
+        assert result['total_count'] == body['total_count']
+
+
+@pytest.mark.parametrize('action,kwargs', [
+    ('get_event_logs', {'history_id': 'h', 'offset': 0, 'limit': 20}),
+    ('get_connector_logs', {'connector_type': 's3custom', 'id_': 'c'}),
+])
+async def test_empty_diagnostic_logs_do_not_imply_no_data_changes(action, kwargs):
+    handler = _build_handler(DOMAIN, available_actions(DOMAIN, True), make_settings())
+    with respx.mock as mock:
+        mock.post(AUTH_URL).respond(200, json={'token': {'access_token': 't'}})
+        mock.get(url__regex=BASE_URL + '/public/v2/data_transfer/.*').respond(200, json=[])
+        async with httpx.AsyncClient() as http:
+            result = json.loads(await handler(action=action, ctx=runtime_ctx(http), **kwargs))
+    assert result['result'] == []
+    assert result['_mcp_evidence']['data_impact'] == 'unknown'
+    assert result['_mcp_evidence']['failure_phase'] == 'unknown'
+
+
+@pytest.mark.parametrize('payload', [
+    {'data': [], 'total_count': 0},
+    {'data': [{'history_id': 'ok', 'status': 'success', 'size_bytes': 42}], 'total_count': 1},
+    {'unexpected': [{'status': 'failed'}]},
+    'unexpected upstream text',
+])
+def test_history_evidence_leaves_unrelated_shapes_and_success_unchanged(payload):
+    from copy import deepcopy
+
+    from mlspace_mcp.data_transfer_hooks import history_evidence
+    before = deepcopy(payload)
+    assert history_evidence(payload, {}) == before
+    assert payload == before
+
+
+@pytest.mark.parametrize('payload', [
+    {'items': [{'message': 'Access denied'}], 'count': 1},
+    {'items': [], 'error_message': 'Access denied'},
+    {'items': [], 'total_count': 4},
+    'Access denied',
+    ['Access denied'],
+    {'status': 'failed', 'logs': ['Access denied']},
+])
+def test_log_evidence_preserves_real_errors_and_nonempty_or_unknown_shapes(payload):
+    from mlspace_mcp.data_transfer_hooks import log_evidence
+    result = log_evidence(payload, {})
+    if isinstance(payload, dict):
+        assert {key: result[key] for key in payload} == payload
+        assert result["_mcp_evidence"]["data_impact"] == "unknown"
+        assert "failure_cause" not in result["_mcp_evidence"]
+    elif isinstance(payload, list):
+        assert result["result"] == payload
+        assert result["_mcp_evidence"]["data_impact"] == "unknown"
+    else:
+        assert result == payload
+
+
+@pytest.mark.parametrize('payload', [None, '', {}, {'items': [], 'count': 0},
+                                      {'status': 'failed', 'logs': []}])
+def test_log_evidence_handles_other_empty_shapes(payload):
+    from mlspace_mcp.data_transfer_hooks import log_evidence
+    result = log_evidence(payload, {})
+    assert result['result'] == payload
+    assert result['_mcp_evidence']['data_impact'] == 'unknown'
+
+
+async def test_known_error_log_preserves_cause_but_does_not_certify_data_impact():
+    body = {'items': [{'last_log': 'Destination returned AccessDenied during PutObject.'}], 'count': 1}
+    handler = _build_handler(DOMAIN, available_actions(DOMAIN, True), make_settings())
+    with respx.mock as mock:
+        mock.post(AUTH_URL).respond(200, json={'token': {'access_token': 't'}})
+        mock.get(BASE_URL + DOMAIN.actions['get_event_logs'].path).respond(200, json=body)
+        async with httpx.AsyncClient() as http:
+            result = json.loads(await handler(action='get_event_logs', history_id='h', offset=0,
+                                              limit=20, ctx=runtime_ctx(http)))
+    assert result['items'] == body['items']
+    assert result['count'] == 1
+    assert result['_mcp_evidence']['data_impact'] == 'unknown'
+    assert 'failure_cause' not in result['_mcp_evidence']
+    assert 'failure_phase' not in result['_mcp_evidence']