Re-audit fixes: clean error on schema-drift + CHANGELOG gaps

CHANGELOG.md

@@ -8,6 +8,7 @@ All notable changes to this project are documented in this file.
 
 - `adop reject`: reject a candidate from `proposed` / `blocked` / `hold` without running a trial (terminal for the scene)
 - `adop aggregate`: read-only cross-project portfolio (scene / tool / state) across multiple `--root` artifact roots
+- `adop render-html`: render the canonical HTML governance dashboard from an artifact root
 - Schema-version tolerance: `MIN_READABLE_SCHEMA_VERSION` keeps older artifacts valid after an upgrade; a too-new `schema_version` reports "written by a newer adop; upgrade adop" instead of a generic invalid
 - HTML dashboard: a "Back to top" button
 - HTML dashboard: the decision detail now shows the `decision_owner` for lanes that record one (was only in the raw JSON)
@@ -26,6 +27,7 @@ All notable changes to this project are documented in this file.
 - `adop init`: creates a nested `--overlay` parent directory instead of crashing with `FileNotFoundError`
 - `adop summary`: no longer prints a comparison-time structural gap once a scene has advanced to `in-trial` or later
 - CI: repaired `ci.yml` (a Windows PowerShell here-string broke the workflow YAML, startup-failing every run since 0.1.1); de-flaked the concurrent id-mint test on loaded runners
+- CLI no longer leaks a raw `KeyError` / traceback when a parent artifact is missing a field a handler reads (e.g. a hand-edited or schema-drifted trial packet); it returns a JSON error envelope with exit 11
 
 ### Changed
 
@@ -34,7 +36,7 @@ All notable changes to this project are documented in this file.
 
 ### Tests
 
-- Suite grew from 105 to 199 tests
+- Suite grew from 105 to 202 tests
 
 ## 0.1.1 - 2026-06-17
 

shared/python/adop_cli.py

@@ -3179,6 +3179,20 @@ def main(argv: list[str] | None = None) -> int:
     except artifacts.AdopArtifactError as exc:
         _emit(artifacts.json_response(args.command, "error", [], [str(exc)]))
         return 11
+    except KeyError as exc:
+        # A schema-drifted or hand-edited parent artifact can be missing a field a
+        # handler reads directly (e.g. packet["landing_target"]). The store
+        # tolerates older/forward records, so surface this as a JSON-native schema
+        # error instead of leaking a raw KeyError traceback.
+        _emit(
+            artifacts.json_response(
+                args.command, "error", [], [f"artifact missing required field: {exc}"]
+            )
+        )
+        return 11
+    except Exception as exc:  # noqa: BLE001 — JSON-native CLI must never leak a raw traceback
+        _emit(artifacts.json_response(args.command, "error", [], [f"unexpected error: {exc}"]))
+        return 11
 
 
 if __name__ == "__main__":

tests/test_lifecycle_cli.py

@@ -949,3 +949,93 @@ def test_reject_open_trial_directs_to_close(run, root):
         == 0
     )
     assert run("reject", "--artifact-root", root, "--use-case", "r", "--reject-reason", "no") == 7
+
+
+def test_close_trial_on_corrupt_packet_returns_clean_error(run, root):
+    """A parent artifact missing a required field must yield a JSON error, not a traceback."""
+    import json as _json
+    from pathlib import Path
+
+    assert (
+        run(
+            "quick-intake",
+            "--artifact-root",
+            root,
+            "--candidate",
+            "ruff",
+            "--source",
+            "doc",
+            "--use-case",
+            "s",
+            "--why-now",
+            "x",
+        )
+        == 0
+    )
+    assert (
+        run(
+            "quick-compare",
+            "--artifact-root",
+            root,
+            "--use-case",
+            "s",
+            "--candidate",
+            "ruff",
+            "--candidate",
+            "p",
+            "--selected",
+            "ruff",
+        )
+        == 0
+    )
+    assert (
+        run(
+            "quick-trial",
+            "--artifact-root",
+            root,
+            "--use-case",
+            "s",
+            "--mode",
+            "review-assist",
+            "--executor",
+            "ci",
+            "--decision-owner",
+            "o",
+            "--landing-target",
+            "l",
+        )
+        == 0
+    )
+    pkt = next(Path(root).glob("adop_trial-packet_*.json"))
+    data = _json.loads(pkt.read_text(encoding="utf-8"))
+    del data["landing_target"]
+    pkt.write_text(_json.dumps(data), encoding="utf-8")
+    # Must not raise a bare KeyError; main() converts it to exit 11.
+    assert (
+        run(
+            "close-trial",
+            "--artifact-root",
+            root,
+            "--trial-id",
+            "tr-001",
+            "--verdict",
+            "hold",
+            "--observed-effect",
+            "x",
+            "--judgment-reason",
+            "j",
+            "--next-action",
+            "n",
+            "--recurring-control-decision",
+            "no",
+            "--root-cause-hypothesis",
+            "h",
+            "--preventive-action",
+            "p",
+            "--why-this-problem-recurred",
+            "w",
+            "--reopen-condition",
+            "later",
+        )
+        == 11
+    )