test: cover saved severity assessment caching

evals/README.md

@@ -12,6 +12,9 @@ being embedded in its source tree or shipped npm runtime.
   core audit finds synthetic credentials in source and keeps them in its final
   findings, with deterministic grading and harness checks.
 
+- [Completed-report merge](../sdk/typescript/scripts/merge-eval/README.md):
+  synthetic grouping quality checks and negative controls.
+
 Model runs are opt-in. CI runs the deterministic triage and secret-discovery
 helper checks and the real-IPC reducer regression through the normal MCP test
 suite.

plugins/codex-security/mcp-app/src/artifact-io.ts

@@ -81,8 +81,10 @@ export async function readArtifactTextWithMetadata(
     } finally {
       await handle.close();
     }
-  } catch {
-    throw new Error(label + ": the requested artifact cannot be read.");
+  } catch (cause) {
+    throw new Error(label + ": the requested artifact cannot be read.", {
+      cause,
+    });
   }
 }
 
@@ -109,8 +111,13 @@ async function artifactSourcePath(
     }
   }
 
-  const canonical = await fs.realpath(current).catch(() => undefined);
-  if (!canonical || !canonical.startsWith(root + sep)) {
+  const canonical = await fs.realpath(current).catch((cause: unknown) => {
+    throw new Error(
+      label + ": the requested artifact escaped its bound context.",
+      { cause },
+    );
+  });
+  if (!canonical.startsWith(root + sep)) {
     throw new Error(
       label + ": the requested artifact escaped its bound context.",
     );