fix(upgrade): close twelfth-round compliance findings

M1: emit upgrade.http_body_read_error Error before returning a mid-body
    read failure; distinguishes a truncated transfer from a refused
    connection in forensic reconstruction (SOC2 CC7.3)
M3: add captureLog() test helper that redirects the global zerolog logger
    to a buffer for test duration; use it to assert upgrade.http_request_failed,
    upgrade.download_size_limit_reached, and upgrade.github_api_rejected are
    actually emitted — test coverage now proves audit events fire, not just
    that errors propagate
M4: add .Err(err) to upgrade.rollback_succeeded so the root cause of the
    apply failure is in the structured log record alongside the rollback
    outcome (SOC1 completeness and accuracy)

Author: spbsoluble

pkg/upgrade/upgrade.go

@@ -498,6 +498,11 @@ func download(rawURL, operator string) ([]byte, error) {
 	}
 	data, err := io.ReadAll(io.LimitReader(resp.Body, maxBinaryBytes))
 	if err != nil {
+		log.Error().Err(err).
+			Str("event", "upgrade.http_body_read_error").
+			Str("operator", operator).
+			Str("url", sanitizeURL(rawURL)).
+			Msg("HTTP response body read failed after successful connection")
 		return nil, err
 	}
 	// LimitReader silently caps at maxBinaryBytes; detect and reject truncated payloads.
@@ -587,8 +592,9 @@ func apply(binary io.Reader, operator, fromVersion, toVersion, exe, sourceURL st
 			return fmt.Errorf("upgrade failed and rollback also failed: %w", rbErr)
 		}
 		// Rollback succeeded — log at Warn so auditors can distinguish a
-		// recovery action from routine Info events.
-		log.Warn().
+		// recovery action from routine Info events. Include the original error
+		// so the root cause is in the structured record (SOC1 completeness).
+		log.Warn().Err(err).
 			Str("event", "upgrade.rollback_succeeded").
 			Str("operator", operator).
 			Str("from_version", fromVersion).

pkg/upgrade/upgrade_test.go

@@ -26,10 +26,24 @@ import (
 	"runtime"
 	"testing"
 
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
+// captureLog redirects the global zerolog logger to a buffer for the duration
+// of the test, then restores it. Returns the buffer so callers can assert on
+// logged event names.
+func captureLog(t *testing.T) *bytes.Buffer {
+	t.Helper()
+	var buf bytes.Buffer
+	orig := log.Logger
+	log.Logger = zerolog.New(&buf)
+	t.Cleanup(func() { log.Logger = orig })
+	return &buf
+}
+
 // ── archiveAssetName ──────────────────────────────────────────────────────────
 
 func TestArchiveAssetName(t *testing.T) {
@@ -137,6 +151,7 @@ func TestDownload_TokenSentToTrustedHost(t *testing.T) {
 }
 
 func TestDownload_NonOKStatus(t *testing.T) {
+	logBuf := captureLog(t)
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusForbidden)
 	}))
@@ -145,11 +160,13 @@ func TestDownload_NonOKStatus(t *testing.T) {
 	_, err := download(srv.URL+"/asset.zip", "testuser")
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "403")
+	assert.Contains(t, logBuf.String(), "upgrade.http_request_failed", "audit event must fire on non-200 download")
 }
 
 func TestDownload_BodyTruncatedAtLimit(t *testing.T) {
 	// Serve exactly maxBinaryBytes bytes — download must return an error rather
 	// than silently returning a truncated payload that would later fail checksum.
+	logBuf := captureLog(t)
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusOK)
 		chunk := make([]byte, 4096)
@@ -168,6 +185,7 @@ func TestDownload_BodyTruncatedAtLimit(t *testing.T) {
 	_, err := download(srv.URL+"/big.zip", "testuser")
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "exceeded maximum allowed size")
+	assert.Contains(t, logBuf.String(), "upgrade.download_size_limit_reached", "audit event must fire on body size cap")
 }
 
 func TestDownload_TokenNotSentToUntrustedHost(t *testing.T) {
@@ -238,12 +256,14 @@ func TestFetchRelease_NotFound(t *testing.T) {
 }
 
 func TestFetchRelease_RateLimited(t *testing.T) {
+	logBuf := captureLog(t)
 	srv := mockReleaseServer(t, "", http.StatusForbidden)
 	defer srv.Close()
 
 	_, err := fetchReleaseFrom(srv.URL, "", "testuser")
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "rate limited")
+	assert.Contains(t, logBuf.String(), "upgrade.github_api_rejected", "audit event must fire on rate-limited response")
 }
 
 // ── sanitizeURL ───────────────────────────────────────────────────────────────