Enforce canonical setup result contract in CLI and GUI

tests/test_provider_install.py

@@ -56,11 +56,28 @@ def _mock_helper_run(status: str, harness_id: str = "claude-code", exit_code: in
             "error_diagnostics": diagnostics,
         }
         result_file_path.write_text(json.dumps(data), encoding="utf-8")
+        result_file_path.chmod(0o600)
         return SimpleNamespace(returncode=exit_code)
 
     return _run
 
 
+@pytest.mark.parametrize("dry_run", [False, True])
+def test_sparse_success_cannot_register_provider(temp_providers_file, capsys, dry_run):
+    def fake(cmd, *args, **kwargs):
+        path = Path(cmd[cmd.index("--result-file") + 1])
+        request_id = cmd[cmd.index("--request-id") + 1]
+        path.write_text(json.dumps({"schema_version": 1, "status": "success", "request_id": request_id}))
+        path.chmod(0o600)
+        return SimpleNamespace(returncode=0)
+    argv = ["cmdforge", "providers", "install"] + (["--dry-run"] if dry_run else [])
+    with patch("cmdforge.cli.provider_commands._find_setup_helper", return_value=["fake"]), patch("subprocess.run", side_effect=fake), patch("sys.argv", argv), patch("builtins.input") as prompt:
+        assert main() == 1
+        prompt.assert_not_called()
+    assert get_provider("claude") is None
+    assert "unknown" in capsys.readouterr().out
+
+
 def test_helper_discovery_finds_executable():
     """Verify _find_setup_helper locates agent-harness-setup."""
     with patch("shutil.which", return_value="/usr/local/bin/agent-harness-setup"):
@@ -182,7 +199,7 @@ def test_providers_install_incoherent_result_rejected(temp_providers_file, capsy
 
     assert exit_code == 1
     captured = capsys.readouterr()
-    assert "Treating as failure" in captured.out
+    assert "not coherent with exit code 1" in captured.out
     assert get_provider("claude") is None