fix(platform): fail closed on GitHub filesystem config errors

src/platform/adapters/fs/cache/file-cache.test.ts

@@ -367,6 +367,12 @@ describe("Distributed cache functions", () => {
       circular.self = circular;
       distributedCache.set("cyclic", circular);
       assertEquals(backendWrites, 0);
+
+      // Positive control: a serializable entry must reach the fake backend,
+      // proving the harness is live and the zero-write assertion above is not
+      // vacuously passing because the backend was never wired up.
+      distributedCache.set("serializable", { ok: true });
+      assertEquals(backendWrites, 1);
     });
 
     it("should return boolean", async () => {

src/platform/adapters/fs/github/github-api-client.test.ts

@@ -7,6 +7,7 @@ import {
 } from "#veryfront/testing/assert.ts";
 import { describe, it } from "#veryfront/testing/bdd.ts";
 import { withMockFetch } from "#veryfront/testing/mock-fetch.ts";
+import { VeryfrontError } from "#veryfront/errors/types.ts";
 import { GitHubApiClient } from "./github-api-client.ts";
 
 const mockConfig = {
@@ -59,11 +60,14 @@ describe("GitHubApiClient", () => {
           ["repo", "r".repeat(257)],
         ] as const
       ) {
-        assertThrows(
+        // A CONFIG-category error keeps enhanceAdapterWithFS failing closed;
+        // a bare TypeError would silently fall back to the local filesystem.
+        const error = assertThrows(
           () => new GitHubApiClient({ ...mockConfig, [field]: value }),
-          TypeError,
+          VeryfrontError,
           "GitHub",
         );
+        assertEquals(error.slug, "config-validation-failed");
       }
     });
   });

src/platform/adapters/fs/github/github-api-client.ts

@@ -1,4 +1,5 @@
 import { createError, retryWithBackoff, toError } from "#veryfront/errors";
+import { CONFIG_VALIDATION_FAILED } from "#veryfront/errors/error-registry/config.ts";
 import { logger } from "#veryfront/utils";
 import type { ResolvedGitHubConfig } from "./types.ts";
 import {
@@ -105,9 +106,20 @@ export class GitHubApiClient {
   private rateLimitInfo: RateLimitInfo | null = null;
 
   constructor(private readonly config: ResolvedGitHubConfig) {
-    const owner = encodeRepositorySegment(config.owner, "owner");
-    const repo = encodeRepositorySegment(config.repo, "repository");
-    this.repositoryEndpoint = `/repos/${owner}/${repo}`;
+    // Invalid repository identity is a configuration error: it must fail
+    // closed (surface as a CONFIG-category VeryfrontError) instead of a bare
+    // TypeError that enhanceAdapterWithFS would swallow before silently
+    // falling back to the host-local filesystem adapter.
+    try {
+      const owner = encodeRepositorySegment(config.owner, "owner");
+      const repo = encodeRepositorySegment(config.repo, "repository");
+      this.repositoryEndpoint = `/repos/${owner}/${repo}`;
+    } catch (cause) {
+      throw CONFIG_VALIDATION_FAILED.create({
+        detail: cause instanceof Error ? cause.message : "GitHub repository identity is invalid",
+        cause,
+      });
+    }
   }
 
   get repoId(): string {

src/platform/adapters/fs/github/types.ts

@@ -1,4 +1,4 @@
-import { createError, toError } from "#veryfront/errors";
+import { CONFIG_INVALID } from "#veryfront/errors";
 
 export type { DirectoryEntry } from "../shared-types.ts";
 
@@ -69,24 +69,20 @@ const DEFAULT_INITIAL_RETRY_DELAY_MS = 1_000;
 const DEFAULT_MAX_RETRY_DELAY_MS = 10_000;
 
 export function createGitHubConfig(config: GitHubConfig): ResolvedGitHubConfig {
+  // CONFIG-category registry errors fail closed in enhanceAdapterWithFS;
+  // legacy plain Errors would trigger its silent local-filesystem fallback.
   if (!config.token) {
-    throw toError(
-      createError({
-        type: "config",
-        message:
-          "GitHub adapter requires a token. Set GITHUB_TOKEN environment variable or provide token in config.",
-      }),
-    );
+    throw CONFIG_INVALID.create({
+      detail:
+        "GitHub adapter requires a token. Set GITHUB_TOKEN environment variable or provide token in config.",
+    });
   }
 
   if (!config.owner || !config.repo) {
-    throw toError(
-      createError({
-        type: "config",
-        message:
-          "GitHub adapter requires owner and repo. Provide them in config or via GITHUB_OWNER and GITHUB_REPO environment variables.",
-      }),
-    );
+    throw CONFIG_INVALID.create({
+      detail:
+        "GitHub adapter requires owner and repo. Provide them in config or via GITHUB_OWNER and GITHUB_REPO environment variables.",
+    });
   }
 
   return {

src/platform/adapters/fs/integration.test.ts

@@ -140,6 +140,40 @@ describe("integration.ts", () => {
       assertEquals(error.slug, "config-validation-failed");
     });
 
+    it("should fail closed when GitHub repository identity is invalid", async () => {
+      const error = await assertRejects(
+        () =>
+          enhanceAdapterWithFS(denoAdapter, {
+            fs: {
+              type: "github",
+              github: { token: "test-token", owner: "team/other", repo: "repo" },
+            },
+          }),
+        VeryfrontError,
+        "GitHub owner",
+      );
+      assertInstanceOf(error, VeryfrontError);
+      assertEquals(error.slug, "config-validation-failed");
+    });
+
+    it("should fail closed when the GitHub adapter has no token", async () => {
+      // token: "" is explicit so the GITHUB_TOKEN environment variable cannot
+      // satisfy the requirement and mask the regression in CI.
+      const error = await assertRejects(
+        () =>
+          enhanceAdapterWithFS(denoAdapter, {
+            fs: {
+              type: "github",
+              github: { token: "", owner: "owner", repo: "repo" },
+            },
+          }),
+        VeryfrontError,
+        "token",
+      );
+      assertInstanceOf(error, VeryfrontError);
+      assertEquals(error.slug, "config-invalid");
+    });
+
     it("should fall back to original adapter for unsupported type", async () => {
       const adapter = await enhanceAdapterWithFS(denoAdapter, {
         fs: { type: "unsupported-type" as any },

src/platform/adapters/fs/integration.ts

@@ -64,7 +64,11 @@ export function enhanceAdapterWithFS(
 
         return enhancedAdapter;
       } catch (error) {
-        if (error instanceof VeryfrontError && error.slug === "config-validation-failed") {
+        // Any configuration-class failure must fail closed: silently falling
+        // back to the host-local filesystem on a misconfigured remote adapter
+        // would serve the wrong filesystem. Only non-config runtime failures
+        // (network, transient init) may degrade to the local adapter.
+        if (error instanceof VeryfrontError && error.category === "CONFIG") {
           throw error;
         }
         logger.error("Failed to initialize FSAdapter", {

src/platform/adapters/fs/veryfront/path-normalizer.test.ts

@@ -152,6 +152,18 @@ describe("PathNormalizer", () => {
       );
     });
 
+    it("should reject C1 control characters like the GitHub normalizer", () => {
+      const normalizer = new PathNormalizer();
+      // U+0080 and U+009F bound the C1 range; NUL is the C0 control anchor.
+      for (const codeUnit of [0x00, 0x80, 0x9f]) {
+        assertThrows(
+          () => normalizer.normalize(`src/${String.fromCharCode(codeUnit)}secrets.ts`),
+          TypeError,
+          "must not contain control characters",
+        );
+      }
+    });
+
     it("should reject unbounded paths", () => {
       const normalizer = new PathNormalizer();
       assertThrows(

src/platform/adapters/fs/veryfront/path-normalizer.ts

@@ -4,10 +4,12 @@ import { CONFIG_VALIDATION_FAILED } from "#veryfront/errors/error-registry/confi
 const logger = baseLogger.component("path-normalizer");
 const MAX_PATH_CODE_UNITS = 4_096;
 
-function hasAsciiControlCharacter(value: string): boolean {
+// Rejects the full non-printable control range (C0, DEL, and C1) — the same
+// policy as the GitHub path normalizer in ../github/path-utils.ts.
+function hasControlCharacter(value: string): boolean {
   for (let index = 0; index < value.length; index++) {
     const codeUnit = value.charCodeAt(index);
-    if (codeUnit <= 0x1f || codeUnit === 0x7f) return true;
+    if (codeUnit <= 0x1f || (codeUnit >= 0x7f && codeUnit <= 0x9f)) return true;
   }
   return false;
 }
@@ -97,7 +99,7 @@ export class PathNormalizer {
         `Filesystem ${label} exceeds the ${MAX_PATH_CODE_UNITS}-character limit`,
       );
     }
-    if (hasAsciiControlCharacter(path)) {
+    if (hasControlCharacter(path)) {
       throw new TypeError(`Filesystem ${label} must not contain control characters`);
     }
     if (path.includes("\\")) {