fix: use Contains+SplitN for artifact parsing, preserve failed decodes

Address three issues with artifact capture:

1. (High) Artifact parsing used HasPrefix which fails with real go test
   -json output where t.Logf prefixes lines with source location
   (e.g. "runner.go:102: ARTIFACT:..."). Now uses Contains+SplitN,
   matching the established CONSTRAINT_RESULT parsing pattern.

2. (Medium) Add slog.Warn when --result is used with --evidence-dir
   to inform users that saved results don't include diagnostic artifacts.

3. (Low) Failed artifact decodes now log a warning and preserve the
   original line in reason output instead of silently dropping it.

Also extracts artifact parsing into a standalone extractArtifacts()
function with comprehensive table-driven tests covering source-prefixed
lines, malformed input preservation, and multi-artifact interleaving.

Author: dims

pkg/cli/validate.go

@@ -227,6 +227,7 @@ func runValidation(
 		evidenceSource := result
 		if evidenceResultPath != "" {
 			slog.Info("loading saved result for evidence rendering", "path", evidenceResultPath)
+			slog.Warn("saved results do not include diagnostic artifacts; evidence output will contain check status only")
 			saved, loadErr := serializer.FromFile[validator.ValidationResult](evidenceResultPath)
 			if loadErr != nil {
 				return errors.Wrap(errors.ErrCodeInvalidRequest, "failed to load evidence result", loadErr)

pkg/validator/phases.go

@@ -1001,6 +1001,37 @@ func parseConstraintResult(output []string) *ConstraintValidation {
 	return nil
 }
 
+// extractArtifacts separates artifact lines from regular test output.
+// ARTIFACT: lines are base64-encoded JSON produced by TestRunner.Cancel().
+// t.Logf prefixes output with source location (e.g. "runner.go:102: ARTIFACT:..."),
+// so we use Contains + SplitN (same approach as CONSTRAINT_RESULT parsing).
+// Lines that contain ARTIFACT: but fail to decode are preserved in reason output
+// and a warning is logged, so debugging context is never silently lost.
+func extractArtifacts(output []string) ([]checks.Artifact, []string) {
+	var artifacts []checks.Artifact
+	var reasonLines []string
+	for _, line := range output {
+		if !strings.Contains(line, "ARTIFACT:") {
+			reasonLines = append(reasonLines, line)
+			continue
+		}
+		parts := strings.SplitN(line, "ARTIFACT:", 2)
+		if len(parts) != 2 {
+			reasonLines = append(reasonLines, line)
+			continue
+		}
+		encoded := strings.TrimSpace(parts[1])
+		a, err := checks.DecodeArtifact(encoded)
+		if err != nil {
+			slog.Warn("failed to decode artifact line", "error", err)
+			reasonLines = append(reasonLines, line)
+			continue
+		}
+		artifacts = append(artifacts, *a)
+	}
+	return artifacts, reasonLines
+}
+
 func (v *Validator) runPhaseJob(
 	ctx context.Context,
 	deployer *agent.Deployer,
@@ -1123,19 +1154,8 @@ func (v *Validator) runPhaseJob(
 			}
 
 			// Extract artifacts from test output and build reason from remaining lines.
-			// ARTIFACT: lines are base64-encoded JSON produced by TestRunner.Cancel().
-			var reasonLines []string
-			for _, line := range test.Output {
-				trimmed := strings.TrimSpace(line)
-				if strings.HasPrefix(trimmed, "ARTIFACT:") {
-					encoded := strings.TrimPrefix(trimmed, "ARTIFACT:")
-					if a, err := checks.DecodeArtifact(encoded); err == nil {
-						checkResult.Artifacts = append(checkResult.Artifacts, *a)
-					}
-				} else {
-					reasonLines = append(reasonLines, line)
-				}
-			}
+			artifacts, reasonLines := extractArtifacts(test.Output)
+			checkResult.Artifacts = artifacts
 
 			// Build reason from last few non-artifact output lines
 			if len(reasonLines) > 0 {

pkg/validator/phases_artifact_test.go

@@ -0,0 +1,145 @@
+// Copyright (c) 2025, NVIDIA CORPORATION.  All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package validator
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/NVIDIA/aicr/pkg/validator/checks"
+)
+
+func TestExtractArtifacts(t *testing.T) {
+	// Build a valid encoded artifact for test cases.
+	sample := checks.Artifact{Label: "DRA Controller", Data: "Status: Available"}
+	encoded, err := sample.Encode()
+	if err != nil {
+		t.Fatalf("failed to encode test artifact: %v", err)
+	}
+
+	tests := []struct {
+		name              string
+		output            []string
+		wantArtifactCount int
+		wantArtifactLabel string
+		wantReasonCount   int
+		wantReasonHas     string // substring that must appear in reason lines
+	}{
+		{
+			name: "bare ARTIFACT line (no source prefix)",
+			output: []string{
+				"normal log line",
+				"ARTIFACT:" + encoded,
+				"another log line",
+			},
+			wantArtifactCount: 1,
+			wantArtifactLabel: "DRA Controller",
+			wantReasonCount:   2,
+		},
+		{
+			name: "t.Logf source-prefixed ARTIFACT line",
+			output: []string{
+				"=== RUN   TestDRASupport",
+				fmt.Sprintf("    runner.go:102: ARTIFACT:%s", encoded),
+				"--- PASS: TestDRASupport (1.23s)",
+			},
+			wantArtifactCount: 1,
+			wantArtifactLabel: "DRA Controller",
+			wantReasonCount:   2,
+		},
+		{
+			name: "deep source prefix with tab",
+			output: []string{
+				fmt.Sprintf("    conformance_test.go:45: ARTIFACT:%s", encoded),
+			},
+			wantArtifactCount: 1,
+			wantArtifactLabel: "DRA Controller",
+			wantReasonCount:   0,
+		},
+		{
+			name: "no artifacts",
+			output: []string{
+				"just normal test output",
+				"nothing special here",
+			},
+			wantArtifactCount: 0,
+			wantReasonCount:   2,
+		},
+		{
+			name: "malformed artifact preserved in reason",
+			output: []string{
+				"    runner.go:102: ARTIFACT:not-valid-base64!!!",
+				"normal line",
+			},
+			wantArtifactCount: 0,
+			wantReasonCount:   2,
+			wantReasonHas:     "ARTIFACT:",
+		},
+		{
+			name:              "empty output",
+			output:            []string{},
+			wantArtifactCount: 0,
+			wantReasonCount:   0,
+		},
+		{
+			name: "multiple artifacts with interleaved output",
+			output: []string{
+				"log line 1",
+				fmt.Sprintf("    runner.go:102: ARTIFACT:%s", encoded),
+				"log line 2",
+				fmt.Sprintf("    runner.go:102: ARTIFACT:%s", encoded),
+				"log line 3",
+			},
+			wantArtifactCount: 2,
+			wantArtifactLabel: "DRA Controller",
+			wantReasonCount:   3,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			artifacts, reasonLines := extractArtifacts(tt.output)
+
+			if len(artifacts) != tt.wantArtifactCount {
+				t.Errorf("artifact count: got %d, want %d", len(artifacts), tt.wantArtifactCount)
+			}
+
+			if tt.wantArtifactLabel != "" && len(artifacts) > 0 {
+				if artifacts[0].Label != tt.wantArtifactLabel {
+					t.Errorf("artifact label: got %q, want %q", artifacts[0].Label, tt.wantArtifactLabel)
+				}
+			}
+
+			if len(reasonLines) != tt.wantReasonCount {
+				t.Errorf("reason line count: got %d, want %d\nlines: %v",
+					len(reasonLines), tt.wantReasonCount, reasonLines)
+			}
+
+			if tt.wantReasonHas != "" {
+				found := false
+				for _, line := range reasonLines {
+					if strings.Contains(line, tt.wantReasonHas) {
+						found = true
+						break
+					}
+				}
+				if !found {
+					t.Errorf("reason lines should contain %q, got: %v", tt.wantReasonHas, reasonLines)
+				}
+			}
+		})
+	}
+}