Truncate long errors keeping the diagnostic tail

Drop the first 40% of long error messages (>80 chars) since the
useful diagnostic info (e.g. PCR mismatches) sits at the end,
after layers of generic wrapping.

Author: nadahalli

cmd/workflow/logs/logs.go

@@ -288,8 +288,9 @@ func (h *handler) printErrors(ctx context.Context, client *graphqlclient.Client,
 	for _, ev := range resp.WorkflowExecutionEvents.Data {
 		if ev.Status == "failure" && len(ev.Errors) > 0 {
 			errMsg := ev.Errors[0].Error
-			if len(errMsg) > 120 {
-				errMsg = errMsg[:120] + "..."
+			if len(errMsg) > 80 {
+				start := len(errMsg) * 2 / 5 // drop first 40%, keep the diagnostic tail
+				errMsg = "..." + errMsg[start:]
 			}
 			fmt.Printf("  -> %s: %s\n", ev.CapabilityID, errMsg)
 		}

cmd/workflow/logs/logs_test.go

@@ -180,6 +180,43 @@ func TestExecute(t *testing.T) {
 		assert.Greater(t, failureIdx, successIdx, "oldest execution should appear first")
 	})
 
+	t.Run("long error is truncated keeping tail", func(t *testing.T) {
+		longErr := "failed to execute enclave request. enclave ID: abc123, error: attestation validation failed for ExecuteBatch: expected PCR0 deadbeef, got cafebabe"
+		ts := newMockGraphQL(t, mockConfig{
+			workflows: []map[string]any{
+				{"uuid": "wf-1", "name": "test-workflow", "status": "ACTIVE"},
+			},
+			executions: []map[string]any{
+				{
+					"uuid":       "exec-1",
+					"status":     "FAILURE",
+					"startedAt":  "2026-02-12T16:00:00Z",
+					"finishedAt": "2026-02-12T16:00:01Z",
+				},
+			},
+			events: []map[string]any{
+				{
+					"capabilityID": "confidential-http@1.0.0",
+					"status":       "failure",
+					"errors":       []map[string]any{{"error": longErr, "count": 1}},
+				},
+			},
+		})
+		defer ts.Close()
+
+		output := captureStdout(t, func() {
+			h := newTestHandler(ts.URL, "test-workflow", false, 10)
+			err := h.Execute(context.Background())
+			require.NoError(t, err)
+		})
+
+		// The diagnostic tail should survive truncation
+		assert.Contains(t, output, "expected PCR0 deadbeef, got cafebabe")
+		// The generic prefix should be dropped
+		assert.NotContains(t, output, "failed to execute enclave request")
+		assert.Contains(t, output, "...")
+	})
+
 	t.Run("workflow not found", func(t *testing.T) {
 		ts := newMockGraphQL(t, mockConfig{})
 		defer ts.Close()