Fix QA validation issues and add M7.1 security fixes (#318)

Co-authored-by: Jason Woltje <jason@diversecanvas.com>
Co-committed-by: Jason Woltje <jason@diversecanvas.com>

apps/api/src/federation/command.service.ts

@@ -18,6 +18,7 @@ import {
   FederationMessageStatus,
 } from "@prisma/client";
 import type { CommandMessage, CommandResponse, CommandMessageDetails } from "./types/message.types";
+import { CommandProcessingError, UnknownCommandTypeError } from "./errors/command.errors";
 
 @Injectable()
 export class CommandService {
@@ -184,13 +185,30 @@ export class CommandService {
         responseData = agentResponse.data;
         errorMessage = agentResponse.error;
       } else {
-        // Other command types can be added here
-        responseData = { message: "Command received and processed" };
+        // Unknown command type - throw business logic error
+        throw new UnknownCommandTypeError(commandMessage.commandType);
       }
     } catch (error) {
-      success = false;
-      errorMessage = error instanceof Error ? error.message : "Command processing failed";
-      this.logger.error(`Command processing failed: ${errorMessage}`);
+      // Only catch expected business logic errors
+      // System errors (OOM, DB failures, network issues) should propagate
+      if (error instanceof CommandProcessingError) {
+        success = false;
+        errorMessage = error.message;
+        this.logger.warn(`Command processing failed (business logic): ${errorMessage}`, {
+          commandType: commandMessage.commandType,
+          instanceId: commandMessage.instanceId,
+          messageId: commandMessage.messageId,
+        });
+      } else {
+        // System error - log and re-throw to preserve stack trace
+        this.logger.error(`System error during command processing: ${String(error)}`, {
+          commandType: commandMessage.commandType,
+          instanceId: commandMessage.instanceId,
+          messageId: commandMessage.messageId,
+          error: error instanceof Error ? error.stack : String(error),
+        });
+        throw error;
+      }
     }
 
     // Get local instance identity