Summary
The plain-directory trust test ran git without pinning the search ceiling and the review output tests did not guard against ancestor-repository probes, so a host environment with an enclosing git repository (or git walking upward past the tempdir) changes which directory is adopted as the repository root.
The trust test now pins GIT_CEILING_DIRECTORIES at the tempdir parent and feeds a controlled env through the existing inspect_repository_trust_with_env entry point; the invalid lexical .git marker test asserts the marker is never adopted as a repository root and keeps the strict Err when no repository ancestor exists. (No historical red entries for these suites in our CI ledger; this is a defensive host-environment isolation for host-sensitive suites.)
Area
src/crates/services/services-integrations/src/git/trust.rs (tests) + src/crates/services/services-integrations/src/git/utils.rs (tests). Crate: bitfun-services-integrations (requires the git feature for its test target).
Reproduction or evidence
At 32f2427, trust.rs has no GIT_CEILING_DIRECTORIES isolation (only the production inspect_repository_trust_with_env and its callers, :386/:389/:512/:565) and utils.rs has no host_has_repository_ancestor guarding (Grep zero hits); tests therefore pass only on hosts without an enclosing repository. Zero production diff.
Environment
Hosts whose tempdir sits inside or above a git checkout (developer machines, some CI images); baseline 32f2427. These suites are not in the remote CI gate (remote only runs file_watch_contracts for this crate) and the local runs are the verification face; disclosed as defensive host-environment isolation.
AI-assisted change. Testing: verified locally (cargo check -p bitfun-services-integrations exit 0; --features git --lib trust 19 passed; --features git --lib review_git_output 3 passed, 0 failed).
Summary
The plain-directory trust test ran git without pinning the search ceiling and the review output tests did not guard against ancestor-repository probes, so a host environment with an enclosing git repository (or git walking upward past the tempdir) changes which directory is adopted as the repository root.
The trust test now pins GIT_CEILING_DIRECTORIES at the tempdir parent and feeds a controlled env through the existing inspect_repository_trust_with_env entry point; the invalid lexical .git marker test asserts the marker is never adopted as a repository root and keeps the strict Err when no repository ancestor exists. (No historical red entries for these suites in our CI ledger; this is a defensive host-environment isolation for host-sensitive suites.)
Area
src/crates/services/services-integrations/src/git/trust.rs (tests) + src/crates/services/services-integrations/src/git/utils.rs (tests). Crate: bitfun-services-integrations (requires the git feature for its test target).
Reproduction or evidence
At 32f2427, trust.rs has no GIT_CEILING_DIRECTORIES isolation (only the production inspect_repository_trust_with_env and its callers, :386/:389/:512/:565) and utils.rs has no host_has_repository_ancestor guarding (Grep zero hits); tests therefore pass only on hosts without an enclosing repository. Zero production diff.
Environment
Hosts whose tempdir sits inside or above a git checkout (developer machines, some CI images); baseline 32f2427. These suites are not in the remote CI gate (remote only runs file_watch_contracts for this crate) and the local runs are the verification face; disclosed as defensive host-environment isolation.
AI-assisted change. Testing: verified locally (
cargo check -p bitfun-services-integrationsexit 0;--features git --lib trust19 passed;--features git --lib review_git_output3 passed, 0 failed).