test: canonicalize temporary security fixture roots

[Alan-TheGentleman]

Closes #1129

Type

• Bug fix

Summary

• Canonicalize macOS temporary fixture roots at creation.
• Preserve strict production remediation and repository-root checks.
• Eliminate /var versus /private/var false failures.

Test Plan

• Focused tests: 10/10
• Aggregate typecheck and runtime harness passed
• Full aggregate suite: 2,622 pass, 0 fail, 38 skip
• git diff --check

Contributor Checklist

• Approved issue, one type:* label, conventional commit, no co-author trailers
• Shellcheck not applicable; regression fixtures included

Summary by CodeRabbit

• Bug Fixes

  • Fixed temporary workspace path handling in runtime settlement and hidden-process tests, improving reliability on macOS systems where temporary directories may resolve through alternate canonical paths.
  • Preserved existing security-related path validation behavior while ensuring fixture paths are compared consistently.

• Tests

  • Verified the affected tests, type checks, runtime harness, provider contract checks, and full test suite successfully.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: e411215e-6a42-42ee-8b0e-029b055f7b0a

📥 Commits

Reviewing files that changed from the base of the PR and between 459f4fe and 6281478.

📒 Files selected for processing (3)

• odd/tasks/portable-canonical-temp-path-tests.md
• tests/sdd-managed-runtime-settlement.test.ts
• tests/windows-hidden-processes.test.ts

Included review availability: Your plan provides up to 4 included reviews per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The change canonicalizes temporary workspace paths in two security fixture tests with realpathSync. A tracking document records the macOS portability issue, scope, acceptance criteria, and verification results.

Changes

Portable fixture paths

Layer / File(s)	Summary
Canonicalize security fixture roots odd/tasks/portable-canonical-temp-path-tests.md, tests/sdd-managed-runtime-settlement.test.ts, tests/windows-hidden-processes.test.ts	The task document records the /var and /private/var portability issue. Both tests canonicalize temporary workspace paths before setup and path-sensitive assertions.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix · Severity of issue fixed: Medium

Suggested reviewers: decode2

Merge Risk: ⚪ Minimal · up to 62814

The portability fix is confined to the affected fixtures, with no current merge-blocking risk identified.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: canonicalizing temporary security fixture roots in tests.
Linked Issues check	✅ Passed	Issue #1129 requires security-sensitive fixture roots to use canonical paths at creation. Both affected tests now wrap mkdtempSync(...) with realpathSync(...). The remediation fixture and CodeGrap…
Out of Scope Changes check	✅ Passed	The changes are limited to the two fixture tests named by issue #1129 and one tracking document for the same portability fix. The tracking document records scope, non-goals, and verification. No unrel…

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch test/canonical-temp-roots

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}