test: add cross-platform connector E2E parity

[aseembits93]

Summary

• add a shared capability-aware E2E scenario matrix for Gmail, Slack, Linear, and Granola
• deepen Linux lifecycle, drift, diagnostics, credential, and read-only enforcement coverage
• add real Windows Cloud Files jobs and serialized signed macOS File Provider scenarios
• add connector live-integrity tests, provider harness self-tests, workflow contracts, and coverage documentation
• preserve serialized Slack OAuth consumers and persist rotated credentials after each consumer
• harden signed macOS dispatch parsing, isolated credentials, privacy-safe diagnostics, and scratch cleanup

Testing

• cargo test -p locality-gmail -p locality-slack -p locality-linear -p locality-granola
• python3 tests/live_connector_matrix.py validate
• python3 tests/live_connector_matrix_selftest.py
• python3 tests/live_provider_connector_scenario_selftest.py
• LOCALITY_LIVE_GMAIL_SELFTEST=1 tests/live_gmail_vfs_roundtrip.sh
• LOCALITY_LIVE_COMMON_SELFTEST=1 tests/live_connector_common_selftest.sh
• bash tests/ci_workflow_contract.sh
• cargo fmt --check
• git diff --check origin/main...HEAD
• signed macOS workflow dispatch: https://github.com/codeflash-ai/locality/actions/runs/32295746377

Live macOS blocker

The signed app builds, installs, registers its extension, and verifies the enabled File Provider domain. Mount registration then fails when filesystem-alias inspection receives macOS EDEADLK for the not-yet-materialized CloudStorage child. The failure remains red and blocks the Gmail, Linear, Slack, and Granola macOS scenarios; it is documented in the coverage matrix and tracked by #217.

Harness fixes made during investigation ensure credentials stay in isolated CI state, diagnostics redact sensitive values, stale scratch fixtures are swept, and cleanup uses the product-compatible block-delete path.

Notes

Credential-dependent jobs remain gated by their existing secret environments. This PR changes tests, CI, and documentation only; it does not change product code, public APIs, or persisted formats. Gmail non-Linux sending, Slack/Granola writes, and Linear create/delete remain explicitly not applicable rather than coverage gaps.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
locality	Ready	Preview	Aug 19, 2026 10:31pm

[github-actions]

Codex review

No high-confidence issues found.

[aseembits93]

Addressed the connector E2E reliability review in a864e53d:

• empty LOCALITY_SLACK_LIVE_TYPES now falls back to the private-conversation defaults, with a regression test
• Slack live integrity follows response_metadata.next_cursor until the configured conversation is found, with a two-page regression test and cursor-cycle guard
• forced Gmail refresh always exports a rotated credential for the following integrity step; GitHub persistence remains independently optional
• Linear restoration preserves nullable descriptions, verifies mutation success, and reads back description/title exactly in both normal and failure cleanup
• provider and shell fingerprints now hash complete entity/shadow/journal/virtual-mutation rows plus durable content-cache bytes, with in-place update regression tests
• read-only provider baselines are captured after the first legitimate hydration read
• the clean harness job now builds loc and localityd before invoking the provider self-test

Focused verification passed: full locality-slack tests, provider runner self-test, common live helper self-test, workflow contracts, binary build, formatting, Python compilation, and diff checks.