[Daniel Meppiel (danielmeppiel)]

Description

Main's release-gate integration suite (nightly schedule, tag push, and repository_dispatch: manual-build-release) has been red since 2026-10-11. Push-to-main skips integration tests, so the regressions landed unnoticed. Tagging v0.34.0 (#3250) would fail the Integration Tests / Build & Validate (macOS arm64) jobs, which gate Create GitHub Release.

Evidence: dispatch run 38893789054 on b71cb47cd9 -- 21 failures on Linux arm64, 22 on macOS arm64, Linux x86_64 cancelled by fail-fast; nightlies 10-11..10-16 failing; recurring push-run unit flakes on macOS x86_64 and Linux arm64.

Product fix

• RuntimeManager now spawns setup scripts, <runtime> --version, and npm uninstall through external_process_env(). Under the PyInstaller binary, the bundle's LD_LIBRARY_PATH / DYLD_* leaked into setup-llm.sh's python3, so python3 -m venv failed in ensurepip (apm runtime setup llm -> exit 1). Matches the existing mitigation in git_env and self_update.

Tests aligned with contracts merged since v0.33.0

Failure	Cause	Fix
test_install_services_{orchestration,phase3w5} MagicMock <	#3106 skills_rel_root / supports / moved deployed_path_entry	fixture mirrors real target contract; patch new owner
test_audit_primitive_contract[True-cursor]	#3149 Cursor hooks are flat-only	assert flat-handler incomplete diagnostic
test_hook_root_source_drift_e2e[cursor]	#3149 native preToolUse, flat handlers	target-shaped event key and user hook
test_frozen_host_qualified_git_e2e x5	#2384 --frozen never rewrites the lock	fixture lock records deployed_files
test_marketplace_metadata_auth_fallback	#3064 anonymous manifestless SKILL.md probe	expect [None, None, token]
test_wave6_deps_cli_coverage idempotency	#3222 unknown-key warning; fixture used invalid owner:	drop invalid key
test_wave2_adapters_coverage Claude user scope (macOS)	#3148 resolves path (/var -> /private/var)	compare resolved paths
test_matrix_covers_every_registry_guard_exactly_once	#3113 added registry-delegation-build-id-verification without a MutationCase	add sorted MutationCase

Flakes

• test_git_cache::test_receipt_precedence_with_actual_stale_bare_reference: copytree raced git background maintenance (objects/maintenance.lock); skip transient lock/temp files.
• test_install_transaction::test_workspace_lock_serializes_concurrent_processes: 10s bounds expired on slow macOS x86_64 runners (holder timed out and released the lock early); bounds widened to 120s.

Issue and approved scope

Issue: N/A -- maintainer-directed CI repair blocking the v0.34.0 release (#3250).

Human scope-approval comment: Daniel Meppiel (@danielmeppiel) directed in-session: "loop and bypass merge PRs until they're fixed and we know that the release workflow would pass".

Does this PR complete the issue, or what remains? Completes the known failures; a post-merge manual-build-release dispatch verifies the release gate.

Type of change

• Bug fix
• New feature
• Documentation
• Maintenance / refactor

Testing

• Tested locally

• All existing tests pass

• Added tests for new functionality (if applicable)

• Each previously failing integration file passes locally (APM_E2E_TESTS=1 uv run --extra dev pytest ...).

• tests/integration/test_architecture_owner_rule_mutations.py -- 460 passed.

• tests/unit/test_runtime_manager.py (+ frozen loader-env regression test), test_runtime_detection.py, test_runtime_windows.py -- 97 passed.

• Lint mirror (ruff check/format, pylint R0801, auth-signals) and scripts/lint_architecture_boundaries.py --root . -- pass.

• The frozen-binary ensurepip failure did not reproduce on macOS arm64 with a statically linked uv Python; CI dispatch after merge is the verification.

Spec conformance (OpenAPM v0.1)

• Spec edit: docs/src/content/docs/specs/openapm-v0.1.md updated
  (new/changed <a id="req-XXX"></a> anchor + prose + Appendix C
  row).
• Manifest edit: docs/src/content/docs/specs/manifests/openapm-v0.1.requirements.yml
  updated.
• Test edit: a @pytest.mark.req("req-XXX") test under
  tests/spec_conformance/ added or extended.
• CONFORMANCE.{md,json} regenerated via
  uv run --extra dev python -m tests.spec_conformance.gen_statement
  and committed.
• N/A -- this PR does not change OpenAPM-observable behaviour.

[Copilot]

🔵 Needs a closer look

The frozen-binary fix still needs end-to-end release-gate verification on the affected platforms.

0 open findings

What changed in this PR

Repairs release-gate regressions blocking v0.34.0 by isolating frozen-binary subprocess environments and aligning tests with current contracts.

Changes:

• Sanitize loader paths for runtime setup, version checks, and removal.
• Update integration fixtures and assertions for recently merged behavior.
• Reduce timing-related flakes and restore missing architecture mutation coverage.

File	Description
tests/​unit/​test_runtime_manager.py	Add frozen loader-environment regression coverage.
tests/​unit/​install/​test_install_transaction.py	Increase process synchronization timeouts.
tests/​unit/​cache/​test_git_cache.py	Exclude transient Git maintenance files from copies.
tests/​integration/​test_wave6_deps_cli_coverage.py	Remove unsupported manifest keys.
tests/​integration/​test_wave2_adapters_coverage.py	Compare resolved Claude configuration paths.
tests/​integration/​test_marketplace_metadata_auth_fallback.py	Account for anonymous skill metadata probing.
tests/​integration/​test_install_services_phase3w5.py	Align target mocks and deployment-path patches.
tests/​integration/​test_install_services_orchestration.py	Align target mocks and deployment-path patches.
tests/​integration/​test_hook_root_source_drift_e2e.py	Use native Cursor events and handlers.
tests/​integration/​test_frozen_host_qualified_git_e2e.py	Record deployed instructions in fixture lockfiles.
tests/​integration/​test_audit_primitive_contract.py	Expect diagnostics for nested Cursor handlers.
tests/​integration/​test_architecture_owner_rule_mutations.py	Add Build ID verification guard mutation.
src/​apm_cli/​runtime/​manager.py	Use sanitized environments for external subprocesses.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.