Repair macOS validation portability and failure diagnostics - #948

Scope

The macOS adoption suite failed when canonical paths were mixed with /var aliases, test instrumentation assumed Linux /proc, and Ubuntu/WSL integration commands ran on Darwin. This repairs portable path/descriptor/report interfaces, names the native platform requirements, and prints failure headers in both macOS test modes while preserving unittest's exit status.

• Base commit: a7bb4a51eea9cc321dd06dd6243a5b2654a5f805.
• Commit: eb90128f6ae2a1e4b48c5517332b8bb594d5ad9e, two commits on the base.
• Lane: lane:foundation.
• Owned paths: readiness reader and source-policy approval; Fleet snapshot/cache seams; their tests and canonical fixture prefixes; two report-count assignments; targeted Ubuntu/WSL test guards; catalog scratch-copy control; adoption-bootstrap diagnostics; decision records, the isolated-render citation, and existing source registrations.

The observability decision's isolated-render citation now points to tests/test_new_wsl_client_config.py:641-656. Its registered evidence hash matches the corrected document bytes.

SDK containment and relative references use one resolved copy while the independent reader guard retains original lexical declarations, exact roles and no-follow checks. The reviewed reader digest/caller positions are updated together. Normalization cannot hide an unapproved descendant symlink or traversal selector.

Sealed producer execution remains a native Linux guarantee. Unsupported systems expose finite unavailable metadata and preserve dated snapshot/Actions observations. Snapshot/seal failures and later transport failures have distinct reasons. The cache uses exclusive mode-0600 creation through its checked directory descriptor instead of a /proc temporary pathname. Linux collection tests retain the real sealed-descriptor path; only systems without that native API mock the transport. The cache regression asserts explicit close-on-exec creation flags and fails when that flag is removed.

Both review workflows already used wc -c; the change normalizes BSD padding with POSIX tr. Static/event-policy and portable tests remain active. Only integrations that execute frozen Linux/Ubuntu commands or unsupported shell capabilities are guarded, with specific reasons. The current advisory macOS event policy is preserved.

Scout alias migration runs on Darwin with a resolved fixture root. Apple's maintained readlink -f implementation is portable for this command; the former skip hid a fixture alias mismatch. An actual symlink temporary prefix reproduced failures for the previous/current owners before resolution, and all six ownership cases pass after it. Claude capture guards name flock; the Inspector probe guard names the Linux port-range file and setsid, while ss is stubbed.

SOTA sources

• CPython v3.13.16 pathlib implementation and official Python3.13 lexical relative_to/symlink resolve contract, checked against installed Python3.13.16 and real alias regressions.
• CPython v3.13.16 tempfile _mkstemp_inner, native API gates and public os descriptor interfaces: exclusive/random/mode-0600 creation, descriptor-relative access and supported memfd availability. Installed tempfile.mkstemp has no dir_fd; os.open supplies the existing checked-descriptor adaptation.
• POSIX.1-2024 Issue8 wc -c and tr: portable byte-count formatting.
• Native failed run37992778130, head dfeea13377cfb15936f856d9ed8df3c6575a7895, job114030975988, step21: actual Darwin full-suite failure, distinct from local simulations.
• Apple file_cmds at659a8a301e2acf0343f8b8673a154a2ca4d07084, stat/stat.c: the readlink entry point accepts -f and calls realpath. This is primary source evidence for the portable Scout command.
• Maintained repository seams at basea7bb4a51: reader/guard, immutable producer and cache, report workflows and frozen Ubuntu/WSL contracts. The existing macOS advisory decision defines the preserved event scope.
• Repository isolated-render contract at eb90128f, tests/test_new_wsl_client_config.py:641-656: rendering and checking a private candidate while preserving unrelated owner bytes. The citation was checked against these actual source lines.

Evidence-class table

The artifact's412 headers are source-policy tests, including407 /proc watcher failures; six are direct readiness failures. The decision record separates these families from the dispatch's shorthand and does not claim a fresh100-job census.

Local commands run

Implementation regression runs below were recorded at379f9df6. The citation-only
forward commit changes no executable code. FULL validation and the actual-host
tip/new-push history gate were refreshed at eb90128.

python3 -B -m unittest tests.test_local_pages tests.test_local_pages_adoption tests.test_local_pages_current_view tests.test_local_pages_fleet_data tests.test_local_pages_fleet_execution tests.test_local_pages_fleet_regressions tests.test_local_pages_fleet_tracking tests.test_local_pages_fleet_tracking_view tests.test_local_pages_fleet_view tests.test_local_pages_sanitization tests.test_local_pages_source_policy tests.test_local_pages_workstation tests.test_north_star_readiness tests.test_new_wsl_definitive_defaults
rc0:400tests/3skips,48.370s unittest/48.789s overall

Python unittest harness with a real symlink tempfile.tempdir/TMPDIR:
tests.test_local_pages, tests.test_local_pages_fleet_data, tests.test_local_pages_fleet_tracking,
tests.test_local_pages_source_policy, tests.test_north_star_readiness,
tests.test_new_wsl_definitive_defaults.FixwaveAcceptanceRepairs.test_scout_alias_migration_preserves_foreign_executables
rc0:165tests/0skips,15.332s overall

python3 -B scripts/validate.py
FULL rc0:70components/11295hashedfiles/4profiles/239receipts;48.694s

python3 -B scripts/evidence_manifest.py --write
python3 -B scripts/evidence_manifest.py --check
both rc0:11295registered files

python3 -B scripts/validate.py --scan-tracked --scan-history 379f9df610038aa1f2be910cb304423288ba3412 eb90128f6ae2a1e4b48c5517332b8bb594d5ad9e
rc0:source=host/zero matching locations/12059trackedfiles; no synthetic override

The final checks above ran as ordinary uncapped native commands. Alias, missing-API and BSD-output fixtures establish the indicated Linux simulations. A native Darwin after-result awaits the next eligible full-suite run.

The initial integration batch found one strict inventory omission for Fleet's
new platform boundary; the selector inventory now includes it and the strict
checks remain intact. An unmodified hang-trace control failed once during a
follow-up workflow group, then passed in an isolated17-test check and the final
146-test native group without a code change. Both outcomes are retained. That
earlier15-module batch ran946tests/4skips; those historical measurements are
distinct from the implementation400-test gate. The first attempt at that gate
used tests/ as CWD and reported three loader import errors; repository-root
imports passed and the corrected implementation gate returned rc0 with400tests/3skips.

Final FULL output SHA256:
edbe447c81a10cad7c1cf4e3eba19131dd89781e912314823f9e30ba02d3cc53.
Actual native-session tip/history output SHA256:
ba498e69af02df2e2273e3d9d7fae58bf436b71f8a2e2a730453a16b8c527949.
Implementation400-test output SHA256:
ba521499a7ea59e5a2bdab26e8c19f643a89dea16429bfb788767e274d6b087c.
Implementation165-test alias output SHA256:
b522a10377193ac5784eb9b8be22751cec56199845570f5b8c28256570efa74c.

Decision record

docs/decisions/2026-10-09-validate-macos-portability.md records native before evidence, root causes, adopted primary interfaces, regression controls, exact platform boundaries and the native after-run limitation. The next eligible main/nightly/dispatch macOS run supplies that native evidence.

Host evidence

N/A: no evidence/hosts receipt or platform-status change.

• Host-receipt validate/review: N/A; no host receipt changed.
• No platform-status change from a receipt alone.

Checklist

• Existing action commit pins/version comments and workflow permission scopes retained.
• No new secret, credential, paid-hosting or billing surface.
• Peer-owned paths/worktrees and protected namespaces preserved.
• Protocol and packet files unchanged; metadata-verifier change only canonicalizes its disposable fixture root.

This remains a draft foundation PR. Hosted checks at the stated head are tracked
in the PR Checks view; they are separate from the retained native fail-before
artifact, local tests and the outstanding native Darwin after-run.