[ViperJuice]

Implements slice A of the hermeticity plan (.consiliency/plans/detailed-test-cwd-filesystem-isolation-20260920-0814.md, merged in #263). Tests only — no src/ changes.

The headline

On a /mnt/<volume>/worktrees/... checkout whose volume root holds node_modules, the suite went from 107 failed / 106 errors → 4011 passed, 0 failed. That artifact has been a standing caveat on every verification run; it is now fixed rather than worked around.

What it does

• isolate_cwd (autouse) runs each test from a private directory under pytest's temp root — a sibling of tmp_path via mktemp, never a child (a child would make files a test writes into tmp_path ancestors of its own cwd). It requests isolate_trust_store explicitly, because pytest does not guarantee autouse ordering and the fake HOME must exist first.
• assert_clean_ancestor_chain (session) fails once, naming the path, when the temp root's own ancestors carry a package.json/node_modules — the one case isolate_cwd cannot escape, since tmp_path lives under gettempdir(). It walks only that chain, never Path.cwd(): a session fixture observes the invocation directory, so walking cwd would fail exactly the hosts isolate_cwd has already fixed.
• real_cwd marker registered, scoped narrowly to tests whose subject is the invocation directory.

Why #261 was really failing

_find_project_manifest walks up from Path.cwd() and stops at Path.home() (the #243 guard). isolate_trust_store redirects HOME to a fake dir, so that stop never matched the real home — from a checkout under $HOME the walk sailed past it, found the developer's own ~/.pmcp/manifest.yaml, and gated it as a project overlay. The isolation fixture caused the failure. chdir-ing under the temp root makes the walk's existing temp_root stop fire.

Verification (all run, not asserted)

Check	Result
#261 on main from a real-home cwd	fails (the "before")
#261 with the fix	passes
Mutation: remove the chdir	red (assert 2 == 1) — falsifiable
/tmp/package.json planted	one named guard error, not a 107-failure cascade
node_modules on a repo ancestor (not a tempdir ancestor)	100 npm tests pass, guard silent — isolated, not detected
cwd-subject test without the marker	passes
Full suite on the polluted /mnt host	4011 passed, 0 failed
ruff check / ruff format	clean

Scope note the plan did not anticipate

Implementation surfaced a class plan review could not: ten tests read repo data files through cwd-relative paths (Path("src/pmcp/manifest/manifest.yaml") etc.), which break once cwd moves. They are not cwd-subjects, so real_cwd would misuse the marker against the plan's own definition — they now anchor to a repo root via Path(__file__), the idiom tests/test_workflow_guards.py already used. Only test_the_allowlist_matches_the_committed_tree takes the marker: its subject genuinely is the committed tree at the invocation root, and scripts/check_workflows.py resolves .github/workflows relative to cwd by design.

npm_resolver._has_local_prefix is deliberately unchanged — it replicates npm's real local-prefix rule, and weakening it to make tests pass would be the actual bug.

Closes nothing on merge by design; #261 is closed by this behaviour but left to a human to confirm. See #235, #261.

🤖 Generated with Claude Code

https://claude.ai/code/session_01H4VQypRNMRJ4caC64P7M3w

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}