scripts/check-fixture-git-isolation.sh recommends, and every harness this repo ships now performs, a clear that includes GIT_CONFIG:
unset GIT_DIR GIT_WORK_TREE GIT_CONFIG
GIT_CONFIG is a second leak path rather than another spelling of the discovery one. It replaces the file the git config subcommand reads and writes, so git -C <fixture> config user.email X lands in whatever file it names even with GIT_DIR cleared, the cwd elsewhere, and -C pointing squarely at the fixture. Reproduced on git 2.55 and covered by scenario D in scripts/test-git-helpers.test.sh.
The gate's CREDIT signal, however, still asks only for GIT_DIR and GIT_WORK_TREE. A new suite can therefore satisfy the gate while remaining exposed on the GIT_CONFIG path.
Requiring GIT_CONFIG for credit was deliberately left out of #2876 because of blast radius rather than doubt about the mechanism. Measured on that branch, tightening the signal would flip 16 self-clearing suites straight to violating, and would additionally decredit the 12 shared hook-utils.sh copies that currently act as isolating harnesses for a further 28 suites — roughly 30 files of churn in a PR whose subject is the detector's precision.
Draining it is mechanical: append GIT_CONFIG to each existing unset line and to the three Python clear tuples, then require the third name in the shell arm's unset-statement match and in NREQ/REQ in the Python arm. scripts/check-fixture-git-isolation.test.sh already has the shape of the case to add.
Neighbour of #2872, which drains the grandfathered baseline.
scripts/check-fixture-git-isolation.shrecommends, and every harness this repo ships now performs, a clear that includesGIT_CONFIG:GIT_CONFIGis a second leak path rather than another spelling of the discovery one. It replaces the file thegit configsubcommand reads and writes, sogit -C <fixture> config user.email Xlands in whatever file it names even withGIT_DIRcleared, the cwd elsewhere, and-Cpointing squarely at the fixture. Reproduced on git 2.55 and covered by scenario D inscripts/test-git-helpers.test.sh.The gate's CREDIT signal, however, still asks only for
GIT_DIRandGIT_WORK_TREE. A new suite can therefore satisfy the gate while remaining exposed on theGIT_CONFIGpath.Requiring
GIT_CONFIGfor credit was deliberately left out of #2876 because of blast radius rather than doubt about the mechanism. Measured on that branch, tightening the signal would flip 16 self-clearing suites straight to violating, and would additionally decredit the 12 sharedhook-utils.shcopies that currently act as isolating harnesses for a further 28 suites — roughly 30 files of churn in a PR whose subject is the detector's precision.Draining it is mechanical: append
GIT_CONFIGto each existingunsetline and to the three Python clear tuples, then require the third name in the shell arm'sunset-statement match and inNREQ/REQin the Python arm.scripts/check-fixture-git-isolation.test.shalready has the shape of the case to add.Neighbour of #2872, which drains the grandfathered baseline.