Runtime tests build temporary roots under a symlinked os.tmpdir(), so ~314 tests fail on macOS before any code change #1017

Summary

The runtime test suite builds its temporary roots with fs.mkdtempSync(path.join(os.tmpdir(), ...)). On macOS os.tmpdir() is /var/folders/..., and /var is a symlink to /private/var, so every one of those roots is non-canonical. The runtime deliberately requires canonical roots, so the tests fail against their own fixtures.

macOS   tmpdir   : /var/folders/4j/5w5ycfps4r54cr1xxf8_76zc0000gn/T
        realpath : /private/var/folders/4j/5w5ycfps4r54cr1xxf8_76zc0000gn/T
        canonical: false

Linux   tmpdir   : /tmp
        realpath : /tmp
        canonical: true

Linux is unaffected, which is why CI has never seen this.

Impact

Running pnpm --filter @ultrafuzz/runtime test on macOS produces 362 distinct failing tests. The dominant error shapes are the canonicality assertions, not real defects:

34x  Error: artifact verification marker root must be canonical
 4x  Error: pinned source root is not a canonical directory
 2x  Error [ArtifactPathError]: untracked governance input root must be canonical
 2x  Error [ArtifactPathError]: provider route config root must be canonical

44 failures are literally must be canonical, and 75 error lines reference /var/folders.

Pointing TMPDIR at a canonical directory takes the same suite on the same commit to 48 distinct failures, with 674 passing. So roughly 314 of the 362 failures are an artifact of the temporary directory rather than anything about the code under test.

The same root cause breaks pnpm validate:pack on macOS, which creates its consumer under os.tmpdir():

$ pnpm validate:pack
Error: packed validate failed (... ultrafuzz validate --project /var/folders/.../initialized-project --json)
  "code": "SYMLINK_PATH",
  "message": "Topology path contains a symlink component: /var",

With a canonical TMPDIR it passes for all 12 packages.

Why this matters beyond convenience

A macOS contributor cannot tell a real regression from the noise: the suite is red before they change anything, and the failures name canonicality rather than the tmpdir, so the cause is not obvious from the output. It also means no darwin-specific defect can be caught by the suite, because the suite never gets far enough to exercise one.

Scope

136 raw mkdtempSync(path.join(os.tmpdir(), ...)) sites across 39 test files. Exactly one call site currently canonicalizes.

Suggested fix

Canonicalize once in a shared test helper and use it everywhere, rather than sprinkling realpathSync at 136 call sites. This pairs naturally with the cleanup problem in the companion issue, since both want the same helper: one function that returns a canonical temporary root and reliably removes it afterwards.

The production code should keep rejecting non-canonical roots; that check is doing its job here.

Environment

• macOS (Darwin 25.6.0) arm64, node v26.3.1, pnpm 11.1.1
• ultrafuzz main @ ab3c03f4