[JacobStephens2]

Summary

Triage's private HOME hid user-installed Rust tools in a minimal environment. Preserve the host toolchain paths while keeping new Cargo caches under the private home.

 prepare_home
   isolate HOME and Harness state
+  preserve RUSTUP_HOME and prepend the installed Cargo bin directory
   keep host mounts read-only

AGENTS.md now requires final affected checks for sessions that modify repository files; read-only sessions such as Triage run tests when needed to verify a bug claim.

Closes #2048

Evidence

Execution evidence

• Before: cargo test --bin thirdshift sandbox::triage::tests::read_machine_keeps_home_installed_rust_tools_available -- --exact --nocapture
  Failed: exit status: 127: /bin/sh: 1: cargo: not found (0 passed, 1 failed). A diagnosis control using the same mounts with explicit toolchain paths succeeded.
  After: The same command passed: 1 passed; 0 failed.
• cargo test --bin thirdshift sandbox::triage::tests -- --nocapture: 5 passed, including host write denial, private Harness settings, and socket confinement.
• CARGO_BUILD_JOBS=2 NEXTEST_TEST_THREADS=3 scripts/affected-tests main selected the full Rust suite. The duplicate local run was intentionally interrupted after all CI checks passed for the exact head 9f258188c010696ac10aa915402454be148a94d8, following docs/testing.md's instruction to reuse successful CI. No test failures preceded the interruption; three active tests received SIGINT. Local compilation took 3m 56s; the selector ran for 999.53s before cancellation.
• CI run 43140947529: all four Rust partitions and the final Rust gate passed, along with Site and Console checks. Release builds also passed for both Linux targets.

Confirmed cause: prepare_home redirected HOME without retaining the original Rust installation's lookup paths. The regression starts without CARGO_HOME, RUSTUP_HOME, or Cargo's inherited toolchain selection and with /usr/bin:/bin on PATH. Real rustup shims now resolve fixture cargo and rustc; host writes fail and new Cargo cache files stay in the worktree.

Test seam: the prepared Triage Launch, executed through real Bubblewrap, with a fixture home and Rust installation.

Review coverage

Independent reviews against refs/remotes/origin/main (259c1c8d): Standards 0 findings, Spec 0 findings. Each reviewer read both changed files, AGENTS.md and src/sandbox/triage.rs. No changed file was left unread; no generated output was excluded. Reports and counts are retained in the Session's .thirdshift-review-QNPoGf/ directory.

Unaddressed findings

Standards

None.

Spec

None.

Security

None.

Security review outcome

No unaddressed introduced findings.

Merge Danger

Door: two-way

Revert restores the previous environment setup and validation instruction.

Blast Radius: Triage

Affects Rust tool lookup in --read-machine sessions and this repository's agent validation guidance. Host filesystem write restrictions remain enforced.

Built with codex codex-cli 0.167.2 · gpt-6.1-sol · xhigh