[JacobStephens2]

Summary

Isolated release-test git commands and their descendants inherit maintenance-off settings, preserving existing command-scope configuration, host-config exclusion, and test identity.

isolated(command)
  preserve inherited or command-specific git parameters
  append maintenance.auto=false and gc.auto=0
  exclude global/system config and set test identity
  launch command → child processes inherit the protection

Closes #732.

Evidence

• Before: With the original isolated() helper on Git 2.47.3, cargo test --test release isolated_git_ -- --nocapture fails both new guards. Direct git has no maintenance.auto; descendant git reads conflicting inherited values true and 42.
  After: cargo test --test release passes all 54 tests on Git 2.47.3, including both guards. Coverage includes repeated unrelated GIT_CONFIG_COUNT entries, inherited and command-specific GIT_CONFIG_PARAMETERS, conflicting maintenance values, global/system exclusion, and author/committer identity.
• cargo check --tests, cargo fmt --check, and cargo clippy --all-targets -- -D warnings pass.
• Full Rust suite on Git 2.47.3: cargo test passed 1,866 tests, with 0 failures and 2 existing ignored tests, across 45 test binaries.

The original DirectoryNotEmpty race was not reproduced: all 52 existing release scenarios also passed with the original helper on locally built Git 2.47.3. The configuration gap is reproduced deterministically; its connection to the historical cleanup race remains inferred. Cleanup errors still propagate without retries.

Test seams

• Real git's effective configuration and identity when launched through tests/release.rs::isolated, directly and through child processes.
• Existing release-script scenarios through tests/release.rs.

Merge Danger

Door: two-way

Blast Radius: tests

Confined to the release-test isolation helper and its regression guards.

Unaddressed findings

Standards

None. The independent reviewer reported no findings.

Spec

None. The independent reviewer reported no findings.

Security

None. Guidance-mode Security review found no introduced Security findings against pinned merge base 8b2af147279ba0d1ccc9e8d8426d6ce6e65330b4.

Security review outcome

No unaddressed introduced findings.

Review coverage

Independent Standards and Spec reviews compare against main (8b2af147279ba0d1ccc9e8d8426d6ce6e65330b4). Both axes read the only changed file, tests/release.rs. Changed files left unread: none for Standards; none for Spec.

The earlier Spec finding about inherited parameter precedence is addressed; the retained descendant guard exercises conflicting values in both command-scope formats. Current independent reviews report no additional findings. Final reports and each axis's files-read list are saved in .thirdshift-review-73gAwW/standards.md and .thirdshift-review-73gAwW/spec.md in the implementation workspace.

Security review

Guidance-mode review against pinned merge base 8b2af147279ba0d1ccc9e8d8426d6ce6e65330b4: 0 introduced Security findings. Reviewed the requested local diff at 6b97d7b0952ca18bf6022cd93738023c6e932fe5 and the additional reconciliation at PR revision f17021279743d890058a40cc7e67a12757609811.

Read the complete change and supporting Git command builders, release fixtures, fake GitHub merge path, release script, CI workflow, and applicable security decisions. Applied injection, configuration inheritance, resource/file handling, and supply-chain/release attack-class guidance. No source fix was needed.

Validation: rebuilt the release-test target directly from source with Rust 1.99.0 and cached dependencies, without dependency downloads. All three isolation guards at the requested local revision passed; both reconciled isolation guards at the PR revision passed. Runs used an OS-enforced sandbox with networking disabled, read-only source/toolchain, an empty allowlisted environment, scratch-only file writes, and bounded CPU, memory, processes, file size, disk, and wall time.

Additional Security review validation at f17021279743d890058a40cc7e67a12757609811: compiled the current tests/release.rs with rustc --test using Rust 1.99.0 and cached dependencies, then ran all 54 release tests successfully on Git 2.43.0. The offline OS sandbox used read-only source/toolchain, an empty allowlisted environment, scratch-only writes, and explicit resource limits. No SECURITY.md or conventional threat-model document was present; the applicable trust/privacy ADRs were read. No security fixes were required.

Built with codex · gpt-6.1-sol · high