Harden coverage for devcontainer export, cleanup safety, and trust error paths

[codeforester]

Goal

Add focused branch and error-path tests for devcontainer export, cache cleanup, and manifest-command trust so their lower-covered behavior is protected without weakening the repository-wide coverage ratchet.

Background

A fresh coverage run on current main (685d538) passed all 1,051 Python tests at 88.12% statements, 77.67% branches, and 85.55% combined coverage. Three important surfaces remain below the repository average or contain concentrated uncovered branches:

• base_devcontainer/export.py: 77.57% statements, 71.43% branches, 75.84% combined. Only the basic extension export and first write are tested directly.
• base_clean/engine.py: 82.43% statements, 81.67% branches, 82.21% combined. Existing safety tests are strong, but several metadata, path-resolution, active-run, and descriptor-relative deletion failures remain uncovered in destructive cleanup code.
• base_trust/engine.py: 81.65% statements, 64.77% branches, 77.60% combined. Project-specific status error handling and CSV/TSV/YAML/text selection are among the missing paths at Base's manifest-command trust boundary.

The aggregate coverage gate can stay green while these local gaps remain, so this issue targets observable behavior rather than percentage-only assertions.

Scope

• Cover devcontainer VS Code settings, settings-plus-extensions, unsupported IDE/manifest fields, ambiguous Python fields, existing-target refusal, stable JSON payloads, and text finding rendering.
• Cover cleanup branches for candidates that become active, unsafe preview candidates, unreadable directory/metadata entries, non-directory path components, resolution failures, descriptor-open/removal failures, and the no-safe-match result.
• Cover trust command resolution/manifest errors, invalid formats, JSON/YAML/CSV/TSV/non-terminal/text rendering, allow/require/revoke error handling, and changed-manifest guidance where currently untested.
• Prefer focused fixtures and mocks; do not weaken path containment checks or perform real destructive operations.

Acceptance Criteria

• Devcontainer tests assert every supported, unsupported, and ambiguous manifest classification and refusal to overwrite a project-owned target.
• Cleanup tests directly exercise the remaining fail-closed filesystem/error branches and prove no path outside the isolated cache fixture is removed.
• Trust tests cover project-specific failure handling and all documented output formats with stable exit codes and output channels.
• Each targeted module shows a meaningful reduction in uncovered lines/branches, and no new coverage omissions are added.
• The repository statement, branch, and combined coverage ratchets remain enabled and pass.

Validation

BASE_CLI_SOURCE_DIR=../base-cli/lib/python \
PYTHONPATH=../base-cli/lib/python:lib/python:cli/python \
python -m pytest \
  cli/python/base_devcontainer/tests/test_export.py \
  cli/python/base_clean/tests/test_engine.py \
  cli/python/base_trust/tests/test_engine.py -q

BASE_CLI_SOURCE_DIR=../base-cli/lib/python \
PYTHONPATH=../base-cli/lib/python:lib/python:cli/python \
python -m pytest --cov=cli/python --cov-report=term-missing --cov-report=json:coverage.json
python -m tests.coverage_gate coverage.json

BASE_BASH_LIBS_DIR=../base-bash-libs/lib/bash \
BASE_CLI_SOURCE_DIR=../base-cli/lib/python \
env -u BASE_HOME ./bin/base-test

Non-Goals

• Changing devcontainer export policy, cleanup retention semantics, or the manifest-command trust model.
• Performing real cache deletion, Homebrew work, or project command execution in tests.
• Requiring uniform per-file coverage or 100% coverage.

Project Fields

• Status: Ready
• Priority: P2
• Area: Python
• Initiative: Contract Hardening
• Size: M

Agent Assignment

Copilot candidate after triage. The work is test-focused and fixture-driven, but cleanup and trust assertions require careful human review because they protect destructive and security-sensitive boundaries.