diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,6 +7,52 @@
   pull_request:
 
 jobs:
+  spec-kit-conformance:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Validate spec-kit artifact set
+        run: |
+          test -f testkit/.specify/memory/constitution.md
+          test -f testkit/.specify/specs/001-polyglot-testkit/spec.md
+          test -f testkit/.specify/specs/001-polyglot-testkit/plan.md
+          test -f testkit/.specify/specs/001-polyglot-testkit/tasks.md
+          test -f testkit/.specify/specs/001-polyglot-testkit/contracts/cli-protocol.json
+          test -f testkit/.specify/specs/001-polyglot-testkit/checklists/quality.md
+
+      - name: Validate spec-kit scaffold and status
+        run: ./testkit/.specify/scripts/validate_specify.sh
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "stable"
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Setup Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "21"
+          cache: maven
+
+      - name: Run Python spec conformance smoke tests
+        run: |
+          cd testkit/python
+          python -m pip install -e ".[dev]"
+          python -m pytest tests/ -v
+
+      - name: Run Java spec conformance smoke tests
+        run: |
+          cd testkit/java
+          mvn test
+
   test:
     runs-on: ubuntu-latest
     strategy:

diff --git a/cmd/git-testkit-cli/main.go b/cmd/git-testkit-cli/main.go
new file mode 100644
--- /dev/null
+++ b/cmd/git-testkit-cli/main.go
@@ -1,0 +1,246 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	testutil "github.com/git-fire/git-testkit"
+)
+
+type request struct {
+	Op       string            `json:"op"`
+	BaseDir  string            `json:"baseDir,omitempty"`
+	RepoPath string            `json:"repoPath,omitempty"`
+	Args     []string          `json:"args,omitempty"`
+	Options  *repoOptionsInput `json:"options,omitempty"`
+
+	SnapshotPath string `json:"snapshotPath,omitempty"`
+}
+
+type repoOptionsInput struct {
+	Name          string            `json:"name"`
+	Dirty         bool              `json:"dirty,omitempty"`
+	Files         map[string]string `json:"files,omitempty"`
+	Remotes       map[string]string `json:"remotes,omitempty"`
+	Branches      []string          `json:"branches,omitempty"`
+	InitialCommit string            `json:"initialCommit,omitempty"`
+}
+
+type response struct {
+	OK bool `json:"ok"`
+
+	Error string `json:"error,omitempty"`
+
+	RepoPath     string            `json:"repoPath,omitempty"`
+	RemotePath   string            `json:"remotePath,omitempty"`
+	FSRoot       string            `json:"fsRoot,omitempty"`
+	Output       string            `json:"output,omitempty"`
+	Dirty        *bool             `json:"dirty,omitempty"`
+	Remotes      map[string]string `json:"remotes,omitempty"`
+	SHA          string            `json:"sha,omitempty"`
+	Branches     []string          `json:"branches,omitempty"`
+	SnapshotName string            `json:"snapshotName,omitempty"`
+	SnapshotSize int               `json:"snapshotSize,omitempty"`
+	RestorePath  string            `json:"restorePath,omitempty"`
+}
+
+func main() {
+	req, err := parseRequest()
+	if err != nil {
+		writeResponse(response{OK: false, Error: err.Error()})
+		os.Exit(1)
+	}
+
+	res, err := handle(req)
+	if err != nil {
+		writeResponse(response{OK: false, Error: err.Error()})
+		os.Exit(1)
+	}
+	writeResponse(res)
+}
+
+func parseRequest() (request, error) {
+	raw, err := os.ReadFile("/dev/stdin")
+	if err != nil {
+		return request{}, fmt.Errorf("failed reading stdin: %w", err)
+	}
+	var req request
+	if err := json.Unmarshal(raw, &req); err != nil {
+		return request{}, fmt.Errorf("invalid JSON request: %w", err)
+	}
+	if strings.TrimSpace(req.Op) == "" {
+		return request{}, fmt.Errorf("missing required field: op")
+	}
+	return req, nil
+}
+
+func handle(req request) (response, error) {
+	switch req.Op {
+	case "create_test_repo":
+		base, err := ensureBaseDir(req.BaseDir)
+		if err != nil {
+			return response{}, err
+		}
+		if req.Options == nil {
+			return response{}, fmt.Errorf("missing options")
+		}
+		repoPath, err := testutil.CreateTestRepoInDir(base, testutil.RepoOptions{
+			Name:          req.Options.Name,
+			Dirty:         req.Options.Dirty,
+			Files:         req.Options.Files,
+			Remotes:       req.Options.Remotes,
+			Branches:      req.Options.Branches,
+			InitialCommit: req.Options.InitialCommit,
+		})
+		if err != nil {
+			return response{}, err
+		}
+		return response{OK: true, RepoPath: repoPath}, nil
+
+	case "create_bare_remote":
+		base, err := ensureBaseDir(req.BaseDir)
+		if err != nil {
+			return response{}, err
+		}
+		if req.Options == nil || req.Options.Name == "" {
+			return response{}, fmt.Errorf("missing options.name")
+		}
+		remotePath, err := testutil.CreateBareRemoteInDir(base, req.Options.Name)
+		if err != nil {
+			return response{}, err
+		}
+		return response{OK: true, RemotePath: remotePath}, nil
+
+	case "setup_fake_filesystem":
+		base, err := ensureBaseDir(req.BaseDir)
+		if err != nil {
+			return response{}, err
+		}
+		root, err := testutil.SetupFakeFilesystemInDir(base)
+		if err != nil {
+			return response{}, err
+		}
+		return response{OK: true, FSRoot: root}, nil
+
+	case "run_git_cmd":
+		if req.RepoPath == "" {
+			return response{}, fmt.Errorf("missing repoPath")
+		}
+		output, err := testutil.RunGitCmdE(req.RepoPath, req.Args...)
+		if err != nil {
+			return response{}, err
+		}
+		return response{OK: true, Output: output}, nil
+
+	case "is_dirty":
+		if req.RepoPath == "" {
+			return response{}, fmt.Errorf("missing repoPath")
+		}
+		dirty, err := testutil.IsDirtyE(req.RepoPath)
+		if err != nil {
+			return response{}, err
+		}
+		return response{OK: true, Dirty: &dirty}, nil
+
+	case "get_remotes":
+		if req.RepoPath == "" {
+			return response{}, fmt.Errorf("missing repoPath")
+		}
+		remotes, err := testutil.GetRemotesE(req.RepoPath)
+		if err != nil {
+			return response{}, err
+		}
+		return response{OK: true, Remotes: remotes}, nil
+
+	case "get_current_sha":
+		if req.RepoPath == "" {
+			return response{}, fmt.Errorf("missing repoPath")
+		}
+		sha, err := testutil.GetCurrentSHAE(req.RepoPath)
+		if err != nil {
+			return response{}, err
+		}
+		return response{OK: true, SHA: sha}, nil
+
+	case "get_branches":
+		if req.RepoPath == "" {
+			return response{}, fmt.Errorf("missing repoPath")
+		}
+		branches, err := testutil.GetBranchesE(req.RepoPath)
+		if err != nil {
+			return response{}, err
+		}
+		return response{OK: true, Branches: branches}, nil
+
+	case "snapshot_repo":
+		if req.RepoPath == "" {
+			return response{}, fmt.Errorf("missing repoPath")
+		}
+		snapshot, err := testutil.SnapshotRepoE(req.RepoPath)
+		if err != nil {
+			return response{}, err
+		}
+		return response{OK: true, SnapshotName: snapshot.Name(), SnapshotSize: snapshot.Size()}, nil
+
+	case "snapshot_save":
+		if req.RepoPath == "" || req.SnapshotPath == "" {
+			return response{}, fmt.Errorf("missing repoPath or snapshotPath")
+		}
+		snapshot, err := testutil.SnapshotRepoE(req.RepoPath)
+		if err != nil {
+			return response{}, err
+		}
+		if err := testutil.SaveSnapshotToDiskE(snapshot, req.SnapshotPath); err != nil {
+			return response{}, err
+		}
+		return response{OK: true, SnapshotName: snapshot.Name(), SnapshotSize: snapshot.Size()}, nil
+
+	case "snapshot_load_restore":
+		if req.SnapshotPath == "" {
+			return response{}, fmt.Errorf("missing snapshotPath")
+		}
+		base, err := ensureBaseDir(req.BaseDir)
+		if err != nil {
+			return response{}, err
+		}
+		snapshot, err := testutil.LoadSnapshotFromDiskE(req.SnapshotPath)
+		if err != nil {
+			return response{}, err
+		}
+		restorePath, err := testutil.RestoreSnapshotToDir(snapshot, base)
+		if err != nil {
+			return response{}, err
+		}
+		return response{
+			OK:           true,
+			RestorePath:  restorePath,
+			SnapshotName: snapshot.Name(),
+			SnapshotSize: snapshot.Size(),
+		}, nil
+
+	default:
+		return response{}, fmt.Errorf("unsupported op: %s", req.Op)
+	}
+}
+
+func ensureBaseDir(baseDir string) (string, error) {
+	if strings.TrimSpace(baseDir) == "" {
+		return "", fmt.Errorf("missing baseDir")
+	}
+	clean := filepath.Clean(baseDir)
+	if err := os.MkdirAll(clean, 0755); err != nil {
+		return "", err
+	}
+	return clean, nil
+}
+
+func writeResponse(res response) {
+	enc := json.NewEncoder(os.Stdout)
+	enc.SetEscapeHTML(false)
+	if err := enc.Encode(res); err != nil {
+		fmt.Fprintf(os.Stderr, `{"ok":false,"error":"failed writing response: %s"}`+"\n", err.Error())
+	}
+}

diff --git a/fixtures.go b/fixtures.go
--- a/fixtures.go
+++ b/fixtures.go
@@ -1,6 +1,7 @@
 package testutil
 
 import (
+	"fmt"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -34,102 +35,128 @@
 func CreateTestRepo(t *testing.T, opts RepoOptions) string {
 	t.Helper()
 
-	// Create temp directory
-	tmpDir := t.TempDir()
-	repoPath := filepath.Join(tmpDir, opts.Name)
+	repoPath, err := CreateTestRepoInDir(t.TempDir(), opts)
+	if err != nil {
+		t.Fatalf("Failed to create test repo: %v", err)
+	}
+	return repoPath
+}
 
+// CreateTestRepoInDir creates a test repository under the provided base directory.
+func CreateTestRepoInDir(baseDir string, opts RepoOptions) (string, error) {
+	repoPath := filepath.Join(baseDir, opts.Name)
+
 	if err := os.MkdirAll(repoPath, 0755); err != nil {
-		t.Fatalf("Failed to create repo directory: %v", err)
+		return "", fmt.Errorf("failed to create repo directory: %w", err)
 	}
 
-	// Initialize git repo
-	runGit(t, repoPath, "init")
-	runGit(t, repoPath, "config", "user.email", "test@example.com")
-	runGit(t, repoPath, "config", "user.name", "Test User")
+	if _, err := RunGitCmdE(repoPath, "init"); err != nil {
+		return "", err
+	}
+	if _, err := RunGitCmdE(repoPath, "config", "user.email", "test@example.com"); err != nil {
+		return "", err
+	}
+	if _, err := RunGitCmdE(repoPath, "config", "user.name", "Test User"); err != nil {
+		return "", err
+	}
 
-	// Create initial commit (required for most operations)
-	initialFile := filepath.Join(repoPath, "README.md")
 	commitMsg := opts.InitialCommit
 	if commitMsg == "" {
 		commitMsg = "Initial commit"
 	}
-
+	initialFile := filepath.Join(repoPath, "README.md")
 	if err := os.WriteFile(initialFile, []byte("# Test Repo\n"), 0644); err != nil {
-		t.Fatalf("Failed to create README: %v", err)
+		return "", fmt.Errorf("failed to create README: %w", err)
 	}
+	if _, err := RunGitCmdE(repoPath, "add", "README.md"); err != nil {
+		return "", err
+	}
+	if _, err := RunGitCmdE(repoPath, "commit", "-m", commitMsg); err != nil {
+		return "", err
+	}
 
-	runGit(t, repoPath, "add", "README.md")
-	runGit(t, repoPath, "commit", "-m", commitMsg)
-
-	// Create additional files if specified
 	for filename, content := range opts.Files {
 		filePath := filepath.Join(repoPath, filename)
-
-		// Create parent directories if needed
-		dir := filepath.Dir(filePath)
-		if err := os.MkdirAll(dir, 0755); err != nil {
-			t.Fatalf("Failed to create directory for %s: %v", filename, err)
+		if err := os.MkdirAll(filepath.Dir(filePath), 0755); err != nil {
+			return "", fmt.Errorf("failed to create directory for %s: %w", filename, err)
 		}
-
 		if err := os.WriteFile(filePath, []byte(content), 0644); err != nil {
-			t.Fatalf("Failed to create file %s: %v", filename, err)
+			return "", fmt.Errorf("failed to create file %s: %w", filename, err)
 		}
-		runGit(t, repoPath, "add", filename)
-		runGit(t, repoPath, "commit", "-m", "Add "+filename)
+		if _, err := RunGitCmdE(repoPath, "add", filename); err != nil {
+			return "", err
+		}
+		if _, err := RunGitCmdE(repoPath, "commit", "-m", "Add "+filename); err != nil {
+			return "", err
+		}
 	}
 
-	// Add remotes
 	for name, url := range opts.Remotes {
-		runGit(t, repoPath, "remote", "add", name, url)
+		if _, err := RunGitCmdE(repoPath, "remote", "add", name, url); err != nil {
+			return "", err
+		}
 	}
 
-	// Create branches
 	for _, branch := range opts.Branches {
-		runGit(t, repoPath, "checkout", "-b", branch)
+		if _, err := RunGitCmdE(repoPath, "checkout", "-b", branch); err != nil {
+			return "", err
+		}
 	}
 
-	// Return to main/master branch
 	if len(opts.Branches) > 0 {
-		// Try main first, fallback to master
-		if err := exec.Command("git", "-C", repoPath, "checkout", "main").Run(); err != nil {
-			runGit(t, repoPath, "checkout", "master")
+		if _, err := RunGitCmdE(repoPath, "checkout", "main"); err != nil {
+			if _, fallbackErr := RunGitCmdE(repoPath, "checkout", "master"); fallbackErr != nil {
+				return "", fallbackErr
+			}
 		}
 	}
 
-	// Make repo dirty if requested
 	if opts.Dirty {
 		dirtyFile := filepath.Join(repoPath, "uncommitted.txt")
 		if err := os.WriteFile(dirtyFile, []byte("uncommitted changes\n"), 0644); err != nil {
-			t.Fatalf("Failed to create dirty file: %v", err)
+			return "", fmt.Errorf("failed to create dirty file: %w", err)
 		}
 	}
 
-	return repoPath
+	return repoPath, nil
 }
 
 // CreateBareRemote creates a bare git repository to use as a remote
 func CreateBareRemote(t *testing.T, name string) string {
 	t.Helper()
 
-	tmpDir := t.TempDir()
-	remotePath := filepath.Join(tmpDir, name+".git")
+	remotePath, err := CreateBareRemoteInDir(t.TempDir(), name)
+	if err != nil {
+		t.Fatalf("Failed to create bare remote: %v", err)
+	}
+	return remotePath
+}
 
+// CreateBareRemoteInDir creates a bare remote repository under the provided base directory.
+func CreateBareRemoteInDir(baseDir, name string) (string, error) {
+	remotePath := filepath.Join(baseDir, name+".git")
 	if err := os.MkdirAll(remotePath, 0755); err != nil {
-		t.Fatalf("Failed to create bare repo directory: %v", err)
+		return "", fmt.Errorf("failed to create bare repo directory: %w", err)
 	}
-
-	runGit(t, remotePath, "init", "--bare")
-
-	return remotePath
+	if _, err := RunGitCmdE(remotePath, "init", "--bare"); err != nil {
+		return "", err
+	}
+	return remotePath, nil
 }
 
 // SetupFakeFilesystem creates a fake filesystem structure for scanning tests
 func SetupFakeFilesystem(t *testing.T) string {
 	t.Helper()
 
-	tmpDir := t.TempDir()
+	root, err := SetupFakeFilesystemInDir(t.TempDir())
+	if err != nil {
+		t.Fatalf("Failed to setup fake filesystem: %v", err)
+	}
+	return root
+}
 
-	// Create directory structure
+// SetupFakeFilesystemInDir creates a deterministic fake filesystem tree under baseDir.
+func SetupFakeFilesystemInDir(baseDir string) (string, error) {
 	dirs := []string{
 		"home/testuser/projects",
 		"home/testuser/src",
@@ -138,27 +165,22 @@
 		"root/sys",
 		"root/proc",
 	}
-
 	for _, dir := range dirs {
-		path := filepath.Join(tmpDir, dir)
+		path := filepath.Join(baseDir, dir)
 		if err := os.MkdirAll(path, 0755); err != nil {
-			t.Fatalf("Failed to create directory %s: %v", dir, err)
+			return "", fmt.Errorf("failed to create directory %s: %w", dir, err)
 		}
 	}
-
-	return tmpDir
+	return baseDir, nil
 }
 
 // runGit is a helper to run git commands in a specific directory
 func runGit(t *testing.T, dir string, args ...string) {
 	t.Helper()
 
-	cmd := exec.Command("git", args...)
-	cmd.Dir = dir
-
-	output, err := cmd.CombinedOutput()
+	_, err := RunGitCmdE(dir, args...)
 	if err != nil {
-		t.Fatalf("Git command failed: git %v\nOutput: %s\nError: %v", args, output, err)
+		t.Fatalf("%v", err)
 	}
 }
 
@@ -166,39 +188,98 @@
 func IsDirty(t *testing.T, repoPath string) bool {
 	t.Helper()
 
-	cmd := exec.Command("git", "status", "--porcelain")
-	cmd.Dir = repoPath
-
-	output, err := cmd.Output()
+	dirty, err := IsDirtyE(repoPath)
 	if err != nil {
 		t.Fatalf("Failed to check git status: %v", err)
 	}
-
-	return len(output) > 0
+	return dirty
 }
 
 // GetRemotes returns the configured remotes for a repo
 func GetRemotes(t *testing.T, repoPath string) map[string]string {
 	t.Helper()
 
-	cmd := exec.Command("git", "remote", "-v")
-	cmd.Dir = repoPath
+	remotes, err := GetRemotesE(repoPath)
+	if err != nil {
+		t.Fatalf("Failed to get remotes: %v", err)
+	}
+	return remotes
+}
 
+// RunGitCmd runs a git command and fails the test if it errors
+// Exported version of runGit for use in other test packages
+func RunGitCmd(t *testing.T, dir string, args ...string) {
+	t.Helper()
+	runGit(t, dir, args...)
+}
+
+// RunGitCmdE runs git command in dir and returns trimmed command output.
+func RunGitCmdE(dir string, args ...string) (string, error) {
+	cmd := exec.Command("git", args...)
+	cmd.Dir = dir
+
 	output, err := cmd.Output()
 	if err != nil {
-		t.Fatalf("Failed to get remotes: %v", err)
+		if exitErr, ok := err.(*exec.ExitError); ok {
+			return "", fmt.Errorf(
+				"git command failed: git %v\nStdout: %s\nStderr: %s\nError: %w",
+				args,
+				strings.TrimSpace(string(output)),
+				strings.TrimSpace(string(exitErr.Stderr)),
+				err,
+			)
+		}
+		return "", fmt.Errorf("git command failed: git %v\nError: %w", args, err)
 	}
+	return strings.TrimSpace(string(output)), nil
+}
 
-	// Parse output into map
-	// Format: "origin	/path/to/remote (fetch)"
-	//         "origin	/path/to/remote (push)"
+// GetCurrentSHA returns the current commit SHA
+func GetCurrentSHA(t *testing.T, repoPath string) string {
+	t.Helper()
+
+	sha, err := GetCurrentSHAE(repoPath)
+	if err != nil {
+		t.Fatalf("Failed to get current SHA: %v", err)
+	}
+	return sha
+}
+
+// GetBranches returns all branches in the repo
+func GetBranches(t *testing.T, repoPath string) []string {
+	t.Helper()
+
+	branches, err := GetBranchesE(repoPath)
+	if err != nil {
+		t.Fatalf("Failed to get branches: %v", err)
+	}
+	return branches
+}
+
+// IsDirtyE checks if a git repo has uncommitted changes.
+func IsDirtyE(repoPath string) (bool, error) {
+	output, err := RunGitCmdE(repoPath, "status", "--porcelain")
+	if err != nil {
+		return false, err
+	}
+	return len(output) > 0, nil
+}
+
+// GetRemotesE returns configured remotes for a repo.
+func GetRemotesE(repoPath string) (map[string]string, error) {
+	output, err := RunGitCmdE(repoPath, "remote", "-v")
+	if err != nil {
+		return nil, err
+	}
+	return parseRemotesOutput(output), nil
+}
+
+func parseRemotesOutput(output string) map[string]string {
 	remotes := make(map[string]string)
-
-	lines := strings.TrimSpace(string(output))
+	lines := strings.TrimSpace(output)
 	if lines == "" {
 		return remotes
 	}
-
 	for _, line := range strings.Split(lines, "\n") {
 		line = strings.TrimSpace(line)
 		if line == "" {
@@ -206,7 +287,6 @@
 		}
 		name, remainder, ok := strings.Cut(line, "\t")
 		if !ok {
-			// Fallback for unusual formatting that does not use tabs.
 			idx := strings.IndexAny(line, " \t")
 			if idx == -1 {
 				continue
@@ -218,8 +298,6 @@
 			remainder = strings.TrimSpace(remainder)
 		}
 
-		// Strip only the trailing git remote role suffix once so paths that end
-		// with text like " (push)" are not damaged by sequential TrimSuffix calls.
 		if strings.HasSuffix(remainder, " (fetch)") {
 			remainder = strings.TrimSuffix(remainder, " (fetch)")
 		} else if strings.HasSuffix(remainder, " (push)") {
@@ -230,42 +308,22 @@
 			remotes[name] = remainder
 		}
 	}
-
 	return remotes
 }
 
-// RunGitCmd runs a git command and fails the test if it errors
-// Exported version of runGit for use in other test packages
-func RunGitCmd(t *testing.T, dir string, args ...string) {
-	t.Helper()
-	runGit(t, dir, args...)
+// GetCurrentSHAE returns the current commit SHA.
+func GetCurrentSHAE(repoPath string) (string, error) {
+	return RunGitCmdE(repoPath, "rev-parse", "HEAD")
 }
 
-// GetCurrentSHA returns the current commit SHA
-func GetCurrentSHA(t *testing.T, repoPath string) string {
-	t.Helper()
-
-	cmd := exec.Command("git", "rev-parse", "HEAD")
-	cmd.Dir = repoPath
-
-	output, err := cmd.Output()
-	if err != nil {
-		t.Fatalf("Failed to get current SHA: %v", err)
-	}
-
-	return strings.TrimSpace(string(output))
-}
-
-// GetBranches returns all branches in the repo
-func GetBranches(t *testing.T, repoPath string) []string {
-	t.Helper()
-
+// GetBranchesE returns all branches in a repo.
+func GetBranchesE(repoPath string) ([]string, error) {
 	cmd := exec.Command("git", "branch", "--format=%(refname:short)")
 	cmd.Dir = repoPath
 
 	output, err := cmd.Output()
 	if err != nil {
-		t.Fatalf("Failed to get branches: %v", err)
+		return nil, err
 	}
 
 	branches := strings.Split(strings.TrimSpace(string(output)), "\n")
@@ -278,5 +336,5 @@
 		}
 	}
 
-	return result
+	return result, nil
 }

diff --git a/fixtures_test.go b/fixtures_test.go
--- a/fixtures_test.go
+++ b/fixtures_test.go
@@ -2,7 +2,9 @@
 
 import (
 	"os"
+	"os/exec"
 	"path/filepath"
+	"strings"
 	"testing"
 
 	testutil "github.com/git-fire/git-testkit"
@@ -151,3 +153,47 @@
 		}
 	}
 }
+
+func TestQueryHelpersIgnoreGitTraceStderr(t *testing.T) {
+	t.Setenv("GIT_TRACE", "1")
+
+	remotePath := testutil.CreateBareRemote(t, "origin")
+	repoPath := testutil.CreateTestRepo(t, testutil.RepoOptions{
+		Name: "trace-safe-repo",
+		Remotes: map[string]string{
+			"origin": remotePath,
+		},
+	})
+
+	dirty, err := testutil.IsDirtyE(repoPath)
+	if err != nil {
+		t.Fatalf("IsDirtyE failed: %v", err)
+	}
+	if dirty {
+		t.Fatal("expected clean repo to remain clean when git writes trace to stderr")
+	}
+
+	sha, err := testutil.GetCurrentSHAE(repoPath)
+	if err != nil {
+		t.Fatalf("GetCurrentSHAE failed: %v", err)
+	}
+
+	cmd := exec.Command("git", "rev-parse", "HEAD")
+	cmd.Dir = repoPath
+	expectedSHABytes, err := cmd.Output()
+	if err != nil {
+		t.Fatalf("failed to get expected sha: %v", err)
+	}
+	expectedSHA := strings.TrimSpace(string(expectedSHABytes))
+	if sha != expectedSHA {
+		t.Fatalf("expected sha %q, got %q", expectedSHA, sha)
+	}
+
+	remotes, err := testutil.GetRemotesE(repoPath)
+	if err != nil {
+		t.Fatalf("GetRemotesE failed: %v", err)
+	}
+	if got := remotes["origin"]; got != remotePath {
+		t.Fatalf("expected origin remote %q, got %q", remotePath, got)
+	}
+}

diff --git a/snapshots.go b/snapshots.go
--- a/snapshots.go
+++ b/snapshots.go
@@ -30,7 +30,15 @@
 // This allows fast restoration of expensive test setups
 func SnapshotRepo(t *testing.T, repoPath string) *Snapshot {
 	t.Helper()
+	snapshot, err := SnapshotRepoE(repoPath)
+	if err != nil {
+		t.Fatalf("Failed to create snapshot: %v", err)
+	}
+	return snapshot
+}
 
+// SnapshotRepoE creates an in-memory snapshot of a repository and returns errors.
+func SnapshotRepoE(repoPath string) (*Snapshot, error) {
 	var buf bytes.Buffer
 	gzipWriter := gzip.NewWriter(&buf)
 	tarWriter := tar.NewWriter(gzipWriter)
@@ -77,23 +85,20 @@
 
 		return nil
 	})
... diff truncated: showing 800 of 2350 lines