fix(tests): restore Windows cache recency CI coverage

[Daniel Meppiel (danielmeppiel)]

fix(tests): restore Windows cache recency CI coverage

TL;DR

Fix both test-harness defects behind the nine Windows main failures from #2861: overly long sparse-Git fixture paths and a socket guard that invented an unsupported Windows capability. Keep real-Git recency assertions and the no-network boundary intact, and select the regressions in the Windows PR gate.

Note

Test-only: no production cache, authentication, release, dependency, or publishing changes. Release PR #2868 is untouched.

Problem (WHY)

• Main Windows job failed eight sparse fixture setups before reaching recency assertions.
• A worker-depth diagnostic run exposed the exact Git error: fatal: unable to access '.git/config.worktree': Filename too long. Git's sparse config probe fails despite core.longpaths=true.
• The ninth failure imported unittest.mock through asyncio, which saw a guard-provided sendmsg and called Windows' nonexistent os.sysconf.
• [!] The initial shallow PR gate passed all eight sparse cases. Main adds an xdist worker directory, so marker coverage alone was not a sufficient trap.

This fix follows observed execution rather than a guessed path diagnosis: "Run the skill against real tasks, then feed the results — all of them, not just failures — back into the creation process."

Approach (WHAT)

• Allocate a short unique pytest root, retaining an explicit worker-depth directory even in the unsharded Windows gate.
• Define guarded sendmsg only if the native raw socket supports it.
• Exercise native parity, real imports, simulated missing capabilities, and IPv4/IPv6 denial without Windows skips.
• Include all nine previously failing cases in the existing marker-based gate.

Implementation (HOW)

File	Change
tests/unit/cache/test_git_cache_recency.py	Short unique fixture roots retain /popen-gw0 depth; real recency cases gain Windows selection; chained local Git failures surface captured stderr.
tests/utils/isolated_apm_environment.py	Guard optional sendmsg definition by the native capability; supported operations still deny IP traffic.
tests/unit/test_isolated_network_guard.py	Twenty marker-selected cases cover constructor/instance capability parity, fresh asyncio/mock imports, simulated Windows absence, and denial through both socket modules.
tests/integration/test_isolated_apm_environment_contract.py	Existing denial contracts require native AttributeError for unsupported sendmsg; supported operations still require the guard's denial.

Diagrams

Dashed nodes highlight the fixture-path correction, capability-preserving guard, and expanded Windows gate coverage.

flowchart LR
    subgraph Fixtures
        A["Short unique pytest root plus worker depth"] --> B["Real sparse and full Git checkouts"]
        B --> C["Pruning and warning assertions"]
    end
    subgraph Guard
        D["Native socket capability"] --> E["Define sendmsg only when supported"]
        E --> F["Real asyncio imports and IP denial"]
    end
    C --> G["Windows compatibility gate"]
    F --> G
    classDef new stroke-dasharray: 5 5;
    class A,E,G new;

Loading

Trade-offs

• Shorten fixture paths, not production cache layout. This addresses the proven harness failure without claiming to fix arbitrary long cache roots.
• Preserve worker-equivalent depth in the unsharded gate instead of adding workflow-specific file enumeration. Under xdist it adds extra depth.
• Unsupported methods remain absent, not artificial no-op or denial methods; supported methods still enforce the no-network contract.
• Keep Git stderr diagnostics in the hermetic local-file-only fixture, not production error rendering. No inherited credentials enter that environment.

Benefits

1. All nine original failing cases are selected before merge.
2. Twenty new cross-platform cases protect native capability parity and denial.
3. The sparse fixture trap retains the depth that reproduced main's failures.

Validation

Final Windows Compatibility Gate at 04aebbfa0548815efc14e931187518b2392bed33:

== 423 passed, 2 skipped, 21759 deselected, 4 warnings in 234.21s (0:03:54) ===

The log explicitly passes all nine original failures at retained worker depth and all twenty new socket cases. All current PR checks pass (CodeQL summary is neutral; both analysis jobs succeeded). The full post-merge Windows build and 21k-test suite were not rerun; this is actual focused Windows evidence.

uv run --frozen --extra dev pytest -q -n 2 tests/unit/cache/test_git_cache_recency.py tests/unit/test_isolated_network_guard.py tests/integration/test_isolated_apm_environment_contract.py -p no:cacheprovider:

53 passed in 13.36s

uv run --frozen --extra dev pytest -q tests/quality -p no:cacheprovider:

63 passed in 41.98s

Regression proof and additional evidence

Before correction, the worker-depth Windows diagnostic revision reproduced all nine original failures:

9 failed, 394 passed, 2 skipped, 21759 deselected, 4 warnings in 235.72s (0:03:55)

The new simulated-Windows socket regression failed against the original guard with the same missing os.sysconf traceback: 1 failed, 19 passed.

Neighboring cache and hermetic/lifecycle tests: 279 passed, 2 skipped in 27.08s.

After merging current main, the canonical lint chain passed: Ruff check and format including architecture scripts, pylint R0801, YAML I/O, file length, portable paths, auth signals, and architecture boundaries. Assertion/duplicate ratchets and the Mermaid renderer also passed.

The pytest processes emitted cleanup warnings for pre-existing temporary directories outside this worktree, unrelated to the passing cases. Dependency bootstrap used exact frozen exported versions through the configured index after direct files.pythonhosted.org downloads failed. uv.lock is unchanged.

Docs-sync: schema-validated L0 no_change, high confidence; all four changed files match the corpus index's test-only no-impact rule. Two bounded reviews found no meaningful correctness or coverage issues.

Scenario Evidence

#	Scenario (user promise)	Principle(s)	Test(s) proving it	Type
1	Recently used cached content survives pruning	DevX (pragmatic as npm)	tests/unit/cache/test_git_cache_recency.py::test_successful_checkout_reuse_survives_prune	integration
2	Timestamp denial warns without losing usable content; other failures propagate	DevX (pragmatic as npm)	tests/unit/cache/test_git_cache_recency.py::test_checkout_recency_error_contract	integration
3	Default CLI stderr exposes the recovery hint on Windows	DevX (pragmatic as npm)	tests/unit/cache/test_git_cache_recency.py::test_recency_permission_warning_reaches_default_cli_stderr (regression trap)	integration
4	Contributors can run isolated Python imports without enabling IP traffic	OSS / community-driven, Secure by default	tests/unit/test_isolated_network_guard.py, including test_guard_without_native_sendmsg_or_sysconf (regression trap), and tests/integration/test_isolated_apm_environment_contract.py::test_python_child_network_is_denied	integration

How to test

• Run uv sync --frozen --extra dev.
• Run the 53-case targeted command above; all cases should pass with two actual xdist workers.
• Run uv run --frozen --extra dev pytest -m windows_compat -q tests/unit/cache/test_git_cache_recency.py tests/unit/test_isolated_network_guard.py; all 37 selected cases should pass.
• Inspect the final Windows Compatibility Gate, including the eight sparse cases at retained worker-equivalent depth and the CLI stderr case.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[Daniel Meppiel (danielmeppiel)]

Docs sync advisory

Verdict: no_change * Pages affected: 0 * LLM calls: 1/15 * Took: 30s

L0 high-confidence path gate: this PR and its bounded follow-up fixes only touch tests/**, matched by .apm/docs-index.yml no-impact paths. No public CLI, manifest, authentication, policy, production cache behavior, or documentation contract changes. No docs edits needed.

The classifier subagent had no repository tools; the orchestrator completed the deterministic path gate and schema validation directly.

[Copilot]

Copilot review overview

🟢 Approval recommended

The changes are test-only, internally consistent across unit/integration contracts, and directly address the documented Windows CI failures without altering production behavior.

Review tier: Lite
Findings: None

What changed in this PR

Restores Windows CI coverage for the Git cache recency regressions by fixing two test-harness behaviors (path depth for sparse Git fixtures and sendmsg capability guarding) and adding marker-selected regression tests to exercise the prior failure modes on Windows.

Changes:

• Shorten/normalize test fixture roots (while preserving worker-depth) to avoid Windows path-length failures in sparse Git setups.
• Update the isolated network guard to only define sendmsg when the native raw socket supports it.
• Add/adjust tests to validate native capability parity, prevent asyncio/unittest.mock import regressions, and assert correct behavior when sendmsg is unsupported.

File	Description
tests/​utils/​isolated_apm_environment.py	Adjusts generated sitecustomize network guard to conditionally define sendmsg only when supported natively.
tests/​unit/​test_isolated_network_guard.py	Adds Windows-gated component tests that validate capability parity and network-denial behavior across socket modules and import paths.
tests/​unit/​cache/​test_git_cache_recency.py	Introduces a shorter, worker-depth-preserving fixture root and expands Windows gate selection for recency regression coverage.
tests/​integration/​test_isolated_apm_environment_contract.py	Updates integration assertions to accept native AttributeError when sendmsg is unsupported, while still enforcing denial when supported.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.