fix(gate): close operator-state leaks in check.sh and selftests

[LeTuR]

Intent

Fleet task test-isolation/01-gate-reads-no-operator-state ("Fix isolation in fleet tests"; the Rust port is postponed). Goal: one commit gives the same ./scripts/check.sh result wherever it runs - CI, a worker worktree, or the operator's control-plane checkout with its live queue and gitignored configs. Leaks to confirm and close: (1) check_queue ran queue.sh check over the checkout's live orchestration/queue - moved out of the gate into an operator health check reachable from scripts/fleet-status.sh (implemented as fleet-status.sh --records, a flag rather than a screen section because validation opens archived topics' task files, which the default screen promises never to open; it validates both queue records via queue.py record_problems() and the registry map via check_yaml.py registry_problems(), and degrades/exits 0 like the rest of fleet-status). (2) check_automerge answered skip beside an operator auto-merge.conf - now judges a temp root holding only the tracked example. (3) selftests building git repos without pinning host git config - one shared helper scripts/lib/selftest-env.sh (selftest_isolate

) pins GIT_CONFIG_, GIT_DIR family, HOME/XDG, identity, forge credentials, THURBOX_SESSION and every FLEET_ settings root to tracked-example copies, keeping PATH and PYTHONUSERBASE; all seven selftests call it. (4) audit: check_yaml validated the gitignored registry map (removed from gate; onboarding-selftest now holds a generated map to the shape instead), check_voice rendered through the checkout's session-glyphs.conf/agent.conf (install-extension.sh now honours FLEET_GLYPH_ROOT), fleet-status-selftest's queue setup reached a real thurbox-cli (now runs under its bare PATH). Test first (operator rule): scripts/isolation-selftest.sh, wired as check.sh isolation and a CI job in All Checks, poisons a throwaway copy of the tree (malformed queue record, auto-merge/publish/agent/glyph/voice confs, registry map, reconcile dir) and a hostile host (signing gpg that fails, failing hooks, trunk default branch, tokens, tripwire gh/glab/thurbox-cli/quota-axi/ssh) and re-runs only the checks that can leak plus the cheap selftests; the two slow selftests (queue ~190s, reconcile ~90s) are held to the helper by §3 instead of being re-run, to keep runtime ~11s. It fails on main naming each leak and passes on the branch. Hard constraints: keep it simple, no test runner/sharding/new dependency; do not weaken what a check proves - move the live-data half, do not delete it; tracked files name no operator tool/vendor/agent; fixtures are made up, never copied from a live control plane; do not touch docs/design/testing.md (PR #85 owns it). Squash-merge only; the worker does not merge. The previous pipeline run already reviewed, tested and pushed this branch (its review fix made §3 behavioural) and failed only at PR creation on a GitHub HTTP 502.

What Changed

• check.sh no longer runs queue.sh check against the checkout's live orchestration/queue or validates the gitignored registry map; that validation moves into fleet-status.sh --records (backed by new queue.py record_problems() and check_yaml.py registry_problems() helpers), and check_automerge now judges a temp root holding only the tracked auto-merge.example.conf instead of an operator's real auto-merge.conf.
• Adds scripts/lib/selftest-env.sh with a selftest_isolate <dir> helper that pins GIT_CONFIG_*/GIT_DIR family, HOME/XDG, git identity, forge credentials, THURBOX_SESSION, and every FLEET_* settings root to tracked-example copies (keeping PATH/PYTHONUSERBASE); wires it into all seven selftests (fleet-status, install, onboarding, pane, queue, reconcile, sync).
• Adds scripts/isolation-selftest.sh, wired as check.sh isolation and a new CI job, which poisons a throwaway copy of the tree (malformed queue record, auto-merge/publish/agent/glyph/voice confs, registry map, reconcile dir) and a hostile host (failing gpg/hooks, trunk default branch, tripwire CLIs) to prove the gate reads no operator state; install-extension.sh now honours FLEET_GLYPH_ROOT and onboarding-selftest.sh validates a generated registry map instead of the gitignored one.

Risk Assessment

✅ Low: The diff (isolation gate, check.sh restructuring, fleet-status --records, check_yaml/queue.py refactors) is internally consistent, matches every constraint in the stated user intent, is exercised by new behavioral (non-source-grep) tests, and passes syntax/AST checks; the one previously-identified defect (isolation-selftest.sh's committed=$? being clobbered by the intervening echo at lines 304-305) is unchanged from the state the user already reviewed and explicitly declined to fix, so it is not a new risk introduced by this diff.

Testing

Baseline ./scripts/check.sh had already passed; targeted testing focused on the branch's actual deliverable, scripts/isolation-selftest.sh, run both standalone and via ./scripts/check.sh isolation. Both runs demonstrate the end-user behavior directly: a poisoned checkout plus hostile host produce the identical clean verdict as a real runner across queue, automerge, yaml, and voice checks, the shared selftest_isolate helper defeats the hostile host, all seven selftests genuinely invoke that helper (proven behaviorally via a DEBUG-trap probe, not source grep), the four cheap selftests pass poisoned, and no tripwire tool was invoked — all ~90 assertions green in ~11s. No leftover artifacts in the worktree. No findings.

Evidence: isolation-selftest.sh full run output

All sections (§1 checks, §2 helper, §3 per-selftest calls, §4 cheap selftests poisoned, §5 tripwires) passed. Final line: 'isolation selftest: the gate reads no operator state'. Runtime: 11.607s total.

Evidence: check.sh isolation entry point

ok isolation: a poisoned checkout under a hostile host gets the same verdict (11.102s total)

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

✅ **Test** - passed

✅ No issues found.

• ./scripts/check.sh
• ./scripts/isolation-selftest.sh (direct run, all sections §1-§5 passed, ~11.6s)
• ./scripts/check.sh isolation (CLI entry point, passed, ~11.1s)
• git status --porcelain=v1 -uall (confirmed no transient artifacts left in worktree after test run)

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.