bug: CSA git guard blocks local-gate receipt test fixtures

[aider4ryder]

CSA session ID: 01KZS053J9Z79PSPC9NP9FZBPR

Session directory: /home/obj/.local/state/cli-sub-agent/home/obj/project/github/RyderFreeman4Logos/mempal/sessions/01KZS053J9Z79PSPC9NP9FZBPR

Command:

TMPDIR=$(readlink -f /home/obj/tmp) just pre-commit

Exit code: 101

The full suite reached tests/local_gate_receipt_scripts.rs, where fixture setup invokes git init --quiet. CSA git-guard blocks it instead of allowing the test-local temporary repository:

CSA git-guard: blocked command: git <command> <option>
Use a hermetic local bare fixture under $CSA_SESSION_DIR/git-fixtures and push to its direct canonical path or file:// URL.

Result: 13 local gate receipt tests fail before exercising their intended assertions. The guard needs a safe allowance for hermetic git init fixtures created by this test suite.

[aider4ryder]

Additional reproduction from adk-workflow-kit:

• Session ID: 01KZTZZJXBBMB438B3E0NEQJGE
• Session dir: /home/obj/.local/state/cli-sub-agent/home/obj/project/github/RyderFreeman4Logos/adk-workflow-kit/sessions/01KZTZZJXBBMB438B3E0NEQJGE
• Outer command: just pre-commit-fast
• Exit: 128
• Failing recipe: bash scripts/test-local-gates.sh
• Exact first fixture command: git -C "$fixture" init -q -b main
• Fixture source: mktemp -d "${TMPDIR:-/tmp}/adk-local-gates.XXXXXX"; CSA supplied TMPDIR=/tmp

Stderr:

CSA git-guard: blocked command: git -C <value> <command> <option> <option> <argument>
Use a hermetic local bare fixture under $CSA_SESSION_DIR/git-fixtures and push to its direct canonical path or file:// URL.
error: recipe `test-local-gates` failed on line 33 with exit code 128

The direct gate had already passed branch protection, fmt-check, lock-check, workspace check, and clippy. The guard/default-TMPDIR mismatch alone prevented the repository local-gate test from running. A session-scoped TMPDIR=$CSA_SESSION_DIR/git-fixtures is the narrow workaround, but the default CSA environment remains incompatible with this repository gate.

[aider4ryder]

Workaround correction for session 01KZTZZJXBBMB438B3E0NEQJGE: the guard-prescribed session fixture root does not resolve the failure.

Exact retry:

mkdir -p "$CSA_SESSION_DIR/git-fixtures"
TMPDIR="$CSA_SESSION_DIR/git-fixtures" TMP="$CSA_SESSION_DIR/git-fixtures" TEMP="$CSA_SESSION_DIR/git-fixtures" just test-local-gates

Exit: 128

Output:

bash scripts/test-local-gates.sh
CSA git-guard: blocked command: git -C <value> <command> <option> <option> <argument>
Use a hermetic local bare fixture under $CSA_SESSION_DIR/git-fixtures and push to its direct canonical path or file:// URL.
error: recipe `test-local-gates` failed on line 33 with exit code 128

The exact blocked command remains git -C "$fixture" init -q -b main, now with $fixture underneath $CSA_SESSION_DIR/git-fixtures. The repository test requires a normal temporary worktree fixture, so merely relocating TMPDIR cannot satisfy the guard.