CI: hermetic spawns in vex-vendor/rollback suites (#823)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Refs #823 (slice 17: vex-vendor and rollback multi-copy suites). Uses Refs, so #823 stays open for the remaining PENDING_RAW_SPAWNS files.

Summary

e2e_vex_vendor.rs and rollback/rollback_multicopy_blob_gate.rs now spawn socket-patch through tests/common/hermetic.rs (hermetic::binary_command() / common::hermetic_command) and leave PENDING_RAW_SPAWNS (9 → 7 on main; 4 once #1515 also lands). The ratchet in spawn_env_hygiene.rs keeps them hermetic. Test-only; no product code and no workflow changes.

The two list entries removed here sit two lines away from #1515's removals, with an untouched line between them, so the two PRs merge cleanly in either order.

Root cause

Each file started the CLI with a bare Command::new and its own SOCKET_* sweep, which had drifted from the shared builder:

• e2e_vex_vendor's cli() kept an ambient SOCKET_NO_CONFIG and set SOCKET_NO_CONFIG=1 / telemetry off in only 1 of its 26 spawns. A developer shell with SOCKET_NO_CONFIG=0 let their real socket login reach the other children.
• rollback_cmd swept every SOCKET_* and re-set the config and telemetry opt-outs, but never forced SOCKET_NO_UPDATE_CHECK.
• Neither got the builder's hostile-seed tripwire or the SOCKET_CLI_* peer-alias removal.

Test evidence

• Red, without the conversions (only the PENDING_RAW_SPAWNS removal): spawn_env_hygiene fails no_new_bare_binary_spawns with ["e2e_vex_vendor.rs", "rollback/rollback_multicopy_blob_gate.rs"].
• Under a hostile shell (SOCKET_DRY_RUN=true SOCKET_ECOSYSTEMS=cargo SOCKET_ORG_SLUG=hostile SOCKET_NO_CONFIG=0 SOCKET_JSON=false SOCKET_SILENT=true SOCKET_NO_UPDATE_CHECK=0), both suites already passed on main, because their sweeps did remove the flag-bound vars. This slice closes the config-layer and update-check gaps and puts the files under the ratchet. It does not fix a failing test.
• Green on this branch under the same hostile shell (plus VIRTUAL_ENV=/nonexistent): e2e_vex_vendor 52/52, rollback 59/59, spawn_env_hygiene 16/16. Neither suite has #[ignore]d tests.
• cargo fmt --all -- --check and cargo clippy --locked --workspace --all-features -- -D warnings are clean. The touched test targets add no clippy warnings.

/code-review high

No correctness findings. Two cleanups:

• Fixed: e2e_vex_vendor's cli() now uses common::hermetic::binary_command(), the same spelling as e2e_vex.rs, which it cites.
• Not fixed: vex_json keeps .env("SOCKET_NO_API_TOKEN", "1"). The builder already removes every ambient token source, so the line is redundant. I kept it as an explicit veto because the test's point is that the attestation is built without a token, and it would still hold if the builder ever let a token source through.

CI cost

No workflow changes. A lean PR run is the same before and after (~28 Linux jobs, ~8 min).

🤖 Generated with Claude Code

https://claude.ai/code/session_01JB2n7Tgpcpp64qDf6PhHus

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 3cc99c3. Configure here.}