CI: hermetic spawns in e2e_redirect_cargo_shapes (#823)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Refs #823 (slice 19: the e2e_redirect_cargo_shapes suite). This uses Refs, so #823 stays open for the last two PENDING_RAW_SPAWNS files: e2e_hosted_production.rs and e2e_vendored_production.rs.

Summary

run_socket_env in e2e_redirect_cargo_shapes.rs now starts socket-patch through hermetic::binary_command() and scrubs an activated venv (Extra::Venv). It sets the leg's own CARGO_HOME after those calls. The file comes off PENDING_RAW_SPAWNS (3 → 2). The change touches tests only: no product code and no workflows.

Root cause

The suite spawned the CLI with a bare Command::new and its own sweep of every ambient SOCKET_*. That sweep was mostly sound, but it had drifted from the shared harness:

• It forced only SOCKET_NO_CONFIG. The update check and telemetry opt-outs that hermetic::FORCED_OPT_OUTS sets were never forced. (Every call does pass --no-telemetry.)
• There were no hostile seeds, so a dropped scrub line would not turn the suite red.
• VIRTUAL_ENV reached the unscoped scan and vex runs.

To be clear about impact: I found no ambient shell that fails this suite on main. Under VIRTUAL_ENV=<real venv with six installed> SOCKET_DRY_RUN=true SOCKET_ECOSYSTEMS=npm SOCKET_NO_CONFIG=0 SOCKET_NO_UPDATE_CHECK=0 SOCKET_TELEMETRY_DISABLED=0 ..., it passes 32/32 both before and after this change. This slice is about consistency and the ratchet, not a live failure.

Test evidence

• Red with only the PENDING_RAW_SPAWNS removal: spawn_env_hygiene fails no_new_bare_binary_spawns with ["e2e_redirect_cargo_shapes.rs"] (15 passed, 1 failed).
• Green at 4d4ade7: e2e_redirect_cargo_shapes 32/32 (real cargo 1.93.1 against crates.io through the wiremock mirror) and spawn_env_hygiene 16/16. Both are also green under the hostile shell above. e2e_maven is 22/22 after rebasing onto CI: hermetic spawns in the e2e_maven suite (#823) #1519.
• Re-verified at takeover (2026-10-14, branch 0 commits behind main): cargo fmt --check clean, clippy on both test targets clean, spawn_env_hygiene 16/16, e2e_redirect_cargo_shapes 32/32.
• cargo fmt --all -- --check is clean. cargo clippy --locked --workspace --all-features -- -D warnings is clean, and so is clippy --test e2e_redirect_cargo_shapes --test spawn_env_hygiene -- -D warnings.

/code-review high

• Fixed: the doc comment said the venv scrub was there for the scan only. It applies to every call, because vex also discovers packages under --cwd.
• Not fixed here (follow-up under Spawn every CLI test child through one hermetic Command builder; 10 test files inherit ambient SOCKET_* today #823): the real-cargo children (cargo_e2e_matrix::cargo_command) pin CARGO_HOME and drop CARGO_TARGET_DIR, but they still inherit CARGO_BUILD_TARGET_DIR, CARGO_NET_OFFLINE, CARGO_REGISTRIES_* / CARGO_SOURCE_* and RUSTFLAGS. That helper is shared by every cargo matrix suite, so changing it belongs in its own slice.
• Not fixed here (follow-up): about 20 suites now repeat binary_command() + scrub_extra(Venv). Making the shared builder scrub VIRTUAL_ENV by default (or adding a ratchet for it) would remove the copies.

CI cost

No workflow changes. A lean PR run costs the same before and after: about 28 Linux jobs and about 8 minutes.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FFQDbPARQNb93vs7DiZJoP

---

Generated by Claude Code

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 4d4ade7. Configure here.}