feat(autofix): require isolated targeted E2E proof

.github/scripts/autofix-cli-launcher.mjs

@@ -0,0 +1,27 @@
+const candidateCli = process.env['AUTOFIX_CANDIDATE_CLI'];
+const uid = Number(process.env['AUTOFIX_VERIFY_UID']);
+const gid = Number(process.env['AUTOFIX_VERIFY_GID']);
+
+if (
+  !candidateCli ||
+  !Number.isInteger(uid) ||
+  uid <= 0 ||
+  !Number.isInteger(gid) ||
+  gid <= 0
+) {
+  throw new Error('Missing isolated candidate CLI configuration');
+}
+
+if (process.getuid() === 0) {
+  process.setgroups([]);
+  process.setgid(gid);
+  process.setuid(uid);
+} else if (process.getuid() !== uid || process.getgid() !== gid) {
+  throw new Error('Isolated candidate CLI is running as an unexpected user');
+}
+
+const candidate = await import(candidateCli);
+if (typeof candidate.runCliEntryPoint !== 'function') {
+  throw new Error('Candidate CLI does not export runCliEntryPoint');
+}
+await candidate.runCliEntryPoint();

.github/scripts/autofix-vitest.config.mjs

@@ -0,0 +1,27 @@
+import { resolve } from 'node:path';
+
+const workspace = process.env.AUTOFIX_WORKSPACE;
+
+if (!workspace) {
+  throw new Error('Missing isolated Vitest configuration');
+}
+
+export default {
+  root: resolve(workspace, 'integration-tests'),
+  test: {
+    // Mirror the integration-tests config default (TB_TIMEOUT_MINUTES=5);
+    // that env var is not on the wrapper's env allowlist. Without this,
+    // Vitest's 5 s default would fail any future allowlisted case that does
+    // not declare its own timeout.
+    testTimeout: 5 * 60 * 1000,
+    retry: 0,
+    fileParallelism: false,
+    pool: 'forks',
+    poolOptions: {
+      forks: {
+        singleFork: true,
+        isolate: true,
+      },
+    },
+  },
+};

.github/scripts/check-autofix-contracts.sh

@@ -10,14 +10,25 @@ fail() {
 
 changed_files="$(cat)"
 
-if ! npm run check-i18n; then
+run_candidate() {
+  if [[ -n "${AUTOFIX_VERIFY_COMMAND:-}" ]]; then
+    "${AUTOFIX_VERIFY_COMMAND}" "${GITHUB_WORKSPACE}" "$@"
+  else
+    "$@"
+  fi
+}
+
+if ! run_candidate npm run check-i18n; then
   echo '❌ i18n verification failed.'
   fail
 fi
 
 if grep -Fxq 'packages/core/src/tools/tool-names.ts' <<< "${changed_files}"; then
-  if ! npm run test --workspace packages/web-shell -- \
-    client/components/messages/toolFormatting.drift.test.ts; then
+  # Coverage and JUnit reporting stay off: the sealed issue verify job
+  # audits every ignored artifact a gate leaves behind and rejects them.
+  if ! run_candidate npm run test --workspace packages/web-shell -- \
+    client/components/messages/toolFormatting.drift.test.ts \
+    --coverage.enabled=false --reporter=default; then
     echo '❌ Web Shell tool-display contract verification failed.'
     fail
   fi

.github/scripts/check-settings-schema.sh

@@ -23,18 +23,34 @@ fail() {
   exit 1
 }
 
-# Guard the generator itself: if it CRASHES (e.g. a type error the agent
-# introduced in the schema source), a caller running under set -eo pipefail
-# would abort before outcome=failed is written, leaving OUTCOME unset. Handle
-# it here so the failure is explicit, not inferred from job.status.
-if ! npm run generate:settings-schema; then
-  echo "❌ Settings schema generator failed to run."
-  fail
-fi
-
-if [[ -n "$(git status --porcelain "${SCHEMA_FILE}")" ]]; then
-  echo "❌ ${SCHEMA_FILE} is out of date. Run: npm run generate:settings-schema"
-  git --no-pager diff -- "${SCHEMA_FILE}" || true
-  git checkout -- "${SCHEMA_FILE}" || true
-  fail
+# Autofix rejects changes to the committed schema and to a best-effort
+# snapshot of the sources that feed it (the protected-path allowlist in
+# validate-autofix-verification-outputs.mjs) before this gate runs; the
+# snapshot is hand-curated, and the normal schema gate still runs on the
+# published PR. Executing the candidate's schema module graph here would let
+# module initialization short-circuit the trusted comparison.
+# TODO: run-autofix-review-verification.sh still executes the generator
+# on candidate code without this wrapper or the protected-path allowlist; the
+# review-address chain was scoped out of the targeted E2E redesign and needs
+# the same isolation before its schema gate is trusted the same way.
+if [[ -n "${AUTOFIX_VERIFY_COMMAND:-}" ]]; then
+  echo 'Skipping settings-schema freshness check: Autofix rejects changes to the committed schema and its protected sources before this gate runs.'
+  exit 0
+else
+  # Guard the generator itself: if it CRASHES (e.g. a type error introduced in
+  # the schema source), report an explicit gate failure.
+  if ! npm run generate:settings-schema; then
+    echo "❌ Settings schema generator failed to run."
+    fail
+  fi
+  if ! schema_status="$(git status --porcelain "${SCHEMA_FILE}")"; then
+    echo "❌ Failed to inspect ${SCHEMA_FILE} after generation."
+    fail
+  fi
+  if [[ -n "${schema_status}" ]]; then
+    echo "❌ ${SCHEMA_FILE} is out of date. Run: npm run generate:settings-schema"
+    git --no-pager diff -- "${SCHEMA_FILE}" || true
+    git checkout -- "${SCHEMA_FILE}" || true
+    fail
+  fi
 fi