From dd5844f48854ed5c7a28c6545b20d979e2dcfe03 Mon Sep 17 00:00:00 2001
From: Tiago Peixoto <tiagop@hey.com>
Date: Sat, 5 Sep 2026 04:17:06 -0300
Subject: [PATCH 01/11] fix(tests): isolate fixture Git configuration from host
 preferences

Ignore global and system Git configuration in the shared test library,
which all four fixture helper entry points source. Keep local config,
command-line overrides and explicitly supplied test config usable without
changing the caller's environment or real project signing preferences.

Exercise global and system signing inputs through all four helpers, real
fixture and child commits, explicit signing overrides, unchanged input
files, and signing refusal outside fixture subprocesses.

Verification evidence for issue #3770:
On pristine upstream f09de8a3, all 12 reported suites failed and each logged
"No secret key" using a private GIT_CONFIG_GLOBAL containing
commit.gpgsign=true and gpg.format=openpgp, GIT_CONFIG_NOSYSTEM=1, and an
empty private GNUPGHOME (GIT_CONFIG_COUNT and GIT_CONFIG_PARAMETERS unset).
With this change, all 12 pass in the identical environment through
bin/fm-test-run.sh --per-script-timeout-secs 900:
fm-backlog-atomicity, fm-bootstrap-network-parallel, fm-bootstrap,
fm-crew-state, fm-fleet-sync, fm-gate-refuse, fm-grok-harness,
fm-session-start, fm-sessionstart-nudge, fm-tangle-guard, fm-test-run,
and fm-update (all tests/<name>.test.sh).
The new fm-test-fixtures regression failed before the library change and
passes after it. Canonical bin/fm-lint.sh passes.

Additional verification exposed fm-teardown's
herdr-preflight-missing-adapter assertion on both this branch and an
unchanged f09de8a3 archive with signing neutralized. That pre-existing
failure needs separate disposition; it is not repaired or skipped here.
The separately owned Muse and composer fixture defects remain untouched.

Fixes #3770
---
 tests/fm-test-fixtures.test.sh | 52 +++++++++++++++++++++++++++++++++-
 tests/lib.sh                   |  6 ++++
 2 files changed, 57 insertions(+), 1 deletion(-)

diff --git a/tests/fm-test-fixtures.test.sh b/tests/fm-test-fixtures.test.sh
index 1ee5baa3a77..937881a11a3 100755
--- a/tests/fm-test-fixtures.test.sh
+++ b/tests/fm-test-fixtures.test.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Behavior tests for tests/fixtures.sh fake-toolchain and spawn-world builders.
+# Behavior tests for shared Git fixtures, fake-toolchain and spawn-world builders.
 #
 # These cases drive the builders as a test would: they write stubs into a
 # fakebin and exec those stubs. Assertions are on the binaries' observable
@@ -13,6 +13,55 @@ set -u
 
 TMP_ROOT=$(fm_test_tmproot fm-test-fixtures)
 
+test_git_config_isolation() (
+  local dir="$TMP_ROOT/git-config" scope helper
+  mkdir -p "$dir"
+  export GIT_CONFIG_GLOBAL="$dir/global" GIT_CONFIG_SYSTEM="$dir/system"
+  export GIT_CONFIG_NOSYSTEM=0
+  unset GIT_CONFIG_COUNT GIT_CONFIG_PARAMETERS
+  # A failing signer exposes inherited config without requiring GPG or keys.
+  for scope in global system; do
+    : > "$dir/global"
+    : > "$dir/system"
+    git config --file "$dir/$scope" commit.gpgsign true
+    git config --file "$dir/$scope" gpg.format openpgp
+    git config --file "$dir/$scope" gpg.program /usr/bin/false
+    cp "$dir/$scope" "$dir/expected"
+    for helper in lib fixtures secondmate-helpers wake-helpers; do
+      bash -eus -- "$ROOT/tests/$helper.sh" "$dir/$scope-$helper" "$dir/$scope" <<'SH' || exit 1
+. "$1"
+fm_git_init_commit "$2"
+[ "$(git -C "$2" log -1 --format=%s)" = initial ] || fail "fixture has no initial commit"
+fm_git_identity
+# Child Git processes and direct commits inherit the same isolation.
+bash -eu -c 'git -C "$1" commit -q --allow-empty -m child' _ "$2"
+# Repository-local config and explicit command inputs remain authoritative.
+git -C "$2" config commit.gpgsign true
+git -C "$2" config gpg.program /usr/bin/false
+if git -C "$2" commit -q --allow-empty -m signed > "$2/signing.log" 2>&1; then
+  fail "repository-local signing config was ignored"
+fi
+assert_grep 'gpg failed to sign' "$2/signing.log" "local signing was not attempted"
+git -C "$2" -c commit.gpgsign=false commit -q --allow-empty -m explicit
+GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=commit.gpgsign GIT_CONFIG_VALUE_0=false \
+  git -C "$2" commit -q --allow-empty -m environment
+# A config test can deliberately supply its own global file after sourcing.
+[ "$(GIT_CONFIG_GLOBAL="$3" git config --get commit.gpgsign)" = true ] || fail "explicit global config was ignored"
+SH
+    done
+    # Sourcing in test subprocesses cannot change the caller or its config files.
+    [ "$(git config --get commit.gpgsign)" = true ] || fail "caller lost signing preference"
+    cmp -s "$dir/$scope" "$dir/expected" || fail "host config file was changed"
+    git init -q "$dir/$scope-outside"
+    if git -C "$dir/$scope-outside" -c user.name=test -c user.email=test@example.invalid \
+      commit -q --allow-empty -m outside > "$dir/outside.log" 2>&1; then
+      fail "commit outside fixtures bypassed signing"
+    fi
+    assert_grep 'gpg failed to sign' "$dir/outside.log" "outside commit did not attempt signing"
+  done
+  pass "shared helpers isolate host Git config and preserve explicit config and outside commits"
+)
+
 test_no_mistakes_version_constant() {
   local fakebin out
   fakebin=$(fm_fakebin "$TMP_ROOT/nm")
@@ -124,6 +173,7 @@ test_spawn_home_layout() {
   pass "spawn-home layout writes harness pin, beat, and brief"
 }
 
+test_git_config_isolation || fail "Git fixture config isolation"
 test_no_mistakes_version_constant
 test_no_mistakes_init_doctor_markers
 test_fake_gh_and_gh_axi
diff --git a/tests/lib.sh b/tests/lib.sh
index e42945de19f..8cb3765a75c 100644
--- a/tests/lib.sh
+++ b/tests/lib.sh
@@ -33,6 +33,12 @@ FM_TEST_LIB_SOURCED=1
 # suite's fixtures were written against.
 umask 022
 
+# Fixture Git processes must not inherit host signing, hooks, or other global
+# and system preferences. This affects only the sourcing test and its children;
+# config tests can still set local config, use -c, or supply their own env after
+# sourcing. Never write the developer's config or disable real project signing.
+export GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1
+
 # Exempt firstmate's own test suite from the gate-lifecycle refusal
 # (bin/fm-gate-refuse-lib.sh). The no-mistakes gate runs this suite FROM a gate
 # worktree - the exact environment that guard refuses - so without this every

From c1097ad357c645e7a2a03fee3a3bc316b6c9d475 Mon Sep 17 00:00:00 2001
From: Tiago Peixoto <tiagop@hey.com>
Date: Sat, 5 Sep 2026 04:45:17 -0300
Subject: [PATCH 02/11] no-mistakes(review): Complete fixture Git isolation and
 scope config assertions

---
 bin/fm-test-run.sh             |  1 +
 tests/fm-test-fixtures.test.sh | 46 ++++++++++++++++++++++++++++++----
 tests/herdr-test-safety.sh     |  2 ++
 3 files changed, 44 insertions(+), 5 deletions(-)

diff --git a/bin/fm-test-run.sh b/bin/fm-test-run.sh
index bfad5cbb5d2..3dcf547b1cd 100755
--- a/bin/fm-test-run.sh
+++ b/bin/fm-test-run.sh
@@ -2173,6 +2173,7 @@ record_script_result() {
 # because an unbounded suite is what silently outruns its caller's budget.
 run_script_bounded() {  # <script> <out> <stream> <id>
   local script=$1 out=$2 stream=$3 id=$4
+  local -x GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1
   local rc
   : "$id"
   set +e
diff --git a/tests/fm-test-fixtures.test.sh b/tests/fm-test-fixtures.test.sh
index 937881a11a3..aeab3a6518c 100755
--- a/tests/fm-test-fixtures.test.sh
+++ b/tests/fm-test-fixtures.test.sh
@@ -14,8 +14,26 @@ set -u
 TMP_ROOT=$(fm_test_tmproot fm-test-fixtures)
 
 test_git_config_isolation() (
-  local dir="$TMP_ROOT/git-config" scope helper
-  mkdir -p "$dir"
+  local dir="$TMP_ROOT/git-config" scope helper jobs timeout
+  mkdir -p "$dir/runner/bin" "$dir/runner/tests"
+  git init -q "$dir/caller"
+  git -C "$dir/caller" config commit.gpgsign false
+  cd "$dir/caller" || exit 1
+  cp "$ROOT/bin/fm-test-run.sh" "$ROOT/bin/fm-timeout-lib.sh" "$dir/runner/bin/"
+  cat > "$dir/runner/tests/fm-test-run.test.sh" <<'SH'
+#!/usr/bin/env bash
+set -eu
+repo=$(mktemp -d "${TMPDIR:-/tmp}/fm-git-runner.XXXXXX")
+trap 'rm -rf "$repo"' EXIT
+git init -q "$repo"
+git -C "$repo" config user.name 'Runner Fixture'
+git -C "$repo" config user.email runner@example.invalid
+git -C "$repo" commit -q --allow-empty -m initial
+[ "$(git -C "$repo" log -1 --format='%s:%an:%ae')" = 'initial:Runner Fixture:runner@example.invalid' ]
+[ "$(git -C "$repo" config --get fixture.input)" = preserved ]
+[ "$(GIT_CONFIG_GLOBAL="$FM_TEST_GIT_CONFIG" git config --global --get commit.gpgsign)" = true ]
+SH
+  chmod +x "$dir/runner/tests/fm-test-run.test.sh"
   export GIT_CONFIG_GLOBAL="$dir/global" GIT_CONFIG_SYSTEM="$dir/system"
   export GIT_CONFIG_NOSYSTEM=0
   unset GIT_CONFIG_COUNT GIT_CONFIG_PARAMETERS
@@ -46,11 +64,29 @@ git -C "$2" -c commit.gpgsign=false commit -q --allow-empty -m explicit
 GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=commit.gpgsign GIT_CONFIG_VALUE_0=false \
   git -C "$2" commit -q --allow-empty -m environment
 # A config test can deliberately supply its own global file after sourcing.
-[ "$(GIT_CONFIG_GLOBAL="$3" git config --get commit.gpgsign)" = true ] || fail "explicit global config was ignored"
+[ "$(GIT_CONFIG_GLOBAL="$3" git config --global --get commit.gpgsign)" = true ] || fail "explicit global config was ignored"
+SH
+    done
+    bash -eus -- "$ROOT/tests/herdr-test-safety.sh" "$dir/$scope-herdr" <<'SH' || exit 1
+. "$1"
+git init -q "$2"
+git -C "$2" -c user.name=test -c user.email=test@example.invalid \
+  commit -q --allow-empty -m initial
+[ "$(git -C "$2" log -1 --format=%s)" = initial ]
 SH
+    for jobs in 1 2; do
+      for timeout in 0 30; do
+        GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=fixture.input GIT_CONFIG_VALUE_0=preserved \
+          FM_TEST_GIT_CONFIG="$dir/$scope" \
+          "$dir/runner/bin/fm-test-run.sh" --jobs "$jobs" --per-script-timeout-secs "$timeout" \
+          tests/fm-test-run.test.sh > "$dir/runner.log" 2>&1 \
+          || fail "runner inherited $scope config (jobs=$jobs, timeout=$timeout): $(cat "$dir/runner.log")"
+        assert_grep 'FM_TEST_SUMMARY total=1 failed=0 skipped_gate=0' "$dir/runner.log" \
+          "runner did not execute the Git fixture"
+      done
     done
     # Sourcing in test subprocesses cannot change the caller or its config files.
-    [ "$(git config --get commit.gpgsign)" = true ] || fail "caller lost signing preference"
+    [ "$(git config --"$scope" --get commit.gpgsign)" = true ] || fail "caller lost signing preference"
     cmp -s "$dir/$scope" "$dir/expected" || fail "host config file was changed"
     git init -q "$dir/$scope-outside"
     if git -C "$dir/$scope-outside" -c user.name=test -c user.email=test@example.invalid \
@@ -59,7 +95,7 @@ SH
     fi
     assert_grep 'gpg failed to sign' "$dir/outside.log" "outside commit did not attempt signing"
   done
-  pass "shared helpers isolate host Git config and preserve explicit config and outside commits"
+  pass "runner and shared helpers isolate host Git config and preserve explicit config and outside commits"
 )
 
 test_no_mistakes_version_constant() {
diff --git a/tests/herdr-test-safety.sh b/tests/herdr-test-safety.sh
index 59a2bb46cc2..fae25511f67 100644
--- a/tests/herdr-test-safety.sh
+++ b/tests/herdr-test-safety.sh
@@ -4,6 +4,8 @@
 # fleet-state tripwire contract is bin/fm-herdr-lab.sh.
 set -u
 
+export GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1
+
 # Herdr backend tests drive the real fm-spawn/fm-teardown but do not source
 # tests/lib.sh, so exempt them from the gate-lifecycle refusal here too (see
 # tests/lib.sh and bin/fm-gate-refuse-lib.sh for why firstmate's own suite,

From bb11762e39b3894412a5841653cdace9c53e8d01 Mon Sep 17 00:00:00 2001
From: Tiago Peixoto <tiagop@hey.com>
Date: Sat, 5 Sep 2026 05:07:53 -0300
Subject: [PATCH 03/11] no-mistakes(review): Share Git isolation across
 standalone fixture entry points

---
 bin/fm-test-run.sh                            |  4 ++-
 tests/fm-claude-stop-autoarm-live-e2e.test.sh |  2 ++
 .../fm-cmux-claude-composer-live-e2e.test.sh  |  2 ++
 tests/fm-codex-continuity-live-e2e.test.sh    |  2 ++
 tests/fm-gitignore-config.test.sh             |  2 ++
 tests/fm-grok-continuity-live-e2e.test.sh     |  2 ++
 tests/fm-muse-signals-live-e2e.test.sh        |  2 ++
 tests/fm-opencode-primary-live-e2e.test.sh    |  2 ++
 tests/fm-pi-primary-live-e2e.test.sh          |  2 ++
 tests/fm-sessionstart-hook-live-e2e.test.sh   |  2 ++
 ...start-instruction-refresh-live-e2e.test.sh |  2 ++
 tests/fm-test-fixtures.test.sh                | 30 ++++++++++++++++++-
 tests/fm-test-run.test.sh                     |  7 +++++
 tests/git-config-helpers.sh                   |  3 ++
 tests/herdr-test-safety.sh                    |  3 +-
 tests/lib.sh                                  |  3 +-
 16 files changed, 66 insertions(+), 4 deletions(-)
 create mode 100644 tests/git-config-helpers.sh

diff --git a/bin/fm-test-run.sh b/bin/fm-test-run.sh
index 3dcf547b1cd..bf4d73d810b 100755
--- a/bin/fm-test-run.sh
+++ b/bin/fm-test-run.sh
@@ -2173,7 +2173,9 @@ record_script_result() {
 # because an unbounded suite is what silently outruns its caller's budget.
 run_script_bounded() {  # <script> <out> <stream> <id>
   local script=$1 out=$2 stream=$3 id=$4
-  local -x GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1
+  local GIT_CONFIG_GLOBAL GIT_CONFIG_NOSYSTEM
+  # shellcheck source=tests/git-config-helpers.sh
+  . "$ROOT/tests/git-config-helpers.sh" || return
   local rc
   : "$id"
   set +e
diff --git a/tests/fm-claude-stop-autoarm-live-e2e.test.sh b/tests/fm-claude-stop-autoarm-live-e2e.test.sh
index ae14d9f3af5..bd613a006ac 100755
--- a/tests/fm-claude-stop-autoarm-live-e2e.test.sh
+++ b/tests/fm-claude-stop-autoarm-live-e2e.test.sh
@@ -18,6 +18,8 @@ set -u
 fm_live_gate opt-in FM_CLAUDE_LIVE_E2E claude
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# shellcheck source=tests/git-config-helpers.sh
+. "$ROOT/tests/git-config-helpers.sh"
 
 fail() {
   printf 'not ok - %s\n' "$1" >&2
diff --git a/tests/fm-cmux-claude-composer-live-e2e.test.sh b/tests/fm-cmux-claude-composer-live-e2e.test.sh
index 439d9335e97..10c5c5c690e 100755
--- a/tests/fm-cmux-claude-composer-live-e2e.test.sh
+++ b/tests/fm-cmux-claude-composer-live-e2e.test.sh
@@ -8,6 +8,8 @@ set -u
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# shellcheck source=tests/git-config-helpers.sh
+. "$ROOT/tests/git-config-helpers.sh"
 TASK="fm-test-cmux-claude-composer-$$"
 LAB=
 SPAWNED=0
diff --git a/tests/fm-codex-continuity-live-e2e.test.sh b/tests/fm-codex-continuity-live-e2e.test.sh
index ccc7133c832..a882422ed84 100755
--- a/tests/fm-codex-continuity-live-e2e.test.sh
+++ b/tests/fm-codex-continuity-live-e2e.test.sh
@@ -9,6 +9,8 @@ set -u
 fm_live_gate opt-in FM_CODEX_LIVE_E2E codex
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# shellcheck source=tests/git-config-helpers.sh
+. "$ROOT/tests/git-config-helpers.sh"
 
 fail() {
   printf 'not ok - %s\n' "$1" >&2
diff --git a/tests/fm-gitignore-config.test.sh b/tests/fm-gitignore-config.test.sh
index a221b4176d2..9c6c4c7ad6f 100755
--- a/tests/fm-gitignore-config.test.sh
+++ b/tests/fm-gitignore-config.test.sh
@@ -8,6 +8,8 @@
 set -u
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# shellcheck source=tests/git-config-helpers.sh
+. "$ROOT/tests/git-config-helpers.sh"
 
 fail() {
   printf 'not ok - %s\n' "$1" >&2
diff --git a/tests/fm-grok-continuity-live-e2e.test.sh b/tests/fm-grok-continuity-live-e2e.test.sh
index a4d8052a4ca..ea20f10a3fc 100755
--- a/tests/fm-grok-continuity-live-e2e.test.sh
+++ b/tests/fm-grok-continuity-live-e2e.test.sh
@@ -9,6 +9,8 @@ set -u
 fm_live_gate opt-in FM_GROK_LIVE_E2E grok tmux
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# shellcheck source=tests/git-config-helpers.sh
+. "$ROOT/tests/git-config-helpers.sh"
 
 fail() {
   printf 'not ok - %s\n' "$1" >&2
diff --git a/tests/fm-muse-signals-live-e2e.test.sh b/tests/fm-muse-signals-live-e2e.test.sh
index a406b9af601..3e4ca82d3aa 100755
--- a/tests/fm-muse-signals-live-e2e.test.sh
+++ b/tests/fm-muse-signals-live-e2e.test.sh
@@ -5,6 +5,8 @@ set -u
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# shellcheck source=tests/git-config-helpers.sh
+. "$ROOT/tests/git-config-helpers.sh"
 MUSE_BIN=$(command -v muse 2>/dev/null || true)
 REAL_TMUX=$(command -v tmux 2>/dev/null || true)
 LAB=
diff --git a/tests/fm-opencode-primary-live-e2e.test.sh b/tests/fm-opencode-primary-live-e2e.test.sh
index 6ce345334e6..ed482666187 100755
--- a/tests/fm-opencode-primary-live-e2e.test.sh
+++ b/tests/fm-opencode-primary-live-e2e.test.sh
@@ -9,6 +9,8 @@ set -u
 fm_live_gate opt-in FM_OPENCODE_LIVE_E2E opencode tmux sqlite3
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# shellcheck source=tests/git-config-helpers.sh
+. "$ROOT/tests/git-config-helpers.sh"
 unset NO_MISTAKES_GATE
 
 fail() {
diff --git a/tests/fm-pi-primary-live-e2e.test.sh b/tests/fm-pi-primary-live-e2e.test.sh
index 004af0ff5c3..be530e64ce4 100755
--- a/tests/fm-pi-primary-live-e2e.test.sh
+++ b/tests/fm-pi-primary-live-e2e.test.sh
@@ -10,6 +10,8 @@ set -u
 fm_live_gate opt-in FM_PI_LIVE_E2E pi tmux
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# shellcheck source=tests/git-config-helpers.sh
+. "$ROOT/tests/git-config-helpers.sh"
 unset NO_MISTAKES_GATE
 
 fail() {
diff --git a/tests/fm-sessionstart-hook-live-e2e.test.sh b/tests/fm-sessionstart-hook-live-e2e.test.sh
index acc295666d6..4c62cdfb22a 100755
--- a/tests/fm-sessionstart-hook-live-e2e.test.sh
+++ b/tests/fm-sessionstart-hook-live-e2e.test.sh
@@ -46,6 +46,8 @@ set -u
 fm_live_gate opt-in FM_SESSIONSTART_HOOK_LIVE_E2E,FM_PI_SESSIONSTART_RACE_LIVE_E2E tmux
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# shellcheck source=tests/git-config-helpers.sh
+. "$ROOT/tests/git-config-helpers.sh"
 unset NO_MISTAKES_GATE
 
 fail() {
diff --git a/tests/fm-sessionstart-instruction-refresh-live-e2e.test.sh b/tests/fm-sessionstart-instruction-refresh-live-e2e.test.sh
index 42819acc1bb..c0f31e88c91 100755
--- a/tests/fm-sessionstart-instruction-refresh-live-e2e.test.sh
+++ b/tests/fm-sessionstart-instruction-refresh-live-e2e.test.sh
@@ -30,6 +30,8 @@ set -u
 fm_live_gate opt-in FM_SESSIONSTART_INSTRUCTION_REFRESH_LIVE_E2E pi tmux git
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# shellcheck source=tests/git-config-helpers.sh
+. "$ROOT/tests/git-config-helpers.sh"
 TMUX_SOCKET="fm-sessionstart-instruction-refresh-$$"
 TMUX_SESSION="instruction-refresh"
 LAB=${TMPDIR:-/tmp}
diff --git a/tests/fm-test-fixtures.test.sh b/tests/fm-test-fixtures.test.sh
index aeab3a6518c..058a33e2d13 100755
--- a/tests/fm-test-fixtures.test.sh
+++ b/tests/fm-test-fixtures.test.sh
@@ -14,12 +14,27 @@ set -u
 TMP_ROOT=$(fm_test_tmproot fm-test-fixtures)
 
 test_git_config_isolation() (
-  local dir="$TMP_ROOT/git-config" scope helper jobs timeout
+  local dir="$TMP_ROOT/git-config" scope helper jobs timeout fakebin rc
   mkdir -p "$dir/runner/bin" "$dir/runner/tests"
   git init -q "$dir/caller"
   git -C "$dir/caller" config commit.gpgsign false
   cd "$dir/caller" || exit 1
   cp "$ROOT/bin/fm-test-run.sh" "$ROOT/bin/fm-timeout-lib.sh" "$dir/runner/bin/"
+  cp "$ROOT/tests/git-config-helpers.sh" "$dir/runner/tests/"
+  fakebin=$(fm_fakebin "$dir/standalone")
+  fm_fake_exit0 "$fakebin" pi
+  cat > "$fakebin/tmux" <<'SH'
+#!/usr/bin/env bash
+set -eu
+while [ "$#" -gt 0 ]; do
+  if [ "$1" = -c ]; then
+    git -C "$2" log -1 --format=%s > "${FM_TEST_STANDALONE_COMMIT:?}"
+    exit 1
+  fi
+  shift
+done
+SH
+  chmod +x "$fakebin/tmux"
   cat > "$dir/runner/tests/fm-test-run.test.sh" <<'SH'
 #!/usr/bin/env bash
 set -eu
@@ -85,6 +100,19 @@ SH
           "runner did not execute the Git fixture"
       done
     done
+    rc=0
+    FM_SESSIONSTART_INSTRUCTION_REFRESH_LIVE_E2E=1 FM_SESSIONSTART_INSTRUCTION_REFRESH_REF=HEAD \
+      FM_SESSIONSTART_INSTRUCTION_REFRESH_EXPECT=updated \
+      FM_TEST_STANDALONE_COMMIT="$dir/$scope-standalone-commit" PATH="$fakebin:$PATH" \
+      bash "$ROOT/tests/fm-sessionstart-instruction-refresh-live-e2e.test.sh" \
+      > "$dir/standalone.log" 2>&1 || rc=$?
+    [ "$rc" = 1 ] || fail "standalone fixture did not stop at the tmux launch"
+    assert_grep 'could not start isolated Pi session' "$dir/standalone.log" \
+      "standalone fixture failed before the tmux launch: $(cat "$dir/standalone.log")"
+    [ "$(cat "$dir/$scope-standalone-commit")" = 'test: initial instruction contract' ] \
+      || fail "standalone fixture did not create its initial commit"
+    bash "$ROOT/tests/fm-gitignore-config.test.sh" > "$dir/gitignore.log" 2>&1 \
+      || fail "standalone gitignore fixture inherited $scope config: $(cat "$dir/gitignore.log")"
     # Sourcing in test subprocesses cannot change the caller or its config files.
     [ "$(git config --"$scope" --get commit.gpgsign)" = true ] || fail "caller lost signing preference"
     cmp -s "$dir/$scope" "$dir/expected" || fail "host config file was changed"
diff --git a/tests/fm-test-run.test.sh b/tests/fm-test-run.test.sh
index b90dfa2129d..0a57fd4da73 100755
--- a/tests/fm-test-run.test.sh
+++ b/tests/fm-test-run.test.sh
@@ -92,6 +92,7 @@ init_changed_fixture_repo() {
   local repo=$1 script
   mkdir -p "$repo/bin" "$repo/tests"
   cp "$RUNNER" "$repo/bin/fm-test-run.sh"
+  cp "$ROOT/tests/git-config-helpers.sh" "$repo/tests/"
   chmod +x "$repo/bin/fm-test-run.sh"
   for script in \
     fm-brief.test.sh \
@@ -484,6 +485,7 @@ PY
   timeout_script=tests/fm-calm-pi-extension.test.sh
   mkdir -p "$timeout_repo/bin" "$timeout_repo/tests"
   cp "$RUNNER" "$timeout_repo/bin/fm-test-run.sh"
+  cp "$ROOT/tests/git-config-helpers.sh" "$timeout_repo/tests/"
   cat >"$timeout_repo/bin/fm-timeout-lib.sh" <<'SH'
 fm_run_timed() {
   [ "$1" -eq 900 ] || return 99
@@ -635,6 +637,7 @@ test_family_proofs_run_in_separate_concurrent_phases() {
   repo="$tmp/repo"
   mkdir -p "$repo/bin" "$repo/tests"
   cp "$RUNNER" "$repo/bin/fm-test-run.sh"
+  cp "$ROOT/tests/git-config-helpers.sh" "$repo/tests/"
   cp "$ROOT/bin/fm-timeout-lib.sh" "$repo/bin/fm-timeout-lib.sh"
   chmod +x "$repo/bin/fm-test-run.sh"
   for script in \
@@ -1180,6 +1183,7 @@ test_unmapped_new_test_never_inherits_family_concurrency() {
   repo="$tmp/repo"
   mkdir -p "$repo/bin" "$repo/tests"
   cp "$RUNNER" "$repo/bin/fm-test-run.sh"
+  cp "$ROOT/tests/git-config-helpers.sh" "$repo/tests/"
   chmod +x "$repo/bin/fm-test-run.sh"
   # Two members of the proven residual family, plus a test basename the family
   # map has never seen - the shape of any test added tomorrow.
@@ -1257,6 +1261,7 @@ test_per_script_timeout_bounds_a_hang() {
   hang=tests/fm-hang-fixture.test.sh
   mkdir -p "$repo/bin" "$repo/tests"
   cp "$RUNNER" "$runner"
+  cp "$ROOT/tests/git-config-helpers.sh" "$repo/tests/"
   cp "$ROOT/bin/fm-timeout-lib.sh" "$repo/bin/fm-timeout-lib.sh"
   grandchild_pid="$tmp/grandchild.pid"
   cat >"$repo/$hang" <<'SH'
@@ -1320,6 +1325,7 @@ test_max_wall_ms_is_a_result_not_advice() {
   fast=tests/fm-budget-fixture.test.sh
   mkdir -p "$repo/bin" "$repo/tests"
   cp "$RUNNER" "$runner"
+  cp "$ROOT/tests/git-config-helpers.sh" "$repo/tests/"
   cat >"$repo/$fast" <<'SH'
 #!/usr/bin/env bash
 sleep 1
@@ -1384,6 +1390,7 @@ test_jobs_parallel_scheduler_and_failure_propagation() {
   d=tests/fm-supervision-instructions.test.sh
   mkdir -p "$repo/bin" "$repo/tests" "$evidence" "$fake_bin"
   cp "$RUNNER" "$runner"
+  cp "$ROOT/tests/git-config-helpers.sh" "$repo/tests/"
   cat >"$fake_bin/stat" <<'SH'
 #!/usr/bin/env bash
 if [ "$1" = "-c" ] && [ "$2" = "%a" ]; then
diff --git a/tests/git-config-helpers.sh b/tests/git-config-helpers.sh
new file mode 100644
index 00000000000..65fb6d9f2d9
--- /dev/null
+++ b/tests/git-config-helpers.sh
@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+export GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1
diff --git a/tests/herdr-test-safety.sh b/tests/herdr-test-safety.sh
index fae25511f67..810b4a518fe 100644
--- a/tests/herdr-test-safety.sh
+++ b/tests/herdr-test-safety.sh
@@ -4,7 +4,8 @@
 # fleet-state tripwire contract is bin/fm-herdr-lab.sh.
 set -u
 
-export GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1
+# shellcheck source=tests/git-config-helpers.sh
+. "$(dirname "${BASH_SOURCE[0]}")/git-config-helpers.sh"
 
 # Herdr backend tests drive the real fm-spawn/fm-teardown but do not source
 # tests/lib.sh, so exempt them from the gate-lifecycle refusal here too (see
diff --git a/tests/lib.sh b/tests/lib.sh
index 8cb3765a75c..2ca9bff2de4 100644
--- a/tests/lib.sh
+++ b/tests/lib.sh
@@ -37,7 +37,8 @@ umask 022
 # and system preferences. This affects only the sourcing test and its children;
 # config tests can still set local config, use -c, or supply their own env after
 # sourcing. Never write the developer's config or disable real project signing.
-export GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1
+# shellcheck source=tests/git-config-helpers.sh
+. "$(dirname "${BASH_SOURCE[0]}")/git-config-helpers.sh"
 
 # Exempt firstmate's own test suite from the gate-lifecycle refusal
 # (bin/fm-gate-refuse-lib.sh). The no-mistakes gate runs this suite FROM a gate

From 40ec2b563cecbc69fbe3c10e8ed8f01f0a02ae59 Mon Sep 17 00:00:00 2001
From: Tiago Peixoto <tiagop@hey.com>
Date: Sat, 5 Sep 2026 06:45:07 -0300
Subject: [PATCH 04/11] no-mistakes(review): Map git-config helper changes to
 lib.sh dependents

---
 CONTRIBUTING.md           |  2 +-
 bin/fm-test-run.sh        | 12 +++++++++---
 tests/fm-test-run.test.sh |  8 ++++++++
 3 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 02641c5195c..ded5865e412 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -113,7 +113,7 @@ Those sleeps look like recoverable overhead - `fm-watch-triage.test.sh` alone is
 Sampling less often does not remove that wait, it only delays detection: raising the interval to 0.5s and charging each sample proportionally measured `fm-watch-triage.test.sh` at 435s and 440s against 390s and 393s for the unchanged script, back to back on 2026-09-03, because each of its ~40 poll-cycle waits and ~73 process-exit waits paid up to half a second more.
 Some of those loops are also catching a transient rather than waiting for a settled condition, so a coarser sample can step over the state they assert on.
 Discover tests by listing `tests/*.test.sh`: each is a self-contained bash script named `<subject>.test.sh`, and its header comment describes what it covers, so pass one to `bin/fm-test-run.sh` to focus on a subject with canonical timing output.
-Shared test helpers live in `tests/lib.sh` (reporters, temp roots, git fixtures), `tests/fixtures.sh` (fake toolchain and spawn-world builders), `tests/wake-helpers.sh`, and `tests/secondmate-helpers.sh`.
+Shared test helpers live in `tests/lib.sh` (reporters, temp roots, git fixtures), `tests/fixtures.sh` (fake toolchain and spawn-world builders), `tests/wake-helpers.sh`, `tests/secondmate-helpers.sh`, and `tests/git-config-helpers.sh` (fixture Git isolation from the host's global and system configuration, already sourced by `tests/lib.sh` and `tests/herdr-test-safety.sh`; a suite that sources neither must source it itself before its first Git operation so a direct invocation stays isolated).
 Source those instead of copying a fake toolchain into a new suite.
 A fixture may shorten a production timeout to keep a failure path prompt, but never below what the real work inside that window costs on a loaded machine: a fork, an exec, a lock acquisition, a beacon publication, or a first-poll check.
 Where a case's assertion is not about the timeout itself, give that window headroom over the measured loaded cost, and bound the test's own waiting with iteration-counted poll loops, which stretch under load where a wall-clock budget does not.
diff --git a/bin/fm-test-run.sh b/bin/fm-test-run.sh
index bf4d73d810b..42b34dbee31 100755
--- a/bin/fm-test-run.sh
+++ b/bin/fm-test-run.sh
@@ -1133,12 +1133,14 @@ select_family() {
   [ "$found" -eq 1 ] || die "no tests mapped to family '$want'"
 }
 
-families_for_test_reference() {
-  local needle=$1 s
+families_for_test_reference() {  # <needle>...
+  local s needle
   local found=0
+  local -a needles=()
+  for needle in "$@"; do needles+=(-e "$needle"); done
   while IFS= read -r s; do
     [ -n "$s" ] || continue
-    if grep -Fq "$needle" "$s"; then
+    if grep -Fq "${needles[@]}" "$s"; then
       family_for_basename "$(basename "$s")"
       found=1
     fi
@@ -1426,6 +1428,10 @@ families_for_changed_path() {
     docs/configuration.md|docs/supervision-protocols/*)
       printf '%s\n' pure-contract-unit
       ;;
+    tests/git-config-helpers.sh)
+      families_for_test_reference git-config-helpers.sh lib.sh herdr-test-safety.sh \
+        || printf '%s\n' "__unmapped__:$path"
+      ;;
     tests/lib.sh|tests/*-helpers.sh|tests/fixtures.sh)
       families_for_test_reference "$(basename "$path")" \
         || printf '%s\n' "__unmapped__:$path"
diff --git a/tests/fm-test-run.test.sh b/tests/fm-test-run.test.sh
index 0a57fd4da73..f3422188000 100755
--- a/tests/fm-test-run.test.sh
+++ b/tests/fm-test-run.test.sh
@@ -300,6 +300,14 @@ test_changed_dependency_selection_and_unmapped_failure() {
   git -C "$repo" add tests/lib.sh
   git -C "$repo" -c user.name=test -c user.email=test@example.invalid commit -qm helper-change
 
+  printf '\n' >>"$repo/tests/git-config-helpers.sh"
+  listed=$(cd "$repo" && bin/fm-test-run.sh --list --changed --base HEAD)
+  assert_contains "$listed" "tests/fm-pr-merge.test.sh" "git-config helper selects lib.sh dependents"
+  assert_contains "$listed" "tests/fm-secondmate-safety.test.sh" "git-config helper selects secondmate dependents"
+  assert_contains "$listed" "tests/fm-bearings-snapshot.test.sh" "git-config helper selects snapshot dependents"
+  git -C "$repo" add tests/git-config-helpers.sh
+  git -C "$repo" -c user.name=test -c user.email=test@example.invalid commit -qm git-config-helper-change
+
   printf '\n' >>"$repo/tests/fm-backend-herdr-eventwait.test.py"
   listed=$(cd "$repo" && bin/fm-test-run.sh --list --changed --base HEAD)
   assert_contains "$listed" "tests/fm-backend-herdr-smoke.test.sh" "eventwait test selects Herdr coverage"

From 7e62e48ca257c84baa47d76ca7fd8ea6a5f257e9 Mon Sep 17 00:00:00 2001
From: Tiago Peixoto <tiagop@hey.com>
Date: Sat, 5 Sep 2026 21:37:59 -0300
Subject: [PATCH 05/11] no-mistakes(review): Select fixture-isolation
 regression on runner change; halve config matrix

---
 bin/fm-test-run.sh             |   3 +
 tests/fm-test-fixtures.test.sh | 105 ++++++++++++++++++++-------------
 tests/fm-test-run.test.sh      |   7 +++
 3 files changed, 73 insertions(+), 42 deletions(-)

diff --git a/bin/fm-test-run.sh b/bin/fm-test-run.sh
index 42b34dbee31..592a7b8533f 100755
--- a/bin/fm-test-run.sh
+++ b/bin/fm-test-run.sh
@@ -1223,6 +1223,9 @@ families_for_changed_path() {
       # only proven by running them: its own contract test passing says the
       # runner's logic is right, not that the suite it drives still runs.
       printf '%s\n' pure-contract-unit
+      # The runner's own fixture Git isolation is proven by a standalone-family
+      # script, which the family above never reaches.
+      printf '%s\n' "__script__:fm-test-fixtures.test.sh"
       ;;
     bin/backends/herdr*|bin/fm-herdr-lab.sh|tests/herdr-test-safety.sh)
       printf '%s\n' real-herdr-gated
diff --git a/tests/fm-test-fixtures.test.sh b/tests/fm-test-fixtures.test.sh
index 058a33e2d13..32ea4207524 100755
--- a/tests/fm-test-fixtures.test.sh
+++ b/tests/fm-test-fixtures.test.sh
@@ -14,7 +14,7 @@ set -u
 TMP_ROOT=$(fm_test_tmproot fm-test-fixtures)
 
 test_git_config_isolation() (
-  local dir="$TMP_ROOT/git-config" scope helper jobs timeout fakebin rc
+  local dir="$TMP_ROOT/git-config" helper jobs timeout fakebin rc
   mkdir -p "$dir/runner/bin" "$dir/runner/tests"
   git init -q "$dir/caller"
   git -C "$dir/caller" config commit.gpgsign false
@@ -52,16 +52,19 @@ SH
   export GIT_CONFIG_GLOBAL="$dir/global" GIT_CONFIG_SYSTEM="$dir/system"
   export GIT_CONFIG_NOSYSTEM=0
   unset GIT_CONFIG_COUNT GIT_CONFIG_PARAMETERS
+
   # A failing signer exposes inherited config without requiring GPG or keys.
-  for scope in global system; do
+  arm_host_signing() {  # <scope>: only this layer carries the failing signer
     : > "$dir/global"
     : > "$dir/system"
-    git config --file "$dir/$scope" commit.gpgsign true
-    git config --file "$dir/$scope" gpg.format openpgp
-    git config --file "$dir/$scope" gpg.program /usr/bin/false
-    cp "$dir/$scope" "$dir/expected"
-    for helper in lib fixtures secondmate-helpers wake-helpers; do
-      bash -eus -- "$ROOT/tests/$helper.sh" "$dir/$scope-$helper" "$dir/$scope" <<'SH' || exit 1
+    git config --file "$dir/$1" commit.gpgsign true
+    git config --file "$dir/$1" gpg.format openpgp
+    git config --file "$dir/$1" gpg.program /usr/bin/false
+    cp "$dir/$1" "$dir/expected"
+  }
+
+  assert_helper_isolates() {  # <helper> <scope>
+    bash -eus -- "$ROOT/tests/$1.sh" "$dir/$2-$1" "$dir/$2" <<'SH' || exit 1
 . "$1"
 fm_git_init_commit "$2"
 [ "$(git -C "$2" log -1 --format=%s)" = initial ] || fail "fixture has no initial commit"
@@ -81,48 +84,66 @@ GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=commit.gpgsign GIT_CONFIG_VALUE_0=false \
 # A config test can deliberately supply its own global file after sourcing.
 [ "$(GIT_CONFIG_GLOBAL="$3" git config --global --get commit.gpgsign)" = true ] || fail "explicit global config was ignored"
 SH
-    done
-    bash -eus -- "$ROOT/tests/herdr-test-safety.sh" "$dir/$scope-herdr" <<'SH' || exit 1
+  }
+
+  assert_host_config_still_governs() {  # <scope>
+    # Sourcing in test subprocesses cannot change the caller or its config files.
+    [ "$(git config --"$1" --get commit.gpgsign)" = true ] || fail "caller lost signing preference"
+    cmp -s "$dir/$1" "$dir/expected" || fail "host config file was changed"
+    git init -q "$dir/$1-outside"
+    if git -C "$dir/$1-outside" -c user.name=test -c user.email=test@example.invalid \
+      commit -q --allow-empty -m outside > "$dir/outside.log" 2>&1; then
+      fail "commit outside fixtures bypassed signing"
+    fi
+    assert_grep 'gpg failed to sign' "$dir/outside.log" "outside commit did not attempt signing"
+  }
+
+  # Every fixture entry point, once. Each only has to reach the shared helper;
+  # which layers that helper neutralizes is the helper's own property, settled
+  # by the system-layer case below.
+  arm_host_signing global
+  for helper in lib fixtures secondmate-helpers wake-helpers; do
+    assert_helper_isolates "$helper" global
+  done
+  bash -eus -- "$ROOT/tests/herdr-test-safety.sh" "$dir/global-herdr" <<'SH' || exit 1
 . "$1"
 git init -q "$2"
 git -C "$2" -c user.name=test -c user.email=test@example.invalid \
   commit -q --allow-empty -m initial
 [ "$(git -C "$2" log -1 --format=%s)" = initial ]
 SH
-    for jobs in 1 2; do
-      for timeout in 0 30; do
-        GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=fixture.input GIT_CONFIG_VALUE_0=preserved \
-          FM_TEST_GIT_CONFIG="$dir/$scope" \
-          "$dir/runner/bin/fm-test-run.sh" --jobs "$jobs" --per-script-timeout-secs "$timeout" \
-          tests/fm-test-run.test.sh > "$dir/runner.log" 2>&1 \
-          || fail "runner inherited $scope config (jobs=$jobs, timeout=$timeout): $(cat "$dir/runner.log")"
-        assert_grep 'FM_TEST_SUMMARY total=1 failed=0 skipped_gate=0' "$dir/runner.log" \
-          "runner did not execute the Git fixture"
-      done
+  for jobs in 1 2; do
+    for timeout in 0 30; do
+      GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=fixture.input GIT_CONFIG_VALUE_0=preserved \
+        FM_TEST_GIT_CONFIG="$dir/global" \
+        "$dir/runner/bin/fm-test-run.sh" --jobs "$jobs" --per-script-timeout-secs "$timeout" \
+        tests/fm-test-run.test.sh > "$dir/runner.log" 2>&1 \
+        || fail "runner inherited global config (jobs=$jobs, timeout=$timeout): $(cat "$dir/runner.log")"
+      assert_grep 'FM_TEST_SUMMARY total=1 failed=0 skipped_gate=0' "$dir/runner.log" \
+        "runner did not execute the Git fixture"
     done
-    rc=0
-    FM_SESSIONSTART_INSTRUCTION_REFRESH_LIVE_E2E=1 FM_SESSIONSTART_INSTRUCTION_REFRESH_REF=HEAD \
-      FM_SESSIONSTART_INSTRUCTION_REFRESH_EXPECT=updated \
-      FM_TEST_STANDALONE_COMMIT="$dir/$scope-standalone-commit" PATH="$fakebin:$PATH" \
-      bash "$ROOT/tests/fm-sessionstart-instruction-refresh-live-e2e.test.sh" \
-      > "$dir/standalone.log" 2>&1 || rc=$?
-    [ "$rc" = 1 ] || fail "standalone fixture did not stop at the tmux launch"
-    assert_grep 'could not start isolated Pi session' "$dir/standalone.log" \
-      "standalone fixture failed before the tmux launch: $(cat "$dir/standalone.log")"
-    [ "$(cat "$dir/$scope-standalone-commit")" = 'test: initial instruction contract' ] \
-      || fail "standalone fixture did not create its initial commit"
-    bash "$ROOT/tests/fm-gitignore-config.test.sh" > "$dir/gitignore.log" 2>&1 \
-      || fail "standalone gitignore fixture inherited $scope config: $(cat "$dir/gitignore.log")"
-    # Sourcing in test subprocesses cannot change the caller or its config files.
-    [ "$(git config --"$scope" --get commit.gpgsign)" = true ] || fail "caller lost signing preference"
-    cmp -s "$dir/$scope" "$dir/expected" || fail "host config file was changed"
-    git init -q "$dir/$scope-outside"
-    if git -C "$dir/$scope-outside" -c user.name=test -c user.email=test@example.invalid \
-      commit -q --allow-empty -m outside > "$dir/outside.log" 2>&1; then
-      fail "commit outside fixtures bypassed signing"
-    fi
-    assert_grep 'gpg failed to sign' "$dir/outside.log" "outside commit did not attempt signing"
   done
+  rc=0
+  FM_SESSIONSTART_INSTRUCTION_REFRESH_LIVE_E2E=1 FM_SESSIONSTART_INSTRUCTION_REFRESH_REF=HEAD \
+    FM_SESSIONSTART_INSTRUCTION_REFRESH_EXPECT=updated \
+    FM_TEST_STANDALONE_COMMIT="$dir/global-standalone-commit" PATH="$fakebin:$PATH" \
+    bash "$ROOT/tests/fm-sessionstart-instruction-refresh-live-e2e.test.sh" \
+    > "$dir/standalone.log" 2>&1 || rc=$?
+  [ "$rc" = 1 ] || fail "standalone fixture did not stop at the tmux launch"
+  assert_grep 'could not start isolated Pi session' "$dir/standalone.log" \
+    "standalone fixture failed before the tmux launch: $(cat "$dir/standalone.log")"
+  [ "$(cat "$dir/global-standalone-commit")" = 'test: initial instruction contract' ] \
+    || fail "standalone fixture did not create its initial commit"
+  bash "$ROOT/tests/fm-gitignore-config.test.sh" > "$dir/gitignore.log" 2>&1 \
+    || fail "standalone gitignore fixture inherited global config: $(cat "$dir/gitignore.log")"
+  assert_host_config_still_governs global
+
+  # The system layer is the shared helper's other half: one entry point settles
+  # it, and the caller still signing proves the layer was genuinely armed.
+  arm_host_signing system
+  assert_helper_isolates lib system
+  assert_host_config_still_governs system
+
   pass "runner and shared helpers isolate host Git config and preserve explicit config and outside commits"
 )
 
diff --git a/tests/fm-test-run.test.sh b/tests/fm-test-run.test.sh
index f3422188000..9593b5a7e7e 100755
--- a/tests/fm-test-run.test.sh
+++ b/tests/fm-test-run.test.sh
@@ -100,6 +100,7 @@ init_changed_fixture_repo() {
     fm-documentation-audiences.test.sh \
     fm-test-isolation-proof.test.sh \
     fm-test-run.test.sh \
+    fm-test-fixtures.test.sh \
     fm-cd-pretool-check.test.sh \
     fm-daemon.test.sh \
     fm-harness-adapter-instructions-live-e2e.test.sh \
@@ -253,6 +254,12 @@ test_changed_runner_surfaces_select_their_family() {
     *tests/fm-ask-user-authority.test.sh*) ;;
     *) fail "runner change did not select its pure-contract-unit family: $listed" ;;
   esac
+  # The suite that proves the runner's per-suite fixture Git isolation lives in
+  # the standalone family, which pure-contract-unit never reaches.
+  case "$listed" in
+    *tests/fm-test-fixtures.test.sh*) ;;
+    *) fail "runner change did not select its fixture-isolation regression: $listed" ;;
+  esac
   git -C "$repo" add bin/fm-test-run.sh
   git -C "$repo" -c user.name=test -c user.email=test@example.invalid commit -qm runner-change
 

From 8261b15382aa665facb826aa493cd1141fea0392 Mon Sep 17 00:00:00 2001
From: Tiago Peixoto <tiagop@hey.com>
Date: Sat, 5 Sep 2026 21:58:08 -0300
Subject: [PATCH 06/11] no-mistakes(review): Scope fixture-isolation regression
 selection to the runner alone

---
 bin/fm-test-run.sh | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/bin/fm-test-run.sh b/bin/fm-test-run.sh
index 592a7b8533f..850a52093bc 100755
--- a/bin/fm-test-run.sh
+++ b/bin/fm-test-run.sh
@@ -1217,16 +1217,22 @@ families_for_changed_path() {
       # resolution in the caller; emit a marker family of __script__
       printf '%s\n' "__script__:$(basename "$path")"
       ;;
-    bin/fm-test-run.sh|bin/fm-test-isolation-proof.sh)
+    bin/fm-test-run.sh)
       # Deliberately the WHOLE family, not just the two contract tests. This
       # runner executes every pure-contract-unit script, so a change to it is
       # only proven by running them: its own contract test passing says the
       # runner's logic is right, not that the suite it drives still runs.
       printf '%s\n' pure-contract-unit
-      # The runner's own fixture Git isolation is proven by a standalone-family
-      # script, which the family above never reaches.
+      # Only this script wraps each suite in run_script_bounded's fixture Git
+      # isolation, and only a standalone-family script proves it.
       printf '%s\n' "__script__:fm-test-fixtures.test.sh"
       ;;
+    bin/fm-test-isolation-proof.sh)
+      # Same reason as the runner above: the proof drives every
+      # pure-contract-unit script. It runs each candidate directly, never
+      # through run_script_bounded, so it cannot regress fixture Git isolation.
+      printf '%s\n' pure-contract-unit
+      ;;
     bin/backends/herdr*|bin/fm-herdr-lab.sh|tests/herdr-test-safety.sh)
       printf '%s\n' real-herdr-gated
       printf '%s\n' backend-dispatch

From 21fbdcbdcfe78c260a7cd410754fd2e1045923de Mon Sep 17 00:00:00 2001
From: Tiago Peixoto <tiagop@hey.com>
Date: Sun, 6 Sep 2026 00:26:01 -0300
Subject: [PATCH 07/11] no-mistakes(document): Give fixture Git isolation
 helper its owning header

---
 bin/fm-test-run.sh          |  9 +++++++++
 tests/git-config-helpers.sh | 23 +++++++++++++++++++++++
 tests/lib.sh                |  6 ++----
 3 files changed, 34 insertions(+), 4 deletions(-)

diff --git a/bin/fm-test-run.sh b/bin/fm-test-run.sh
index 850a52093bc..5fc1ad66539 100755
--- a/bin/fm-test-run.sh
+++ b/bin/fm-test-run.sh
@@ -111,6 +111,10 @@
 # live-capability (a live-harness guard governed by fm_live_gate, which records
 # unavailable tools and explicit policy skips; see tests/lib.sh), or none.
 #
+# Every selected script runs isolated from the host's global and system Git
+# configuration, including one that sources no test helper of its own;
+# tests/git-config-helpers.sh owns that contract and its limits.
+#
 # Family labels, the changed-file map, and production portable-shard composition
 # live in this script only (one owner). The proven-isolated candidate set remains
 # owned by bin/fm-test-isolation-proof.sh; portable parallel shards are a
@@ -1438,6 +1442,8 @@ families_for_changed_path() {
       printf '%s\n' pure-contract-unit
       ;;
     tests/git-config-helpers.sh)
+      # The reference scan is not transitive, so match the two helpers that
+      # source this one as well: most suites inherit it only through them.
       families_for_test_reference git-config-helpers.sh lib.sh herdr-test-safety.sh \
         || printf '%s\n' "__unmapped__:$path"
       ;;
@@ -2188,6 +2194,9 @@ record_script_result() {
 # because an unbounded suite is what silently outruns its caller's budget.
 run_script_bounded() {  # <script> <out> <stream> <id>
   local script=$1 out=$2 stream=$3 id=$4
+  # Declaring the variables local first keeps the helper's export scoped to this
+  # call and its child script, so the runner's own environment is left as the
+  # caller had it.
   local GIT_CONFIG_GLOBAL GIT_CONFIG_NOSYSTEM
   # shellcheck source=tests/git-config-helpers.sh
   . "$ROOT/tests/git-config-helpers.sh" || return
diff --git a/tests/git-config-helpers.sh b/tests/git-config-helpers.sh
index 65fb6d9f2d9..8fde3e7f85e 100644
--- a/tests/git-config-helpers.sh
+++ b/tests/git-config-helpers.sh
@@ -1,3 +1,26 @@
 #!/usr/bin/env bash
+# tests/git-config-helpers.sh - fixture Git isolation from the host's global and
+# system configuration.
+#
+# Source this before a fixture's first Git operation:
+#   # shellcheck source=tests/git-config-helpers.sh
+#   . "$(dirname "${BASH_SOURCE[0]}")/git-config-helpers.sh"
+#
+# Fixture Git processes must not inherit host signing, hooks, or other global and
+# system preferences: with commit.gpgsign=true set globally and no secret key for
+# the fixture identities, every fixture commit fails before its assertion.
+# Isolation is limited to those two layers on purpose, so repository-local config,
+# inline `git -c`, GIT_CONFIG_COUNT, and a GIT_CONFIG_GLOBAL the caller supplies
+# after sourcing all stay authoritative - the Git-config suites assert on them.
+# The export reaches only the sourcing shell and its children, so the developer's
+# own config files are never written and real project commits made outside the
+# fixtures keep their configuration and signing.
+#
+# tests/lib.sh and tests/herdr-test-safety.sh source this for every suite that
+# uses them, bin/fm-test-run.sh sources it per suite in run_script_bounded, and a
+# suite reaching none of those sources it directly so a hand-run invocation is
+# isolated too. tests/fm-test-fixtures.test.sh is the regression - it drives the
+# shared helpers, the runner, and the standalone entry points that run without a
+# live vendor - and the changed-file map selects it for a change to this file.
 
 export GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1
diff --git a/tests/lib.sh b/tests/lib.sh
index 2ca9bff2de4..c4cd97a5831 100644
--- a/tests/lib.sh
+++ b/tests/lib.sh
@@ -33,10 +33,8 @@ FM_TEST_LIB_SOURCED=1
 # suite's fixtures were written against.
 umask 022
 
-# Fixture Git processes must not inherit host signing, hooks, or other global
-# and system preferences. This affects only the sourcing test and its children;
-# config tests can still set local config, use -c, or supply their own env after
-# sourcing. Never write the developer's config or disable real project signing.
+# Fixture Git isolation for every suite that reaches this library; the helper's
+# header owns the invariant and the layers it deliberately leaves in force.
 # shellcheck source=tests/git-config-helpers.sh
 . "$(dirname "${BASH_SOURCE[0]}")/git-config-helpers.sh"
 

From 86e6d749e9c8b610b20cad8cbfc4542bc146c17d Mon Sep 17 00:00:00 2001
From: Tiago Peixoto <tiagop@hey.com>
Date: Sun, 6 Sep 2026 20:47:28 -0300
Subject: [PATCH 08/11] no-mistakes(document): Record fixture Git-isolation
 coverage in fixtures suite header

---
 tests/fm-test-fixtures.test.sh | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tests/fm-test-fixtures.test.sh b/tests/fm-test-fixtures.test.sh
index 32ea4207524..33d64a39e64 100755
--- a/tests/fm-test-fixtures.test.sh
+++ b/tests/fm-test-fixtures.test.sh
@@ -6,6 +6,12 @@
 # output, exit status, and files they create - never on fixtures.sh source
 # text. Migrated spawn suites cover fm_test_run_spawn through the real
 # fm-spawn.sh; this file pins the stubs those suites now share.
+#
+# It is also the fixture Git-config isolation regression, with host signing
+# armed on a scratch config file: it drives every entry point that must reach
+# tests/git-config-helpers.sh - the shared helpers, bin/fm-test-run.sh's
+# per-suite wrapper, and the standalone scripts runnable without a live vendor.
+# That helper's header owns the contract and the layers it leaves in force.
 set -u
 
 # shellcheck source=tests/fixtures.sh

From 68c44f7744e9bcdfb5b8dd325a19b4d79131ddd2 Mon Sep 17 00:00:00 2001
From: Tiago Peixoto <tiagop@hey.com>
Date: Tue, 8 Sep 2026 11:37:37 -0300
Subject: [PATCH 09/11] no-mistakes(review): Fix linked-worktree fixtures and
 remove redundant Git isolation

---
 tests/fm-claude-stop-autoarm-live-e2e.test.sh              | 2 --
 tests/fm-cmux-claude-composer-live-e2e.test.sh             | 2 --
 tests/fm-codex-continuity-live-e2e.test.sh                 | 2 --
 tests/fm-grok-continuity-live-e2e.test.sh                  | 2 --
 tests/fm-muse-signals-live-e2e.test.sh                     | 2 --
 tests/fm-opencode-primary-live-e2e.test.sh                 | 2 --
 tests/fm-pi-primary-live-e2e.test.sh                       | 2 --
 tests/fm-sessionstart-hook-live-e2e.test.sh                | 2 --
 tests/fm-sessionstart-instruction-refresh-live-e2e.test.sh | 2 --
 tests/fm-test-run.test.sh                                  | 1 +
 10 files changed, 1 insertion(+), 18 deletions(-)

diff --git a/tests/fm-claude-stop-autoarm-live-e2e.test.sh b/tests/fm-claude-stop-autoarm-live-e2e.test.sh
index bd613a006ac..ae14d9f3af5 100755
--- a/tests/fm-claude-stop-autoarm-live-e2e.test.sh
+++ b/tests/fm-claude-stop-autoarm-live-e2e.test.sh
@@ -18,8 +18,6 @@ set -u
 fm_live_gate opt-in FM_CLAUDE_LIVE_E2E claude
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-# shellcheck source=tests/git-config-helpers.sh
-. "$ROOT/tests/git-config-helpers.sh"
 
 fail() {
   printf 'not ok - %s\n' "$1" >&2
diff --git a/tests/fm-cmux-claude-composer-live-e2e.test.sh b/tests/fm-cmux-claude-composer-live-e2e.test.sh
index 10c5c5c690e..439d9335e97 100755
--- a/tests/fm-cmux-claude-composer-live-e2e.test.sh
+++ b/tests/fm-cmux-claude-composer-live-e2e.test.sh
@@ -8,8 +8,6 @@ set -u
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-# shellcheck source=tests/git-config-helpers.sh
-. "$ROOT/tests/git-config-helpers.sh"
 TASK="fm-test-cmux-claude-composer-$$"
 LAB=
 SPAWNED=0
diff --git a/tests/fm-codex-continuity-live-e2e.test.sh b/tests/fm-codex-continuity-live-e2e.test.sh
index a882422ed84..ccc7133c832 100755
--- a/tests/fm-codex-continuity-live-e2e.test.sh
+++ b/tests/fm-codex-continuity-live-e2e.test.sh
@@ -9,8 +9,6 @@ set -u
 fm_live_gate opt-in FM_CODEX_LIVE_E2E codex
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-# shellcheck source=tests/git-config-helpers.sh
-. "$ROOT/tests/git-config-helpers.sh"
 
 fail() {
   printf 'not ok - %s\n' "$1" >&2
diff --git a/tests/fm-grok-continuity-live-e2e.test.sh b/tests/fm-grok-continuity-live-e2e.test.sh
index ea20f10a3fc..a4d8052a4ca 100755
--- a/tests/fm-grok-continuity-live-e2e.test.sh
+++ b/tests/fm-grok-continuity-live-e2e.test.sh
@@ -9,8 +9,6 @@ set -u
 fm_live_gate opt-in FM_GROK_LIVE_E2E grok tmux
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-# shellcheck source=tests/git-config-helpers.sh
-. "$ROOT/tests/git-config-helpers.sh"
 
 fail() {
   printf 'not ok - %s\n' "$1" >&2
diff --git a/tests/fm-muse-signals-live-e2e.test.sh b/tests/fm-muse-signals-live-e2e.test.sh
index 3e4ca82d3aa..a406b9af601 100755
--- a/tests/fm-muse-signals-live-e2e.test.sh
+++ b/tests/fm-muse-signals-live-e2e.test.sh
@@ -5,8 +5,6 @@ set -u
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-# shellcheck source=tests/git-config-helpers.sh
-. "$ROOT/tests/git-config-helpers.sh"
 MUSE_BIN=$(command -v muse 2>/dev/null || true)
 REAL_TMUX=$(command -v tmux 2>/dev/null || true)
 LAB=
diff --git a/tests/fm-opencode-primary-live-e2e.test.sh b/tests/fm-opencode-primary-live-e2e.test.sh
index ed482666187..6ce345334e6 100755
--- a/tests/fm-opencode-primary-live-e2e.test.sh
+++ b/tests/fm-opencode-primary-live-e2e.test.sh
@@ -9,8 +9,6 @@ set -u
 fm_live_gate opt-in FM_OPENCODE_LIVE_E2E opencode tmux sqlite3
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-# shellcheck source=tests/git-config-helpers.sh
-. "$ROOT/tests/git-config-helpers.sh"
 unset NO_MISTAKES_GATE
 
 fail() {
diff --git a/tests/fm-pi-primary-live-e2e.test.sh b/tests/fm-pi-primary-live-e2e.test.sh
index be530e64ce4..004af0ff5c3 100755
--- a/tests/fm-pi-primary-live-e2e.test.sh
+++ b/tests/fm-pi-primary-live-e2e.test.sh
@@ -10,8 +10,6 @@ set -u
 fm_live_gate opt-in FM_PI_LIVE_E2E pi tmux
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-# shellcheck source=tests/git-config-helpers.sh
-. "$ROOT/tests/git-config-helpers.sh"
 unset NO_MISTAKES_GATE
 
 fail() {
diff --git a/tests/fm-sessionstart-hook-live-e2e.test.sh b/tests/fm-sessionstart-hook-live-e2e.test.sh
index 4c62cdfb22a..acc295666d6 100755
--- a/tests/fm-sessionstart-hook-live-e2e.test.sh
+++ b/tests/fm-sessionstart-hook-live-e2e.test.sh
@@ -46,8 +46,6 @@ set -u
 fm_live_gate opt-in FM_SESSIONSTART_HOOK_LIVE_E2E,FM_PI_SESSIONSTART_RACE_LIVE_E2E tmux
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-# shellcheck source=tests/git-config-helpers.sh
-. "$ROOT/tests/git-config-helpers.sh"
 unset NO_MISTAKES_GATE
 
 fail() {
diff --git a/tests/fm-sessionstart-instruction-refresh-live-e2e.test.sh b/tests/fm-sessionstart-instruction-refresh-live-e2e.test.sh
index c0f31e88c91..42819acc1bb 100755
--- a/tests/fm-sessionstart-instruction-refresh-live-e2e.test.sh
+++ b/tests/fm-sessionstart-instruction-refresh-live-e2e.test.sh
@@ -30,8 +30,6 @@ set -u
 fm_live_gate opt-in FM_SESSIONSTART_INSTRUCTION_REFRESH_LIVE_E2E pi tmux git
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-# shellcheck source=tests/git-config-helpers.sh
-. "$ROOT/tests/git-config-helpers.sh"
 TMUX_SOCKET="fm-sessionstart-instruction-refresh-$$"
 TMUX_SESSION="instruction-refresh"
 LAB=${TMPDIR:-/tmp}
diff --git a/tests/fm-test-run.test.sh b/tests/fm-test-run.test.sh
index 9593b5a7e7e..767838126d5 100755
--- a/tests/fm-test-run.test.sh
+++ b/tests/fm-test-run.test.sh
@@ -176,6 +176,7 @@ init_primary_and_linked_worktree() {
   for tree in "$repo" "$linked"; do
     mkdir -p "$tree/bin" "$tree/tests"
     cp "$RUNNER" "$tree/bin/fm-test-run.sh"
+    cp "$ROOT/tests/git-config-helpers.sh" "$tree/tests/"
     chmod +x "$tree/bin/fm-test-run.sh"
     cat >"$tree/tests/probe.test.sh" <<PROBE
 #!/usr/bin/env bash

From ec31493f966c546c456da8f597efe31afb511582 Mon Sep 17 00:00:00 2001
From: Tiago Peixoto <tiagop@hey.com>
Date: Tue, 8 Sep 2026 11:48:29 -0300
Subject: [PATCH 10/11] no-mistakes(document): Correct stale runner-selection
 documentation

---
 docs/fm-test-isolation-proof.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/fm-test-isolation-proof.md b/docs/fm-test-isolation-proof.md
index e8df1878041..bd494a6465e 100644
--- a/docs/fm-test-isolation-proof.md
+++ b/docs/fm-test-isolation-proof.md
@@ -119,10 +119,10 @@ Both `bin/fm-test-run.sh` and the current proof harness therefore order concurre
 | 1 | `FM_ISOLATION_SUMMARY total=32 failed=0 concurrency=4 duration_ms=161837` |
 | 2 | `FM_ISOLATION_SUMMARY total=32 failed=0 concurrency=4 duration_ms=156462` |
 
-This family is what a change to `bin/fm-test-run.sh` itself selects, so it decides that selection's wall clock.
+The current runner-change selection is owned by [`bin/fm-test-run.sh`](../bin/fm-test-run.sh)'s changed-file map.
 Before admission, 14 of its scripts fell to the serial tail and the 33-script selection measured 327.3s against a 300s budget: the concurrent group was 19 scripts totalling 273.4s while the tail alone was 215.7s, dominated by `fm-calm-pi-extension` (77.5s), `fm-vendor-auth-probe` (51.0s), and `fm-muse-harness` (39.7s).
 Admitting the family moves that tail into the bounded concurrent group.
-Current runner-file selection was verified on 2026-08-28 with the runner and its tests bound to each measured Bash version.
+The then-current runner-file selection was verified on 2026-08-28 with the runner and its tests bound to each measured Bash version.
 Because the runner uses `#!/usr/bin/env bash` and invokes each test with `bash` from `PATH`, the stock macOS measurement used `PATH=/bin:$PATH bin/fm-test-run.sh --changed --max-wall-ms 300000` so both resolved to `/bin/bash` 3.2.57.
 Two runs selected all 33 scripts, passed the five-minute result check in 153.5s and 166.8s, and reported the same two failures as `main`: `tests/fm-muse-harness.test.sh` and `tests/fm-composer-lib.test.sh`.
 With Bash 5.3.9 on `PATH`, three runs of `bin/fm-test-run.sh --changed --max-wall-ms 300000` selected the same 33 scripts, completed with 0 failures, and reported 163.8s, 172.0s, and 166.9s.

From 1a551b4280204a406633568cb4119bd4783f438f Mon Sep 17 00:00:00 2001
From: Tiago Peixoto <tiagop@hey.com>
Date: Thu, 10 Sep 2026 16:54:32 -0300
Subject: [PATCH 11/11] no-mistakes(document): Clarify family antecedent in
 isolation-proof runner evidence

---
 docs/fm-test-isolation-proof.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/fm-test-isolation-proof.md b/docs/fm-test-isolation-proof.md
index bd494a6465e..6f0766a16bc 100644
--- a/docs/fm-test-isolation-proof.md
+++ b/docs/fm-test-isolation-proof.md
@@ -120,7 +120,7 @@ Both `bin/fm-test-run.sh` and the current proof harness therefore order concurre
 | 2 | `FM_ISOLATION_SUMMARY total=32 failed=0 concurrency=4 duration_ms=156462` |
 
 The current runner-change selection is owned by [`bin/fm-test-run.sh`](../bin/fm-test-run.sh)'s changed-file map.
-Before admission, 14 of its scripts fell to the serial tail and the 33-script selection measured 327.3s against a 300s budget: the concurrent group was 19 scripts totalling 273.4s while the tail alone was 215.7s, dominated by `fm-calm-pi-extension` (77.5s), `fm-vendor-auth-probe` (51.0s), and `fm-muse-harness` (39.7s).
+Before admission, 14 of the family's scripts fell to the serial tail and the 33-script selection measured 327.3s against a 300s budget: the concurrent group was 19 scripts totalling 273.4s while the tail alone was 215.7s, dominated by `fm-calm-pi-extension` (77.5s), `fm-vendor-auth-probe` (51.0s), and `fm-muse-harness` (39.7s).
 Admitting the family moves that tail into the bounded concurrent group.
 The then-current runner-file selection was verified on 2026-08-28 with the runner and its tests bound to each measured Bash version.
 Because the runner uses `#!/usr/bin/env bash` and invokes each test with `bash` from `PATH`, the stock macOS measurement used `PATH=/bin:$PATH bin/fm-test-run.sh --changed --max-wall-ms 300000` so both resolved to `/bin/bash` 3.2.57.