Cover the managed-config path rule's normalisation and Windows clauses under ntpath

[seathatflowsinourveins]

Scope

• What this PR changes, in one or two sentences: two tests added to tests.test_skill_usage.ManagedMcpDefaultLocations for the managed-config path rule of Count only an absolute managed-mcp.json path as a managed MCP config #967 (no production change): the normalisation equality os.path.abspath(name) == name, which could be removed with every test green (the co-op's GPT read of Count only an absolute managed-mcp.json path as a managed MCP config #967 at 3de3dda8, P3), and the Windows side of the rule under ntpath on every host, so CI's Python 3.12 executes it (the command center's note on landing Count only an absolute managed-mcp.json path as a managed MCP config #967).
• Base commit: 9d4c00cd05d79b3fd5074df2e46bacab87ee67ff (main, which has Ground the Claude Code native practice in primary sources and one cross-client mapping #958 landed); two commits, e466b490e5502166eadec79e6ed4c2b199eee99b and 01fe0aecd939555ded316ceaf375ed90a1fb480f, replayed onto it from the follow-up prepared on Count only an absolute managed-mcp.json path as a managed MCP config #967's landed commit 60004bb1d (no conflict).
• Lane: lane:foundation
• Owned paths touched (two files): tests/test_skill_usage.py (two tests, two imports) and manifests/evidence.json (re-registration of that file).

Follows #967. Nothing here changes a setting, a hook, a host or tools/skill-usage/skill_usage.py.

SOTA sources

• The reproduction and the gap: the co-op's GPT full read of Count only an absolute managed-mcp.json path as a managed MCP config #967 at 3de3dda8 (ACK, one non-blocking P3; verdict sha256 015f8308537fb21367254453ec47afe35ee8d6674ec27db728af25eba57ad13d): removing only and os.path.abspath(name) == name kept all 20 relevant tests green; for a readable file reached by an absolute spelling with an existing child/../ segment the head keeps --strict-mcp-config and that mutant drops it.
• CPython's own path rules, read from the installed interpreters at the versions CI and this host use: ntpath.isabs at Lib/ntpath.py line 87 in 3.12.3 (accepts a leading single separator, so /etc/claude-code/managed-mcp.json is absolute and only the equality rejects it, because abspath adds a drive and turns the separators) and line 80 in 3.13.16 (rejects it first). On a POSIX host ntpath.abspath is its pure-Python fallback (no _getfullpathname), which is all the cases need and is why the drive-relative case is decided by isabs here.
• The native client's directory selector (the 2.1.296 binary, sha256 24972e3bc859fab2b46ed4c1e51f7d6130f06d3bd550811a114640de3370d0de, My() at byte 209080002, read 2026-10-10): /Library/Application Support/ClaudeCode on macOS, C:\Program Files\ClaudeCode on Windows, /etc/claude-code otherwise; cited in Fence the headless /skill-doctor run #925 and Count only an absolute managed-mcp.json path as a managed MCP config #967.

Evidence-class table

Claim	Evidence class	Command / receipt
An existing file reached through a dot-dot, a dot or a doubled-separator spelling of an absolute path is not a managed config, by parameter and by the default route, while the normalised spelling is, alone and next to a rejected candidate (pathlib drops the dot and doubled-separator segments itself, so only the dot-dot spelling is also asserted as a Path)	local_integration (real files, every platform)	tests.test_skill_usage.ManagedMcpDefaultLocations.test_an_absolute_path_that_is_not_normalised_is_not_a_managed_config
With the module's os replaced, for the test, by one whose isabs and abspath are ntpath's and whose file checks answer yes: the Windows documented string counts and the macOS and Linux strings do not; a dot-dot, dot, forward-slash and doubled-separator spelling of the Windows string, a relative name and a drive-relative name each keep every fence; one counted candidate decides the form, by parameter and by the default route	local_integration (ntpath on a POSIX host; not run on Windows)	tests.test_skill_usage.ManagedMcpDefaultLocations.test_the_windows_path_rules_count_the_windows_string_and_not_the_posix_ones, run under CPython 3.12.3 and 3.13.16
Source-level mutants of _readable_system_file, executed in the module's own globals so the mutated body sees the swapped os (the earlier whole-function harness could not): removing only the normalisation equality fails both new tests on 3.12 and 3.13 (the four non-normalised Windows spellings, plus the macOS and Linux strings on 3.12); removing only isabs fails the ntpath test through the drive-relative name (equivalent on a real Windows host, where abspath resolves it); reverting to the presence-only check fails the relative-name, POSIX and Windows tests; removing only the regular-file or the readability check fails the matrix	local_integration (mutation harness; nothing on disk changes)	mutations_p3_source.py, tables pr925/p3-source-mutations-py3.12.3.txt and -py3.13.16.txt in the lane's research record

Declared test contract change

None: two tests are added and no existing test changes.

Local commands run

Head 01fe0aecd939555ded316ceaf375ed90a1fb480f, rebased once onto main 9d4c00cd0 (#968; clean). The unit tests, generators and convergence check ran on the same two
commits on #958's landed commit 7a6bfbcf0 (gates head 62f773914) before that rebase; validate.py, the manifest check and the two
classes were rerun at this head. CPython 3.13.16 locally, TMPDIR outside /tmp and outside home:
$ python3 -E -s -B scripts/validate.py   # at this head
{"components": 70, "hashed_files": 11421, "profiles": 4, "receipts": 239, "status": "passed"}   (rc 0)
$ python3 -E -s -B scripts/evidence_manifest.py --check   # at this head
{"files": 11421, "status": "passed"}   (rc 0)
$ python3 -E -s -B -m unittest tests.test_skill_usage.ManagedMcpDefaultLocations tests.test_skill_usage.RunSkillDoctor   # at this head
Ran 22 tests; OK
$ python3 -E -s -B scripts/validate_convergence.py --all-recorded
rc 0
$ python3 -E -s -B scripts/component_matrix.py --write && python3 -E -s -B scripts/new_host_grand_list.py --write
rc 0; no change to a generated report
$ python3 -E -s -B -m unittest tests.test_skill_usage tests.test_workflow_hardening tests.test_evidence_manifest tests.test_upstream_surface_watch
Ran 475 tests in 78.168s; OK (skipped=26)
$ /var/tmp/ccnp-ci-venv/bin/python -E -B -m unittest tests.test_skill_usage tests.test_freeze_snapshot tests.test_token_measurement tests.test_transcript_audit tests.test_workflow_hardening   # CPython 3.12.3 plus the CI requirements
Ran 640 tests in 391.997s; OK (skipped=66)
$ git diff origin/main --unified=0 | grep '^+'   # added lines, scanned for the host's private names
hits 0

A first draft of the mutation table replaced the whole function, which cannot see a swapped os; it reported the isabs mutant as equivalent and a missing normpath in the shim looked like a catch. Both were corrected before the commit by executing the mutated source in the module's globals.

Decision record

No new record: tests for the rule of #967 and its decision locator, which this PR does not move.

Host evidence

Not applicable: no file under evidence/hosts/ changes.

Checklist

• New/changed GitHub Actions are pinned to a full commit SHA with a version comment (no floating tags). (none changed)
• New/changed workflows declare top-level permissions: {} and grant each job only what it needs. (none changed)
• No secrets are printed, logged or committed; no new required secret was added without a documented owner.
• No new paid hosting, subscription or billing surface was introduced.
• Peer-owned untracked files and worktrees were preserved (not deleted, moved or overwritten).

🤖 Generated with Claude Code