fix: distinguish tamper timeouts and pytest launchers

[stranske]

Summary

• report git/tamper inspection timeouts as tamper-check-timeout instead of command execution timeouts
• treat a plain pytest launcher as safely managed only when its shebang resolves to the active interpreter without import-context flags
• mirror the checker into the consumer template and add exact regression coverage

Validation

• 188 passed, 3 skipped across checker, sync dependency, and template-drift coverage
• 123 passed in the focused checker suite after formatting
• Black, Ruff, mypy, template parity, and git diff --check pass

Review lineage

Addresses exact-head review findings on learning-management-system #513 and trip-planner #1635. Ready #503 was resolved with evidence because EIPsS already contains uppercase P. The consumer fleet remains held pending corrected propagation.

Summary by CodeRabbit

• Bug Fixes

  • Improved detection of standalone pytest commands by verifying their launcher uses the active Python interpreter.
  • Rejects launchers that alter the import context.
  • Tamper-check timeouts now report the clearer tamper-check-timeout status.

• Tests

  • Added coverage for launcher-based pytest classification and distinct timeout reporting.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 2f906245-1df5-4bee-b6e9-370abcaaf9c4

📥 Commits

Reviewing files that changed from the base of the PR and between ee07f66 and 290a99d.

📒 Files selected for processing (3)

• scripts/check_deliberate_break.py
• templates/consumer-repo/scripts/check_deliberate_break.py
• tests/scripts/test_check_deliberate_break.py

---

📝 Walkthrough

Walkthrough

The change validates direct pytest executables against their shebang launcher and import context. It also reports assertion tamper-check timeouts as tamper-check-timeout. Tests cover both runtime classification and timeout reporting.

Changes

Pytest runtime and timeout classification

Layer / File(s)	Summary
Validate direct pytest launchers scripts/check_deliberate_break.py, templates/consumer-repo/scripts/check_deliberate_break.py, tests/scripts/test_check_deliberate_break.py	Direct pytest commands are managed only when their launcher uses the active interpreter without changing import context. Tests cover direct and isolated-import launchers.
Classify tamper-check timeouts scripts/check_deliberate_break.py, templates/consumer-repo/scripts/check_deliberate_break.py, tests/scripts/test_check_deliberate_break.py	Tamper-check timeouts now use tamper-check-timeout. Tests verify the broken verdict, command, and timeout value.

Estimated code review effort: 2 (Simple) | ~15 minutes

Possibly related PRs

• stranske/Workflows#2930: Modifies related PyYAML and pytest failure classification logic.
• stranske/Workflows#2932: Extends pytest runtime detection in complementary logic.
• stranske/Workflows#2936: Updates related PyYAML runtime handling.

Suggested labels: autofix, autofix:patch, verify:compare

Suggested reviewers: codex-automation

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the two main changes: distinct tamper timeout reporting and safer pytest launcher detection.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/tamper-timeout-pytest-launcher

---

_{Comment @coderabbitai help to get the list of available commands.}

[stranske-keepalive]

Workflow source needed

PR #2946 needs either a linked GitHub issue or one valid non-issue Workflow Source before PR metadata automation can manage it safely.

Please do one of:

• Add <!-- meta:issue:123 --> or a normal Closes #123 / Related to #123 line.
• Check one Workflow Source option in the PR body.
• Add a hidden marker such as <!-- workflow-source:local_request -->, <!-- workflow-source:manual_remote -->, <!-- workflow-source:review_followup -->, <!-- workflow-source:sync_campaign -->, or <!-- workflow-source:dependabot -->.
• Add a workflow source label such as workflow:source-direct-pr, workflow:source-local-request, workflow:source-review-followup, workflow:source-sync, or workflow:no-automation.

Once a valid source is present, this warning will not be reposted.

[Copilot]

Pull request overview

This PR tightens the deliberate-break checker’s classification and runtime safety checks by (1) reporting tamper-inspection timeouts with a distinct reason code and (2) being more selective about when a bare pytest launcher is considered “managed” (only when its shebang resolves to the active interpreter and does not alter import-context flags). It also mirrors the behavior into the consumer template and adds regression tests to lock in the updated contract.

Changes:

• Report subprocess.TimeoutExpired during the tamper (git diff/assertion) inspection phase as tamper-check-timeout (while preserving command-timeout for the actual command execution path).
• Treat a plain pytest ... invocation as managed only when the resolved shebang launcher matches sys.executable and does not change Python import context.
• Add regression tests for the new timeout reason and for managed/unmanaged pytest shebang behavior.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
scripts/check_deliberate_break.py	Adds stricter managed-runtime detection for bare pytest based on shebang resolution; classifies tamper inspection timeouts as tamper-check-timeout.
templates/consumer-repo/scripts/check_deliberate_break.py	Mirrors the same checker logic updates into the consumer template to prevent drift.
tests/scripts/test_check_deliberate_break.py	Adds focused regression coverage for tamper timeout reason and for managed/unmanaged pytest shebang variants.

[stranske-keepalive]

Automated Status Summary

Head SHA: 0d24f7a
Latest Runs: ⏳ pending — Gate
Required contexts: summary
Required: core tests (3.12): ⏳ pending, core tests (3.13): ⏳ pending, docker smoke: ⏳ pending, gate: ⏳ pending

Workflow / Job	Result	Logs
(no jobs reported)	⏳ pending	—

Coverage Overview

• Coverage history entries: 1

Coverage Trend

Metric	Value
Current	76.18%
Baseline	85.00%
Delta	-8.82%
Minimum	70.00%
Status	✅ Pass

Top Coverage Hotspots (lowest coverage)

File	Coverage	Missing
scripts/issue_dedup_smoke.py	0.0%	4
scripts/runner_lib/__main__.py	0.0%	3
scripts/validate_template_sync.py	0.0%	81
scripts/langchain/topic_splitter.py	19.1%	57
tools/codex_log_analyzer.py	19.6%	140
scripts/repo_review_round2_runner.py	25.1%	344
scripts/prune_agent_stubs.py	39.7%	26
scripts/repo_review_round1_runner.py	40.7%	133
tools/ensure_workflow_timeout_variables.py	42.1%	74
scripts/sync_label_docs.py	42.9%	64
tools/discover_model_catalog.py	44.8%	55
scripts/repo_review_backlog_scan.py	45.3%	116
scripts/repo_review_body_writer.py	46.5%	86
tools/codex_session_analyzer.py	47.9%	59
scripts/create_verifier_labels.py	48.3%	58

Low Coverage Files (<50.0%)

File	Coverage	Missing
scripts/issue_dedup_smoke.py	0.0%	4
scripts/runner_lib/__main__.py	0.0%	3
scripts/validate_template_sync.py	0.0%	81
scripts/langchain/topic_splitter.py	19.1%	57
tools/codex_log_analyzer.py	19.6%	140
scripts/repo_review_round2_runner.py	25.1%	344
scripts/prune_agent_stubs.py	39.7%	26
scripts/repo_review_round1_runner.py	40.7%	133
tools/ensure_workflow_timeout_variables.py	42.1%	74
scripts/sync_label_docs.py	42.9%	64
tools/discover_model_catalog.py	44.8%	55
scripts/repo_review_backlog_scan.py	45.3%	116
scripts/repo_review_body_writer.py	46.5%	86
tools/codex_session_analyzer.py	47.9%	59
scripts/create_verifier_labels.py	48.3%	58

Updated automatically; will refresh on subsequent CI/Docker completions.

---

Keepalive checklist

Scope

No scope information available

Tasks

• No tasks defined

Acceptance criteria

• No acceptance criteria defined