Close CMUX fleet Git probe environment

scripts/cmux_fleet.py

@@ -1127,11 +1127,11 @@ def _bounded_tail(path: Path, ceiling: int = 4096) -> str:
 
 def _git_oid(cmux_root: Path, expression: str) -> str:
     environment = {
-        name: value
-        for name, value in os.environ.items()
-        if not name.startswith("GIT_")
+        "LC_ALL": "C",
+        "LANG": "C",
+        "GIT_CONFIG_GLOBAL": "/dev/null",
+        "GIT_CONFIG_NOSYSTEM": "1",
     }
-    environment["LC_ALL"] = "C"
     try:
         completed = subprocess.run(
             ["/usr/bin/git", "-C", str(cmux_root), "rev-parse", expression],

scripts/test-cmux-fleet.py

@@ -432,6 +432,58 @@ def test_external_semantic_evidence_cannot_mint_accepted_receipt(self):
         self.assertEqual(receipt["result"], "rejected")
         self.assertFalse(f.node_status(e, [receipt])["routingCandidateEligible"])
 
+    def test_git_oid_uses_closed_environment(self):
+        observed = {}
+
+        def fake_run(argv, **kwargs):
+            observed.update(kwargs)
+            return __import__("subprocess").CompletedProcess(
+                argv,
+                0,
+                stdout=COMMIT + "\n",
+                stderr="",
+            )
+
+        with (
+            mock.patch.dict(
+                f.os.environ,
+                {
+                    "PATH": "/attacker/bin",
+                    "HOME": "/attacker/home",
+                    "PYTHONPATH": "/attacker/python",
+                    "SSH_AUTH_SOCK": "/private/agent.sock",
+                    "SECRET_SENTINEL": "do-not-forward",
+                    "LD_PRELOAD": "/attacker/lib.so",
+                    "GIT_DIR": "/attacker/git",
+                    "GIT_CONFIG_GLOBAL": "/attacker/config",
+                },
+                clear=True,
+            ),
+            mock.patch.object(f.subprocess, "run", side_effect=fake_run),
+        ):
+            value = f._git_oid(Path("/cmux"), "HEAD^{commit}")
+
+        self.assertEqual(value, COMMIT)
+        self.assertEqual(
+            observed["env"],
+            {
+                "LC_ALL": "C",
+                "LANG": "C",
+                "GIT_CONFIG_GLOBAL": "/dev/null",
+                "GIT_CONFIG_NOSYSTEM": "1",
+            },
+        )
+        for forbidden in (
+            "PATH",
+            "HOME",
+            "PYTHONPATH",
+            "SSH_AUTH_SOCK",
+            "SECRET_SENTINEL",
+            "LD_PRELOAD",
+            "GIT_DIR",
+        ):
+            self.assertNotIn(forbidden, observed["env"])
+
     def test_acceptance_child_environment_is_explicit_allowlist(self):
         with tempfile.TemporaryDirectory() as temporary:
             root = Path(temporary).resolve()