test(agentcompat): make dedicated fixtures platform-native

Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>

integration/agentcompat/internal/evidence/dedicated_assertion_test.go

@@ -20,10 +20,10 @@ func TestEvidence_DedicatedArtifactsRequireExactScenarioAssertions(t *testing.T)
 			writeJSONEvidenceFile(t, dir, "transfer.json", validTransferArtifact("", true))
 		}},
 		{"reconnect generic", contract.ScenarioReconnect, "scenario passed", func(t *testing.T, dir string) {
-			writeJSONEvidenceFile(t, dir, "reconnect.json", validReconnectArtifact("", true))
+			writeJSONEvidenceFile(t, dir, "reconnect.json", validReconnectArtifact(t, "", true))
 		}},
 		{"reconnect mismatched", contract.ScenarioReconnect, contract.AssertionTransferWarmup, func(t *testing.T, dir string) {
-			writeJSONEvidenceFile(t, dir, "reconnect.json", validReconnectArtifact("", true))
+			writeJSONEvidenceFile(t, dir, "reconnect.json", validReconnectArtifact(t, "", true))
 		}},
 	}
 	for _, test := range tests {

integration/agentcompat/internal/evidence/dedicated_fault_fields_test.go

@@ -75,7 +75,7 @@ func TestEvidence_DashboardExitRejectsEveryPostFaultField(t *testing.T) {
 		t.Run(test.name, func(t *testing.T) {
 			dir := t.TempDir()
 			writeDedicatedExecutableEvidence(t, dir, "reconnect", "dashboard-exit", false)
-			artifact := validReconnectArtifact("dashboard-exit", false)
+			artifact := validReconnectArtifact(t, "dashboard-exit", false)
 			test.mutate(&artifact.Evidence)
 			writeJSONEvidenceFile(t, dir, "reconnect.json", artifact)
 			if err := ValidateDirectory(dir); err == nil {

integration/agentcompat/internal/evidence/dedicated_permissions_unix_test.go

@@ -0,0 +1,29 @@
+//go:build aix || darwin || dragonfly || freebsd || linux || netbsd || openbsd || solaris
+
+package evidence
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestEvidence_RejectsDedicatedArtifactWithPublicMode(t *testing.T) {
+	dir := t.TempDir()
+	writeExecutableEvidence(t, dir, "pr-full", "transfer-100mib", true, true, true)
+	path := filepath.Join(dir, "transfer.json")
+	if err := os.WriteFile(path, []byte(`{}`), 0o644); err != nil {
+		t.Fatalf("write transfer artifact: %v", err)
+	}
+	if err := os.Chmod(path, 0o644); err != nil {
+		t.Fatalf("chmod transfer artifact: %v", err)
+	}
+	t.Cleanup(func() {
+		if err := os.Chmod(path, 0o600); err != nil {
+			t.Errorf("restore transfer artifact mode: %v", err)
+		}
+	})
+	if err := ValidateDirectory(dir); err == nil {
+		t.Fatal("public dedicated artifact mode accepted")
+	}
+}

integration/agentcompat/internal/evidence/dedicated_validation_test.go

@@ -2,7 +2,6 @@ package evidence
 
 import (
 	"fmt"
-	"os"
 	"path/filepath"
 	"testing"
 	"time"
@@ -57,7 +56,7 @@ func TestEvidence_ValidatesTypedReconnectSuccessAndFaultArtifacts(t *testing.T)
 		t.Run(test.name, func(t *testing.T) {
 			dir := t.TempDir()
 			writeDedicatedExecutableEvidence(t, dir, "reconnect", test.fault, test.passed)
-			artifact := validReconnectArtifact(test.fault, test.passed)
+			artifact := validReconnectArtifact(t, test.fault, test.passed)
 			writeJSONEvidenceFile(t, dir, "reconnect.json", artifact)
 			if err := ValidateDirectory(dir); err != nil {
 				t.Fatalf("validate reconnect evidence: %v", err)
@@ -86,18 +85,6 @@ func TestEvidence_RejectsWrongOrStaleDedicatedArtifact(t *testing.T) {
 	}
 }
 
-func TestEvidence_RejectsDedicatedArtifactWithPublicMode(t *testing.T) {
-	dir := t.TempDir()
-	writeExecutableEvidence(t, dir, "pr-full", "transfer-100mib", true, true, true)
-	path := filepath.Join(dir, "transfer.json")
-	if err := os.WriteFile(path, []byte(`{}`), 0o644); err != nil {
-		t.Fatalf("write transfer artifact: %v", err)
-	}
-	if err := ValidateDirectory(dir); err == nil {
-		t.Fatal("public dedicated artifact mode accepted")
-	}
-}
-
 func writeDedicatedExecutableEvidence(t *testing.T, dir, scenarioName, fault string, passed bool) {
 	t.Helper()
 	metadata := validMetadata(t, dir, scenarioName)
@@ -153,7 +140,8 @@ func validTransferArtifact(fault string, passed bool) transferArtifact {
 	return transferArtifact{Scenario: "transfer-100mib", Fault: fault, Passed: passed, CleanupOK: true, Error: errorText, Evidence: evidence}
 }
 
-func validReconnectArtifact(fault string, passed bool) reconnectArtifact {
+func validReconnectArtifact(t *testing.T, fault string, passed bool) reconnectArtifact {
+	t.Helper()
 	var artifact reconnectArtifact
 	artifact.Scenario = "reconnect"
 	artifact.Fault = fault
@@ -163,12 +151,16 @@ func validReconnectArtifact(fault string, passed bool) reconnectArtifact {
 		artifact.Error = "reconnect scenario: injected Dashboard exit"
 	}
 	evidence := &artifact.Evidence
-	evidence.Fixture.Dashboard.WorkspaceRoot = "/tmp/dashboard"
-	evidence.Fixture.Dashboard.ConfigPath = "/tmp/dashboard/config"
-	evidence.Fixture.Dashboard.BinaryPath = "/tmp/dashboard/bin"
-	evidence.Fixture.AgentRoot = "/tmp/agent"
-	evidence.Fixture.AgentConfigPath = "/tmp/agent/config"
-	evidence.Fixture.AgentBinaryPath = "/tmp/agent/bin"
+	fixtureRoot := t.TempDir()
+	// filepath.IsAbs follows the target OS, so fixtures must use native absolute paths.
+	dashboardRoot := filepath.Join(fixtureRoot, "dashboard")
+	agentRoot := filepath.Join(fixtureRoot, "agent")
+	evidence.Fixture.Dashboard.WorkspaceRoot = dashboardRoot
+	evidence.Fixture.Dashboard.ConfigPath = filepath.Join(dashboardRoot, "config")
+	evidence.Fixture.Dashboard.BinaryPath = filepath.Join(dashboardRoot, "bin")
+	evidence.Fixture.AgentRoot = agentRoot
+	evidence.Fixture.AgentConfigPath = filepath.Join(agentRoot, "config")
+	evidence.Fixture.AgentBinaryPath = filepath.Join(agentRoot, "bin")
 	evidence.Runtime.DashboardBefore = runtimeIdentity{Generation: 1, PID: 10, ProcessGroupID: 10}
 	evidence.Runtime.AgentBefore = runtimeIdentity{Generation: 1, PID: 20, ProcessGroupID: 20}
 	evidence.Identity.ServerID = 1