linux-sandbox test brittleness: cwd='/' exact bwrap argv depends on host /.git

Codex version

v0.117.0-alpha.13

Summary

A linux-sandbox unit test failed on my machine because it has a real /.git directory.

The failing test was:

• bwrap::tests::mounts_dev_before_writable_dev_binds

What happened

The test uses cwd = "/" with a WorkspaceWrite policy. In that setup, / becomes a writable root. The policy's default protected subpaths include .git, so if /.git exists, bwrap args include:

• --ro-bind /.git /.git

On my machine, /.git exists, so the generated argv had that extra carveout and the test failed because it expected an exact hardcoded argv list without /.git.

Why this is confusing / brittle

The test intent is to validate mount ordering for /dev, but exact full-vector matching makes it host-dependent when / is the writable root.

That means:

• host with /.git: extra /.git carveout appears
• host without /.git: no extra carveout

So the same code can pass/fail depending on host filesystem state.

Important clarification

The /.git carveout itself is expected behavior (security policy), not the bug.

The brittle part is the test shape:

• exact argv equality in a root-cwd scenario where protected subpaths are host-dependent.

Suggested test strategy

• Keep asserting the behavior under test (--dev /dev comes before writable /dev bind).
• If testing exact vectors, either:
• run with a temp cwd (not /), or
• include conditional expectation for /.git when it exists.