test: isolate git identity in CI

WORK-RECORDS.md

@@ -42,7 +42,7 @@
 | task | GLAS-WP-0005-T01 | done | — | workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md |
 | task | GLAS-WP-0005-T02 | done | — | workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md |
 | task | GLAS-WP-0005-T03 | done | — | workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md |
-| task | GLAS-WP-0005-T04 | done | — | workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md |
+| task | GLAS-WP-0005-T04 | progress | — | workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md |
 | task | GLAS-WP-0005-T05 | wait | — | workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md |
 | intake | GLAS-IN-0001 | done | blue | docs/intakes/residuals.md |
 | intake | GLAS-IN-0002 | todo | red | docs/intakes/residuals.md |

tests/test_rein_aharness.py

@@ -11,6 +11,18 @@ from glas_harness.reins.rein_aharness import ReinAharness, ReinAharnessNotInstal
 from glas_harness.transport import ExecutionTransport, TransportError
 
 
+def _init_repo(repo) -> None:
+    repo.mkdir()
+    subprocess.run(["git", "init", "-q"], cwd=repo, check=True)
+    subprocess.run(["git", "config", "user.name", "Glas Harness Tests"], cwd=repo, check=True)
+    subprocess.run(
+        ["git", "config", "user.email", "glas-harness-tests@example.invalid"],
+        cwd=repo,
+        check=True,
+    )
+    subprocess.run(["git", "commit", "-q", "--allow-empty", "-m", "init"], cwd=repo, check=True)
+
+
 def test_is_rein_subclass() -> None:
     assert issubclass(ReinAharness, Rein)
 
@@ -25,9 +37,7 @@ def test_bin_raises_if_not_installed() -> None:
 
 def test_start_session_writes_task_file_and_captures_head(tmp_path) -> None:
     repo = tmp_path / "repo"
-    repo.mkdir()
+    _init_repo(repo)
-    subprocess.run(["git", "init", "-q"], cwd=repo, check=True)
-    subprocess.run(["git", "commit", "-q", "--allow-empty", "-m", "init"], cwd=repo, check=True)
 
     rein = ReinAharness()
     sandbox = SandboxHandle(
@@ -97,9 +107,7 @@ def test_dispatch_tool_reports_failure() -> None:
 
 def test_end_session_detects_new_commit(tmp_path) -> None:
     repo = tmp_path / "repo"
-    repo.mkdir()
+    _init_repo(repo)
-    subprocess.run(["git", "init", "-q"], cwd=repo, check=True)
-    subprocess.run(["git", "commit", "-q", "--allow-empty", "-m", "init"], cwd=repo, check=True)
 
     rein = ReinAharness()
     head_before = subprocess.run(
@@ -126,9 +134,7 @@ def test_end_session_detects_new_commit(tmp_path) -> None:
 
 def test_end_session_no_new_commit(tmp_path) -> None:
     repo = tmp_path / "repo"
-    repo.mkdir()
+    _init_repo(repo)
-    subprocess.run(["git", "init", "-q"], cwd=repo, check=True)
-    subprocess.run(["git", "commit", "-q", "--allow-empty", "-m", "init"], cwd=repo, check=True)
 
     rein = ReinAharness()
     head = subprocess.run(

tests/test_rein_openweights.py

@@ -11,6 +11,18 @@ from glas_harness.reins.rein_openweights import ReinOpenWeights, ReinOpenWeights
 from glas_harness.transport import ExecutionTransport, TransportError
 
 
+def _init_repo(repo) -> None:
+    repo.mkdir()
+    subprocess.run(["git", "init", "-q"], cwd=repo, check=True)
+    subprocess.run(["git", "config", "user.name", "Glas Harness Tests"], cwd=repo, check=True)
+    subprocess.run(
+        ["git", "config", "user.email", "glas-harness-tests@example.invalid"],
+        cwd=repo,
+        check=True,
+    )
+    subprocess.run(["git", "commit", "-q", "--allow-empty", "-m", "init"], cwd=repo, check=True)
+
+
 def test_is_rein_subclass() -> None:
     assert issubclass(ReinOpenWeights, Rein)
 
@@ -25,9 +37,7 @@ def test_bin_raises_if_not_installed() -> None:
 
 def test_start_session_writes_task_file_and_captures_head(tmp_path) -> None:
     repo = tmp_path / "repo"
-    repo.mkdir()
+    _init_repo(repo)
-    subprocess.run(["git", "init", "-q"], cwd=repo, check=True)
-    subprocess.run(["git", "commit", "-q", "--allow-empty", "-m", "init"], cwd=repo, check=True)
 
     rein = ReinOpenWeights()
     sandbox = SandboxHandle(
@@ -129,9 +139,7 @@ def test_dispatch_tool_enforces_outer_timeout() -> None:
 
 def test_end_session_detects_new_commit(tmp_path) -> None:
     repo = tmp_path / "repo"
-    repo.mkdir()
+    _init_repo(repo)
-    subprocess.run(["git", "init", "-q"], cwd=repo, check=True)
-    subprocess.run(["git", "commit", "-q", "--allow-empty", "-m", "init"], cwd=repo, check=True)
 
     rein = ReinOpenWeights()
     head_before = subprocess.run(

workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md

@@ -107,7 +107,7 @@ for direct and optional dependencies.
 
 ```task
 id: GLAS-WP-0005-T04
-status: done
+status: progress
 priority: high
 ```
 
@@ -115,10 +115,13 @@ Make Forgejo CI check out the repository, install the project and its test
 dependencies, run the full unit suite, and run `glas-harness profiles`. Retain
 only routing probes that still provide operational value.
 
-**Completed 2026-08-21:** replaced the two echo-only jobs with the estate's
+**2026-08-21 progress:** replaced the two echo-only jobs with the estate's
 archive-checkout pattern, explicit Python/sand-boxer/project installation, the
-full test suite, and packaged catalog validation. Forgejo Actions run `#45` on
+full test suite, and packaged catalog validation. Run `#45` was superseded and
-commit `f773b5c` passed after publication.
+canceled; run `#46` exposed five tests that incorrectly relied on the host's
+global Git author identity. The same job reproduced this cleanly in the runner's
+`node:20-bookworm` image, and the test repositories now configure a local,
+non-deliverable test identity. A green published rerun remains required.
 
 ## Task: Re-prove the sandbox boundary and close evidence