Create private evidence directories safely on fsGroup volumes

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

tests/test_container_runtime.py

@@ -101,3 +101,20 @@ def test_listener_exposure_requires_explicit_supported_setting(monkeypatch,host)
         assert not observed
     else:
         web.main();assert observed[0]['host']==(host or '127.0.0.1')
+
+
+def test_fsgroup_volume_creates_private_store_without_inherited_setgid(tmp_path):
+    volume=tmp_path/'volume';volume.mkdir();volume.chmod(0o2770)
+    directory=private_directory(volume/'private')
+    assert stat.S_IMODE(directory.stat().st_mode)==0o700
+    store=Store(directory/'review.sqlite')
+    assert store.outbox()==[]
+    assert private_directory(directory)==directory
+
+
+@pytest.mark.parametrize('mode',[0o2700,0o2770])
+def test_existing_setgid_directory_is_refused_without_chmod(tmp_path,mode):
+    directory=tmp_path/'private';directory.mkdir();directory.chmod(mode)
+    with pytest.raises(ValueError,match='unsafe ownership or mode'):
+        private_directory(directory)
+    assert stat.S_IMODE(directory.stat().st_mode)==mode