fix(cli): a test that refused to pass vacuously failed instead

[AminChirazi]

Small, and it makes cargo test --workspace green on macOS for the first time in a while.

What was wrong

a_run_that_was_not_contained_keeps_no_evidence_from_an_optimistic_probe asserts that a control record carries what the run achieved rather than what the host probe optimistically reported. That is a good thing to test.

To stop it passing for the wrong reason, it required the probe and the run to disagree — by asserting the probe says Enforced:

assert!(
    agent_flow::containment(&spec).is_enforced(),
    "this test is only meaningful where the probe and the run DISAGREE; ..."
);

That is true only on Linux. Everywhere else the assertion fires and the test fails outright, so cargo test --workspace is red on macOS and Windows before anyone has touched anything.

Why it is worth fixing rather than tolerating

cargo test --workspace is one of the three gates the Builder role requires to pass before opening a PR. A gate that is red by default is one people learn to read past — and over this session every local verification had to be checked against "is this the known failure, or mine?", which is exactly the ambiguity a green baseline removes.

It is the second instance of this shape: #324 fixed the same class in the sibling test, where an assertion pinned a wording that had since changed.

The fix

The instinct was right and the mechanism was wrong. The disagreement is what the test needs, not which side of it this machine is on.

Off Linux the probe still says "not contained" — but for a different reason — so comparing the two rendered lines keeps the test meaningful everywhere:

assert_ne!(
    agent_flow::containment(&spec).report_line(),
    achieved.report_line(),
    "the probe and the run must differ, or this test proves nothing"
);

On Linux that compares enforced (linux seccomp) against not contained (the filters never installed). Off Linux it compares two different not-contained reasons. Either way the record must carry the run's, and the test still fails if it carries the probe's.

No #[ignore], no skip, no weakened assertion — the vacuity guard is kept, just expressed in a way that holds on every host.

Verification

cargo test --workspace on macOS: 57 suites, zero failures — previously one. cargo fmt --check and cargo clippy --workspace --all-targets -- -D warnings clean.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR fixes a CLI test that was unintentionally failing on non-Linux hosts by changing the “vacuity guard” to require only that the host probe and the run’s achieved containment tier disagree (rather than requiring the probe to report Enforced). This restores a green baseline for cargo test --workspace across macOS/Windows while keeping the test meaningful.

Changes:

• Update the test precondition to assert_ne!(probe.report_line(), achieved.report_line()), making it host-agnostic while still preventing vacuous passes.
• Add a CHANGELOG entry documenting the cross-platform test fix and why it matters for local verification gates.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
crates/flowproof-cli/src/lib.rs	Adjusts the test’s precondition so it remains meaningful without failing outright on non-Linux hosts.
CHANGELOG.md	Documents the underlying problem (host-specific precondition) and the new cross-platform guard.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.