guard: ci_gate_runability verdicts are location-independent (removes surviving temp-dir fail-open)

[matt82198]

Problem (VERIFIED P1, regression lens)

tools/ci_gate_runability.py carried a second copy of the Windows temp-dir exemption that commit 6afb94ba claims to have deleted. 6afb94ba removed it from find_file_on_disk() but missed the copy in check_workflow():

repo_root_path = Path(repo_root).resolve()
is_temp_fixture = 'AppData' in str(repo_root_path) and 'Temp' in str(repo_root_path)

if step['run'] and not is_temp_fixture:   # <- check (c) silently skipped

The gate's verdict therefore depended on where the checkout lives on disk, not on what it contains. Byte-identical fixtures:

root	verdict
C:\Users\...\AppData\Local\Temp\tmpXXXX	[OK] All CI gates are runnable on PR events — rc 0
C:\Users\...\aesop-repro-nontemp	... references missing file: tools/verify_definitely_missing.py — rc 1

find_file_on_disk()'s own comment (:253-259) forbids exactly this. The gate is a blocking step in ci.yml, so this is fail-open on any runner whose workspace sits under a temp-shaped path — the "green can mean never ran" incident class this Guardrail (G2.5) exists to prevent.

Why the exemption existed, and the correct replacement

Test fixtures built workflow YAML in temp dirs citing tools/*.py the fixture never created, so check (c) reported them missing. The exemption made the gate recognise its own fixtures.

6afb94ba already fixed this correctly on the test side: the fixture harness stubs every tools/*.py its workflow references (tests/test_ci_gate_runability.py:38-47). So the right replacement was already on disk — the surviving copy is pure dead fail-open. No --root change and no new skip flag is needed; a skip flag would just re-introduce the hole.

TDD

Reproduced first — TestCIGateRunabilityLocationIndependence was RED on 2 of 4 before the fix:

FAIL: test_missing_file_flagged_under_temp_shaped_root
  AssertionError: 0 != 1 : Gate must flag the missing file regardless of where the repo lives
FAIL: test_source_has_no_path_shape_sniffing
  AssertionError: ["314: is_temp_fixture = 'AppData' in str(repo_root_path) ...", "316: if step['run'] and not is_temp_fixture:"] != []

Roots are built at <tmp>/AppData/Temp/repo — trigger-shaped on every OS, so the repro is red on Linux CI too, not just Windows — and at <tmp>/ordinary/workspace/repo. The four tests assert:

1. a missing file is flagged under a temp-shaped root;
2. both roots yield identical verdicts and finding counts;
3. a fixture that provides the file it cites stays clean (no inverted false positive);
4. a static scan of the module source fails on any future copy of the path sniff (rules-as-code — the prose fix regressed once already because a second copy survived).

Verification

• tests.test_ci_gate_runability: 23/23 OK
• Python suite: Ran 4346 tests — OK (skipped=20), rc 0
• Shell suite: 14/14, rc 0
• Node suite: 308/309 — the single failure is a pre-existing node --test IPC flake (fleet-cli.test.mjs: "Unable to deserialize cloned data"); isolated re-run 7/7, rc 0
• Gate battery all rc 0: ci_gate_runability (real repo clean), verify_test_suite_count --check, claudemd_lint, claudemd_contract, claudemd_sync_gate --check, encoding_lint, watcher_linter --check, verify_test_coverage --check, spec_contract_validator --check, workflow_model_linter --check, subprocess_guard --check --baseline .subprocess-guard-baseline.json
• secret_scan --staged rc 0; pre-push gates green

tools/CLAUDE.md also corrects a stale claim on the same entry ("staged (wire into ci.yml after #596)" — it is wired, ci.yml:148) and records the location-independence invariant.

🤖 Generated with Claude Code