Preserve identical hosted identity in historical admission

Co-Authored-By: Paperclip <noreply@paperclip.ing>

tests/runner-e2e/native-completion-admission.test.ts

@@ -15,6 +15,21 @@ describe("native completion credential-free admission", () => {
       ...Object.fromEntries(CREDENTIAL_NAMES.map(name => [name, "secret"])) };
     expect(nativeCompletionPreflightEnvironment(source)).toEqual({ PATH: "/bin", HOME: "/home/fixture", CARGO_HOME: "/cargo", CI: "true" });
   });
+  it("carries only public hosted identity through actual prepare and verify subprocess options", () => {
+    const identity = { GITHUB_ACTIONS: "true", PAPERCLIP_RUNNER_E2E_SOURCE_SHA: "a".repeat(40), GITHUB_RUN_ID: "123", GITHUB_RUN_ATTEMPT: "1" };
+    for (const [name, value] of Object.entries(identity)) vi.stubEnv(name, value);
+    for (const name of [...CREDENTIAL_NAMES, "GH_TOKEN", "FUTURE_PROVIDER_API_KEY", "NODE_OPTIONS"]) vi.stubEnv(name, "secret");
+    spawn.mockReturnValueOnce({ status: 0 } as ReturnType<typeof spawnSync>);
+    spawn.mockReturnValueOnce({ status: 0, stdout: JSON.stringify({ passed: true, sourceSha: identity.PAPERCLIP_RUNNER_E2E_SOURCE_SHA }) } as ReturnType<typeof spawnSync>);
+    prepareNativeCompletionPreflight(campaignDirectory);
+    expect(spawn).toHaveBeenCalledTimes(2);
+    for (const call of spawn.mock.calls) {
+      expect(call[2]?.env).toMatchObject(identity);
+      for (const name of [...CREDENTIAL_NAMES, "GH_TOKEN", "FUTURE_PROVIDER_API_KEY", "NODE_OPTIONS"]) expect(call[2]?.env).not.toHaveProperty(name);
+    }
+    expect(spawn.mock.calls[0]?.[1]?.some(arg => arg.startsWith("--output-dir="))).toBe(true);
+    expect(spawn.mock.calls[1]?.[1]?.some(arg => arg.startsWith("--verify="))).toBe(true);
+  });
   it("rejects missing receipts without invoking a process", () => {
     expect(() => verifyNativeCompletionPreflight(undefined)).toThrow("no prerequisite receipt");
     expect(spawn).not.toHaveBeenCalled();

tests/runner-e2e/native-completion-admission.ts

@@ -31,6 +31,7 @@ export function nativeCompletionPreflightEnvironment(source: NodeJS.ProcessEnv):
   return Object.fromEntries([
     "PATH", "HOME", "TMPDIR", "TMP", "TEMP", "SYSTEMROOT", "LANG", "LC_ALL",
     "CARGO_HOME", "RUSTUP_HOME", "CI", "GITHUB_ACTIONS",
+    "PAPERCLIP_RUNNER_E2E_SOURCE_SHA", "GITHUB_RUN_ID", "GITHUB_RUN_ATTEMPT",
   ].flatMap(name => source[name] === undefined ? [] : [[name, source[name]]]));
 }
 

tests/runner-e2e/native-completion-source-contract.mjs

@@ -8,8 +8,8 @@ export const NATIVE_COMPLETION_SOURCE_CONTRACT = {
   "baseSha": "59c07ede72dc08b8aba149a01cc11e0b7a204621",
   "archiveSha": "9138f570c341c251a5727c32d6615ce238bc8e03",
   "shallowParentAnchors": {
-    "candidate": "e18c2cf9e96a4d31acb6d03ce918dfe223107d3f",
-    "historical": "459455acb11a012a97ad1b4afb77a1dc024a88bc"
+    "candidate": "76a247643869efda6f2adec300c0f46c88e79cae",
+    "historical": "5cafc2cbc48f86ad95dfbfb7dc71a9a588238083"
   },
   "variants": {
     "candidate": {