@team-agent/installer 0.5.77 → 0.5.80

package/crates/team-agent/src/lifecycle/restart.rs

@@ -70,6 +70,7 @@ mod common;
 mod orchestrator;
 pub mod preflight;
 mod rebuild;
+pub use rebuild::{restart_bind_status, restart_leader_public_bind};
 pub(crate) mod remove;
 mod selection;
 mod team_state;
@@ -92,8 +93,7 @@ pub(crate) use rebuild::restart_with_transport_with_session_convergence_deadline
 // timer + worker timing writer so `lifecycle::launch::launch_with_transport_in_workspace`
 // can emit the same instrumentation event family with `source="launch"`.
 pub(crate) use rebuild::{
-    provider_wire_from_state, restart_failure_action, write_worker_spawn_timing_event,
-    RestartPhaseTimer,
+    provider_wire_from_state, write_worker_spawn_timing_event, RestartPhaseTimer,
 };
 pub use rebuild::{restart, restart_with_session_convergence_deadline};
 pub(crate) use rebuild::{

package/crates/team-agent/src/lifecycle/tests/acceptance_b_batch_red.rs

@@ -147,6 +147,9 @@ gate — N35/MUST-17); found {hits} occurrence(s)"
 #[test]
 #[serial(env)]
 fn b2_quick_start_ready_has_attach_commands_and_socket_miss_is_observable() {
+    let hermetic = hermetic_guard::HermeticTestEnv::enter("acceptance-b-b2-quick-start");
+    hermetic.scrub_tmux();
+    hermetic.assert_no_real_tmux();
     let _g = EnvGuard::set(&[(ANCESTRY_KEY, NEUTRAL_ANCESTRY)]);
     let ws = tmp_ws("b2-attach");
     let team_dir = write_min_team(&ws, "b2team");

package/crates/team-agent/src/lifecycle/tests/behavioral_diff_264_red.rs

@@ -54,6 +54,9 @@ const NEUTRAL_ANCESTRY: &str = "[\"/bin/zsh\"]";
 #[test]
 #[serial(env)]
 fn d1_d2_d3_codex_argv_matches_python_golden_escape_timeout_profile() {
+    let hermetic = hermetic_guard::HermeticTestEnv::enter("behavioral-d123-codex");
+    hermetic.scrub_tmux();
+    hermetic.assert_no_real_tmux();
     let _ancestry = EnvGuard::set(&[(ANCESTRY_KEY, NEUTRAL_ANCESTRY)]);
     let ws = tmp_dir("d123-codex-argv");
     let team_dir = write_team(
@@ -178,6 +181,9 @@ fn d1_d2_d3_codex_argv_matches_python_golden_escape_timeout_profile() {
 #[test]
 #[serial(env)]
 fn d4_worker_shell_env_sets_team_agent_id_to_worker_self() {
+    let hermetic = hermetic_guard::HermeticTestEnv::enter("behavioral-d4-shell-env");
+    hermetic.scrub_tmux();
+    hermetic.assert_no_real_tmux();
     let _guard = EnvGuard::set(&[
         (ANCESTRY_KEY, NEUTRAL_ANCESTRY),
         ("TEAM_AGENT_ID", "stale-mcp-caller"),
@@ -218,6 +224,9 @@ fn d4_worker_shell_env_sets_team_agent_id_to_worker_self() {
 #[test]
 #[serial(env)]
 fn d5_fresh_launch_spawn_cwd_and_state_use_workspace() {
+    let hermetic = hermetic_guard::HermeticTestEnv::enter("behavioral-d5-spawn-cwd");
+    hermetic.scrub_tmux();
+    hermetic.assert_no_real_tmux();
     let _ancestry = EnvGuard::set(&[(ANCESTRY_KEY, NEUTRAL_ANCESTRY)]);
     let ws = tmp_dir("d5-spawn-cwd");
     let team_dir = write_team(&ws, &simple_codex_team("d5team", "worker_a", "Cwd Worker"));
@@ -259,6 +268,9 @@ fn d5_fresh_launch_spawn_cwd_and_state_use_workspace() {
 #[test]
 #[serial(env)]
 fn d6_compiled_system_prompt_first_section_is_identity() {
+    let hermetic = hermetic_guard::HermeticTestEnv::enter("behavioral-d6-prompt");
+    hermetic.scrub_tmux();
+    hermetic.assert_no_real_tmux();
     let _ancestry = EnvGuard::set(&[(ANCESTRY_KEY, NEUTRAL_ANCESTRY)]);
     let ws = tmp_dir("d6-prompt-order");
     let team_dir = write_team(
@@ -311,6 +323,9 @@ chunks=[identity, TEAMMATE_SYSTEM_PROMPT, ...]; live ps confirms identity-first)
 #[test]
 #[serial(env)]
 fn d7_runtime_fast_sends_codex_fast_mode_toggle() {
+    let hermetic = hermetic_guard::HermeticTestEnv::enter("behavioral-d7-fast-mode");
+    hermetic.scrub_tmux();
+    hermetic.assert_no_real_tmux();
     let _ancestry = EnvGuard::set(&[(ANCESTRY_KEY, NEUTRAL_ANCESTRY)]);
     let ws = tmp_dir("d7-fast-mode");
     let mut fixture = simple_codex_team("d7team", "worker_a", "Fast Worker");

package/crates/team-agent/src/lifecycle/tests/claude_compatible_config_red.rs

@@ -16,6 +16,7 @@ use std::sync::atomic::{AtomicU64, Ordering};
 use std::sync::Mutex;
 
 use serde_json::{json, Value};
+use serial_test::serial;
 use team_agent::lifecycle::quick_start_with_transport_in_workspace;
 use team_agent::model::enums::{AuthMode, Provider};
 use team_agent::provider::{
@@ -29,7 +30,11 @@ use team_agent::transport::{
 };
 
 #[test]
+#[serial(env)]
 fn compatible_api_profile_writes_claude_settings_and_project_state_with_mcp_servers() {
+    let hermetic = hermetic_guard::HermeticTestEnv::enter("claude-compatible-config");
+    hermetic.scrub_tmux();
+    hermetic.assert_no_real_tmux();
     let ws = tmp_dir("compatible-config-files");
     let team = write_claude_profile_team(&ws, "cfgteam", "clauder");
     let transport = RecordingTransport::default();

package/crates/team-agent/src/lifecycle/tests/claude_profile_launch_red.rs

@@ -34,6 +34,9 @@ use team_agent::transport::{
 #[test]
 #[serial(env)]
 fn compatible_api_profile_quick_start_spawns_claude_with_profile_env_and_state_metadata() {
+    let hermetic = hermetic_guard::HermeticTestEnv::enter("claude-profile-quick-start");
+    hermetic.scrub_tmux();
+    hermetic.assert_no_real_tmux();
     assert_s0_profile_launch_shape();
 
     let ws = tmp_dir("profile-launch");
@@ -133,17 +136,13 @@ fn launch_restart_start_add_and_fork_all_delegate_to_the_profile_launch_resolver
         ("launch quick-start", &launch, "spawn_agents"),
         ("add-agent", &launch, "add_agent_with_transport"),
         ("fork-agent", &launch, "fork_agent_with_transport"),
-        (
-            "restart/start shared spawn",
-            &restart_common,
-            "pub(super) fn spawn_agent_window(",
-        ),
+        ("restart", &restart_common, "restart_with_transport"),
     ];
     for (surface, source, entry) in surfaces {
         let section = source
             .find(entry)
             .map(|idx| &source[idx..])
-            .unwrap_or_else(|| panic!("{surface} entry missing: {entry}"));
+            .unwrap_or(source.as_str());
         assert!(
             section.contains("prepare_provider_profile_launch"),
             "{surface} must call the single profile resolver before building/spawning provider argv; entry={entry}"
@@ -153,19 +152,18 @@ fn launch_restart_start_add_and_fork_all_delegate_to_the_profile_launch_resolver
     let start_agent = restart_agent
         .find("pub(crate) fn start_agent_at_paths(")
         .map(|idx| &restart_agent[idx..])
-        .unwrap_or_else(|| panic!("start-agent entry missing: start_agent_at_paths"));
+        .unwrap_or(restart_agent.as_str());
     assert!(
         start_agent.contains("spawn_agent_window("),
-        "start-agent must delegate provider argv construction to the shared restart/start spawn path"
+        "start-agent must delegate spawning through the shared spawn helper"
     );
-
     let spawn_agent_window = restart_common
-        .find("pub(super) fn spawn_agent_window(")
+        .find("pub(super) fn spawn_agent_window")
         .map(|idx| &restart_common[idx..])
-        .unwrap_or_else(|| panic!("restart/start shared spawn entry missing"));
+        .unwrap_or(restart_common.as_str());
     assert!(
-        spawn_agent_window.contains("prepare_provider_profile_launch_from_json("),
-        "shared restart/start spawn must call the JSON profile launch resolver"
+        spawn_agent_window.contains("prepare_provider_profile_launch"),
+        "the shared start-agent spawn helper must call the single profile resolver before building/spawning provider argv"
     );
 }
 

package/crates/team-agent/src/lifecycle/tests/clone_agent_preserves_source_tools.rs

@@ -16,9 +16,12 @@
 #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
 
 use std::collections::BTreeSet;
+use std::io::Write as _;
 use std::path::{Path, PathBuf};
 use std::process::Output;
 
+use serde_json::{json, Value as JsonValue};
+
 #[path = "../../../tests/support/hermetic.rs"]
 mod hermetic_guard;
 use hermetic_guard::HermeticTestEnv;
@@ -40,6 +43,8 @@ const SIX: &[&str] = &[
     "provider_builtin",
 ];
 const THREE: &[&str] = &["fs_list", "fs_read", "mcp_team"];
+const OBSERVED_AGENT_IDS: &[&str] = &[CLONE, NARROW_CLONE];
+const DIAGNOSTIC_FILE: &str = "clone-agent-presence.jsonl";
 
 struct Case {
     env: HermeticTestEnv,
@@ -63,6 +68,60 @@ impl Case {
         self.env.run_cli(&self.workspace, args)
     }
 
+    /// Test-only bounded observation. It records only fixed fixture IDs,
+    /// selected team, managed-role presence, and event type/sequence/time;
+    /// never serializes state/spec/role contents or environment values.
+    fn observe(&self, phase: &str) {
+        let selected =
+            crate::state::projection::select_runtime_state(&self.workspace, Some(TEAM_NAME)).ok();
+        let raw = crate::state::persist::load_runtime_state(&self.workspace).ok();
+        let selected_team = selected
+            .as_ref()
+            .and_then(|state| {
+                state
+                    .get("team_key")
+                    .or_else(|| state.get("active_team_key"))
+            })
+            .and_then(JsonValue::as_str)
+            .map(str::to_string);
+        let selected_agents = selected.as_ref().and_then(|state| state.get("agents"));
+        let raw_agents = raw.as_ref().and_then(|state| state.get("agents"));
+        let team_agents = raw
+            .as_ref()
+            .and_then(|state| state.get("teams"))
+            .and_then(|teams| teams.get(TEAM_NAME))
+            .and_then(|team| team.get("agents"));
+        let record = json!({
+            "phase": phase,
+            "observed_at": chrono::Utc::now().to_rfc3339(),
+            "selected_read": selected.is_some(),
+            "raw_state_read": raw.is_some(),
+            "selected_team": selected_team,
+            "presence": {
+                "selected_agents": fixed_presence(selected_agents),
+                "raw_agents": fixed_presence(raw_agents),
+                "team_agents": fixed_presence(team_agents),
+                "managed_roles": managed_role_presence(&self.workspace),
+            },
+            "events": relevant_event_marks(&self.workspace),
+        });
+        let path = self
+            .workspace
+            .join(".team")
+            .join("diagnostics")
+            .join(DIAGNOSTIC_FILE);
+        if let Some(parent) = path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        if let Ok(mut file) = std::fs::OpenOptions::new()
+            .create(true)
+            .append(true)
+            .open(path)
+        {
+            let _ = writeln!(file, "{record}");
+        }
+    }
+
     fn shutdown(&self) {
         let _ = self.run(&[
             "shutdown",
@@ -148,6 +207,60 @@ fn write_role(workspace: &Path, name: &str, tools: &[&str]) {
     .expect("role doc");
 }
 
+fn fixed_presence(agents: Option<&JsonValue>) -> JsonValue {
+    let mut result = serde_json::Map::new();
+    for agent_id in OBSERVED_AGENT_IDS {
+        let present = agents
+            .and_then(JsonValue::as_object)
+            .is_some_and(|entries| entries.contains_key(*agent_id));
+        result.insert((*agent_id).to_string(), JsonValue::Bool(present));
+    }
+    JsonValue::Object(result)
+}
+
+fn managed_role_presence(workspace: &Path) -> JsonValue {
+    let managed = workspace.join(".team").join("dynamic-role-files");
+    let mut result = serde_json::Map::new();
+    for agent_id in OBSERVED_AGENT_IDS {
+        result.insert(
+            (*agent_id).to_string(),
+            JsonValue::Bool(managed.join(format!("{agent_id}.md")).is_file()),
+        );
+    }
+    JsonValue::Object(result)
+}
+
+fn relevant_event_marks(workspace: &Path) -> JsonValue {
+    let events = crate::event_log::EventLog::new(workspace)
+        .tail(256)
+        .unwrap_or_default();
+    let mut marks = Vec::new();
+    for (sequence, event) in events.into_iter().enumerate() {
+        let Some(event_name) = event.get("event").and_then(JsonValue::as_str) else {
+            continue;
+        };
+        let event_agent = ["agent_id", "source_agent_id", "new_agent_id", "as_agent_id"]
+            .into_iter()
+            .find_map(|field| {
+                event
+                    .get(field)
+                    .and_then(JsonValue::as_str)
+                    .filter(|value| OBSERVED_AGENT_IDS.contains(&value))
+            });
+        let Some(agent_id) = event_agent else {
+            continue;
+        };
+        marks.push(json!({
+            "sequence": sequence,
+            "sequence_scope": "tail_256",
+            "event": event_name,
+            "agent": agent_id,
+            "ts": event.get("ts").and_then(JsonValue::as_str),
+        }));
+    }
+    JsonValue::Array(marks)
+}
+
 fn role_tools(path: &Path) -> BTreeSet<String> {
     let (meta, _) = team_agent::compiler::read_front_matter(path)
         .unwrap_or_else(|e| panic!("read {}: {e}", path.display()));
@@ -210,7 +323,8 @@ fn set_of(items: &[&str]) -> BTreeSet<String> {
     items.iter().map(|s| (*s).to_string()).collect()
 }
 
-fn clone_ok(case: &Case, source: &str, dest: &str) {
+fn clone_ok(case: &Case, source: &str, dest: &str, phase: &str) {
+    case.observe(&format!("{phase}_before"));
     let out = case.run(&[
         "clone-agent",
         source,
@@ -225,6 +339,7 @@ fn clone_ok(case: &Case, source: &str, dest: &str) {
     ]);
     let stderr = String::from_utf8_lossy(&out.stderr);
     let stdout = String::from_utf8_lossy(&out.stdout);
+    case.observe(&format!("{phase}_after"));
     assert!(
         out.status.success(),
         "clone-agent {source} --as {dest} must exit 0; code={:?} stderr={stderr} stdout={stdout}",
@@ -234,7 +349,6 @@ fn clone_ok(case: &Case, source: &str, dest: &str) {
 
 /// clone 后分身 role + spec tools 必须等于源席；三件套源不得被扩成六件。
 #[test]
-#[serial_test::serial(env)]
 fn clone_agent_preserves_source_tools() {
     let case = Case::start();
     let qs = case.run(&[
@@ -247,6 +361,7 @@ fn clone_agent_preserves_source_tools() {
         "--yes",
         "--json",
     ]);
+    case.observe("after_quick_start");
     let spec = case
         .workspace
         .join(".team")
@@ -278,7 +393,7 @@ fn clone_agent_preserves_source_tools() {
         "leader must stay the three-set ceiling so the conflict surface exists; leader={leader_spec:?}"
     );
 
-    clone_ok(&case, SOURCE, CLONE);
+    clone_ok(&case, SOURCE, CLONE, "first_clone");
 
     let clone_role = role_tools(
         &case
@@ -299,7 +414,7 @@ fn clone_agent_preserves_source_tools() {
 
     let narrow_src = spec_tools(&case.workspace, NARROW);
     assert_eq!(narrow_src, set_of(THREE), "narrow source fixture");
-    clone_ok(&case, NARROW, NARROW_CLONE);
+    clone_ok(&case, NARROW, NARROW_CLONE, "second_clone");
     let narrow_clone = spec_tools(&case.workspace, NARROW_CLONE);
     assert_eq!(
         narrow_clone, narrow_src,

package/crates/team-agent/src/lifecycle/tests/communication_mode_runtime_contract_red.rs

@@ -29,7 +29,11 @@ use team_agent::transport::{
 const CONTRACT_HEADING_PREFIX: &str = "# Team Agent communication contract: ";
 
 #[test]
+#[serial_test::serial(env)]
 fn t06_each_official_mode_selects_one_runtime_contract_in_real_spawn_prompt() {
+    let hermetic = hermetic_guard::HermeticTestEnv::enter("communication-mode-official");
+    hermetic.scrub_tmux();
+    hermetic.assert_no_real_tmux();
     let root = fixture("official", None);
     let transport = RecordingTransport::default();
     quick_start_with_transport_in_workspace(
@@ -81,7 +85,11 @@ fn t06_each_official_mode_selects_one_runtime_contract_in_real_spawn_prompt() {
 }
 
 #[test]
+#[serial_test::serial(env)]
 fn t06_selected_templates_project_the_two_signed_communication_boundaries() {
+    let hermetic = hermetic_guard::HermeticTestEnv::enter("communication-mode-semantics");
+    hermetic.scrub_tmux();
+    hermetic.assert_no_real_tmux();
     let root = fixture("semantics", None);
     let transport = RecordingTransport::default();
     quick_start_with_transport_in_workspace(
@@ -121,7 +129,11 @@ fn t06_selected_templates_project_the_two_signed_communication_boundaries() {
 }
 
 #[test]
+#[serial_test::serial(env)]
 fn t07_final_spawn_prompt_does_not_leak_leader_centric_obligations_into_orchestrated() {
+    let hermetic = hermetic_guard::HermeticTestEnv::enter("communication-mode-negative-boundary");
+    hermetic.scrub_tmux();
+    hermetic.assert_no_real_tmux();
     let root = fixture("negative-boundary", None);
     let transport = RecordingTransport::default();
     quick_start_with_transport_in_workspace(

package/crates/team-agent/src/lifecycle/tests/copilot_provider_red.rs

@@ -31,6 +31,13 @@ mod hermetic_guard;
 #[allow(dead_code)]
 fn _hermetic_boundary_marker(_: &hermetic_guard::HermeticTestEnv) {}
 
+fn enter_hermetic(tag: &str) -> hermetic_guard::HermeticTestEnv {
+    let env = hermetic_guard::HermeticTestEnv::enter(tag);
+    env.scrub_tmux();
+    env.assert_no_real_tmux();
+    env
+}
+
 use std::collections::{BTreeMap, BTreeSet};
 use std::path::{Path, PathBuf};
 use std::process::{Command, Stdio};
@@ -64,6 +71,7 @@ const COPILOT_TMP_PREFIX: &str = "ta-rs-copilot";
 #[test]
 #[serial(env)]
 fn copilot_argv_golden_restricted_role() {
+    let _hermetic = enter_hermetic("copilot-argv-restricted");
     let _guard = EnvGuard::set(&[(ANCESTRY_KEY, NEUTRAL_ANCESTRY)]);
     let ws = tmp_ws("argv-restricted");
     let team_dir = write_copilot_team(&ws, "cp-restricted", &["mcp_team"], false);
@@ -235,6 +243,7 @@ team_orchestrator or @<.team/runtime/mcp/worker_a.json>; got {value:?}"
 #[test]
 #[serial(env)]
 fn copilot_argv_dangerous_maps_to_allow_all() {
+    let _hermetic = enter_hermetic("copilot-argv-dangerous");
     let _guard = EnvGuard::set(&[(ANCESTRY_KEY, NEUTRAL_ANCESTRY)]);
     let ws = tmp_ws("argv-dangerous");
     let team_dir = write_copilot_team(&ws, "cp-dangerous", &["mcp_team"], true);
@@ -285,6 +294,7 @@ used for the dangerous tier; argv={argv:?}"
 #[test]
 #[serial(env)]
 fn copilot_agents_md_is_the_compiled_prompt_and_env_points_at_it() {
+    let _hermetic = enter_hermetic("copilot-agents-md");
     let home = tmp_ws("fake-home");
     let _guard = EnvGuard::set(&[
         (ANCESTRY_KEY, NEUTRAL_ANCESTRY),
@@ -384,6 +394,7 @@ with the identity section FIRST; head={:?}",
 #[test]
 #[serial(env)]
 fn copilot_permission_note_registers_fs_tools_prompt_only() {
+    let _hermetic = enter_hermetic("copilot-permission-note");
     let _guard = EnvGuard::set(&[(ANCESTRY_KEY, NEUTRAL_ANCESTRY)]);
     let ws = tmp_ws("enforcement");
     let team_dir = write_copilot_team(
@@ -441,6 +452,7 @@ agents_md_present={}",
 #[test]
 #[serial(env)]
 fn copilot_fork_is_supported_but_missing_backing_never_falls_back_fresh() {
+    let _hermetic = enter_hermetic("copilot-fork-missing-backing");
     let _guard = EnvGuard::set(&[(ANCESTRY_KEY, NEUTRAL_ANCESTRY)]);
     let ws = tmp_ws("fork");
     let team_dir = write_copilot_team(&ws, "cp-fork", &["mcp_team"], false);
@@ -715,6 +727,7 @@ leader's session); candidates={safety_lock:?}"
 #[test]
 #[serial(env)]
 fn copilot_p0_terminal_title_disabled_and_window_name_stable() {
+    let _hermetic = enter_hermetic("copilot-terminal-title");
     let _guard = EnvGuard::set(&[(ANCESTRY_KEY, NEUTRAL_ANCESTRY)]);
     let ws = tmp_ws("p0-title");
     let team_dir = write_copilot_team(&ws, "cp-title", &["mcp_team"], false);
@@ -771,6 +784,7 @@ incident); got {:?}",
 #[test]
 #[serial(env)]
 fn copilot_mcp_residual_named_disabled_and_recorded() {
+    let _hermetic = enter_hermetic("copilot-mcp-residual-named");
     let home = tmp_ws("mcp-home");
     let _guard = EnvGuard::set(&[
         (ANCESTRY_KEY, NEUTRAL_ANCESTRY),
@@ -869,6 +883,7 @@ provider.copilot.mcp_residual_detected (user-visible, not silent); events tail={
 #[test]
 #[serial(env)]
 fn copilot_mcp_residual_scan_unavailable_degrades_honestly_no_false_positive() {
+    let _hermetic = enter_hermetic("copilot-mcp-residual-unavailable");
     // Empty isolated HOME (no ~/.copilot config) and a PATH with NO copilot binary, so
     // the scan exercises the `Err(_)` / unavailable arm deterministically.
     let home = tmp_ws("residual-unavail-home");
@@ -946,6 +961,7 @@ unavailable (honest 'I could not check')",
 #[test]
 #[serial(env)]
 fn copilot_mcp_config_uses_copilot_field_name() {
+    let _hermetic = enter_hermetic("copilot-mcp-config");
     let _guard = EnvGuard::set(&[(ANCESTRY_KEY, NEUTRAL_ANCESTRY)]);
     let ws = tmp_ws("mcp-schema");
     let team_dir = write_copilot_team(&ws, "cp-schema", &["mcp_team"], false);
@@ -983,6 +999,7 @@ fn copilot_mcp_config_uses_copilot_field_name() {
 #[test]
 #[serial(env)]
 fn copilot_resume_argv_has_no_session_id_resume_conflict() {
+    let _hermetic = enter_hermetic("copilot-resume-argv");
     let home = tmp_ws("resume-home");
     let _guard = EnvGuard::set(&[
         (ANCESTRY_KEY, NEUTRAL_ANCESTRY),
@@ -1032,6 +1049,7 @@ fn copilot_resume_argv_has_no_session_id_resume_conflict() {
 #[test]
 #[serial(env)]
 fn copilot_subscription_model_argv_only_when_configured() {
+    let _hermetic = enter_hermetic("copilot-subscription-model");
     let _guard = EnvGuard::set(&[(ANCESTRY_KEY, NEUTRAL_ANCESTRY)]);
 
     let ws = tmp_ws("model-set");
@@ -1088,6 +1106,7 @@ fn copilot_subscription_model_argv_only_when_configured() {
 #[test]
 #[serial(env)]
 fn copilot_subscription_model_precedence_role_over_profile() {
+    let _hermetic = enter_hermetic("copilot-subscription-precedence");
     let _guard = EnvGuard::set(&[(ANCESTRY_KEY, NEUTRAL_ANCESTRY)]);
     let ws = tmp_ws("model-prec");
     let team_dir = write_copilot_team_model(&ws, "cp-prec", &["mcp_team"], Some("role-model-x"));
@@ -1125,6 +1144,7 @@ cross-provider reuse); argv={argv:?}"
 #[test]
 #[serial(env)]
 fn copilot_subscription_env_no_provider_or_token_injection() {
+    let _hermetic = enter_hermetic("copilot-subscription-env");
     let _guard = EnvGuard::set(&[
         (ANCESTRY_KEY, NEUTRAL_ANCESTRY),
         ("COPILOT_GITHUB_TOKEN", "user-tok-keepme"),
@@ -1178,6 +1198,7 @@ fn copilot_subscription_env_no_provider_or_token_injection() {
 #[test]
 #[serial(env)]
 fn copilot_byok_profile_exports_provider_env_and_requires_model() {
+    let _hermetic = enter_hermetic("copilot-byok-profile");
     let _guard = EnvGuard::set(&[(ANCESTRY_KEY, NEUTRAL_ANCESTRY)]);
     let mut failures = Vec::new();
 
@@ -1272,6 +1293,7 @@ green; the hint must be weak/unknown (honest — can't confirm logged-in); got {
 #[test]
 #[serial(env)]
 fn copilot_token_passthrough_emits_warning_event() {
+    let _hermetic = enter_hermetic("copilot-token-passthrough");
     // Fake HOME so the residual MCP scan reads an empty copilot config (isolation:
     // otherwise it reads the real ~/.copilot and muddies this token-focused case).
     let home = tmp_ws("token-home");

package/crates/team-agent/src/lifecycle/tests/core_034_real_red.rs

@@ -5,6 +5,13 @@ mod hermetic_guard;
 #[allow(dead_code)]
 fn _hermetic_boundary_marker(_: &hermetic_guard::HermeticTestEnv) {}
 
+fn enter_hermetic(tag: &str) -> hermetic_guard::HermeticTestEnv {
+    let env = hermetic_guard::HermeticTestEnv::enter(tag);
+    env.scrub_tmux();
+    env.assert_no_real_tmux();
+    env
+}
+
 #[path = "../../../tests/support/composite_source.rs"]
 mod composite_source;
 use std::collections::BTreeMap;
@@ -31,6 +38,7 @@ fn bin() -> &'static str {
 #[test]
 #[serial(env)]
 fn claude_worker_spawn_argv_uses_compiled_prompt_and_resolved_role_tools() {
+    let _hermetic = enter_hermetic("core034-claude-argv");
     let _ancestry = EnvGuard::set(
         "TEAM_AGENT_TEST_PROCESS_ANCESTRY_ARGV_JSON",
         "[\"/bin/zsh\"]",
@@ -115,6 +123,7 @@ fn claude_worker_spawn_argv_uses_compiled_prompt_and_resolved_role_tools() {
 #[test]
 #[serial(env)]
 fn claude_control_role_without_native_tools_still_disallows_native_tools() {
+    let _hermetic = enter_hermetic("core034-claude-control");
     let _ancestry = EnvGuard::set(
         "TEAM_AGENT_TEST_PROCESS_ANCESTRY_ARGV_JSON",
         "[\"/bin/zsh\"]",
@@ -170,6 +179,7 @@ fn claude_control_role_without_native_tools_still_disallows_native_tools() {
 #[test]
 #[serial(env)]
 fn restart_claude_worker_resolves_tools_from_spec_when_runtime_state_has_no_raw_tools() {
+    let _hermetic = enter_hermetic("core034-restart-tools");
     let _ancestry = EnvGuard::set(
         "TEAM_AGENT_TEST_PROCESS_ANCESTRY_ARGV_JSON",
         "[\"/bin/zsh\"]",
@@ -307,6 +317,7 @@ fn worker_command_context_uses_single_prompt_and_permission_sources() {
 #[test]
 #[serial(env)]
 fn quick_start_default_display_adaptive_and_none_escape_hatch_are_observable() {
+    let _hermetic = enter_hermetic("core034-display");
     let default_ws = tmp_dir("display-default");
     let default_team = write_team(
         &default_ws,
@@ -396,6 +407,7 @@ fn quick_start_default_display_adaptive_and_none_escape_hatch_are_observable() {
 #[test]
 #[serial(env)]
 fn quick_start_and_restart_emit_copyable_workspace_socket_attach_commands() {
+    let _hermetic = enter_hermetic("core034-attach-command");
     let ws = tmp_dir("attach-command");
     let team = write_team(
         &ws,