[mremond]

Why

Prevent another local user from redirecting native test compilation or replacing test executables.

What changed

• Give every native test executable fresh private storage until execution finishes.
• Reject unsafe Unix temporary roots and use a protected home directory when available.
• Clean up private storage after successful tests, compilation errors, crashes and timeouts.

Before and after

Before: A planted directory symlink redirected two real test executables into directories with mode 0777.

After: The adversarial regression passed 17 scenarios and observed 13 distinct mode-0700 executable directories with no leaks.

This changes temporary executable storage, not the test interface; linker-boundary transcripts verify the filesystem behavior.

Checked

Live validation: Demonstrated for this version. 4 of 4 scenarios driven live in the product.

Scenario	Result	Evidence
Fresh private storage under a permissive umask and pre-planted paths.	✅ Passed live	Real native linker observations confirmed distinct owner-owned mode-0700 directories; planted entries stayed untouched in single-account Unix fixtures.
Preserve outcomes and remove executable storage after handled results.	✅ Passed live	Success, compile failure, crash, timeout and output mismatch returned expected results with no directory leaks; skip/list invoked no linker.
Use protected storage ancestry or fail before compilation.	✅ Passed live	Sticky temp roots and protected-home fallback worked; unsafe home ancestry failed before linking and temp aliases resolved to canonical paths.
Use private storage without breaking project-relative EUnit fixtures.	✅ Passed live	Native driver execution completed and read the relative fixture using a local EUnit stand-in; private fallback, refusal and cleanup passed.

• Local Rust workspace tests: 2,163 passed, zero failed and one ignored.
• Strict workspace lint: Passed with warnings denied.
• Local native Erlang suite: 487 passed, zero failed and two expected skips.
• Allocator and uncaught-stacktrace probes: Both passed.
• Change-map tests and independent reviews: All 26 tests passed; independent code, repair and proof reviews passed.

How it was checked

Built the runtime before the compiler using cargo build --release --locked for each package.

Ran python3 scripts/test-test-storage.py with disposable fixtures, an isolated HOME and an aliased temporary parent.

Ran cargo clippy --workspace --all-targets --locked -- -D warnings and cargo test --workspace --locked --no-fail-fast.

Ran ./target/release/nera test -j 1 --timeout 30, scripts/test-allocator-config.py and scripts/test-stacktrace-order.py.

Corrected duplicate EUnit fixture sources and a macOS temporary-path comparison; the complete aliased-parent rerun passed all 17 cases.

Risk

Risk above low: Novelty, medium — Adds a storage helper using existing ancestry checks and temporary-directory guards.

Full risk assessment

Dimension	Level	Why
Blast radius	low	Only native test storage and its verification paths change.
Behavior	low	Corrects unsafe executable storage while preserving test working directories.
Undo	low	Reverting the change requires no data or settings migration.
Evidence	low	Real native compilation and execution covered hostile paths and cleanup.
Sensitivity	low	Uses disposable test files without sign-ins or persistent user data.
Novelty	medium	Adds a storage helper using existing ancestry checks and temporary-directory guards.
Dependencies	low	No dependency additions or updates.

Not done

Native multi-account Unix access checks and Windows ACL behavior were not exercised.

EUnit storage verification used a local framework stand-in rather than external OTP sources.

Pipeline

Updates from git push no-mistakes

Infinitary checked this version: an independent review that also judged the documents, and live validation the review accepted.