From 7f975b95ad39096463a7548bd6be0dbb387cb61b Mon Sep 17 00:00:00 2001
From: ms-lead-reviewer <reviewer@mosaic.local>
Date: Sat, 18 Jul 2026 16:34:36 -0500
Subject: [PATCH] test(827): scrub D4 fixture credentials

---
 .../probes/p3_d4_focused_run.py               | 39 ++++++++++++-------
 .../probes/p3_generation_broker.py            | 16 --------
 2 files changed, 26 insertions(+), 29 deletions(-)

diff --git a/docs/compaction-refresh/probes/p3_d4_focused_run.py b/docs/compaction-refresh/probes/p3_d4_focused_run.py
index a29641c..71d8673 100644
--- a/docs/compaction-refresh/probes/p3_d4_focused_run.py
+++ b/docs/compaction-refresh/probes/p3_d4_focused_run.py
@@ -464,6 +464,16 @@ def isolated_environment(
     return environment
 
 
+def scrub_fixture_credentials(root: Path) -> None:
+    """Remove the copied Pi credential/config subtree before retaining evidence."""
+
+    copied_agent = root / "home" / ".pi" / "agent"
+    if copied_agent.exists():
+        shutil.rmtree(copied_agent)
+    if copied_agent.exists():
+        raise RuntimeError("D4 credential scrub failed")
+
+
 def run_once(index: int) -> Path:
     root = Path(tempfile.mkdtemp(prefix=f"gate0-d4-{index}-"))
     workspace = root / "workspace"
@@ -475,11 +485,11 @@ def run_once(index: int) -> Path:
     pi_log = root / "pi.jsonl"
     extension = root / "d4_extension.ts"
     write_extension(extension)
-    environment = isolated_environment(root, index, workspace, socket_path, pi_log)
     broker: subprocess.Popen[str] | None = None
     pi: PiRpc | None = None
 
     try:
+        environment = isolated_environment(root, index, workspace, socket_path, pi_log)
         # Must run before the fixture broker or Pi process is launched. It proves
         # the launcher registers before exec and can only read this fixture socket.
         gated_launcher_precondition(root, socket_path, environment)
@@ -570,19 +580,22 @@ def run_once(index: int) -> Path:
         raise
     finally:
         try:
-            if pi is not None:
-                pi.close()
+            try:
+                if pi is not None:
+                    pi.close()
+            finally:
+                if broker is not None:
+                    try:
+                        request(socket_path, {"action": "shutdown-broker"})
+                    except OSError:
+                        pass
+                    try:
+                        broker.wait(timeout=5)
+                    except subprocess.TimeoutExpired:
+                        broker.kill()
+                        broker.wait()
         finally:
-            if broker is not None:
-                try:
-                    request(socket_path, {"action": "shutdown-broker"})
-                except OSError:
-                    pass
-                try:
-                    broker.wait(timeout=5)
-                except subprocess.TimeoutExpired:
-                    broker.kill()
-                    broker.wait()
+            scrub_fixture_credentials(root)
     return root
 
 
diff --git a/docs/compaction-refresh/probes/p3_generation_broker.py b/docs/compaction-refresh/probes/p3_generation_broker.py
index 4dce478..b90dd33 100644
--- a/docs/compaction-refresh/probes/p3_generation_broker.py
+++ b/docs/compaction-refresh/probes/p3_generation_broker.py
@@ -176,22 +176,6 @@ def main() -> None:
                 emit(log_path, record)
                 conn.sendall((json.dumps(record, sort_keys=True) + "\n").encode())
                 continue
-            if request.get("action") == "source-invalid":
-                old_lease = lease_state.get(identity, "NONE")
-                lease_state[identity] = "REVOKED"
-                record = {
-                    "event": "source_invalidation_revoke",
-                    "peercred": {"pid": pid, "uid": uid, "gid": gid},
-                    "starttime_ticks": starttime,
-                    "generation": generations.get(identity, 0),
-                    "source_reason": request.get("reason"),
-                    "prior_lease": old_lease,
-                    "new_lease_state": "REVOKED",
-                    "promotion": False,
-                }
-                emit(log_path, record)
-                conn.sendall((json.dumps(record, sort_keys=True) + "\n").encode())
-                continue
             if request.get("action") != "lifecycle":
                 conn.sendall(b'{"ok":false,"reason":"invalid-action"}\n')
                 continue