test(827): scrub D4 fixture credentials

docs/compaction-refresh/probes/p3_d4_focused_run.py

@@ -464,6 +464,16 @@ def isolated_environment(
     return environment
 
 
+def scrub_fixture_credentials(root: Path) -> None:
+    """Remove the copied Pi credential/config subtree before retaining evidence."""
+
+    copied_agent = root / "home" / ".pi" / "agent"
+    if copied_agent.exists():
+        shutil.rmtree(copied_agent)
+    if copied_agent.exists():
+        raise RuntimeError("D4 credential scrub failed")
+
+
 def run_once(index: int) -> Path:
     root = Path(tempfile.mkdtemp(prefix=f"gate0-d4-{index}-"))
     workspace = root / "workspace"
@@ -475,11 +485,11 @@ def run_once(index: int) -> Path:
     pi_log = root / "pi.jsonl"
     extension = root / "d4_extension.ts"
     write_extension(extension)
-    environment = isolated_environment(root, index, workspace, socket_path, pi_log)
     broker: subprocess.Popen[str] | None = None
     pi: PiRpc | None = None
 
     try:
+        environment = isolated_environment(root, index, workspace, socket_path, pi_log)
         # Must run before the fixture broker or Pi process is launched. It proves
         # the launcher registers before exec and can only read this fixture socket.
         gated_launcher_precondition(root, socket_path, environment)
@@ -570,19 +580,22 @@ def run_once(index: int) -> Path:
         raise
     finally:
         try:
-            if pi is not None:
-                pi.close()
+            try:
+                if pi is not None:
+                    pi.close()
+            finally:
+                if broker is not None:
+                    try:
+                        request(socket_path, {"action": "shutdown-broker"})
+                    except OSError:
+                        pass
+                    try:
+                        broker.wait(timeout=5)
+                    except subprocess.TimeoutExpired:
+                        broker.kill()
+                        broker.wait()
         finally:
-            if broker is not None:
-                try:
-                    request(socket_path, {"action": "shutdown-broker"})
-                except OSError:
-                    pass
-                try:
-                    broker.wait(timeout=5)
-                except subprocess.TimeoutExpired:
-                    broker.kill()
-                    broker.wait()
+            scrub_fixture_credentials(root)
     return root