Real-git integration coverage for the FM provisioning chain (default clone seam)

Context

The Fleet Manager repo-provisioning chain (deriveAgentRepoPath → inspectAgentRepo → provisionAgentRepo → ensureAgentRepo, #13145 / #13148 / #13155 / #13162) is unit-tested via the injectable cloneRepo stub — by design, so the contract tests run without a git binary. But the default seam is a real git clone (provisionAgentRepo.gitClone → execFile('git', ['clone', '--', cloneUrl, repoPath])), and that production path has zero coverage. The #13162 commit explicitly flagged this follow-up: "a real-git integration test vs a bare-repo fixture (the un-injected default seam)." This ticket is that test.

The Problem

The stub models the clone/reuse/conflict contract; it cannot catch a divergence between the modeled contract and real git's behavior. The highest-risk divergence — does git clone create the intermediate <agent>/ leading directory that deriveAgentRepoPath's <root>/<agent>/<repo> layout implies? — was probed empirically (git 2.53.0 → yes, leading dirs created, exit 0), but nothing guards that behavior against regression, and the reuse-no-clobber + conflict-fail-closed paths are likewise unverified against actual git. The provisioning chain is load-bearing: if its production clone path silently breaks, no agent can be provisioned.

The Architectural Reality

• ai/services/fleet/provisionAgentRepo.mjs — gitClone(cloneUrl, repoPath) = execFileAsync('git', ['clone', '--', cloneUrl, repoPath]), the default cloneRepo.
• ai/services/fleet/ensureAgentRepo.mjs — composes the chain; with the un-injected seam it runs real git end-to-end.
• Real-git-in-temp-dir is an established test idiom here (check-branch-discipline.spec / check-chore-sync.spec: mkdtempSync + git init + git config user.* + execFileSync('git', …)).

The Fix

• test/playwright/unit/ai/ensureAgentRepoGit.integration.spec.mjs (new): a real-git fixture (a temp source repo with one commit) + a temp managedRoot, exercising ensureAgentRepo with the default seam (no cloneRepo injected):
  • absent path → real git clone: the derived checkout exists with a real .git + the source content, the leading <agent>/ dir was created, {cloned: true, action: 'cloned'};
  • re-run over the checkout → {cloned: false, action: 'reused'}, a written marker survives (no re-clone clobber);
  • a foreign occupant pre-placed at the derived path → conflict throw, the foreign content survives (never clobbered).

No production-code change expected (the probe shows the clone path is sound); if the integration run surfaces a real-git/stub divergence, the fix lands here with the test that caught it.

Contract Ledger Matrix

Decision Record impact

none — test-only hardening, aligned-with the #13015 MVP decomposition.

Acceptance Criteria

• Real-git integration spec exercises ensureAgentRepo with the default (un-injected) clone seam.
• Clone case asserts the checkout exists with .git + source content + the created leading dir + {cloned: true}.
• Reuse case asserts {cloned: false, action: 'reused'} and a written marker survives (no clobber).
• Conflict case asserts a throw + the foreign occupant survives.
• Green via the custom unit config; temp dirs cleaned in afterAll; offline (clones a local fixture, no network).

Out of Scope

• Any change to the provisioning contract / chain logic (unless the integration run surfaces a real divergence).
• The turnkey caller / managedRoot config resolution (separate FM control-plane work).
• FleetLifecycleService real-process-spawn integration (a distinct subprocess-coverage concern).

Related

• Parent epic #13015 (FM MVP). The flagged #13162 follow-up; covers provisionAgentRepo (#13155) + ensureAgentRepo (#13162) production paths.

Live latest-open sweep: checked the live tracker + in-flight A2A claims immediately before filing; no equivalent.

Authored by Claude Opus 4.8 (Claude Code), @neo-opus-ada. Origin Session ID: 4c598c8f-d8a7-4288-9420-e825a45d310e Retrieval Hint: "Fleet Manager real-git integration test default clone seam ensureAgentRepo"