pub fn run_bounded_gate_command(cwd: &Path, command: &str) -> (bool, String)Expand description
Execute one repository-owned merge gate with the same process-tree timeout
used by validation-contract commands, but with a deliberately small
inherited environment. This synchronous wrapper is intended for a
spawn_blocking thread; it owns a current-thread runtime so the robust
async timeout/kill implementation remains the single source of truth.
The gate env intentionally retains ambient HOME/CI/temp dirs (the
operator’s toolchain shape — see agent_env’s module doc), but NOT the
ambient CARGO_HOME: gate commands execute worker-authored build scripts
and test binaries engine-side, and the real Cargo root carries registry
credentials and credential-provider config.
It is replaced with a fresh cache-only home (registry/git seeded as
per-env copies — clonefile/reflink/plain — never credentials;
[crate::agent_env::cache_only_cargo_home]) over a temp scratch that
self-cleans when the gate returns. The
substitution FAILS CLOSED: no scratch, no gate run — running with the
ambient Cargo root is the hole this exists to close.
This is the UNSANDBOXED executor — today’s exact behavior, kept for the
enforce == off posture. When the merged mission’s
worker.sandbox.enforce is not off, the server routes to
run_bounded_gate_command_sandboxed instead.