Edit Issue - .issue.db

Title *

Description

EARS SPEC:
- When the mypy ratchet finds a file over its baseline, the ratchet shall print every mypy error line for that file, so CI logs name each regression.
- The highway tests job shall pass the mypy ratchet with no file over its baseline, and the baseline shall not be raised to absorb new errors; regressions are fixed in code.
- When a file's mypy count drops below its baseline, the baseline entry shall be lowered to the new count (logs_activities.py 5->4, mcp_client/__init__.py 5->2, storage_service_uploads.py 5->4).
- If the CI process is root without CAP_DAC_OVERRIDE, then test_file_owned_by_another_user_is_refused shall still reach the ownership check and see 'not owned by uid'.
- read_platform_secret_file shall keep checking ownership with fstat on the opened descriptor (no stat-before-open).

EVIDENCE (red): pipeline 3806 job 13872 'mypy ratchet: 132 errors in 54 files now, baseline 118 in 46 files: FAIL'; pipeline 3807 job 13874 '1 failed, 921 passed, 5 skipped', expected 'not owned by uid', got 'cannot be opened: PermissionError'.

SYNTHESIS: localised CI/test fix, no new component. Domain: POSIX discretionary access control. Root without CAP_DAC_OVERRIDE reads a foreign-owned file only through the 'other' permission bits, so the test makes the foreign-owned file other-readable; the uid check runs before the mode check, so the ownership error is reported. Rejected: stat-before-open in the reader (ci-conductor option 1) because it reopens a TOCTOU window; skipping the test under root (option 2) because CI is the only place it runs as root and it would never be exercised there.

Due Date (YYYY-MM-DD)

Tags (comma separated)

Related Issues (IDs)

Enter IDs of issues related to this one. They will be linked as 'related'.

Edit Issue #1054