Private
Public Access
5-part fix to prevent test data loss outside ./tests/: 1. FR2 (root-cause): remove SLOP_CONFIG env var fallback from src/paths.py 2. --config CLI flag at entry point (sloppy.py for prod, conftest.py for tests) 3. FR1: sys.addaudithook runtime guard blocks writes outside ./tests/ 4. FR3: pytest --basetemp + isolate_workspace migration under ./tests/ 5. FR4: static audit (scripts/audit_test_sandbox_violations.py) + --strict CI gate Opt-in: FR5 Windows restricted-token wrapper (scripts/run_tests_sandboxed.ps1). 13 regression tests in tests/test_test_sandbox.py. Baseline: 1288 passed + 4 xdist-skipped (per result_migration_small_files_20260617). User directive: NO ENV VARS for config path. Use --config CLI flag. Test workspace file naming: config_overrides.toml (per user direction). Hard fail on any sandbox violation. Tests should never need AppData temp. Co-Authored-By: Claude <noreply@anthropic.com>