From 2c767867ca021c969507ea6db9e792a4d02f147f Mon Sep 17 00:00:00 2001
From: weichen <weichen@home.local>
Date: Mon, 12 Oct 2026 14:36:32 +0000
Subject: [PATCH] Hard-disable RDM exec tools in realcombo tests

Why: CI runners lack bwrap, so the real RDM binary refuses to start
under the sandbox fail-closed policy (run 2607: serve exits right after
launch); the product provides RDM_DISABLE_EXEC_TOOLS as the top-level
fallback and lifecycle semantics under test are unchanged.
Evidence: local rerun with the env set stays green.
Impact: tests only.
---
 tests/test_svc_realcombo.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tests/test_svc_realcombo.py b/tests/test_svc_realcombo.py
index 27c2a6d3..b1d3cad4 100644
--- a/tests/test_svc_realcombo.py
+++ b/tests/test_svc_realcombo.py
@@ -70,6 +70,9 @@ class RealComboTests(tsr.SvcAutoRecoverTests):
             return False
 
     def seed_real(self, name, port, binary):
+        # CI 运行器无 bwrap：RDM 沙箱 fail-closed 会拒启——硬关 exec 工具
+        #（产品提供的最高兜底，RDM_DISABLE_EXEC_TOOLS=1）后生命周期语义不变。
+        self.env["RDM_DISABLE_EXEC_TOOLS"] = "1"
         d = self.runtime(name)
         (d / "bin").mkdir(parents=True, exist_ok=True)
         (d / "data").mkdir(exist_ok=True)
@@ -150,6 +153,7 @@ class RealComboTests(tsr.SvcAutoRecoverTests):
         """全轨：materialize（真实 make build）→ 候选身份门禁 → release 切换 →
         伴生工作台 200 → 裸重启稳定。"""
         env = dict(self.env)
+        env["RDM_DISABLE_EXEC_TOOLS"] = "1"
         env.update({"SVC_RDM_SRC_DIR": str(self.root / "rdmcache"),
                     "SVC_RDM_ORIGIN": RDM_ORIGIN})
         result = self.svc("rcf", "deploy", "--from", "rdm", "--port", "9474", env=env)