Share one docker test harness: cov_docker_args ×10, skip_if_no_image ×11 and assert_vex_agent_attested ×8 are copied, and 8 docker suites never honour SOCKET_PATCH_DOCKER_E2E_REQUIRED #1968

[agent] Filed by the scheduled architecture audit (audit-cli-tests). Register: register comment.

Kind: refactor. Register ID: T60.

Problem

Every docker_e2e_*.rs agent suite carries its own copy of the same container scaffolding, even though tests/docker_vendor_common/mod.rs already exports most of it. docker_e2e_npm.rs includes docker_vendor_common and still keeps its own copies. All links are at cbbbdb9.

• cov_docker_args, 10 copies. Nine are byte-identical (md5-checked); the docker_vendor_common one differs only by pub.
  • cargo L37-L52, composer L42-L57,`` deno L55-L70, gem L48-L63, golang L35-L50, maven L47-L62, npm L65-L80, nuget L51-L66, pypi L53-L68, docker_vendor_common L44-L59.```
  • sbt forks it as binary_mounts (sbt L464-L482) and adds SOCKET_PATCH_DOCKER_BIN.
• skip_if_no_image, 11 variants, and the required gate has drifted:
  • 7 copies never read a "required" variable, so they soft-skip whenever the image is missing. They are identical apart from the image name: gem L385-L398, plus cargo L379, composer L355, golang L347, maven L403, nuget L476 and pypi L756. npm's skip_if_no_docker_image (L603-L618) is also ungated.
  • deno gates on SOCKET_PATCH_REQUIRE_DOCKER (deno L497-L524). That variable is set nowhere in the repository, so its comment "CI does this" is false.
  • sbt (L440-L461) and docker_vendor_common (L72-L96) honour SOCKET_PATCH_DOCKER_E2E_REQUIRED=="1".
  • CI exports SOCKET_PATCH_DOCKER_E2E_REQUIRED=1 only inside the sbt) case arm of both docker jobs (ci.yml L945, ci.yml L2332). If the image tag of any other leg drifts from the suite's literal, that leg goes green having asserted nothing, and that includes the vendor capstones whose shared gate does read the variable. The tags match today, so this is a latent hole rather than a test that is vacuous now.
• run_container, 5 copies, identical apart from the image name: composer L370, deno L526, gem L400, nuget L533, pypi L813. pypi's copy has an unused _api_url parameter. cargo, golang and maven inline the same docker run instead (for example cargo L402-L416).`````
• assert_vex_agent_attested, 8 byte-identical 34-line copies (md5-checked): cargo L334-L367, composer L390, gem L420, golang L306, maven L362, npm L718, nuget L498, pypi L778. vex_e2e_common::assert_attested with Marker::Applied already does this check, and more strictly.
• The in-container git-blob hasher, 4 copies:
  • GIT_SHA256_FN is byte-identical in cargo L130, golang L126 and maven L140.
  • docker_vendor_common::git_blob_sha (L250-L259) is the only copy that fails on a missing file. The others hash a bare header.
  • npm prepends that prelude and then redefines its own git_sha256 anyway (L868).
• A plain sha256 helper, 4 copies, in suites that already include common: plain_sha256 in composer L63, gem L69 and nuget L71, and sha256_hex in pypi L75. This is the same pattern as Use tests/common's helpers in the suites that already include it: has_command ×9, sha256_hex ×16, a dead stderr_chatter filter ×5, and rollback_json's drifted envelope readers #1959.
• The mock-request check has drifted.
  • cargo and pypi .expect the recorded requests and check that the batch body carries the purl.
  • gem L462, nuget L550 and npm L757 use unwrap_or_default and check the path only. pypi's own comment warns that this form is vacuous.
• The apply-summary check is grepped in bash four ways.
  • gem's unanchored '"applied": 1' also matches 10. I executed the grep on "applied": 10,, and it matched.
  • maven and nuget use a trailing comma, so they depend on field order.
  • golang uses an anchored -E.
  • docker_vendor_common::assert_summary exists and uses a word boundary.
• Dead code: docker_vendor_common::run_in_image (L203-L205) has no callers. #[allow(dead_code)] hides it.

Proposed change

1. Rename docker_vendor_common to docker_common, or add tests/docker_common/mod.rs with docker_vendor_common built on it. Make it the only home for these helpers:
   • cov_docker_args, folding in sbt's SOCKET_PATCH_DOCKER_BIN branch;
   • skip_or_require(image), which reads SOCKET_PATCH_DOCKER_E2E_REQUIRED with the truthiness rule chosen in Gate toolchain e2e suites through one common::toolchain_gate: ten *_E2E_REQUIRED readers disagree on whether =0 and =true mean required #1940;
   • run(image, script);
   • assert_vex_agent_attested(stdout, purl, uuid, ghsa), built on vex_e2e_common::assert_attested;
   • an assert_api_exercised(server, purl) that .expects the recorded requests and checks the batch body;
   • the git_blob_sha prelude.
2. Delete the per-suite copies, plain_sha256/sha256_hex (use common::sha256_hex) and run_in_image.
3. In ci.yml, export SOCKET_PATCH_DOCKER_E2E_REQUIRED=1 for every docker matrix leg, not just inside the sbt) arm. Delete deno's SOCKET_PATCH_REQUIRE_DOCKER.
4. Replace the bash summary greps with assert_summary, or print the envelope between markers and parse it on the host with common/envelope.rs.

Size

About 11 test files plus ci.yml. Roughly −700 / +150 lines.

Acceptance criteria

• Every docker suite still passes in the coverage-docker and e2e-docker jobs, with the same test names.
• With a deliberately wrong image tag and the CI env set, each leg fails instead of skipping.
• grep -c "fn cov_docker_args\|fn skip_if_no_image\|fn assert_vex_agent_attested" tests/docker_e2e_*.rs returns 0.
• gem's applied check no longer matches "applied": 10.

Related: #1940 (T50, the gate truthiness rule), #1959 (T55), #1957 (T58).