test(security): fix an intermittent failure in the extraction-guard suite [DEVA11Y-484]

A reviewer running the suite alongside another run saw it fail once in seven, and
the cause is real: fixture generation is not atomic, and run_tests.sh gated on
"does legit.tar.gz exist?" — which make_fixtures.sh creates FIRST. A second run
starting behind a generating one saw the gate satisfied and began reading
bomb/manyfiles/multifile while they were still being written.

Reproduced deterministically: clear the fixtures, start one run, start a second 3
seconds later, and the second fails 5 of 51 assertions — many-files and multi-file
across all three variants, which are exactly the fixtures written last.

Generation now takes an atomic mkdir lock (macOS ships no flock CLI) and writes a
`.complete` marker as its final act; run_tests.sh gates on that marker and hard-
fails if it is still absent afterwards. A run that loses the lock waits for the
marker rather than proceeding on half-written input.

Validated: 4 concurrent cold starts, a staggered cold start, and 6 warm serial
runs — 51/51 every time, lock cleaned up, fixtures still gitignored. Mutation
validation re-run and unchanged: disabling the decompressed-size rejection,
raising the cap to 4 GB, dropping the head -c truncation, and removing both
compressed-cap layers are each still caught.

Also documents why the corrupt fixture uses /dev/urandom rather than /dev/zero:
an all-zero file is a VALID EMPTY tar archive, so zeros make bsdtar exit 0 and the
corrupt assertions pass for the wrong reason. That one bit me while building this.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: maunilm

tests/extraction-guard/README.md

@@ -49,6 +49,16 @@ test. The suite asserts on the *message*, which differs per path.
 **The expected file mode is read from `cli.sh`**, not hardcoded: main tightened it
 from `0775` to `0755` and a hardcoded expectation had already rotted.
 
+**Fixture generation is locked and marker-gated.** Generation is not atomic, and
+the first version gated on "does `legit.tar.gz` exist?" — which `make_fixtures.sh`
+creates *first*. A second run starting behind a generating one therefore saw the
+gate satisfied and read `bomb`/`manyfiles`/`multifile` while they were still being
+written, failing 5 of 51 assertions. This was not theoretical: a reviewer running
+the suite alongside another run hit it (1 run in 7). Generation now takes an
+atomic `mkdir` lock and writes a `.complete` marker last; `run_tests.sh` gates on
+that marker. Validated with 4 concurrent cold starts, a staggered cold start, and
+6 warm serial runs — all green.
+
 ## Mutation-validated
 
 Baseline green; each guard removal below flips it red:

tests/extraction-guard/make_fixtures.sh

@@ -2,10 +2,39 @@
 # Generates real .tar.gz fixtures for the DEVA11Y-484 extraction-guard tests.
 # Everything is bounded: even if a guard regressed and failed to abort, no fixture
 # decompresses beyond ~400 MB, so a test run can never exhaust the disk.
+#
+# Generation is LOCKED and gated by a `.complete` marker written last, because it is
+# not atomic and a concurrent reader will otherwise consume half-written files.
+# Measured: gating on "does legit.tar.gz exist?" let a second run — started 3s behind
+# a generating one — fail 5 of 51 assertions, because legit.tar.gz is created FIRST
+# and the later fixtures were still being written. That is a real intermittent
+# failure, first observed by a reviewer running the suite alongside another run.
 set -euo pipefail
 
 DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/fixtures"
 mkdir -p "$DIR"
+
+MARKER="$DIR/.complete"
+LOCK="$DIR/.lock"
+
+# mkdir is atomic on every POSIX filesystem, so it serves as a lock without flock,
+# which macOS does not ship as a CLI.
+if ! mkdir "$LOCK" 2>/dev/null; then
+  echo "  another run is generating fixtures; waiting..."
+  for _ in $(seq 1 300); do
+    [ -f "$MARKER" ] && { echo "  fixtures ready (generated by the other run)."; exit 0; }
+    sleep 1
+  done
+  echo "ERROR: timed out waiting for fixtures. Remove $LOCK if it is stale." >&2
+  exit 1
+fi
+trap 'rmdir "$LOCK" 2>/dev/null || true' EXIT
+
+if [ -f "$MARKER" ]; then
+  echo "  fixtures already complete."
+  exit 0
+fi
+
 cd "$DIR"
 
 log() { printf '  %s\n' "$*"; }
@@ -62,6 +91,9 @@ make_oversized_download() {
 }
 
 # --- 6. corrupt: not a valid archive (bsdtar should fail cleanly) ---
+# /dev/urandom, not /dev/zero: an all-zero file is a VALID EMPTY tar archive (tar
+# terminates on two zero blocks), so zeros would make bsdtar exit 0 and the "corrupt"
+# assertions would pass for the wrong reason — measured while building this suite.
 make_corrupt() {
   head -c 4096 /dev/urandom > corrupt.tar.gz
   log "corrupt.tar.gz              (random bytes, not a real archive)"
@@ -74,4 +106,7 @@ make_manyfiles
 make_multifile
 make_oversized_download
 make_corrupt
+
+# Marker LAST. A reader gated on this can never observe a partially written fixture.
+touch "$MARKER"
 echo "Done."

tests/extraction-guard/run_tests.sh

@@ -25,12 +25,20 @@ for tool in bsdtar curl python3 awk; do
   }
 done
 
-if [ ! -f "$HERE/fixtures/legit.tar.gz" ]; then
+# Gate on the completion marker, NOT on any individual fixture. legit.tar.gz is
+# written first, so gating on it lets a concurrent run start reading while the later
+# fixtures are still being written — measured: 5 of 51 assertions failed that way.
+if [ ! -f "$HERE/fixtures/.complete" ]; then
   echo
   echo "▶ Generating fixtures (~106 MB, gitignored)"
   bash "$HERE/make_fixtures.sh" || exit 1
 fi
 
+if [ ! -f "$HERE/fixtures/.complete" ]; then
+  echo "FATAL: fixtures incomplete after generation." >&2
+  exit 1
+fi
+
 echo
 echo "▶ Shell launcher tests (bash / zsh / fish)"
 bash "$HERE/test_shell_extraction.sh" || rc=1