test: git-remote coverage (1/4) — plan + backend matrix, real-hook push, hermeticity

[Soph]

https://entire.io/gh/entireio/cli/trails/757

Part 1 of a 4-PR stack adding systematic test coverage for git-remote operations across both checkpoint backends. The plan (committed here as docs/testing/git-remote-test-plan.md) came out of a survey of existing e2e/integration coverage, the production remote code paths, and past remote-related regressions.

Stack: this PR → #2/4 (P0 hook & cross-machine) → #3/4 (divergence matrix) → #4/4 (OPF, degraded remotes, shallow clones, e2e).

What's here

• Test plan — gap analysis + coverage map (groups A–H), including the product decisions it surfaces (Checkpoint reads always target origin while pushes follow the hook remote (non-origin remotes unsupported) #1634, git-refs: push queue is drained by the first successful push — checkpoints never reach a second remote #1635).
• I-1: integration backend matrix — TestEnv.CheckpointStore injects ENTIRE_CHECKPOINTS_PRIMARY into every spawned CLI and git hook process (condensation happens in post-commit), ForEachBackend(t, fn) subtest helper, and backend-aware assertions (CheckpointsPresentLocally/OnRemote, RemoteCheckpointState, LatestCheckpointID) mirroring e2e/testutil/backend.go. The remote-touching suites (remote_operations_test.go, http_remote_test.go, explain fetch-on-miss) now run under both backends.
• I-2: real-hook push helpers — GitPushWithHooks (no --no-verify) + InstallRealPrePushHook run a plain git push through the installed pre-push hook exactly as git does (stdin refspecs); RunPrePush now feeds computed stdin instead of nil. Smoke test proves a plain git push alone lands checkpoints on a bare remote under both backends — the first end-to-end assertion of the real hook. Plus e2e AssertCheckpointsOnRemote.
• I-4: hermeticity tripwire — integration tests route github.com/gitlab.com HTTPS through a dead loopback proxy (insteadOf rewrites broke trail forge detection, so this blocks at transport level only), with a self-test proving external hosts fail in ~20ms. Regression class: tests doing live github.com fetches / triggering macOS keychain prompts (strategy: stop resolvePushSettings tests from fetching github.com #1463).

Verification

• mise run fmt && mise run lint clean per commit
• mise run test:integration green
• mise run test:e2e:canary green under both E2E_CHECKPOINT_STORE values

🤖 Generated with Claude Code

https://claude.ai/code/session_012yi3hHGAGepwfrfjPETjGq

---

Note

Low Risk
Test-only and documentation changes; production behavior is unchanged aside from optional hermetic git config when ENTIRE_TEST_GIT_HERMETIC is set in tests.

Overview
Adds docs/testing/git-remote-test-plan.md as the roadmap for remote/checkpoint coverage across git-branch and git-refs, and lands the first infrastructure slice from that plan.

Dual-backend integration matrix: ForEachBackend plus TestEnv.CheckpointStore inject ENTIRE_CHECKPOINTS_PRIMARY into CLI and hook subprocesses; backend-aware helpers (CheckpointsPresentLocally/OnRemote, CheckpointExistsOnRemote, RemoteCheckpointState, LatestCheckpointID) replace hardcoded entire/checkpoints/v1 checks. Remote-focused suites (remote_operations_test, http_remote_test, explain fetch-on-miss) now run under both backends, with comments/skips where behavior still differs (v1-only rebase/treeless tests, a documented git-refs skip for staging-after-stop).

Real pre-push path: GitPushWithHooks / InstallRealPrePushHook exercise a normal git push through the installed hook; RunPrePush feeds realistic stdin refspecs. New TestGitPushWithHooks_SyncsCheckpointsToRemote asserts checkpoints reach the bare remote without explicit RunPrePush. E2E gains AssertCheckpointsOnRemote.

Hermeticity: integration TestMain sets ENTIRE_TEST_GIT_HERMETIC and GIT_TERMINAL_PROMPT=0; testutil appends per-host HTTPS proxy config to the isolation git config so accidental github.com/gitlab.com dials fail fast, with TestHermeticityGuard_ExternalHostFailsFast as a regression guard.

^{Reviewed by Cursor Bugbot for commit aec192c. Configure here.}

[Copilot]

Pull request overview

Adds the first slice of systematic git-remote test coverage across both checkpoint backends by introducing an integration backend matrix, exercising the real pre-push hook via plain git push, and enforcing hermetic git transport in integration tests to prevent accidental external network access.

Changes:

• Introduces a dual-backend integration test matrix (git-branch vs git-refs) with backend-aware assertion helpers.
• Adds “real hook” push helpers/tests so a plain git push exercises the installed pre-push hook end-to-end.
• Adds a hermeticity tripwire for integration tests by routing HTTPS transport for external hosts through a dead loopback proxy, plus a guard test.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
e2e/testutil/repo.go	Adds an E2E assertion helper to verify checkpoints landed on a bare remote without an explicit checkpoint push.
docs/testing/git-remote-test-plan.md	New test plan documenting coverage gaps, priorities, and sequencing for git-remote behaviors across both backends.
cmd/entire/cli/testutil/testutil.go	Adds opt-in hermetic git config injection (dead loopback proxy) to prevent accidental external HTTPS dials in tests.
cmd/entire/cli/integration_test/testenv.go	Adds backend selection env injection, real-hook push helpers, and realistic stdin for pre-push direct invocation.
cmd/entire/cli/integration_test/setup_test.go	Sets GIT_TERMINAL_PROMPT=0 and enables the hermetic git tripwire for the whole integration suite.
cmd/entire/cli/integration_test/remote_operations_test.go	Runs remote operation tests under both backends and switches assertions to backend-aware helpers.
cmd/entire/cli/integration_test/real_hook_push_test.go	New integration test proving plain git push via the real installed pre-push hook syncs checkpoints to the remote.
cmd/entire/cli/integration_test/http_remote_test.go	Runs selected HTTPS remote tests under both backends and adjusts assertions accordingly.
cmd/entire/cli/integration_test/hermeticity_test.go	New guard test ensuring external-host git HTTPS attempts fail fast under the hermeticity tripwire.
cmd/entire/cli/integration_test/explain_test.go	Runs fetch-on-miss explain coverage under both backends (v1 fetch vs per-checkpoint RefFetcher).
cmd/entire/cli/integration_test/backend.go	Adds backend constants, ForEachBackend, and backend-aware local/remote checkpoint assertion helpers.