feat(core): add Linux support for process activity checks and filesystem tests

[coder1408]

Linux Native Support for Chippytea Core

Summary

This PR enables the Chippytea core Rust engine to run natively on Linux, laying the foundation for cross-platform Linux support while preserving all existing safety guarantees and invariants.

Previously, on non-macOS platforms, ActivitySnapshot::capture returned an unconditional error, preventing artifact revalidation and cleanup. This PR implements Linux /proc inspection to track active processes and addresses filesystem differences, including ext4/XFS directory block allocation, delayed allocation timing, and strict umask permissions.

As a result, the entire core test suite now compiles and passes cleanly on Linux.

No deletion safety rules or candidate eligibility definitions have been broadened or altered.

---

Key Changes

1. Linux Process Activity Tracking

File: core/src/activity.rs

• Implemented #[cfg(target_os = "linux")] ActivitySnapshot::capture(&AtomicBool).

• Uses /proc/<pid>/exe and /proc/<pid>/cwd to inspect running processes.

• Tracks only processes owned by the current effective user (stat.st_uid == libc::geteuid()).

• Excludes the current process's own working directory to avoid self-blocking.

• Handles the macOS app-bundle cache (blocked_owning_cache) on Linux by returning Ok(BTreeSet::new()) instead of failing closed with a platform error.

2. Filesystem & Allocation Adaptations

Ext4/XFS Directory Block Accounting

File: core/src/scanner.rs

• On Linux, directories consume allocated blocks, typically 4,096 bytes per directory, unlike APFS where directories consume 0 allocated bytes.

• Updated logical_lanes_share_exact_hardlink_accounting_without_duplicate_bytes to deduct directory-allocated blocks from traverse_metadata totals.

• This keeps hardlink accounting exact across different filesystem implementations.

Ext4 Delayed Allocation

File: core/src/cleanup.rs

• Added file.sync_all() to review_fixture.

• Ensures disk extents are committed before scanning.

• Prevents delayed-allocation timing races during parallel test execution.

Engine Lock Reopen Retry

File: core/src/lib.rs

• Added a bounded retry in reopen_foreground_fixture.

• Prevents lockfile contention races when an Engine instance is dropped and immediately reopened during heavy concurrent test execution.

3. Strict Trusted Context & umask Hardening

Files:

• core/src/scan_worker.rs

• core/tests/support/mod.rs

Chippytea's trusted_context requires helper directories to be non-writable by group or others (mode & 0o022 == 0).

On Linux distributions with a default 0002 umask, temporary test folders and Cargo's target/debug/deps directory can be created with mode 0775, violating this invariant.

To address this:

• Updated test runners to explicitly set directory permissions to 0o700 or 0o755.

• Updated stage_helper to explicitly strip group/other write permissions.

• Preserves the existing trusted-context security invariant across Linux environments.

4. Un-gated Test Coverage

Files:

• core/src/cleanup.rs

• core/src/scanner.rs

• core/tests/hardlinks.rs

Un-gated 20+ tests that were previously restricted to #[cfg(target_os = "macos")].

This enables full Linux verification of:

• Hardlink integration tests (core/tests/hardlinks.rs)

• Python virtual environment (.venv) symlink preservation and measurement

• Live process activity rejection during revalidation

• Duplicate cleanup guards

• Atomic manifest rollback on failure

---

Verification & Checks Run

All checks were executed on Linux (x86_64, kernel 6.17+).

Check | Result -- | -- Core Test Suite | 465 passed, 0 failed, 0 ignored Clippy | 0 warnings Formatter | Clean Public Files Check | 143 paths checked, 0 errors CLI Smoke Test | Completed in 1ms with 0 errors

Core Test Suite

env -u CARGO_TARGET_DIR -u CARGO_BUILD_TARGET_DIR cargo test --locked

Result: 465 passed, 0 failed, 0 ignored

Breakdown:

• 438 unit tests in chippytea_core

• 1 unit test in chippytea_scan_helper

• 15 integration tests in discovery

• 2 integration tests in hardlinks

• 9 integration tests in safety

Linter

cargo clippy --all-targets --locked -- -D warnings

Result: 0 warnings

Formatter

cargo fmt --all -- --check

Result: Clean

Public Files Check

python3 scripts/check-public-files.py

Result: 143 paths checked, 0 errors

CLI Smoke Test

cargo run --bin chippytea-cli -- scan .

Result: Completed in 1ms with 0 errors

---

Checks Not Run

macOS Native SwiftUI App Build

./scripts/build.sh

This check was not run because the development environment was Linux and did not have access to macOS 14+ or Xcode.

Note: No macOS-specific code under native/ was modified in this PR.

[vercel]

@coder1408 is attempting to deploy a commit to the McIlroy Team on Vercel.

A member of the Team first needs to authorize it.