M30a: a slow host could move the provenance digest

`test · windows-latest` failed on M30 with two calls to detect() inside one
process disagreeing. Not a flake in the test: `docker --version` can take
longer than the ten-second timeout on a loaded runner, the TimeoutExpired is
caught, and the probe then reports exactly what it reports for a host with no
docker at all -- so the isolation tier fell from docker to subprocess between
one call and the next, and the digest of what the host could enforce moved
with it.

The probe now answers once per process. Failing to probe still reads as
absent, which under-claims the host's isolation, and that is the safe
direction to be wrong in here -- so the fix is to stop the answer changing
rather than to make a timeout mean something new.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: martex-dev

src/nullius/environment.py

@@ -21,6 +21,7 @@
 import sys
 from dataclasses import asdict, dataclass
 from enum import StrEnum
+from functools import cache
 from importlib.util import find_spec
 
 
@@ -92,7 +93,24 @@ def warnings(self) -> list[str]:
         return out
 
 
+@cache
 def _tool_version(executable: str, *args: str) -> str | None:
+    """Ask an external tool what version it is, once per process.
+
+    Cached because it must be: the digest this feeds is a *run's* provenance,
+    and two calls inside one run have to agree about the host. They did not.
+    A loaded machine can take longer than the timeout to answer `docker
+    --version`, the timeout is caught, and the probe reports the same thing it
+    reports for a host with no docker at all -- so the isolation tier fell from
+    docker to subprocess between one call and the next and the digest moved
+    with it. Windows CI found it; the failure is a property of load, not of
+    platform.
+
+    Failing to probe still reads as absent, which under-claims what the host
+    can enforce. That is the safe direction to be wrong in for this project,
+    and it is the reason the fix is to stop the answer changing rather than to
+    make a timeout mean something new.
+    """
     path = shutil.which(executable)
     if path is None:
         return None

tests/test_environment.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import dataclasses
+import subprocess
 
 import pytest
 from typer.testing import CliRunner
@@ -31,6 +32,24 @@ def test_digest_is_stable_and_sensitive() -> None:
     assert weaker.digest() != caps.digest(), "the tier must change the provenance digest"
 
 
+@pytest.mark.invariant
+def test_a_slow_host_cannot_move_the_provenance_digest(monkeypatch: pytest.MonkeyPatch) -> None:
+    """The digest is a run's record of what its host could enforce, so two calls
+    inside one run have to agree. They did not: `docker --version` can take
+    longer than the timeout on a loaded machine, the timeout is caught, and the
+    probe then reports what it reports for a host with no docker at all. The
+    isolation tier fell from docker to subprocess between one call and the next
+    and the digest moved with it.
+    """
+    before = detect().digest()
+
+    def refuse(*_args: object, **_kwargs: object) -> object:
+        raise subprocess.TimeoutExpired(cmd="docker", timeout=10)
+
+    monkeypatch.setattr(subprocess, "run", refuse)
+    assert detect().digest() == before
+
+
 @pytest.mark.parametrize(
     ("tier", "expected_fragment"),
     [