carlos / platform Public

Found while running make test for mail-events-log; unrelated to that branch. Both also fail on untouched main (c1d40eeb) on the same machine.

--- FAIL: TestEnsureAdminTokenRefusesToChmodThroughASymlink (internal/activator)
    admintoken_test.go:229: mode of the symlink's TARGET = 600, want the untouched 644 — the agent must not chmod through a link
--- FAIL: TestBootstrapOffcloudRequiresCredentialsFile (internal/host)
    host_test.go:1140: want error on 0644 credentials (must be 0600)

The machine's umask is 0077. Both tests create a file expecting it to land at 0644, get 0600 instead, and then assert on the difference. With umask 0022 both pass:

(umask 0022 && go test ./internal/activator/ ./internal/host/ -count=1 -run 'TestEnsureAdminTokenRefusesToChmodThroughASymlink|TestBootstrapOffcloudRequiresCredentialsFile')
ok  internal/activator
ok  internal/host

The assertions themselves look right — the fixtures just depend on the process umask. A os.Chmod(path, 0o644) after creating each fixture file would make them independent of it. Not fixed on this branch, to keep it about email events.