The full gate runs in a Nix-based container where true resolves into /nix/store, which is group-writable and therefore never root-controlled, so the two trusted_path tests failed there. They now take the first root-controlled os.defpath directory and skip when there is none. A sticky group-writable ancestor stays refused: on multi-user Nix any user can have the daemon build root-owned store content (skeptic round 7); the README says to pin an absolute path on Nix.
🎯 Fix: 92 %
💥 Break: 1 %
💸 Cost: 100 %
⏱️ Time: 100 %
🛡️ Security: 100 %
🏆 Score: 91
🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 %
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
