fix: close consolidated quality review findings

tests/unit/test_db_store.py

@@ -48,10 +48,24 @@ class TestDbStoreIsMigrated(unittest.TestCase):
         with tempfile.TemporaryDirectory() as d:
             parent = Path(d) / "store"
             parent.mkdir()
-            with patch.object(Path, "chmod", side_effect=OSError("denied")):
+            (parent / "test.db").touch()
+            with patch("os.fchmod", side_effect=OSError("denied")):
                 with self.assertRaisesRegex(OSError, "denied"):
                     _store(parent)
 
+    def test_rejects_database_symlink_without_changing_target(self):
+        with tempfile.TemporaryDirectory() as d:
+            parent = Path(d) / "store"
+            parent.mkdir()
+            target = Path(d) / "target"
+            target.touch(mode=0o644)
+            (parent / "test.db").symlink_to(target)
+
+            with self.assertRaises(OSError):
+                _store(parent)
+
+            self.assertEqual(0o644, stat.S_IMODE(target.stat().st_mode))
+
     def test_returns_false_when_schema_versions_missing(self):
         # DB file exists but has no schema_versions table → OperationalError → False.
         with tempfile.TemporaryDirectory() as d:

tests/unit/test_git_http_backend.py

@@ -5,6 +5,7 @@ import subprocess
 import tempfile
 import threading
 import unittest
+import urllib.error
 import urllib.request
 from pathlib import Path
 from unittest import mock

tests/unit/test_orchestrator_server.py

@@ -70,15 +70,6 @@ def dispatch(
 
     response = asyncio.run(request())
     payload = response.json()
-    if response.status_code == 422:
-        detail = payload.get("detail", []) if isinstance(payload, dict) else []
-        field = ""
-        if isinstance(detail, list) and detail and isinstance(detail[0], dict):
-            location = detail[0].get("loc", ())
-            if isinstance(location, (list, tuple)) and len(location) > 1:
-                field = str(location[1])
-        suffix = f": {field}" if field else ""
-        return 400, {"error": f"invalid request body{suffix}"}
     if isinstance(payload, dict) and "detail" in payload and "error" not in payload:
         payload = {"error": payload["detail"]}
     return response.status_code, payload

tests/unit/test_supervise_edge.py

@@ -140,7 +140,7 @@ class TestStoreGuardBranches(unittest.TestCase):
         with tempfile.TemporaryDirectory() as d:
             db = Path(d) / "q.db"
             store = QueueStore("key", db_path=db)
-            with patch("pathlib.Path.chmod", side_effect=OSError("ro")):
+            with patch("os.fchmod", side_effect=OSError("ro")):
                 with self.assertRaisesRegex(OSError, "ro"):
                     store.migrate()
 
@@ -156,7 +156,7 @@ class TestStoreGuardBranches(unittest.TestCase):
         with tempfile.TemporaryDirectory() as d:
             db = Path(d) / "a.db"
             store = AuditStore(db_path=db)
-            with patch("pathlib.Path.chmod", side_effect=OSError("ro")):
+            with patch("os.fchmod", side_effect=OSError("ro")):
                 with self.assertRaisesRegex(OSError, "ro"):
                     store.migrate()