tests: key the static-only subprocess allowlist by function, not line number #1078

Deferred by the engineering-review implementation loop (PRs #1070 and #1074).

Problem

tests/test_adapter_static_only.py allowlists the permitted subprocess.Popen / subprocess.run sites in src/agents_shipgate/cli/verify/git.py by exact line number (cli/verify/git.py:<line>:attr_call:subprocess.run). Any edit above those lines, including a merge of main, moves them and the test job fails with "allowlisted entry … pins line N, but no violation of that surface was found at that line". In the current implementation loop this happened on PR #1070 three times and on PR #1074 after merging main, each time costing a CI round and a commit that changes only two integers. The guard is right; its key is wrong.

Evidence

• tests/test_adapter_static_only.py ALLOWED_EXCEPTIONS entries for cli/verify/git.py (line-keyed), and test_allowlist_entry_matches_real_surface, which asserts the pinned line is flagged.
• PR fix(verify): fail closed without a base or with a deleted manifest #1070 commits 30981fc, c405022, 18186a1 and PR fix(verify): read in-repo --diff-from and ci policy from the base #1074 (after f403410) each moved only the two line numbers.

Proposed fix

Key allowlist entries by enclosing function (module path + qualified function name + surface), resolved from the AST, keeping the prose rationale per entry; keep a strict check that each allowlisted function contains exactly the expected number of that surface so a new spawn inside an allowlisted function is still caught. Migrate the existing entries; no change to what is allowed.

Acceptance criteria

• Inserting lines above an allowlisted call no longer fails the test.
• Adding a second subprocess.run inside an allowlisted function, or a new call in a non-allowlisted function, still fails the test.
• The allowlist still carries a prose rationale per entry.

Source

Engineering review 2026-10-12 implementation loop. Tracked in #1060.