[efraespada]

Java 17 can keep discovering the operating-system account home even when verification has a private HOME. Copilot now derives a single JVM user.home argument and GRADLE_USER_HOME from each fresh verification profile, and passes those same host-derived values to native setup. The argument encoder preserves whitespace, quotes, Unicode and Windows separators. Preparation failures clean the owned profile; native requests reject missing or foreign derived values before exposing setup metadata.

Inherited tool-option injection stays excluded, and setup responses still accept only approved PATH/JAVA_HOME metadata. Native acceptance downloads a real Temurin 17 installation using setup-java's supported force-download input, so a hosted tool-cache alias cannot escape the existing canonical-root guard. JVM/Gradle account configuration remains private for every verifier. The generated coordinator, operator guidance, owning SDDs and catalog cover the same contract. Shared YAML steps keep the smoke workflow within its existing 100 KB review limit without changing parsed jobs or permissions.

Validation:

• Baseline: seven failing regressions with 74 passing controls. Disposable Linux before/after runs use the actual GitCommitAdapter, JDK 17 preflight, offline fresh Gradle compilation and JavaExec twice per version. The baseline reads disposable account sentinels; the correction uses only private configuration. Candidate source stays unchanged.
• 48 added regression cases: 16 argument grammar, eight profile/environment, 16 native protocol, six workflow and two Git cases. Encoding and profile modules reach 100% on every coverage metric; the native controller passes its 95% lines/statements and 90% branches/functions budgets. Existing thresholds and verification selections remain unchanged.
• Exact-head native Linux acceptance passes Python/pytest, Node/pnpm and JVM/Gradle through three distinct profiles. JVM/Gradle homes are private, inherited options are excluded, Java compilation is fresh, JavaExec passes, and candidate files remain unchanged. Deferred native post cleanup passes on all three platforms.
• Linux and macOS full runs: 790 suites, 14,661 passing tests and 35 existing skips. Windows: 789 passing suites, 14,557 passing tests, with its existing platform selections (one skipped suite / 138 skipped cases). All module/acceptance coverage budgets pass.
• Canonical CI coverage: 97.30% statements, 94.99% branches, 97.95% functions and 98.07% lines. Extension: 267 passing cases, 100% on all four metrics. Package inventory/CLI/typed API/local web smoke, generated bundle synchronization, Svelte checks, reproducible extension artifacts, typecheck, lint, documentation, workflow and specification validations pass locally.

CI and all three platforms pass on a9d7de1. Codecov reports 94.90% project coverage. Its automatic comparison selects a historical base, so a separate audit uses the exact-head Codecov line report and the actual develop-to-head Git diff: 37/37 added instrumented lines fully hit (100%; no misses or partials). The generator keeps its existing executable workflow-contract tests. Bugbot review is complete with complete context, zero active findings and all threads resolved.

One unchanged-head CI retry passed the entire benchmark (116/116) after two 5-second timeouts in the first attempt. Those cases had passed in that same attempt's full suite; the isolated benchmark also passed 116/116 before the retry. No test, threshold, timeout or source changed for the retry.

Closes #775

[docs-page]

To preview the documentation for this pull request, visit the following URL:

docs.page/vypdev/copilot~793

Documentation is deployed and generated using docs.page

[vypbot]

Bugbot: review complete

Current status: No active findings on a9d7de1.

Pull request · Verified commit · Workflow run

[vypbot]

Copilot approval · Human review needed

Status: Only open, non-draft, complete same-repository pull requests are eligible.
Completed: 1/1 observed checks succeeded; Bugbot complete.
Action required: Ask a human reviewer to decide.
Impact: No new approval is confirmed for this revision.
See checks

Technical evidence

Revision: a9d7de1f156b; base: 229c576e5a0b; reason: unsupported-pr.

[vypbot]

Current status: All findings originating in this review are resolved.
Last reconciled on a9d7de1. See aggregate Bugbot status.

🤖 Bugbot review snapshot

Bugbot reported 1 potential problem when commit e9a2370 was analyzed. This snapshot is historical; use the status block above for current state. 1 finding is linked to changed code.

Findings

• medium: The JDK tool cache path can resolve to the filesystem root — src/tooling/__tests__/fixtures/verification_native_fixture.ts:56

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.90%. Comparing base (5b3664f) to head (a9d7de1).
⚠️ Report is 69 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop     #793      +/-   ##
===========================================
+ Coverage    94.50%   94.90%   +0.40%     
===========================================
  Files         1035     1090      +55     
  Lines        33299    35310    +2011     
  Branches      9824    10489     +665     
===========================================
+ Hits         31468    33510    +2042     
+ Misses         699      677      -22     
+ Partials      1132     1123       -9     

Files with missing lines	Coverage Δ
...ation/policies/repository_agent_guidance_policy.ts	100.00% <ø> (ø)
...c/infrastructure/native_verification_controller.ts	95.45% <100.00%> (+5.91%)	⬆️
src/infrastructure/private_jvm_environment.ts	100.00% <100.00%> (ø)
...rc/infrastructure/untrusted_command_environment.ts	100.00% <100.00%> (ø)

... and 99 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.