bug: test_cloud_sync tests leak HOME — fail in dev when ~/.gradata/key exists

[Gradata]

Symptom

Running pytest tests/test_cloud_sync.py locally on a dev machine that has ~/.gradata/key present (typical for any contributor who actually uses Gradata) fails on:

tests/test_cloud_sync.py::TestCloudClient::test_client_disabled_by_default     FAIL
tests/test_cloud_sync.py::TestCloudClient::test_client_disabled_without_token  FAIL

with:

assert True is False
 +  where True = <gradata.cloud.sync.CloudClient object at ...>.enabled

Root cause

CloudClient.enabled (src/gradata/cloud/sync.py:166) falls through to _resolved_credential() which calls gradata.cloud._credentials.resolve_credential(). That reads ~/.gradata/key from the real $HOME (not the tmp_path the test scopes to). On a dev machine with a real key file, the credential resolves and enabled becomes True — contradicting the test's premise.

CI passes (4342/4342, see e.g. PR #213 / run 26174508058) because the CI runner has no ~/.gradata/key.

Fix

Add an autouse fixture to TestCloudClient (or to the test module) that:

1. Monkeypatches HOME to tmp_path so ~/.gradata/key resolves to a non-existent path
2. OR monkeypatches gradata.cloud._credentials.resolve_credential to return ""

Sketch:

import pytest

@pytest.fixture(autouse=True)
def isolate_credential_resolution(monkeypatch, tmp_path):
    # Force credential resolution into tmp_path so ~/.gradata/key
    # doesn't leak from the dev machine into the test.
    monkeypatch.setenv("HOME", str(tmp_path))
    monkeypatch.delenv("GRADATA_API_KEY", raising=False)

Scope

2 tests in tests/test_cloud_sync.py:

• TestCloudClient::test_client_disabled_by_default
• TestCloudClient::test_client_disabled_without_token

The other CloudClient tests pass because they explicitly set token="abc123" so the keyfile fallback isn't reached.

Reproduction

ls ~/.gradata/key   # confirm file exists
cd /path/to/gradata-sdk/Gradata
source .venv/bin/activate
pytest tests/test_cloud_sync.py::TestCloudClient -x
# → 2 failed

Risk

Test-only fix. No SDK behavior change.

Discovered during

Council Option A engineering sprint 2026-05-20 (kanban-orchestrator + subagent-driven-dev). Surfaced when running full test suite locally before opening PRs #213 / #215.