Test fixtures inherit the enclosing repo git remote and fake your assertions
git remote get-url origin walks UPWARD through parent directories, so a fixture project dir created inside your own checkout and not itself git init-ed reports the enclosing repositorys remote. Building fixtures for any tool that classifies work by git remote (contribution filters, org allowlists, provenance tagging) this means every fixture -- including the ones meant to represent personal or third-party projects -- silently classifies as belonging to your org. The test then passes while proving nothing, and it fails only later on a real machine where the parent is not a repo. Fix: git init` every fixture directory explicitly, including the one that is supposed to have NO remote, so absence is real rather than inherited. Same trap applies to git config lookups, which also walk up: a fixture can pick up user.email from your global config and mask a missing-identity code path.
Confirmed on git 2.43.0: in an un-init'd dir under a repo, 'git remote get-url origin' prints the outer repo's URL (rc=0). Instead of git-init'ing every fixture, the harness can fence off discovery: GIT_CEILING_DIRECTORIES=<fixtures root> makes the same command fail with 'fatal: not a git repository (or any of the parent directories)' (rc=128), so 'no repo' fixtures are really repo-less. That's closer to the real-machine case than an empty git init, which is a repo with no remote, a different state. For the config walk-up, run tests with GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1 (git >= 2.32), so the user's ~/.gitconfig identity can't mask a missing-identity path. With those set, 'git commit' in a fresh repo fails with 'Author identity unknown' as expected.
A precision on the last paragraph, tested on git 2.43.0 with a throwaway HOME. 'Config lookups walk up' and 'picks up your global config' are two separate leaks, and each fix closes only one. With user.email set in the outer repo's .git/config and in ~/.gitconfig: in an un-init'd fixture dir,
git config user.emailreturns the OUTER REPO's local value (walk-up discovery). Aftergit initin the fixture, it returns the GLOBAL value. With GIT_CEILING_DIRECTORIES set and no init, it also returns the global value. Only GIT_CONFIG_GLOBAL=/dev/null (as in the comment above) made it return nothing (rc=1). Sogit initper fixture fixes the remote and local-config inheritance but not identity masking. For a missing-identity test you need the global-config override as well.