Advance dependency roots with guarded source implementations

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a10391-6355-7b41-b0fa-3e14e874f091

scripts/smoke-bwrap-runtime.py

@@ -14,7 +14,25 @@ from pathlib import Path
 from sandboxer.extensions.bwrap import BwrapExtension
 from sandboxer.models import Profile
 
-PROBE = r'''
+ENTRYPOINT_PROBE = r'''
+def entrypoint_started(runtime, name, timeout=15):
+    launcher = runtime / 'bin' / name
+    if launcher.is_symlink() or not launcher.is_file():
+        return False
+    try:
+        result = subprocess.run([str(launcher), '--help'], capture_output=True,
+                                timeout=timeout)
+    except (OSError, subprocess.TimeoutExpired):
+        return False
+    return result.returncode == 0 and b'usage:' in result.stdout.lower()
+
+
+def package_inside_runtime(module, runtime):
+    origin = getattr(module, '__file__', None)
+    return bool(origin) and Path(origin).resolve().is_relative_to(runtime.resolve())
+'''
+
+PROBE = ENTRYPOINT_PROBE + r'''
 import json, os, subprocess, sys
 from pathlib import Path
 import rein_aharness.adapter
@@ -35,9 +53,22 @@ else:
     readonly = False
 assert readonly
 assert not source.exists()
-help_result = subprocess.run(['rein-aharness', '--help'], capture_output=True, timeout=15)
-assert help_result.returncode == 0
-assert b'usage:' in help_result.stdout
+assert entrypoint_started(runtime, 'rein-aharness'), 'rein entrypoint did not start'
+owner_entrypoints_required = sys.argv[3] == 'true'
+glas_cli_started = False
+packages = [rein_aharness.adapter, llm_connect]
+if owner_entrypoints_required:
+    import glas_harness
+    import sandboxer
+    packages.extend([glas_harness, sandboxer])
+    glas_cli_started = entrypoint_started(runtime, 'glas-harness')
+    assert glas_cli_started, 'glas entrypoint did not start'
+packages_inside_runtime = all(package_inside_runtime(module, runtime) for module in packages)
+assert packages_inside_runtime, 'package outside runtime'
+assert json.loads(os.environ['SANDBOXER_CREDENTIAL_ROUTE_REFS']) == []
+assert not any(name in os.environ for name in
+               ('ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN', 'OPENAI_API_KEY',
+                'OPENROUTER_API_KEY')), 'provider credential present'
 claude_version = None
 proxy_present = False
 if sys.argv[2]:
@@ -55,6 +86,8 @@ interfaces = [line.split(':', 1)[0].strip()
 assert interfaces == ['lo']
 print(json.dumps({'rein_cli_started': True, 'adapter_imported': True,
                   'runtime_readonly': readonly, 'source_absent': True,
+                  'owner_entrypoints_required': owner_entrypoints_required,
+                  'glas_cli_started': glas_cli_started, 'packages_inside_runtime': True,
                   'home_outside_workspace': True, 'home_mode': '0700',
                   'worktree_clean': True, 'interfaces': interfaces,
                   'python_prefix': sys.prefix,
@@ -69,6 +102,8 @@ def main() -> int:
     parser.add_argument("--runtime-path", required=True)
     parser.add_argument("--runtime-sha256", required=True)
     parser.add_argument("--claude-version", default="")
+    parser.add_argument("--require-owner-entrypoints", action="store_true",
+                        help="Require Glas and rein startup and all four owner packages")
     args = parser.parse_args()
     with tempfile.TemporaryDirectory(prefix="sandboxer-runtime-proof-") as temporary:
         root = Path(temporary)
@@ -87,11 +122,12 @@ def main() -> int:
         try:
             extension.wait_ready(handle)
             result = extension.execute(
-                handle, ["python3", "-c", PROBE, str(source), args.claude_version],
+                handle, ["python3", "-c", PROBE, str(source), args.claude_version,
+                         str(args.require_owner_entrypoints).lower()],
                 credential_route_refs=[],
                 execution_context={"actor": "agt", "project": "sand-boxer-runtime-proof",
                                    "run_id": "sand-wp-0015-proof"},
-                timeout_seconds=30, max_output_bytes=65536,
+                timeout_seconds=60, max_output_bytes=65536,
             )
             persistence = extension.execute(
                 handle, ["python3", "-c",