Package sandbox definitions and build a pinned owner runtime

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

tests/test_messages_route.py

@@ -62,3 +62,19 @@ def test_route_refuses_expansion(binding, tmp_path, change):
         backend = SimpleNamespace()
     with pytest.raises(ValueError):
         binding.validate(profile, consumer, backend, {})
+
+
+def test_trusted_runtime_pin_is_injected_and_overlap_refused(binding, tmp_path):
+    runtime = tmp_path / "runtime"
+    binding = replace(binding, runtime_path=runtime, runtime_sha256="b" * 64)
+    backend = BwrapExtension({"base_dir": str(tmp_path / "workspaces")})
+    profile = load_profile("profile.bwrap-local")
+    consumer = Consumer(actor="agt", project="fixture", run_id="run-1")
+    binding.validate(profile, consumer, backend, {})
+    assert backend.config["runtime"] == {"path": str(runtime), "sha256": "b" * 64}
+    with pytest.raises(ValueError, match="overlaps"):
+        replace(binding, runtime_path=binding.socket_path.parent).validate(
+            profile, consumer, backend, {}
+        )
+    with pytest.raises(ValueError, match="exact path"):
+        replace(binding, runtime_sha256=None).validate(profile, consumer, backend, {})

tests/test_runtime_builder.py

@@ -50,3 +50,22 @@ def test_incomplete_claude_pin_refuses_before_build(tmp_path):
     with pytest.raises(ValueError, match="supplied together"):
         builder.build(tmp_path / "out", tmp_path, tmp_path, claude_binary=tmp_path / "claude")
     assert not (tmp_path / "out").exists()
+
+
+def test_owner_build_requires_matching_sibling_lock_before_output(tmp_path, monkeypatch):
+    import json
+    rein = tmp_path / "rein"
+    llm = tmp_path / "llm"
+    output = tmp_path / "output"
+    def checked(argv, **kwargs):
+        if "--porcelain" in argv:
+            return ""
+        if "rev-parse" in argv:
+            return "a" * 40
+        return json.dumps({"ok": True, "dependencies": [
+            {"distribution": "llm-connect", "commit": "b" * 40}
+        ]})
+    monkeypatch.setattr(builder, "checked", checked)
+    with pytest.raises(ValueError, match="does not match"):
+        builder.build(output, rein, llm, owner_runtime=True)
+    assert not output.exists()