Package sandbox definitions and build a pinned owner runtime

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

tests/test_messages_route.py

@@ -62,3 +62,19 @@ def test_route_refuses_expansion(binding, tmp_path, change):
         backend = SimpleNamespace()
     with pytest.raises(ValueError):
         binding.validate(profile, consumer, backend, {})
+
+
+def test_trusted_runtime_pin_is_injected_and_overlap_refused(binding, tmp_path):
+    runtime = tmp_path / "runtime"
+    binding = replace(binding, runtime_path=runtime, runtime_sha256="b" * 64)
+    backend = BwrapExtension({"base_dir": str(tmp_path / "workspaces")})
+    profile = load_profile("profile.bwrap-local")
+    consumer = Consumer(actor="agt", project="fixture", run_id="run-1")
+    binding.validate(profile, consumer, backend, {})
+    assert backend.config["runtime"] == {"path": str(runtime), "sha256": "b" * 64}
+    with pytest.raises(ValueError, match="overlaps"):
+        replace(binding, runtime_path=binding.socket_path.parent).validate(
+            profile, consumer, backend, {}
+        )
+    with pytest.raises(ValueError, match="exact path"):
+        replace(binding, runtime_sha256=None).validate(profile, consumer, backend, {})