Package sandbox definitions and build a pinned owner runtime

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

tests/test_runtime_builder.py

@@ -50,3 +50,22 @@ def test_incomplete_claude_pin_refuses_before_build(tmp_path):
     with pytest.raises(ValueError, match="supplied together"):
         builder.build(tmp_path / "out", tmp_path, tmp_path, claude_binary=tmp_path / "claude")
     assert not (tmp_path / "out").exists()
+
+
+def test_owner_build_requires_matching_sibling_lock_before_output(tmp_path, monkeypatch):
+    import json
+    rein = tmp_path / "rein"
+    llm = tmp_path / "llm"
+    output = tmp_path / "output"
+    def checked(argv, **kwargs):
+        if "--porcelain" in argv:
+            return ""
+        if "rev-parse" in argv:
+            return "a" * 40
+        return json.dumps({"ok": True, "dependencies": [
+            {"distribution": "llm-connect", "commit": "b" * 40}
+        ]})
+    monkeypatch.setattr(builder, "checked", checked)
+    with pytest.raises(ValueError, match="does not match"):
+        builder.build(output, rein, llm, owner_runtime=True)
+    assert not output.exists()