code-sandboxes 1.9.11__tar.gz → 1.9.14__tar.gz

{code_sandboxes-1.9.11 → code_sandboxes-1.9.14}/CHANGELOG.md

@@ -8,6 +8,36 @@
 
 ## Unreleased
 
+## 1.9.14
+
+- **`datalayer/python-cpu:2026.09` base channel repinned** to the rebuilt
+  `jupyter-python:0.2.2` (now carrying `jupyter-kernels==1.2.23`) plus the
+  contract layer, digest
+  `sha256:aa5413000bb5b6ecd0a0cf03959b107f0d572f65bf230c08bbdf9a4569775545`,
+  released 2026-09-16 to `environments/base/python-cpu`. Every variant pins the
+  same digest.
+
+## 1.9.13
+
+- **`jupyter-kernels==1.2.23` forced into `sandbox-contract/v1`**: it carries
+  the pooled kernel manager the runtime's Jupyter config selects
+  (`kernel_manager_class = jupyter_kernels.pool.mapping.PooledMappingKernelManager`),
+  replacing the deprecated private `datalayer-kernels`. PyPI serves it, so a
+  resolve satisfies it from the index and the wheelhouse carries no wheel for
+  it; the pin keeps `uv pip sync --require-hashes` from stripping it out of a
+  user environment's image.
+
+## 1.9.12
+
+- **`owner_repository`, `owner_cache_repository` and `ECR_ENVIRONMENT_PREFIX`
+  moved from `environments.adapters.datalayer` to `environments.builders`**
+  (PLAN_ENV E1-14): Runtimes now validates a smoke-test launch's artifact
+  against this same repository shape, and `builders` is the neutral module a
+  service may import — `adapters.datalayer` is not, and importing it from a
+  service binds that service to the Datalayer provider the way
+  `check_provider_boundary.py` exists to prevent. Re-exported from the
+  adapter unchanged, so every existing `from .datalayer import owner_repository` still works. No behavior change; 78 tests still pass.
+
 ## 1.9.11
 
 - **1.9.10's own fix did not work: `--registry-referrers-mode` only ever
@@ -17,8 +47,7 @@
   landed as an OCI 1.1 referrer, no legacy tag. `Attestor` no longer tries
   to force cosign's own storage choice. Its replay check and its own
   `signature_ref` now ask cosign directly, the same way the Operator's own
-  verify will: `can_verify(reference)` runs `cosign verify --key <key>
-  --insecure-ignore-tlog=true <reference>` and answers its exit code, and
+  verify will: `can_verify(reference)` runs `cosign verify --key <key> --insecure-ignore-tlog=true <reference>` and answers its exit code, and
   `signature_ref` is the digest reference itself — what `cosign verify`
   takes, not a tag it may or may not have written. Signing the same digest
   twice no longer errors the way a second push under the old immutable tag
@@ -31,8 +60,7 @@
 - **cosign signs the legacy tag again, not just an OCI referrer**
   (`environments.attest`; PLAN_ENV.md E1-09). cosign 3.1.3 defaults to the
   OCI 1.1 referrers API for a signature's own storage, not the classic
-  `sha256-<hex>.sig` sidecar tag. Found live on r1, 2026-09-14: `cosign
-  sign` reported success — the first artifact this pipeline ever actually
+  `sha256-<hex>.sig` sidecar tag. Found live on r1, 2026-09-14: `cosign sign` reported success — the first artifact this pipeline ever actually
   signed — but pushed no such tag; `_signature_exists`'s own replay check
   and the `signature_ref` this workflow records both assume one exists.
   `--registry-referrers-mode=legacy` restores it. `cosign verify` needs no
@@ -54,8 +82,7 @@
 ## 1.9.8
 
 - **Every page of a scan's findings is read before deciding**
-  (`environments.attest`; PLAN_ENV.md E1-08, D-11). `describe_image_scan_
-  findings` paginates, and the attestor called it exactly once. Found live
+  (`environments.attest`; PLAN_ENV.md E1-08, D-11). `describe_image_scan_ findings` paginates, and the attestor called it exactly once. Found live
   on r1, 2026-09-14: the first real image with more findings than one page
   had 1,547 enhanced findings, 31 of them critical, and the single-page read
   saw a small enough slice that the decision passed — an image with real,
@@ -66,8 +93,7 @@
 
 ## 1.9.7
 
-- **cosign signs again under `--use-signing-config=false`** (`environments
-  .attest`; PLAN_ENV.md E1-09). cosign 3.1.3 defaults `--use-signing-config`
+- **cosign signs again under `--use-signing-config=false`** (`environments .attest`; PLAN_ENV.md E1-09). cosign 3.1.3 defaults `--use-signing-config`
   to `true`: a TUF-provided signing config now names the service URLs,
   including a transparency log, and `--tlog-upload=false` alone no longer
   overrides that — cosign refused the combination outright (found live on
@@ -100,8 +126,7 @@
   from the same snapshot. This replaces a `deb` line that named only `main`
   (`gdal-bin` is in `universe`) and left the live mirror enabled beside it.
   `DATALAYER_APT_SNAPSHOT` must now be a snapshot id.
-- **A private registry's credential is resolved and used** (`environments
-  .image_import`, `environments.resolve`; PLAN_ENV.md E3-04's second half).
+- **A private registry's credential is resolved and used** (`environments .image_import`, `environments.resolve`; PLAN_ENV.md E3-04's second half).
   `image.credentialSecretId` used to only clear the allowlist check; nothing
   fetched or used the credential it named. It is now fetched through the
   same IAM route a build secret is (E3-05), and sent as HTTP Basic on the
@@ -113,8 +138,7 @@
 - **The Datalayer base channel's own five ESM-locked advisories are allowed**
   (`environments.policy`; PLAN_ENV.md E1-08). Amazon Inspector marks all five
   fixable, but the fix is an Ubuntu ESM package version a plain
-  `apt-get upgrade` cannot reach. Reviewed and added to `DEFAULT_POLICY
-  .allowed`, 2026-09-14, so they are recorded as allowed rather than missed,
+  `apt-get upgrade` cannot reach. Reviewed and added to `DEFAULT_POLICY .allowed`, 2026-09-14, so they are recorded as allowed rather than missed,
   and any other critical still blocks.
 
 ## 1.9.4

{code_sandboxes-1.9.11 → code_sandboxes-1.9.14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code_sandboxes
-Version: 1.9.11
+Version: 1.9.14
 Project-URL: Home, https://github.com/datalayer/code-sandboxes
 Author-email: Datalayer <info@datalayer.io>
 License: BSD 3-Clause License
@@ -45,6 +45,7 @@ Requires-Dist: jupyter-kernel-client>=1.0.2
 Requires-Dist: jupyter-server
 Requires-Dist: jupyter-server-client
 Requires-Dist: pydantic>=2.0
+Requires-Dist: pyyaml
 Requires-Dist: rich
 Requires-Dist: typer>=0.12.0
 Provides-Extra: all
@@ -96,6 +97,7 @@ Requires-Dist: pytest-cov>=4.0; extra == 'test'
 Requires-Dist: pytest>=7.0; extra == 'test'
 Provides-Extra: typing
 Requires-Dist: mypy>=0.990; extra == 'typing'
+Requires-Dist: types-pyyaml; extra == 'typing'
 Description-Content-Type: text/markdown
 
 <!--

{code_sandboxes-1.9.11 → code_sandboxes-1.9.14}/code_sandboxes/__version__.py

@@ -3,4 +3,4 @@
 
 """Code Sandboxes."""
 
-__version__ = "1.9.11"
+__version__ = "1.9.14"

{code_sandboxes-1.9.11 → code_sandboxes-1.9.14}/code_sandboxes/environments/__init__.py

@@ -49,8 +49,12 @@ from .contract import (
     CONTRACT_V1,
     SANDBOX_CONTRACT_V1,
     SUPPORTED_CONTRACTS,
+    BuildContextEntry,
+    BuildContextFinding,
     SandboxContract,
+    check_build_context,
     check_dockerfile,
+    validate_build_context,
     validate_dockerfile,
 )
 from .errors import ERROR_CODES, EnvironmentsError, ErrorCode, map_provider_error
@@ -91,6 +95,8 @@ __all__ = [
     "ApprovedBase",
     "ArtifactReference",
     "Attestor",
+    "BuildContextEntry",
+    "BuildContextFinding",
     "BuildRequest",
     "BuildkitResolveRunner",
     "CapabilityReport",
@@ -114,6 +120,7 @@ __all__ = [
     "can_transition",
     "canonical_digest",
     "canonical_json",
+    "check_build_context",
     "check_dockerfile",
     "decide",
     "fingerprint_matches",
@@ -131,6 +138,7 @@ __all__ = [
     "spec_digest",
     "spec_findings",
     "transition",
+    "validate_build_context",
     "validate_dockerfile",
     "validate_environment",
 ]

{code_sandboxes-1.9.11 → code_sandboxes-1.9.14}/code_sandboxes/environments/adapters/datalayer.py

@@ -50,6 +50,7 @@ from typing import Any, Callable
 
 from ..build_secrets import resolve_build_secret
 from ..builders import (
+    ECR_ENVIRONMENT_PREFIX,
     ArtifactMetadata,
     ArtifactReference,
     BuildRequest,
@@ -57,6 +58,8 @@ from ..builders import (
     CapabilityReport,
     CapabilitySet,
     ValidationResult,
+    owner_cache_repository,
+    owner_repository,
 )
 from ..contract import SANDBOX_CONTRACT_V1
 from ..errors import (
@@ -75,6 +78,12 @@ from ..resolve import (
     apt_snapshot_in,
     locked_versions,
 )
+from ..resolve_conda import (
+    MICROMAMBA_BINARY,
+    conda_lock_pip_requirements,
+    is_conda_lock,
+    micromamba_bootstrap_dockerfile_line,
+)
 from ..spec import BuildSecret, Environment, command_names_secret
 
 __all__ = [
@@ -84,9 +93,6 @@ __all__ = [
     "owner_repository",
 ]
 
-#: Where an owner's environments live in ECR (D-10).
-ECR_ENVIRONMENT_PREFIX = "environments/u/"
-
 #: The size classes a Datalayer sandbox runs (D-4). The GPU ones stay in the
 #: specification and run on Modal or Daytona until E4-11 (D-20).
 CPU_SIZE_CLASSES = ("small", "medium", "large")
@@ -98,34 +104,12 @@ DEFAULT_MAX_BUILD_SECONDS = 45 * 60
 #: and waited for at every cold start.
 DEFAULT_MAX_ARTIFACT_BYTES = 20 * 1024**3
 
-
-def owner_repository(owner_uid: str, environment_name: str) -> str:
-    """The owner's repository for one environment: ``environments/u/<owner>/<name>``.
-
-    Lowercased: an ECR repository name matches
-    ``[a-z0-9]+((\\.|_|__|-+)[a-z0-9]+)*`` per path segment, and this
-    project's own uids are ULIDs, conventionally uppercase — found live,
-    2026-09-14, the first real build ever run for a real account's own
-    uid rather than a lowercase test fixture: ``DescribeRepositories``
-    refused it outright, "Invalid parameter at 'repositoryName'". Lowering
-    both segments here, the one place this reference is built, keeps every
-    caller (create, inspect, exists, delete) consistent with itself without
-    each needing to remember to.
-    """
-    if not owner_uid or not environment_name:
-        raise ValueError("an owner and an environment name make the repository")
-    return f"{ECR_ENVIRONMENT_PREFIX}{owner_uid}/{environment_name}".lower()
-
-
-def owner_cache_repository(owner_uid: str) -> str:
-    """The owner's own BuildKit cache repository: ``environments/cache/u/<owner>``.
-
-    Lowercased for the same reason ``owner_repository`` is (a ULID, not a
-    lowercase test fixture, is what a real build actually names).
-    """
-    if not owner_uid:
-        raise ValueError("an owner makes the cache repository")
-    return f"environments/cache/u/{owner_uid}".lower()
+# `ECR_ENVIRONMENT_PREFIX`, `owner_repository` and `owner_cache_repository`
+# moved to `..builders` (E1-14): Runtimes validates a smoke-test launch's
+# artifact against this same repository shape, and `builders` is the neutral
+# module a service may import — this adapter is not. Re-exported here, still
+# `from .datalayer import owner_repository`, for every caller that already
+# does; nothing about their behavior changed.
 
 
 def _secret_mount(secret: BuildSecret) -> str:
@@ -251,8 +235,8 @@ class Builder:
             findings.append(
                 CapabilityFinding(
                     code=CAPABILITY_UNSUPPORTED.code,
-                    message="conda environments are resolved by their own solver, "
-                    "which is not built yet",
+                    message="a conda environment is brought as a `dependencyFile` "
+                    "whose `sourceFormat` is `conda`, not through `packages`",
                     field="spec.packages.python.manager",
                 )
             )
@@ -275,7 +259,8 @@ class Builder:
                     field="spec.platform.architecture",
                 )
             )
-        if lock_text is not None and not locked_versions(lock_text):
+        pins_or_lock = lock_text is not None and not is_conda_lock(lock_text)
+        if pins_or_lock and not locked_versions(lock_text):
             findings.append(
                 CapabilityFinding(
                     code=SPEC_INVALID.code,
@@ -345,18 +330,45 @@ class Builder:
                 f"COPY wheelhouse/ {imported_wheelhouse}/",
                 'RUN pip install --no-cache-dir "uv==0.12.11"',
             ]
-        lines.extend(
-            [
-                "COPY lock.txt /opt/datalayer/lock.txt",
-                # `sync` and not `install`: the artifact holds the lock's set,
-                # and `--require-hashes` means every byte was the resolved one.
-                # `--find-links` for what no index has — a protected pin's
-                # own wheel, the fork's local version above all (E1-04).
-                "RUN --mount=type=cache,target=/root/.cache/uv "
-                f"uv pip sync --system --require-hashes --find-links {find_links} "
-                "/opt/datalayer/lock.txt",
-            ]
-        )
+        if is_conda_lock(request.lock_text):
+            # A conda source (E3-02): the lock is an `@EXPLICIT` file
+            # `micromamba install --file` installs without re-solving, and the
+            # pip layer the solve resolved — the user's own pip requirements and
+            # the protected pins forced over them — is in the lock's own
+            # `# datalayer-pip:` header. The conda layer goes into the base's
+            # own environment; the pip layer follows, so the kernel stack
+            # (E1-04) and everything the solve installed is present the same as
+            # every source. micromamba is copied in from its pinned image
+            # first: the approved base bakes uv and the wheelhouse but not it.
+            pip_requirements = conda_lock_pip_requirements(request.lock_text)
+            lines.extend(
+                [
+                    micromamba_bootstrap_dockerfile_line(),
+                    "COPY lock.txt /opt/datalayer/lock.txt",
+                    "RUN --mount=type=cache,target=/opt/conda/pkgs "
+                    f"{MICROMAMBA_BINARY} install --yes --name base "
+                    "--file /opt/datalayer/lock.txt",
+                ]
+            )
+            if pip_requirements:
+                requirements = " ".join(shlex.quote(req) for req in pip_requirements)
+                lines.append(
+                    "RUN --mount=type=cache,target=/root/.cache/uv "
+                    f"uv pip install --system --find-links {find_links} {requirements}"
+                )
+        else:
+            lines.extend(
+                [
+                    "COPY lock.txt /opt/datalayer/lock.txt",
+                    # `sync` and not `install`: the artifact holds the lock's set,
+                    # and `--require-hashes` means every byte was the resolved one.
+                    # `--find-links` for what no index has — a protected pin's
+                    # own wheel, the fork's local version above all (E1-04).
+                    "RUN --mount=type=cache,target=/root/.cache/uv "
+                    f"uv pip sync --system --require-hashes --find-links {find_links} "
+                    "/opt/datalayer/lock.txt",
+                ]
+            )
         # A build secret is mounted on the postInstall commands that name it
         # and nowhere else (§4.1, D-11): never an `ARG` or `ENV`, which bakes a
         # value into the image's history, never the package-install or files

{code_sandboxes-1.9.11 → code_sandboxes-1.9.14}/code_sandboxes/environments/adapters/daytona.py

@@ -87,6 +87,7 @@ item 7).
 
 from __future__ import annotations
 
+import shlex
 import tempfile
 import uuid
 from collections.abc import Callable
@@ -110,6 +111,11 @@ from ..errors import (
 )
 from ..files import files_step
 from ..resolve import WHEELHOUSE_IMAGE_PATH, apt_pins_in
+from ..resolve_conda import (
+    conda_lock_pip_requirements,
+    is_conda_lock,
+    micromamba_bootstrap_command,
+)
 from ..spec import GPU_SIZE_CLASSES, Environment
 from .managed import ManagedBuilder
 
@@ -171,6 +177,10 @@ class Builder(ManagedBuilder):
     variant = "daytona"
     item = "E2-04"
     title = "Daytona"
+    #: A `packages` list and, for conda (E3-02), an `environment.yml`
+    #: dependency file installed with `micromamba`.
+    build_sources = ("packages", "dependencyFile")
+    dependency_formats = ("conda",)
     #: Daytona runs GPUs, on its own hardware and the owner's account (E2-17).
     #: This builder does not build one yet: see `_own_findings`.
     gpu = True
@@ -343,28 +353,43 @@ class Builder(ManagedBuilder):
                 # wheelhouse again would only duplicate what `uv pip sync`
                 # can already reach at `WHEELHOUSE_IMAGE_PATH`. Only the
                 # lock is genuinely per-build.
-                image = (
-                    image.add_local_file(str(lock_file), _LOCK_PATH)
+                image = image.add_local_file(str(lock_file), _LOCK_PATH)
+                if is_conda_lock(request.lock_text):
+                    # A conda source (E3-02): `micromamba install --file`
+                    # reads the `@EXPLICIT` lock without re-solving, and the
+                    # pip layer the solve resolved — the user's pip
+                    # requirements and the protected pins over them — comes
+                    # from the lock's own `# datalayer-pip:` header, so the
+                    # kernel stack (E1-04) and everything the solve installed is
+                    # present the same as for a pip source. micromamba is
+                    # installed first: the approved base bakes uv but not it.
+                    image = image.run_commands(micromamba_bootstrap_command())
+                    image = image.run_commands(
+                        f"micromamba install --yes --name base --file {_LOCK_PATH}"
+                    )
+                    pip_requirements = conda_lock_pip_requirements(request.lock_text)
+                    if pip_requirements:
+                        requirements = " ".join(shlex.quote(req) for req in pip_requirements)
+                        image = image.run_commands(
+                            "pip install --no-cache-dir "
+                            f"--find-links {WHEELHOUSE_IMAGE_PATH} {requirements}"
+                        )
+                else:
                     # `uv` is not installed here: the approved base already
                     # bakes it (E1-05, `resolve.py`'s own `bootstrap_uv`
                     # docstring — "an approved Datalayer base already has it
-                    # baked in"), and this phase's `build_sources` is
-                    # `("packages",)` only, so every build starts from that
-                    # base. Reinstalling it added an extra un-hashed network
-                    # fetch outside the resolved lock for no reason (found in
-                    # review) — matching the Datalayer builder's own
-                    # `dockerfile()`, which installs `uv` only for the
-                    # `image` source, not implemented for this variant yet.
+                    # baked in"). Reinstalling it added an extra un-hashed
+                    # network fetch outside the resolved lock for no reason
+                    # (found in review).
                     #
                     # Packages install as root, the same reason the
                     # Datalayer and E2B builders give: a user install lands
                     # under the content directory's own home, which the
                     # runtime mounts over.
-                    .run_commands(
+                    image = image.run_commands(
                         "uv pip sync --system --require-hashes "
                         f"--find-links {WHEELHOUSE_IMAGE_PATH} {_LOCK_PATH}"
                     )
-                )
                 image = image.dockerfile_commands([f"USER 1000:100\nWORKDIR {_CONTENT_DIR}"])
                 for command in files_step(request.environment, variant=self.variant):
                     image = image.run_commands(command)

{code_sandboxes-1.9.11 → code_sandboxes-1.9.14}/code_sandboxes/environments/adapters/e2b.py

@@ -119,6 +119,7 @@ never went through a `smoke_test` method either.
 
 from __future__ import annotations
 
+import shlex
 import tempfile
 from collections.abc import Callable
 from pathlib import Path
@@ -140,6 +141,11 @@ from ..errors import (
 )
 from ..files import files_step
 from ..resolve import WHEELHOUSE_PATH, apt_pins_in
+from ..resolve_conda import (
+    conda_lock_pip_requirements,
+    is_conda_lock,
+    micromamba_bootstrap_command,
+)
 from ..spec import Environment
 from .managed import ManagedBuilder
 
@@ -191,6 +197,10 @@ class Builder(ManagedBuilder):
     variant = "e2b"
     item = "E2-03"
     title = "E2B"
+    #: A `packages` list and, for conda (E3-02), an `environment.yml`
+    #: dependency file installed with `micromamba`.
+    build_sources = ("packages", "dependencyFile")
+    dependency_formats = ("conda",)
     #: Firecracker microVMs: no GPU passthrough.
     gpu = False
     #: E0-04's spike found only a registry login for the private base, never
@@ -390,15 +400,38 @@ class Builder(ManagedBuilder):
                 chain.copy("datalayer-sandbox", _DOCTOR_PATH, mode=0o755, user="root")
                 .copy("wheelhouse", _WHEELHOUSE_PATH, user="root")
                 .copy("lock.txt", _LOCK_PATH, user="root")
-                .run_cmd(f'pip install --no-cache-dir "uv=={_UV_VERSION}"', user="root")
-                # Packages install as root (E0-04): a user install lands
-                # under /home/user, which the runtime mounts over.
-                .run_cmd(
+            )
+            if is_conda_lock(request.lock_text):
+                # A conda source (E3-02): `micromamba install --file` reads the
+                # `@EXPLICIT` lock without re-solving, and the pip layer the
+                # solve resolved — the user's pip requirements and the protected
+                # pins over them — comes from the lock's own `# datalayer-pip:`
+                # header, so the kernel stack (E1-04) and everything the solve
+                # installed is present the same as for a pip source. micromamba
+                # is installed first: the approved base bakes uv but not it.
+                chain = chain.run_cmd(micromamba_bootstrap_command(), user="root")
+                chain = chain.run_cmd(
+                    f"micromamba install --yes --name base --file {_LOCK_PATH}",
+                    user="root",
+                )
+                pip_requirements = conda_lock_pip_requirements(request.lock_text)
+                if pip_requirements:
+                    requirements = " ".join(shlex.quote(req) for req in pip_requirements)
+                    chain = chain.run_cmd(
+                        f"pip install --no-cache-dir --find-links {_WHEELHOUSE_PATH} "
+                        f"{requirements}",
+                        user="root",
+                    )
+            else:
+                chain = chain.run_cmd(
+                    f'pip install --no-cache-dir "uv=={_UV_VERSION}"', user="root"
+                ).run_cmd(
+                    # Packages install as root (E0-04): a user install lands
+                    # under /home/user, which the runtime mounts over.
                     "uv pip sync --system --require-hashes "
                     f"--find-links {_WHEELHOUSE_PATH} {_LOCK_PATH}",
                     user="root",
                 )
-            )
             for command in files_step(request.environment, variant=self.variant):
                 chain = chain.run_cmd(command)
             for command in spec.commands.post_install:

{code_sandboxes-1.9.11 → code_sandboxes-1.9.14}/code_sandboxes/environments/adapters/managed.py

@@ -36,7 +36,7 @@ from ..builders import (
     ValidationResult,
 )
 from ..errors import CAPABILITY_UNSUPPORTED, SPEC_INVALID, EnvironmentsError
-from ..spec import GPU_SIZE_CLASSES, Environment
+from ..spec import GPU_SIZE_CLASSES, Environment, EnvironmentSpec
 
 __all__ = ["ManagedBuilder"]
 
@@ -67,6 +67,11 @@ class ManagedBuilder:
     supports_build_secrets = True
     #: The build sources it will accept in this phase.
     build_sources: tuple[str, ...] = ("packages",)
+    #: When `dependencyFile` is among `build_sources`, the `sourceFormat`s the
+    #: variant's own build actually installs. A conda source (E3-02) installs
+    #: with `micromamba`; a `pyproject`/`requirements` dependencyFile is not
+    #: built for a managed variant yet (E3-01), so it is not listed here.
+    dependency_formats: tuple[str, ...] = ()
     package_managers: tuple[str, ...] = ("uv", "pip")
     #: Dockerfile instructions its own builder does not implement (§6).
     forbidden_instructions: tuple[str, ...] = ()
@@ -121,6 +126,8 @@ class ManagedBuilder:
                     field="spec.build.source",
                 )
             )
+        elif spec.build.source == "dependencyFile":
+            findings.extend(self._dependency_file_findings(spec))
         if spec.packages.python.manager not in self.package_managers:
             findings.append(
                 CapabilityFinding(
@@ -141,34 +148,7 @@ class ManagedBuilder:
                 )
             )
         if not self.gpu:
-            # A GPU is asked for two ways, and the spec's own validation
-            # couples them; a `validate` can be reached before that, so both
-            # are read here rather than trusting the coupling.
-            if spec.resources.size_class in GPU_SIZE_CLASSES:
-                findings.append(
-                    CapabilityFinding(
-                        code=CAPABILITY_UNSUPPORTED.code,
-                        message=(
-                            f"{self.title} has no GPU, so `{spec.resources.size_class}` cannot be "
-                            f"built for it. Drop {self.variant} from the variants, or build "
-                            "the GPU classes for modal or daytona, which run them on their "
-                            "own hardware"
-                        ),
-                        field="spec.resources.sizeClass",
-                    )
-                )
-            elif spec.resources.accelerator != "none":
-                findings.append(
-                    CapabilityFinding(
-                        code=CAPABILITY_UNSUPPORTED.code,
-                        message=(
-                            f"{self.title} has no GPU, so an accelerator cannot be built for it. "
-                            f"Drop {self.variant} from the variants, or build the GPU classes for "
-                            "modal or daytona, which run them on their own hardware"
-                        ),
-                        field="spec.resources.accelerator",
-                    )
-                )
+            findings.extend(self._gpu_findings(spec))
         if self.regions:
             asked = [
                 region
@@ -201,6 +181,58 @@ class ManagedBuilder:
             )
         return findings
 
+    def _gpu_findings(self, spec: EnvironmentSpec) -> list[CapabilityFinding]:
+        """A variant with no GPU refuses either way a GPU is asked for. A GPU
+        is asked two ways, and the spec's own validation couples them; a
+        `validate` can be reached before that, so both are read here rather
+        than trusting the coupling."""
+        if spec.resources.size_class in GPU_SIZE_CLASSES:
+            return [
+                CapabilityFinding(
+                    code=CAPABILITY_UNSUPPORTED.code,
+                    message=(
+                        f"{self.title} has no GPU, so `{spec.resources.size_class}` cannot be "
+                        f"built for it. Drop {self.variant} from the variants, or build "
+                        "the GPU classes for modal or daytona, which run them on their "
+                        "own hardware"
+                    ),
+                    field="spec.resources.sizeClass",
+                )
+            ]
+        if spec.resources.accelerator != "none":
+            return [
+                CapabilityFinding(
+                    code=CAPABILITY_UNSUPPORTED.code,
+                    message=(
+                        f"{self.title} has no GPU, so an accelerator cannot be built for it. "
+                        f"Drop {self.variant} from the variants, or build the GPU classes for "
+                        "modal or daytona, which run them on their own hardware"
+                    ),
+                    field="spec.resources.accelerator",
+                )
+            ]
+        return []
+
+    def _dependency_file_findings(self, spec: EnvironmentSpec) -> list[CapabilityFinding]:
+        """A `dependencyFile` this variant accepts still only builds the
+        `sourceFormat`s it has an install step for (E3-01, E3-02): a conda
+        file installs with `micromamba`, but a `pyproject` or `requirements`
+        one is not built for a managed variant yet."""
+        source_format = spec.build.dependency_file.source_format
+        if source_format in self.dependency_formats:
+            return []
+        return [
+            CapabilityFinding(
+                code=CAPABILITY_UNSUPPORTED.code,
+                message=(
+                    f"a `{source_format}` dependency file is not built for "
+                    f"{self.title} yet; it builds "
+                    f"{', '.join(self.dependency_formats) or 'no dependency file'}"
+                ),
+                field="spec.build.dependencyFile.sourceFormat",
+            )
+        ]
+
     def _own_findings(
         self, environment: Environment, lock_text: str | None
     ) -> list[CapabilityFinding]: