code-sandboxes 1.9.13__tar.gz → 1.9.17__tar.gz

{code_sandboxes-1.9.13 → code_sandboxes-1.9.17}/CHANGELOG.md

@@ -8,6 +8,70 @@
 
 ## Unreleased
 
+## 1.9.17
+
+- **An artifact's size is read from the registry** (`environments/attest.py`;
+  PLAN_ENVS.md E1-25). `attest_artifact` took `size_bytes` from its caller and
+  nobody ever passed one — the builder answers a reference, not a weight — so
+  every artefact was recorded with `sizeBytes: null` and
+  `environments.artifact.bytes`, the series section 14 tracks the artifact
+  size in, had no point in it although artifacts had been recorded (seen on r1,
+  2026-09-16, through the OTEL query API). `Attestor.size_of()` asks the
+  registry, with the client the scan is already read from, and a size that
+  cannot be read is logged rather than raised: a missing number on a dashboard
+  is not a reason to refuse an artifact that is otherwise signed. 3 new tests.
+
+## 1.9.15
+
+- **A restart restarts the kernel, not just this client's socket**
+  (`jupyter_server_sandbox`, `client`; PLAN_ENV.md E0-09, Appendix B check
+  7). `CodeSandboxClient.restart()` was `stop()` then `start()`, which is
+  right for a sandbox this process owns — it is destroyed and recreated, and
+  nothing survives — and wrong for one *attached* to a Jupyter server
+  somebody else runs, which is every Datalayer runtime pod: stopping drops
+  the websocket while the kernel process keeps running, so the reconnect
+  lands in the same interpreter with every global still set. Check 7 is
+  "nothing is assumed to persist across restarts", and it read `state survived the restart ('True')` for exactly this reason — found live on r1,
+  2026-09-16, the first drill whose smoke test reached the check.
+  `JupyterServerSandbox.restart_kernel()` now asks the server's own
+  `POST /api/kernels/{id}/restart` (the way `_do_interrupt` already uses the
+  API rather than the client's lifecycle) and reconnects onto the new
+  kernel; `restart()` prefers it and falls back to the lifecycle for every
+  variant that draws no such distinction. 7 new tests.
+- **`datalayer/python-cpu:2026.09` repinned** to
+  `sha256:122d3e31f5e2507251457cbf47871c39ac1753adb1d83777ab0743fa11cd6148`:
+  the contract layer now sets `MappingKernelManager.root_dir`, so kernels
+  start in `/home/datalayer/content`. The image already declared `WORKDIR`
+  there and `sandbox-contract/v1`'s User row already required it, but a
+  kernel's cwd is the Jupyter server's to choose and jupyter-python's config
+  roots it at `$HOME` — so every environment's kernel ran in
+  `/home/datalayer` and Appendix B check 2 read `cwd is '/home/datalayer', not '/home/datalayer/content'`. The file browser stays rooted at `$HOME`,
+  where a person expects to see everything they have; only the kernel moves.
+- Two assertions that had rotted through three base releases are pinned in
+  one place again: the channel's digest and its apt snapshot were duplicated
+  across `test_environment_bases.py` and `test_environment_resolve.py`, and
+  2026-09-15's and 2026-09-16's releases left both red rather than catching
+  anything.
+
+## 1.9.14
+
+- **`datalayer/python-cpu:2026.09` base channel repinned** to the rebuilt
+  `jupyter-python:0.2.2` (now carrying `jupyter-kernels==1.2.23`) plus the
+  contract layer, digest
+  `sha256:aa5413000bb5b6ecd0a0cf03959b107f0d572f65bf230c08bbdf9a4569775545`,
+  released 2026-09-16 to `environments/base/python-cpu`. Every variant pins the
+  same digest.
+
+## 1.9.13
+
+- **`jupyter-kernels==1.2.23` forced into `sandbox-contract/v1`**: it carries
+  the pooled kernel manager the runtime's Jupyter config selects
+  (`kernel_manager_class = jupyter_kernels.pool.mapping.PooledMappingKernelManager`),
+  replacing the deprecated private `datalayer-kernels`. PyPI serves it, so a
+  resolve satisfies it from the index and the wheelhouse carries no wheel for
+  it; the pin keeps `uv pip sync --require-hashes` from stripping it out of a
+  user environment's image.
+
 ## 1.9.12
 
 - **`owner_repository`, `owner_cache_repository` and `ECR_ENVIRONMENT_PREFIX`

{code_sandboxes-1.9.13 → code_sandboxes-1.9.17}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code_sandboxes
-Version: 1.9.13
+Version: 1.9.17
 Project-URL: Home, https://github.com/datalayer/code-sandboxes
 Author-email: Datalayer <info@datalayer.io>
 License: BSD 3-Clause License

{code_sandboxes-1.9.13 → code_sandboxes-1.9.17}/code_sandboxes/__version__.py

@@ -3,4 +3,4 @@
 
 """Code Sandboxes."""
 
-__version__ = "1.9.13"
+__version__ = "1.9.17"

{code_sandboxes-1.9.13 → code_sandboxes-1.9.17}/code_sandboxes/client.py

@@ -508,7 +508,21 @@ class CodeSandboxClient:
         return self.is_started
 
     def restart(self) -> None:
-        """Restart the wrapped sandbox through its public lifecycle."""
+        """Restart the wrapped sandbox, clearing what it was holding.
+
+        A sandbox this process owns is restarted by its own lifecycle: stop
+        and start destroy and recreate it, and nothing survives. One that is
+        merely *attached* to a server somebody else runs — a Jupyter server
+        in a Datalayer runtime pod — is not: stopping drops this client's
+        websocket while the kernel process goes on running, and starting
+        reconnects to the same interpreter with every global still set. A
+        sandbox that knows how to restart what it is attached to says so with
+        `restart_kernel`, and that is used in preference; the lifecycle is
+        the fallback for every variant that has no such distinction.
+        """
+        restart_kernel = getattr(self._sandbox, "restart_kernel", None)
+        if callable(restart_kernel) and restart_kernel():
+            return
         self._sandbox.stop()
         self._sandbox.start()
 

{code_sandboxes-1.9.13 → code_sandboxes-1.9.17}/code_sandboxes/environments/attest.py

@@ -536,10 +536,35 @@ class Attestor:
             signature_ref=signature,
             sbom_ref=sbom_ref or f"{registry}/{repository}@{digest}.sbom",
             provenance_ref=provenance_ref or f"{registry}/{repository}@{digest}.att",
-            size_bytes=size_bytes,
+            size_bytes=size_bytes
+            if size_bytes is not None
+            else self.size_of(repository=repository, digest=digest),
             signed_now=signed_now,
         )
 
+    def size_of(self, *, repository: str, digest: str) -> int | None:
+        """What the registry says the artifact weighs, or None.
+
+        Nobody hands the size down: the builder answers a reference, not a
+        weight, so until this asked the registry `size_bytes` was always None
+        — and with it `environments.artifact.bytes`, the series section 14
+        tracks the artifact size in, which had no point in it on 2026-09-16
+        although artifacts had been recorded. The registry has known all
+        along; the scan is read from the same client.
+
+        Never a reason to fail an attestation: a size that could not be read
+        is a missing number on a dashboard, and the artifact is still signed.
+        """
+        try:
+            images = self._client().describe_images(
+                repositoryName=repository, imageIds=[{"imageDigest": digest}]
+            )["imageDetails"]
+        except Exception as error:
+            self._log(f"The artifact's size could not be read: {error}")
+            return None
+        size = (images[0] or {}).get("imageSizeInBytes") if images else None
+        return int(size) if size else None
+
     def _client(self) -> Any:
         if self._ecr is None:
             try:

{code_sandboxes-1.9.13 → code_sandboxes-1.9.17}/code_sandboxes/environments/bases.py

@@ -109,8 +109,9 @@ APPROVED_BASES: dict[str, ApprovedBase] = {
     base.ref: base
     for base in (
         # E1-05: jupyter-python:0.2.2 (Ubuntu security packages and conda's own
-        # OpenSSL upgraded, JupyterLab's staging yarn.lock dropped) plus the
-        # contract layer, released 2026-09-14 to environments/base/python-cpu.
+        # OpenSSL upgraded, JupyterLab's staging yarn.lock dropped, jupyter-kernels
+        # installed) plus the contract layer, released 2026-09-16 to
+        # environments/base/python-cpu.
         # One image, so every variant pins the same digest until a variant
         # needs a base of its own. The prior digest, jupyter-python:0.2.1,
         # carried 31 fixable-critical findings the scan (E1-08) blocks every
@@ -125,10 +126,19 @@ APPROVED_BASES: dict[str, ApprovedBase] = {
                     # `.spec.VARIANTS`, spelled out: `spec` imports from this
                     # module, so importing it back here would be circular.
                     ("datalayer", "e2b", "daytona", "modal"),
-                    "sha256:334adf6c2714c8919ef60beeca1db12e3531a391c9dde41932c782f81c432b36",
+                    # 2026-09-16: kernels now start in the contract's own
+                    # working directory. The image already declared `WORKDIR
+                    # /home/datalayer/content`, but a kernel's cwd is the
+                    # Jupyter server's to choose, and jupyter-python's config
+                    # roots it at `$HOME` — so every environment's kernel ran
+                    # in `/home/datalayer` and Appendix B check 2 read "cwd is
+                    # '/home/datalayer', not '/home/datalayer/content'". The
+                    # contract layer now sets `MappingKernelManager.root_dir`,
+                    # which moves the kernel without moving the file browser.
+                    "sha256:122d3e31f5e2507251457cbf47871c39ac1753adb1d83777ab0743fa11cd6148",
                 )
             },
-            snapshots={"2026.09": "20260914T150000Z"},
+            snapshots={"2026.09": "20260916T120000Z"},
         ),
         # E2-17: jupyter-python-cuda plus the same layer.
         ApprovedBase(

{code_sandboxes-1.9.13 → code_sandboxes-1.9.17}/code_sandboxes/environments/files.py

@@ -25,12 +25,15 @@ __all__ = ["build_entries", "files_step"]
 def build_entries(
     environment: Environment, *, source_of: Callable[[FileEntry], str] | None = None
 ) -> list[BuildEntry]:
-    """The spec's files as build entries.
+    """The spec's baked files as build entries: ``files`` then ``contentsBuild``.
 
-    ``source_of`` turns a ``contentRef`` into a URL the build can fetch —
-    a presigned URL for a ``blob://`` reference — and defaults to the
-    reference itself. A file without its sha256 is refused: the build
-    verifies every byte it bakes.
+    ``files`` a user uploaded (referenced by ``contentRef``) and
+    ``contentsBuild`` fetched from an external ``source`` are both baked the
+    same way, so they are the same kind of entry here. ``source_of`` turns a
+    ``contentRef`` into a URL the build can fetch — a presigned URL for a
+    ``blob://`` reference — and defaults to the reference itself; a
+    ``contentsBuild`` source is already a URL and is used as is. A file without
+    its sha256 is refused: the build verifies every byte it bakes.
     """
     entries: list[BuildEntry] = []
     for index, entry in enumerate(environment.spec.files):
@@ -48,6 +51,15 @@ def build_entries(
                 size_bytes=entry.size_bytes,
             )
         )
+    for built in environment.spec.contents_build:
+        entries.append(
+            BuildEntry(
+                source_uri=built.source,
+                destination_path=built.path,
+                sha256=built.sha256,
+                size_bytes=built.size_bytes,
+            )
+        )
     return entries
 
 
@@ -63,7 +75,7 @@ def files_step(
     """
     if variant not in VARIANTS:
         raise ValueError(f"{variant!r} is not a variant")
-    if not environment.spec.files:
+    if not environment.spec.files and not environment.spec.contents_build:
         return []
     build = EnvironmentBuild(
         environment=environment.metadata.name,

{code_sandboxes-1.9.13 → code_sandboxes-1.9.17}/code_sandboxes/environments/spec.py

@@ -259,6 +259,21 @@ class FileEntry(_Model):
     sha256: str | None = Field(default=None, pattern=r"^[0-9a-f]{64}$")
 
 
+class ContentsBuildEntry(_Model):
+    """One immutable file the Environment bakes from an external source.
+
+    Unlike ``files`` — which a user uploads, referenced by ``contentRef`` — a
+    ``contentsBuild`` entry names an external ``source`` URL fetched at build
+    time and verified against ``sha256`` (required: the build verifies every
+    byte it bakes). Both are baked the same way, into every provider artifact.
+    """
+
+    source: str
+    path: str
+    sha256: str = Field(pattern=r"^[0-9a-f]{64}$")
+    size_bytes: int | None = Field(default=None, ge=0)
+
+
 class Commands(_Model):
     post_install: list[str] = Field(default_factory=list)
 
@@ -365,6 +380,7 @@ class EnvironmentSpec(_Model):
     platform: Platform = Field(default_factory=Platform)
     packages: Packages = Field(default_factory=Packages)
     files: list[FileEntry] = Field(default_factory=list)
+    contents_build: list[ContentsBuildEntry] = Field(default_factory=list)
     env: dict[str, str] = Field(default_factory=dict)
     commands: Commands = Field(default_factory=Commands)
     build_secrets: list[BuildSecret] = Field(default_factory=list)

{code_sandboxes-1.9.13 → code_sandboxes-1.9.17}/code_sandboxes/jupyter_server_sandbox.py

@@ -607,6 +607,58 @@ class JupyterServerSandbox(Sandbox):
             logger.warning(f"Failed to interrupt Jupyter kernel: {e}")
             return False
 
+    def restart_kernel(self) -> bool:
+        """Restart the kernel itself, through the server's own REST API.
+
+        Not `stop()` then `start()`: those are this *client's* lifecycle, and
+        when the server is somebody else's — a Datalayer runtime pod, which
+        is every attached sandbox — stopping the client only drops the
+        websocket. The kernel is a process on the server and keeps running,
+        so a reconnect lands back in the same interpreter with every global
+        still set.
+
+        That is what Appendix B check 7 ("nothing is assumed to persist
+        across restarts") measures, and it read `state survived the restart`
+        for exactly this reason — found live on r1, 2026-09-16, the first
+        drill whose smoke test reached the check. `POST
+        /api/kernels/{id}/restart` is the one that restarts the kernel, the
+        same way `_do_interrupt` already uses the API rather than the
+        client's own lifecycle.
+
+        Answers whether the server accepted it; never raises, so a caller
+        that cannot restart reports a failed check rather than an error.
+        """
+        if not self._server_url or not self._client:
+            return False
+        kernel_id = getattr(self._client, "id", None)
+        if not kernel_id:
+            return False
+        try:
+            response = requests.post(
+                f"{self._server_url}/api/kernels/{kernel_id}/restart",
+                params={"token": self._token},
+                headers=self._headers or None,
+                timeout=30,
+            )
+        except Exception as error:
+            # A restart that cannot even be asked for is a failed check, not
+            # an error to raise at the caller, exactly as `_do_interrupt` is.
+            logger.warning(f"Failed to restart Jupyter kernel: {error}")
+            return False
+        if not response.ok:
+            logger.warning(
+                "Failed to restart Jupyter kernel: the server answered %s", response.status_code
+            )
+            return False
+        # The websocket the client holds is to the kernel that has just been
+        # replaced; reconnecting is what makes the next execution land in the
+        # new interpreter rather than on a channel nobody is reading.
+        with contextlib.suppress(Exception):
+            self._client.stop()
+        with contextlib.suppress(Exception):
+            self._client.start()
+        return True
+
     @marks_execution
     def run_code(  # noqa: C901
         self,

{code_sandboxes-1.9.13 → code_sandboxes-1.9.17}/schemas/environment-v1alpha1.json

@@ -152,6 +152,45 @@
       "title": "Compatibility",
       "type": "object"
     },
+    "ContentsBuildEntry": {
+      "additionalProperties": false,
+      "description": "One immutable file the Environment bakes from an external source.\n\nUnlike ``files`` \u2014 which a user uploads, referenced by ``contentRef`` \u2014 a\n``contentsBuild`` entry names an external ``source`` URL fetched at build\ntime and verified against ``sha256`` (required: the build verifies every\nbyte it bakes). Both are baked the same way, into every provider artifact.",
+      "properties": {
+        "path": {
+          "title": "Path",
+          "type": "string"
+        },
+        "sha256": {
+          "pattern": "^[0-9a-f]{64}$",
+          "title": "Sha256",
+          "type": "string"
+        },
+        "sizeBytes": {
+          "anyOf": [
+            {
+              "minimum": 0,
+              "type": "integer"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "default": null,
+          "title": "Sizebytes"
+        },
+        "source": {
+          "title": "Source",
+          "type": "string"
+        }
+      },
+      "required": [
+        "source",
+        "path",
+        "sha256"
+      ],
+      "title": "ContentsBuildEntry",
+      "type": "object"
+    },
     "DependencyFileSpec": {
       "additionalProperties": false,
       "description": "A `requirements.txt`, a `pyproject.toml` with its `uv.lock`, or a conda\n`environment.yml` (E3-01, E3-02).\n\n``requirements`` resolves the way ``packages`` does \u2014 the protected\nconstraints merged in, the same solve. ``pyproject`` does not resolve at\nall: its own ``uv.lock`` is verified against the current\n``pyproject.toml`` and exported, never re-solved, because a lock the\nauthor already made is the whole point of bringing one. ``conda`` resolves\nthe ``environment.yml`` in its own ``micromamba`` solve into an explicit\nlock, with the protected constraints merged over its ``pip:`` layer.",
@@ -202,6 +241,13 @@
         "compatibility": {
           "$ref": "#/$defs/Compatibility"
         },
+        "contentsBuild": {
+          "items": {
+            "$ref": "#/$defs/ContentsBuildEntry"
+          },
+          "title": "Contentsbuild",
+          "type": "array"
+        },
         "contract": {
           "default": "sandbox-contract/v1",
           "title": "Contract",

{code_sandboxes-1.9.13 → code_sandboxes-1.9.17}/tests/test_client.py

@@ -157,6 +157,62 @@ def test_variables_interrupt_and_restart_delegate_to_sandbox():
     assert client.is_alive() is True
 
 
+class TestRestartingWhatIsActuallyHoldingTheState:
+    """A restart has to clear the interpreter, not just this client's socket.
+
+    Appendix B check 7 is "nothing is assumed to persist across restarts". A
+    sandbox this process owns is cleared by its own lifecycle; one attached
+    to somebody else's Jupyter server is not, because the kernel outlives
+    the websocket. Found live on r1, 2026-09-16: `state survived the
+    restart`.
+    """
+
+    def test_a_sandbox_that_can_restart_its_kernel_is_asked_to(self):
+        class _AttachedSandbox(_FakeSandbox):
+            def __init__(self):
+                super().__init__()
+                self.kernel_restarts = 0
+
+            def restart_kernel(self):
+                self.kernel_restarts += 1
+                return True
+
+        sandbox = _AttachedSandbox()
+        sandbox.start()
+        CodeSandboxClient(sandbox).restart()
+
+        assert sandbox.kernel_restarts == 1
+        # And the lifecycle was left alone: stopping it would have dropped a
+        # connection the restarted kernel is still reachable on.
+        assert sandbox.is_started is True
+
+    def test_a_kernel_restart_that_fails_falls_back_to_the_lifecycle(self):
+        class _RefusingSandbox(_FakeSandbox):
+            def __init__(self):
+                super().__init__()
+                self.stops = 0
+
+            def restart_kernel(self):
+                return False
+
+            def stop(self):
+                self.stops += 1
+                super().stop()
+
+        sandbox = _RefusingSandbox()
+        sandbox.start()
+        CodeSandboxClient(sandbox).restart()
+
+        assert sandbox.stops == 1, "a refused kernel restart still restarts the sandbox"
+        assert sandbox.is_started is True
+
+    def test_a_sandbox_with_no_kernel_of_its_own_restarts_as_it_always_did(self):
+        sandbox = _FakeSandbox()
+        sandbox.start()
+        CodeSandboxClient(sandbox).restart()
+        assert sandbox.is_started is True
+
+
 def test_a_sandbox_that_knows_it_is_gone_is_believed():
     """`is_alive` reports what the sandbox can find out, not the local start
     flag, so a backend that died under us is not reported as ready."""

{code_sandboxes-1.9.13 → code_sandboxes-1.9.17}/tests/test_environment_attest.py

@@ -80,7 +80,7 @@ def basic(identifier: str, severity: str, *, package: str = "openssl") -> dict:
 
 
 class FakeEcr:
-    """The two ECR calls the attestor makes, and nothing else."""
+    """The three ECR calls the attestor makes, and nothing else."""
 
     def __init__(
         self,
@@ -90,6 +90,7 @@ class FakeEcr:
         enhanced_findings=True,
         manifest: dict | None = None,
         pages: list[list[dict]] | None = None,
+        size_bytes: int | None = 2_147_483_648,
     ) -> None:
         self.statuses = list(statuses)
         self.findings = list(findings)
@@ -99,8 +100,12 @@ class FakeEcr:
         self.pages = pages
         self.enhanced_findings = enhanced_findings
         self.manifest = manifest
+        #: What `describe_images` answers for the digest; None makes it raise
+        #: `ImageNotFoundException`, the way a registry that lost it would.
+        self.size_bytes = size_bytes
         self.asked = 0
         self.scanned: list[str] = []
+        self.sized: list[str] = []
 
     def batch_get_image(self, repositoryName, imageIds, acceptedMediaTypes):  # noqa: N803 - boto3's spelling
         manifest = self.manifest or {
@@ -117,6 +122,14 @@ class FakeEcr:
             ]
         }
 
+    def describe_images(self, repositoryName, imageIds):  # noqa: N803 - boto3's spelling
+        self.sized.append(imageIds[0]["imageDigest"])
+        if self.size_bytes is None:
+            error = Exception("ImageNotFoundException")
+            error.response = {"Error": {"Code": "ImageNotFoundException"}}
+            raise error
+        return {"imageDetails": [{"imageSizeInBytes": self.size_bytes}]}
+
     def describe_image_scan_findings(self, repositoryName, imageId, nextToken=None):  # noqa: N803 - boto3's spelling
         self.asked += 1
         self.scanned.append(imageId["imageDigest"])
@@ -630,6 +643,33 @@ class TestAttestingAnArtifact:
         answer = attest_artifact(artifact=self.an_artifact(), attestor=an_attestor())
         assert answer["scan_summary"]["policy"] == DEFAULT_POLICY.body()
 
+    def test_the_size_is_read_from_the_registry_when_nobody_hands_one_down(self) -> None:
+        """Which is every real call: the builder answers a reference, not a
+        weight, so `environments.artifact.bytes` — section 14's artifact size
+        — had no point in it although artifacts had been recorded (E1-25)."""
+        ecr = FakeEcr(size_bytes=2_147_483_648)
+        answer = attest_artifact(artifact=self.an_artifact(), attestor=an_attestor(ecr=ecr))
+        assert answer["size_bytes"] == 2_147_483_648
+        assert ecr.sized == [DIGEST]
+
+    def test_a_size_handed_down_is_kept_and_the_registry_is_not_asked(self) -> None:
+        ecr = FakeEcr()
+        answer = attest_artifact(
+            artifact=self.an_artifact(), size_bytes=116_183_040, attestor=an_attestor(ecr=ecr)
+        )
+        assert answer["size_bytes"] == 116_183_040
+        assert ecr.sized == []
+
+    def test_a_size_that_cannot_be_read_is_not_a_reason_to_refuse(self) -> None:
+        """A missing number on a dashboard, against an artifact nothing can
+        launch: the artifact is signed and the attestation stands."""
+        said: list[str] = []
+        attestor = an_attestor(ecr=FakeEcr(size_bytes=None), log=said.append)
+        answer = attest_artifact(artifact=self.an_artifact(), attestor=attestor)
+        assert answer["size_bytes"] is None
+        assert answer["signature_ref"] == f"{REGISTRY}/{REPOSITORY}@{DIGEST}"
+        assert any("size could not be read" in line for line in said)
+
 
 def test_nothing_reaches_a_registry_when_nothing_could_sign() -> None:
     """The order that keeps a refusal cheap and honest (E1-08, E1-09).

{code_sandboxes-1.9.13 → code_sandboxes-1.9.17}/tests/test_environment_bases.py

@@ -52,10 +52,17 @@ def test_the_2026_09_channel_of_python_cuda_has_no_digest_until_it_is_pushed(
 def test_the_2026_09_channel_of_python_cpu_resolves_the_digest_its_release_pushed(
     variant: str,
 ) -> None:
-    """PLAN_ENV.md, E1-05: released 2026-09-14 (jupyter-python 0.2.2, E1-08's
-    scan fix), same digest for every variant."""
+    """PLAN_ENV.md, E1-05: the digest the channel's last release pushed, the
+    same one for every variant.
+
+    **This moves with every base release**, and `bases.py` is where it moves
+    first: two releases (2026-09-15's and 2026-09-16's) changed the channel
+    and left this assertion on 2026-09-14's digest, so it sat red rather than
+    catching anything. Current: released 2026-09-16, the contract layer that
+    starts kernels in `/home/datalayer/content` (E1-05, Appendix B check 2).
+    """
     ref = "datalayer/python-cpu"
-    digest = "sha256:334adf6c2714c8919ef60beeca1db12e3531a391c9dde41932c782f81c432b36"
+    digest = "sha256:122d3e31f5e2507251457cbf47871c39ac1753adb1d83777ab0743fa11cd6148"
     assert APPROVED_BASES[ref].channels == {"2026.09": dict.fromkeys(VARIANTS, digest)}
     assert resolve_base(ref, "2026.09", variant) == digest
 
@@ -114,8 +121,12 @@ def test_each_base_is_published_under_its_own_repository() -> None:
 
 
 def test_the_2026_09_channel_of_python_cpu_pins_apt_to_its_snapshot() -> None:
-    """D-9: the moment just after the channel's image upgraded its packages."""
-    assert channel_snapshot("datalayer/python-cpu", "2026.09") == "20260914T150000Z"
+    """D-9: the moment just after the channel's image upgraded its packages.
+
+    Moves with the channel, like the digest above, and had rotted the same
+    way — left on 2026-09-14's id after the channel moved to 2026-09-16's.
+    """
+    assert channel_snapshot("datalayer/python-cpu", "2026.09") == "20260916T120000Z"
     assert channel_snapshot("datalayer/python-cuda", "2026.09") == ""
     assert channel_snapshot("datalayer/nothing", "2026.09") == ""
 

{code_sandboxes-1.9.13 → code_sandboxes-1.9.17}/tests/test_environment_builders.py

@@ -280,6 +280,58 @@ def test_a_file_is_not_baked_without_its_digest() -> None:
         files_step(environment(), variant="kaggle")
 
 
+CONTENTS_SHA = "c" * 64
+
+
+def test_the_files_step_bakes_a_contents_build_manifest_from_an_external_source() -> None:
+    env = environment(
+        files=[],
+        contents_build=[
+            {
+                "source": "https://data.example/iris.csv",
+                "path": "/opt/datalayer/contents/iris.csv",
+                "sha256": CONTENTS_SHA,
+            }
+        ],
+    )
+    commands = files_step(env, variant="modal")
+    # The external source is fetched as it is (no contentRef to sign) and verified.
+    assert (
+        "curl -fsSL https://data.example/iris.csv -o /opt/datalayer/contents/iris.csv"
+        in commands[0]
+    )
+    assert f'echo "{CONTENTS_SHA}  /opt/datalayer/contents/iris.csv" | sha256sum -c' in commands[0]
+    assert "environment-contents.json" in commands[-1]
+
+
+def test_files_and_contents_build_are_baked_together() -> None:
+    env = environment(
+        contents_build=[
+            {
+                "source": "https://data.example/iris.csv",
+                "path": "/opt/datalayer/contents/iris.csv",
+                "sha256": CONTENTS_SHA,
+            }
+        ]
+    )
+    entries = build_entries(env, source_of=lambda entry: "https://signed.example/notes.md")
+    # The uploaded file first, then the external build entry — both baked, one engine.
+    assert [entry.destination_path for entry in entries] == [
+        "/home/datalayer/content/notes.md",
+        "/opt/datalayer/contents/iris.csv",
+    ]
+    assert entries[0].source_uri == "https://signed.example/notes.md"
+    assert entries[1].source_uri == "https://data.example/iris.csv"
+    assert entries[1].sha256 == CONTENTS_SHA
+
+
+def test_a_contents_build_entry_without_its_digest_will_not_parse() -> None:
+    with pytest.raises(Exception):
+        environment(
+            contents_build=[{"source": "https://data.example/x", "path": "/opt/x"}]
+        )
+
+
 def test_the_neutral_modules_import_no_provider_sdk() -> None:
     """What a service may import must not drag a provider in."""
     code = (

{code_sandboxes-1.9.13 → code_sandboxes-1.9.17}/tests/test_environment_resolve.py

@@ -998,8 +998,12 @@ def test_the_solve_is_asked_to_pin_apt_at_the_base_channels_snapshot() -> None:
     runner = RecordedRunner(A_LOCK)
     resolve_environment(spec=a_spec(), variants=["datalayer"], runner=runner)
     assert runner.request is not None
+    # What this test is about: the solve is pinned at *the channel's* snapshot,
+    # whatever that is. The id itself is pinned once, in
+    # `test_environment_bases.py`, where it moves with the channel — repeating
+    # it here only meant a base release left two tests red instead of one.
     assert runner.request.apt_snapshot == channel_snapshot("datalayer/python-cpu", "2026.09")
-    assert runner.request.apt_snapshot == "20260914T150000Z"
+    assert runner.request.apt_snapshot
 
 
 class TestTheBuildkitRunner: