code-sandboxes 1.9.34__tar.gz → 1.9.35__tar.gz

{code_sandboxes-1.9.34 → code_sandboxes-1.9.35}/.github/workflows/environments-live.yml

@@ -4,18 +4,19 @@ name: Environments Live Matrix
 # providers, nightly (PLAN_ENV.md E2-11): a real, hash-verified lock, a real
 # build, a real launch, and the formal core tier — tests/test_environment_live_matrix.py.
 #
-# E2B and Modal carry their own already-documented, unticked gaps there
-# (E2-03's uid/gid mismatch; modal_sandbox.py's missing setpriv) and are
-# `xfail(strict=False)` in that file, so an ordinary failure there is
-# expected and does not fail this workflow. Daytona carries no such marker:
-# a failure there is a real regression, and this workflow opens (or
-# comments on) an issue naming it.
+# E2B carries its own documented, unticked gap there (E2-03: its services run
+# as root) and is `xfail(strict=False)` in that file, so an ordinary failure
+# there is expected and does not fail this workflow. Daytona and Modal carry
+# no such marker: a failure there is a real regression, and this workflow
+# opens (or comments on) an issue naming it.
 #
-# Needs, as repository secrets: E2B_API_KEY, DAYTONA_API_KEY, MODAL_TOKEN_ID,
-# MODAL_TOKEN_SECRET, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY — the last two
-# scoped to read the approved base from ECR only (D-18). A secret that is
-# not set is not a workflow failure: the test each secret belongs to skips,
-# by name, and says so in the job summary.
+# Needs one repository secret, DATALAYER_API_KEY. The providers' keys are
+# Datalayer secrets of the account it belongs to, read at run time: E2B_API_KEY,
+# DAYTONA_API_KEY, MODAL_TOKEN_ID, MODAL_TOKEN_SECRET, and the AWS pair under
+# CODE_SANDBOXES_CI_AWS_ACCESS_KEY_ID and CODE_SANDBOXES_CI_AWS_SECRET_ACCESS_KEY,
+# a key of the base reader that can only pull the approved base from ECR (D-18).
+# A key that is not there skips the test it belongs to, by name, and the job
+# summary lists each leg's outcome; a Daytona leg that did not run fails the job.
 
 on:
   schedule:
@@ -55,6 +56,48 @@ jobs:
           uv pip install ".[e2b,daytona,modal,test]"
           uv pip install boto3
 
+      # Each value is masked before it reaches the job's environment, and none
+      # is set on a later step's own `env:`, which would override it with an
+      # empty string.
+      - name: Read the providers' keys from Datalayer
+        env:
+          DATALAYER_API_KEY: ${{ secrets.DATALAYER_API_KEY }}
+          DATALAYER_IAM_URL: https://prod1.datalayer.run
+        run: |
+          python - <<'PY'
+          import json
+          import os
+          import urllib.request
+
+          key = os.environ.get("DATALAYER_API_KEY", "")
+          if not key:
+              print("DATALAYER_API_KEY is not a secret of this repository: every leg will skip")
+              raise SystemExit(0)
+          request = urllib.request.Request(
+              os.environ["DATALAYER_IAM_URL"] + "/api/iam/v1/secrets/values",
+              headers={"Authorization": f"Bearer {key}"},
+          )
+          with urllib.request.urlopen(request, timeout=60) as response:
+              secrets = json.load(response).get("secrets") or {}
+          wanted = {
+              "DAYTONA_API_KEY": "DAYTONA_API_KEY",
+              "E2B_API_KEY": "E2B_API_KEY",
+              "MODAL_TOKEN_ID": "MODAL_TOKEN_ID",
+              "MODAL_TOKEN_SECRET": "MODAL_TOKEN_SECRET",
+              "AWS_ACCESS_KEY_ID": "CODE_SANDBOXES_CI_AWS_ACCESS_KEY_ID",
+              "AWS_SECRET_ACCESS_KEY": "CODE_SANDBOXES_CI_AWS_SECRET_ACCESS_KEY",
+          }
+          with open(os.environ["GITHUB_ENV"], "a", encoding="utf-8") as environment:
+              for variable, name in wanted.items():
+                  value = str(secrets.get(name) or "")
+                  if not value or "\n" in value:
+                      print(f"{variable}: no Datalayer secret {name} for this account")
+                      continue
+                  print(f"::add-mask::{value}")
+                  environment.write(f"{variable}={value}\n")
+                  print(f"{variable}: read from the Datalayer secret {name}")
+          PY
+
       - name: Configure AWS credentials
         run: |
           mkdir -p ~/.aws
@@ -63,9 +106,6 @@ jobs:
             echo "aws_access_key_id=${AWS_ACCESS_KEY_ID}"
             echo "aws_secret_access_key=${AWS_SECRET_ACCESS_KEY}"
           } > ~/.aws/credentials
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
 
       - name: Run the live matrix
         id: live
@@ -75,13 +115,51 @@ jobs:
             tests/test_environment_live_matrix.py \
             --junitxml=live-matrix-results.xml
         env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           AWS_REGION: us-east-1
-          E2B_API_KEY: ${{ secrets.E2B_API_KEY }}
-          DAYTONA_API_KEY: ${{ secrets.DAYTONA_API_KEY }}
-          MODAL_TOKEN_ID: ${{ secrets.MODAL_TOKEN_ID }}
-          MODAL_TOKEN_SECRET: ${{ secrets.MODAL_TOKEN_SECRET }}
+
+      # A leg whose secret is not set skips, and a run where every leg skipped
+      # reported success in under a second: the nightly was green every night
+      # while it tested nothing (found on 2026-09-18, "3 skipped in 0.61s").
+      # Each leg's outcome goes in the job summary, and a Daytona leg that did
+      # not run fails the job: it is the one this matrix is required to prove
+      # (PLAN_ENV.md, the Datalayer and Daytona target, E2-11).
+      - name: Say which legs ran, and refuse a Daytona leg that did not
+        if: always()
+        run: |
+          python - <<'PY'
+          import os
+          import sys
+          import xml.etree.ElementTree as ET
+
+          try:
+              cases = list(ET.parse("live-matrix-results.xml").getroot().iter("testcase"))
+          except (OSError, ET.ParseError) as error:
+              sys.exit(f"no JUnit report to read: {error}")
+          rows, daytona = [], None
+          for case in cases:
+              leg = (case.get("classname") or "").rsplit(".", 1)[-1]
+              skipped = case.find("skipped")
+              if skipped is not None:
+                  outcome = "skipped: " + (skipped.get("message") or "").strip()
+              elif case.find("failure") is not None or case.find("error") is not None:
+                  outcome = "failed"
+              else:
+                  outcome = "passed"
+              rows.append(f"| {leg} | {outcome} |")
+              if leg == "TestDaytona":
+                  daytona = outcome
+          summary = "| Leg | Outcome |\n|---|---|\n" + "\n".join(rows) + "\n"
+          with open(os.environ["GITHUB_STEP_SUMMARY"], "a", encoding="utf-8") as handle:
+              handle.write(summary)
+          print(summary)
+          if daytona is None or daytona.startswith("skipped"):
+              sys.exit(
+                  f"The Daytona leg did not run ({daytona or 'absent'}): it is the one this "
+                  "matrix must prove, so a run without it is not a green run. Set the "
+                  "DATALAYER_API_KEY repository secret, whose account holds the "
+                  "DAYTONA_API_KEY and CODE_SANDBOXES_CI_AWS_* Datalayer secrets."
+              )
+          PY
 
       - name: Upload the JUnit report
         if: always()

{code_sandboxes-1.9.34 → code_sandboxes-1.9.35}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code_sandboxes
-Version: 1.9.34
+Version: 1.9.35
 Project-URL: Home, https://github.com/datalayer/code-sandboxes
 Author-email: Datalayer <info@datalayer.io>
 License: BSD 3-Clause License

{code_sandboxes-1.9.34 → code_sandboxes-1.9.35}/code_sandboxes/__version__.py

@@ -3,4 +3,4 @@
 
 """Code Sandboxes."""
 
-__version__ = "1.9.34"
+__version__ = "1.9.35"

{code_sandboxes-1.9.34 → code_sandboxes-1.9.35}/code_sandboxes/environments/adapters/modal.py

@@ -96,13 +96,11 @@ end and the container exited before that first real exec ever reached it.
 The entrypoint now execs `sleep infinity` when it is given no arguments,
 and `"$@"` when it is — correct either way a caller invokes it.
 
-**A GPU size class is left buildable at `validate()`,** matching an existing
-test (`test_a_gpu_spec_is_buildable_on_modal_and_daytona`), and refused at
-`build()` instead, naming E2-17 — the same reasoning as Daytona's: the CUDA
-base is not published yet, so this cannot be reached in practice, and this
-builder does not know the launch-time `gpu=` argument to hand a size class
-either (D-20 leaves that to a later item; a GPU is Modal's own launch
-option, not an image property, per section 11.4 item 10).
+**A GPU is a launch option on Modal, not part of the image** (section 11.4
+item 10, E2-17). A GPU version builds the same image any version does, on the
+CUDA base; the spec's `accelerator` names one of Modal's GPUs, checked at
+`validate`, and the smoke test launches the image on it (`gpu="T4"`,
+`"H100:2"`) and adds check 11 to the core tier.
 
 **A build secret is attached to the `postInstall` steps that name it (E3-05).**
 `run_commands` takes a per-step `secrets=` collection, a mechanism E2B and
@@ -149,14 +147,42 @@ from ..files import files_step
 from ..redact import redact
 from ..resolve import WHEELHOUSE_IMAGE_PATH, apt_pins_in
 from ..resolve_conda import conda_lock_pip_requirements, is_conda_lock
-from ..spec import GPU_SIZE_CLASSES, BuildSecret, Environment, command_names_secret
+from ..spec import BuildSecret, Environment, command_names_secret
 from .managed import ManagedBuilder
 
-__all__ = ["UNIMPLEMENTED_INSTRUCTIONS", "Builder"]
+__all__ = ["MODAL_GPUS", "UNIMPLEMENTED_INSTRUCTIONS", "Builder", "modal_gpu"]
 
 #: What Modal's own Dockerfile builder does not implement (§6).
 UNIMPLEMENTED_INSTRUCTIONS = ("ONBUILD", "STOPSIGNAL", "VOLUME")
 
+#: The GPUs a Modal sandbox takes by name (E2-17), as its `gpu=` spells them.
+MODAL_GPUS: tuple[str, ...] = (
+    "T4",
+    "L4",
+    "A10G",
+    "L40S",
+    "A100",
+    "A100-40GB",
+    "A100-80GB",
+    "H100",
+    "H200",
+    "B200",
+)
+
+
+def modal_gpu(accelerator_type: str, count: int = 1) -> str | None:
+    """Modal's `gpu=` for an accelerator, or `None` when Modal has no such GPU.
+
+    `t4` and `a100_80gb` name what Modal calls `T4` and `A100-80GB`, and a
+    count above one is Modal's `"H100:2"`. An `RTX-4090` is Daytona's
+    vocabulary, not Modal's.
+    """
+    name = accelerator_type.strip().upper().replace("_", "-")
+    if name not in MODAL_GPUS:
+        return None
+    return f"{name}:{count}" if count > 1 else name
+
+
 #: `uv`, pinned the same way every other builder's bootstrap is (E1-04/E3-04).
 _UV_VERSION = "0.12.11"
 
@@ -269,7 +295,10 @@ def _intermediates_of(built: Any) -> tuple[str, ...]:
             if hasattr(dependency, "deps"):
                 walk(dependency)
         object_id = getattr(image, "object_id", None)
-        if object_id and image is not built:
+        # Only images: the build's ECR secret is in `deps()` too, and has an
+        # `st-` id `ImageDelete` refuses ("not a valid Image ID", found live
+        # on 2026-09-18). It is deleted by the build itself, as a secret.
+        if object_id and image is not built and str(object_id).startswith("im-"):
             found.append(str(object_id))
 
     try:
@@ -393,6 +422,18 @@ class Builder(ManagedBuilder):
                         field=f"spec.buildSecrets[{index}].mountAs",
                     )
                 )
+        accelerator = environment.spec.resources.accelerator
+        if accelerator != "none" and modal_gpu(accelerator.type) is None:
+            findings.append(
+                CapabilityFinding(
+                    code="DL_ENV_CAPABILITY_UNSUPPORTED",
+                    message=(
+                        f"Modal has no GPU called `{accelerator.type}`; it offers "
+                        + ", ".join(MODAL_GPUS)
+                    ),
+                    field="spec.resources.accelerator.type",
+                )
+            )
         return findings
 
     # -- Building -------------------------------------------------------------
@@ -406,18 +447,6 @@ class Builder(ManagedBuilder):
         launch, not here, for the same reason.
         """
         spec = request.environment.spec
-        if request.size_class in GPU_SIZE_CLASSES:
-            # `validate` leaves a GPU class buildable (`gpu = True`, D-20):
-            # the CUDA base E2-17 has not published yet, so this cannot be
-            # reached in practice — refused plainly here rather than
-            # guessing at the launch-time `gpu=` argument this class needs
-            # (section 11.4 item 10 is a launch concern, not a build one).
-            raise EnvironmentsError(
-                CAPABILITY_UNSUPPORTED,
-                f"Modal runs `{request.size_class}` on its own GPUs, but the CUDA base this "
-                "needs is E2-17's, not built yet",
-                detail={"variant": self.variant, "missing": "E2-17"},
-            )
         # Resolved before Modal is touched: a secret IAM will not give stops
         # the build with nothing to clean up in the owner's workspace.
         declared, values = self._resolved_secrets(request)
@@ -717,11 +746,13 @@ class Builder(ManagedBuilder):
             )
         from ...modal_sandbox import ModalSandbox
         from ...models import SandboxConfig
-        from ..conformance import expected_packages, run_core_tier
+        from ..conformance import expected_packages, run_accelerator_check, run_core_tier
 
         sdk = self._modal_sdk()
+        accelerator = environment.spec.resources.accelerator
+        gpu = None if accelerator == "none" else modal_gpu(accelerator.type, accelerator.count)
         sandbox = ModalSandbox(
-            config=SandboxConfig(name=f"smoke-{artifact.provider_artifact_id}"),
+            config=SandboxConfig(name=f"smoke-{artifact.provider_artifact_id}", gpu=gpu),
             app_name=f"dl-{environment.metadata.name}",
             image_id=artifact.provider_artifact_id,
             client=self._client(sdk),
@@ -729,13 +760,21 @@ class Builder(ManagedBuilder):
         self._log(f"Launching {artifact.provider_artifact_id} to smoke-test it")
         try:
             sandbox.start()
-            return run_core_tier(
+            result = run_core_tier(
                 sandbox,
                 python_version=environment.spec.language.version,
                 expected_packages=expected_packages(environment, lock_text or ""),
                 secret_values=tuple(secret_values),
                 restart=lambda: self._restart(sandbox),
             )
+            if gpu is not None:
+                # The core tier passes on a machine with no GPU: a GPU version
+                # is the version its spec describes only when its GPUs are
+                # visible and its CUDA is the spec's (check 11, E2-17).
+                result.checks.append(
+                    run_accelerator_check(sandbox, cuda=accelerator.cuda, count=accelerator.count)
+                )
+            return result
         except EnvironmentsError:
             raise
         except Exception as error:

{code_sandboxes-1.9.34 → code_sandboxes-1.9.35}/pyproject.toml

@@ -105,6 +105,10 @@ filterwarnings = [
   # use of the client in a test became an exception. It took the live matrix
   # against a real Datalayer sandbox down before the sandbox was reached.
   "module:Datalayer is migrating its paths to use standard platformdirs:DeprecationWarning",
+  # The Daytona SDK (0.205) reads its own deprecated `DaytonaConfig.server_url`
+  # inside `Daytona(config)`: with `error` in force, every live Daytona test
+  # failed before reaching Daytona, and a nightly that skipped hid it.
+  "ignore:`server_url` is deprecated:DeprecationWarning",
 ]
 
 [tool.mypy]

{code_sandboxes-1.9.34 → code_sandboxes-1.9.35}/tests/test_environment_builders.py

@@ -326,10 +326,10 @@ def test_files_and_contents_build_are_baked_together() -> None:
 
 
 def test_a_contents_build_entry_without_its_digest_will_not_parse() -> None:
-    with pytest.raises(Exception):
-        environment(
-            contents_build=[{"source": "https://data.example/x", "path": "/opt/x"}]
-        )
+    with pytest.raises(EnvironmentsError) as raised:
+        environment(contents_build=[{"source": "https://data.example/x", "path": "/opt/x"}])
+    assert raised.value.code.code == "DL_ENV_SPEC_INVALID"
+    assert "sha256" in raised.value.message
 
 
 def test_the_neutral_modules_import_no_provider_sdk() -> None:

{code_sandboxes-1.9.34 → code_sandboxes-1.9.35}/tests/test_environment_contract.py

@@ -163,9 +163,7 @@ def test_a_plain_build_context_passes() -> None:
         ),
     ],
 )
-def test_a_forbidden_context_member_is_refused(
-    entry: BuildContextEntry, message: str
-) -> None:
+def test_a_forbidden_context_member_is_refused(entry: BuildContextEntry, message: str) -> None:
     findings = validate_build_context([entry])
     assert any(finding.message == message for finding in findings), findings
     with pytest.raises(EnvironmentsError) as refused:

{code_sandboxes-1.9.34 → code_sandboxes-1.9.35}/tests/test_environment_live_matrix.py

@@ -243,25 +243,12 @@ class TestDaytona:
 
 
 class TestModal:
-    """`xfail(strict=False)`: checks 5 (imports) and 6 (filesystem) fail —
-    confirmed live, 2026-09-13, the session driver refusing to start
-    against a sandbox that reports itself already shutting down, while 1,
-    2, 3, 4, 7, 8 and 9 all pass. This used to be attributed to the
-    identity gap (checks 1/2 failed too, then) — closed since, live: a
-    contract-built artifact's `ModalSandbox` now drops its driver to
-    `1000:100` (`_start_driver`, gated on `image_id` so a plain
-    `ModalSandbox` is unaffected), and checks 1/2 pass with it. 5/6 turned
-    out to be a separate, still-unexplained issue: a plain, non-Environments
-    `ModalSandbox` runs several sequential snippets with no trouble at all
-    over the same span, so this is specific to a contract-built artifact's
-    image under repeated `exec`. An `XPASS` here means that's closed too."""
+    """No `xfail` since 2026-09-18: a real artifact, built by the production
+    builder and launched by image id, passes all nine checks, check 9 included
+    with a secret to scan for, right after check 8. The break recorded under
+    E2-05 (the exec channel gone after check 8) no longer reproduces; the
+    kernel-restart fix of 1.9.28, check 7's own path, is the likeliest cause."""
 
-    @pytest.mark.xfail(
-        reason="checks 5 and 6 fail on a session driver restart the sandbox refuses, "
-        "specific to a contract-built artifact and not yet root-caused (identity, "
-        "checks 1 and 2, is fixed)",
-        strict=False,
-    )
     def test_build_launch_and_the_core_tier(self, real_lock: tuple[str, str]) -> None:
         _skip_unless_available("modal")
         import modal

{code_sandboxes-1.9.34 → code_sandboxes-1.9.35}/tests/test_environment_modal_builder.py

@@ -23,7 +23,7 @@ from typing import Any, ClassVar
 
 import pytest
 
-from code_sandboxes.environments.adapters.modal import Builder
+from code_sandboxes.environments.adapters.modal import MODAL_GPUS, Builder, modal_gpu
 from code_sandboxes.environments.builders import ArtifactReference, BuildRequest
 from code_sandboxes.environments.errors import (
     ARTIFACT_MISSING,
@@ -748,16 +748,84 @@ class TestTheEcrSecretIsCleanedUp:
         assert deleted.kwargs["secret_id"] == secret.object_id
 
 
-class TestWhatModalCannotBuildYet:
-    def test_a_gpu_size_class_is_refused_at_build_time_naming_e2_17(self) -> None:
+class TestAGpuVersion:
+    """E2-17: on Modal a GPU is a launch option, not part of the image."""
+
+    GPU: ClassVar[dict[str, Any]] = {
+        "base": {"ref": "datalayer/python-cuda", "channel": "2026.09"},
+        "resources": {
+            "sizeClass": "gpu-small",
+            "accelerator": {"type": "l4", "count": 2, "cuda": "12.8"},
+        },
+    }
+
+    def test_it_builds_the_image_any_version_builds(self) -> None:
         modal = FakeModalModule()
-        with pytest.raises(EnvironmentsError) as raised:
-            a_builder(modal=modal).build(a_request(size_class="gpu-large"))
-        assert raised.value.code.code == CAPABILITY_UNSUPPORTED.code
-        assert raised.value.detail["missing"] == "E2-17"
-        # Refused before any provider is touched.
-        assert modal.Secret.from_dict_calls == []
-        assert modal.Image.from_aws_ecr_calls == []
+        artifact = a_builder(modal=modal).build(a_request(spec=self.GPU, size_class="gpu-small"))
+        assert artifact.provider_artifact_id.startswith("im-")
+        assert modal.Image.from_aws_ecr_calls, "built from the CUDA base like any image"
+
+    def test_a_gpu_modal_does_not_offer_is_refused_before_any_build(self) -> None:
+        spec = {
+            **self.GPU,
+            "resources": {"sizeClass": "gpu-small", "accelerator": {"type": "RTX-4090"}},
+        }
+        report = a_builder().validate(a_request(spec=spec).environment)
+        assert report.supported is False
+        [finding] = [item for item in report.findings if "RTX-4090" in item.message]
+        assert finding.field == "spec.resources.accelerator.type"
+        assert all(name in finding.message for name in MODAL_GPUS)
+
+    def test_a_name_is_modal_s_gpu_argument(self) -> None:
+        assert [
+            modal_gpu("t4"),
+            modal_gpu("a100_80gb"),
+            modal_gpu("H100", 2),
+            modal_gpu("RTX-4090"),
+        ] == [
+            "T4",
+            "A100-80GB",
+            "H100:2",
+            None,
+        ]
+
+    def test_the_smoke_test_runs_on_the_gpu_and_adds_check_eleven(self, monkeypatch) -> None:
+        from code_sandboxes.environments.builders import CheckResult, ValidationResult
+
+        made: dict = {}
+        asked: dict = {}
+
+        class FakeSandbox:
+            def __init__(self, **kwargs):
+                made.update(kwargs)
+
+            def start(self):
+                pass
+
+            def stop(self):
+                pass
+
+        monkeypatch.setattr("code_sandboxes.modal_sandbox.ModalSandbox", FakeSandbox)
+        monkeypatch.setattr(
+            "code_sandboxes.environments.conformance.run_core_tier",
+            lambda sandbox, **kwargs: ValidationResult(contract_version="sandbox-contract/v1"),
+        )
+        monkeypatch.setattr(
+            "code_sandboxes.environments.conformance.run_accelerator_check",
+            lambda sandbox, **kwargs: asked.update(kwargs)
+            or CheckResult(id="conformance:11", name="gpu", passed=True, gating=True),
+        )
+        environment = a_request(spec=self.GPU, size_class="gpu-small").environment
+        artifact = ArtifactReference(
+            variant="modal",
+            immutable_reference="im-1",
+            provider_artifact_id="im-1",
+            contract_version="sandbox-contract/v1",
+        )
+        answer = a_builder().smoke_test(artifact, environment=environment, lock_text=LOCK)
+        assert made["config"].gpu == "L4:2"
+        assert asked == {"cuda": "12.8", "count": 2}
+        assert [check.id for check in answer.checks] == ["conformance:11"]
 
 
 class TestABuildSecret:
@@ -958,6 +1026,16 @@ class TestTheIntermediateLayers:
         # The built image is the artifact, not an intermediate.
         assert _intermediates_of(built) == ("im-base", "im-middle")
 
+    def test_the_builds_ecr_secret_is_not_an_intermediate(self) -> None:
+        """It sits in `deps()` beside the layers, with an `st-` id `ImageDelete`
+        refuses as "not a valid Image ID" (found live, 2026-09-18)."""
+        from code_sandboxes.environments.adapters.modal import _intermediates_of
+
+        secret = _Layer(object_id="st-ecr", deps=lambda: ())
+        base = _Layer(object_id="im-base", deps=lambda: (secret,))
+        built = _Layer(object_id="im-built", deps=lambda: (base,))
+        assert _intermediates_of(built) == ("im-base",)
+
     def test_a_layer_with_no_id_is_not_recorded(self) -> None:
         """Only a hydrated layer has an id worth writing down."""
         from code_sandboxes.environments.adapters.modal import _intermediates_of