Validate complete engine addresses and retain shared socket inputs (#503)

restricted-execution/default.nix

@@ -41,6 +41,8 @@ let
       ''
         mkdir -p "$out/lib" "$out/bin"
         cp ${./service.mjs} "$out/lib/service.mjs"
+        cp ${../socket-address.mjs} "$out/lib/socket-address.mjs"
+        substituteInPlace "$out/lib/service.mjs" --replace-fail '../socket-address.mjs' './socket-address.mjs'
         cp ${./worker.mjs} "$out/lib/worker.mjs"
         makeWrapper ${pkgs.nodejs_24}/bin/node "$out/bin/quixos-restricted-registry" \
           --add-flags "$out/lib/service.mjs" \
@@ -48,6 +50,13 @@ let
           --set QUIXOS_RESTRICTED_SANDBOX ${sandbox}/bin/quixos-restricted-sandbox \
           --set QUIXOS_RESTRICTED_WORKER "$out/lib/worker.mjs"
       '';
+  qualificationSource = pkgs.lib.fileset.toSource {
+    root = ../.;
+    fileset = pkgs.lib.fileset.unions [
+      (pkgs.lib.fileset.fileFilter (file: file.hasExt "mjs") ./.)
+      ../socket-address.mjs
+    ];
+  };
   qualification =
     pkgs.runCommand "quixos-restricted-execution-qualification"
       {
@@ -56,7 +65,7 @@ let
         QUIXOS_TEST_SDK = "${sdk}/core.mjs";
       }
       ''
-        node --test ${./.}/service.test.mjs
+        node --test ${qualificationSource}/restricted-execution/service.test.mjs
         touch "$out"
       '';
 in
@@ -69,6 +78,7 @@ in
     nativeProbeSandbox
     sdk
     runtime
+    qualificationSource
     qualification
     ;
 }