Supply exact private platform source to sealed checks without private evaluator egress

nix/checked-candidate.nix

@@ -7,6 +7,7 @@
   generator,
   contractOnly ? false,
   workspaceId ? null,
+  platformSourceJSON ? null,
   system ? builtins.currentSystem,
 }:
 let
@@ -71,9 +72,16 @@ let
     else
       { };
   execution = (configuration.backend or "typescript") == "execution";
-  runtime = builtins.getFlake (
-    "git+${root.lock.quixos.repository}?rev=${root.lock.quixos.commit}&ref=refs/tags/quixos-reachability/${root.lock.quixos.commit}"
-  );
+  platformSource = if platformSourceJSON == null then null else builtins.fromJSON platformSourceJSON;
+  runtime =
+    if platformSource == null then
+      builtins.getFlake (
+        "git+${root.lock.quixos.repository}?rev=${root.lock.quixos.commit}&ref=refs/tags/quixos-reachability/${root.lock.quixos.commit}"
+      )
+    else
+      assert platformSource.repository == root.lock.quixos.repository;
+      assert platformSource.commit == root.lock.quixos.commit;
+      builtins.getFlake "path:${builtins.storePath platformSource.directory}";
   runtimePackages = runtime.packages.${system};
   resourceClosure =
     includeBuild: node: