Supply exact private platform source to sealed checks without private evaluator egress

src/capability-language/checked-build.ts

@@ -113,6 +113,7 @@ export async function buildImmutableCandidate(
   contractOnly = false,
   observe?: (phase: "nixEvaluationMs" | "nixBuildMs", ms: number) => void,
   workspaceId?: string,
+  platformSource?: { repository: string; commit: string; directory: string },
 ): Promise<string> {
   if (workspaceId !== undefined && (kind !== "workspace" || !/^[a-zA-Z0-9][a-zA-Z0-9:._-]{0,255}$/.test(workspaceId)))
     throw new Error("Instance binding requires a valid Workspace identity and a Workspace root");
@@ -121,6 +122,13 @@ export async function buildImmutableCandidate(
   const url = new URL(source.repository);
   if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash)
     throw new Error("Candidate origin must be credential-free HTTPS");
+  if (
+    platformSource &&
+    (Object.keys(platformSource).sort().join(",") !== "commit,directory,repository" ||
+      !/^[a-f0-9]{40}$/.test(platformSource.commit) ||
+      !/^\/nix\/store\/[a-z0-9]{32}-[^/\s]+$/.test(platformSource.directory))
+  )
+    throw Error("Invalid immutable platform source input");
   const generator =
     process.env.QUIXOS_CHECK_GENERATOR ?? path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
   if (!/^\/nix\/store\/[^/]+$/.test(generator)) throw new Error("Use the installed Quixos checker");
@@ -204,6 +212,7 @@ export async function buildImmutableCandidate(
         "contractOnly",
         contractOnly ? "true" : "false",
         ...(workspaceId === undefined ? [] : ["--argstr", "workspaceId", workspaceId]),
+        ...(platformSource ? ["--argstr", "platformSourceJSON", JSON.stringify(platformSource)] : []),
         "--add-root",
         gcRoot,
         "--indirect",

src/capability-language/source-check-driver.ts

@@ -6,5 +6,13 @@ const [repository, commit, log, workspaceId] = process.argv.slice(2);
 if (!repository || !commit || !log || !workspaceId || process.argv.length !== 6)
   throw Error("source-check-driver REPOSITORY COMMIT LOG WORKSPACE_ID");
 process.stdout.write(
-  (await buildImmutableCandidate({ repository, commit }, "workspace", log, false, undefined, workspaceId)) + "\n",
+  (await buildImmutableCandidate(
+    { repository, commit },
+    "workspace",
+    log,
+    false,
+    undefined,
+    workspaceId,
+    process.env.QUIXOS_CHECK_PLATFORM_SOURCE ? JSON.parse(process.env.QUIXOS_CHECK_PLATFORM_SOURCE) : undefined,
+  )) + "\n",
 );