From 3c0378358fef56877afc2969a6b1e1d8097cc985 Mon Sep 17 00:00:00 2001
From: "Timothy J. Aveni" <tja@berkeley.edu>
Date: Mon, 21 Sep 2026 01:56:17 -0700
Subject: [PATCH] Run checked execution candidates in isolated development
 workspaces

---
 nix/checked-candidate.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/nix/checked-candidate.nix b/nix/checked-candidate.nix
index 7fe5a4e..e460047 100644
--- a/nix/checked-candidate.nix
+++ b/nix/checked-candidate.nix
@@ -164,6 +164,12 @@ pkgs.runCommand (if contractOnly then "qx-contract" else "qx-checked-candidate")
       ${pkgs.nodejs_24}/bin/node ${./check-execution.mjs} \
         ${protocol}/libexec/quixos-protocol/execution-world.mjs \
         "$out/execution-plan.json" "$out/checks.json" "$out"
+      mkdir -p "$out/bin"
+      cat > "$out/bin/run-isolated" <<EOF
+      #!${pkgs.runtimeShell}
+      exec ${runtimePackages.camino-isolated-workspace}/bin/camino-isolated-workspace "$out" "\$@"
+      EOF
+      chmod +x "$out/bin/run-isolated"
     ''}
   ''}
   ${pkgs.lib.optionalString (