Build checked workspace source in a sealed tenant-scoped VM

src/capability-language/source-check-driver.ts

@@ -0,0 +1,8 @@
+import { buildImmutableCandidate } from "./checked-build.js";
+
+// Installed platform driver, run only inside the sealed checker's unprivileged
+// evaluator. Authored flakes never become the outer evaluator program.
+const [repository, commit, log] = process.argv.slice(2);
+if (!repository || !commit || !log || process.argv.length !== 5)
+  throw Error("source-check-driver REPOSITORY COMMIT LOG");
+process.stdout.write((await buildImmutableCandidate({ repository, commit }, "workspace", log)) + "\n");