feat: add remote workspaces and verified deliverables

e2e/stub_provider.py

@@ -60,10 +60,18 @@ class StubHandler(BaseHTTPRequestHandler):
         messages = payload.get("messages") or []
         tools = payload.get("tools") or []
         has_tool_result = any(message.get("role") == "tool" for message in messages)
+        called_tools = {
+            str((call.get("function") or {}).get("name", ""))
+            for message in messages
+            if message.get("role") == "assistant"
+            for call in (message.get("tool_calls") or [])
+        }
+        available_names = {
+            str((tool.get("function") or {}).get("name", "")) for tool in tools if isinstance(tool, dict)
+        }
+        is_work = "update_plan" in available_names
 
         if tools and not has_tool_result:
-            names = {str((tool.get("function") or {}).get("name", "")) for tool in tools if isinstance(tool, dict)}
-            is_work = "update_plan" in names
             path = "work-proof.txt" if is_work else "chat-proof.txt"
             arguments = json.dumps(
                 {"path": path, "content": _last_user_text(messages) or "e2e"},
@@ -83,6 +91,24 @@ class StubHandler(BaseHTTPRequestHandler):
             self._respond(payload, _completion(model, message, "tool_calls"))
             return
 
+        if is_work and "write_file" in called_tools and "read_file" not in called_tools:
+            message = {
+                "role": "assistant",
+                "content": None,
+                "tool_calls": [
+                    {
+                        "id": "call_e2e_verify",
+                        "type": "function",
+                        "function": {
+                            "name": "read_file",
+                            "arguments": json.dumps({"path": "work-proof.txt"}),
+                        },
+                    }
+                ],
+            }
+            self._respond(payload, _completion(model, message, "tool_calls"))
+            return
+
         text = "E2E provider completed after tool execution." if has_tool_result else "E2E provider response."
         self._respond(payload, _completion(model, {"role": "assistant", "content": text}, "stop"))
 

e2e/verify_stack.py

@@ -1,7 +1,9 @@
 from __future__ import annotations
 
 import atexit
+import io
 import os
+import tarfile
 import time
 import uuid
 from typing import Any
@@ -235,6 +237,35 @@ def main() -> None:
         )
         assert status_code == 200, work_body
         assert _workspace_file(docker_client, users[0]["id"], "work-proof.txt") == work_marker
+        listing = client.get(
+            "/api/v1/k1412/workspace/files",
+            headers=_auth(users[0]["token"]),
+            params={"path": "."},
+        )
+        listing.raise_for_status()
+        assert "work-proof.txt" in {item["name"] for item in listing.json()["entries"]}
+        download = client.get(
+            "/api/v1/k1412/workspace/download",
+            headers=_auth(users[0]["token"]),
+            params={"path": "work-proof.txt"},
+        )
+        download.raise_for_status()
+        assert download.text == work_marker
+        isolated_listing = client.get(
+            "/api/v1/k1412/workspace/files",
+            headers=_auth(users[1]["token"]),
+            params={"path": "."},
+        )
+        isolated_listing.raise_for_status()
+        assert "work-proof.txt" not in {item["name"] for item in isolated_listing.json()["entries"]}
+        archive = client.get(
+            "/api/v1/k1412/workspace/archive",
+            headers=_auth(users[0]["token"]),
+            params={"path": "."},
+        )
+        archive.raise_for_status()
+        with tarfile.open(fileobj=io.BytesIO(archive.content), mode="r:gz") as workspace_tar:
+            assert any(name.endswith("work-proof.txt") for name in workspace_tar.getnames())
 
         with httpx.Client(base_url=_runtime_url(docker_client), timeout=30, trust_env=False) as runtime:
             runtime_headers = _runtime_headers(users[0], chat_ids[0])
@@ -254,7 +285,10 @@ def main() -> None:
             )
             assert downgrade.status_code == 409, downgrade.text
 
-    print("E2E passed: auth approval, six models, Chat tools, Work loop, isolation, and downgrade lock.")
+    print(
+        "E2E passed: auth approval, six models, Chat tools, Work evidence, file downloads, "
+        "isolation, and downgrade lock."
+    )
 
 
 if __name__ == "__main__":