feat: add remote workspaces and verified deliverables

e2e/verify_stack.py

@@ -1,7 +1,9 @@
 from __future__ import annotations
 
 import atexit
+import io
 import os
+import tarfile
 import time
 import uuid
 from typing import Any
@@ -235,6 +237,35 @@ def main() -> None:
         )
         assert status_code == 200, work_body
         assert _workspace_file(docker_client, users[0]["id"], "work-proof.txt") == work_marker
+        listing = client.get(
+            "/api/v1/k1412/workspace/files",
+            headers=_auth(users[0]["token"]),
+            params={"path": "."},
+        )
+        listing.raise_for_status()
+        assert "work-proof.txt" in {item["name"] for item in listing.json()["entries"]}
+        download = client.get(
+            "/api/v1/k1412/workspace/download",
+            headers=_auth(users[0]["token"]),
+            params={"path": "work-proof.txt"},
+        )
+        download.raise_for_status()
+        assert download.text == work_marker
+        isolated_listing = client.get(
+            "/api/v1/k1412/workspace/files",
+            headers=_auth(users[1]["token"]),
+            params={"path": "."},
+        )
+        isolated_listing.raise_for_status()
+        assert "work-proof.txt" not in {item["name"] for item in isolated_listing.json()["entries"]}
+        archive = client.get(
+            "/api/v1/k1412/workspace/archive",
+            headers=_auth(users[0]["token"]),
+            params={"path": "."},
+        )
+        archive.raise_for_status()
+        with tarfile.open(fileobj=io.BytesIO(archive.content), mode="r:gz") as workspace_tar:
+            assert any(name.endswith("work-proof.txt") for name in workspace_tar.getnames())
 
         with httpx.Client(base_url=_runtime_url(docker_client), timeout=30, trust_env=False) as runtime:
             runtime_headers = _runtime_headers(users[0], chat_ids[0])
@@ -254,7 +285,10 @@ def main() -> None:
             )
             assert downgrade.status_code == 409, downgrade.text
 
-    print("E2E passed: auth approval, six models, Chat tools, Work loop, isolation, and downgrade lock.")
+    print(
+        "E2E passed: auth approval, six models, Chat tools, Work evidence, file downloads, "
+        "isolation, and downgrade lock."
+    )
 
 
 if __name__ == "__main__":