Optional Python environments and notebooks

A deployment operator approves the sandbox profiles and an application Administrator registers an approved environment for a particular application. The embedded editor edits source; the isolated headless builder executes authored Python to produce plans for fixed-core validation.

Approve and register a builder environment

1. On the packaged Ubuntu host, maintain the protected epm_python_builder_profiles.json under EPM_SECRETS_DIR. The JSON object has a profiles array. Each entry declares environmentId, integer environmentVersion, immutable image and sandbox network, with optional compilerVersions. Keep the deployed registry, worker, broker and trusted sandbox launcher on the same profile content. Run the matching packaged epmctl doctor to check runsc and the protected configuration. After startup, epmctl status requires the active trusted sandbox launcher and its control socket.
2. As application Administrator, use read_v2_program with python.environment.profile.list and an empty argument object. Match the returned profileId, environmentId, environmentVersion and imageDigest to the approved profile. Registration takes that profile ID and its exact environment ID and version.
3. Read application.state.read immediately before registration. Use execute_v2_python_program_registry with the program below and a stable idempotency_key. Supply the three current revisions from the application state. Registry tool reference

This disposable example assumes the host approves docs-python version 1. The three zeros illustrate integer fields. Replace them with the actual metadataRevision, policyRevision and schemaEpoch in your selected application.

{"languageVersion":2,"function":"python.environment.register","arguments":{"environmentId":"docs-python","version":1,"profileId":"docs-python","expectedMetadataRevision":0,"expectedPolicyRevision":0,"expectedSchemaEpoch":0}}

Expect Active, the approved image digest, the registered version and a committed operation ID. Read it back with python.environment.read. In the browser, open Rules → Python programs, choose Read environments or Refresh environments, and verify the version appears under Approved environment. To reconcile a lost registration response, replay the exact program with its original key and identity. If the server reports stale context, read current state and review the new intent before submitting it.

Run the disposable sealed-build example and verify its source and plan digests. If the build fails, inspect its status and build log when available, then check the profile digest, launcher and resource limits. A sealed build requires a separate authorized run to publish results.

Verify the embedded editor and headless builder

1. Open the Python rule editor and verify its locally bundled editor worker loads under the application Content Security Policy, without an external CDN. Open an exact saved version and edit a new version.
2. Save source with a syntax error and verify structured, source-bound diagnostics. Correct the source and verify that Save automatically queues Validation; an inactive version must be buildable and testable without permitting business publication.
3. Test a bounded numeric rule, inspect its complete before/after result and verify ordinary application reads remain unchanged. Activate the exact valid version and run it under current execution authority. Verify worker lease fencing, current permission checks, checkpoints and expiry of private Test results.