fix(#829): enforce repository-wide runtime launch choke point

packages/mosaic/src/mutator-gate/runtime_tools_unittest.py

@@ -6,7 +6,10 @@ from __future__ import annotations
 import importlib.util
 import io
 import json
+import os
+import runpy
 import socket
+import sys
 import unittest
 from contextlib import redirect_stderr
 from pathlib import Path
@@ -97,6 +100,17 @@ class LaunchRuntimeTest(unittest.TestCase):
         self.assertEqual(environment["MOSAIC_LEASE_RUNTIME"], "claude")
         self.assertEqual(environment["PRESERVED"], "yes")
 
+    def test_command_without_separator_is_forwarded_unchanged(self) -> None:
+        executed: list[tuple[str, list[str], dict[str, str]]] = []
+        result = LAUNCHER.main(
+            ["--runtime", "pi", "pi", "--print", "hello"],
+            environ={"MOSAIC_LEASE_BROKER_SOCKET": "/broker"},
+            request=lambda *_args: {"ok": True, "session_id": "f" * 64},
+            execute=lambda *args: executed.append(args),
+        )
+        self.assertEqual(result, 0)
+        self.assertEqual(executed[0][0:2], ("pi", ["pi", "--print", "hello"]))
+
     def test_missing_command_is_usage_error(self) -> None:
         with redirect_stderr(io.StringIO()):
             self.assertEqual(
@@ -185,6 +199,31 @@ class LaunchRuntimeTest(unittest.TestCase):
                         self.assertEqual(fake.shutdown_how, socket.SHUT_WR)
 
 
+class ExecutableEntrypointTest(unittest.TestCase):
+    def test_launcher_entrypoint_returns_usage_without_a_command(self) -> None:
+        with patch.object(
+            sys,
+            "argv",
+            [str(TOOLS_DIR / "launch-runtime.py"), "--runtime", "claude"],
+        ), redirect_stderr(io.StringIO()), self.assertRaises(SystemExit) as raised:
+            runpy.run_path(str(TOOLS_DIR / "launch-runtime.py"), run_name="__main__")
+        self.assertEqual(raised.exception.code, 64)
+
+    def test_gate_entrypoint_denies_when_identity_environment_is_absent(self) -> None:
+        class Stdin:
+            buffer = io.BytesIO(b'{"tool_name":"Bash"}')
+
+        with patch.object(
+            sys,
+            "argv",
+            [str(TOOLS_DIR / "mutator-gate.py"), "--runtime", "claude"],
+        ), patch.object(sys, "stdin", Stdin()), patch.dict(
+            os.environ, {}, clear=True
+        ), redirect_stderr(io.StringIO()), self.assertRaises(SystemExit) as raised:
+            runpy.run_path(str(TOOLS_DIR / "mutator-gate.py"), run_name="__main__")
+        self.assertEqual(raised.exception.code, 2)
+
+
 class MutatorGateTest(unittest.TestCase):
     @staticmethod
     def environment() -> dict[str, str]: