chore(sandbox): pin the published image that carries the mock provider

The pinned digest predated src/mock_provider, so mock mode required
`up --build`. That module is now on main and published, so the sandbox runs
from a released image again and plain `up` works.

The module check stays. A digest without the module resolves and pulls fine,
then crash-loops one service, so the guard is still the difference between a
clear message and an obscure failure — its wording is just no longer tied to
an unmerged PR.

Verified against the new digest from clean volumes: `up` in 44s with no
--build, all three Honcho services on the pinned digest, 4 explicit
conclusions as documented; a junk peer added then `reset` in 1.1s restored
exactly the seeded state; and pinning the old digest still refuses to start
with the rewritten message.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

sandbox/README.md

@@ -17,10 +17,6 @@ The API lands on <http://127.0.0.1:18000>. Postgres is on 15432 and Redis on 163
 deliberately off the defaults, so the sandbox coexists with a normal local stack instead of
 fighting it for ports and volumes.
 
-> **Right now you need `--build`.** The mock provider comes from PR #1094, which is not merged, so
-> no published image contains it. `sandbox.sh` checks and tells you. Once #1094 lands and an image
-> is published, bump the digest in `image.env` and plain `up` works.
-
 ## Provider modes
 
 The deriver calls a model provider, which is what made a sandbox neither free nor deterministic.

sandbox/compose.mock.yml

@@ -1,6 +1,6 @@
 # Provider overlay: deterministic, free, no network egress. The sandbox default.
 #
-# Adds src/mock_provider (PR #1094) as its own service. It runs from the standard
+# Adds src/mock_provider as its own service. It runs from the standard
 # Honcho image under a different entrypoint, the way api and deriver already differ,
 # so there is no second image to build or keep in digest-sync.
 

sandbox/image.env

@@ -4,13 +4,10 @@
 # machines exercise the same bytes, which a floating tag does not give you.
 #
 # This is the multi-arch index digest (linux/amd64 + linux/arm64), so it resolves on
-# both Apple Silicon and CI.
+# both Apple Silicon and CI. Take it from the index, not a per-platform manifest:
 #
-# NOTE: this digest predates PR #1094, so it does NOT contain src/mock_provider.
-# Until #1094 lands and a new image is published, mock mode needs --build:
+#     docker buildx imagetools inspect ghcr.io/plastic-labs/honcho:latest
 #
-#     sandbox/sandbox.sh up --build
-#
-# sandbox.sh checks for the module and tells you this rather than failing obscurely.
-# When #1094 is merged and published, bump the digest here and drop this note.
-HONCHO_SANDBOX_IMAGE=ghcr.io/plastic-labs/honcho@sha256:3e62ce949cd020155e59d58302e11a20465c79815d80e2d4eecd106e9c8f9ab4
+# The image must contain src/mock_provider, which mock mode runs as its own service.
+# sandbox.sh checks that before starting rather than letting the service crash-loop.
+HONCHO_SANDBOX_IMAGE=ghcr.io/plastic-labs/honcho@sha256:a741e601e2c2fda5af4b6c207946aad45db2a11db05f04c1dc094f998794eae1

sandbox/sandbox.sh

@@ -116,20 +116,19 @@ preflight() {
   return 0
 }
 
-# The pinned digest predates PR #1094, so it carries no src/mock_provider. Say so
-# precisely instead of letting the service crash-loop on a missing module.
+# Mock mode runs src/mock_provider out of the same image. A digest that predates the
+# module resolves and pulls fine, then crash-loops one service on a missing module —
+# so check for it up front and name the two ways out.
 check_mock_provider_present() {
   [ "$PROVIDER" = mock ] || return 0
   if ! docker run --rm --entrypoint test "$HONCHO_SANDBOX_IMAGE" -d /app/src/mock_provider; then
     die "$(cat <<MSG
 the image $HONCHO_SANDBOX_IMAGE does not contain src/mock_provider.
 
-PR #1094 adds it and is not merged yet, so no published image has it. Build from
-the working tree instead:
+It predates the mock provider. Either bump the digest in sandbox/image.env to an
+image that has it, or build from the working tree:
 
     sandbox/sandbox.sh up --build
-
-Once #1094 is merged and published, bump the digest in sandbox/image.env.
 MSG
 )"
   fi