The hermetic contract tests inspect reviewed core/provider fragments, trusted composition, generated settings with no shell/background tool exposure, package-lock evidence, and the repository-managed LM Studio registration:

python -m unittest tests.nono.capabilities.core.test_policy
node --test --experimental-strip-types extensions/lm-studio/index.test.ts

The mandatory Linux host gate requires Nono 0.74.x. It creates only isolated HOME/XDG/session roots and temporary profile paths. It proves Nono composition and inherited command-denial/caller-edge behavior, personal/work Pi startup with the managed LM Studio extension loaded from isolated settings, real managed-extension model requests to the fixture endpoint, raw credential filtering, cross-session state denial, read-only versus read/write worktrees, and real selected-versus-adjacent port enforcement using loopback listeners on ports 1234 and 1235. Nono 0.74's grant is destination-port-only, as recorded in ADR 0003:

PYTHONPATH=. python tests/nono/capabilities/core/host_gate.py

The gate fails instead of skipping when Nono, Pi, or either fixture port is unavailable. It hashes active Pi settings, the unmanaged LM Studio source, and active Nono profile links before execution and fails if verification changes any of them. While quarantine is deferred, it also requires the active legacy source to match its reviewed lock digest; Slice 3 must replace that precondition with active-path absence and quarantined-file identity during the atomic cutover.

Activation remains blocked

Slice 1 does not mutate active Pi settings, credentials, packages, or Nono profile links. The reviewed LM Studio source remains blocked in config/pi-package-lock.json until maintenance verifies the recorded legacy hash, quarantines the unmanaged active file outside Pi auto-discovery, and Slice 3 promotes this source into an immutable installed snapshot. Provider credential routes are schema-validated only; live credential evidence remains a separate explicitly approved operation.