@@ -33,8 +33,6 @@ github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJ
 github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
 github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8=
 github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
-github.com/codefly-dev/core v0.2.11 h1:EZZscZPW1VSIvoQzekMUH/epNgyl7AkA19I2UbciRnE=
-github.com/codefly-dev/core v0.2.11/go.mod h1:17JyLS7Ni2GsOXSzl5pL6I8++GFogzRMDynle4+2uEs=
 github.com/cyphar/filepath-securejoin v0.6.1 h1:5CeZ1jPXEiYt3+Z6zqprSAgSWiggmpVyciv8syjIpVE=
 github.com/cyphar/filepath-securejoin v0.6.1/go.mod h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 
@@ -66,7 +66,11 @@ func (s *Runtime) Load(ctx context.Context, req *runtimev0.LoadRequest) (*runtim
 		s.Service.SourceLocation = wd
 	}
 
-	return s.Runtime.LoadResponse()
+	resp, err := s.Runtime.LoadResponse()
+	if resp != nil && resp.Status != nil {
+		resp.Status.Message = pythonhelpers.AppendRuntimeEvidence(resp.Status.Message, pythonhelpers.RuntimeEvidence(s.Service.SourceLocation))
+	}
+	return resp, err
 }
 
 // Init runs `uv sync` to materialize the venv. Non-fatal on failure.
@@ -150,11 +154,14 @@ func (s *Runtime) Test(ctx context.Context, req *runtimev0.TestRequest) (*runtim
 			wool.Field("command", fspec.Command), wool.Field("output", fspec.Output))
 		fStart := time.Now()
 		fRun, fErr := pythonhelpers.RunFormulaStructured(ctx, s.Service.SourceLocation, fspec)
+		evidence := pythonhelpers.RuntimeEvidenceForFormula(s.Service.SourceLocation, cmd, output, env, prov, formulaDerivedFromProject(req, s.Base.Service))
 		if fRun == nil {
-			return s.Runtime.TestError(fErr)
+			return s.testErrorWithEvidence(fErr, evidence)
 		}
 		s.Wool.Forwardf("Tests: %s", fRun.LegacyTestSummary().SummaryLine())
-		return fRun.ToProtoResponse("formula", req.Suite, time.Since(fStart)), fErr
+		resp := fRun.ToProtoResponse("formula", req.Suite, time.Since(fStart))
+		appendTestResponseEvidence(resp, evidence)
+		return resp, fErr
 	}
 
 	opts := pythonhelpers.TestOptions{
@@ -195,9 +202,11 @@ func (s *Runtime) Test(ctx context.Context, req *runtimev0.TestRequest) (*runtim
 	}
 
 	if run == nil {
-		return s.Runtime.TestError(runErr)
+		return s.testErrorWithEvidence(runErr, pythonhelpers.RuntimeEvidence(s.Service.SourceLocation))
 	}
-	return run.ToProtoResponse("pytest", req.Suite, duration), runErr
+	resp := run.ToProtoResponse("pytest", req.Suite, duration)
+	appendTestResponseEvidence(resp, pythonhelpers.RuntimeEvidence(s.Service.SourceLocation))
+	return resp, runErr
 }
 
 // Lint runs ruff via the core python helper.
@@ -229,12 +238,29 @@ func (s *Runtime) Information(ctx context.Context, req *runtimev0.InformationReq
 // (resources.Service.Test), else the formula DERIVED from the project, else none
 // (ok=false → the agent's default runner). Returns the raw language-agnostic
 // fields; SpecFromFormula does the uv mapping.
+//
+// A per-call formula with NO command but WITH provisioning/env (a Mind
+// environment heal like {cwd: tests} or {with: Werkzeug<3}) is an OVERLAY: it
+// rides on top of the configured/derived formula instead of being dropped.
+// Mirrors Mind's InProcessRuntime so local == remote — before this, a healed
+// work_dir sent without a command was a silent no-op on the agent path.
 func resolveTestFormula(req *runtimev0.TestRequest, svc *resources.Service, sourceDir string) (cmd []string, output string, env, prov map[string]string, ok bool) {
-	if f := req.GetFormula(); f != nil && len(f.GetCommand()) > 0 {
-		return f.GetCommand(), f.GetOutput(), f.GetEnv(), f.GetProvisioning(), true
+	f := req.GetFormula()
+	if f != nil && len(f.GetCommand()) > 0 {
+		return f.GetCommand(), f.GetOutput(), f.GetEnv(), enrichSuppliedProvisioning(f.GetProvisioning(), sourceDir), true
+	}
+	overlay := func(bcmd []string, boutput string, benv, bprov map[string]string) ([]string, string, map[string]string, map[string]string, bool) {
+		if f != nil {
+			if o := f.GetOutput(); o != "" {
+				boutput = o
+			}
+			benv = overlayStringMap(benv, f.GetEnv())
+			bprov = overlayStringMap(bprov, f.GetProvisioning())
+		}
+		return bcmd, boutput, benv, bprov, true
 	}
 	if svc != nil && svc.Test != nil && len(svc.Test.Command) > 0 {
-		return svc.Test.Command, svc.Test.Output, svc.Test.Env, svc.Test.Provisioning, true
+		return overlay(svc.Test.Command, svc.Test.Output, svc.Test.Env, enrichSuppliedProvisioning(svc.Test.Provisioning, sourceDir))
 	}
 	// No explicit (per-call) or configured (service.yaml) formula → DERIVE it from
 	// the project: read its own declarations (tox/Makefile/CI/README) for the
@@ -243,12 +269,87 @@ func resolveTestFormula(req *runtimev0.TestRequest, svc *resources.Service, sour
 	// python plugin "just run the project's tests" — no framework knowledge in Mind.
 	if sourceDir != "" {
 		if dcmd, doutput, denv, dprov, dok := pythonhelpers.DeriveFormula(sourceDir); dok {
-			return dcmd, doutput, denv, dprov, true
+			return overlay(dcmd, doutput, denv, dprov)
 		}
 	}
 	return nil, "", nil, nil, false
 }
 
+// overlayStringMap returns base with overlay's entries layered on top (overlay
+// wins). Used so a per-call heal (provisioning/env without a command) survives
+// when the command comes from config/derivation. Returns base unchanged when
+// the overlay is empty.
+func overlayStringMap(base, overlay map[string]string) map[string]string {
+	if len(overlay) == 0 {
+		return base
+	}
+	out := make(map[string]string, len(base)+len(overlay))
+	for k, v := range base {
+		out[k] = v
+	}
+	for k, v := range overlay {
+		out[k] = v
+	}
+	return out
+}
+
+// enrichSuppliedProvisioning delegates to the SHARED core helper
+// (pythonhelpers.EnrichSuppliedProvisioning) so the agent's Test RPC and
+// Mind's in-process runtime resolve identical formulas — the health probe and
+// the task-phase test run must see the same derived editable/python/
+// build-requires under any supplied keys.
+func enrichSuppliedProvisioning(supplied map[string]string, sourceDir string) map[string]string {
+	return pythonhelpers.EnrichSuppliedProvisioning(supplied, sourceDir)
+}
+
+func formulaDerivedFromProject(req *runtimev0.TestRequest, svc *resources.Service) bool {
+	if f := req.GetFormula(); f != nil && len(f.GetCommand()) > 0 {
+		return false
+	}
+	return svc == nil || svc.Test == nil || len(svc.Test.Command) == 0
+}
+
+func (s *Runtime) testErrorWithEvidence(err error, evidence string) (*runtimev0.TestResponse, error) {
+	if err == nil {
+		msg := pythonhelpers.AppendRuntimeEvidence("test runtime errored before tests could execute", evidence)
+		return &runtimev0.TestResponse{
+			Status: &runtimev0.TestStatus{State: runtimev0.TestStatus_ERROR, Message: msg},
+			Result: &runtimev0.TestRunResult{State: runtimev0.TestRunResult_ERRORED, Message: msg},
+			Counts: &runtimev0.TestCounts{},
+		}, nil
+	}
+	resp, testErr := s.Runtime.TestError(err)
+	appendTestResponseErrorEvidence(resp, evidence)
+	return resp, testErr
+}
+
+func appendTestResponseEvidence(resp *runtimev0.TestResponse, evidence string) {
+	if resp == nil || resp.GetResult().GetState() != runtimev0.TestRunResult_ERRORED {
+		return
+	}
+	appendTestResponseErrorEvidence(resp, evidence)
+}
+
+func appendTestResponseErrorEvidence(resp *runtimev0.TestResponse, evidence string) {
+	if resp == nil {
+		return
+	}
+	if resp.Counts == nil {
+		resp.Counts = &runtimev0.TestCounts{}
+	}
+	if resp.Status != nil {
+		resp.Status.Message = pythonhelpers.AppendRuntimeEvidence(resp.Status.Message, evidence)
+	}
+	if resp.Result != nil {
+		resp.Result.Message = pythonhelpers.AppendRuntimeEvidence(resp.Result.Message, evidence)
+	} else {
+		resp.Result = &runtimev0.TestRunResult{
+			State:   runtimev0.TestRunResult_ERRORED,
+			Message: pythonhelpers.AppendRuntimeEvidence("", evidence),
+		}
+	}
+}
+
 func boolToLintState(ok bool) runtimev0.LintStatus_Status {
 	if ok {
 		return runtimev0.LintStatus_SUCCESS
 
@@ -0,0 +1,125 @@
+package runtime
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	runtimev0 "github.com/codefly-dev/core/generated/go/codefly/services/runtime/v0"
+	"github.com/codefly-dev/core/resources"
+)
+
+// TestEnrichSuppliedProvisioning locks the supplied-formula environment
+// contract: the caller owns WHAT to run, the plugin derives the uv
+// environment around it (editable install, interpreter pin), and explicitly
+// supplied keys always win. This is the regression test for the SWE-bench
+// easy-tier failure where django's supplied "python runtests.py" formula ran
+// without --with-editable . and env-blocked with "Django module not found".
+func TestEnrichSuppliedProvisioning(t *testing.T) {
+	dir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(dir, "setup.py"), []byte("from setuptools import setup\nsetup(name='pkg')\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, ".python-version"), []byte("3.9\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	t.Run("empty bag gains derived environment", func(t *testing.T) {
+		got := enrichSuppliedProvisioning(nil, dir)
+		if got["editable"] != "true" {
+			t.Fatalf("editable = %q, want true (project package must be importable)", got["editable"])
+		}
+		if got["no_project"] != "true" {
+			t.Fatalf("no_project = %q, want true", got["no_project"])
+		}
+		if got["python"] != "3.9" {
+			t.Fatalf("python = %q, want 3.9 from .python-version", got["python"])
+		}
+	})
+
+	t.Run("supplied keys win over derived", func(t *testing.T) {
+		got := enrichSuppliedProvisioning(map[string]string{"editable": "false", "python": "3.11"}, dir)
+		if got["editable"] != "false" {
+			t.Fatalf("editable = %q, want supplied false to win", got["editable"])
+		}
+		if got["python"] != "3.11" {
+			t.Fatalf("python = %q, want supplied 3.11 to win", got["python"])
+		}
+		if got["no_project"] != "true" {
+			t.Fatalf("no_project = %q, want derived true to fill the gap", got["no_project"])
+		}
+	})
+
+	t.Run("no source dir passes supplied through", func(t *testing.T) {
+		supplied := map[string]string{"editable": "false"}
+		got := enrichSuppliedProvisioning(supplied, "")
+		if len(got) != 1 || got["editable"] != "false" {
+			t.Fatalf("got %v, want supplied bag unchanged", got)
+		}
+	})
+}
+
+// A per-call formula with NO command but WITH provisioning/env — a Mind
+// environment heal such as {cwd: tests} or {with: Werkzeug<3} — must OVERLAY
+// the configured/derived formula instead of being dropped. This locks the
+// remote-agent path against the django-trace defect where a healed work_dir
+// sent without a command was a silent no-op (mirrors Mind's InProcessRuntime).
+func TestResolveTestFormulaOverlaysCommandlessHealOntoConfiguredFormula(t *testing.T) {
+	svc := &resources.Service{
+		Test: &resources.TestFormula{
+			Command:      []string{"python", "runtests.py"},
+			Output:       "unittest-text",
+			Provisioning: map[string]string{"python": "3.9"},
+			Env:          map[string]string{"KEEP": "1"},
+		},
+	}
+	req := &runtimev0.TestRequest{Formula: &runtimev0.TestFormula{
+		Provisioning: map[string]string{"cwd": "tests", "with": "Werkzeug<3"},
+		Env:          map[string]string{"PYTHONPATH": "."},
+	}}
+
+	cmd, output, env, prov, ok := resolveTestFormula(req, svc, "")
+	if !ok {
+		t.Fatal("resolveTestFormula returned ok=false")
+	}
+	if len(cmd) != 2 || cmd[0] != "python" || cmd[1] != "runtests.py" {
+		t.Fatalf("command = %v, want the configured command", cmd)
+	}
+	if output != "unittest-text" {
+		t.Fatalf("output = %q", output)
+	}
+	if prov["cwd"] != "tests" || prov["with"] != "Werkzeug<3" {
+		t.Fatalf("healed provisioning must overlay the configured formula, got %v", prov)
+	}
+	if prov["python"] != "3.9" {
+		t.Fatalf("configured provisioning must survive the overlay, got %v", prov)
+	}
+	if env["PYTHONPATH"] != "." || env["KEEP"] != "1" {
+		t.Fatalf("env overlay wrong: %v", env)
+	}
+}
+
+func TestResolveTestFormulaOverlaysCommandlessHealOntoDerivedFormula(t *testing.T) {
+	dir := t.TempDir()
+	toxIni := "[tox]\nenvlist = py\n\n[testenv]\ncommands =\n    python -m unittest -v test_sample {posargs}\n"
+	if err := os.WriteFile(filepath.Join(dir, "tox.ini"), []byte(toxIni), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	req := &runtimev0.TestRequest{Formula: &runtimev0.TestFormula{
+		Provisioning: map[string]string{"cwd": "tests"},
+	}}
+
+	cmd, _, _, prov, ok := resolveTestFormula(req, nil, dir)
+	if !ok {
+		t.Fatal("resolveTestFormula returned ok=false (derivation should succeed from tox.ini)")
+	}
+	if len(cmd) == 0 || cmd[0] != "python" {
+		t.Fatalf("command = %v, want the tox-derived command", cmd)
+	}
+	if prov["cwd"] != "tests" {
+		t.Fatalf("healed cwd must overlay the DERIVED formula, got %v", prov)
+	}
+	if prov["no_project"] != "true" {
+		t.Fatalf("derived provisioning must survive the overlay, got %v", prov)
+	}
+}