Function check_interpreted_entrypoints_reachable 

pub fn check_interpreted_entrypoints_reachable(
    policy: &CapabilityPolicy,
    declared_floor: ContainmentClass,
) -> Result<(), RuntimeError>

Refuses a sealed capsule whose capabilities.shell.allow names a script that nothing declared could make importable inside the composed root.

See the module doc for why this is a refusal and what it does not claim. In short: for each allowlisted entry that resolves to a #! script, the entry is accepted when any of the following holds, and collected as unreachable when none does.

1. The script already lives under crate::sealed::SEALED_RUNTIME_PATHS. That tree is bind-mounted whole into every composed root and granted list_dir: true, so a system /usr/bin/pip3 reaches its dist-packages beside it without anything being declared. (Read access is all an import needs; the missing Execute right on that tree is Case 2’s problem, below, not this one’s.)
2. The script lives under a directory the manifest already named in a staged_runtime source_path or an interpreter_runtime dir. The operator staged the tree the script is part of.
3. Some grant names this binary, or its shebang interpreter, by name. This is the general case, and the match is exact string equality against the grant’s binary field — not a prefix, not a basename, not case-insensitive. It can be exact because the manifest parser already requires a grant’s binary to appear verbatim in the same block’s allow, so the strings being compared come from the same list.

Rule 3 is the loose one on purpose. A grant naming python3 satisfies every script whose shebang says python3, regardless of whether the directory that grant names is the one holding the package the script imports. Verifying that would mean deriving the import closure, which is the thing this module opens by saying is not derivable. So the guarantee here is narrow and stated rather than implied: the operator was made to think about the interpreter’s runtime and write something down. Getting the directory right is still on them, and the refusal text names the strace invocation that measures it.

A non-script entry is skipped unconditionally — an ELF binary’s reachability is already resolve_landlock_grants’ concern, and re-deciding it here would be a second, weaker opinion about a question that is already answered correctly.