tapid ci
Install exact locked dependencies without resolving versions or rewriting project inputs.
Status
Available starting with published v0.0.13. This command is absent from v0.0.12. See Release changes for the reviewed source revision.
Syntax
ci requires a matching manifest, workspace graph and complete ordinary tapid.lock. It installs exact locked versions and edges. Missing source archives can be downloaded from locked HTTPS URLs and checked against SHA-512 integrity and tree digests, without registry metadata lookup or version resolution. Manifest and lockfile bytes remain unchanged.
--offline requires every necessary verified tree already in the store. Download URLs remain required even for warm-cache or offline ordinary locks. An explicit readable local registry fixture can supply every URL-less locked identity; integrity and tree digests still apply.
Prepare a repeatable CI install
Create and review an ordinary lock in a development checkout before CI. Include the root and member manifests, tapid.lock, registry routing and any exact hook policy in the job's project inputs. Use the same reviewed CLI release and target context; do not regenerate a rejected lock inside CI.
A cold store works when every source has a pinned artifact URL and valid integrity. Private artifacts also need the selected route's protected credential environment. A cache is an optimization for source packages, not a substitute for lock validation. Locks with approved derived outputs need the matching authenticated store state and policy/toolchain prerequisites; copying a derived package directory alone is insufficient.
Installation does not run tests or builds. Run those separately through authorized script profiles on a supported containment platform, and inspect transaction outcomes before retrying a failed install. Imported locks use frozen installation instead of ci.
Options and failures
Use --project-dir PATH, --store-dir PATH and --registry-fixture PATH where needed. Check your installed client's tapid ci --help for its exact syntax.
Locks missing artifact URLs need a deliberate tapid update using live registry metadata, followed by review. A matching lock can be replayed by ordinary install, so it does not necessarily refresh missing download metadata. Unmanaged node_modules is rejected. Activation and store publication use the recoverable lifecycle transaction. ci never runs dependency hooks; approved derived outputs must already be authenticated in the store.
Imported schema-8 locks are rejected. Use the import workflow and tapid install --frozen for those locks. Global --json currently rejects ci before execution. Read the source contract.