Dependency scripts
Default denial, exact hook approvals, and Linux execution prerequisites.
Published v0.0.13 denies dependency lifecycle scripts by default and reports skipped hooks. Packages that rely on native builds or generated files may install but remain unusable. Explicit root scripts run separately through tapid run.
Exact approvals
Published v0.0.13 can approve dependency preinstall, install and postinstall hooks in checked-in tapid.lifecycle.toml. Each approval binds the exact package name, version, registry-declared archive SHA-512 and SHA-256 of the script bytes. Changed inputs fail rather than inheriting old permission. Preparation hooks cannot be approved.
Approvals declare filesystem, network, environment, tool bytes and resource limits. They must explicitly acknowledge access to the backend's system toolchain. Hook environments exclude caller credentials. Execution uses a private dependency copy; source store trees, active dependencies, manifests and locks remain outside its write grants.
This is permission to execute arbitrary dependency code within the selected boundary. It does not prove output correctness. Use the complete pinned policy reference when reviewing a policy; placeholder digests are not approvals.
Linux prerequisites
The first backend uses Linux ManagedTree with Landlock ABI 3 or newer, seccomp, util-linux unshare, private PID/mount namespaces and writable delegated cgroup v2 with memory and pids controllers, kill and swap controls. Tapid does not configure host delegation. Missing prerequisites fail before dependency code starts. macOS and Windows approved execution remain unavailable.
The implementation applies whole-attempt resource limits and owns descendants through the private namespace and cgroup. Exact-commit platform acceptance remains pending. Host administration and concurrent host filesystem mutation remain outside the boundary.
Derived outputs and replay
Successful hook outputs have separate derived-tree identities. Schema 9 retains original source identities and authenticates derived outputs with store-local attestations. Changes to policy, tools, toolchain or inputs invalidate reuse. Missing or corrupt store keys invalidate replay and require approved rebuilding.
Offline/frozen replay never executes hooks. It requires matching verified source and derived trees plus policy and toolchain prerequisites. tapid ci can fetch missing sources but never rebuilds derived outputs. Imported schema-8 locks never run hooks; approved builds require ordinary online resolution.
Live workspace inputs, cyclic approved graphs and unsupported preparation hooks fail closed. Check tapid --version and command help before using this workflow; v0.0.12 does not include these approvals.