rc.8 truthworkspace-write grants the Session workspace and temp areas. No public extraWritableRoots or cache-resource key exists.

Model intent, not arbitrary paths.

Named resource

One cache id and one sandbox-visible mount.

Sharing scope

Session, workspace, profile, or deployment.

Toolchain namespace

Version, OS, architecture, and artifact kind.

Lifecycle owner

Quota, expiry, locks, quarantine, and cleanup.

Do not grant a whole home subtree.

Download blobsPotential cache

Retain integrity and immutable identity.

Bins · hooks · buildsExecutable state

Separate from downloaded content.

Tokens · configCredential state

Never share as cache.

CARGO_HOME is not just downloads.

Whole toolchain homes can contain executable bins, credentials, mutable indexes, and configuration. Grant only a dedicated single-purpose directory.

Prove every enforcement dialect.

bwrap

Bind visibility and mount flags.

Landlock

Rights and kernel ABI.

Seatbelt

Canonical subpath filters.

Windows ACL

SID grant and cleanup.

Acceptance gates.

Primary evidence.

Keep the complete capability design.

The canonical guide covers package-manager contents, trust scopes, path admission, TOCTOU, five runners, operational options, and twelve gates.

Read the full guideStar on GitHub