Declarative composition.

Every fact lives in exactly one row. A slice’s needs are never re-authored into the composition — they resolve from the slice’s own declaration. The operator layers may tighten or add grants; they may not edit a slice’s declaration.

The in-image manifest’s needs: block is the ONLY spelling of host-surface requirements — one key, one grammar, one semantics. Every entry is absolute (or a symbolic atom: $HOME, $TMPDIR, $CWD, $TEBAKO_HOME — resolved at bind, per invocation, never baked), carries ro|rw, an optional bind-mount spelling, an optional platform filter, an optional: true marker for probe artifacts — and a MANDATORY why:.

Fail-closed by construction: a need absent without the optional marker is a named error; an ro ancestor may not hide an rw descendant; rw on a user-surface atom requires the composition’s explicit consent — declared write access is visible by construction. Deriving a grant derives its strict ancestors as traverse reads, so canonicalization walks pass (the JVM’s realpath-at-boot case).

tebako.yaml — YAML, versioned JSON Schema, discovered walking up from the cwd (or named with -f). The CLI flags are this document written inline: tebako run accepts --slice name@req, --runtime, --entrypoint, --mount host:mount:ro|rw, --policy open|deny, --need path:ro — each flag maps 1:1 onto a key; flags and -f compose, flags win.

Any declaration in force — a composition document, a slice with needs, a CLI flag — turns the policy default to deny; open must be asked for by name. A run with NO declarations anywhere runs open (never_denies) — declarations are what turn the jail on. Under deny, the effective world is exactly: the VFS images (read-only by construction, not policy-gated at all); the platform floor; the system’s own surface ($TEBAKO_HOME and the exec cache, read-only at bind); the union of declared needs; the composition’s mounts/needs; and argument files auto-granted ro. Everything else: EPERM/EROFS, journaled — and the journal line names the covering declaration (would-need=slice:openjdk) or says none exists, so the operator learns the exact key to add from the denial itself.

One algorithm, three front ends (shim, bootstrap, tebako run/press), in order:

Fat and lean are the same architecture (the locked model): press always resolves and locks the full closure — every slice’s version and sha256 recorded in the package manifest — and the only question left is where the bytes live. A slice is carried (its bytes are carried in a trailer slot) or shared (resolved at first run into the machine store, verified against the locked digest, and shared with every package that needs the same slice). A self-contained package carries everything — zero network, empty cache, one file. A shared-runtime package carries its payloads and shares the runtime — the shape packed-mn ships. lean/fat survive as deprecated aliases with a named warning.

Carried slices seed the store lazily at first run — best-effort, tmp+rename, journaled, never blocking the run — so a self-contained download doubles as a cache prime. Shared slices resolve by the locked digests, fail-closed: carry/shared changes where bytes come from, never what runs. Platform coverage is declared by the slice itself (platforms: universal or an explicit triplet list); the composition’s per-slice platforms: key is an assertion that can narrow, never extend — a slice that cannot cover the host triplet is a named error, never a silent fallback.

A slice author usually does not know the host surface their executable touches. policy: record (env form: TEBAKO_JAIL=record) allows every host check and journals it (event=jail-allow path=… op=…) — nothing is denied, so the workload cannot crash from policy during discovery, and spawned children append to the same journal. The generator, tfs needs --from-journal, folds the journal (denials included — a denial is an unmet need) into a draft needs: block: atoms re-substituted, floor/store/exec-cache excluded, strongest observed op wins, ancestor collapse, why: "TODO — observed: …" for the author to replace. The human gate is the point: the record shows the observed minimum; the author decides what production actually wants. The generator never edits a manifest itself, and shipping record in force is a named lint warning.

Slice images are immutable and content-addressed — a configuration change never mutates or rebuilds one. In managed mode the swap IS editing tebako.yaml. A standalone package’s baked composition is the DEFAULT; an external document overrides it — first hit wins: --compose, then TEBAKO_COMPOSE, then a sidecar <package>.tebako.yaml. The override replaces the baked policy/mounts/needs/entrypoint; it can never conjure slice content — a slice the trailer does not carry is a named error, and the trust checks apply to newly referenced slices exactly as at press. The run’s provenance is journaled: event=composition source=external(<path>) sha256=… or source=baked. Today tfs exec --compose speaks the image-layer subset; the bootstrap/shim override channels arrive in Phase-R.

See also: Jails and host proxying · The driver contract · Where shared slices live.