Set a jail policy.

A deny policy is not a blank refusal. Every policy bound under the deny default gains a fixed per-platform set of read-only grants — the floor — covering the surface a spawned interpreter physically cannot boot without. The floor exists because a missing platform grant never failed as a policy verdict: it crashed the child in someone else’s library (a JVM under a scratch-only jail segfaulted in its locale init when reads under /usr were denied). Denying the platform surface never produced a working process, so the floor grants it always:

Two rules keep the floor honest. An authored mount covering a floor path supersedes the floor entry — widening one to read-write is one authored grant away, and the floor never narrows what you allowed. And every bound grant, authored or floor, implies its strict ancestors are traversable by exact-path reads, so the platform’s canonicalization walks pass by construction. The floor is system surface only: your home directory and your own tool trees stay authored grants — a deny never read-exposes them for you.

Tighten a single run at invocation with --jail:

With tebako run the flag goes before the -- that separates payload arguments. At a shim, leading --jail / --mount / --no-host tokens are consumed by the dispatcher — everything else reaches the payload untouched.

The two invocation-time grants are --mount and --no-host:

--mount <host:mount:ro|rw> adds a host directory into the process’s filesystem view at the given path, read-only or read-write; repeat it per grant. --no-host goes further than tightening: it drops every host grant the package requested.

A jail policy is YAML — a default profile plus explicit mounts:

Publishers bake a policy into the package at press time; users apply one per run by passing the file path as the spec:

The same grammar works from the environment: TEBAKO_JAIL takes directives separated by semicolons — open, deny, <host>:<mount>:ro|rw, or @<path> to read directives from a file:

An author rarely knows the host surface their payload touches — the JVM’s home probe was invisible until the journal named it. Discovery is a first-class policy mode, not a guess: TEBAKO_JAIL=record allows every host access and journals it — event=jail-allow path=… op=read|write — so the workload cannot crash from policy while you observe it. Spawned children inherit the spec and append to the same journal.

Record a run, then feed the journal to the generator:

The generator reads the record journal — folding in jail-deny lines too, since a denial is an unmet need — and emits a draft needs: block: one entry per observed path, symbolic atoms re-substituted (/Users/alice/… → $HOME/…), access set to the strongest observed op, floor and store paths excluded (they are automatic), each entry carrying a why: "TODO" for you to replace with the real reason.

The generator never edits a manifest. The record shows the observed minimum; you review the draft — flipping ro↔rw where production differs from the observation, deleting noise, filling in why — and merge it yourself. And record is a development mode: it journals at full volume and installs no enforcement, so shipping a composition with record still in force draws a named lint warning.

A slice declares its host surface in its manifest — needs: is the only spelling, one key with one grammar:

The symbolic atoms resolve at bind, per invocation, per user — never baked: $HOME, $TMPDIR, $CWD (the invoking directory), $TEBAKO_HOME. A need absent at bind without the optional marker is a named error, never a silent skip.

Stated plainly: record mode and the journal generator ship today at the image layer — TEBAKO_JAIL=record, tfs needs --from-journal, and needs: inside tfs exec --compose documents. The wiring of needs: into slice manifests, shims, and press is Phase-R — specified, not yet shipped. When it lands, a declared need is a contract: an effective policy that does not cover it fails the run before exec, naming the slice, the path, and the why — a need never surfaces as a mid-run EPERM.

The package manifest requests a policy; the user can only narrow it. The effective policy is the intersection — manifest ∩ user — and the user’s policy wins every conflict. A package may ask for read-write $HOME; --jail deny:arg at invocation still cuts it down, and --no-host drops the request entirely. Nothing at run time can widen what the publisher denied.

Every denial appends one line to the journal — $TEBAKO_HOME/journal.log by default. When a tool cannot see something you expected it to, that file is the first place to read. Under record mode (above) the allows append too — the same file is what tfs needs --from-journal reads.

A malformed policy never runs half-applied: the run fails closed with exit 73 and nothing mounts.

See also: Run a packaged app · Package a Ruby app · Exec tiers — where the preload shim ends