Expand description
Capture explicit build-input trees before admission, and stage their exact bytes.
This is not Cargo dependency discovery. The caller must include every local path dependency inside the root and supply compiler/configuration/environment inputs. Builds must place output outside the staged tree. Network inputs, generated inputs outside the tree, and mutable external dependencies require restart.
Structsยง
- Build
Inputs - An owned, byte-exact revision. Rust sources remain text for function admission; every other input is encoded so binary assets are covered without lossy decoding.
- Staged
Inputs - An isolated build tree. Build scripts can still write to it: verification fails closed if they do. This is source isolation, not a sandbox for arbitrary builds.