The sandbox: turning a declaration into a boundary
A cache is only correct if the declared inputs are the complete set of files the task reads. Instead of inferring that set, vx lets a task run with the declared paths as the only ones it can touch, and fails the run on anything else.