Correct by default
Nothing leaks in, nothing wrong comes back.
The worst build is a green one with the wrong bytes. vx keeps each task to the environment and the files it names, and checks what it stores and what it ships.
6 features
A task sees only the env it namesUndeclared variables never reach a task, and secrets are masked in its output.A build that reads a stray variable from your shell works on your machine and nowhere else. vx starts each task with a clean environment plus what you name.
Projects stay in their laneA project’s globs never reach into another project’s files.A root task with **/*.ts as its input would sweep in every package’s sources, so any change anywhere would move its key. Bugs like that take days to find.Each one has a page that shows it working.
Damaged artifacts are missesEvery artifact is checked before it is restored; damage means a rebuild, not a wrong file.
The sandbox says what to allowA refused write is named beside the failed task, with the line that allows it.
Numbers mean what you typedHex, exponents and fractions are refused, never quietly reinterpreted.And 1 smaller things that add up.