The sandbox says what to allow
A refused write is named beside the failed task, with the line that allows it.
A sandbox that only says “permission denied” sends you hunting. vx names the path the task tried to write and the exact allow entry that would permit it.
Copy the fix, or move the write inside the project where it belongs.
// what it prints
vx: the sandbox refused writes outside the project: …/packages/shared.txt.
If the task needs one, grant its directory, e.g. `allow: { write: ['../'] }`.More in Correct by default
A task sees only the env it names
Undeclared variables never reach a task, and secrets are masked in its output.
Projects stay in their lane
A project’s globs never reach into another project’s files.
Damaged artifacts are misses
Every artifact is checked before it is restored; damage means a rebuild, not a wrong file.
Numbers mean what you typed
Hex, exponents and fractions are refused, never quietly reinterpreted.
Releases you can verify
Binaries carry provenance, and vx upgrade checks every download’s SHA-256.