Approved Tools¶

Tools that have been security-reviewed and are pre-approved for agent use. Check this list before installing anything. If a tool is not listed, request approval in Discord #admin.

Python Packages (pip)¶

Package	Install	Purpose	Reviewed	Notes
mkdocs-material	`pip install mkdocs-material`	Documentation site generation	2026-03-15	Includes mkdocs core, pymdownx, mermaid support
websockify	`pip install websockify`	noVNC proxy (WebSocket to VNC)	2026-03-15	Used on Mac Mini M4 for noVNC

TTS engines (Mac Mini, run-the-docs Claude Code series)¶

Reviewed 2026-06-07 — see security review. All confirmed local-inference, no telemetry, no exfiltration in audited paths; commercial-use OK. Install per the review's hash-locked plan (chatterbox --no-deps, or two isolated venvs — transformers==5.2.0 vs 4.57.3 cannot coexist), and run offline (HF_HUB_OFFLINE=1) after the first-run weight download. Never enable the Qwen DashScope cloud path; never pass remote reference-audio URLs.

Package	Install	Purpose	Reviewed	Notes
chatterbox-tts	`pip install --no-deps "chatterbox-tts==0.1.7"`	Multilingual zero-shot local TTS narration (Resemble AI)	2026-06-07	MIT, commercial-use OK. `--no-deps` to avoid the `transformers==5.2.0`/`diffusers==0.29.0` clash with qwen-tts. Embeds benign Perth watermark (attribution only, no exfil, no commercial block). Run offline after weight download.
resemble-perth	`pip install "resemble-perth>=1.0.0"`	Imperceptible audio watermark used by chatterbox-tts	2026-06-07	MIT. Checkpoint bundled in wheel. Pure local inference, zero network calls.
qwen-tts	`pip install "qwen-tts==0.1.1"`	Qwen3-TTS local TTS / voice clone (Alibaba, import `qwen_tts`)	2026-06-07	Apache-2.0, commercial-use OK. No watermark. DO NOT use the DashScope cloud path; voice-clone refs = local paths only. Official QwenLM package (not a wrapper).
s3tokenizer	`pip install s3tokenizer`	Speech tokenizer backbone for chatterbox-tts	2026-06-07	Apache-2.0. Downloads ONNX from modelscope.cn with SHA256 verification. No telemetry.
conformer	`pip install "conformer==0.3.2"`	Conformer module (chatterbox sub-dep)	2026-06-07	MIT (lucidrains). Pure PyTorch, no network.
diffusers	`pip install "diffusers==0.29.0"`	Diffusion components (chatterbox sub-dep)	2026-06-07	Apache-2.0 (HuggingFace). HF model hub only, no telemetry.
omegaconf	`pip install omegaconf`	Config loading (chatterbox sub-dep)	2026-06-07	BSD-3-Clause. No network.
pykakasi	`pip install "pykakasi==2.3.0"`	Japanese kana/kanji conversion (chatterbox sub-dep)	2026-06-07	GPL-3.0 — copyleft applies to code redistribution only, NOT to generated audio. Local-only, no network.
spacy-pkuseg	`pip install spacy-pkuseg`	Chinese word segmentation (chatterbox sub-dep)	2026-06-07	MIT (Explosion). Model downloads from GitHub releases. No telemetry.
pyloudnorm	`pip install pyloudnorm`	Loudness normalization (chatterbox sub-dep)	2026-06-07	MIT. Pure DSP, no network.
einops	`pip install einops`	Tensor ops (qwen/chatterbox sub-dep)	2026-06-07	MIT. No network.

Not yet approved — needs its own review: uv (Astral) and uv-managed CPython 3.12 are used on the Mac Mini to build the TTS venvs (brew python@3.12 ships a broken pyexpat). They are not covered by the TTS review above; file a separate security review before listing them here.

Node.js Packages (npm/npx)¶

Package	Install	Purpose	Reviewed	Notes
wrangler	`npx wrangler`	Cloudflare Workers/Pages CLI	2026-03-14	Deploy workers, pages, D1, KV
@capacitor/core, cli, ios, app, device, push-notifications, splash-screen, status-bar	`npm ci` in `shell/` (rig-cockpit-ios) — CI, and the operator's Mac when run attended by him, subject to the six conditions in the review. Not approved for unattended agent execution	Native shell around the Rig Cockpit web app for TestFlight	2026-09-09; full 104-package tree reviewed 2026-09-11 → APPROVED with conditions	Genuinely Ionic's packages, integrity-pinned by the lockfile, no install scripts. Pinned to 6.2.2 — the earlier pin predated a navigation fix whose release notes name blocking navigation to the internal proxy path. The 6→8 major bump is deliberately held until one build ships. Conditions: add the platform with `--packagemanager SPM` (keeps CocoaPods off the machine entirely); export `CI=1` on every invocation (the only thing that disables the telemetry POST to `api.ionicjs.com`, which otherwise defaults to on and sends verbatim error strings and arguments); keep `--ignore-scripts`; commit `Package.resolved`; re-run the gate on any lockfile change; never `cap run`. Note `--ignore-scripts` protects nothing today — 0 of 104 packages declare an install script — the exposure is at CLI runtime, not install. See security review.
CocoaPods (`pod`)	CI only — pre-installed on the `macos-26` runner. NOT approved for local install on any developer machine (reviewed and rejected 2026-09-11)	Dependency manager Capacitor's generated iOS project requires	2026-09-10; local install reviewed 2026-09-11 → REJECTED	Only ever installs Capacitor's own local-path pods, pinned by `shell/package-lock.json`. No remote pod spec is fetched — but note that condition is currently unenforced, and `--repo-update` is not the control it looks like (a CDN source resolves a remote pod without any spec-repo refresh). First run does contact `cdn.cocoapods.org` for `CocoaPods-version.yml` and creates `~/.cocoapods`. The tool is clean — zero advisories against the gem, all disclosed incidents server-side in trunk — the rejection is about where, not what: `prepare-ios.sh` executes third-party JS via `npx cap add/sync ios` before `pod` runs, so approving it on a machine holding SSH keys and credentials approves that too. See security review.

NuGet Packages (.NET)¶

Mac Mini claude user, delegated dashecorp/rig-conductor build/test only (reviewed 2026-09-24, APPROVE-WITH-CONDITIONS, review). Covers the restore closure of these direct references as on rig-conductor main 7bf0595: Marten 8.37.0, Marten.AspNetCore 8.37.0, JasperFx 1.29.1, Microsoft.AspNetCore.OpenApi 10.0.3, StackExchange.Redis 2.12.14, YamlDotNet 16.2.1, coverlet.collector 6.0.4 + 8.0.1, Microsoft.AspNetCore.Mvc.Testing 10.0.5, Microsoft.NET.Test.Sdk 17.14.1, Testcontainers.PostgreSql 4.11.0, xunit 2.9.3, xunit.runner.visualstudio 3.1.4, NSubstitute 5.3.0. All are nuget.org repository-signed; no package runs Exec, downloads, or inline code tasks at build time (build-time code: the Microsoft OpenApi source generator, xunit.analyzers, the Microsoft-signed Mvc.Testing task). Tracked advisories: Marten GHSA-rfx3-98h7-v3xp (rig-conductor#2177), Microsoft.OpenApi 2.0.0 GHSA-v5pm-xwqc-g5wc, SSH.NET 2025.1.0 GHSA-q939-rpr3-3284 / GHSA-mggc-4xg6-vcxf (rig-conductor#2178; ScpClient-only, not reachable from Testcontainers 4.11.0). Restore from nuget.org only via the review's dedicated NuGet.Config (<clear/> + source mapping) and NUGET_PACKAGES; signature verification is not usable on macOS. A new or bumped direct reference is not covered: update this note first.

Homebrew (macOS only)¶

Package	Install	Purpose	Reviewed	Notes
xcodegen	`brew install xcodegen`	Generate .xcodeproj from project.yml	Pre-existing	All iOS apps depend on this
displayplacer	`brew install displayplacer`	Display resolution management	2026-03-15	Used for VNC display debugging
gh	`brew install gh`	GitHub CLI	Pre-existing	Core tool for all agents
codex (OpenAI Codex CLI)	Present at `/opt/homebrew/bin/codex` on the operator MacBook (who installed it is not recorded); signed in with ChatGPT	Delegated code work for the orchestrator, only on the operator's instruction	No written security review on file (used 2026-10-20 on the operator's explicit instruction, Stig-Johnny/claude-3#1275)	0.163.0. Run as `codex exec -C <worktree> -s workspace-write` (writes only in the worktree, plus `--add-dir <clone>/.git` to commit), network on only for docs lookups. It never pushes; the orchestrator verifies and publishes. It wrote dashecorp/rig-cockpit-worker#329. Separate from the rig agents' codex-cli inside the rig-agent-runtime image
bw	`brew install bitwarden-cli` (or GitHub release, checksum-verified)	Bitwarden personal-vault CLI	2026-05-25 (Pre-existing — Ops-E v0 uses since 2026-05-23)	Bitwarden Inc., open-source. Reads personal-vault items via `bw login --apikey` + `bw unlock --passwordenv BW_PASSWORD --raw`. Used by `encrypt-secret.yml`, `rotate-discord-webhook-url.yml`, `delete-discord-webhook.yml` in dashecorp/rig-gitops. Requires master password in `BW_PASSWORD` GHA secret — see decisions/2026-05-25-ops-e-v0-bws-vs-rotation.md for the BWS-migration option that obviates that requirement.
bws	`brew install bws` (or GitHub release, checksum-verified)	Bitwarden Secrets Manager CLI	2026-05-25	Separate product from `bw` personal-vault CLI; same vendor (Bitwarden Inc.), same open-source Rust client base. Authenticates via `BWS_ACCESS_TOKEN` env var only — no master password required. Stateless per invocation. Used by the Ops-E v0 BWS migration path (see decisions/2026-05-25-ops-e-v0-bws-vs-rotation.md).
asciinema	`brew install asciinema`	Record a live terminal session (e.g. a real Claude Code run) to a local `.cast`	2026-06-06	v3.2.0, homebrew/core (SHA256-verified bottle). Rust; no browser/server in the record path. No telemetry; `upload`/`auth` are explicit opt-in and MUST NOT be used. Never type/show secrets during capture — `.cast` is plaintext JSON, grep it for secrets before sharing. Pin version; re-review before bump. See security review.
agg	`brew install agg`	Render an asciinema `.cast` to an animated GIF (then `ffmpeg` → MP4)	2026-06-06	v1.9.0, homebrew/core (SHA256-verified bottle). Rust; local-only rendering (gifski/resvg). No network when rendering from a local `.cast` (the only supported use); `agg --input <URL>` has an outbound fetch path — do not use it. No telemetry. Pin version; re-review before bump. See security review.
ffmpeg	`brew install ffmpeg`	Audio/video transcode, mux, and compositing — TTS narration muxing, asciinema+agg → MP4, 4:5/Ken-Burns video assembly	Pre-existing (2026-06-07 documented)	Long-standing dependency of the `/dashecorp-video` and `/run-the-docs` pipelines (the final encoder for asciinema+agg recordings). Install from homebrew-core only; pin the reviewed version (8.1.1) and re-review before a major bump.
vhs	`brew install vhs`	Scripted synthetic terminal demos (`.tape` → GIF/MP4/WebM)	2026-06-06 (APPROVE-WITH-CONDITIONS)	MIT, homebrew/core. HIGH-RISK: `.tape` files execute arbitrary shell; go-rod auto-downloads a ~600 MB Chromium from Google/NPM/Playwright CDNs. Author tapes in-house only; pre-stage/pin Chromium + block CDN egress; keep the default sandbox (never `VHS_NO_SANDBOX`); never `--publish`/`VHS_PUBLISH`; never `vhs serve`. Not for recording live sessions — use asciinema+agg. See security review.
dotnet	`brew install dotnet`, Mac Mini `claude` user only, for delegated `dashecorp/rig-conductor` build/test	.NET 10 SDK (source-built; includes ASP.NET Core 10.0.12 shared framework)	2026-09-24 (APPROVE-WITH-CONDITIONS)	10.0.401 only, arm64_tahoe bottle `6dfc193bf00817200f19683c7993e7ce5b96240842aac662456b702323f9da7f`; `brew update` once, check version + hash, then `brew pin dotnet`. Telemetry is off by default in this source build but still compiled in. Every invocation, including the first, sources the review's env file: `DOTNET_CLI_TELEMETRY_OPTOUT=1`, `DOTNET_NOLOGO=1`, `DOTNET_GENERATE_ASPNET_CERTIFICATE=false` (otherwise first run imports a dev-cert private key into the login keychain with `-A`), `DOTNET_ADD_GLOBAL_TOOLS_TO_PATH=false`, `DOTNET_CLI_WORKLOAD_UPDATE_NOTIFY_DISABLE=1`. No `dev-certs --trust`, `workload install`, `tool install`. See security review.
brotli, icu4c@78, openssl@3, ca-certificates	pulled by `brew install dotnet`, same scope	dotnet runtime dependencies	2026-09-24 (APPROVE-WITH-CONDITIONS)	brotli 1.2.0 (`71ffd30c…7601f`), icu4c@78 78.3 (`0476be29…e4fb5`), openssl@3 3.6.4 (`8c7dab98…028b9`; the 3.6.1/3.6.2 on the host predate the 2026-08-25 fixes), ca-certificates 2026-08-13 (`all` bottle `37f5c141…3d010`; post-install reads only the System keychain). openssl 3.6 EOL 2026-11-01: the move to 3.5 LTS is a version change to re-check. Same review.
colima	`brew upgrade colima` (pre-installed 0.10.1 since 2026-03-19, unreviewed), Mac Mini `claude` user only, delegated rig-conductor build/test	Docker VM for Testcontainers e2e tests	2026-09-24 (APPROVE-WITH-CONDITIONS)	0.10.3 only (bottle `a9dfd1fa0a4aee62fef75974f39f174e4da774f7ba495c43dd0bcc23633381b8`), pinned. An empty or omitted `mounts` mounts `~` WRITABLE: use only profile `rigbuild` from the review's colima.yaml, started with `--mount none` (`mounts: null`), and never start the `default` profile. `docker.ip: 127.0.0.1` + `host_binding_ipv4: 127.0.0.1` (colima otherwise forwards published ports to host `0.0.0.0`), `lsof` check after a run. Every run goes through `~/bin/with-rigbuild.sh` (a lock, and it fails closed unless `DOCKER_HOST` answers as `colima-rigbuild` and nothing answers on `/var/run/docker.sock`; review amendment 2026-10-20). 2 CPU / 2 GiB (3 with parallel tests, as configured) / 20 GiB, vz, no Rosetta/binfmt/k8s, `sshConfig: false`, `autoActivate: false`. Isolated `DOCKER_CONFIG`, PATH without `~/.orbstack/bin`. No `brew services`, no `colima update`. VM image: colima-core v0.10.4 `ubuntu-24.04-minimal-cloudimg-arm64-docker.raw.gz`, sha512 `32242674…40abbd` compiled into 0.10.3 (unsigned; integrity only). See review.
lima	`brew upgrade lima` (pre-installed 2.1.0), same scope	colima's VM backend (only runtime dep)	2026-09-24 (APPROVE-WITH-CONDITIONS)	2.2.0 only (bottle `9dfb60d4c7d0c6721eee679ab188d8b502ad61d1063c9914b830b66ce795b4a4`), pinned. vz driver only; `lima-additional-guestagents`/qemu not approved. No `start-at-login`. Same review.
docker (CLI formula)	`brew upgrade docker` (pre-installed 29.3.0), same scope. Not Docker Desktop	Docker client for the colima `rigbuild` VM	2026-09-24 (APPROVE-WITH-CONDITIONS)	29.8.1 only (bottle `40d9396a0e2a2edfea5c69137b0d5722f2049da0a218a3e1b1c94080c5f1b3f0`), pinned. No telemetry by default (OTel only with a context `otel` key or `DOCKER_CLI_OTEL_EXPORTER_OTLP_ENDPOINT`). Auto-detects an `osxkeychain` helper on PATH, so run with `DOCKER_CONFIG=~/.docker-rigbuild` (`{}`) and `~/.orbstack/bin` off PATH. `docker-compose`, `docker-completion` and OrbStack on this host are not covered. Same review.
age	`brew install age`, operator MacBook only, attended, for the rig backups' key generation and restore drills. Not agents, not scripts	Generate the dedicated backup key pair; decrypt backups in restore drills	2026-10-03 (APPROVE-WITH-CONDITIONS), delta review 1.2.1 → 1.3.2	1.3.2 only: arm64_tahoe bottle `48bbd797cd00ab11ec496717f51205ba07f4f7fdc7c8a939c5f4b7b6a11d5287` (the same file for sequoia and sonoma), built from `v1.3.2.tar.gz` sha256 `b07c28c6c4bdafa272073a310b75bc22c49da8904585a89c30e5ca4233e63843`. Pinning: `brew update`; `brew info --json=v2 age` must show 1.3.2 and that bottle; then `HOMEBREW_VERIFY_ATTESTATIONS=1 brew install age`, `brew pin age`, and `age --version` must print `v1.3.2`. Any other version is a new review. Key: `age-keygen -o <offline medium>`, without `-pq` (the backup image's Debian age 1.2.1 cannot encrypt to `age1pq1…`), and never on the internal disk. Restore: only `age -d -i <key> -o <scratch> <file>`. Compare the object's SHA-256 with the job's report first, accept only exit status 0, and delete the plaintext afterwards. Never `-j`, a plugin identity, `AGE_PASSPHRASE*` or `AGEDEBUG`. The formula also installs `age-plugin-batchpass` and `age-inspect`; the plugin runs only when named, so never name it. No network code; the one exec site is plugins only. See security review §11.
sops	`brew upgrade sops`, operator MacBook only, attended, encrypt only. The 3.12.2 installed there is not approved: upgrade it. Not agents	Encrypt Kubernetes Secrets to rig-gitops' age recipient	2026-10-03 (APPROVE-WITH-CONDITIONS)	3.13.3 only: arm64_tahoe bottle `baeff34ec84e339c8b1e3d930e53243a417c897b73773c47f73d68db43c5448a` (the same file for sequoia and sonoma; arm64_golden_gate `23c1c93aee914c3b6aa7431f7f8fcd58ddea579e0588bbd4844750cd7de98b8d`), built from `v3.13.3.tar.gz` sha256 `49811c5ed80f6b4d4e98cef98e3f7378406aa692fd773dfb72ad1b4dfb940448`. Pinning: `brew update`; `brew info --json=v2 sops` must show 3.13.3 and that bottle; then `HOMEBREW_VERIFY_ATTESTATIONS=1 brew upgrade sops`, `brew pin sops`, and `sops --disable-version-check --version` must print `sops 3.13.3`. 3.12.2 encrypts the same way, but it is not the reviewed artifact and three advisories fixed in 3.13.0/3.13.2 affect it. Use: `sops encrypt` from the rig-gitops root (prefer stdin with `--filename-override` over `--in-place`), and the matched creation rule must be age-only. A KMS recipient in `.sops.yaml` (credential-automation step P4) would make sops call GCP KMS with the operator's gcloud credentials, so that needs a new review first. No `SOPS_KEYSERVICE`, `SOPS_ENABLE_LOCAL_KEYSERVICE=false`, key env vars (`SOPS_KMS_ARN`, `SOPS_GCP_KMS_IDS`, …) or `/etc/sops/audit.yaml`. Set `SOPS_DISABLE_VERSION_CHECK=true`, because `sops --version` otherwise calls GitHub. Never `sops <file>` (that is edit mode), `decrypt`, `exec-*`, `publish` or `keyservice`. See security review §6.

System Tools (pre-installed or OS-provided)¶

Tool	Purpose	Notes
git	Version control	Pre-installed
python3	Scripting, MkDocs	Pre-installed on macOS
node/npm	JavaScript runtime	Pre-installed via Homebrew
docker	Container runtime	On Dell, Pi-E, Volt-E
kubectl	Kubernetes CLI	On Dell
tailscale	Mesh networking	On all hosts
ssh/scp	Remote access	On all hosts
curl/wget	HTTP requests	On all hosts
nfs-kernel-server	NFS server for the agents' home (the `agent-home` disk) on the rig's control plane `invotek-k3s` only (dashecorp/infra#508, #513)	Approved by the operator in chat on 2026-10-01T09:37:23Z. Ubuntu 24.04 `main` (Origin: Ubuntu; source package `nfs-utils`, upstream linux-nfs.org), version 1:2.6.4-3ubuntu5.1, the same source and version as the `nfs-common` client already on every rig node (infra#394). `apt-get install` adds only this package, and unattended security upgrades are on. Installed by `gcp/dashecorp/scripts/agent-home-nfs-setup.sh` in dashecorp/infra; installed on `invotek-k3s` 2026-10-01 10:53Z (exactly `1:2.6.4-3ubuntu5.1`). Scope: `invotek-k3s`; any other host needs its own review
nvme-cli	Read-only NVMe health and power-state diagnostics on the Dell (`dell-stig`) only, to find out why its drive slows down (dashecorp/infra#622, #635)	Approved by the operator in chat on 2026-10-14T12:40:55Z ("yes nvme-cli"). Ubuntu 24.04 `main` (noble-updates): `nvme-cli=2.8-1ubuntu0.1`, `.deb` SHA-256 `2e2bf58e08848870834e31f7c38927bf8a862d875773faa8b4baa1768c09720b` (680,176 bytes); upstream github.com/linux-nvme/nvme-cli. It adds only this package, because its dependencies (`libnvme1t64` 1.8-3ubuntu1, `libjson-c5`, `uuid-runtime`, `pci.ids`) are already on the host. It installs `/usr/sbin/nvme`, an empty `/etc/nvme/discovery.conf`, five NVMe-over-Fabrics systemd units and three udev rules. The install masks every fabrics unit, because the host uses no NVMe over Fabrics. Source check at v2.8 (`nvme.c`, `nvme-print.c`, `fabrics.c`) and libnvme v1.8 (`src/nvme/ioctl.c`): no sockets, HTTP or exec; admin commands go to the kernel through `NVME_IOCTL_ADMIN_CMD`. Read-only admin commands only: `id-ctrl`, `smart-log`, `error-log`, and `get-feature` for `0x0c` (APST) and `0x02` (power state). Never `format`, `sanitize`, `fw-download`/`fw-commit`, `set-feature`, `connect`/`discover` or `mi` commands. Installed by `k8s/dell/k3s` in dashecorp/infra (#635). Installed on `dell-stig` 2026-10-14 13:46Z (exactly `2.8-1ubuntu0.1`, dashecorp/infra#638). infra's own `docs/infrastructure/approved-tools.md` has the same row, with `docs/2026-10-14-nvme-cli-security-review.md`, because Review-E cannot read this private repo. Scope: `dell-stig`; any other host needs its own review
tmux	Terminal multiplexer — drives the interactive `claude` TUI for the `claude-tmux` provider in the rig agent image, and is the recorder backbone of the run-the-docs Claude Code series	Reviewed 2026-06-15. BSD-2-Clause (OpenBSD project, ~20 yrs maintained). `apt install tmux` (Debian `main`) baked into `dashecorp/rig-agent-runtime` `Dockerfile.base`; `brew install tmux` (homebrew-core) on the Mac Mini. Local PTY/terminal multiplexing only (libevent + ncurses) — no network, telemetry, auto-update, or remote-fetch in any code path. Pin via the distro package; re-review before a major bump.
openssl (`/usr/bin/openssl`, LibreSSL 3.3.6, built into macOS 26)	Operator MacBook only, attended: verify a backup run's signature before any restore or drill, and generate the run-signing key once (O2b)	Reviewed 2026-10-03 (APPROVE-WITH-CONDITIONS), delta review, dashecorp/rig-gitops#897. OS-provided on Apple's sealed system volume, so the pin is `/usr/bin/openssl version` = exactly `LibreSSL 3.3.6`; anything else is a new review. Call it by that absolute path, never from `PATH`, with `OPENSSL_CONF=/dev/null`. Verify only as `dgst -sha256 -verify <pin> -signature <sig> <SHA256SUMS>`, trusting the exit status (1 on any failure), with pins from a clean rig-conductor checkout at origin/main. Key generation: `umask 077`, `ecparam -name prime256v1 -genkey -noout -out` straight to the offline medium, then a sign/verify round trip, because `ecparam` and `pkey` exit 0 even when the write fails. Signatures from Debian's openssl 3.5.7 verify here (strict DER, the same SPKI). LibreSSL 3.3 gets no upstream fixes now, only Apple's; no published advisory touches ECDSA verify. See security review.

GitHub Actions (SHA-pinned)¶

Action	SHA	Version	Purpose
actions/checkout	`de0fac2e4500dabe0009e67214ff5f5447ce83dd`	v6	Checkout repo
actions/setup-python	`a309ff8b426b58ec0e2a45f0f869d46889d02405`	v6	Python setup
actions/setup-node	`53b83947a5a98c8d113130e565377fae1a50d02f`	v6	Node.js setup
actions/github-script	`ed597411d8f924073f98dfc5c65a23a2325f34cd`	v8	GitHub API scripting
googleapis/release-please-action	`c3fc4de07084f75a2b61a5b933069bda6edf3d5c`	v4	Release management
cloudflare/wrangler-action	`da0e0dfe58b7a431659754fdf3f186c529afbe65`	v3	CF deployments

GitHub Release Binaries (SHA-256-pinned, in workflows)¶

A binary a workflow downloads from a project's GitHub release. Release assets can be replaced unless the release is immutable, so the approval is the hash: the workflow holds it and checks it with sha256sum --check --strict. A hash that stops matching fails the job, and that is a new review, never a hash update.

Binary	Asset and SHA-256	Scope	Reviewed	Notes
sops	`sops-v3.13.3.linux.amd64` from `getsops/sops` release v3.13.3, `e5bec3346a873ae91d871550f3e698c1aad962aff462a080e40f25fde17fef6b`	credential-ops workflow, encrypt only (dashecorp/rig-gitops#896): GitHub-hosted `ubuntu-latest`, behind the `credential-ops` environment	2026-10-03 (APPROVE-WITH-CONDITIONS), on the operator's "go" in claude-3#1027	CNCF Sandbox. GoReleaser on GitHub Actions, with keyless-cosign-signed checksums and SLSA3 provenance. Encrypting to an X25519 age recipient makes no network call, runs no process and writes only to stdout. The version check (`--version` only), the KMS/Vault/Azure/GCP backends, a remote keyservice, `/etc/sops/audit.yaml` (Postgres), age plugins, `SOPS_AGE_KEY_CMD`, gpg, `$EDITOR` and `exec-` are all off that path. Conditions:* call it by absolute path as `env -i PATH=/usr/bin:/bin sops --config .sops.yaml encrypt --age "$AGE_RECIPIENT" --filename-override <target>`, with the plaintext on stdin. The recipient matches `^age1[02-9ac-hj-np-z]{58}$` and appears in `.sops.yaml`. Fail if `.sops.yaml` mentions `azure_keyvault` (parsed at config load, where it dials Azure) or if `/etc/sops/audit.yaml` exists. No `--keyservice` and no `--verbose`. Output gate: `sops filestatus` prints `{"encrypted":true}` and the token is absent. Mask derived values with `::add-mask::`. cosign is not run per job; verify the checksums bundle once, at pin time (not yet done, since cosign is unapproved). Any other version, or decrypt/edit, is a new review. See security review.
structurizr	Homebrew bottle `structurizr--2026.09.19.x86_64_linux.bottle.tar.gz` from `ghcr.io/v2/homebrew/core/structurizr/blobs/sha256:<hash>` (the anonymous `Bearer QQ==` brew uses), `9f280a928fd68d8a03a5662b6ea5212654f12b011e3377cafdca07ccb34bc30a`; the WAR inside, `libexec/structurizr-2026.09.19.war`, is `32ef78192642fb89da5d1452af350333dd899a03861b05e4aa59c8191f7d95ca`	CI only, two repos, GitHub-hosted `ubuntu-latest`, `validate` and `export -format mermaid\\|static`: dashecorp/rig-docs on `public/diagrams/rig-c4.dsl`, and dashecorp/dashe-tags-gone-crazy on `docs/architecture/c4/workspace.dsl` (owner, 2026-10-08, operator-inbox#35)	2026-10-07 (APPROVE-WITH-CONDITIONS); the operator approved the review on 2026-10-07 and extended it to dashe-tags-gone-crazy CI on 2026-10-08	The vendor's own WAR (download.structurizr.com) and Docker image carry 59 closed-source classes and have no checksum, signature or provenance. So the Homebrew build of the public tag is pinned instead; its SLSA provenance from homebrew-core's `publish-commit-bottles.yml` was verified. Single maintainer (bus factor 1). No restricted mode: `validate`/`export` run `!script` (Groovy, Kotlin, JRuby), `!plugin`, file and URL `!include`, `workspace extends <url>` and `${ENV}`, and fetch any URL (the allowlist is hard-coded to `.`). Conditions:* the DSL gate (no `!` except `!identifiers flat\\|hierarchical`; no `${`, `://`, line-start `image`/`theme`/`themes`/`workspace extends`). Copy the DSL into a fresh directory as `workspace.dsl`. Run `env -i PATH=/usr/bin:/bin HOME=<tmp> "$JAVA_HOME_21_X64/bin/java" -Djava.io.tmpdir=<tmp> -Dhttp.proxyHost=127.0.0.1 -Dhttp.proxyPort=9 -Dhttps.proxyHost=127.0.0.1 -Dhttps.proxyPort=9 -jar <war> validate\\|export -workspace <copy> [-format mermaid\\|static -output <fresh dir>]`. The job has `permissions: contents: read`, names no GitHub environment (dashe-tags-gone-crazy's `media` environment holds an R2 upload key), and the step uses no secrets. The static export embeds the model and the DSL source (base64) and vendors crypto-js 4.1.1. Mermaid labels are raw HTML. They need `securityLevel: 'antiscript'` (keeps HTML, removes scripts), which rig-docs uses since rig-docs#370, not `loose`; no rig-docs page renders the Mermaid export. Never a URL `-workspace`, never `-format png\\|svg\\|<fqcn>`, never any other command. A hash mismatch is a new review. See security review.

Debian Packages (apt, in container images)¶

Debian main packages installed into one of our images. A row covers that image only. The pinned version is part of the approval, and Debian drops superseded versions from the archive, so a pin that stops resolving fails the build. That failure is the signal to re-check: a newer +deb13uN or +bN of the same upstream version is a row update after reading its changelog, and a new upstream version is a new review.

Package	Install	Purpose	Reviewed	Notes
age	`apt-get install --no-install-recommends age=1.2.1-1+b5` (Debian `trixie`), only in the rig backup image (the Dell's off-site backup CronJob, dashecorp/rig-gitops#897)	Encrypt each Postgres dump to the dedicated backup recipient before it leaves the cluster	2026-10-03 (APPROVE-WITH-CONDITIONS), on the operator's conditional approval in rig-gitops#897	No network code. Its only exec is the plugin client (`plugin/client.go:400`), which a valid X25519 recipient never reaches (`cmd/age/parse.go:33-36`), and the image has no plugins. Encrypt only: `age -r "$AGE_RECIPIENT"`, with the recipient checked against `^age1[02-9ac-hj-np-z]{58}$` and its committed value. Never `-R`, `-i`, `-j`, `-p` or `-d` in the cluster. `set -o pipefail`, because a dead `pg_dump` still yields a valid ciphertext. A dedicated backup key, separate from `sops-age`; its private half stays offline and never enters the cluster. A Go package with limited Debian security support: this binary was built on 2025-06-22 with Go 1.24.4 and not rebuilt since, but no later Go fix touches the X25519 path. `age` on the operator's machine (key generation, restore) is not covered. See security review.
jq	`jq=1.7.1-6+deb13u4` with `libjq1` at the same version and `libonig5` (from `trixie-security`, DSA-6416-2), same image only	Build the Discord status message	2026-10-03 (APPROVE-WITH-CONDITIONS)	No exec, socket or `dlopen` in the source, and Debian's patched source was checked too. `@sh` only quotes text, `input_filename` returns a string, and modules are jq source or JSON, never native code. Fixed program literals only, with data passed through `--arg`/`--argjson`. No `-L`, `import`/`include`, `-f`, `--rawfile`, `--slurpfile`, `env` or `$ENV`. `HOME=/nonexistent`, because jq auto-imports `$HOME/.jq` (`linker.c:423-431`). Never `eval` its output. Open in trixie: only CVE-2025-9403, in the test harness. Review.
curl	`curl=8.14.1-2+deb13u5` with `libcurl4t64` at the same version (Debian `trixie`), plus `ca-certificates=20250419`, which the base image purges. Same image only	HTTPS PUT to the R2 bucket (SigV4) and POST to the Discord webhook	2026-10-03 (APPROVE-WITH-CONDITIONS)	trixie has 19 open curl CVEs with no DSA. None is reachable with these flags, so the flags are part of the approval. Every call starts `curl -q --proto =https --proto-redir =https --noproxy '' --globoff --http1.1 --fail-with-body`. Only two destinations: `https://<account-id>.r2.cloudflarestorage.com/<bucket>/<key>` (`--aws-sigv4 aws:amz:auto:s3`, with `Content-MD5`) and the webhook. No URL comes from data. Credentials only in `--config` files from the Secret, because curl blanks argv only after parsing. Never `-k`, `-L`, `-x`, `--netrc`, cookies, `--negotiate`/`--ntlm`/`--digest`, `--engine`, `--proto-default`, `--http3`, `--tls-earlydata`, or `-v`/`--trace*` (they would log the webhook token). Nothing may set `SSLKEYLOGFILE`. Review.
openssl	`openssl=3.5.7-1~deb13u3 libssl3t64=3.5.7-1~deb13u3` (Debian `trixie-security`, DSA-6531-1). Already in the image, so this pins it and adds no package. Same image only	Sign each backup run's `SHA256SUMS` (ECDSA P-256, P6) and check that the signing key is pinned; the existing `Content-MD5`	2026-10-03 (APPROVE-WITH-CONDITIONS), delta review	`.deb` SHA-256 `43a9cbcf2a8a0e1f0a1c3f5a33ee1f56b269690e7a2129f2b2d0582e789589d7` and `ff16bc048bcd7d1b256094450b79c77947d8e76fe2a24bd99b91021d591fa074`. No socket, no process. No advisory in 3.5.7 to 3.5.9 touches ECDSA on P-256, SHA-256 or key loading. Only `dgst -sha256 -sign`, `pkey -pubout` (pin check), `dgst -sha256 -verify` (self-check) and `dgst -md5 -binary`. `OPENSSL_CONF=/dev/null`, because a config file can load provider shared objects. Never `-engine`, `-provider`, `-passin`, `-rand` or a network subcommand. The signing key stays in Secret `rig-backup-signing`, read-only in the two backup jobs only. Check the signature against the pinned keys before uploading it*: `dgst -sign -out` exits 0 even when the write fails. See security review.

Container Images (digest-pinned)¶

A container image is third-party code like any package. Approval covers one digest for one use. The tag is recorded for readability only: Docker Hub tags can be re-pushed.

Image	Digest	Scope	Review / approval
`docker.io/valkey/valkey:9.0.6` (Debian trixie)	index `sha256:63346cb24a61221e76bdf41acce99b3968a9fa83d8122144deab45394b27b4f2` (same on `ghcr.io/valkey-io/valkey`)	The rig's Valkey store (`rig-conductor` namespace), replacing Bitnami	Reviewed 2026-09-23, approved by the operator 2026-09-23 (rig-gitops#819). Published by the Valkey project's own CI (LF Projects), not a Docker Official Image. The source tarball is SHA-256 verified, and the build has no network calls beyond GitHub and Debian apt. Unsigned, no provenance, mutable tag (re-pushed 2026-09-21), so it is pinned by digest, and every re-pin must match GHCR and diff `valkey-container/9.0/debian`. Conditions: uid/gid/fsGroup 1001, non-root, drop ALL, RuntimeDefault seccomp; `args:` not `command:`; explicit config with `appendonly yes` and FLUSHDB/FLUSHALL/`RESTORE` disabled.
`docker.io/library/postgres:16-alpine` (PostgreSQL 16.15, Alpine 3.24.2)	index `sha256:721873c34ceb9f8d8fc265984940dc982404c105f19ad51be9fdc5970a6080ea`; linux/arm64 `sha256:2c942175a1255a9abe0366e48c1b401d9f50f835b04dfea13f111609b5530df7`	Mac Mini `claude` user, delegated rig-conductor build/test: the Testcontainers Postgres in ConductorE.Api.Tests, inside the colima `rigbuild` VM only	Reviewed 2026-09-24 (APPROVE-WITH-CONDITIONS) — review, claude-3#944. Docker Official Image (`docker-library/postgres` `16/alpine3.24`), SBOM + SLSA provenance attestations. Pull by index digest, `docker tag` it `postgres:16-alpine` locally (Testcontainers' default `PullPolicy.Missing` then never resolves the floating tag), verify `RepoDigests` before each run. `testcontainers/ryuk` is rejected for this use (privileged by default, Docker socket, unauthenticated port): run with `TESTCONTAINERS_RYUK_DISABLED=true` and a `label=org.testcontainers=true` sweep before and after.
`docker.io/pgvector/pgvector:0.8.7-pg16-trixie` (PostgreSQL 16.15, pgvector 0.8.7, Debian trixie)	index `sha256:40d828eda66737aaacb934387a337babf1455ebd56e9bdd13fc08e211257c972`; linux/amd64 `sha256:a127fec3c5922c6e7f538ed623bb4c5fe771c580d8a0e81073c958fb32b41870`	Base of the rig backup image only (the Dell's off-site backup CronJob, dashecorp/rig-gitops#897). Not the server image `postgres-0` runs	Reviewed 2026-10-03 (APPROVE-WITH-CONDITIONS), review. Not a Docker Official Image, and pushed from outside public CI: pgvector's only workflow runs tests. But its first 14 content layers are, blob for blob, the whole Docker Official `postgres:16.15-trixie` amd64 image (`sha256:a85daf0d…a61c`). The only addition is pgvector's `Dockerfile` at `v0.8.7`: `ADD …pgvector.git#v0.8.7` and one 4.4 MB build layer. Conditions: `FROM` by index digest; a re-pin repeats that layer check and keeps `PG_MAJOR` equal to the server's (16); re-pin at least monthly and on any DSA for a package in the image; never run the server or `docker-entrypoint.sh` (the backup script is the entrypoint); dumps `-Fc`, restored only with `pg_restore`; non-root uid 999, read-only rootfs, no service-account token, egress only to Postgres, DNS and Cloudflare 443. The base purges `ca-certificates`, so the curl row's `ca-certificates` is required. Fallback: the official `postgres:16.x-trixie`.
`docker.io/library/node:24.21.0-trixie-slim` (Node 24.21.0 LTS, Debian trixie)	index `sha256:173f125896c3b47ddf056734c7ea789d04595a6a08769a8f78e0df642781fb66`; linux/amd64 `sha256:c83040f7e24bacea68e58a0b96a484ba430bf24abb2973eab7ba4701144b7b63`	Base of the TAGS GONE CRAZY P1 playtest container only (`tgc-play` namespace, GCP k3s; dashecorp/dashe-tags-gone-crazy#24). Deleted after the P1 gate	Reviewed 2026-10-07 (APPROVE-WITH-CONDITIONS), approved by the operator 2026-10-07 (in chat, recorded by claude-4; operator-inbox#23): review, claude-3#1054. Docker Official Image (`nodejs/docker-node` `24/trixie-slim` @ `93a7bafc`). The Node tarball is GPG- and SHA-256-verified at build. SPDX SBOM and SLSA provenance attestations are present. Conditions: `FROM` by index digest; delete npm, npx, corepack and yarn; `CMD ["node","proto/web/server.ts"]` with no entrypoint script; uid 1000, non-root, drop ALL, RuntimeDefault seccomp, read-only rootfs except `/data`, no service-account token; reachable only via cloudflared behind an Access app; no `TGC_JEV=live` without a separate OK. Re-pin on Node 24 security releases, on Debian advisories and at least monthly, with the provenance re-checked. `node:24-slim` (bookworm) is not used: Debian 12 has been in LTS only since 2026-06-11.

Pinned is not reviewed. On 2026-09-23 every third-party image that ran on a floating tag in the GCP rig's manifests was digest-pinned (rig-gitops#820, #822, rig-conductor#2330, #2332), and a CI gate now rejects floating tags in rig-gitops apps/ and clusters/ (rig-gitops#826). The rig-conductor repo's deploy/ (google/cloud-sdk, postgres-0's pgvector) has no such gate yet (rig-conductor#2339). The Flux controllers and coredns/coredns:1.11.3 stay on upstream semver release tags, which the gate accepts by policy (immutable by convention only). The gate does not see images a chart renders from its own defaults (KEDA, Weave GitOps) or the k3s-bundled rancher/* images; those run on upstream release tags too. The digest-pinned images are cloudflare/cloudflared, envoyproxy/envoy, nginx, alpine, alpine/git, google/cloud-sdk, and pgvector/pgvector (bitnami/valkey left on 2026-09-23 when the rig moved to the reviewed upstream image above). A pin makes each one immutable, but none of them has a recorded review here. They predate this section. Review before re-pinning any of them to a new digest, and add a row when you do. The pgvector/pgvector row above (2026-10-03) is a different digest for a different use, the backup image's base. The pin postgres-0 runs is still unreviewed.

Unity (Mac Mini `post`, TAGS GONE CRAZY only)¶

Reviewed 2026-10-08, APPROVE WITH CONDITIONS, and approved by the owner in chat the same day (dashecorp/operator-inbox#15). Reviews: Hub and Editor (dashecorp/dashe-tags-gone-crazy#99) and agent plugin, CLI and Pipeline (#105). Scope: the Mac Mini M4, macOS user post, under the owner's Unity Personal seat, for dashecorp/dashe-tags-gone-crazy only. Licence risk accepted by the owner: Unity's Terms of Service §17.2(ff) and §26 allow AI agents to operate Unity products only through a Unity-designated gateway with Unity's authorization, which Claude Code does not have; agents drive the Editor only through Unity's own plugin. The Mac Mini is never a Unity build machine: no scheduled or CI-triggered Unity runs, one Editor instance at a time.

Tool	Pin	Install	Conditions
Unity Hub	3.22.2 (never below 3.20.0)	`https://public-cdn.cloud.unity3d.com/hub/prod/3.22.2/UnityHubSetup-3.22.2-arm64.dmg`, SHA-256 `5a2212142c0ee33d4493e710c0aa913853ac9f5120714f279e0dbd624d843eaf` (Homebrew) and the SHA-512 in Unity's `latest-mac.yml`; `codesign --verify --deep --strict` and `spctl` before copying to `/Applications`. Signed by Developer ID Application: Unity Technologies SF (`9QW8UQUTAA`), notarized	Exception (owner, 2026-10-08): the Hub still has both `disable-library-validation` and `allow-dyld-environment-variables`, so a `post` process can inject code into it; never grant the Hub any macOS privacy permission (camera, microphone, contacts, calendars, location, photos, automation), so injection gains nothing. The owner signs in, accepts the terms and answers admin prompts. Analytics, Developer Data, the AI Assistant option and deeplink forwarding to the Editor off. Auto-update on, Production channel. No source-control connection: the Hub can see the GitHub CLI's keychain login and showed it as connected; it was disconnected on 2026-10-08 (safe since Hub 3.20.0, which no longer clears other tools' credentials), and "Clear personal access tokens … on logout" is off. Re-check after any Hub reinstall.
Unity Editor	6000.3.25f1 (`e1dba0a9aba4`) with iOS, Android, Android SDK & NDK Tools and OpenJDK only. Exception (owner, 2026-10-08): Unity-signed (`9QW8UQUTAA`) but not notarized and no hardened runtime; never grant the Editor a macOS privacy permission	Through the Hub (`unityhub://6000.3.25f1/e1dba0a9aba4`)	Unity-registry packages only, pinned, `packages-lock.json` committed; no Asset Store, git-URL, scoped-registry or `com.unity.ai.*` packages without their own review. Editor Analytics off. Move Unity to a separate macOS user before the first third-party Unity package.
Unity CLI	≥ 1.0.0-beta.13 (1.0.0-beta.13 installed 2026-10-08)	The Hub installs it at `~/.unity/bin/unity` and adds that folder to PATH in `~/.zshrc`; update only through the Hub's Tools → Unity CLI (runs `unity upgrade`); never `curl \\| bash`. `codesign` checks before first use (beta.13: Unity Technologies SF `9QW8UQUTAA`, hardened runtime)	Signed out unless the owner decides otherwise. `UNITY_NO_*` telemetry, update-check and cloud variables set. No MCP mode.
Unity agent plugin (`Unity-Technologies/unity-agent-plugin`)	commit `cf6b2da24e424b0a60d560a57f39f676cb6f79f3` (0.1.8-beta)	Project scope only, from a repo-local marketplace entry with a `sha` pin; never `unity setup claude` or a user-scope install	Never edit its files (Unity Companion License §3.2). Restrictions live in the game repo's `.claude/settings.json`. Re-review each SHA bump.
`com.unity.pipeline` (UPM)	0.8.0-exp.1 or later	`Packages/manifest.json` by reviewed PR	Loopback only (check with `lsof`); Allow Browser Clients, request logging and `enableInBuilds` off.

Blender (Mac Mini `post`, TAGS GONE CRAZY only)¶

Reviewed 2026-10-15, APPROVE WITH CONDITIONS, and approved by the owner the same day: in chat with claude-4 (dashecorp/operator-inbox#46), then confirmed to claude-3. Security review (Stig-Johnny/claude-3#1176). Codex and Claude write bpy scripts that build, render and export TAGS GONE CRAZY models, headless, for dashecorp/dashe-tags-gone-crazy only. GPL-3.0-or-later; blender.org states that what you create with Blender is your own, so generated assets are not GPL.

Tool	Pin	Install	Conditions
Blender	5.2.2 LTS (`/Applications/Blender.app`)	Official blender.org macOS arm64 DMG, SHA-256 `dc4125399b8bfefe283cc1624d6cfc7809d1cac20ace51072127eb371f31f210` (matches the official `blender-5.2.2.sha256`); `codesign --verify --deep --strict` and `spctl` before first use. Developer ID Application: Stichting Blender Foundation (`68UA947AUU`), notarized, hardened runtime. Any other build, including a 5.2.x fix release, repeats these checks and updates this row	Headless only, by absolute path: `Blender --background --factory-startup --offline-mode --disable-autoexec --python-exit-code 1 --python <script>`. Never `-y`/`--enable-autoexec`, `--online-mode`, `--python-use-system-env` or the GUI. Open only scripts and files our agents wrote or the game repo holds, never a downloaded `.blend`, `.fbx`, `.obj`, `.glb` or image (Blender's CVEs are mostly crafted-file bugs). Scripts make no network calls and `pip install` nothing into Blender's Python. No add-ons, extensions or Blender MCP bridges without their own review (`blender-mcp` has four 2026 CVEs). Never grant Blender a macOS privacy permission: it is entitled to request camera and microphone, and has library validation off, as Unity Hub does.

Browser Extensions (operator-installed)¶

Extension	Publisher / ID	Version	Where	Status
Claude in Chrome	Anthropic, Chrome Web Store `fcoeoabgfenejglbffodgkkbkcdhcgfn`	1.0.94	Operator MacBook Chrome, profiles `stig` (installed 2026-09-24, so Claude Code can drive the Rig Cockpit), `Claude` and `veriton.io`. Also in the Mac Mini's `post` Chrome, profiles «Your Chrome» and `veriton.io` (versions 1.0.99–1.0.101, seen 2026-10-20), where claude-3 used it at the operator's request to read Upwork job pages, read-only (`/chrome` from the Mac Mini's terminal)	Operator-installed, no written security review on file. The manifest requests `debugger`, `nativeMessaging`, `scripting`, `tabs`, `downloads` and `identity`, which count as high-risk under the CLAUDE.md third-party rule. Agents must not install it anywhere else.

MCP Servers (approved for Claude Code)¶

See mcp-servers.md for the full list.

This was a blanket approval by reference and is being narrowed. "Everything in that file is approved" is not a review — an MCP server runs with the agent's full tool access, which is a larger grant than most npm packages get. The inventory stays usable, but each third-party server needs its own scoped row here. Tracked as an enforcement gap in dependency-security-policy.md. Servers we wrote ourselves are first-party and out of scope for this.

Process: Requesting a New Tool¶

Agent posts to Discord #admin: "Need tool-name for task. Package source: npm/pip/brew. Purpose: why."
Run the mechanical pass first — it is cheap and it is evidence, not opinion:
```
scripts/audit-npm-tree.py <path>/package-lock.json --out /tmp/audit.md   # npm trees
```
It verifies every tarball against the lockfile hash, counts install scripts, checks archive hygiene, maps the capability surface (network / subprocess / eval / credential access) and screens for typosquats — without installing or executing anything.
Then the human pass, which the script cannot do:
Author/maintainer trust (age, maintainer count, publish history, official repo)
Read the call sites the capability table points at — a match is a place to look, not a verdict
Trace reachability before repeating a scanner's severity. A critical CVE in a package you never enter the vulnerable path of is not a critical risk here. Say which it is.
Compare to official alternatives, and ask whether the dependency is needed at all — an alternative backend often already exists in the version you have
Write the verdict to docs/ai-tooling-registry/<category>/ and add the row here via PR
If rejected → find an alternative or build our own
NEVER install an unapproved tool — this is a security boundary

What Agents Must Do¶

Being listed here is not blanket permission. Every row is scoped, and the scope is the approval. Read it.

Before installing or running ANY third-party code:
1. Find the row in this file.
2. Not listed?            -> STOP. Post to #admin. Do not install.
3. Listed? Check the Install column against what you are about to do:
     - the HOST      (a CI runner is not the operator's laptop)
     - the CHANNEL   (brew is not gem is not curl|sh)
     - the VERSION   (a pin is part of the approval)
     - the CONDITIONS in Notes (they are requirements, not trivia)
4. Any of those differ from the approved scope?
                          -> STOP. That is a NEW review, not a covered install.
5. All match?             -> proceed, honouring the conditions.

If you find yourself writing the caveat, that IS the signal to stop. Flagging a gap and then walking through it is worse than not noticing it, because it launders the decision as considered.

This section is written in the negative because the previous version said "Listed? → Install" and that is exactly what went wrong on 2026-09-11: CocoaPods was listed, approved for the macos-26 runner, and an agent read that scope, wrote it down, and started brew install cocoapods on the operator's MacBook anyway. The host was the whole difference — an ephemeral credential-free runner versus a machine holding ten SSH keys, gcloud, gh, Bitwarden state and the Claude OAuth credential. See the CocoaPods review.

Enforcement¶

Prose rules did not hold. These do:

Control	Where	What it catches
`scripts/audit-npm-tree.py`	this repo	Integrity, install scripts, archive hygiene, capability surface, typosquats — without executing anything
`.github/workflows/dependency-review.yml`	this repo	A PR that adds or upgrades an npm package, audited against the PR base. Fails closed: an audit that cannot complete fails the job

Coverage today is npm trees in this repo. The gaps are tracked, not assumed away — see the Enforcement gaps section of the dependency policy.