[raphaelvigee]

Filling in a config file should not require a shell. template(name, src, out, vars) renders a declared template with declared variables, in-process — inputs and outputs fully declared, no sed pipeline, no quoting rules to get wrong.

One feature, two surfaces

The renderer lives in crates/template so the rule and the tmpl applet are the same code rather than two implementations of one syntax:

• template() — the rule, and the one to reach for. Its inputs are in the cache key.
• tmpl — the applet, for the mid-recipe case, and it covers envsubst.

They land together because splitting them would put a crate in trunk with one caller and review the same rendering semantics twice.

Two constraints the renderer carries deliberately

• No non-deterministic builtins. No now(), no randomness — a template that can render differently from identical inputs is a target that can never be a cache hit.
• TEMPLATE_FORMAT_VERSION in the def hash, so a minijinja upgrade that changes rendering invalidates rather than silently diverging.

vars is hashed from a BTreeMap because it arrives as a HashMap, and hashing it in iteration order would move the def hash on every run.

---

vars take deferred values

vars values are Deferred<String>, so vars = {"image": "${read://infra:registry}/app"} works as in an exec run: the host adds a hashed edge at parse and hands over the producer's bytes at run. The def hash takes the text as written, so plain values hash byte-for-byte as before. ${src://…} is refused at parse (this driver has no sandbox), and vars = None still parses — the usual macro-forwarding shape. Hermeticity board: HERMETIC. Covered by unit tests and two crates/e2e/tests/deferred.rs cases (renders the bytes; re-renders when the value moves, def hash unchanged).

---

The stack

Merge bottom-up, and gh stack sync after each one lands — master is squash-only, so the rebase will conflict and the resolution rule in CLAUDE.md applies.

	PR	What
5	#446	the toolbox on by default, and the host directories off a target's PATH — breaking
4	#440	the template rule and the tmpl applet
3	#453	grep, find, xargs, sed, tar, gzip, zstd
2	#438	the crate, the entry points, the shim directory
1	#451	the runner PATH seam ← base, targets master

#445 (default-on) was folded into #446: the two flips only mean something together. Only #451 builds automatically: since #449 a stacked PR is skipped unless it carries ci/force-ci. Every layer was checked locally on its own after rebasing onto master — fmt, cargo clippy --workspace --all-targets -D warnings, the touched crates' unit tests, and the e2e + engine suites — not just at the top of the stack.

🤖 Generated with Claude Code

https://claude.ai/code/session_0181d7hhbYWXT42Z1KQPM29Q