Executable trust

Unapproved hooks, bin/ executables, and self-defined MCP (registry: false) from dependency packages are parked on ht apply / ht install. Those commands still succeed and print ht approve <pkg>. Text primitives and local .apm/ stay trusted. Apply root stays trusted. Text primitives are never gated. Parking is unchanged (depth > 0 when executables: is on). Root-manifest MCP is depth 0 and is not a new trust path.

Opt-in

The gate is off unless the project declares executables: (even {}) or apm-policy.yml has a non-empty executables: block.

This extends the existing apm-policy.yml document and the apply / install / audit paths — not a second policy engine.

Layers

One noun: executables. Layers:

1. org apm-policy.yml
2. user ~/.harnesstap/config.jsonc
3. project apm.yml

Deny-wins, first-match-wins. Org executables.enforce is accepted but inert (degrades to recommend). bin_deploy folds into executables.deny for bin only.

User grants live under executables.{allow,deny} in ~/.harnesstap/config.jsonc, not ~/.apm/config.json.

Approve and deny

ht approve owner/repo
ht approve --user owner/repo
ht approve --pending
ht approve --all
ht approve --recommended
ht approve --list
ht deny owner/repo
ht deny --user owner/repo
ht policy explain owner/repo
ht policy explain owner/repo --format json

• ht approve / ht deny write project grants by default (apm.yml executables.allow / executables.deny); --user writes ~/.harnesstap/config.jsonc (can only narrow past an org or project deny). Grant keys are owner/repo or owner/repo#version (version-blind in v1).
• ht approve --pending lists packages with unapproved executables; --all approves currently pending; --recommended approves the org executables.recommend set; --list shows effective trust per installed package.
• ht deny writes a deny grant only (no --pending/--list).
• ht policy explain <target> prints the effective decision, deciding layer, and shadowed layers.

Lockfile

When the gate is on, apm.lock.yaml records exec_status per dep: deployed | gated_pending_approval | denied | absent.

CI

ht audit --ci fails required-executable-untrusted for executables.require packages whose executables are untrusted.

See also: Apply, Install, MCP Registry identities, Audit, Lockfile, Command reference, Desktop pending approvals.