Supply-Chain

A repo config that runs code on open is twenty years old — tasks.json, npm postinstall, git hooks. We built the countermeasures too: Workspace Trust, git not shipping hooks on clone, direnv re-blocking on any change. The AI editors regressed on all of it, then added the new part: the config now writes itself from untrusted input, executes before any classifier or prompt gets a vote, and lands with your account’s access to everything you’ve authenticated. Closes with an operator’s appendix: how to lock it down, and where the file hides. Part three of a series, on the device.

When npx skills add ships an agent capability the same way npm install ships a library, a large part of governance stops looking novel and starts looking like supply chain. The muscle to handle this exists. The OS just started cooperating. The missing pieces are a real capability manifest and stateful execution policy — and someone needs to ship them.