Build Lane

An agent that may run cargo still cannot compile anything, because compiling means running binaries that do not exist yet. mur agent perm allow-spawn-dir grants exec on a directory the toolchain fills — so an agent can build, test, and verify its own work.

mur agent perm allow-spawn-dir rustsmith /path/to/repo/target
mur agent restart rustsmith          # entitlements load at startup
mur agent perm deny-spawn-dir rustsmith /path/to/repo/target

Why the binary allowlist isn't enough

processes.spawn.allowed names binaries — git, cargo, rustc. That works for a toolchain whose executables sit at fixed paths, and it is the right tool when one exists:

mur agent perm allow-spawn rustsmith /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang

It cannot work for what a build produces. cargo compiles build scripts, proc-macro shims and test executables and then runs them, at paths like:

target/debug/build/libc-ddba4ad6d232e641/build-script-build

Those paths do not exist when you write the entitlement, and the hash changes on every dependency bump. Without a lane the build stops at:

could not execute process `target/debug/build/libc-<hash>/build-script-build`
Caused by: Operation not permitted (os error 1)

What the grant means

Everything under the directory becomes executable by that agent. Grant a build-output directory — not a source tree, not a home directory.

The grant is refused if the path is missing, is not a directory, or is too broad to be a lane: /, /usr, /opt, your home directory, and a bare /Volumes/<mount> are rejected. Those are not build lanes; they are every binary underneath them.

Filesystem and network entitlements still bound whatever runs. An agent with the lane and network.outbound: restricted can compile and test, and still cannot reach the internet:

mur agent perm show rustsmith        # read the whole picture before granting

Profile shape

processes:
  spawn:
    mode: allowlist
    allowed:
      - git
      - cargo
      - rustc
    allowed_dirs:
      - /path/to/repo/target

Notes

• Entitlements are read when the runtime starts. mur agent restart <name> after any change — mur agent status reports stale runtime until you do.
• A MUR older than the release that introduced allowed_dirs does not know the field, and will drop it if it rewrites the profile. Upgrade before granting.
• On macOS the system exec paths (/bin, /usr/bin, /usr/lib) are already exempt under allowlist mode. A toolchain installed elsewhere — Homebrew, an Xcode on an external volume — is not, and needs an explicit allow-spawn entry.