only root maintains a manifest