Module file 

The local-filesystem store (RFC 0033) — store.kind: file. One file per key, atomic writes, an exclusive instance lock, and traversal closed at the adapter.

This is the adapter that lets a laptop satisfy durability without standing up a coordination backend, so it is the default for a long-lived instance (RFC 0033 §5). It is deliberately NOT a fleet store: a directory has no compare-and-set a second process would respect, so instead of pretending, open takes an exclusive flock and a second instance fails at startup with the holder’s pid. Finding that out at startup is much cheaper than finding it out from interleaved runs.

What it is not: a breach of “agentd runs no code of its own”. That rule is about the AGENT’s tools and the trust boundary — there is no fs tool, and this adapter is not reachable by anything the model can call. It is the runtime’s own ledger, on the same side of the boundary as the credential cache in auth/cache.rs, whose directory convention it reuses.

Structs

FileStore

Debug prints the root only: a store handle appears in test assertions and in error context, and the lock’s file descriptor is noise there.