Module runtime_dir 

The session’s runtime directory: every file the runtime writes for its own use, outside the workdir the capsule’s commands can write.

~/.murmur/sessions/                 0700
└── <session-id>/                   0700, created at staging, removed when the session ends
    ├── .lock                       flock held from creation until removal
    ├── runtime/                    $MURMUR_RUNTIME_DIR: MURMUR.md, task.md, murmur.yaml,
    │   │                           tools/, plans/ — readable by commands, never writable
    │   └── delegations/            <delegation-id>.txt: the whole answer of a sub-capsule
    │                               whose answer was cut in the report its parent was handed
    ├── sealed-etc/                 the composed root's /etc/passwd and /etc/group
    └── harness/<run-id>/           a `transport: process` harness's files

On the Full tier a Landlock rule grants runtime/ read-only to every command; on the Sealed tier it is also bound read-only into the composed root at its own path. sealed-etc/ and harness/ get no rule, so no command opens them. [crate::containment::runtime_dir_report] says per tier what holds.

Every runtime read and write beneath the directory goes through a crate::workdir_fs::WorkdirRoot sharing the session’s refusal latch, so a link is refused there exactly as it is in the workdir.

Structs

RuntimeDir

One session’s runtime directory, from its creation at staging to its removal when the value is dropped.

RuntimeDirPlacement

Where the runtime directory and the records directory lie relative to a workdir, decided without creating anything.

RuntimeDirRoots

The three held directories beneath one session’s <session-id>/, and the session’s records directory beside them, each sharing the session’s refusal latch: every directory outside the workdir a command is told of or a sealed root is composed from. Cheap to clone.

Constants

DELEGATIONS_SUBDIR

The directory beneath runtime/ holding <delegation-id>.txt, the whole answer of each sub-capsule whose answer was cut at [crate::delegation_plane::MAX_OUTPUT_BYTES] in what the parent was handed. Written only by [crate::delegation::hand_over_answer], and only for a cut answer.

HARNESS_SUBDIR

The directory beneath <session-id>/ holding one <run-id>/ per transport: process harness run.

LOCK_FILE_NAME

The lock file in <session-id>/, flocked by the live session.

RUNTIME_DIR_ENV

The variable naming the runtime directory in every shell command’s, plan shell step’s, murmur:process program’s and transport: process harness’s environment. Runtime-owned like HOME: no manifest, override or host value can set it.

RUNTIME_DIR_GUEST_PATH

The guest path a runtime: tool with no capabilities.filesystem.scope finds the runtime directory at, preopened read-only beside its ".".

RUNTIME_SUBDIR

The directory beneath <session-id>/ that $MURMUR_RUNTIME_DIR names.

SEALED_ETC_SUBDIR

The directory beneath <session-id>/ holding the composed root’s synthetic /etc files.

SESSIONS_DIR_NAME

~/.murmur/sessions, relative to the murmur home.

SESSION_ID_PLACEHOLDER

The literal segment a reported path carries in place of a real session id, in --explain-scope and session_start.effective_grants.

STALE_AFTER

How old a session directory nobody holds must be before staging removes it: long enough to cover the instant between a directory’s creation and its lock.

Functions

runtime_dir_inside_warning

The W-SEC-033 line for a runtime or records directory inside the workdir, without a prefix: shared by stage_session and mur doctor so the two cannot word it differently.

runtime_dir_placement

Where the runtime directory and the records directory would lie relative to workdir, the session’s workdir root. Creates nothing.

sessions_dir

The sessions/ directory every runtime directory on this host is created in, ~/.murmur/sessions, decided without creating anything. A HOME that cannot hold it is refused, never replaced by another location.