Module workdir_writes 

What the runtime itself writes inside the capsule’s work folder, declared rather than discovered.

A consumer for whom the work folder is the deliverable — a benchmark harness diffing it to score a patch, a git-worktree workspace whose diff becomes a pull request — has to answer “what did the capsule change?”. Without a declaration that answer is a hand-maintained exclusion list that goes stale the moment the runtime gains an entry, and silently: nothing tells the consumer the set grew. [runtime_writes] is that declaration, carried by crate::containment::ScopeReport and therefore printed by mur run --explain-scope and recorded verbatim in trace.jsonl’s session_start.effective_grants.

Path form

Every RuntimeWriteReport::path is relative to the work folder: the --workdir directory, or <manifest dir>/workdir/<session id>/ for a launch without one. The runtime creates nothing else in it, so the declaration is the same fixed answer for both.

What is labelled

RuntimeWriteCondition names when a path is present. Each turns on what the capsule does after it starts — a peer handle the agent redeems, a script capsule’s own write to its . — which no report can know, so every row is always declared, whatever the tier, and the condition says when the path appears. Both are written only at the capsule’s own request.

What is not here

Every file the runtime writes for its own use — MURMUR.md, task.md, the manifest copy, tools/ and plans/ — is written into the session’s runtime directory, ~/.murmur/sessions/<session-id>/runtime, and the synthetic /etc files and a transport: process harness’s files go beside it. Everything else it writes about or for the session goes into the session’s records directory, ~/.murmur/records/<workdir root>/<session-id>: trace.jsonl, blobs/, logs/bootstrap.log, logs/otel.log, logs/hook-<name>.log, a shell command’s full-output log (logs/shell-<ms>.log for a truncated foreground command, logs/<work-id>.log for a demoted one), a delegated child’s completion.json, the hooks/ a records-granted hook writes in, an agent’s out/result.txt, out/result_<task-id>.txt and out/compaction-summaries.jsonl, the commands’ tmp/ and home/, and children/<capsule>-<16 hex>/, each delegated child’s work folder. None of them is a runtime write inside the work folder, so none is declared here; crate::runtime_dir, crate::records_dir and crate::temp_dir describe them.

Adding an entry

A file the runtime writes for its own use goes through the runtime directory’s root and is declared in the test module’s RUNTIME_DIR_WRITES; anything else it writes goes through the records directory’s root, records_root, and is declared in its RECORDS_DIR_WRITES. every_workdir_write_is_declared_or_exempted reads the runtime’s own source text and fails until a new write is declared in one of those tables, in [DECLARED_WRITES] or in an exempt table with a written reason. A row in [DECLARED_WRITES] is a path the runtime writes into the operator’s folder, which needs a reason the capsule asked for it.

Structs

RuntimeWriteReport

One path the runtime writes inside the capsule’s work folder.

Enums

RuntimeWriteCondition

When a declared entry is present on disk.

RuntimeWriteKind

Whether a declared entry is a single file or a directory whose whole subtree the runtime owns.

Functions

render_runtime_writes

The Runtime writes block of mur run --explain-scope’s human rendering.