Module workdir_writes 

What the runtime itself writes inside the capsule’s workdir, declared rather than discovered.

A consumer for whom the workdir is the deliverable — a benchmark harness diffing it to score a patch, a git-worktree workspace whose diff becomes a pull request — has to answer “what did the capsule change?”. Without a declaration that answer is a hand-maintained exclusion list that goes stale the moment the runtime gains an entry, and silently: nothing tells the consumer the set grew. [runtime_writes] is that declaration, carried by crate::containment::ScopeReport and therefore printed by mur run --explain-scope and recorded verbatim in trace.jsonl’s session_start.effective_grants.

Path form

Every RuntimeWriteReport::path is relative to the accessible workdir — the directory a --workdir run hands the capsule, and the directory a consumer diffs — and carries the literal segment <session-id> (SESSION_ID_PLACEHOLDER) wherever a real session id appears. mur run --explain-scope answers before a session exists, so there is no id to substitute; keeping the placeholder in both renderings is what lets a consumer capture the declaration ahead of a run and compare it byte for byte with the one the trace carries. session_start.session_id supplies the substitution.

Without --workdir there is no separate deliverable: the accessible workdir is the session directory, under <manifest dir>/workdir/<session id>/, and the runtime owns all of it. The declaration describes the --workdir layout in both cases, so that it is one fixed answer a consumer can compare against rather than two.

What is filtered and what is labelled

RuntimeWriteCondition names when a path is present. Only RuntimeWriteCondition::Sealed filters the set: the enforcement tier is host state the report has already probed, so a report that omitted the sealed rows on a host that will use them — or listed them on a host that cannot — would be describing a different launch than the one it is about. Every other condition turns on what the session does after it starts, which no report can know, so those rows are always declared and the condition says when the path appears.

What is not here

Every file the runtime writes for its own use — MURMUR.md, task.md, the manifest copy, tools/ and plans/ — is written into the session’s runtime directory, ~/.murmur/sessions/<session-id>/runtime, never into the workdir, and the synthetic /etc files and a transport: process harness’s files go beside it. Every record it writes about the session — trace.jsonl, blobs/, logs/bootstrap.log, logs/otel.log, logs/hook-<name>.log, a delegated child’s completion.json and the hooks/ a records-granted hook writes in — goes into the session’s records directory, ~/.murmur/records/<workdir root>/<session-id>. None of them is a runtime write inside the workdir, so none is declared here; crate::runtime_dir and crate::records_dir describe them.

Adding an entry

Add a row to [DECLARED_WRITES]. every_workdir_write_is_declared_or_exempted reads the runtime’s own source text and fails until a new workdir.join(...) is either declared here or listed in that test’s exempt tables with a written reason. A file the runtime writes for its own use goes through the runtime directory’s root instead and is declared in that test’s RUNTIME_DIR_WRITES; a record about the session goes through the records directory’s root, records_root, and is declared in its RECORDS_DIR_WRITES.

Structs

RuntimeWriteReport

One path the runtime writes inside the capsule’s workdir.

Enums

RuntimeWriteCondition

When a declared entry is present on disk.

RuntimeWriteKind

Whether a declared entry is a single file or a directory whose whole subtree the runtime owns.

RuntimeWriteScope

Which of the two workdirs an entry lands in.

Constants

SESSION_ID_PLACEHOLDER

The literal segment a declared path carries in place of a real session id.

Functions

render_runtime_writes

The Runtime writes block of mur run --explain-scope’s human rendering.