Module temp_dir 

The session’s temporary folder: tmp/ in the session’s records directory, which every shell command, plan shell step and murmur:process program reaches as $TMPDIR, $TMP and $TEMP, and on Linux as a literal /tmp wherever the host can give a command a private mount namespace.

~/.murmur/records/<workdir root>/<session-id>/
└── tmp/        0700, created at staging, writable by the session's commands

One folder per session, never inside the workdir and never shared between sessions. Its bytes count against capabilities.resources.workdir_max_bytes with the workdir’s ([crate::resources::WorkdirGuard]), and trace.retain removes it with the records directory. The runtime itself writes nothing in it.

[temp_mapping] is the one decision of whether a literal /tmp reaches the folder. Staging makes it once, and the session’s crate::containment::ScopeReport and its enforcement both read that answer; mur run --explain-scope and mur doctor make it from the same inputs.

Applied tier	Mount namespace usable	Literal /tmp	TMPDIR
KernelSealed	required by the tier	the composed root binds the folder	/tmp
KernelFull, KernelSeccompOnly	yes	a private mount namespace per command binds it	/tmp
KernelFull	no	not mapped; Landlock refuses it	the folder
KernelSeccompOnly	no	not mapped; the host’s /tmp	the folder
EnvironmentOnly	—	not mapped; the host’s /tmp	the folder
any but KernelSealed, workdir is /tmp	—	not mapped	the folder

Enums

NotMappedReason

Why a session’s /tmp is not mapped onto its temporary folder.

TempMapping

How a literal /tmp reaches the session’s temporary folder, or why it does not.

Constants

SESSION_TEMP_DIR_NAME

The folder’s name beneath the session’s records directory.

TEMP_DIR_ENV

The variables naming the folder in every capsule command’s environment. Runtime-owned: no manifest key, override or host value can set them.

TMP_MAP_FAILURE_PREFIX

What every mapping failure’s message starts with.

TMP_PATH

The path a mapped command reaches the folder at, and the value of TMPDIR there.