[tend-agent]

Problem

running-in-ci's Temporary Files section names $TMPDIR as the writable scratch directory but never says /tmp is not one, so a session that writes its own scratch path reaches for the habitual /tmp/... and takes Read-only file system. The checkout it works in is itself under /tmp (prepare_agent_workspace.py clones into a dedicated container there), so the constraint has to name the writable set rather than the /tmp prefix. Nothing in the environment warns it first — /tmp is mode drwxrwxrwt, and only the mount is read-only, because SRT's write allowlist is the agent workspace, the agent home, and the auto-memory directory (sandbox_runtime.mjs). #1192 moved the bundled scripts and recipes off /tmp and #1211 fixed TMPPREFIX; neither covers a path the model writes itself.

The failure is usually one wasted turn, but #1242 records a nightly where the dead write was the backup step of a back-up → revert → test → restore sequence run as one compound command with no set -e: the backup never existed, the restore silently failed, and the reverted file survived in the worktree.

Solution

One clause on the existing sentence, so the constraint arrives with the fact it qualifies: writes land in $TMPDIR and the checkout, and the /tmp container around the checkout does not take them. Plus a sentence naming the compound-command shape that turns the failure from a wasted turn into a bad push.

test_bundled_runner_guidance_has_no_unscoped_tmp_paths bans a bare /tmp anywhere under plugins/tend-ci-runner/, which is why no bundled file could state the constraint. The guard now scans per line and exempts a line that says /tmp is read-only — that line is the rule, not an instance of the failure. Every other mention still fails the test; I confirmed by probing it with a scratch file carrying /tmp/foo.md.

Testing

Prose change; no test covers the skill text. Verified the claim from inside this session's sandbox:

$ ls -ld /tmp
drwxrwxrwt 18 nobody nogroup 4096 Sep 14 08:12 /tmp
$ touch /tmp/probe-tend-1242
touch: cannot touch '/tmp/probe-tend-1242': Read-only file system

uv run pytest passes apart from the two test_refresh_consumers.py cases that need DNS, which the sandbox has none of. pre-commit run --all-files passes, including the three repo: local guards.

Closes #1242 — automated triage

[tend-agent]

The claim as written is false for the session's own working directory, which weakens the paragraph it is meant to strengthen. The sandbox's write allowlist is allowWrite: [agentWorkspace, agentHome, autoMemory] (shared/steps/sandbox_runtime.mjs), and prepare_agent_workspace.py clones TEND_AGENT_WORKSPACE into what its module docstring calls a "dedicated /tmp container" — so the checkout a session edits all run long is itself a /tmp/... path, and it writes fine while its parent container does not. Verified from inside this session: a write to the checkout succeeds, one to the workspace root takes Read-only file system. A session reading "the sandbox mounts /tmp read-only, so a hand-written /tmp/... path fails" hits a counterexample on its first file edit, and the sentence stops being something it can act on.

The suggestion keeps both of the change's points — the token the model habitually reaches for, and the misleading mode — while naming the writable set accurately. It still contains /tmp, so it still depends on the guard exemption in 456d933.