feat(directives): scavenge sweep 4/5 (tracks + commands + styleguides + todos): 18 batch-4 directives + concurrent worker batches

2026-07-04 02:00:42 -04:00
parent e8d3578f2e
commit 79124774ec
82 changed files with 2430 additions and 0 deletions
@@ -0,0 +1,10 @@
+# ban_appdata_paths
+
+## v1
+
+**Why this iteration:** Lifted from `conductor/tier2/agents/tier2-autonomous.md:127` + `conductor/tier2/commands/tier-2-auto-execute.md:60-62` — the Tier 2 sandbox enforces 3 layers of denial (OpenCode bash rules, OS restricted token + ACLs, git hooks) for AppData and temp-dir API access. The relocations to project-relative paths (2026-06-18) make AppData obsolete; using it now is a leak site.
+**Source:** `conductor/tier2/agents/tier2-autonomous.md:127` + `conductor/tier2/commands/tier-2-auto-execute.md:60-62`
+
+---
+
+**Lifted:** 2026-07-03 scavenge sweep batch 4/5: tracks + commands + styleguides + todos
@@ -0,0 +1,45 @@
+# NEVER use AppData, `$env:TEMP`, `%TEMP%`, or any temp-dir API for any read, write, or shell command — all scratch/state/audit output lives INSIDE the project clone
+
+## What it says
+
+Tier 2 autonomous execution (and any other code running in the sandboxed OpenCode session) MUST keep all scratch, state, audit-output, and intermediate files INSIDE the Tier 2 clone. AppData (`*AppData\\*`, `*AppData\Local\Temp\*`) is OFF-LIMITS. The full list of forbidden literals (matched against the command string by the bash deny rules):
+
+- `*AppData\\*`
+- `*AppData\Local\Temp\*`
+- `*$env:TEMP*`
+- `*$env:TMP*`
+- `*%TEMP%*`
+- `*%TMP%*`
+- `*GetTempPath*`
+- `*gettempdir*`
+- `*mkstemp*`
+
+A violation halts the run at the OS level (Windows restricted token + ACLs) AND at the OpenCode bash-deny layer.
+
+## Why
+
+The Tier 2 sandbox enforces path isolation: filesystem access is restricted to the Tier 2 clone (`C:\projects\manual_slop_tier2\` on Windows). The Windows restricted token blocks reads/writes outside this path at the OS level. AppData is the historical leak site (the pre-2026-06-18 design put scratch files there); the relocations to project-relative paths (`tests/artifacts/tier2_state/<track>/`, `tests/artifacts/tier2_failures/`, `scripts/tier2/artifacts/<track>/`) make the AppData path obsolete and dangerous.
+
+## Default locations for Tier 2 artifacts
+
+| Artifact type | Location |
+|---|---|
+| Failcount state | `tests/artifacts/tier2_state/<track>/state.json` |
+| Failure reports | `tests/artifacts/tier2_failures/` |
+| Throw-away scripts | `scripts/tier2/artifacts/<track-name>/` |
+| Test run logs | `tests/artifacts/tier2_state/<track>/test_run_<phase>_<task>.log` |
+| Audit outputs | `tests/artifacts/tier2_state/<track>/audit_<name>.json` |
+
+## Examples
+
+WRONG (halted by the deny rule):
+
+```bash
+uv run python scripts/audit_exception_handling.py --json > %TEMP%\audit_initial.json
+```
+
+RIGHT:
+
+```bash
+uv run python scripts/audit_exception_handling.py --json > tests/artifacts/tier2_state/audit_initial.json
+```