# ban_appdata_paths

## v1

**Why this iteration:** Lifted from `conductor/tier2/agents/tier2-autonomous.md:127` + `conductor/tier2/commands/tier-2-auto-execute.md:60-62` — the Tier 2 sandbox enforces 3 layers of denial (OpenCode bash rules, OS restricted token + ACLs, git hooks) for AppData and temp-dir API access. The relocations to project-relative paths (2026-06-18) make AppData obsolete; using it now is a leak site.
**Source:** `conductor/tier2/agents/tier2-autonomous.md:127` + `conductor/tier2/commands/tier-2-auto-execute.md:60-62`

---

**Lifted:** 2026-07-03 scavenge sweep batch 4/5: tracks + commands + styleguides + todos