II.
FilesystemSafetyInvariant overview
Reference · livefs-safety-invariant:no-writes-outside-workspace
Agent writes confined to workspace overview
Inspect the raw attributes, linked wiki pages, and inbound or outbound graph edges for fs-safety-invariant:no-writes-outside-workspace.
Attributes
displayName
Agent writes confined to workspace
rule
Agent subprocess must never write outside resolved workspace cwd.
scope
agent-session
enforcement
sandbox-policy
rationale
Symphony invariant: orchestrator host filesystem is off-limits.
Outgoing edges
None.
Incoming edges
enforces_invariant1
- agent-runtime-impl:claude-code.runtime@1.x·AgentRuntimeImplClaude Code Runtime (1.x)