Teach builder sandbox rootfs capture

agent_builder/skills/a2apack-agent-authoring/SKILL.md

@@ -130,9 +130,10 @@ If a skill calls `ctx.workspace_backend()` or `ctx.workspace`, declare
 
 If a skill runs code, renderers, converters, or data tools that create
 downloadable files, run them through `await ctx.workspace_shell(...)` or
-`await ctx.workspace_python(...)` and make the command write under
-`/workspace/outputs/...`. In-process subprocesses write inside the agent pod,
-not the caller's mounted workspace.
+`await ctx.workspace_python(...)`. The sandbox persists `/workspace` writes
+directly and mirrors changed files elsewhere in the guest rootfs under
+`outputs/rootfs-captures/...`. In-process subprocesses write inside the agent
+pod, not the caller's mounted or rootfs-captured workspace.
 
 When invoking an inner DeepAgents graph, pass
 `config={"recursion_limit": 500}` to `graph.ainvoke(...)` or

agent_builder/skills/agent-quality-review/SKILL.md

@@ -38,8 +38,9 @@ Check these items:
 - Deterministic tools do exact work; no fake canned-response tools.
 - File-producing skills call `ctx.write_artifact` and `ctx.emit_artifact`.
 - Commands that create downloadable outputs run through `ctx.workspace_shell`
-  or `ctx.workspace_python` and write under `/workspace/outputs/...`. Plain
-  subprocesses in the agent container are not durable workspace writes.
+  or `ctx.workspace_python`; `/workspace` writes persist directly and other
+  changed sandbox rootfs files are mirrored under `outputs/rootfs-captures/...`.
+  Plain subprocesses in the agent container are not durable workspace writes.
 - External calls, secrets, workspace access, pricing, and resources are
   declared on the class.
 

agent_builder/skills/deepagents-implementation-patterns/SKILL.md

@@ -25,7 +25,8 @@ RUNTIME_SKILLS_ROOT = "/outputs/research-agent/.deepagents/skills/"
 
 SYSTEM_PROMPT = """\
 You are a careful research agent. Use project skills for workflow rules and
-write durable files under /workspace/outputs/.
+use workspace-backed tools for durable files. Prefer /workspace/outputs/ for
+stable output paths.
 """
 
 

agent_builder/skills/workspace-artifact-safety/SKILL.md

@@ -29,9 +29,9 @@ backend = ctx.workspace_backend()
 graph = create_deep_agent(model=model, backend=backend, skills=skill_sources or None)
 ```
 
-Write durable model-created files under `/workspace/outputs/...` in prompts.
-When writing through `ctx.workspace`, use workspace-relative paths such as
-`outputs/report.md`.
+For stable, human-readable paths, ask model-created files to use
+`/workspace/outputs/...`. When writing through `ctx.workspace`, use
+workspace-relative paths such as `outputs/report.md`.
 
 ## Artifact Pattern
 
@@ -77,10 +77,12 @@ async def run_checked(script: str, timeout_s: int = 120) -> dict[str, str | int]
     }
 ```
 
-Commands should write user-visible files under `/workspace/outputs/...`; that
-path is backed by the caller's workspace bucket. Do not use
-`asyncio.create_subprocess_exec(...)` for durable outputs. Plain subprocesses
-run inside the agent container, which is not mounted to the caller workspace.
+Commands may write to `/workspace/outputs/...` for stable paths, or to normal
+tool defaults such as `/tmp`, `/root`, or `/app`. The platform sandbox mirrors
+changed files outside `/workspace` into `outputs/rootfs-captures/...`. Do not
+use `asyncio.create_subprocess_exec(...)` for durable outputs. Plain subprocesses
+run inside the agent container, which is not mounted to the caller workspace and
+is not rootfs-captured.
 
 If a nonzero command still produced a usable output, preserve the output and
 include the command failure as a warning instead of discarding the file.