require a2a pack write prefix support

agent_builder/skills/workspace-artifact-safety/SKILL.md

@@ -77,21 +77,23 @@ async def run_checked(script: str, timeout_s: int = 120) -> dict[str, str | int]
     }
 ```
 
-Commands may write to `/workspace/outputs/...` for stable paths, or to normal
-tool defaults such as `/tmp`, `/root`, or `/app`. The platform sandbox mirrors
-changed files outside `/workspace` into `outputs/rootfs-captures/...`. Do not
-use `asyncio.create_subprocess_exec(...)` for durable outputs. Plain subprocesses
-run inside the agent container, which is not mounted to the caller workspace and
-is not rootfs-captured.
+Commands may write under the grant's `write_prefixes` for stable paths, or to
+normal tool defaults such as `/tmp`, `/root`, or `/app`. The platform sandbox
+mirrors changed files outside `/workspace` into `outputs/rootfs-captures/...`.
+Do not use `asyncio.create_subprocess_exec(...)` for durable outputs. Plain
+subprocesses run inside the agent container, which is not mounted to the caller
+workspace and is not rootfs-captured.
 
 If a nonzero command still produced a usable output, preserve the output and
 include the command failure as a warning instead of discarding the file.
 
 ## Scope Expansion
 
-Only use `ctx.request_scope(...)` when the public `@skill` declares
+Only use `ctx.request_scope(...)`, `ctx.ensure_read(...)`, or
+`ctx.ensure_write(...)` when the public `@skill` declares
 `allow_scope_expansion=True`. Explain the reason in plain language and keep
-the requested read/write patterns narrow.
+the requested read/write patterns narrow. New write prefixes always require
+caller approval.
 
 ```python
 @skill(
@@ -99,10 +101,9 @@ the requested read/write patterns narrow.
     allow_scope_expansion=True,
 )
 async def analyze_folder(ctx: RunContext[NoAuth], folder: str) -> dict[str, str]:
-    await ctx.request_scope(
+    await ctx.ensure_read(
         reason=f"Need to read {folder} to analyze the requested files",
-        read=(f"{folder.rstrip('/')}/**",),
-        mode="read_only",
+        patterns=(f"{folder.rstrip('/')}/**",),
     )
     return {"status": "approved"}
 ```