Summary

• remove Daytona ownership/mode calls from the persistent FUSE-backed workspace path
• retain the separate workspace-materialization record, R2 checksum repair, bounded file-plane verification, and application-level write/delete guards
• publish the runtime manifest directly through the toolbox file plane without a shell visibility dependency
• document the actual enforcement boundary instead of claiming portable FUSE permissions

Production finding

The deployed permissions implementation returned Daytona HTTP 403 while repairing a deliberately removed workspace cache file. That failure occurred before model access and the same call failed again during cleanup. The mounted volume cannot use the provider permissions endpoint as a reliable ownership boundary, so allowing it to fail the user run is incorrect.

Verification

• pnpm turbo lint typecheck build — 76/76 tasks passed on Node 24.18.0
• affected architecture boundary check — passed, 113 modules / 210 dependencies
• affected Knip workspaces — passed
• git diff --check — passed
• exactly one Drizzle migration remains; no database changes

Acceptance after merge

Repeat the same destructive cache-only test: remove uploads/README.md, verify exact R2 checksum recovery before the agent reads it, verify the runtime manifest exists, and ensure a following unchanged run does not rematerialize the file.