resolved by the application. The caller names a repository the operator may

  read as `owner/name`; a filesystem path from a caller never reaches an SCV.

  The workspace is removed on every terminal path, including the one that runs

  when the worker died.

  when the worker died. In staging and production that workspace must sit on a

  durable path: a container's `System.tmp_dir!()` is the writable image layer

  on the boot disk, which the node already shares with Docker and the import

  workspace, so a repository cloned there is how a node runs out of room while

  its durable volume idles. Configuration names the root, and a node refuses

  to boot with an SCV lane enabled and a clone root under `/tmp`.

- **No job may deploy one.** `scv.deploy` is a turn authority only. Job

  authorities never include it, so neither a deep-work job, a delegation, a

  coding job, nor an SCV can start another SCV.

    file_root:

      optional_text.("OPENAGENTS_SCV_CODEX_FILE_ROOT") ||

        Application.fetch_env!(:openagents, :scv_codex)[:file_root],

    temporary_root: System.tmp_dir!(),

    temporary_root:

      optional_text.("OPENAGENTS_SCV_TEMPORARY_ROOT") ||

        Application.fetch_env!(:openagents, :scv_codex)[:temporary_root],

    client_options: []

  ]

| `OPENAGENTS_SCV_DEPLOY_OPENCODE_BIN` | Absolute path to the pinned OpenCode executable; the release image uses `/usr/local/bin/opencode` |

| `OPENAGENTS_SCV_DEPLOY_OPENCODE_API_KEY` | Optional OpenCode gateway key; the default model runs without one |

| `OPENAGENTS_SCV_DEPLOY_OUTPUT_ROOT` | Durable directory for run artifacts; must not be under `/tmp` |

| `OPENAGENTS_SCV_TEMPORARY_ROOT` | Durable directory for SCV repository clones; must not be under `/tmp` when an SCV lane is enabled in staging or production |

The compiled defaults cap concurrency at two simultaneous SCVs, the wall clock

at 15 minutes, and captured output at 16 MB. The lane runs read-only against a

      features.scv_deploy and not valid_scv_deploy?(Map.get(settings, :scv_deploy)) ->

        error(:scv_deploy, "requires an admitted model, bounds, and output root")

      # An SCV clones the repository before it runs, and that clone is the

      # largest thing the lane writes. `System.tmp_dir!()` inside a container

      # is the writable image layer on the boot disk, which the node already

      # shares with Docker and the import workspace; a repository landing

      # there is how a node runs out of room while its durable volume idles.

      environment in [:staging, :production] and

        (features.scv_deploy or Map.get(settings, :scv_codex, [])[:enabled] == true) and

          not durable_path?(keyword_value(Map.get(settings, :scv_codex), :temporary_root)) ->

        error(:scv_temporary_root, "must be durable when an SCV lane is enabled")

      features.forge_deploy and not features.forge ->

        error(:forge_deploy_lane_enabled, "requires the forge")

    end

  end

  test "an SCV lane refuses a clone root on the container layer" do

    # Gate 14 admits the lane; the clone root is what decides whether the

    # repository lands on the durable volume or on the boot disk.

    settings =

      staging_settings()

      |> Map.put(:staging_gate, 14)

      |> Map.put(:build_revision, String.duplicate("a", 40))

      |> Map.put(:image_digest, "sha256:" <> String.duplicate("b", 64))

      |> put_nested(:work, :enabled, true)

      |> Map.put(:work_workers_enabled, true)

      |> put_nested(:scv_deploy, :enabled, true)

    assert {:error, %{setting: :scv_temporary_root}} =

             settings

             |> put_nested(:scv_codex, :temporary_root, "/tmp")

             |> RuntimeConfig.validate()

    assert {:error, %{setting: :scv_temporary_root}} =

             settings

             |> put_nested(:scv_codex, :temporary_root, "/tmp/openagents-scv")

             |> RuntimeConfig.validate()

    assert {:ok, config} =

             settings

             |> put_nested(:scv_codex, :temporary_root, "/var/lib/openagents/workspace/scv")

             |> RuntimeConfig.validate()

    assert RuntimeConfig.feature_enabled?(config, :scv_deploy)

  end

  defp staging_settings do

    current = Map.new(Application.get_all_env(:openagents))