## identity
uid=1000(<user>) gid=1000(<user>) groups=1000(<user>),127(docker),993(kvm)
## home as the subject sees it
total 12
drwxrwxr-x  4 <user> <user> 4096 Oct 22 14:48 .
drwxr-xr-x  3 root           root             60 Oct 22 14:48 ..
drwxrwxr-x 17 <user> <user> 4096 Oct 22 14:24 .claude
drwxrwxr-x  8 <user> <user> 4096 Feb  2  2026 .nvm
absent      <home>/credentials
absent      <home>/.ssh
absent      <home>/.openclaw
absent      <home>/projects
absent      <home>/kitforge-runs
absent      <home>/.config
absent      <home>/.docker
absent      <home>/.claude.json
absent      /home/readystack
READABLE    /root (directory)
empty       <home>/.claude/CLAUDE.md (regular empty file, 0 bytes readable)
unreadable  <home>/.claude/projects (exists only as an inaccessible mount point)
unreadable  <home>/.claude/sessions (exists only as an inaccessible mount point)
empty       <home>/.claude/history.jsonl (regular empty file, 0 bytes readable)
empty       <home>/.claude/settings.local.json (regular empty file, 0 bytes readable)
unreadable  <home>/.claude/file-history (exists only as an inaccessible mount point)
unreadable  <home>/.claude/paste-cache (exists only as an inaccessible mount point)
unreadable  <home>/.claude/debug (exists only as an inaccessible mount point)
unreadable  <home>/.claude/backups (exists only as an inaccessible mount point)
absent      <harness>/harness
absent      <harness>/private
absent      <harness>/runs/cs-r1-A
absent      /tmp/claude-1000/-home-<user>/b1512325-4914-484e-9db6-51a9d926d428
socket      /var/run/docker.sock (connect test below)
socket      /run/docker.sock (connect test below)
unreadable  /run/containerd (exists only as an inaccessible mount point)
## ~/.claude/.credentials.json (the CLI's own login; must stay readable for the CLI)
readable (expected)
## /tmp as the subject sees it (everything)
/tmp
/tmp/claude-1000
/tmp/claude-1000/-home-<user>
/tmp/claude-1000/-home-<user>/418e4418-dfc2-4e7e-94cf-1a19549a29a8
/tmp/claude-1000/-home-<user>/418e4418-dfc2-4e7e-94cf-1a19549a29a8/scratchpad
<harness>
<harness>/runs
<harness>/runs/cs-probe-A
<harness>/runs/cs-probe-A/work
<harness>/runs/cs-probe-A/work/probe-ok
<harness>/runs/cs-probe-A/work/probe.sh
<harness>/runs/cs-probe-A/tmp
<harness>/runs/cs-probe-A/ssh
<harness>/runs/cs-probe-A/ssh/ssh-wrapper
## writes
read-only /etc/probe-x
read-only /usr/probe-x
WRITABLE <home>/.claude/../probe-x
WRITABLE <harness>/runs/cs-probe-A/work/probe-ok
## sudo
sudo: The "no new privileges" flag is set, which prevents sudo from running as root.
## docker
permission denied while trying to connect to the docker API at unix:///var/run/docker.sock
## ssh
wrapper
