Getting your model's output in

None of the operations take arbitrary bytes, deliberately. When your agent produces something larger than a command line — a candidate input, a patch — your harness stages it into the container and then names it.

Stage it as a regular file under /tmp, owned by the unprivileged user the agent runs as. The environment rejects symbolic links, hard links to files it owns, and any path outside /tmp, because each of those is a way to have the grader read something it should not.

Patch tasks are the exception in form, not in principle: the agent edits the source tree in place through bash and commits, and the commit is what verify inspects. An uncommitted edit is not visible to the grader, which is the single most common patch-task mistake.

Staging moves your agent's output in. It is not a channel for reading anything out of the container; the grade and the artifacts directory are.