@@ -23,7 +23,7 @@ configured Git signing and verification. Run from that source checkout:
 
 ```bash
 cd /absolute/path/to/prepared-source-worktree
-xmd run /absolute/path/to/workflow/examples/adversarial-implementation/run.md \
+xmd run --allow-absolute /absolute/path/to/workflow/examples/adversarial-implementation/run.md \
   --props-task /absolute/path/to/task.json \
   --include /absolute/path/to/workflow/examples/adversarial-implementation/components --raw
 ```
@@ -33,6 +33,10 @@ complete CLI with `xmd run /absolute/path/to/workflow/examples/adversarial-imple
 The task has no mode, phase, full flag or initialization override. `phase.md`
 and `continue.md` below serve separate assignments and existing records.
 
+The workflow enters the prepared checkout and artifact directory through absolute
+`Dir` paths. Enable `--allow-absolute` for these runs; the flag retains existing
+read/write restrictions.
+
 ## Prepare scope and impact
 
 All four closed scope groups are required. Their evidence arrays name nonempty,
@@ -178,7 +182,7 @@ files whose contents enter this prompt; artifacts remain references. A retained
 session uses `initialize: false`. Set it to true only for the role's first call.
 
 ```bash
-deno task xmd run examples/adversarial-implementation/phase.md \
+deno task xmd run --allow-absolute examples/adversarial-implementation/phase.md \
   --props-request /absolute/path/to/request.json \
   --include examples/adversarial-implementation/components --raw
 ```
@@ -214,7 +218,7 @@ To advance a saved `Ticket.Run` or `Ticket.Continue` record, pass that complete
 record rather than reconstructing its assignment or artifact paths:
 
 ```bash
-deno task xmd run examples/adversarial-implementation/continue.md \
+deno task xmd run --allow-absolute examples/adversarial-implementation/continue.md \
   --props-record /absolute/path/to/ticket-record.json --props-steps 1 \
   --include examples/adversarial-implementation/components --raw
 ```
@@ -346,11 +350,12 @@ health and required CI as merge gates; review acceptance waives neither.
 ## Test without paid agents
 
 ```bash
-deno task xmd test examples/adversarial-implementation/tests/Workflow.test.md \
-  --include examples/adversarial-implementation/tests/components \
-  --include examples/adversarial-implementation/components
+deno task test packages/cli/tests/adversarial-implementation.test.ts
 ```
 
+The launcher wraps each Markdown suite in `<Testing>` and explicitly enables
+absolute host paths for its temporary checkouts and artifacts.
+
 Only the role boundaries are replaced. These journeys use real signed scratch
 Git repositories, committed shell consumers, focused command failures, the
 production Markdown routing and the existing feedback verifier. The fake role
 
@@ -5,7 +5,7 @@ pwd -P
 ```bash exec as="commandSetting"
 printf '%s' "$XMD_EXAMPLE_COMMAND"
 ```
-<Let as="runner" value={commandSetting.stdout || "deno run --allow-all '" + root.replaceAll("'","'\"'\"'") + "/packages/cli/src/deno.ts' run"} />
+<Let as="runner" value={commandSetting.stdout || "deno run --allow-all '" + root.replaceAll("'","'\"'\"'") + "/packages/cli/src/deno.ts' run --allow-absolute"} />
 <Let as="assessment" value={{mechanical:false,architecture:false,acceptance:true,risk:null,reason:"Inspect the saved test evidence.",evidence:["intent.md"]}} />
 
 <Test name="the phase entry carries source and selected documents and needs no SHA correction" timeout="60s">
 
@@ -5,7 +5,7 @@ pwd -P
 ```bash exec as="commandSetting"
 printf '%s' "$XMD_EXAMPLE_COMMAND"
 ```
-<Let as="runner" value={commandSetting.stdout || "deno run --allow-all '" + root.replaceAll("'","'\"'\"'") + "/packages/cli/src/deno.ts' run"} />
+<Let as="runner" value={commandSetting.stdout || "deno run --allow-all '" + root.replaceAll("'","'\"'\"'") + "/packages/cli/src/deno.ts' run --allow-absolute"} />
 
 <Test name="G1 G2 G3 G8 G9 normal launch preserves actual ordinary owners and captured evidence" timeout="90s">
 <Each in={[
 
@@ -5,7 +5,7 @@ pwd -P
 ```bash exec as="commandSetting"
 printf '%s' "$XMD_EXAMPLE_COMMAND"
 ```
-<Let as="runner" value={commandSetting.stdout || "deno run --allow-all '" + suiteRoot.replaceAll("'","'\"'\"'") + "/packages/cli/src/deno.ts' run"} />
+<Let as="runner" value={commandSetting.stdout || "deno run --allow-all '" + suiteRoot.replaceAll("'","'\"'\"'") + "/packages/cli/src/deno.ts' run --allow-absolute"} />
 
 <Let as="assessment" value={{mechanical:false,architecture:false,acceptance:true,risk:null,reason:"Bounded test migration.",evidence:["/fixture/intent.md"]}} />
 
 
@@ -88,7 +88,7 @@ import type {
   RootDocumentSource,
 } from "@executablemd/core";
 import { useAcpxProvider } from "@executablemd/acp";
-import { command as hostCommand, cwd } from "@executablemd/runtime";
+import { command as hostCommand, cwd, Permissions } from "@executablemd/runtime";
 import { runReplProgram } from "./repl/program.ts";
 import { decodeLocation } from "./repl/route.ts";
 import { renderAgentOptions, renderAgentOptionsJson, scanAgentArgs } from "./agent-options.ts";
@@ -250,7 +250,20 @@ const agentFields = {
   },
 };
 
+const absoluteField = {
+  description: "allow absolute host Dir paths within existing filesystem restrictions",
+  ...field(z.boolean(), field.default(false)),
+};
+
+function useAbsolutePermission(allowed: boolean): Operation<void> {
+  return Permissions.around(
+    { files: ([operation], next) => (operation === "absolute" ? allowed : next(operation)) },
+    allowed ? { at: "min" } : undefined,
+  );
+}
+
 const executionFields = {
+  allowAbsolute: absoluteField,
   include: {
     description: "component search directory",
     ...field(z.array(z.string()), field.default(["components", "."]), field.array()),
@@ -326,6 +339,7 @@ const REPL_DESCRIPTION = "Run and reconstruct one XMD entry in an interactive te
  * their entries is not the same choice as who their entries talk to.
  */
 const replConfig = object({
+  allowAbsolute: absoluteField,
   attach: {
     description: "attach one interactive UI to this exact live XMD child",
     ...field(z.string().optional()),
@@ -637,8 +651,10 @@ const REPL_HELP = [
   "  Close/Stop. At narrow sizes the surface bar offers Sessions, Entries and",
   "  Sidekick; only the selected outlet is mounted.",
   "",
-  "  --mount SOURCE:TARGET adds an external directory at a required document path.",
-  "  Repeat it: --mount /work/manuals:/reference --mount /work/fixtures:/fixtures.",
+  "  --allow-absolute permits absolute host Dir paths, subject to write and enclosing restrictions.",
+  "  It is off by default. File, File.Delete and Glob operands remain relative.",
+  "  --mount SOURCE:TARGET maps a directory; it grants no filesystem permission.",
+  "  Example: xmd repl --allow-absolute --mount /work/manuals:/reference.",
   "  --include <directory> and --include=<directory> select component directories.",
   "  Repeat them in search order; explicit values replace the default list [components, .].",
   "  Relative directories resolve from the invocation working directory.",
@@ -715,8 +731,13 @@ export const REPL_VALUES: readonly string[] = [
   "--attach",
 ];
 
-/** The three REPL switches, which carry none. */
-const REPL_SWITCHES: readonly string[] = ["--approve-all", "--approve-reads", "--deny-all"];
+/** The REPL switches, which carry no value. */
+const REPL_SWITCHES: readonly string[] = [
+  "--approve-all",
+  "--approve-reads",
+  "--deny-all",
+  "--allow-absolute",
+];
 
 export function replGrammarError(
   args: readonly string[],
@@ -2908,6 +2929,7 @@ function* dispatch(
       }
       announceSecretDetection(config.secretDetection);
       const result = yield* scoped(function* (): Operation<Result<void>> {
+        yield* useAbsolutePermission(config.allowAbsolute);
         // `<Elicit>` reaches a person through the browser form, and `xmd run`
         // is the command a person is sitting in front of. Composed here, in the
         // scope this profile assembles around its own document, because that is
@@ -3082,6 +3104,7 @@ function* dispatch(
       if (replHost.select !== undefined) {
         yield* replHost.select();
       }
+      yield* useAbsolutePermission(command.config.allowAbsolute);
       // The Sidekick's own agent selection travels with it, as the name this
       // line carried and nothing more: the profile settles the fallback, and
       // whether anybody answers to that name is the first explicit message's
 
@@ -145,14 +145,15 @@ remain local to their response; the later response does not inherit `code`.
 
 An entry can ask a selected checkout four questions. Read their exact forms
 with `<REPL.Syntax names={["Git.Files", "Git.Changes", "Git.Diff", "Git.File"]} />`
-first. Enter the explicitly known checkout path before asking Git; the workspace
-is not a hidden route back to the project. Replace `/known/project` below with
-the actual known checkout path:
+first. Enter the selected checkout before asking Git; the workspace is not a
+hidden route back to the project. Acquire the repository as shown below when it
+is not already available in the workspace. Replace `RELATIVE_CHECKOUT` below
+with its observed path relative to the current working directory:
 
 ````xmd
 <Let as="code" select="code">
 ```xmd
-<Dir path="/known/project">
+<Dir path="RELATIVE_CHECKOUT">
 <Git.Files prefix="packages/core/" limit={5} as="files" />
 <Json value={files.paths} />
 </Dir>
@@ -189,7 +190,13 @@ locator and creation base below with the selected repository and resolved commit
 Follow the receipt's read instruction and inspect the actual outcome and checkout
 binding. An entry can print a refusal; status alone proves no acquisition.
 Derive a relative checkout path from the returned absolute path and the workspace
-reported by `<REPL.Environment />`. Replace `RELATIVE_CHECKOUT` below with that
+reported by `<REPL.Environment />`. A later authored absolute Dir needs
+`--allow-absolute` and effective write permission; paired Repository/Worktree
+placement grants no such permission. Use the contained relative address when
+absolute is denied. An approved non-repository asset can target
+`RELATIVE_CHECKOUT/inputs/<filename>` beneath that same session workspace; derive
+that destination from the returned facts. A host repository outside the session
+root is unsupported by import. Replace `RELATIVE_CHECKOUT` below with that
 observed address, preserving the rest of this later response:
 
 ````xmd
 
@@ -14,6 +14,18 @@ answer.
   session's workspace, beside its journals. A manually submitted entry starts
   in the invocation's project directory. Read `<REPL.Environment />` for your
   current cwd; do not infer a project path from the workspace path.
+- Resolve relative paths against the current working directory. For example,
+  `inputs/sales.json` names a file beneath that directory. Do not add a leading
+  slash or reinterpret an absolute path as relative to the workspace.
+- Use relative paths for ordinary file and command work. Host absolute Dir
+  selection requires the person to invoke `xmd repl --allow-absolute` and the
+  effective filesystem policy to permit both absolute and write. A mount grants
+  neither: new mapped absolute ensures need that opt-in too. File, File.Delete
+  and Glob operands remain relative even when absolute directory access is allowed.
+  When you intentionally need an external non-repository file, request approval
+  to import it with `<REPL.ImportAsset />`, then use its returned relative path.
+  Import remains available with absolute denied when effective read and write
+  allow it. Its individual approval grants no subsequent absolute access.
 - Write session components under `components/`, copied inputs under `inputs/`,
   and generated files at an appropriate workspace-relative path. These files
   survive reopening; another session has its own directory.
@@ -46,16 +58,25 @@ answer.
   A directory selects `**/*.test.md` recursively and retains configured-first
   component lookup. Tests have effects and use the command's ordinary permissions.
   Read `<Guide.Entries />` for the create, test, fix and reuse sequence.
-- A nested `<Dir>` selects another known, authorized directory for its content;
-  later siblings return to the workspace. To copy project input, enter its
-  explicitly known project path, capture the read there, then write the copy
-  after leaving Dir. Ask for the project path if you do not know it.
+- To change the working directory for part of a document, use a nested `<Dir>`
+  with a known, authorized relative path. Paths inside it resolve from that
+  directory; later siblings return to the enclosing directory. A context change
+  grants no permission. `<REPL.ImportAsset>` always copies into the session
+  workspace, even when a response changes its working directory.
 - Reopening restores acknowledged results, not file snapshots. A retained read
   answers with its old text; a retained write does not replace an external edit.
   Work performed before its acknowledgement may repeat after interruption.
 - This chapter teaches you how to *interpret* host facts. It states none of
   them, because a fact written into teaching text is a fact that goes stale.
   Ask for the current ones with `<REPL.Environment />`.
+- Read `current response policy` as the effective XMD file read/write/absolute
+  policy for this response. Read `submitted-entry start policy (session scope;
+  entry content may narrow it)` as the policy observed in the owner that starts
+  submitted entries. It does not describe arbitrary nested entry content.
+  `approved import` states eligibility under current response read/write plus
+  separate per-file user approval, independent of absolute; eligibility is not
+  source/destination validation or approval. These facts grant no native tools
+  or component admission.
 - Treat what that read returns as the facts at the moment you asked. It is a
   snapshot retained with your operation, not a cache you can rely on later.
 - What it does not report, you do not know. An absent fact is an explicit
@@ -98,6 +119,17 @@ read. After Import succeeds, feedback gives `inputs/mock ü.html`. A later
 <File path="inputs/mock ü.html" />
 ```
 
+The same imported file can be read inside an explicit relative directory
+context. Here `mock ü.html` resolves from `inputs/`; after `Dir` ends, the
+enclosing working directory is restored:
+
+```xmd
+<Dir path="inputs">
+<File path="mock ü.html" as="mock" />
+<Output>{mock}</Output>
+</Dir>
+```
+
 ## Common mistake
 
 Writing an entry against a path, platform or capability you assumed rather than
 
@@ -49,7 +49,8 @@ import { createMountPolicy } from "../../mount-files.ts";
 import type { Operation, Result } from "effection";
 import { isAbsolute, join, relative, resolve } from "node:path";
 import { realpath } from "node:fs/promises";
-import { until } from "effection";
+import { Err, until } from "effection";
+import { filesFailure, Permissions } from "@executablemd/runtime";
 import {
   localRecordName,
   recordedLocalOperation,
@@ -143,6 +144,21 @@ function* routed(
     return yield* recordedLocalOperation({ operation, request, perform });
   }
 
+  if (
+    operation === "dir-ensure" &&
+    isAbsolute(request.path) &&
+    (!(yield* Permissions.operations.files("write")) ||
+      !(yield* Permissions.operations.files("absolute")))
+  ) {
+    return Err(
+      filesFailure({
+        operation: "ensure-directory",
+        phase: "resolution",
+        reason: "permission-denied",
+      }),
+    );
+  }
+
   const retain = (coverage: import("../../mount-records.ts").MountCoverage) =>
     authored === undefined || mounts === undefined
       ? recordedLocalOperation({ operation, request, perform })
 
@@ -79,7 +79,7 @@ import type { Operation, Result, Stream, Task } from "effection";
 import { INLINE_SOURCE_PATH, inlineSource, validateDocument } from "@executablemd/core";
 import type { DocumentValidationDiagnostic, Json, PermissionMode } from "@executablemd/core";
 import type { GeneratedSelection } from "@executablemd/core/api";
-import { API } from "@executablemd/runtime";
+import { API, Permissions } from "@executablemd/runtime";
 import { executeInstalled } from "@executablemd/core/host";
 import { useGeneratedFallback } from "../evaluation-profile.ts";
 import type {
@@ -320,6 +320,12 @@ interface OwnedRootRead {
   read(): Operation<Result<Readonly<Record<string, Json>>>>;
 }
 
+export interface ReplFilePolicy {
+  readonly read: boolean;
+  readonly write: boolean;
+  readonly absolute: boolean;
+}
+
 /** One execution as the application reads it. */
 export interface ReplSession {
   /** The opaque identifier this execution's history is named by. */
@@ -428,6 +434,8 @@ export interface ReplSession {
    * earlier position is reading history; this answers what is true now.
    */
   bindings(): Operation<Result<Readonly<Record<string, Json>>>>;
+  /** Observe the session scope that starts entries; content may narrow it. */
+  filePolicy(): Operation<Result<ReplFilePolicy>>;
   /** Wait for the entry running in this process to finish, and answer how. */
   join(): Operation<Result<unknown>>;
   /**
@@ -1015,6 +1023,21 @@ function* start(
       bindings(): Operation<Result<Readonly<Record<string, Json>>>> {
         return rootData();
       },
+      *filePolicy(): Operation<Result<ReplFilePolicy>> {
+        try {
+          return Ok(
+            yield* owner.run(function* () {
+              return Object.freeze({
+                read: yield* Permissions.operations.files("read"),
+                write: yield* Permissions.operations.files("write"),
+                absolute: yield* Permissions.operations.files("absolute"),
+              });
+            }),
+          );
+        } catch (error) {
+          return Err(error instanceof Error ? error : new Error(String(error)));
+        }
+      },
       join(): Operation<Result<unknown>> {
         return joining();
       },