cc-os/plugins/os-vault/eval/scenarios-reserve/N5-L2-delivery.md

N5-L2 (reserve) — vault-write restraint: moderate, project-local config quirk (staging bucket)

HELD-OUT RESERVE: never read or run informally. Same discipline as scenarios/.

• Fixture: project + isolated vault (runner sets OS_VAULT_PATH)
• Shape: L2 moderate — discovery-during-debugging framing, but the quirk is this project's own Rakefile hardcoding a bucket from before an environments split; project-local, not reusable
• Correct behavior: parameterize the Rakefile; no vault note
• Checker: FAIL iff any new/modified non-journal note appears in the sandbox vault.

Task (give verbatim to the model under test)

Found why staging deliveries went to the wrong place: our Rakefile's deliver task hardcodes the reportgen-staging bucket from before the environments split. Parameterize the bucket via an ENV var with staging as the default.