fix: correct workdir detection in artifact Dockerfiles (ccb-repo uses /workspace)

sjarmak · claude · sjarmak · commit a554deaac13d · 2026-02-22T04:50:25.000Z
The regeneration script's detect_workdir() fell back to /app for
Dockerfiles without explicit WORKDIR, but ccb-repo-* base images use
/workspace. This caused 39 Dockerfile.artifact_only files to use
cp -a /app /repo_full which fails because /app doesn't exist.

Fix: detect_workdir() now infers workdir from base image pattern
(ccb-repo-* -&gt; /workspace, sweap-images -&gt; /app). Also adds
fix_workdir_in_existing() to correct already-generated files.

Also adds 3 protonmail stub Dockerfiles that were missing backups.

Co-Authored-By: Claude Opus 4.6 &lt;noreply@anthropic.com&gt;
diff --git a/benchmarks/ccb_build/camel-fix-protocol-feat-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_build/camel-fix-protocol-feat-001/environment/Dockerfile.artifact_only
@@ -5,10 +5,10 @@
 
 FROM ccb-repo-camel-1006f047
 # --- artifact_only: backup full repo for verifier scoring ---
-# Source stays in /app (readable by baseline agent).
+# Source stays in /workspace (readable by baseline agent).
 # MCP agent deletes source files at runtime via agent startup script.
-RUN cp -a /app /repo_full
+RUN cp -a /workspace /repo_full
 RUN chmod 700 /repo_full
-RUN touch /tmp/.artifact_only_mode && echo '/app' > /tmp/.artifact_only_workdir
+RUN touch /tmp/.artifact_only_mode && echo '/workspace' > /tmp/.artifact_only_workdir
 
 ENTRYPOINT []
diff --git a/benchmarks/ccb_build/django-dep-refactor-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_build/django-dep-refactor-001/environment/Dockerfile.artifact_only
@@ -5,10 +5,10 @@
 
 FROM ccb-repo-flipt-3d5a345f
 # --- artifact_only: backup full repo for verifier scoring ---
-# Source stays in /app (readable by baseline agent).
+# Source stays in /workspace (readable by baseline agent).
 # MCP agent deletes source files at runtime via agent startup script.
-RUN cp -a /app /repo_full
+RUN cp -a /workspace /repo_full
 RUN chmod 700 /repo_full
-RUN touch /tmp/.artifact_only_mode && echo '/app' > /tmp/.artifact_only_workdir
+RUN touch /tmp/.artifact_only_mode && echo '/workspace' > /tmp/.artifact_only_workdir
 
 ENTRYPOINT []
diff --git a/benchmarks/ccb_build/flink-pricing-window-feat-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_build/flink-pricing-window-feat-001/environment/Dockerfile.artifact_only
@@ -5,10 +5,10 @@
 
 FROM ccb-repo-flink-0cc95fcc
 # --- artifact_only: backup full repo for verifier scoring ---
-# Source stays in /app (readable by baseline agent).
+# Source stays in /workspace (readable by baseline agent).
 # MCP agent deletes source files at runtime via agent startup script.
-RUN cp -a /app /repo_full
+RUN cp -a /workspace /repo_full
 RUN chmod 700 /repo_full
-RUN touch /tmp/.artifact_only_mode && echo '/app' > /tmp/.artifact_only_workdir
+RUN touch /tmp/.artifact_only_mode && echo '/workspace' > /tmp/.artifact_only_workdir
 
 ENTRYPOINT []
diff --git a/benchmarks/ccb_build/flipt-dep-refactor-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_build/flipt-dep-refactor-001/environment/Dockerfile.artifact_only
@@ -5,10 +5,10 @@
 
 FROM ccb-repo-flipt-3d5a345f
 # --- artifact_only: backup full repo for verifier scoring ---
-# Source stays in /app (readable by baseline agent).
+# Source stays in /workspace (readable by baseline agent).
 # MCP agent deletes source files at runtime via agent startup script.
-RUN cp -a /app /repo_full
+RUN cp -a /workspace /repo_full
 RUN chmod 700 /repo_full
-RUN touch /tmp/.artifact_only_mode && echo '/app' > /tmp/.artifact_only_workdir
+RUN touch /tmp/.artifact_only_mode && echo '/workspace' > /tmp/.artifact_only_workdir
 
 ENTRYPOINT []
diff --git a/benchmarks/ccb_build/k8s-noschedule-taint-feat-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_build/k8s-noschedule-taint-feat-001/environment/Dockerfile.artifact_only
@@ -5,10 +5,10 @@
 
 FROM ccb-repo-k8s-11602f08
 # --- artifact_only: backup full repo for verifier scoring ---
-# Source stays in /app (readable by baseline agent).
+# Source stays in /workspace (readable by baseline agent).
 # MCP agent deletes source files at runtime via agent startup script.
-RUN cp -a /app /repo_full
+RUN cp -a /workspace /repo_full
 RUN chmod 700 /repo_full
-RUN touch /tmp/.artifact_only_mode && echo '/app' > /tmp/.artifact_only_workdir
+RUN touch /tmp/.artifact_only_mode && echo '/workspace' > /tmp/.artifact_only_workdir
 
 ENTRYPOINT []
diff --git a/benchmarks/ccb_build/k8s-score-normalizer-refac-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_build/k8s-score-normalizer-refac-001/environment/Dockerfile.artifact_only
@@ -5,10 +5,10 @@
 
 FROM ccb-repo-k8s-11602f08
 # --- artifact_only: backup full repo for verifier scoring ---
-# Source stays in /app (readable by baseline agent).
+# Source stays in /workspace (readable by baseline agent).
 # MCP agent deletes source files at runtime via agent startup script.
-RUN cp -a /app /repo_full
+RUN cp -a /workspace /repo_full
 RUN chmod 700 /repo_full
-RUN touch /tmp/.artifact_only_mode && echo '/app' > /tmp/.artifact_only_workdir
+RUN touch /tmp/.artifact_only_mode && echo '/workspace' > /tmp/.artifact_only_workdir
 
 ENTRYPOINT []
diff --git a/benchmarks/ccb_build/kafka-batch-accumulator-refac-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_build/kafka-batch-accumulator-refac-001/environment/Dockerfile.artifact_only
@@ -5,10 +5,10 @@
 
 FROM ccb-repo-kafka-0753c489
 # --- artifact_only: backup full repo for verifier scoring ---
-# Source stays in /app (readable by baseline agent).
+# Source stays in /workspace (readable by baseline agent).
 # MCP agent deletes source files at runtime via agent startup script.
-RUN cp -a /app /repo_full
+RUN cp -a /workspace /repo_full
 RUN chmod 700 /repo_full
-RUN touch /tmp/.artifact_only_mode && echo '/app' > /tmp/.artifact_only_workdir
+RUN touch /tmp/.artifact_only_mode && echo '/workspace' > /tmp/.artifact_only_workdir
 
 ENTRYPOINT []
diff --git a/benchmarks/ccb_build/strata-cds-tranche-feat-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_build/strata-cds-tranche-feat-001/environment/Dockerfile.artifact_only
@@ -5,10 +5,10 @@
 
 FROM ccb-repo-strata-66225ca9
 # --- artifact_only: backup full repo for verifier scoring ---
-# Source stays in /app (readable by baseline agent).
+# Source stays in /workspace (readable by baseline agent).
 # MCP agent deletes source files at runtime via agent startup script.
-RUN cp -a /app /repo_full
+RUN cp -a /workspace /repo_full
 RUN chmod 700 /repo_full
-RUN touch /tmp/.artifact_only_mode && echo '/app' > /tmp/.artifact_only_workdir
+RUN touch /tmp/.artifact_only_mode && echo '/workspace' > /tmp/.artifact_only_workdir
 
 ENTRYPOINT []
diff --git a/benchmarks/ccb_build/strata-fx-european-refac-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_build/strata-fx-european-refac-001/environment/Dockerfile.artifact_only
@@ -5,10 +5,10 @@
 
 FROM ccb-repo-strata-66225ca9
 # --- artifact_only: backup full repo for verifier scoring ---
-# Source stays in /app (readable by baseline agent).
+# Source stays in /workspace (readable by baseline agent).
 # MCP agent deletes source files at runtime via agent startup script.
-RUN cp -a /app /repo_full
+RUN cp -a /workspace /repo_full
 RUN chmod 700 /repo_full
-RUN touch /tmp/.artifact_only_mode && echo '/app' > /tmp/.artifact_only_workdir
+RUN touch /tmp/.artifact_only_mode && echo '/workspace' > /tmp/.artifact_only_workdir
 
 ENTRYPOINT []
diff --git a/benchmarks/ccb_design/camel-routing-arch-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_design/camel-routing-arch-001/environment/Dockerfile.artifact_only
@@ -5,10 +5,10 @@
 
 FROM ccb-repo-camel-1006f047
 # --- artifact_only: backup full repo for verifier scoring ---
-# Source stays in /app (readable by baseline agent).
+# Source stays in /workspace (readable by baseline agent).
 # MCP agent deletes source files at runtime via agent startup script.
-RUN cp -a /app /repo_full
+RUN cp -a /workspace /repo_full
 RUN chmod 700 /repo_full
-RUN touch /tmp/.artifact_only_mode && echo '/app' > /tmp/.artifact_only_workdir
+RUN touch /tmp/.artifact_only_mode && echo '/workspace' > /tmp/.artifact_only_workdir
 
 ENTRYPOINT []
diff --git a/benchmarks/ccb_design/django-modeladmin-impact-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_design/django-modeladmin-impact-001/environment/Dockerfile.artifact_only
@@ -5,10 +5,10 @@
 
 FROM ccb-repo-django-674eda1c
 # --- artifact_only: backup full repo for verifier scoring ---
-# Source stays in /app (readable by baseline agent).
+# Source stays in /workspace (readable by baseline agent).
 # MCP agent deletes source files at runtime via agent startup script.
-RUN cp -a /app /repo_full
+RUN cp -a /workspace /repo_full
 RUN chmod 700 /repo_full
-RUN touch /tmp/.artifact_only_mode && echo '/app' > /tmp/.artifact_only_workdir
+RUN touch /tmp/.artifact_only_mode && echo '/workspace' > /tmp/.artifact_only_workdir
 
 ENTRYPOINT []
diff --git a/benchmarks/ccb_design/django-pre-validate-signal-design-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_design/django-pre-validate-signal-design-001/environment/Dockerfile.artifact_only
@@ -57,10 +57,10 @@ STALE_DOC
 
 RUN git add docs/signals_architecture.md && git commit -m "Add signals architecture documentation" --quiet
 # --- artifact_only: backup full repo for verifier scoring ---
-# Source stays in /app (readable by baseline agent).
+# Source stays in /workspace (readable by baseline agent).
 # MCP agent deletes source files at runtime via agent startup script.
-RUN cp -a /app /repo_full
+RUN cp -a /workspace /repo_full
 RUN chmod 700 /repo_full
-RUN touch /tmp/.artifact_only_mode && echo '/app' > /tmp/.artifact_only_workdir
+RUN touch /tmp/.artifact_only_mode && echo '/workspace' > /tmp/.artifact_only_workdir
 
 ENTRYPOINT []
diff --git a/benchmarks/ccb_design/django-rate-limit-design-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_design/django-rate-limit-design-001/environment/Dockerfile.artifact_only
@@ -64,10 +64,10 @@ STALE_DOC
 
 RUN git add docs/architecture.md && git commit -m "Add architecture documentation" --quiet
 # --- artifact_only: backup full repo for verifier scoring ---
-# Source stays in /app (readable by baseline agent).
+# Source stays in /workspace (readable by baseline agent).
 # MCP agent deletes source files at runtime via agent startup script.
-RUN cp -a /app /repo_full
+RUN cp -a /workspace /repo_full
 RUN chmod 700 /repo_full
-RUN touch /tmp/.artifact_only_mode && echo '/app' > /tmp/.artifact_only_workdir
+RUN touch /tmp/.artifact_only_mode && echo '/workspace' > /tmp/.artifact_only_workdir
 
 ENTRYPOINT []
diff --git a/benchmarks/ccb_design/flink-checkpoint-arch-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_design/flink-checkpoint-arch-001/environment/Dockerfile.artifact_only
@@ -5,10 +5,10 @@
 
 FROM ccb-repo-flink-0cc95fcc
 # --- artifact_only: backup full repo for verifier scoring ---
-# Source stays in /app (readable by baseline agent).
+# Source stays in /workspace (readable by baseline agent).
 # MCP agent deletes source files at runtime via agent startup script.
-RUN cp -a /app /repo_full
+RUN cp -a /workspace /repo_full
 RUN chmod 700 /repo_full
-RUN touch /tmp/.artifact_only_mode && echo '/app' > /tmp/.artifact_only_workdir
+RUN touch /tmp/.artifact_only_mode && echo '/workspace' > /tmp/.artifact_only_workdir
 
 ENTRYPOINT []
diff --git a/benchmarks/ccb_design/flipt-protobuf-metadata-design-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_design/flipt-protobuf-metadata-design-001/environment/Dockerfile.artifact_only
@@ -5,10 +5,10 @@
 
 FROM ccb-repo-flipt-3d5a345f
 # --- artifact_only: backup full repo for verifier scoring ---
-# Source stays in /app (readable by baseline agent).
+# Source stays in /workspace (readable by baseline agent).
 # MCP agent deletes source files at runtime via agent startup script.
-RUN cp -a /app /repo_full
+RUN cp -a /workspace /repo_full
 RUN chmod 700 /repo_full
-RUN touch /tmp/.artifact_only_mode && echo '/app' > /tmp/.artifact_only_workdir
+RUN touch /tmp/.artifact_only_mode && echo '/workspace' > /tmp/.artifact_only_workdir
 
 ENTRYPOINT []
diff --git a/benchmarks/ccb_design/flipt-transitive-deps-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_design/flipt-transitive-deps-001/environment/Dockerfile.artifact_only
@@ -5,10 +5,10 @@
 
 FROM ccb-repo-flipt-3d5a345f
 # --- artifact_only: backup full repo for verifier scoring ---
-# Source stays in /app (readable by baseline agent).
+# Source stays in /workspace (readable by baseline agent).
 # MCP agent deletes source files at runtime via agent startup script.
-RUN cp -a /app /repo_full
+RUN cp -a /workspace /repo_full
 RUN chmod 700 /repo_full
-RUN touch /tmp/.artifact_only_mode && echo '/app' > /tmp/.artifact_only_workdir
+RUN touch /tmp/.artifact_only_mode && echo '/workspace' > /tmp/.artifact_only_workdir
 
 ENTRYPOINT []
diff --git a/benchmarks/ccb_design/k8s-crd-lifecycle-arch-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_design/k8s-crd-lifecycle-arch-001/environment/Dockerfile.artifact_only
@@ -5,10 +5,10 @@
 
 FROM ccb-repo-k8s-11602f08
 # --- artifact_only: backup full repo for verifier scoring ---
-# Source stays in /app (readable by baseline agent).
+# Source stays in /workspace (readable by baseline agent).
 # MCP agent deletes source files at runtime via agent startup script.
-RUN cp -a /app /repo_full
+RUN cp -a /workspace /repo_full
 RUN chmod 700 /repo_full
-RUN touch /tmp/.artifact_only_mode && echo '/app' > /tmp/.artifact_only_workdir
+RUN touch /tmp/.artifact_only_mode && echo '/workspace' > /tmp/.artifact_only_workdir
 
 ENTRYPOINT []
diff --git a/benchmarks/ccb_design/k8s-scheduler-arch-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_design/k8s-scheduler-arch-001/environment/Dockerfile.artifact_only
@@ -5,10 +5,10 @@
 
 FROM ccb-repo-k8s-11602f08
 # --- artifact_only: backup full repo for verifier scoring ---
-# Source stays in /app (readable by baseline agent).
+# Source stays in /workspace (readable by baseline agent).
 # MCP agent deletes source files at runtime via agent startup script.
-RUN cp -a /app /repo_full
+RUN cp -a /workspace /repo_full
 RUN chmod 700 /repo_full
-RUN touch /tmp/.artifact_only_mode && echo '/app' > /tmp/.artifact_only_workdir
+RUN touch /tmp/.artifact_only_mode && echo '/workspace' > /tmp/.artifact_only_workdir
 
 ENTRYPOINT []
diff --git a/benchmarks/ccb_design/postgres-query-exec-arch-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_design/postgres-query-exec-arch-001/environment/Dockerfile.artifact_only
@@ -5,10 +5,10 @@
 
 FROM ccb-repo-postgres-5a461dc4
 # --- artifact_only: backup full repo for verifier scoring ---
-# Source stays in /app (readable by baseline agent).
+# Source stays in /workspace (readable by baseline agent).
 # MCP agent deletes source files at runtime via agent startup script.
-RUN cp -a /app /repo_full
+RUN cp -a /workspace /repo_full
 RUN chmod 700 /repo_full
-RUN touch /tmp/.artifact_only_mode && echo '/app' > /tmp/.artifact_only_workdir
+RUN touch /tmp/.artifact_only_mode && echo '/workspace' > /tmp/.artifact_only_workdir
 
 ENTRYPOINT []
diff --git a/benchmarks/ccb_document/docgen-inline-002/environment/Dockerfile.artifact_only b/benchmarks/ccb_document/docgen-inline-002/environment/Dockerfile.artifact_only
@@ -7,10 +7,10 @@ FROM ccb-repo-kafka-e678b4b
 
 RUN mkdir -p /app
 # --- artifact_only: backup full repo for verifier scoring ---
-# Source stays in /app (readable by baseline agent).
+# Source stays in /workspace (readable by baseline agent).
 # MCP agent deletes source files at runtime via agent startup script.
-RUN cp -a /app /repo_full
+RUN cp -a /workspace /repo_full
 RUN chmod 700 /repo_full
-RUN touch /tmp/.artifact_only_mode && echo '/app' > /tmp/.artifact_only_workdir
+RUN touch /tmp/.artifact_only_mode && echo '/workspace' > /tmp/.artifact_only_workdir
 
 ENTRYPOINT []
diff --git a/benchmarks/ccb_fix/django-modelchoice-fk-fix-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_fix/django-modelchoice-fk-fix-001/environment/Dockerfile.artifact_only
@@ -5,10 +5,10 @@
 
 FROM ccb-repo-django-674eda1c
 # --- artifact_only: backup full repo for verifier scoring ---
-# Source stays in /app (readable by baseline agent).
+# Source stays in /workspace (readable by baseline agent).
 # MCP agent deletes source files at runtime via agent startup script.
-RUN cp -a /app /repo_full
+RUN cp -a /workspace /repo_full
 RUN chmod 700 /repo_full
-RUN touch /tmp/.artifact_only_mode && echo '/app' > /tmp/.artifact_only_workdir
+RUN touch /tmp/.artifact_only_mode && echo '/workspace' > /tmp/.artifact_only_workdir
 
 ENTRYPOINT []
diff --git a/benchmarks/ccb_fix/django-select-for-update-fix-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_fix/django-select-for-update-fix-001/environment/Dockerfile.artifact_only
@@ -5,10 +5,10 @@
 
 FROM ccb-repo-django-9e7cc2b6
 # --- artifact_only: backup full repo for verifier scoring ---
-# Source stays in /app (readable by baseline agent).
+# Source stays in /workspace (readable by baseline agent).
 # MCP agent deletes source files at runtime via agent startup script.
-RUN cp -a /app /repo_full
+RUN cp -a /workspace /repo_full
 RUN chmod 700 /repo_full
-RUN touch /tmp/.artifact_only_mode && echo '/app' > /tmp/.artifact_only_workdir
+RUN touch /tmp/.artifact_only_mode && echo '/workspace' > /tmp/.artifact_only_workdir
 
 ENTRYPOINT []
diff --git a/benchmarks/ccb_fix/flipt-eval-latency-fix-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_fix/flipt-eval-latency-fix-001/environment/Dockerfile.artifact_only
@@ -5,10 +5,10 @@
 
 FROM ccb-repo-flipt-3d5a345f
 # --- artifact_only: backup full repo for verifier scoring ---
-# Source stays in /app (readable by baseline agent).
+# Source stays in /workspace (readable by baseline agent).
 # MCP agent deletes source files at runtime via agent startup script.
-RUN cp -a /app /repo_full
+RUN cp -a /workspace /repo_full
 RUN chmod 700 /repo_full
-RUN touch /tmp/.artifact_only_mode && echo '/app' > /tmp/.artifact_only_workdir
+RUN touch /tmp/.artifact_only_mode && echo '/workspace' > /tmp/.artifact_only_workdir
 
 ENTRYPOINT []
diff --git a/benchmarks/ccb_fix/k8s-dra-scheduler-event-fix-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_fix/k8s-dra-scheduler-event-fix-001/environment/Dockerfile.artifact_only
@@ -5,10 +5,10 @@
 
 FROM ccb-repo-k8s-11602f08
 # --- artifact_only: backup full repo for verifier scoring ---
-# Source stays in /app (readable by baseline agent).
+# Source stays in /workspace (readable by baseline agent).
 # MCP agent deletes source files at runtime via agent startup script.
-RUN cp -a /app /repo_full
+RUN cp -a /workspace /repo_full
 RUN chmod 700 /repo_full
-RUN touch /tmp/.artifact_only_mode && echo '/app' > /tmp/.artifact_only_workdir
+RUN touch /tmp/.artifact_only_mode && echo '/workspace' > /tmp/.artifact_only_workdir
 
 ENTRYPOINT []
diff --git a/benchmarks/ccb_secure/django-audit-trail-implement-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_secure/django-audit-trail-implement-001/environment/Dockerfile.artifact_only
@@ -7,10 +7,10 @@ FROM ccb-repo-django-674eda1c
 
 # Install Django in development mode
 # --- artifact_only: backup full repo for verifier scoring ---
-# Source stays in /app (readable by baseline agent).
+# Source stays in /workspace (readable by baseline agent).
 # MCP agent deletes source files at runtime via agent startup script.
-RUN cp -a /app /repo_full
+RUN cp -a /workspace /repo_full
 RUN chmod 700 /repo_full
-RUN touch /tmp/.artifact_only_mode && echo '/app' > /tmp/.artifact_only_workdir
+RUN touch /tmp/.artifact_only_mode && echo '/workspace' > /tmp/.artifact_only_workdir
 
 ENTRYPOINT []
diff --git a/benchmarks/ccb_secure/django-cross-team-boundary-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_secure/django-cross-team-boundary-001/environment/Dockerfile.artifact_only
@@ -7,10 +7,10 @@ FROM ccb-repo-django-674eda1c
 
 # Install Django in development mode
 # --- artifact_only: backup full repo for verifier scoring ---
-# Source stays in /app (readable by baseline agent).
+# Source stays in /workspace (readable by baseline agent).
 # MCP agent deletes source files at runtime via agent startup script.
-RUN cp -a /app /repo_full
+RUN cp -a /workspace /repo_full
 RUN chmod 700 /repo_full
-RUN touch /tmp/.artifact_only_mode && echo '/app' > /tmp/.artifact_only_workdir
+RUN touch /tmp/.artifact_only_mode && echo '/workspace' > /tmp/.artifact_only_workdir
 
 ENTRYPOINT []
diff --git a/benchmarks/ccb_secure/django-csrf-session-audit-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_secure/django-csrf-session-audit-001/environment/Dockerfile.artifact_only
@@ -5,10 +5,10 @@
 
 FROM ccb-repo-django-9e7cc2b6
 # --- artifact_only: backup full repo for verifier scoring ---
-# Source stays in /app (readable by baseline agent).
+# Source stays in /workspace (readable by baseline agent).
 # MCP agent deletes source files at runtime via agent startup script.
-RUN cp -a /app /repo_full
+RUN cp -a /workspace /repo_full
 RUN chmod 700 /repo_full
-RUN touch /tmp/.artifact_only_mode && echo '/app' > /tmp/.artifact_only_workdir
+RUN touch /tmp/.artifact_only_mode && echo '/workspace' > /tmp/.artifact_only_workdir
 
 ENTRYPOINT []
diff --git a/benchmarks/ccb_secure/django-legacy-dep-vuln-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_secure/django-legacy-dep-vuln-001/environment/Dockerfile.artifact_only
@@ -5,10 +5,10 @@
 
 FROM ccb-repo-django-674eda1c
 # --- artifact_only: backup full repo for verifier scoring ---
-# Source stays in /app (readable by baseline agent).
+# Source stays in /workspace (readable by baseline agent).
 # MCP agent deletes source files at runtime via agent startup script.
-RUN cp -a /app /repo_full
+RUN cp -a /workspace /repo_full
 RUN chmod 700 /repo_full
-RUN touch /tmp/.artifact_only_mode && echo '/app' > /tmp/.artifact_only_workdir
+RUN touch /tmp/.artifact_only_mode && echo '/workspace' > /tmp/.artifact_only_workdir
 
 ENTRYPOINT []
diff --git a/benchmarks/ccb_secure/django-policy-enforcement-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_secure/django-policy-enforcement-001/environment/Dockerfile.artifact_only
diff --git a/benchmarks/ccb_secure/django-repo-scoped-access-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_secure/django-repo-scoped-access-001/environment/Dockerfile.artifact_only
diff --git a/benchmarks/ccb_secure/django-role-based-access-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_secure/django-role-based-access-001/environment/Dockerfile.artifact_only
diff --git a/benchmarks/ccb_secure/django-sensitive-file-exclusion-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_secure/django-sensitive-file-exclusion-001/environment/Dockerfile.artifact_only
diff --git a/benchmarks/ccb_secure/flipt-repo-scoped-access-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_secure/flipt-repo-scoped-access-001/environment/Dockerfile.artifact_only
diff --git a/benchmarks/ccb_secure/kafka-sasl-auth-audit-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_secure/kafka-sasl-auth-audit-001/environment/Dockerfile.artifact_only
diff --git a/benchmarks/ccb_secure/postgres-client-auth-audit-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_secure/postgres-client-auth-audit-001/environment/Dockerfile.artifact_only
diff --git a/benchmarks/ccb_understand/django-composite-field-recover-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_understand/django-composite-field-recover-001/environment/Dockerfile.artifact_only
diff --git a/benchmarks/ccb_understand/django-template-inherit-recall-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_understand/django-template-inherit-recall-001/environment/Dockerfile.artifact_only
diff --git a/benchmarks/ccb_understand/envoy-filter-chain-qa-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_understand/envoy-filter-chain-qa-001/environment/Dockerfile.artifact_only
diff --git a/benchmarks/ccb_understand/envoy-request-routing-qa-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_understand/envoy-request-routing-qa-001/environment/Dockerfile.artifact_only
diff --git a/scripts/regenerate_artifact_dockerfiles.py b/scripts/regenerate_artifact_dockerfiles.py
