@@ -6,7 +6,7 @@ Plugins for collecting evidence about client support for [Agent Plugins](https:/
 
 | Plugin | Coverage |
 | --- | --- |
-| [Agent Plugins Conformance — Core](plugins/agent-plugins-conformance-core/) | Skill discovery, MCP tool availability, working directories, and selected subprocess environment and placeholder rules |
+| [Agent Plugins Conformance — Core](plugins/agent-plugins-conformance-core/) | Skill discovery, MCP tool availability, working directories, plugin data writability, and selected subprocess environment and placeholder rules |
 
 Install **`plugins/agent-plugins-conformance-core`** through the client's Agent Plugins support. Each directory under `plugins/` is an installable plugin; the repository root is the development project.
 
 
@@ -1,6 +1,6 @@
 # Agent Plugins Conformance — Core
 
-A portable [Agent Plugins](https://agent-plugins.org/) plugin for collecting evidence about skill discovery, MCP tool availability, working directories, and selected subprocess environment and placeholder rules. It provides three [Agent Skills](https://agentskills.io/specification) and four stdio MCP servers. A deterministic reporter evaluates their observations against fixed fixtures.
+A portable [Agent Plugins](https://agent-plugins.org/) plugin for collecting evidence about skill discovery, MCP tool availability, working directories, plugin data writability, and selected subprocess environment and placeholder rules. It provides three [Agent Skills](https://agentskills.io/specification) and four stdio MCP servers. A deterministic reporter evaluates their observations against fixed fixtures.
 
 Results describe the observed run and these covered cases; they are not whole-client certification.
 
@@ -52,16 +52,18 @@ The following example is abbreviated: observations, notes, and some results are
     }
   ],
   "summary": {
-    "pass": 6,
+    "pass": 7,
     "fail": 1,
     "not_verified": 7,
-    "total": 14
+    "total": 15
   }
 }
 ```
 
 Each result identifies its case through `id` and `label`, explains the outcome in `detail`, and cites the relevant specification sections in `specSections`.
 
+An optional `warning` reports a probe cleanup failure, including the probe file's path and error. It does not change the check's status.
+
 The three statuses mean:
 
 | Status | Meaning |
@@ -129,7 +131,7 @@ jq '
 
 ### Summarize a saved report
 
-The summarizer displays saved outcomes as a table with explanations for checks that failed or were not verified. From the plugin directory, run:
+The summarizer displays saved outcomes as a table with explanations for checks that failed or were not verified, followed by any warnings. From the plugin directory, run:
 
 ```sh
 node skills/conformance-guide/scripts/summarize.mjs '/absolute/path/to/report.json'
@@ -141,7 +143,7 @@ Reporting and summarizing errors are command failures. Producing a valid report
 
 ## Coverage
 
-The environment and argument checks use the `default` server's observation; each of the other servers supplies tool-availability and working-directory evidence.
+The environment, argument, and plugin data writability checks use the `default` server's observation; each of the other servers supplies tool-availability and working-directory evidence.
 
 | Case IDs | What the check establishes |
 | --- | --- |
@@ -151,9 +153,12 @@ The environment and argument checks use the `default` server's observation; each
 | `mcp.stdio.cwd.plugin-relative`, `mcp.stdio.cwd.plugin-root` | Relative and root-placeholder `cwd` resolve to `probe-workdir`. |
 | `mcp.stdio.cwd.plugin-data` | Data-placeholder `cwd` matches the data path resolved by the probe. |
 | `mcp.stdio.env.plugin-root` | Supplied `PLUGIN_ROOT` matches the independently determined package root. |
-| `mcp.stdio.env.plugin-data-absolute` | Supplied `PLUGIN_DATA` is an absolute path. This check does not exercise storage dedication, writability, or persistence across updates. |
+| `mcp.stdio.env.plugin-data-absolute` | Supplied `PLUGIN_DATA` is an absolute path. This check does not exercise writability, storage dedication, or persistence across updates. |
+| `mcp.stdio.data.writable` | The default server can create, write, and close a small temporary file directly in the supplied `PLUGIN_DATA` directory. |
 | `mcp.stdio.env.configured-value` | The configured value reaches the subprocess. The fixture does not arrange a conflicting inherited value, so it does not establish override behavior. |
 | `mcp.stdio.args.preservation-and-expansion` | Argument boundaries, including spaces and an empty argument, are preserved; recognized placeholders expand and unknown placeholder-like text stays literal. |
 | `mcp.stdio.env.expansion` | Repeated recognized placeholders expand in environment values and unknown placeholder-like text stays literal. |
 
+Each default observation attempts a fresh write using a unique, exclusively created file, then removes that file. Missing or relative `PLUGIN_DATA` leaves writability `not_verified`; an unusable absolute path fails. Cleanup failures appear as warnings in JSON and the requested human summary without changing a successful write result.
+
 This plugin exercises valid stdio configurations; invalid configuration handling, failure isolation, and remote MCP transports are outside its coverage.
@@ -52,7 +52,7 @@ Replace `observation` with the complete observation just obtained. The script re
 
 1. Record the guide observation above only if the client exposed this skill and you loaded its body through the client's normal skill mechanism. A client-provided skill catalog followed by reading its advertised resource is a valid mechanism. Locating a known skill by filesystem search or receiving its body in a prompt does not establish client discovery.
 2. Find and load `conformance-alpha` and `conformance-beta` through that same client mechanism. Record the observation each loaded body supplies, one at a time. Do not infer their markers or claim discovery from files located independently of the client.
-3. Find each server's `observe` tool: `default`, `relative`, `root`, and `data`. Tool names may be client-namespaced. Call each available tool with `{}`. Take its observation from `structuredContent` (some clients show `structured_content`), or parse the JSON in the tool's text content. Immediately record that complete object. It begins with `{"kind":"mcp-stdio","server":...}`; exclude the MCP result wrapper containing `content` or `structuredContent`. Preserve the returned paths and values exactly.
+3. Find each server's `observe` tool: `default`, `relative`, `root`, and `data`. Tool names may be client-namespaced. Call each available tool with `{}`. The default tool also tests data-directory writability by creating, writing, and removing its own temporary file. Take each observation from `structuredContent` (some clients show `structured_content`), or parse the JSON in the tool's text content. Immediately record that complete object. It begins with `{"kind":"mcp-stdio","server":...}`; exclude the MCP result wrapper containing `content` or `structuredContent`. Preserve the returned paths and values exactly.
 4. Omit observations for unavailable skills, missing tools, or calls that did not return evidence. Keep track of those collection limitations for your final response. Missing evidence remains `not_verified`; it does not by itself establish failure.
 
 A recording error means that observation was not successfully saved. Address an input or command error using the actual evidence, or explicitly identify the unsaved observation in your final response. Distinguish a failed write from unavailable probe evidence. Retry an individual recording with `record`; invoking `start` again discards previously collected evidence.
 
@@ -13,6 +13,7 @@ export const CASES = Object.freeze([
   ]),
   ['mcp.stdio.env.plugin-root', 'Plugin root environment', ['9.1']],
   ['mcp.stdio.env.plugin-data-absolute', 'Plugin data environment', ['9.1']],
+  ['mcp.stdio.data.writable', 'Plugin data writability', ['9.1']],
   ['mcp.stdio.env.configured-value', 'Configured environment', ['9.1']],
   ['mcp.stdio.args.preservation-and-expansion', 'Argument preservation and expansion', ['7.2.1', '9.2']],
   ['mcp.stdio.env.expansion', 'Environment expansion', ['9.2']],
 
@@ -0,0 +1,38 @@
+import fs from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import { isAbsolute, join } from 'node:path';
+
+const errorFacts = (error) => ({ code: error.code ?? null, message: error.message });
+
+export function observeDataWrite(data) {
+  if (!data || !isAbsolute(data)) return null;
+  const observation = {
+    path: join(data, `.agent-plugins-conformance-${randomUUID()}.tmp`),
+    error: null,
+    cleanupError: null,
+  };
+  let descriptor;
+  let operation = 'create';
+  try {
+    descriptor = fs.openSync(observation.path, 'wx');
+    operation = 'write';
+    fs.writeFileSync(descriptor, 'Agent Plugins conformance write probe\n');
+  } catch (error) {
+    observation.error = { operation, ...errorFacts(error) };
+  } finally {
+    // Only a successful exclusive create grants ownership of this file.
+    if (descriptor !== undefined) {
+      try {
+        fs.closeSync(descriptor);
+      } catch (error) {
+        observation.error ??= { operation: 'close', ...errorFacts(error) };
+      }
+      try {
+        fs.unlinkSync(observation.path);
+      } catch (error) {
+        observation.cleanupError = errorFacts(error);
+      }
+    }
+  }
+  return observation;
+}
@@ -4,6 +4,7 @@ import { isAbsolute } from 'node:path';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { CallToolRequestSchema, ListToolsRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+import { observeDataWrite } from './data-write.mjs';
 
 const serverName = process.argv[2];
 if (!['default', 'relative', 'root', 'data'].includes(serverName)) {
@@ -31,9 +32,11 @@ const server = new Server({ name: `agent-plugins-conformance-${serverName}`, ver
   { capabilities: { tools: {} } });
 const observeTool = {
   name: 'observe',
-  description: 'Return this process launch evidence. Record the observation object from structuredContent (or parsed JSON text) unchanged with the conformance guide reporter; exclude the MCP result wrapper. Reads only fixture variables.',
+  description: 'Return this process launch evidence, including only fixture environment variables.' +
+    (serverName === 'default' ? ' Each call also creates, writes, closes, and removes a uniquely named temporary file directly in an absolute PLUGIN_DATA directory, recording any operation or cleanup error.' : '') +
+    ' Record the observation object from structuredContent (or parsed JSON text) unchanged with the conformance guide reporter; exclude the MCP result wrapper.',
   inputSchema: { type: 'object', properties: {}, additionalProperties: false },
-  annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+  annotations: { readOnlyHint: serverName !== 'default', destructiveHint: false, idempotentHint: serverName !== 'default', openWorldHint: false },
 };
 server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: [observeTool] }));
 server.setRequestHandler(CallToolRequestSchema, async ({ params }) => {
@@ -44,6 +47,7 @@ server.setRequestHandler(CallToolRequestSchema, async ({ params }) => {
         throw new Error('observe requires an empty object');
       }
       const observation = { kind: 'mcp-stdio', server: serverName, evidence: { version: 1, ...launch } };
+      if (serverName === 'default') observation.evidence.dataWrite = observeDataWrite(process.env.PLUGIN_DATA);
       return { content: [{ type: 'text', text: JSON.stringify(observation) }], structuredContent: observation };
     }
     throw new Error(`Unknown tool: ${params.name}`);
 
@@ -30,6 +30,7 @@ export function validateSavedReport(report) {
     const at = `report.results[${index}]`;
     object(result, at);
     for (const key of ['id', 'label', 'detail']) string(result[key], `${at}.${key}`);
+    if (Object.hasOwn(result, 'warning')) string(result.warning, `${at}.warning`);
     if (ids.has(result.id)) invalid(`${at}.id`, 'duplicate result ID');
     ids.add(result.id);
     if (!STATUSES.includes(result.status)) invalid(`${at}.status`, `expected one of: ${STATUSES.join(', ')}`);
@@ -79,5 +80,12 @@ export function formatReport(report) {
       lines.push(`  ${escapeText(label)} (${escapeText(id)})`, `    ${escapeText(detail)}`);
     }
   }
+  const warnings = report.results.filter((result) => result.warning !== undefined);
+  if (warnings.length) {
+    lines.push('', 'Warnings');
+    for (const { id, label, warning } of warnings) {
+      lines.push(`  ${escapeText(label)} (${escapeText(id)})`, `    ${escapeText(warning)}`);
+    }
+  }
   return lines.join('\n');
 }