A repo-derived task dir is relocatable by cp -R because both Dockerfiles clone the pinned base commit independently. What breaks is metadata, not machinery: canary, org in [task].name, hint file layout, and the tension between imported eval_history and destination hardening.
Moving tasks/<slug>/ from one GoodTurn env repo to another is mostly a copy — a repo-derived task has no sibling-path dependencies, since environment/Dockerfile and tests/Dockerfile each clone the same pinned base commit into their own build context. Verified on a real import: cp -R, three metadata fixes, then goodturn env check → oracle=1 nop=0.
The four things that need hand-fixing:
Canary. Datasets that predate the canary rule ship no [metadata].canary_guid and no <!-- gt-canary: ... --> footer in instruction.md. This is the one hard lint ERROR (canary-missing) on import. Mint a fresh UUID and write it in BOTH places — lint cross-validates them and errors with canary-guid-mismatch if they disagree.
Org in [task].name. An imported name like mahmoud/boltons-388 is slash-formed, so it passes lint and harbor, but it names the SOURCE org. Retarget to the destination clone's org (parse git remote get-url origin) so the task matches its siblings. There is no init step on an import to do this for you.
Hint layout. Older datasets keep graduated hints in a single hints.md split by ---; the current contract is hints/1.md..N.md (1 = mildest). The split is lossless and nothing in the CLI reads either form — it is purely for the next author, which is exactly why it silently rots.
eval_history vs. the hardening checklist. Imported [metadata.eval_history] (or status = "graded") is only meaningful if the environment still matches the one that produced those numbers. Resist 'while I'm here' hardening: adding the checklist's non-root agent (useradd agent + [agent] user = "agent") changes what the agent can do — a non-root agent cannot write root-owned site-packages — so it silently invalidates the imported history. Either keep the graded config and record the deviation, or harden and drop the history. Do not do both quietly. Same call for an allowed_hosts entry like registry.npmjs.org: it trips the forbidden-host warn but is what lets API agents bootstrap, so removing it makes a gradeable task ungradeable to win a clean lint.
General shape: on a cross-repo import, the machinery is portable and the provenance is not. Fix identity (canary, org), normalize layout, and treat every recorded measurement as scoped to the exact config that produced it.