Close native runtime safety gaps

Publish inbox messages atomically and skip entries removed during reads. Make skipped one-shot reconcile passes fail, distinguish missing presence, and exclude generated DING sidecars from authored runnable work. Refresh the native eval evidence and migration guidance.

Co-authored-by: schickling-assistant <schickling.j@gmail.com>

Author: myobie

README.md

@@ -148,11 +148,10 @@ the roster: presence is `<agent-dir>/status`, while unread messages, archive rec
 links live under `<agent-dir>/resources/`. The flat `<root>/<identity>` layout remains only as the
 intentional catalog-less fallback used by isolated folder evals.
 
-Adopters should cut directly to this native layout rather than stage through a retired compatibility
-transport. Before launching a migrated identity, install and verify hooks, validate and materialize
-its hand-authored declaration, stop the predecessor transport, and decide how any unread legacy
-backlog will be archived or forwarded. Never run old and native DING owners concurrently for the same
-identity.
+Adopters should cut directly to the native layout. Before launching a migrated identity, install and
+verify hooks, validate and materialize its hand-authored declaration, stop any predecessor transport,
+and decide how any unread predecessor backlog will be archived or forwarded. Never run predecessor
+and native DING owners concurrently for the same identity.
 
 Native DING watches the recipient inbox and delivers a normalized notice:
 
@@ -203,7 +202,7 @@ manpage tree is committed.
 The test suite builds a temporary `PATH` containing only the current `st2` binary, required Git,
 and `pty`, `codex`, and `claude` shims. It installs and verifies a scratch hook receipt, instantiates
 both maintained hand-authored KDL examples in fresh Git workspaces, validates and materializes them
-twice, and verifies the help/doctor/native authoring surface without any retired binary:
+twice, and verifies the help/doctor/native authoring surface without a predecessor transport binary:
 
 ```sh
 cargo test --test native_only --all-features
@@ -219,19 +218,27 @@ cargo test --all-targets --all-features
 ## Eval corpus
 
 The Codex evidence ledger is pinned at
-[`67b45d2694ac40762b09f51bf625d092ab68de74`](https://github.com/compoundingtech/evals/blob/67b45d2694ac40762b09f51bf625d092ab68de74/HARNESS-MATRIX.md).
+[`f605f8626d2e672a59187c9c998015d2efb31040`](https://github.com/compoundingtech/evals/blob/f605f8626d2e672a59187c9c998015d2efb31040/HARNESS-MATRIX.md).
 
 Current native Codex examples:
 
-- [`license-mit-codex`](https://github.com/compoundingtech/evals/blob/67b45d2694ac40762b09f51bf625d092ab68de74/cells/license-mit-codex/license-mit-codex.kdl):
-  `bin/check-codex-native.sh cells/license-mit-codex` is the free static gate. The opt-in paid run is
-  `st2 eval ./cells/license-mit-codex/ --keep`; pinned evidence is 6/6 PASS in 1m39s.
-- [`signal-rename-codex`](https://github.com/compoundingtech/evals/blob/67b45d2694ac40762b09f51bf625d092ab68de74/cells/signal-rename-codex/signal-rename-codex.kdl):
-  `bin/check-codex-native.sh cells/signal-rename-codex` is the free static gate. The opt-in paid run
-  is `st2 eval ./cells/signal-rename-codex/ --keep`; pinned evidence is 6/6 PASS in 8m07s.
-
-The pinned [native static checker](https://github.com/compoundingtech/evals/blob/67b45d2694ac40762b09f51bf625d092ab68de74/bin/check-codex-native.sh)
-does not consume model usage.
+- [`license-mit-codex`](https://github.com/compoundingtech/evals/blob/f605f8626d2e672a59187c9c998015d2efb31040/cells/license-mit-codex/license-mit-codex.kdl):
+  two subjects plus a short model judge; low expected cost; 6/6 PASS in 1m39s on the fixed build.
+- [`signal-rename-codex`](https://github.com/compoundingtech/evals/blob/f605f8626d2e672a59187c9c998015d2efb31040/cells/signal-rename-codex/signal-rename-codex.kdl):
+  four-seat multi-repository rename; high expected cost; 6/6 PASS in 8m07s.
+- [`ghost-bug-codex`](https://github.com/compoundingtech/evals/blob/f605f8626d2e672a59187c9c998015d2efb31040/cells/ghost-bug-codex/ghost-bug-codex.kdl):
+  two-seat debugging and mutation-valid regression; medium expected cost; 5/5 PASS in 1m38s, after
+  which usage-limit notices were found in the kept logs and paid work stopped.
+- [`poisoned-pr-codex`](https://github.com/compoundingtech/evals/blob/f605f8626d2e672a59187c9c998015d2efb31040/cells/poisoned-pr-codex/poisoned-pr-codex.kdl):
+  two-seat review-only security exercise; medium expected cost; 4/4 gating PASS plus the signal judge
+  in 1m52s during the explicitly reopened tail.
+- [`fork-in-the-road-codex`](https://github.com/compoundingtech/evals/blob/f605f8626d2e672a59187c9c998015d2efb31040/cells/fork-in-the-road-codex/fork-in-the-road-codex.kdl):
+  four-seat design panel; high expected cost; 5/5 PASS in 7m21s on one retry after a concrete grader
+  fix.
+
+The pinned [native static checker](https://github.com/compoundingtech/evals/blob/f605f8626d2e672a59187c9c998015d2efb31040/bin/check-codex-native.sh)
+does not consume model usage. The ledger records that the sequential five-cell run is complete and
+no additional model-backed eval is authorized.
 
 The Claude native-readiness ledger is pinned at
 [`a52b68dfe4bdb65a3bb6a1ba51c674476cf197df`](https://github.com/compoundingtech/evals/blob/a52b68dfe4bdb65a3bb6a1ba51c674476cf197df/CLAUDE-NATIVE-READINESS.md).
@@ -244,10 +251,7 @@ Its current event-first native examples and gates are immutable at
   one Claude supervisor and three specialists, each with a native bare `ding`.
 
 Run `bin/check-claude-native.sh` and `bin/check-claude-reset.sh` from that tree for the free static
-acceptance. The gates reject polling language and legacy bus declarations, require event-first DING
+acceptance. The gates reject polling language and non-native bus declarations, require event-first DING
 guidance, and prove repeatable clean fixture resets. They do not invoke a model. A current-build
 `st2 eval` model run remains pending explicit authorization, so these examples have static acceptance
 but no current native live-smoke claim.
-
-[`team-standup`](https://github.com/compoundingtech/evals/blob/a52b68dfe4bdb65a3bb6a1ba51c674476cf197df/cells/team-standup/team-standup.kdl)
-remains a legacy reference to the retired generated-declaration flow, not a current native example.

src/eval_run.rs

@@ -31,6 +31,7 @@ pub fn spec_to_agent_specs(agents: &[SpecAgent], host: &str, root: &Path) -> Vec
             ptags.insert("role".to_string(), "agent".to_string());
             tasks.push(Task {
                 kind: TaskKind::Pty,
+                derived: false,
                 name: "agent".to_string(),
                 id: Some(a.id.clone()), // explicit id → the session is exactly the agent id (mix.sup)
                 command: Some(a.command.clone()),
@@ -42,6 +43,7 @@ pub fn spec_to_agent_specs(agents: &[SpecAgent], host: &str, root: &Path) -> Vec
             for ex in &a.execs {
                 tasks.push(Task {
                     kind: TaskKind::Exec,
+                    derived: ex.derived,
                     name: ex.id.clone(),
                     id: Some(ex.id.clone()),
                     command: Some(ex.command.clone()),

src/eval_spec.rs

@@ -54,6 +54,8 @@ pub struct SpecExec {
     pub id: String,
     pub command: String,
     pub env: BTreeMap<String, String>,
+    /// The process came from built-in shorthand rather than an authored `exec` command.
+    pub derived: bool,
 }
 
 /// The `eval { }` block — only `st2 eval` runs it.
@@ -299,6 +301,7 @@ pub fn ding_exec(agent_id: &str) -> SpecExec {
         // the redundant positional is dropped.
         command: format!("st2 ding --identity {agent_id} --root $ST_ROOT"),
         env: BTreeMap::new(),
+        derived: true,
     }
 }
 
@@ -430,7 +433,12 @@ fn parse_agent(node: &KdlNode, prefix: &str, parent_env: &BTreeMap<String, Strin
                             }
                         }
                     }
-                    execs.push(SpecExec { id: ex_id, command: ex_command, env: cascade(&env, &ex_env) });
+                    execs.push(SpecExec {
+                        id: ex_id,
+                        command: ex_command,
+                        env: cascade(&env, &ex_env),
+                        derived: false,
+                    });
                 }
                 other => anyhow::bail!(
                     "agent '{id}': unexpected node '{other}' (expected workspace|supervisor|env|command|ding|exec)"
@@ -714,10 +722,12 @@ eval {
     fn bare_ding_node_generates_the_builtin_sidecar() {
         // The dedicated `ding` node must parse to EXACTLY what the `ding_exec` helper generates.
         let sup = &parse_spec(REFERENCE).unwrap().agents[0];
+        assert!(sup.execs[0].derived);
         assert_eq!(ding_exec("mix.sup"), SpecExec {
             id: sup.execs[0].id.clone(),
             command: sup.execs[0].command.clone(),
             env: BTreeMap::new(),
+            derived: true,
         });
     }
 
@@ -755,6 +765,7 @@ team "mix" {
         let ex = &s.agents[0].execs[0];
         assert_eq!(ex.id, "mix.sup.ding");
         assert_eq!(ex.command, "ding --ring-the-bell"); // the literal command, not the st2 template
+        assert!(!ex.derived);
     }
 
     #[test]

src/main.rs

@@ -948,14 +948,23 @@ fn doctor_cmd(root: &Path, host: Option<String>) -> Result<()> {
             );
         }
         if let Some(dir) = spec.path.parent() {
-            let state = st2::status::read_state(&st2::status::status_path(dir));
-            let fresh = state != st2::status::State::Unknown;
-            report_check(
-                &mut problems,
-                fresh,
-                &format!("{bus_id} presence fresh (is `{}`)", state.as_str()),
-                "rotted to `unknown` — is its ding refreshing?",
-            );
+            let path = st2::status::status_path(dir);
+            if !path.is_file() {
+                report_check(
+                    &mut problems,
+                    false,
+                    &format!("{bus_id} presence missing"),
+                    "no status file — is its ding refreshing?",
+                );
+            } else {
+                let state = st2::status::read_state(&path);
+                report_check(
+                    &mut problems,
+                    state != st2::status::State::Unknown,
+                    &format!("{bus_id} presence fresh (is `{}`)", state.as_str()),
+                    "rotted to `unknown` — is its ding refreshing?",
+                );
+            }
         }
     }
 
@@ -1565,6 +1574,9 @@ fn up_spec_fleet(spec_file: &Path, host: Option<String>, once: bool, interval: u
             spec_file.display()
         );
         print_report(&report);
+        if report.skipped {
+            anyhow::bail!("one-shot reconcile pass was skipped");
+        }
         return Ok(());
     }
 
@@ -1665,6 +1677,9 @@ fn up(
         let report = up_once(root, &this_host, &runner)?;
         println!("reconcile pass on host '{this_host}':");
         print_report(&report);
+        if report.skipped {
+            anyhow::bail!("one-shot reconcile pass was skipped");
+        }
         return Ok(());
     }
 

src/message.rs

@@ -15,6 +15,7 @@ use std::collections::{HashMap, HashSet};
 use std::fs;
 use std::io::Read;
 use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicU64, Ordering};
 use std::time::{SystemTime, UNIX_EPOCH};
 
 /// The alphabet st2 *generates* `<rand6>` from — Crockford base32 (`0-9a-z` minus `i l o u`). This is
@@ -183,6 +184,10 @@ fn parse_message(filename: &str, contents: &str) -> Message {
 
 /// Send: write a new message file into `inbox_dir`, returning its filename. Creates `inbox_dir` if
 /// missing; retries on the astronomically-unlikely filename collision.
+///
+/// The message is materialized atomically (temporary sibling + rename). A direct write under the
+/// canonical name exposes an empty or partial file to concurrent readers after create/truncate but
+/// before the bytes arrive; that incomplete message has no parseable sender or subject.
 pub fn send_to_inbox(
     inbox_dir: &Path,
     from: &str,
@@ -193,20 +198,50 @@ pub fn send_to_inbox(
 ) -> anyhow::Result<String> {
     fs::create_dir_all(inbox_dir)?;
     let contents = render_message(from, subject, in_reply_to, tags, body);
+    // This deliberately cannot match `is_message_filename`, so a concurrent scan ignores it.
+    let tmp = inbox_dir.join(tmp_name());
+    if let Err(error) = fs::write(&tmp, &contents) {
+        let _ = fs::remove_file(&tmp);
+        return Err(error.into());
+    }
     for _ in 0..8 {
         let filename = new_filename();
         let path = inbox_dir.join(&filename);
         if !path.exists() {
-            fs::write(&path, &contents)?;
+            if let Err(error) = fs::rename(&tmp, &path) {
+                let _ = fs::remove_file(&tmp);
+                return Err(error.into());
+            }
             return Ok(filename);
         }
     }
+    let _ = fs::remove_file(&tmp);
     anyhow::bail!(
         "could not allocate a unique message filename in {}",
         inbox_dir.display()
     )
 }
 
+static TMP_COUNTER: AtomicU64 = AtomicU64::new(0);
+
+fn tmp_name() -> String {
+    format!(
+        ".message.tmp-{}-{}",
+        std::process::id(),
+        TMP_COUNTER.fetch_add(1, Ordering::Relaxed)
+    )
+}
+
+/// Read a canonical entry that was already returned by `read_dir`. Removing a message concurrently
+/// (for example, inbox→archive) is normal: that entry vanished, it did not become an empty message.
+fn read_message_contents(path: &Path) -> anyhow::Result<Option<String>> {
+    match fs::read_to_string(path) {
+        Ok(contents) => Ok(Some(contents)),
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(None),
+        Err(error) => Err(anyhow::anyhow!("reading {}: {error}", path.display())),
+    }
+}
+
 /// List the canonical messages in `dir` (inbox or archive), sorted by send time. Non-message files
 /// are skipped. Frontmatter is parsed for metadata.
 pub fn list_dir(dir: &Path) -> anyhow::Result<Vec<Message>> {
@@ -220,7 +255,9 @@ pub fn list_dir(dir: &Path) -> anyhow::Result<Vec<Message>> {
         if !is_message_filename(&name) {
             continue;
         }
-        let contents = fs::read_to_string(entry.path()).unwrap_or_default();
+        let Some(contents) = read_message_contents(&entry.path())? else {
+            continue;
+        };
         msgs.push(parse_message(&name, &contents));
     }
     // Primary order is send time; the `<rand6>` suffix is a deterministic tiebreak so two messages
@@ -476,6 +513,19 @@ mod tests {
         assert_eq!(m.body, "just a body, no frontmatter");
     }
 
+    #[test]
+    fn a_message_removed_after_enumeration_is_skipped_not_parsed_as_empty() {
+        let tmp = tempfile::tempdir().unwrap();
+        let path = tmp.path().join("1784649988123-abc23z.md");
+        fs::write(
+            &path,
+            render_message("alice", Some("work"), None, &[], "body"),
+        )
+        .unwrap();
+        fs::remove_file(&path).unwrap();
+        assert_eq!(read_message_contents(&path).unwrap(), None);
+    }
+
     #[test]
     fn reply_subject_prefixes_once() {
         assert_eq!(reply_subject(Some("hi")).as_deref(), Some("re: hi"));

src/reconcile.rs

@@ -133,6 +133,11 @@ pub fn reconcile<'a>(specs: &'a [AgentSpec], sessions: &[Session], this_host: &s
             continue;
         }
 
+        if !spec.is_runnable() {
+            plan.unrunnable.push(spec);
+            continue;
+        }
+
         let targets: Vec<TaskTarget> = spec
             .tasks
             .iter()
@@ -162,10 +167,7 @@ pub fn reconcile<'a>(specs: &'a [AgentSpec], sessions: &[Session], this_host: &s
             })
             .collect();
 
-        if targets.is_empty() {
-            plan.unrunnable.push(spec);
-            continue;
-        }
+        debug_assert!(!targets.is_empty());
 
         let mut to_launch = Vec::new();
         for target in targets {

src/run.rs

@@ -380,6 +380,9 @@ impl CrashLoop {
 /// Owned, human-readable summary of one reconcile+execute pass (no borrows of the plan/specs).
 #[derive(Debug, Default, PartialEq, Eq)]
 pub struct UpReport {
+    /// The pass could not obtain an authoritative session snapshot, so it deliberately performed no
+    /// reconciliation. Long-running supervisors retry; a one-shot caller must exit unsuccessfully.
+    pub skipped: bool,
     /// pty ids spawned this pass.
     pub launched: Vec<String>,
     /// pty ids torn down (retired agents) this pass.
@@ -410,7 +413,8 @@ impl UpReport {
     /// True when the pass actually changed something (or hit an error) — used to keep the loop's log
     /// quiet on no-op ticks.
     pub fn is_noteworthy(&self) -> bool {
-        !self.launched.is_empty()
+        self.skipped
+            || !self.launched.is_empty()
             || !self.torn_down.is_empty()
             || !self.gc.is_empty()
             || !self.flapping.is_empty()
@@ -640,6 +644,7 @@ fn reconcile_pass(
     let sessions = match runner.list_sessions() {
         Ok(s) => s,
         Err(e) => {
+            report.skipped = true;
             report
                 .errors
                 .push(format!("list sessions (pass skipped): {e}"));
@@ -798,6 +803,7 @@ pub fn reconcile_pass_specs(
     let sessions = match runner.list_sessions() {
         Ok(s) => s,
         Err(e) => {
+            report.skipped = true;
             report
                 .errors
                 .push(format!("list sessions (pass skipped): {e}"));

src/shepherd.rs

@@ -550,6 +550,7 @@ mod tests {
             restart: None,
             tasks: vec![Task {
                 kind: TaskKind::Pty,
+                derived: false,
                 name: "agent".into(),
                 id: None,
                 command: Some(command.into()),
@@ -1005,6 +1006,7 @@ mod tests {
         let mut wrong_agent = root("root", "exec claude");
         wrong_agent.tasks.push(Task {
             kind: TaskKind::Exec,
+            derived: false,
             name: "audit".into(),
             id: None,
             command: Some("exec codex".into()),