Re-armable atime sensor + --sensor selector (#28, #100)

[LiorFink00]

Adds the atime regular-file primary detection layer from the validated layered design (#100), stacked on the FIFO companion (#123).

Why

The FIFO sensor (#123) gives deterministic pid for raw-readers but is a named pipe — a worm that statSync().isFile()-guards, mmaps, or only scan-discovers a path walks past it, and it doesn't satisfy the "normal file" requirement. The atime layer covers exactly those gaps: a normal regular-file bait, detection under every constraint (no kdebug, no mount, no privilege).

What

• Re-armable atime tripwire. The bait's atime is armed to the past (touch -a -t), so a read bumps it; the agent fires and re-arms, so every subsequent read is detectable. The old watch_atime fired at most once under APFS relatime — the core bug.
• --sensor auto|fifo|atime (default auto). atime forces a regular-file bait + the atime watcher on any platform (incl. Linux), making the layer selectable and testable.
• read_atime() helper centralizes the Agent atime fallback sensor is broken #28 stat-order fix (GNU %X before BSD %a) — DRY across the one call site; arm_atime() arms/re-arms.
• Detection-only (no pid by design — the FIFO companion supplies pid; a best-effort churn-ledger shortlist for atime-only trips is the next FIFO sensor follow-ups (deferred from #123) #124 item).

Validated

On macOS 26.5.1: armed→read→bump→fire→re-arm→read→fire confirmed; relatime bumps atime on read.

Tests

• New tests/test_agent_atime.py (2): plant-as-regular-file + arm, and the re-arm cycle — driven by os.utime() so it's deterministic regardless of the filesystem's relatime policy, cross-platform.
• Updated the Agent atime fallback sensor is broken #28 stat-order guard for the single-helper refactor.
• Full suite: 260 passed, 1 skipped; shellcheck -S error clean.

Closes part of #28 (re-armable + primary-layer role). Implements the atime layer of #100 / #124.

🤖 Generated with Claude Code

Relates to #28 (broken atime sensor) and #100 (sensor refactor).

[AnguIar]

Finding 1 — Switching from FIFO to atime mode after a hard-kill hangs the agent (line 375)

The agent can run in two modes: FIFO (named pipes) and atime (regular files). If a FIFO-mode agent is force-killed, the named pipes stay on disk. On restart with --sensor atime, the FIFO cleanup step is skipped (FIFO_MODE=0, so the remove_fifos guard fails). When the agent tries to plant baits, it writes content into those leftover named pipe paths with curl. Writing to a named pipe with no reader blocks forever — the agent hangs at startup with no error.

Finding 2 — Re-planted atime bait fires a false-positive alert (line 904)

The atime sensor works by setting each bait's "last accessed" timestamp to the year 2000. A read jumps it to the present; the agent detects the jump and fires. If a bait is deleted mid-run and re-planted, the new file's timestamp is set to now, not year 2000 — nobody arms it. The watcher still holds its old baseline (year 2000), sees the jump from 2000 to 2025, and fires a ghost alert with no actual read.

Finding 3 — --sensor fifo accepted but silently ignored on Linux (line 918)

The --sensor flag accepts auto, fifo, and atime. Passing --sensor atime forces atime mode. But --sensor fifo doesn't force FIFO mode — it falls through to auto-detection. On macOS that happens to pick FIFO anyway, but on Linux auto-detection picks inotify or atime. The agent runs a different sensor than requested with no warning.

[LiorFink00]

@AnguIar all of your findings are addressed, and the branch is now reconciled with current main (merged #177 ruff + #178 interval validation) and CI-clean (test ubuntu+macOS, ruff, CodeQL). Fixes: F1 FIFO→atime hang, F2 ghost-alert re-arm, F3 --sensor fifo forcing. Re-requesting review when you have a moment 🙏

[avivhalfon11]

LGTM