Per-deployment sensor: run FIFO + atime baits together (#100, dual-plant 1/3)

[LiorFink00]

Increment 1 of 3 for the dual-plant pair (FIFO canonical · atime companion). Stacked on #160.

What

Each deployment record gains an optional 6th sensor field (fifo|atime|inotify). The agent plants and watches each bait under its own sensor, so a FIFO bait (definitive pid) and an atime bait (normal-file detection) run side by side from one agent — the foundation for always deploying the pair.

• Parse sensor → dep_sensor_$i; effective_sensor / has_explicit_sensors helpers.
• plant() keys FIFO-vs-regular on the deployment's sensor, not global FIFO_MODE.
• watch_atime → atime_poll "<indices>" (poll a subset); watch_atime() still polls all (homogeneous + degradation fallback).
• New watch_mixed: FIFO baits served individually, the rest atime-polled as a group.
• verify's FIFO-tamper check keys on the deployment's sensor.

Backward-compatible

An absent sensor field → today's global behavior. The existing homogeneous FIFO/atime/inotify paths are byte-for-byte unchanged; watch_mixed only engages once the server sends explicit sensors. So this merges safely before the server (increment 2) sends pairs.

Tests

• New tests/test_agent_mixed.py: a fifo+atime pair from one agent — both plant as the right type (named pipe + armed regular file) and both fire.
• Full suite: 261 passed, 1 skipped; shellcheck -S error clean.

Next

• 2/3 — server pair generation: companion-path table + sensor/pair_id columns + migration; deploying a tripwire emits the FIFO-canonical + atime-companion pair.
• 3/3 — correlation + UI: group a pair's two alerts into one incident via pair_id.

🤖 Generated with Claude Code

Part of #100 (sensor refactor, dual-plant 1/3).

[AnguIar]

Finding 1 — Re-planted FIFO baits go unserved on Linux (line 904)

The watcher restart after a re-plant checks FIFO_MODE=1, but probe_fifo_mode() only sets that flag on macOS. When the server sends sensor=fifo for a Linux deployment, effective_sensor() bypasses the platform check and returns fifo — so the FIFO is planted and served correctly. But if the bait is later deleted and re-planted by verify_planted, the restart guard fails (FIFO_MODE is 0 on Linux) and the new FIFO is never served. The coverage gap is silent and permanent until manual restart.

Finding 2 — --sensor atime override silently bypassed by per-deployment sensors (line 694)

In start_watcher, has_explicit_sensors is checked before $SENSOR = atime. Once the server starts sending sensor fields (increment 2), an operator's explicit --sensor atime flag will be ignored — the agent enters watch_mixed and plants FIFO baits even though the operator specifically asked to avoid them. No warning is logged.

[LiorFink00]

@AnguIar all of your findings are addressed, and the branch is now reconciled with current main (merged #177 ruff + #178 interval validation) and CI-clean (test ubuntu+macOS, ruff, CodeQL). Fixes: F1 Linux re-plant restart, F2 --sensor override precedence. Re-requesting review when you have a moment 🙏

[avivhalfon11]

LGTM - checked both findings, F1 (re-plant restart is now unconditional) and F2 (effective_sensor honors the operator --sensor override first) are both properly fixed.