Agent Native

Launch and observe caller-selected agent sessions as explicit roles, and return runtime facts per packet. Execution does not validate output, and the runtime never becomes AgentOps lifecycle authority: an adapter cannot select AgentOps semantics, issue a binding verdict, or turn factory completion into delivery or validation proof. Orchestrate decides what to dispatch and when; this skill launches and observes.

Before launch, and while running

• Validate the whole batch first. Every packet needs its selected executor, packet identity, all transitive effects and a canonical workspace-relative write scope in separate isolation. If any packet is invalid, launch none: starting the valid ones and fixing the rest later is a partial launch.
• Compare canonical scopes. Resolve symlinks, normalize paths and compare case-insensitively so an alias cannot hide a collision. A lexical check alone cannot prove symlink or runtime isolation.
• Delivery is not engagement. A delivered prompt or an acknowledgement proves transport only; reading it as a working worker is prompt-send optimism. Prove engagement from observable state: session output, tool activity, changed files.
• Capture before restart. Before a nudge, replacement or restart, capture the worker's observable state. A restart destroys the evidence of why it stalled, and rescue is usually cheaper than rerun. Silence or impatience alone does not justify a restart; any replacement stays within authority and remaining bounds.
• Dispatch once. Keep each packet's identity with its result. An executor error is a result, not a retry trigger; repair and follow-up are the caller's authority.

Roles

• Orchestrator: passes focused intent, scope and evidence references, names the integration/final-review owner, and reports runtime facts. Retrieve extra history only for a consequential uncertainty; a fresh context is not necessarily small. A new goal does not clear history or renew spent bounds.
• Implementer: may modify only its packet's declared subject.
• Validator: receives exact candidate content in a fresh, read-only context. It may supply judgment to Validate; only Validate writes verdict.v2.
• Scribe: records runtime evidence without judging acceptance.

Reader and Writer are bounded cheap delegations, not roles with authority. A Reader returns line-referenced bullets over files the caller never loads, in slices of at most 350 lines. A Writer lands one patterned file from a spec plus a required reference file and returns a receipt the caller never reads back. Both are caller-selected per call and yield runtime facts only; a receipt is not validation. For Codex, use the source-owned bulk-reader and code-writer native roles; their model and sandbox are pinned in agents/bulk-reader.toml and agents/code-writer.toml. Context-budget delegation covers installation, native invocation, opt-in refusal hooks and the limits of role instructions.

Launch and observe

1. Before starting a worker, require caller intent, role, workspace, authorized source/output scope and evidence destination. Record the dispatch association in the caller-owned native channel before execution can fail. A requested ID is not an observed ID; worker identity stays unknown until the runtime reports it.
2. At startup, before substantive work, capture the observed runtime, session and context identity and return it through that channel. Report launch failures, recording gaps and unknowns; never fill them in. Session associations owns parent and resume links, multi-work spans and frozen source bounds.
3. Keep concurrent writers disjoint and isolated. Runtime coordination is not a claim, lease, queue or completion state in AgentOps.
4. Observe through native waits or status notifications; observation costs time and context. Unchanged state is no reason for another analysis, review or retrospective, while a known blocking failure deserves action even as other jobs run. Stop at terminal status or the end of the caller's window.
5. For new authorized work after a worker completes, use the runtime's documented follow-up or resume operation that starts a turn. A message operation only queues text for a running worker; a queued repair request is not a resumed attempt.
6. Record provider state, transcript references, artifacts and terminal status. Provider retries, reconnects, idle states and failures stay runtime facts, never Plan, Candidate or verdict state.

The batch contract's reference implementation, scripts/swarm/dispatch_once.py, needs an AgentOps source checkout and is not bundled with installed skills; installed use dispatches through the selected native runtime. It rejects a nonempty write_scope.exclude because its proof cannot honor exclusions. Batch mode selects no backlog work, creates no queue and integrates no changes.

Adapters and judgment

NTM, native processes, Agent Mail, Gas City and the one-shot headless runners (codex-exec, claude-exec, agy-native) are replaceable adapters. Use one only when the caller selected that execution shape; a single local agent pays no factory coordination cost.

For judgment, default to a fresh context in the author's model family. Cross-model Validate, mixed Council and dueling model perspectives are explicit caller selections. Model dispatch owns host authorization, isolation, finite input/output, timeout and cleanup for each leg; the working session is the controller, no factory is required, and Agent Mail is never the judgment path. Role requests declare authority, but only native runtime/OS filesystem and egress controls enforce it. Native judgment receipts define receipt references and the checks for caller-required model diversity; missing native identity never satisfies a leg. For exact native source spans, follow bounded raw source reads and its access and output limits.

Per-packet result

packet_id:        the caller's packet id
executor:         selected runtime; requested model; observed model if reported
observed_session: session/context id the runtime reported, else unknown
engagement:       observable evidence the worker started, else unobserved
terminal_status:  exit or terminal state | running | launch failed
result:           candidate <ref> | evidence <ref> | error <verbatim>
gaps:             recording failures and unknowns