/agent-native

name: agent-native
description: 'Dispatch independent tasks to parallel workers or selected persistent roles. Use when: delegation is authorized with disjoint scopes; execution does not validate output.'
practices: [team-topologies, design-by-contract]
hexagonal_role: supporting
consumes: [explicit-role-packets]
produces: [runtime-evidence, worker-handoff, per-packet-results]
context_rel:
- kind: customer-of
  with: ntm
- kind: customer-of
  with: codex-exec
- kind: customer-of
  with: agent-mail
skill_api_version: 1
user-invocable: true
metadata:
  tier: meta
  dependencies: []
  capabilities: [role_dispatch, observe_workers, handoff, dispatch_once]
  effects: [manage_runtime_sessions, invoke_selected_executor]
  canonical_status: canonical
  disposition: keep_optional_adapter
output_contract: runtime evidence and per-packet candidate, evidence, or error for explicit authorized work

Agent Native

Operate caller-selected agent sessions as explicit roles without turning the runtime into AgentOps lifecycle authority.

For judgment, default to a fresh context in the author's model family. Cross-model Validate, mixed Council and dueling model perspectives are explicit caller selections. Follow [references/model-dispatch.md](references/model-dispatch.md): the working session is the controller; check the explicitly selected adapter at runtime; no factory is required and Agent Mail is never the judgment path. The recipe owns host authorization, finite input/output, timeout and cleanup requirements.

Role requests declare authority; actual native runtime/OS filesystem and egress controls must enforce it. A prompt, worktree, chmod or unrestricted same-user process does not establish isolation. Observe synthetic canary denials before restricted-source work; unavailable protection remains unavailable.

Use native waits or status notifications while workers or checks are pending. Unchanged state is no reason for another analysis, review or provisional retrospective. Observation consumes time and context; it is not free. A known blocking failure deserves action even while other jobs run. For a suspected stall, inspect observable state before choosing a nudge or replacement within authority and remaining bounds. Stop observing at terminal status or the end of the caller's observation window; impatience alone does not justify restart.

Named failure mode — **prompt-send optimism**: treating a successfully delivered prompt as a working worker; delivery proves transport, not engagement.

For new authorized work after a worker completes, use the selected runtime's documented follow-up or resume operation that starts a turn. A message operation may only queue text for a running worker. Check native state and engagement; do not treat a queued repair request as a resumed implementation attempt.

Anti-pattern: restarting an unresponsive worker as the first move. Corrective: capture its observable state first — a restart destroys the evidence of why it stalled, and rescue is usually cheaper than rerun.

Roles

• **Orchestrator:** passes focused intent, scope and evidence references, names

the integration/final-review owner, and reports runtime facts. Retrieve extra history only for a consequential uncertainty; a fresh context is not necessarily small. A new goal does not clear history or renew spent bounds.

• **Implementer:** may modify only its packet's declared subject.
• **Validator:** receives exact candidate content in a fresh, read-only context.
• **Scribe:** records runtime evidence without judging acceptance.

Reader and Writer are bounded cheap delegations, not roles with authority: a Reader returns line-referenced bullets over files the caller never loads, and a Writer lands one patterned file from a spec plus a reference file and returns a receipt the caller never reads back. Both are caller-selected per call, default to a cheap model, and yield runtime facts only — a receipt is not validation. For Codex, use the source-owned `bulk-reader` or `code-writer` native role (`gpt-5.6-luna`); pass a fresh bounded task and receive findings or a receipt. The reader uses explicit slices of at most 350 lines; the parent keeps file content out of its context. A reference file is required for a writer. See [context-budget delegation](references/context-budget-delegation.md) for installation, native invocation, opt-in refusal hooks and the limits of role instructions.

Contract

For a caller-selected parallel batch, validate every complete packet before the first launch. Require the selected executor, packet identity and all transitive effects, with canonical workspace-relative write scopes in separate isolation. Resolve symlinks and normalize paths; compare scopes case-insensitively so an alias cannot hide a collision. A lexical disjointness check alone cannot prove symlink or runtime isolation. The reference batch contract rejects nonempty `write_scope.exclude` because its proof cannot honor those exclusions.

Dispatch each validated packet once and preserve its identity with the result: candidate, evidence or executor error. Do not partly launch a batch that later fails validation, or retry an error as if it had never happened. Native caller authority determines any repair or follow-up. The developer reference `scripts/swarm/dispatch_once.py` requires an AgentOps source checkout; it is exercised by repository tests and is not bundled with standalone skills. Installed use dispatches through the selected native runtime. This optional batch mode selects no backlog work, creates no queue and integrates no changes.

1. Require caller intent, role, workspace, authorized source/output scope and evidence destination before starting a worker. Pass source-store/project/work identity and permitted intent locators before execution can fail. Record this dispatch association in caller-owned native comments/metadata or runtime facts, with actual worker session/context IDs explicitly unknown