eval: prove content-addressed catalog admission

CATALOG.md

@@ -1,7 +1,7 @@
 <!-- Generated by bin/generate-catalog.sh from cell KDL and evidence/*.tsv. Do not edit. -->
 # Current eval catalog and evidence
 
-This is the sole current corpus surface: **43 included cells** (12 model-free,
+This is the sole current corpus surface: **46 included cells** (15 model-free,
 31 model-backed) and **4 retired exclusions**. Inventory fields are derived from the active
 KDL and executable judge scripts. Latest accepted PASS evidence remains distinct from the append-only run
 history: a failed last run is visible without being advertised as accepted evidence, and cells with no
@@ -16,6 +16,9 @@ harness-native loader plus canonical hook file.
 
 | Cell | Harness | Model(s) / effort | Model seats | Cost | Timeout | Held-out judges | Latest accepted PASS | Last recorded run |
 |---|---|---|---:|---|---|---:|---|---|
+| `agent-spec-lifecycle-catalog-prepare` | model-free | — | 0 | none | `60s` | 4 | — | **NO STRUCTURED RUN** |
+| `agent-spec-lifecycle-catalog-publish-cas` | model-free | — | 0 | none | `90s` | 5 | — | **NO STRUCTURED RUN** |
+| `agent-spec-lifecycle-catalog-root-atomicity` | model-free | — | 0 | none | `120s` | 7 | — | **NO STRUCTURED RUN** |
 | `context-resource-continuity` | model-free | — | 0 | none | `90s` | 4 | — | **NO STRUCTURED RUN** |
 | `crash-ding` | mixed | `claude-sonnet-5+gpt-5.6-sol` / medium | 4 | high | `180s` | 5 | — | **NO STRUCTURED RUN** |
 | `ding-mode` | Claude | `claude-sonnet-5` / medium | 2 | medium | `1200s` | 4 | — | **NO STRUCTURED RUN** |
@@ -79,6 +82,9 @@ while the last-run column makes a recorded failure distinct from a cell with no
 
 ## Harness hook exclusions
 
+- `agent-spec-lifecycle-catalog-prepare` / `cell` — deterministic content-addressed prepare probe; no harness seat
+- `agent-spec-lifecycle-catalog-publish-cas` / `cell` — deterministic immutable staging and CAS probe; no harness seat
+- `agent-spec-lifecycle-catalog-root-atomicity` / `cell` — deterministic multi-seat catalog-root transaction probe; no harness seat
 - `context-resource-continuity` / `cell` — deterministic native context/resource restart probe; no harness seat
 - `docs` / `judge:cold-reader` — one-shot offline Claude print grader; no bus identity, DING, or hook surface
 - `exec-lifecycle-logging` / `cell` — deterministic native exec lifecycle probe; no harness seat
@@ -93,7 +99,7 @@ while the last-run column makes a recorded failure distinct from a cell with no
 - `st2-network` / `cell` — deterministic catalog/message round-trip probe; no harness seat
 - `two-networks-coexist` / `cell` — deterministic catalog-isolation probe; no harness seat
 
-These **13** rows are generated from structured exclusions. A cell-level row is required for
+These **16** rows are generated from structured exclusions. A cell-level row is required for
 every derived model-free cell. The one-shot docs cold reader is a model-backed grader, but not a bus-connected
 agent: it has no st2 identity, DING sidecar, or lifecycle hooks.
 

cells/agent-spec-lifecycle-catalog-prepare/README.md

@@ -0,0 +1,6 @@
+# agent-spec-lifecycle-catalog-prepare
+
+Product-conformance cell for the first content-addressed catalog boundary. It
+invokes `st2 catalog prepare` directly and proves that prepare imports the exact
+Agent Spec bytes idempotently without creating a catalog root or making the
+seat visible.

cells/agent-spec-lifecycle-catalog-prepare/agent-spec-lifecycle-catalog-prepare.kdl

@@ -0,0 +1,23 @@
+eval {
+  copy "./fixture"
+  max-timeout "60s"
+
+  run "exercise" {
+    command "bash ./exercise.sh"
+  }
+
+  judges {
+    judge "PRODUCT SURFACE — st2 persists exact prepared Agent Spec bytes" {
+      exec "test \"$(cat $CATALOG/results/prepare.code)\" = 0"
+    }
+    judge "HEAD UNCHANGED — prepare imports an object without publishing the seat" {
+      exec "bash ./judges/head-unchanged.sh"
+    }
+    judge "SOURCE SNAPSHOT — later source mutation cannot change the prepared object" {
+      exec "bash ./judges/source-snapshot.sh"
+    }
+    judge "IDEMPOTENT IMPORT — identical byte preparation returns one object identity" {
+      exec "bash ./judges/idempotent.sh"
+    }
+  }
+}

cells/agent-spec-lifecycle-catalog-prepare/fixture/exercise.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+results="$CATALOG/results"
+network="$CATALOG/network"
+spec="$CATALOG/source/agents/h/seat/agent.kdl"
+mkdir -p "$results" "$CATALOG/expected"
+cp "$spec" "$CATALOG/expected/agent.kdl"
+
+capture() {
+  local name=$1
+  shift
+  set +e
+  "$@" >"$results/$name.json" 2>"$results/$name.err"
+  local code=$?
+  set -e
+  printf '%s\n' "$code" >"$results/$name.code"
+}
+
+capture head-before st2 --catalog "$network" catalog head
+capture prepare st2 --catalog "$network" catalog prepare "$spec"
+capture prepare-again st2 --catalog "$network" catalog prepare "$spec"
+
+# Source bytes are mutable after the import. The catalog object is not.
+printf '\n// later source mutation\n' >>"$spec"
+capture head-after st2 --catalog "$network" catalog head

cells/agent-spec-lifecycle-catalog-prepare/fixture/source/agents/h/seat/agent.kdl

@@ -0,0 +1,5 @@
+agent "seat" {
+  identity "seat"
+  host "h"
+  command "exec sleep 3600"
+}

cells/agent-spec-lifecycle-catalog-prepare/judges/head-unchanged.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -euo pipefail
+test "$(cat "$CATALOG/results/head-before.code")" = 0
+test "$(cat "$CATALOG/results/head-after.code")" = 0
+jq -e '. == null' "$CATALOG/results/head-before.json" >/dev/null
+jq -e '. == null' "$CATALOG/results/head-after.json" >/dev/null

cells/agent-spec-lifecycle-catalog-prepare/judges/idempotent.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -euo pipefail
+test "$(cat "$CATALOG/results/prepare-again.code")" = 0
+a=$(jq -er .object "$CATALOG/results/prepare.json")
+b=$(jq -er .object "$CATALOG/results/prepare-again.json")
+test "$a" = "$b"

cells/agent-spec-lifecycle-catalog-prepare/judges/source-snapshot.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -euo pipefail
+object_path=$(jq -er .objectPath "$CATALOG/results/prepare.json")
+test -f "$object_path"
+cmp "$CATALOG/expected/agent.kdl" "$object_path"

cells/agent-spec-lifecycle-catalog-publish-cas/README.md

@@ -0,0 +1,6 @@
+# agent-spec-lifecycle-catalog-publish-cas
+
+Product-conformance cell for explicit immutable staging. Ref CAS expects a
+parent commit identity, not only an object identity, so A-B-A cannot revive a
+stale writer. Operation replay is idempotent, manager ownership is fenced, and
+none of the staging operations changes the selected catalog root.

cells/agent-spec-lifecycle-catalog-publish-cas/agent-spec-lifecycle-catalog-publish-cas.kdl

@@ -0,0 +1,26 @@
+eval {
+  copy "./fixture"
+  max-timeout "90s"
+
+  run "exercise" {
+    command "bash ./exercise.sh"
+  }
+
+  judges {
+    judge "PRODUCT SURFACE — explicit immutable staging is supported" {
+      exec "test \"$(cat $CATALOG/results/setup.code)\" = 0"
+    }
+    judge "LOST ACK — replaying one request returns the original ref commit" {
+      exec "bash ./judges/lost-ack.sh"
+    }
+    judge "MANAGER FENCE — a foreign manager cannot move or adopt the head" {
+      exec "bash ./judges/manager-fence.sh"
+    }
+    judge "ABA FENCE — stale parent ref fails after A -> B -> A" {
+      exec "bash ./judges/aba-fence.sh"
+    }
+    judge "ROOT UNCHANGED — staging never changes catalog visibility" {
+      exec "bash ./judges/root-unchanged.sh"
+    }
+  }
+}

cells/agent-spec-lifecycle-catalog-publish-cas/fixture/exercise.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+results="$CATALOG/results"
+network="$CATALOG/network"
+spec_a="$CATALOG/source/a/agents/h/seat/agent.kdl"
+spec_b="$CATALOG/source/b/agents/h/seat/agent.kdl"
+mkdir -p "$results" "$network/agents/h/seat/resources"
+
+capture() {
+  local name=$1
+  shift
+  set +e
+  "$@" >"$results/$name.json" 2>"$results/$name.err"
+  local code=$?
+  set -e
+  printf '%s\n' "$code" >"$results/$name.code"
+}
+
+stage() {
+  local name=$1 spec=$2 manager=$3 operation=$4
+  shift 4
+  capture "$name" st2 --catalog "$network" catalog stage "$spec" \
+    --manager "$manager" \
+    --state-relative agents/h/seat \
+    --operation-id "$operation" \
+    "$@"
+}
+
+capture head-before st2 --catalog "$network" catalog head
+stage publish-a "$spec_a" nix stage-a
+cp "$results/publish-a.code" "$results/setup.code"
+
+ref_a=$(jq -er .refCommit "$results/publish-a.json")
+binding_a=$(jq -er .resourceBindingCommit "$results/publish-a.json")
+
+# Simulate an acknowledged result being lost, then replay the same operation.
+stage replay-a "$spec_a" nix stage-a
+
+# A foreign manager must not advance a Nix-owned ref.
+stage foreign "$spec_b" human foreign \
+  --expected-ref "$ref_a" --binding-parent "$binding_a"
+
+# Advance A -> B -> A with immutable parent commits.
+stage publish-b "$spec_b" nix stage-b \
+  --expected-ref "$ref_a" --binding-parent "$binding_a"
+ref_b=$(jq -er .refCommit "$results/publish-b.json")
+binding_b=$(jq -er .resourceBindingCommit "$results/publish-b.json")
+
+stage publish-a2 "$spec_a" nix stage-a2 \
+  --expected-ref "$ref_b" --binding-parent "$binding_b"
+ref_a2=$(jq -er .refCommit "$results/publish-a2.json")
+printf '%s\n' "$ref_a2" >"$results/expected-final-ref"
+
+# The ref points at A again, but the old A parent commit is stale.
+stage stale "$spec_b" nix stale-a-parent \
+  --expected-ref "$ref_a" --binding-parent "$binding_a"
+stage replay-a2 "$spec_a" nix stage-a2 \
+  --expected-ref "$ref_b" --binding-parent "$binding_b"
+
+capture head-after st2 --catalog "$network" catalog head

cells/agent-spec-lifecycle-catalog-publish-cas/fixture/source/a/agents/h/seat/agent.kdl

@@ -0,0 +1,8 @@
+agent "seat" {
+  identity "seat"
+  host "h"
+  pty "agent" {
+    id "h.seat.agent"
+    command "exec echo a; sleep 3600"
+  }
+}

cells/agent-spec-lifecycle-catalog-publish-cas/fixture/source/b/agents/h/seat/agent.kdl

@@ -0,0 +1,8 @@
+agent "seat" {
+  identity "seat"
+  host "h"
+  pty "agent" {
+    id "h.seat.agent"
+    command "exec echo b; sleep 3600"
+  }
+}

cells/agent-spec-lifecycle-catalog-publish-cas/judges/aba-fence.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euo pipefail
+test "$(cat "$CATALOG/results/publish-b.code")" = 0
+test "$(cat "$CATALOG/results/publish-a2.code")" = 0
+test "$(cat "$CATALOG/results/stale.code")" != 0
+test "$(cat "$CATALOG/results/replay-a2.code")" = 0
+test "$(jq -er .refCommit "$CATALOG/results/replay-a2.json")" = \
+  "$(cat "$CATALOG/results/expected-final-ref")"

cells/agent-spec-lifecycle-catalog-publish-cas/judges/lost-ack.sh

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+set -euo pipefail
+test "$(cat "$CATALOG/results/replay-a.code")" = 0
+test "$(jq -er .refCommit "$CATALOG/results/publish-a.json")" = \
+  "$(jq -er .refCommit "$CATALOG/results/replay-a.json")"
+test "$(jq -er .resourceBindingCommit "$CATALOG/results/publish-a.json")" = \
+  "$(jq -er .resourceBindingCommit "$CATALOG/results/replay-a.json")"

cells/agent-spec-lifecycle-catalog-publish-cas/judges/manager-fence.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -euo pipefail
+test "$(cat "$CATALOG/results/foreign.code")" != 0
+# The next Nix stage still succeeds from the pre-foreign expected ref, proving
+# the rejected manager did not move it.
+test "$(cat "$CATALOG/results/publish-b.code")" = 0

cells/agent-spec-lifecycle-catalog-publish-cas/judges/root-unchanged.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+test "$(cat "$CATALOG/results/head-before.code")" = 0
+test "$(cat "$CATALOG/results/head-after.code")" = 0
+jq -e '. == null' "$CATALOG/results/head-before.json" >/dev/null
+jq -e '. == null' "$CATALOG/results/head-after.json" >/dev/null
+
+for result in publish-a replay-a publish-b publish-a2 replay-a2; do
+  jq -e '.rootChanged == false' "$CATALOG/results/$result.json" >/dev/null
+done

cells/agent-spec-lifecycle-catalog-root-atomicity/README.md

@@ -0,0 +1,11 @@
+# agent-spec-lifecycle-catalog-root-atomicity
+
+Product-conformance cell for catalog-root transactions.
+
+Two seats are staged without changing visibility. Root CAS rejects a stale
+writer, and graph validation rejects a cross-seat ref/binding join without
+moving the root. A valid two-seat Nix admission then commits both changes under
+one root identity; concurrent readers see only complete old/new roots. Finally,
+a dynamic manager admits a distinct seat without changing either Nix admission,
+while both managers remain fenced from the other's refs. Corrupting an admitted
+immutable object then makes resolution fail closed.

cells/agent-spec-lifecycle-catalog-root-atomicity/agent-spec-lifecycle-catalog-root-atomicity.kdl

@@ -0,0 +1,32 @@
+eval {
+  copy "./fixture"
+  max-timeout "120s"
+
+  run "exercise" {
+    command "bash ./exercise.sh"
+  }
+
+  judges {
+    judge "PRODUCT SURFACE — immutable root commits are supported" {
+      json "results/outcomes.json" field "surface" is #true
+    }
+    judge "ROOT CAS — a separately-valid stale seat patch cannot cross a newer root" {
+      json "results/outcomes.json" field "staleRootRejected" is #true
+    }
+    judge "GRAPH VALIDATION — a cross-seat ref/binding join cannot change the root" {
+      json "results/outcomes.json" field "invalidGraphRejected" is #true
+    }
+    judge "ATOMIC NIX PATCH — two seat changes publish under exactly one new root commit" {
+      json "results/outcomes.json" field "nixPatchOneRoot" is #true
+    }
+    judge "NO MIXED SNAPSHOT — readers observe only the old or new complete root" {
+      json "results/outcomes.json" field "noMixedSnapshot" is #true
+    }
+    judge "MIXED MANAGERS — dynamic admission preserves Nix seats and ref ownership" {
+      json "results/outcomes.json" field "mixedManagersPreserved" is #true
+    }
+    judge "CORRUPTION CLOSED — an admitted object digest mismatch cannot be inspected" {
+      json "results/outcomes.json" field "corruptionRejected" is #true
+    }
+  }
+}