fix(fleet-state): create .bak before write + validate TMP before promote (replay of e0e326f)

[antfleet-ops]

Bench replay of upstream aaronjmars/aeon#203 (commit e0e326f).

This PR triggers AntFleet's review pipeline against aeon's .bak + TMP-validate change. Patch Agent v1.5 is enabled for this install as the v1.5 canary — expect a suggestion block in the review comment when both reviewers (Opus 4.7 + GPT-5) agree on a localized fix.

Source: https://github.com/aaronjmars/aeon/pull/203

[antfleet]

AntFleet · 2 findings

Both reviewers flagged the items below on the changed files. AntFleet posts only what two independent frontier models agree on.

---

Bug · High — jq pipeline for SPOTLIGHT_PICK fails when history is empty
skills/fleet-state/SKILL.md:113-117

If contributor-spotlight history is empty, SPOTLIGHT_PICK becomes an empty string. Piping empty input to jq (without -n) causes a parse error and a non-zero exit, aborting the run. This violates the "degrade gracefully" intent.

Fix: Avoid echo | jq on possibly empty input. Either extract both fields directly from the file with a single jq call (e.g., jq -r '(.history | sort_by(.featured_at) | .[-1]) // {} | [.fork, .featured_at] | @TSV' ...) or guard: if [ -n "$SPOTLIGHT_PICK" ]; then ... fi. Alternatively, use jq -n with inpu…

---

Docs-gap · Low — Step 2 'Resolve parent repo' contradicts the Sandbox note's no-gh-api claim
skills/fleet-state/SKILL.md:79-86

The Sandbox note asserts the skill performs 'No gh api calls,' but Step 2 explicitly runs gh api repos/... (and gh repo view) to resolve the parent repo when PARENT_OVERRIDE is empty. This is a deceptive doc — an operator reading the security/sandbox section would believe the skill is hermetic local I/O when in fact it shells out to GitHub on every non-override run.

Fix: Either remove the gh api invocation in Step 2 (e.g., cache PARENT_REPO from an existing state file, or require the override), or update the Sandbox note to declare the single gh api repos/<self> call used purely to discover the parent repo's full_name.

—

_{Review 1939cc1e · claude-opus-4-7 + gpt-5 (unanimous) · 265s · ~$0.40}