Add Agent Machine executor adapter and evidence contract

[mdheller]

Context

AgentPlane already owns the evidence-forward execution lifecycle: Bundle -> Validate -> Place -> Run -> Evidence -> Replay.

The SourceOS Agent Machine workspace should become a first-class executor target so local Mac/Windows/Linux operator machines can run governed agent bundles inside a Podman-backed Linux workspace while emitting existing AgentPlane artifacts.

Scope

Add an executor adapter concept for Agent Machine:

• executor.kind = agent-machine
• executor.runtime = podman-machine | podman-native | wsl-podman | lima | qemu
• workspace.profileRef = AgentMachineProfile URI/hash
• workspace.fingerprintRef = AgentMachineFingerprint URI/hash
• workspace.mounts[] explicit repo/cache mounts
• workspace.toolSurface[] declared tool grants

Required behavior v0

• Validate bundle compatibility with AgentMachineProfile.
• Place only when host fingerprint and policy match the bundle requirements.
• Run via a delegated local CLI (sourceosctl agent-machine run ...) or equivalent adapter boundary.
• Emit normal Validation, Placement, Run, Replay artifacts.
• Add AgentMachine-specific evidence fields without breaking existing schemas.
• Record image digest, container ID/name, Podman machine name, git ref, mounted paths, tool surface, and policy hash.

Acceptance criteria

• Docs updated under docs/executors.md or integration docs.
• Schema patch or example demonstrates agent-machine executor placement.
• Demo bundle can target the adapter in dry-run mode.
• No host credentials or local paths outside examples are committed.

Non-goals

• Do not implement the local Podman CLI engine here if it belongs in sourceos-devtools.
• Do not bypass existing Validate/Place/Run/Evidence/Replay lifecycle.
• Do not treat arbitrary host shell execution as an AgentPlane run.

[mdheller]

SourceOS Agent Machine Local Data Plane contracts are now available in SourceOS-Linux/sourceos-spec on main.

Schemas to consume or reference:

• schemas/AgentMachineLocalDataPlane.json
• schemas/AgentMachineMountPolicy.json
• schemas/TopoLVMPlacementProfile.json

Examples:

• examples/agent_machine_local_data_plane_macos.json
• examples/agent_machine_mount_policy_default.json
• examples/topolvm_placement_profile_agent_machine.json

AgentPlane evidence implication:

• Placement/run artifacts should record localDataPlaneRef, mountPolicyRef, storage backend, host path class, internal mount path, access mode, policy hash, git ref when applicable, and TopoLVM node/PVC/PV metadata when the backend is topolvm-local-pv.
• Browser downloads are a distinct path class and should be treated as browser read/write + agent read-only by default.
• Downloads promoted into code or document-output space require explicit evidence, not silent file movement.

[mdheller]

Triage — Agent Machine executor adapter and evidence contract: Design. AgentPlane → Agent Machine execution adapter + evidence contract. Depends on Agent Machine contract.