Integrate local agent-machine execution with Workspace Operation Plane

[mdheller]

Purpose

Make agent-machine the governed local execution substrate for SourceOS agents, tools, containers, local models, and enterprise/user network profiles.

Required operation types

• agent_machine.profile.create
• agent_machine.execution.start
• agent_machine.execution.cancel
• agent_machine.tool_grant.apply
• agent_machine.tool_grant.revoke
• agent_machine.container.run
• agent_machine.model_provider.bind
• agent_machine.diagnostics.export_redacted

Required profiles

• personal profile
• corporate firewall profile
• multi-corporate firewall profile
• local model provider profile
• hosted model provider profile
• airgapped/local-only profile
• user-owned model profile

Required artifacts

• AgentMachineProfile
• LocalAgentExecution
• ToolGrantRecord
• ContainerExecutionRecord
• ModelProviderBinding
• AgentMachineDiagnosticBundle

Required controls

• Delegated authority for every local agent action.
• Policy gates for tool grants, model provider use, network profile, container execution, and artifact access.
• Budget dimensions: model calls, tokens, connector calls, CPU/GPU, local disk, sandbox memory, wall-clock runtime, agent concurrency.
• OperationEvents for start/progress/failure/retry/cancel/complete.
• Redacted diagnostics with no credentials, tokens, local secrets, or sensitive prompts.

Integration targets

• SocioProphet/agentplane#85
• SocioProphet/agent-registry
• SocioProphet/mcp-a2a-zero-trust
• SocioProphet/model-router
• SocioProphet/guardrail-fabric
• SocioProphet/policy-fabric#46
• SocioProphet/prophet-core-contracts#1
• SourceOS-Linux/sourceos-spec#87
• SociOS-Linux/workstation-contracts#28
• SourceOS-Linux/sourceos-devtools#19

Acceptance criteria

• Local agent execution is represented as WorkspaceOperation and OperationTask state.
• Tool grants and revocations are auditable operation commands.
• Model provider use is explicit, profile-bound, and policy-gated.
• Enterprise firewall profiles and personal/user-owned model profiles are separate and inspectable.
• Agent-machine never writes durable workspace state outside OperationContract.

Hard rule

Local agent execution must not imply ambient authority. Every action needs delegation, scope, budget, policy profile, and audit.

[mdheller]

@copilot please implement this as a bounded agent-machine Operation Plane integration slice.

Scope:

• Add operation-shaped records/examples for profile create, execution start/cancel, tool grant apply/revoke, container run, model provider bind, diagnostics export.
• Add profiles for personal, corporate firewall, multi-corporate firewall, local model provider, hosted model provider, airgapped/local-only, and user-owned model.
• Add artifact examples for AgentMachineProfile, LocalAgentExecution, ToolGrantRecord, ContainerExecutionRecord, ModelProviderBinding, AgentMachineDiagnosticBundle.
• Add budget/profile fields: tokens, model calls, connector calls, CPU/GPU, local disk, sandbox memory, wall-clock runtime, agent concurrency.

Use current seams:

• SocioProphet/prophet-core-contracts#1.
• SocioProphet/prophet-platform#376 command/boundary shape.
• SocioProphet/agent-registry#16 and SocioProphet/agentplane#85.
• SocioProphet/mcp-a2a-zero-trust#4.
• SourceOS-Linux/sourceos-devtools#19.

Validation:

• Add fixtures/tests for profile creation, allowed local execution, denied tool grant, revoked grant, model provider binding, and redacted diagnostics.
• Do not implement real container execution, model calls, policy rules, or ledger persistence here.

PR evidence required:

• Summary of files changed.
• Validation commands run and output.
• Explanation of how local agent execution avoids ambient authority.