Merge main into feat/office-quality-gates

Union office.py imports (keep branch's validate_ooxml_artifact + main's runtime contracts);
integrate branch's office quality-gate commands, ooxml validation, and CLI tests.
Restores wrongly-closed feature content.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: mdheller

.github/workflows/operation-conformance.yml

@@ -0,0 +1,26 @@
+name: operation-conformance
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+jobs:
+  smoke:
+    name: SourceOS operation conformance smoke
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Run structural smoke validation
+        run: |
+          python3 tools/sourceos_operation_conformance.py \
+            --examples-dir tests/fixtures/workspace-operation \
+            --structural-only

.sourceos/manifest.json

@@ -0,0 +1,23 @@
+{
+  "repo": "SourceOS-Linux/sourceos-devtools",
+  "domain": "tooling",
+  "specVersion": "0.1.0",
+  "ownedSchemas": [],
+  "syncEngines": [],
+  "sourceChannels": [],
+  "policyClasses": [
+    "high"
+  ],
+  "auditEvents": [
+    "devtools.contract.validated",
+    "devtools.repo.scanned"
+  ],
+  "dangerousSurfaces": [
+    "devtools.schema.validation_bypass",
+    "devtools.repo_scan.incomplete"
+  ],
+  "authorityRepos": [
+    "SourceOS-Linux/sourceos-spec"
+  ],
+  "notes": "Developer/operator tooling surface for SourceOS contract validation, repo scanning, graph doctor, sync doctor, and policy explanation commands."
+}

Makefile

@@ -1,6 +1,6 @@
-.PHONY: validate test
+.PHONY: validate test scan-local-persistence validate-local-agents validate-local-agent-templates check-local-agent-drift validate-reasoning-cli validate-portable-ai validate-packaging
 
-validate: test
+validate: test scan-local-persistence validate-local-agents validate-local-agent-templates check-local-agent-drift validate-reasoning-cli validate-portable-ai validate-packaging
 	@test -f README.md
 	@test -f AGENTS.md
 	@test -f .github/copilot-instructions.md
@@ -11,3 +11,29 @@ validate: test
 test:
 	@python3 -m pip install --user jsonschema >/dev/null
 	@python3 -m unittest discover -s tests -v
+
+scan-local-persistence:
+	@python3 scripts/scan_local_persistence.py . --fail-on none
+
+validate-local-agents:
+	@python3 scripts/validate_local_agents.py .
+
+validate-local-agent-templates:
+	@python3 scripts/validate_local_agent_templates.py .
+
+check-local-agent-drift:
+	@python3 scripts/check_local_agent_registry_drift.py . --fail-on high
+
+validate-reasoning-cli:
+	@python3 bin/sourceosctl reasoning validate tests/fixtures/reasoning/deterministic >/dev/null
+	@python3 bin/sourceosctl reasoning inspect tests/fixtures/reasoning/deterministic >/dev/null
+	@python3 bin/sourceosctl reasoning replay-plan tests/fixtures/reasoning/deterministic >/dev/null
+	@python3 bin/sourceosctl reasoning events tests/fixtures/reasoning/deterministic >/dev/null
+
+validate-portable-ai:
+	@python3 bin/sourceosctl portable-ai profiles >/dev/null
+	@python3 bin/sourceosctl portable-ai preflight /tmp/SOURCEOS_AI --profile tiny-router >/dev/null
+	@python3 bin/sourceosctl portable-ai prepare /tmp/SOURCEOS_AI --profile tiny-router --dry-run >/dev/null
+
+validate-packaging:
+	@python3 scripts/validate_packaging.py

README.md

@@ -16,8 +16,10 @@ It should contain:
 - lab/profile selection utilities;
 - local model-service client helpers;
 - model-router client utilities;
+- Network Door, Firewall Door, Mesh Door, BYOM provider, and Native Assistant Door plan/probe helpers;
 - guardrail/eval/evidence helpers;
 - agent sandbox/run helpers;
+- Local Model Door runtime detection and route planning helpers;
 - Agent Machine local mount and secure host-interface helpers;
 - Office Plane dry-run, guarded execution, inspection, and evidence helpers;
 - fingerprint and proof bundle tools;
@@ -34,7 +36,10 @@ It should not contain:
 - model-router backend;
 - web control plane backend;
 - SourceOS image build state;
-- secrets, tokens, credentials, private keys, or device-specific enrollment secrets.
+- secrets, tokens, credentials, private keys, or device-specific enrollment secrets;
+- firewall mutation engines;
+- service mesh installers;
+- native assistant runtime adapters.
 
 ## sourceosctl CLI
 
@@ -60,6 +65,16 @@ sourceosctl [--version] <command> [<subcommand>] [options]
 | `sourceosctl fingerprint collect --dry-run` | Print environment fingerprint fields (dry-run only) |
 | `sourceosctl ai labs list` | List available AI labs (read-only) |
 | `sourceosctl agents sandbox plan --dry-run` | Print agent sandbox plan (dry-run only) |
+| `sourceosctl local-model doctor` | Inspect local model runtime and installed models without pulling weights or inference |
+| `sourceosctl local-model profiles` | List SourceOS Local Model Door profile refs |
+| `sourceosctl local-model plan --profile local-llama32-1b` | Render local model runtime plan without installing or running models |
+| `sourceosctl local-model route --task-class office-assist` | Render hash-only model route decision under local-first policy |
+| `sourceosctl local-model evidence inspect <path>` | Inspect local model route evidence JSON |
+| `sourceosctl network doctor` | Inspect Network Door contract posture without changing firewall, mesh, or provider state |
+| `sourceosctl network plan --destination <label>` | Render a hash-only Network Door route plan |
+| `sourceosctl network provider` | Render a BYOM / external model provider plan without contacting the provider |
+| `sourceosctl network evidence inspect <path>` | Inspect Network Door evidence JSON |
+| `sourceosctl native-assistant plan` | Render a native assistant bridge plan without invoking host assistant APIs |
 | `sourceosctl agent-machine mounts plan` | Render Agent Machine local mount plan for dev/docs/downloads roots (dry-run) |
 | `sourceosctl agent-machine mounts init --dry-run` | Render mount initialization plan; no directories or mounts are created |
 | `sourceosctl agent-machine mounts init --execute --policy-ok` | Create only scoped local output/download directories and emit AgentMachineMountEvidence |
@@ -74,6 +89,11 @@ sourceosctl [--version] <command> [<subcommand>] [options]
 | `sourceosctl office convert <path> --to <format> --execute --policy-ok` | Run guarded local LibreOffice conversion and emit OfficeArtifactEvidence |
 | `sourceosctl office inspect <path>` | Inspect a local office artifact file and hash it |
 | `sourceosctl office evidence inspect <path>` | Inspect Office Plane evidence JSON (read-only) |
+| `sourceosctl operation conformance --contracts-dir ../prophet-core-contracts` | Run Workspace Operation fixture bundle conformance checks |
+| `sourceosctl operation validate-fixture <path>` | Validate one Workspace Operation fixture |
+| `sourceosctl operation replay-fixture <output> --surface terminal-command\|browser-capture\|local-agent-execution` | Generate a local replay fixture starter |
+| `sourceosctl operation scaffold-adapter <output-dir>` | Scaffold starter adapter skeletons |
+| `sourceosctl diagnostics redact <input> --output <output>` | Export redacted diagnostics (cookies/tokens/keys/IDs/prompts/policy snippets) |
 
 ### Running from the repo
 
@@ -89,6 +109,16 @@ python3 bin/sourceosctl release inspect-archive fixtures/nlboot_release_valid
 python3 bin/sourceosctl fingerprint collect --dry-run
 python3 bin/sourceosctl ai labs list
 python3 bin/sourceosctl agents sandbox plan --dry-run
+python3 bin/sourceosctl local-model doctor
+python3 bin/sourceosctl local-model profiles
+python3 bin/sourceosctl local-model plan --profile local-llama32-1b
+python3 bin/sourceosctl local-model route --task-class office-assist --prompt "local prompt text is hashed only"
+python3 bin/sourceosctl network doctor
+python3 bin/sourceosctl network plan --destination models.enterprise.example
+python3 bin/sourceosctl network plan --enterprise --mesh --allow-listed --destination models.enterprise.example
+python3 bin/sourceosctl network provider --provider-class openai-compatible --owner user
+python3 bin/sourceosctl native-assistant plan --operation open-workroom
+python3 bin/sourceosctl native-assistant plan --operation create-office-artifact --prompt "local prompt text is hashed only"
 python3 bin/sourceosctl agent-machine mounts plan
 python3 bin/sourceosctl agent-machine mounts init --dry-run
 python3 bin/sourceosctl agent-machine mounts init --execute --policy-ok --evidence-out ./mount-evidence.json
@@ -102,8 +132,69 @@ python3 bin/sourceosctl office generate --execute --policy-ok --artifact-type sp
 python3 bin/sourceosctl office generate --execute --policy-ok --artifact-type slide-deck --format pptx --title "Demo Deck" --evidence-out ./office-pptx-evidence.json
 python3 bin/sourceosctl office convert ./example.docx --to pdf --dry-run
 python3 bin/sourceosctl office convert ./example.docx --to pdf --execute --policy-ok --evidence-out ./office-convert-evidence.json
+python3 bin/sourceos operation conformance --contracts-dir ../prophet-core-contracts
+python3 bin/sourceos operation validate-fixture tests/fixtures/workspace-operation/minimal-operation.json --structural-only
+python3 bin/sourceos operation replay-fixture ./tmp-operation-replay.json --surface terminal-command
+python3 bin/sourceos operation scaffold-adapter ./tmp-adapter
+python3 bin/sourceos diagnostics redact ./diagnostic.log --output ./diagnostic.redacted.log
 ```
 
+### Local Model Door defaults
+
+The Local Model Door aligns with:
+
+- `SourceOS-Linux/sourceos-model-carry` for local model profiles;
+- `SocioProphet/model-router` for routing;
+- `SocioProphet/model-governance-ledger` for personal tuning contracts;
+- `SociOS-Linux/socios` for opt-in personalization orchestration.
+
+Default profiles:
+
+| Profile key | Model | Role |
+| --- | --- | --- |
+| `local-llama32-1b` | `llama3.2:1b` | laptop-safe router, triage, summarization, rewrite, Office assist |
+| `local-llama32-3b` | `llama3.2:3b` | quality local fallback |
+
+The Local Model Door does **not** pull model weights, start Ollama, run inference, send prompts off-device, or authorize tool use. `local-model route --prompt ...` emits only a SHA-256 prompt hash.
+
+### Network Door, Mesh Door, BYOM, and Native Assistant Door defaults
+
+The Network/Assistant Door slice aligns with `SourceOS-Linux/sourceos-spec`:
+
+- `NetworkAccessProfile`
+- `FirewallBindingProfile`
+- `MeshBindingProfile`
+- `ExternalModelProviderProfile`
+- `NativeAssistantBridgeProfile`
+
+Default refs:
+
+| Purpose | Ref |
+| --- | --- |
+| Enterprise/user network stack | `urn:srcos:network-access-profile:enterprise-and-user-default` |
+| User firewall profile | `urn:srcos:firewall-binding-profile:macos-lulu-user-default` |
+| Enterprise firewall profile | `urn:srcos:firewall-binding-profile:enterprise-gateway-default` |
+| Istio/Admiral-style mesh profile | `urn:srcos:mesh-binding-profile:istio-egress-default` |
+| User BYOM OpenAI-compatible provider profile | `urn:srcos:external-model-provider-profile:user-openai-compatible` |
+| Apple App Intents native assistant bridge profile | `urn:srcos:native-assistant-bridge-profile:apple-app-intents-default` |
+
+The Network Door does **not** mutate firewall rules, install mesh components, contact external model providers, store credentials, or send prompts. Destination labels are represented as SHA-256 hashes in route plans.
+
+The Native Assistant Door does **not** invoke Siri, App Intents, Shortcuts, Android intents, Windows shell integrations, browser extensions, or MCP/native bridge transports. It renders a bridge plan with prompt text redacted to a SHA-256 hash when provided.
+
+Default policy posture:
+
+- default egress is denied;
+- BYOM provider auth must be a reference, never inline;
+- enterprise firewall denies have precedence over user allows;
+- user firewall profiles may be stricter than enterprise profiles;
+- mesh binding and firewall binding are complementary, not interchangeable;
+- prompt egress is denied by default;
+- native assistant side effects require user confirmation;
+- raw app database access is denied by default.
+
+See `docs/integration/network-native-assistant-door.md`.
+
 ### Agent Machine local mount defaults
 
 The first Agent Machine mount slice aligns with the SourceOS contracts in `SourceOS-Linux/sourceos-spec`:
@@ -178,13 +269,15 @@ M1 is repo maturity and install surface definition:
 - `SociOS-Linux/nlboot`: boot/recovery client and evidence records.
 - `SourceOS-Linux/sourceos-spec`: canonical SourceOS schemas and contracts.
 - `SourceOS-Linux/sourceos-boot`: SourceOS boot/recovery integration.
+- `SourceOS-Linux/sourceos-model-carry`: local model profiles and carry-layer service refs.
 - `SourceOS-Linux/agent-term`: terminal-native SourceOS operator ChatOps console.
 - `SociOS-Linux/workstation-contracts`: workstation/CI conformance contracts and IPC receipts.
+- `SociOS-Linux/socios`: opt-in automation and personalization orchestration.
 - `SocioProphet/prophet-workspace`: workspace product semantics, Professional Workrooms, and OfficeArtifact contracts.
 - `SocioProphet/homebrew-prophet`: Homebrew install formulae.
 - `SocioProphet/model-router`: governed model/service routing.
 - `SocioProphet/guardrail-fabric`: guardrail policy client integration.
-- `SocioProphet/model-governance-ledger`: evidence and promotion records.
+- `SocioProphet/model-governance-ledger`: evidence, consent, evaluation, promotion, and personalization governance records.
 - `SocioProphet/agent-registry`: governed agent identity/tool-grant contracts.
 - `SocioProphet/agentplane`: governed execution, placement, run, replay, and evidence.
 
@@ -199,4 +292,3 @@ The validation target runs the unit test suite and checks repository metadata. A
 ```bash
 make test   # run tests only
 ```
-

bin/sourceos

@@ -0,0 +1,10 @@
+#!/usr/bin/env python3
+"""sourceos alias entry-point script."""
+
+import os
+import runpy
+import sys
+
+repo_root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+sys.argv[0] = "sourceos"
+runpy.run_path(os.path.join(repo_root, "bin", "sourceosctl"), run_name="__main__")

bin/sourceos-agent

@@ -0,0 +1,11 @@
+#!/usr/bin/env python3
+"""sourceos-agent entry-point script."""
+import os
+import sys
+
+# Allow running directly from the repo root without installing.
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from sourceosctl.commands.local_agent_registry_cli import main
+
+sys.exit(main())

bin/sourceos-portable-ai

@@ -0,0 +1,14 @@
+#!/usr/bin/env python3
+"""Standalone SourceOS Portable AI Kit CLI."""
+
+from __future__ import annotations
+
+import os
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from sourceosctl.commands.portable_ai_cli import main
+
+if __name__ == "__main__":
+    sys.exit(main())

bin/sourceosctl

@@ -6,6 +6,82 @@ import os
 # Allow running directly from the repo root without installing.
 sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
 
+# Lightweight plugin routing for newer command groups while keeping the core
+# argparse surface stable. These command groups are non-mutating plan/probe
+# surfaces and own their own subparsers.
+if len(sys.argv) > 1 and sys.argv[1] == "contract":
+    from sourceosctl.commands.contracts import contract_main
+
+    sys.exit(contract_main(sys.argv[2:]))
+
+if len(sys.argv) > 1 and sys.argv[1] == "repo":
+    from sourceosctl.commands.contracts import repo_main
+
+    sys.exit(repo_main(sys.argv[2:]))
+
+if len(sys.argv) > 1 and sys.argv[1] == "estate":
+    from sourceosctl.commands.contracts import estate_main
+
+    sys.exit(estate_main(sys.argv[2:]))
+
+if len(sys.argv) > 1 and sys.argv[1] == "graph":
+    from sourceosctl.commands.contracts import graph_main
+
+    sys.exit(graph_main(sys.argv[2:]))
+
+if len(sys.argv) > 1 and sys.argv[1] == "sync":
+    from sourceosctl.commands.contracts import sync_main
+
+    sys.exit(sync_main(sys.argv[2:]))
+
+if len(sys.argv) > 1 and sys.argv[1] == "policy":
+    from sourceosctl.commands.contracts import policy_main
+
+    sys.exit(policy_main(sys.argv[2:]))
+
+if len(sys.argv) > 1 and sys.argv[1] == "reasoning":
+    from sourceosctl.commands.reasoning import reasoning_main
+
+    sys.exit(reasoning_main(sys.argv[2:]))
+
+if len(sys.argv) > 1 and sys.argv[1] == "operation":
+    from sourceosctl.commands.operation import operation_main
+
+    sys.exit(operation_main(sys.argv[2:]))
+
+if len(sys.argv) > 1 and sys.argv[1] == "diagnostics":
+    from sourceosctl.commands.diagnostics import diagnostics_main
+
+    sys.exit(diagnostics_main(sys.argv[2:]))
+
+if len(sys.argv) > 1 and sys.argv[1] == "network":
+    from sourceosctl.commands.network import network_main
+
+    sys.exit(network_main(sys.argv[2:]))
+
+if len(sys.argv) > 1 and sys.argv[1] == "native-assistant":
+    from sourceosctl.commands.network import native_assistant_main
+
+    sys.exit(native_assistant_main(sys.argv[2:]))
+
+if len(sys.argv) > 1 and sys.argv[1] == "portable-ai":
+    from sourceosctl.commands.portable_ai_cli import main as portable_ai_main
+
+    sys.exit(portable_ai_main(sys.argv[2:]))
+
+if len(sys.argv) > 1 and sys.argv[1] == "local-agent":
+    from sourceosctl.commands.local_agent_registry_cli import main as local_agent_main
+
+    sys.exit(local_agent_main(sys.argv[2:]))
+
+if len(sys.argv) > 2 and sys.argv[1:3] == ["doctor", "local-runtime"]:
+    from sourceosctl.commands.local_agent_registry_cli import local_runtime_doctor
+
+    class _Args:
+        pass
+
+    sys.exit(local_runtime_doctor(_Args()))
+
 from sourceosctl.cli import main
 
-sys.exit(main())
+sys.exit(main())