Integrate local agent-machine execution with Workspace Operation Plane

[mdheller]

Purpose

Make agent-machine the governed local execution substrate for SourceOS agents, tools, containers, local models, and enterprise/user network profiles.

Required operation types

• agent_machine.profile.create
• agent_machine.execution.start
• agent_machine.execution.cancel
• agent_machine.tool_grant.apply
• agent_machine.tool_grant.revoke
• agent_machine.container.run
• agent_machine.model_provider.bind
• agent_machine.diagnostics.export_redacted

Required profiles

• personal profile
• corporate firewall profile
• multi-corporate firewall profile
• local model provider profile
• hosted model provider profile
• airgapped/local-only profile
• user-owned model profile

Required artifacts

• AgentMachineProfile
• LocalAgentExecution
• ToolGrantRecord
• ContainerExecutionRecord
• ModelProviderBinding
• AgentMachineDiagnosticBundle

Required controls

• Delegated authority for every local agent action.
• Policy gates for tool grants, model provider use, network profile, container execution, and artifact access.
• Budget dimensions: model calls, tokens, connector calls, CPU/GPU, local disk, sandbox memory, wall-clock runtime, agent concurrency.
• OperationEvents for start/progress/failure/retry/cancel/complete.
• Redacted diagnostics with no credentials, tokens, local secrets, or sensitive prompts.

Integration targets

• SocioProphet/agentplane#85
• SocioProphet/agent-registry
• SocioProphet/mcp-a2a-zero-trust
• SocioProphet/model-router
• SocioProphet/guardrail-fabric
• SocioProphet/policy-fabric#46
• SocioProphet/prophet-core-contracts#1
• SourceOS-Linux/sourceos-spec#87
• SociOS-Linux/workstation-contracts#28
• SourceOS-Linux/sourceos-devtools#19

Acceptance criteria

• Local agent execution is represented as WorkspaceOperation and OperationTask state.
• Tool grants and revocations are auditable operation commands.
• Model provider use is explicit, profile-bound, and policy-gated.
• Enterprise firewall profiles and personal/user-owned model profiles are separate and inspectable.
• Agent-machine never writes durable workspace state outside OperationContract.

Hard rule

Local agent execution must not imply ambient authority. Every action needs delegation, scope, budget, policy profile, and audit.