Skip to content

Commit 6db19d0

Browse files
mdhellermdheller
committed
merge: resolve conflicts keeping all content from both sides
2 parents 980a789 + 26901aa commit 6db19d0

102 files changed

Lines changed: 8182 additions & 101 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/contract-schemas.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: contract-schemas
2+
3+
on:
4+
workflow_dispatch:
5+
pull_request:
6+
paths:
7+
- "contracts/**/*.schema.json"
8+
- "fixtures/**/*.json"
9+
- "tools/validate_contract_schemas.py"
10+
- ".github/workflows/contract-schemas.yml"
11+
push:
12+
branches: [main]
13+
paths:
14+
- "contracts/**/*.schema.json"
15+
- "fixtures/**/*.json"
16+
- "tools/validate_contract_schemas.py"
17+
- ".github/workflows/contract-schemas.yml"
18+
19+
jobs:
20+
validate:
21+
runs-on: ubuntu-latest
22+
steps:
23+
- uses: actions/checkout@v4
24+
- uses: actions/setup-python@v5
25+
with:
26+
python-version: "3.11"
27+
- name: Validate contract schemas
28+
run: python3 tools/validate_contract_schemas.py

‎.github/workflows/trust-surface.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: Trust Surface
2+
3+
on:
4+
pull_request:
5+
push:
6+
branches:
7+
- main
8+
9+
jobs:
10+
validate-trust-surface:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- name: Checkout
14+
uses: actions/checkout@v4
15+
- name: Require trust surface baseline
16+
run: |
17+
test -f TRUST_SURFACE.yaml
18+
test -f SECURITY.md
19+
test -f scripts/doctor
20+
test -f scripts/network-surface
21+
test -f scripts/policy-surface
22+
test -f scripts/purge
23+
test -f scripts/prove-clean

‎.gitignore‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
__pycache__/
2+
*.py[cod]
3+
*.egg-info/
4+
dist/
5+
build/
6+
.eggs/

‎.sourceos/manifest.json‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
{
2+
"repo": "SourceOS-Linux/agent-machine",
3+
"domain": "agent",
4+
"specVersion": "0.1.0",
5+
"ownedSchemas": [
6+
"AgentRuntimeProfile",
7+
"AgentExecutionPlan",
8+
"AgentRuntimeEvidence"
9+
],
10+
"syncEngines": [],
11+
"sourceChannels": [
12+
"agent.execute.tool",
13+
"agent.access.memory",
14+
"agent.access.shell",
15+
"agent.model.route",
16+
"agent.mcp.invoke"
17+
],
18+
"policyClasses": [
19+
"critical"
20+
],
21+
"auditEvents": [
22+
"agent.execution.started",
23+
"agent.execution.denied",
24+
"agent.execution.completed",
25+
"agent.lease.expired",
26+
"agent.lease.revoked",
27+
"agent.policy.mismatch"
28+
],
29+
"dangerousSurfaces": [
30+
"agent.execute.tool",
31+
"agent.access.memory",
32+
"agent.access.shell",
33+
"agent.access.network",
34+
"agent.model.route",
35+
"agent.mcp.invoke",
36+
"agent.secret_ref.use"
37+
],
38+
"authorityRepos": [
39+
"SourceOS-Linux/sourceos-spec",
40+
"SocioProphet/agent-registry",
41+
"SocioProphet/policy-fabric",
42+
"SocioProphet/guardrail-fabric",
43+
"SocioProphet/memory-mesh"
44+
],
45+
"notes": "Local agent runtime. High-risk execution requires scoped capability leases and policy decisions before tool, memory, shell, network, MCP, model, or secret-reference access."
46+
}

‎Makefile‎

Lines changed: 39 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
.PHONY: validate validate-json validate-yaml validate-quadlet validate-render validate-evidence validate-governance validate-activation validate-supply-chain validate-release-bundle validate-package validate-cli validate-formula doctor probe
1+
.PHONY: validate validate-json validate-yaml validate-quadlet validate-render validate-evidence validate-governance validate-policy-fabric validate-agent-registry validate-superconscious-runtime-plan validate-activation validate-supply-chain validate-release-bundle validate-sourceos-projections validate-package validate-cli validate-formula validate-runtime-install-receipts doctor probe
22

33
PYTHON ?= python3
44
RUBY ?= ruby
@@ -15,12 +15,14 @@ READY_GRANT := examples/agent-registry-grant.active-activation.json
1515
FAIL_POLICY := examples/policy-admission.missing.json
1616
FAIL_GRANT := examples/agent-registry-grant.missing.json
1717
RECEIPT_DIR := examples
18+
POLICY_DIR := examples
19+
GRANT_DIR := examples
1820
DEPLOYMENT_RECEIPT_ID := urn:srcos:agent-machine:deployment-receipt:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
1921
DECIDED_AT := 2026-05-04T12:51:00Z
2022
PYCLI := PYTHONPATH=src $(PYTHON) -m agent_machine.cli
2123
PYMOD := PYTHONPATH=src $(PYTHON) -m
2224

23-
validate: validate-json validate-yaml validate-quadlet validate-render validate-evidence validate-governance validate-activation validate-supply-chain validate-release-bundle validate-package validate-cli validate-formula
25+
validate: validate-json validate-yaml validate-quadlet validate-render validate-evidence validate-governance validate-policy-fabric validate-agent-registry validate-superconscious-runtime-plan validate-activation validate-supply-chain validate-release-bundle validate-sourceos-projections validate-package validate-cli validate-formula validate-runtime-install-receipts
2426

2527
validate-json:
2628
$(PYTHON) scripts/validate-json.py
@@ -52,10 +54,28 @@ validate-evidence:
5254
validate-governance:
5355
$(PYTHON) scripts/validate-governance.py
5456

57+
validate-policy-fabric:
58+
$(PYTHON) scripts/validate-policy-fabric.py
59+
$(PYTHON) scripts/resolve-policy-admission.py $(LOCAL_AGENTPOD) --policy-dir $(POLICY_DIR) --expected-status allowed --deployment-receipt-id $(DEPLOYMENT_RECEIPT_ID) --agent-machine-id urn:srcos:agent-machine:m2-asahi-local --provider-id urn:srcos:agent-machine:inference-provider:asahi-llama-cpp --pretty >/tmp/agent-machine-policy-resolve-allowed.json
60+
$(PYCLI) policy resolve $(LOCAL_AGENTPOD) --policy-dir $(POLICY_DIR) --expected-status denied --deployment-receipt-id $(DEPLOYMENT_RECEIPT_ID) --agent-machine-id urn:srcos:agent-machine:m2-asahi-local --provider-id urn:srcos:agent-machine:inference-provider:asahi-llama-cpp --pretty >/tmp/agent-machine-pycli-policy-resolve-denied.json
61+
62+
validate-agent-registry:
63+
$(PYTHON) scripts/validate-agent-registry.py
64+
$(PYTHON) scripts/resolve-agent-registry-grant.py $(LOCAL_AGENTPOD) --grant-dir $(GRANT_DIR) --grant-id urn:srcos:agent-machine:agent-registry-grant:active-loopback-activation --requested-agent-identity-ref urn:srcos:agent:local-inference-provider --session-ref urn:srcos:session:local-bootstrap --agent-machine-id urn:srcos:agent-machine:m2-asahi-local --pretty >/tmp/agent-machine-registry-resolve-active.json
65+
$(PYCLI) registry resolve $(LOCAL_AGENTPOD) --grant-dir $(GRANT_DIR) --grant-id urn:srcos:agent-machine:agent-registry-grant:active-loopback-activation --session-ref urn:srcos:session:local-bootstrap --agent-machine-id urn:srcos:agent-machine:m2-asahi-local --pretty >/tmp/agent-machine-pycli-registry-resolve-active.json
66+
67+
validate-superconscious-runtime-plan:
68+
$(PYTHON) scripts/validate-superconscious-runtime-plan.py
69+
70+
validate-superconscious-runtime-plan:
71+
$(PYTHON) scripts/validate-superconscious-runtime-plan.py
72+
5573
validate-activation:
5674
$(PYTHON) scripts/validate-activation.py
57-
$(PYTHON) scripts/evaluate-activation.py $(LOCAL_AGENTPOD) $(READY_POLICY) $(READY_GRANT) --deployment-receipt-id $(DEPLOYMENT_RECEIPT_ID) --storage-receipt-dir $(RECEIPT_DIR) --decided-at $(DECIDED_AT) --decision-id urn:srcos:agent-machine:activation-decision:local-llama-cpp-allowed --pretty >/tmp/agent-machine-evaluate-activation-allowed.json
75+
$(PYTHON) scripts/evaluate-activation.py $(LOCAL_AGENTPOD) $(READY_POLICY) $(READY_GRANT) --deployment-receipt-id $(DEPLOYMENT_RECEIPT_ID) --storage-receipt-dir examples --decided-at $(DECIDED_AT) --decision-id urn:srcos:agent-machine:activation-decision:local-llama-cpp-allowed --pretty >/tmp/agent-machine-evaluate-activation-allowed.json
5876
$(PYCLI) activate evaluate $(LOCAL_AGENTPOD) $(FAIL_POLICY) $(FAIL_GRANT) --deployment-receipt-id $(DEPLOYMENT_RECEIPT_ID) --storage-receipt-dir $(RECEIPT_DIR) --decided-at $(DECIDED_AT) --decision-id urn:srcos:agent-machine:activation-decision:local-llama-cpp-fail-closed --pretty >/tmp/agent-machine-pycli-evaluate-activation-fail-closed.json
77+
$(PYCLI) activate evaluate $(LOCAL_AGENTPOD) $(READY_GRANT) --policy-dir $(POLICY_DIR) --expected-status allowed --deployment-receipt-id $(DEPLOYMENT_RECEIPT_ID) --agent-machine-id urn:srcos:agent-machine:m2-asahi-local --provider-id urn:srcos:agent-machine:inference-provider:asahi-llama-cpp --storage-receipt-dir $(RECEIPT_DIR) --decided-at $(DECIDED_AT) --decision-id urn:srcos:agent-machine:activation-decision:local-llama-cpp-allowed --pretty >/tmp/agent-machine-pycli-resolved-policy-activation-allowed.json
78+
$(PYCLI) activate evaluate $(LOCAL_AGENTPOD) --policy-dir $(POLICY_DIR) --expected-status allowed --grant-dir $(GRANT_DIR) --grant-id urn:srcos:agent-machine:agent-registry-grant:active-loopback-activation --session-ref urn:srcos:session:local-bootstrap --deployment-receipt-id $(DEPLOYMENT_RECEIPT_ID) --agent-machine-id urn:srcos:agent-machine:m2-asahi-local --provider-id urn:srcos:agent-machine:inference-provider:asahi-llama-cpp --storage-receipt-dir $(RECEIPT_DIR) --decided-at $(DECIDED_AT) --decision-id urn:srcos:agent-machine:activation-decision:local-llama-cpp-allowed --pretty >/tmp/agent-machine-pycli-resolved-policy-grant-activation-allowed.json
5979
$(BOOTSTRAP_CLI) activate evaluate $(LOCAL_AGENTPOD) $(READY_POLICY) $(READY_GRANT) --deployment-receipt-id $(DEPLOYMENT_RECEIPT_ID) --storage-receipt-dir $(RECEIPT_DIR) --decided-at $(DECIDED_AT) --decision-id urn:srcos:agent-machine:activation-decision:local-llama-cpp-allowed --pretty >/tmp/agent-machine-bootstrap-evaluate-activation-allowed.json
6080

6181
validate-supply-chain:
@@ -66,6 +86,9 @@ validate-release-bundle:
6686
$(PYTHON) scripts/validate-release-bundle.py
6787
$(PYTHON) scripts/generate-release-evidence.py --pretty >/tmp/agent-machine-release-evidence-bundle.json
6888

89+
validate-sourceos-projections:
90+
$(PYTHON) scripts/validate-sourceos-projection-fixtures.py
91+
6992
validate-package:
7093
$(PYTHON) scripts/validate-package.py
7194

@@ -75,6 +98,15 @@ validate-cli:
7598
$(BOOTSTRAP_CLI) paths
7699
$(BOOTSTRAP_CLI) doctor --format json
77100
$(BOOTSTRAP_CLI) probe --format json
101+
printf '%s\n' '{"prompt":"Write one short sentence about Paris.","model_id":"gpt2-small","steering":{"feature_id":"10200","layer":"6-res-jb","strength":5}}' >/tmp/agent-machine-steer-request.json
102+
$(PYCLI) steer stub-response /tmp/agent-machine-steer-request.json --pretty >/tmp/agent-machine-pycli-steer-stub-response.json
103+
$(BOOTSTRAP_CLI) steer stub-response /tmp/agent-machine-steer-request.json --pretty >/tmp/agent-machine-bootstrap-steer-stub-response.json
104+
$(PYCLI) steer preflight --sourceset gpt2-small.res-jb --pretty >/tmp/agent-machine-pycli-steer-preflight.json
105+
$(BOOTSTRAP_CLI) steer preflight --sourceset gpt2-small.res-jb --pretty >/tmp/agent-machine-bootstrap-steer-preflight.json
106+
$(PYCLI) steer resolve-artifacts --sourceset gpt2-small.res-jb --local-dir /tmp/agent-machine-steering-artifacts --receipt-out /tmp/agent-machine-steering-artifact-receipt.json --dry-run --pretty >/tmp/agent-machine-pycli-artifact-receipt.json
107+
$(PYTHON) scripts/verify-steering-receipt.py examples/steering-artifact-receipts/gpt2-small-res-jb.missing.steering-artifact-receipt.json --expect-status not_configured --pretty >/tmp/agent-machine-steering-verify-preflight.json
108+
$(PYTHON) scripts/load-steering-receipt.py examples/steering-artifact-receipts/synthetic.available.steering-artifact-receipt.json --attempt-load --pretty >/tmp/agent-machine-steering-synthetic-load.json
109+
$(PYTHON) scripts/run-mock-steering.py /tmp/agent-machine-steer-request.json --pretty >/tmp/agent-machine-mock-steering.json
78110
$(PYCLI) version
79111
$(PYCLI) paths --format json
80112
$(PYCLI) doctor --format json
@@ -83,8 +115,11 @@ validate-cli:
83115
validate-formula:
84116
$(RUBY) -c $(FORMULA)
85117

118+
validate-runtime-install-receipts:
119+
$(PYTHON) scripts/validate-runtime-install-receipts.py
120+
86121
doctor:
87122
$(BOOTSTRAP_CLI) doctor --format json
88123

89124
probe:
90-
$(BOOTSTRAP_CLI) probe --format json
125+
$(BOOTSTRAP_CLI) probe --format json

‎SECURITY.md‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# Security
2+
3+
Agent Machine is the Linux-first runtime-control substrate for local and clustered agent execution. It is expected to become sensitive infrastructure because it can govern hardware/runtime probing, inference provider lifecycle, model residency, cache-aware scheduling, AgentPod activation, side-effect boundaries, and runtime evidence.
4+
5+
## Current posture
6+
7+
Agent Machine is production-blocked until release gates are satisfied.
8+
9+
Current default posture:
10+
11+
- dry-run render/evaluate behavior only by default;
12+
- no provider activation by default;
13+
- no declared listener by default;
14+
- no declared credential store by default;
15+
- no declared background service by default;
16+
- no browser or terminal control;
17+
- no model provider process launched until policy, registry, and evidence gates land.
18+
19+
The current authority declaration lives in `TRUST_SURFACE.yaml`.
20+
21+
## Blocking rule
22+
23+
Block changes that introduce any of the following without updating `TRUST_SURFACE.yaml`:
24+
25+
- provider activation or lifecycle management;
26+
- model server, OpenAI-compatible endpoint, WebSocket, HTTP, gRPC, MCP, ACP, or other listener;
27+
- systemd, Quadlet, Kubernetes, LaunchAgent, cron, scheduled task, or service installer;
28+
- container, VM, Podman, Docker, Lima, Kubernetes, or local sandbox runtime;
29+
- model cache, prompt cache, scratch, evidence, local LVM, TopoLVM, or object-store authority;
30+
- credential, token, API key, OAuth, SecretRef, SSH-agent, keychain, or provider auth handling;
31+
- PolicyAdmission, AgentRegistryGrant, or AgentPlane evidence bypass;
32+
- logs or receipts that expose secrets, prompts, local paths, model-provider tokens, workload identity, or sensitive runtime metadata.
33+
34+
## Required local commands
35+
36+
Before runtime activation ships, Agent Machine must provide or map:
37+
38+
```text
39+
scripts/doctor
40+
scripts/network-surface
41+
scripts/credential-surface
42+
scripts/policy-surface
43+
scripts/purge
44+
scripts/prove-clean
45+
```
46+
47+
## Cleanup and revocation
48+
49+
Uninstall must remove authority, not just binaries.
50+
51+
`prove-clean` must verify no Agent Machine process, service unit, Quadlet unit, provider process, listener, credential, cache, state directory, config directory, or runtime evidence residue remains unless explicitly retained by the user.

‎TRUST_SURFACE.yaml‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
schema_version: "1.0"
2+
component: agent-machine
3+
repo: SourceOS-Linux/agent-machine
4+
owner: SourceOS-Linux
5+
runtime_classes:
6+
- cli
7+
- container_runtime
8+
- model_gateway
9+
- agent_orchestrator
10+
- policy_engine
11+
authority_summary: >-
12+
Agent Machine is the Linux-first node substrate for local and clustered agent execution.
13+
It owns hardware/runtime probing, inference provider lifecycle, model residency, cache-aware scheduling facts,
14+
AgentPod envelopes, governed side-effect boundaries, activation decisions, and execution receipts.
15+
This first-pass trust surface keeps production runtime activation blocked until provider, policy, registry, and evidence gates are declared.
16+
17+
entrypoints:
18+
- type: cli
19+
path: agent-machine
20+
purpose: Bootstrap CLI for version, paths, doctor, probe, render, and activation evaluation.
21+
- type: renderer
22+
path: agent-machine render
23+
purpose: Render local AgentPod plans, Quadlet assets, Kubernetes assets, and evidence artifacts.
24+
- type: activation_evaluator
25+
path: agent-machine activate evaluate
26+
purpose: Produce dry-run activation decisions before runtime side effects.
27+
28+
launch_services: []
29+
containers: []
30+
31+
network:
32+
plaintext_non_loopback_allowed: false
33+
listeners: []
34+
egress: []
35+
36+
filesystem:
37+
host_mounts: []
38+
writable_paths:
39+
- ~/.local/state/agent-machine/
40+
- ~/.config/agent-machine/
41+
- ~/.cache/agent-machine/
42+
cache_paths:
43+
- ~/.cache/agent-machine/
44+
log_paths:
45+
- ~/.local/state/agent-machine/logs/
46+
47+
credentials:
48+
expected_secrets: []
49+
secret_locations: []
50+
inherits_ssh_agent: false
51+
redaction_required: true
52+
53+
policy:
54+
filesystem: render_and_probe_only_until_activation_gates_land
55+
network: no_runtime_provider_listener_or_egress_until_declared
56+
execution: dry_run_render_and_evaluate_only_by_default
57+
approval: policy_admission_required_for_provider_activation_side_effects_teardown_and_wipe
58+
workspace_scope: declared_agentpod_workspace_or_none
59+
60+
model_providers:
61+
- llama.cpp planned
62+
- vLLM planned
63+
- SGLang planned
64+
- Ollama-compatible planned
65+
- oMLX optional macOS compatibility planned
66+
67+
browser_surfaces: []
68+
update_channels:
69+
- type: homebrew_formula
70+
url_or_ref: SourceOS-Linux/tap/agent-machine
71+
signature_required: true
72+
- type: direct_homebrew_formula
73+
url_or_ref: https://raw.githubusercontent.com/SourceOS-Linux/agent-machine/main/packaging/homebrew/Formula/agent-machine.rb
74+
signature_required: true
75+
remote_config: []
76+
77+
purge:
78+
commands:
79+
- rm -rf ~/.local/state/agent-machine ~/.config/agent-machine ~/.cache/agent-machine
80+
removes:
81+
- Agent Machine state directory
82+
- Agent Machine config directory
83+
- Agent Machine cache directory
84+
- Agent Machine logs
85+
- any future rendered local provider services declared in this file
86+
87+
prove_clean:
88+
checks:
89+
- no process matching agent-machine
90+
- no LaunchAgent, LaunchDaemon, systemd unit, Quadlet unit, or scheduled task matching agent-machine
91+
- no listener owned by agent-machine
92+
- no model-provider process started by agent-machine
93+
- no credentials owned by agent-machine
94+
- no state, config, cache, or log residue unless explicitly retained by user
95+
96+
known_risks:
97+
- Provider activation can start high-authority local inference runtimes.
98+
- Rendered Quadlet, systemd, Kubernetes, or container assets may create persistence or network listeners.
99+
- Model/cache/scratch/evidence storage may contain sensitive path, prompt, workload, or identity metadata.
100+
- Cache reuse is unsafe without identity, tenant, policy, and evidence boundaries.
101+
- Activation decisions are not authorization unless Policy Fabric and Agent Registry gates are enforced.
102+
103+
compensating_controls:
104+
- Keep production activation blocked until release gate passes.
105+
- Require PolicyAdmission for model load, cache reuse, side effects, teardown, and wipe.
106+
- Require AgentRegistryGrant for agent identity, session, provider, model, tool, cache, memory, storage, and evidence scopes.
107+
- Emit secret-free AgentPlane runtime evidence.
108+
- Prefer dry-run evaluation artifacts until provider lifecycle controls are implemented.

0 commit comments

Comments
 (0)