Define workstation IPC and local-first contracts for Workspace Operations

[mdheller]

Purpose

Define the workstation-side contracts that allow SourceOS local surfaces to participate in the Workspace Operation Plane without inventing separate lifecycle/state models.

Context

The April 29 dossier identifies workstation-contracts as the P0 workstation IPC, UI, and conformance contract plane. New SourceOS repos now need local operation bindings: TurtleTerm, BearBrowser, sourceos-devtools, and agent-machine.

Required contracts

• LocalOperationLog contract
• DeviceIdentity and DeviceTrustProfile
• CapabilityProfile for local device, terminal, browser, filesystem, sandbox, local model, and network state
• TerminalSession artifact contract
• TerminalCommand operation contract
• BrowserSession operation contract
• WebCapture artifact contract
• Download/Upload operation contract
• LocalAgentExecution operation contract
• File availability states: local, remote, syncing, conflicted, quarantined
• Local diagnostic redaction contract
• Cross-device resume/provisional artifact ID mapping

Integration targets

• SourceOS-Linux/TurtleTerm
• SourceOS-Linux/BearBrowser
• SourceOS-Linux/sourceos-devtools
• SourceOS-Linux/agent-machine
• SourceOS-Linux/sourceos-shell
• SourceOS-Linux/sourceos-spec
• SocioProphet/prophet-core-contracts#1

Acceptance criteria

• Local operation contracts map cleanly to WorkspaceOperation, OperationTask, OperationEvent, Artifact, DecisionCard, and PolicyGateRecord.
• Terminal/browser/agent-machine actions cannot create hidden workspace side effects.
• Contracts include validation fixtures for terminal command, browser capture, local agent execution, and file conflict.
• Contracts preserve Linux-first and local-first semantics.

Hard rule

Local-first does not mean policy-free. SourceOS local surfaces must participate in admission, audit, redaction, and operation lifecycle rules.

[mdheller]

@copilot please implement this as a bounded workstation/local-first contract slice.

Scope:

• Add schemas/types/examples for LocalOperationLog, DeviceIdentity, DeviceTrustProfile, CapabilityProfile, TerminalSession, TerminalCommand, BrowserSession, WebCapture, Download/Upload, LocalAgentExecution, file availability states, diagnostic redaction, provisional artifact ID mapping.
• Keep these aligned to WorkspaceOperation, OperationTask, OperationEvent, Artifact, DecisionCard, and PolicyGateRecord from SocioProphet/prophet-core-contracts#1.
• Include fixtures for terminal command, browser capture, local agent execution, local/remote conflict, and diagnostic redaction.

Use current seams:

• SocioProphet/prophet-core-contracts#1
• SourceOS-Linux/sourceos-spec#87
• SourceOS-Linux/sourceos-syncd#3
• SourceOS-Linux/sourceos-shell#10
• SourceOS-Linux/BearBrowser#20
• SourceOS-Linux/agent-machine#18

Validation:

• Add tests or validation commands for fixture shape.
• Do not implement SourceOS shell UI, sync daemon runtime, browser runtime, terminal runtime, policy, or ledger here.

PR evidence required:

• Summary of files changed.
• Validation commands run and output.
• Explanation of Linux-first/local-first semantics and how hidden side effects are prevented.