Codex task: add suite execution bridge for Prophet CLI and SourceOS carry workflows

[mdheller]

Mission

Add an Agentplane execution bridge for the SocioProphet product suite so prophet-cli, SourceOS carry, Holmes, model routing, guardrails, and agent registry workflows can run through governed bundle→validate→run→evidence→replay paths.

This issue is designed for a Codex agent. Keep the change bounded and open a PR.

Scope

Implement a small, deterministic suite execution profile that can accept delegated suite commands and emit evidence-ready execution records.

Initial command families to recognize:

• prophet sourceos carry validate
• prophet sourceos carry emit-evidence
• prophet holmes analyze
• prophet model route
• prophet guardrail test
• prophet agent registry list

Expected artifacts

Add or update repo-local artifacts consistent with existing Agentplane conventions:

• suite execution profile or manifest
• validation fixture
• evidence fixture
• replay fixture
• tests or smoke validation

Acceptance criteria

• A suite execution fixture can be validated.
• A suite execution fixture emits an evidence/replay-shaped record.
• Missing delegated tools produce explicit not-yet-wired status rather than fake success.
• Existing Agentplane validation remains green.
• PR summary lists validation commands run.

Do not

• Do not implement actual Holmes/model-router/guardrail internals here.
• Do not vendor model artifacts or lab dependencies.
• Do not modify unrelated execution policies.

[mdheller]

Integration update: release/devtools/sourceos-ai/Holmes lanes are part of Agentplane scope

This issue must account for the product-suite release work now landing across the first-wave repos.

New concrete upstream surfaces

• SourceOS-Linux/sourceos-model-carry: sourceos-ai CLI now has build/test/validate/dist/release-dry-run targets, CI validation, carry-ref examples, and evidence output.
• SocioProphet/holmes: holmes CLI skeleton is being added with build/test/validate/dist/release-dry-run targets, deterministic local analysis, evidence output, and explicit not-yet-wired records for search/graph/govern.
• SocioProphet/prophet-cli: must expose the façade path for these tools.
• SocioProphet/sociosphere: owns suite registry/governance and Copilot/Codex lane coordination.
• SocioProphet/global-devsecops-intelligence: owns release posture and agent-PR risk posture.

Agentplane requirement

Agentplane should model these as governed execution profiles, not as free-form shell calls. Required workflow shape:

suite command request
  -> validate command profile
  -> run delegated local CLI or stubbed profile
  -> capture stdout/stderr/artifact refs
  -> emit evidence record
  -> store replay fixture

First command profiles to support

prophet sourceos carry validate
prophet sourceos carry emit-evidence
prophet holmes analyze examples/sample.txt
prophet holmes search "truth and evidence"
prophet model route --task summarize --privacy local-first
prophet guardrail test examples/policy.json examples/input.json
prophet agent registry list

Acceptance criteria addition

• Add fixtures for sourceos-ai and holmes command profiles.
• Evidence records should include tool name, command, status, repo, issue/PR ref when known, and output artifact refs.
• not-yet-wired statuses are valid if explicit and replayable.
• Do not fake success for delegated tools that are missing or pending.

This keeps Agentplane aligned with the suite release train and lets Copilot/Codex output become replayable governance evidence rather than untracked PR churn.