feat(orchestrators): add Agor+acq sandbox integration (Tier 1 worked example)

[mogul]

Context

Tier 1 worked example of an Agor + acq sandbox-isolation integration
(map #247): a runnable
executor_command_template wrapper that runs an Agor executor inside an acq
sandbox, a small agor-daemon-egress kit the wrapper requires, a new
integrations/orchestrators/ area with its ADR, and the two source exploration
docs. Zero Agor code changes for the OpenCode path.

All decision/build child issues are closed and AFK-confirmed by the human owner
(#248–#256, #258, #259, #261). This PR rebases that work cleanly onto current
main.

AI assistance disclosed: prepared with an AI coding agent (OpenCode);
human-owned and reviewed.

Plan (what changed, and how it maps to the approved plan)

The prior feat/agor-integration branch also carried 6 openchamber commits
that are a parallel implementation of the "startup owns server" feature that
main has since landed authoritatively (#246 + #283). Rather than merge and
resolve 13 openchamber conflicts, this branch is a fresh cut of origin/main
with only the 8 Agor-deliverable commits cherry-picked; the obsolete
openchamber commits were dropped. main's openchamber remains authoritative.

Files (+2,113 / 14 files, no openchamber files touched):

• integrations/orchestrators/ — new area: README.md, area ADR
  0001-orchestrators-area-and-agor-acq.md, agor/README.md (setup guide),
  agor/sandbox-wrapper-acq.sh, two exploration docs.
• integrations/isolation/acq-kits/agor-daemon-egress/ — new egress kit
  (spec.yaml, README.md, TROUBLESHOOTING.md, scripts/verify, kit ADR)
  • kits.yaml registry row + acq-kits/README.md link.
• integrations/README.md — orchestrators area row.

Two additions beyond the cherry-picks:

• provenance: {repo: GSA-TTS/agentic-coding-patterns} on the egress kit,
  aligning it with main's newer kits (quickstart#235 / PR1: kit-bundle provenance schema field + permission-preservation & acq/sbx drift-guard tests #273). It declares
  repo only (no bundle/kit_names), so it does not affect the acq-builtin
  bundle cross-check.
• SC2015 shellcheck fix in the egress-kit verify ([ -f ] && ok || {…} →
  explicit if/else; no behavior change).

Verification

Run in the project's standard environment (Python 3, shellcheck 0.11.0):

Check	Result
validate-kits.py --strict	PASS — 6/6 kits OK; registry cross-check passes
validate_repo.py	PASS — 38 patterns, all refs resolve, no cycles
scan_unsafe_shell.py .	PASS — 0 errors, 0 warnings
generate_index.py --check	PASS — INDEX.yaml up to date
generate_catalog.py --check	PASS — CATALOG.md up to date
shellcheck (wrapper + verify)	PASS — clean
egress kit vs kit-hybrid-v1 schema	PASS — validates with provenance
provenance/drift assertions (manual*)	PASS — malformed provenance rejected; usai bundle set unchanged

* pytest is not installable in this container (no ensurepip/venv); the
provenance-relevant assertions from scripts/tests/test_kit_provenance_and_drift.py
were exercised directly with jsonschema. CI runs the full pytest suite.

Live wrapper dry-run against real acq (quickstart main): remote /
Agor-managed payload emits the correct plan
(acq create shell <worktree> <repo.git> --name agor-… --kit <egress> … | acq exec … -- agor-executor --stdin,
then acq rm on exit); a worktree whose main repo is outside AGOR_DATA_HOME
is correctly refused (exit 5).

CLI-surface re-verify vs current quickstart main (since #248/#249 closed,
quickstart landed #233 sbx↔msb parity and #257 fail-closed run): acq create
positional agent+workspaces + --name + repeatable --kit; acq exec <name> -- CMD stdin passthrough; acq secret set <SANDBOX> usai reads value from stdin
with positional scope; sbx-v2 synthesis preserves caps.network.allow
host:port. The v1 contract still holds.

Live end-to-end validation (#257): BLOCKED

Per the isolation area ADR, a live acq run cannot execute inside an sbx
sandbox (no nested sandboxes). This CI/dev host is itself a Docker container
(/proc/1/cgroup → 0::/docker/…), and sbx is not installed (commercial;
brew install docker/tap/sbx + sbx login), msb is absent with no
/dev/kvm, and agor/agor-executor are absent (no daemon to spawn the
executor or mint the scoped JWT). Recorded BLOCKED per AGENTS.md §8.3 rather
than fabricating a pass. Retry trigger: a sandbox-capable, non-nested host —
sbx (installed + logged in) and/or msb (KVM host) — with a running Agor
daemon on :3030 + an out-of-band USAi key.

Rollback

Revert this PR (single squash commit) — the change is purely additive
(a new orchestrators/ area + one new isolation kit + registry/README rows).
No existing kit, script, schema, or test is modified, so revert restores the
prior state cleanly with no data or config migration.

Security Impact

• Adds the agor-daemon-egress security-relevant kit: it widens outbound
  egress to exactly one host:port (host.docker.internal:3030, the Agor
  daemon control-plane). It drops no files, runs no commands, and carries no
  secret. Governed by human review (the kit schema models no governance
  frontmatter); posture documented in the kit README + its ADR.
• The wrapper never places the USAi key on argv (piped to acq secret set on
  stdin) and refuses to mount a non-Agor-managed local repo checkout,
  avoiding exposure of a user's .env/working files.
• No secrets, PII, CUI, or internal URLs. CC0 community-hub content; carries no
  compliance authority (references the playbook, does not restate it).

msb backend note (#260 closed)

The earlier "msb is a gap" framing is stale and removed. #260 was filed
because acq's msb adapter mounted the workspace at a fixed guest path and
wired no extra mounts — but quickstart#230 + the #233 parity omnibus changed msb
to mount each workspace at its host path (sbx-parity) with multiple
positional mounts, so the worktree .git gitdir: pointer resolves the same
on msb. The wrapper is backend-agnostic here; #260 is closed as resolved.
The only residual — a live msb create→exec run on a KVM host (msb is not
live-verified upstream) — is folded into #257. This PR's wrapper header,
agor/README backend table, and the egress-kit spec/README/TROUBLESHOOTING/ADR
were updated to reference #257 instead of the closed #260.

Links

• Map: Wayfinder: Agor + acq sandbox isolation integration (Tier 1 worked example) #247
• Live-validation gate (stays open, BLOCKED; now covers sbx and live msb):
  Live end-to-end validation: Agor session executing inside an acq sandbox #257
• msb mount gap (closed — resolved by quickstart#230/openchamber kit: msb/ppp parity (neutral port-publish + background vocab) and adopt acq publishedPorts translation #233):
  msb backend support for the Agor+acq wrapper (fixed-guest-path mount gap) #260

Co-authored-by: OpenCode Agent bret.mogilefsky@gsa.gov