[G21] Evaluate optional macOS VM and multi-host providers

[jjangg96]

Goal

Decide whether optional isolated macOS VM and multi-host adapters can meet safety, licensing and operating-cost requirements without coupling the core to one runtime.

Create one active Codex goal from the statement above when this issue is dispatched. The Project Goal field is a work specification; it does not start an agent. Do not invent a token budget.

Execution contract

Field	Value
Goal key	G21
Stage	M5 - Future
Initial status	Future
Primary agent	gpt-5.6-luna / max
Priority / risk	P2 / High
Test profiles	offline

Use one issue branch/worktree and one focused PR. Independent Luna max review is required for authentication, protocol, concurrency, resource ownership, cleanup or service identity boundaries; other changes need independent contract review. Model fields are routing instructions, not GitHub user assignments.

Dependencies

• G17 #17

Dependencies must be Done before implementation begins. A new issue is not blocked simply because its future evidence has not been collected.

Scope

Research/prototype ADR only after core qualification. Evaluate Apple Virtualization helper and optional external tools; no default Tart bundling.

TDD and failure evidence

1. Reproduce image clone/boot/one-job/teardown and controller-restart behavior in an isolated experiment.
2. Measure startup/capacity and validate exact macOS VM licence/runtime limits separately from runner-process counts.
3. Probe persistence, credential access and host/LAN networking before claiming untrusted-job support.

Capture a meaningful failing case before the implementation, then green evidence and relevant refactor checks. Tooling/prose-only work uses appropriate negative checks without artificial application tests. Live/runtime profiles require reviewed commits, a dedicated trusted test environment and explicit authorization for the concrete experiment. Public PR CI uses hosted environments without credentials. Planned or skipped tests never count as passed.

Acceptance criteria

• Document go/no-go, license boundaries and optional provider interface changes.
• No unlimited scaling claim on one Mac or inference that all Linux VMs share macOS guest cap.
• Remote-host design includes trust/auth/recovery and central budget semantics before implementation.
• Scope stays outside v0.1; create bounded follow-up implementation issues only after evidence.
• Record exact validation commands, actual results, skipped/live-test gaps and applicable rollback notes in the PR.
• Independent review is resolved and the focused PR is merged under the repository execution policy.
• Update issue/Project accurately; mark the active goal complete only after all required evidence and work are complete.

Safety invariants

Preserve existing manual runners; no global Docker prune/context switching, broad process kill, implicit App enrollment, busy-job cancellation during ordinary scale-down or transparent workflow replay. Use only verifiably owned resources. Keep management credentials and raw secret-bearing SDK errors out of worker environments, logs, fixtures and commits; per-worker JIT transport follows G01. Native pools remain trusted-only.

Design references

• Architecture and gates
• Language decision
• Security design
• TDD strategy
• Goal/model execution policy
• Ordered backlog