VRS: define runner-owned stable launch identity

[myobie]

Problem

Issue #64 requires one stable agent identity boundary before child start without depending on session-name inference or late runtime enrichment. Issue #108 additionally requires mutable display names to remain presentation-only and outside that identity boundary.

Draft contract

• The runner derives ST_AGENT=<host.identity> for every declared task.
• Only the canonical agent PTY receives role=agent, run.role=coding-agent, and agent.actor.path=<host.identity>.
• Matching authored values are accepted; conflicts fail validation and are never silently overwritten.
• Compact and explicit canonical-agent forms have the same guarantees.
• Sidecars receive ST_AGENT but no canonical-agent PTY tags.
• Mutable harness, provider, model, and account facts remain outside stable identity.
• An optional display name is mutable presentation metadata: changing or clearing it cannot change ST_AGENT, bus paths, task IDs, resource anchors, or the running process, and never restarts work. Issue Add first-class display-name authoring without changing agent identity #108 owns the authoring surface.

Scope

This is a thin, source-linked VRS clarification only:

• docs/vrs/requirements.md adds R23.
• docs/vrs/spec.md separates the accepted contract from current implementation evidence and gaps.
• Every normative clause links to issue Decide ownership of stable agent identity at PTY creation #64, issue Add first-class display-name authoring without changing agent identity #108, or immutable current source/test evidence.

R23 avoids the R20-R21 requirements already on live main and the concurrent R22 draft. No runtime, parser, validator, generator, test, or vision change is included. The draft explicitly records that runner derivation, explicit-form tag parity, richer stable tags, and authored-conflict validation remain implementation gaps.

Exact evidence

• Base: c6846f6239329f0803142afc06c15a07b93937c1
• Head: a31099bc2426f35935bd176e3b53e03b6300bb5b
• Semantic diff: exactly 2 protected VRS files, +52/-0
• cargo test --test invariants -- --test-threads=1
• cargo test --doc --workspace
• cargo doc --workspace --no-deps (5 pre-existing warnings)
• git diff --check origin/live-main
• All referenced source and issue URLs returned HTTP 200.
• Hosted Nix run 30586582783, job 91019263754: success on the exact head.
• Complete two-file diff walk.

No merge or rollout.

Tracks #64 and #108.

[schickling-assistant]

Superseded by merged presentation and runner-owned launch identity work (#136 and #180).

Posted on behalf of @schickling

field	value
agent_identity	dev3.direct.omp.jmg9x29x
session	dev3.jmg9x29x
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.0.11
agent_runtime	OMP 18.0.11
tooling_profile	dotfiles@2161b9c