feat: freeze ssh and vnc port contracts

Define the minimum machine networking surface for the next host slice and
limit exposed guest ports to SSH and VNC.

contract/machines.go

@@ -7,8 +7,9 @@ type Machine struct {
 	Artifact       ArtifactRef   `json:"artifact"`
 	SystemVolumeID VolumeID      `json:"system_volume_id,omitempty"`
 	UserVolumeIDs  []VolumeID    `json:"user_volume_ids,omitempty"`
-	Phase          MachinePhase `json:"phase"`
 	RuntimeHost    string        `json:"runtime_host,omitempty"`
+	Ports          []MachinePort `json:"ports,omitempty"`
+	Phase          MachinePhase  `json:"phase"`
 	Error          string        `json:"error,omitempty"`
 	CreatedAt      time.Time     `json:"created_at"`
 	StartedAt      *time.Time    `json:"started_at,omitempty"`

contract/networking.go

@@ -0,0 +1,20 @@
+package host
+
+type MachinePortName string
+
+type PortProtocol string
+
+const (
+	MachinePortNameSSH MachinePortName = "ssh"
+	MachinePortNameVNC MachinePortName = "vnc"
+)
+
+const (
+	PortProtocolTCP PortProtocol = "tcp"
+)
+
+type MachinePort struct {
+	Name     MachinePortName `json:"name"`
+	Port     uint16          `json:"port"`
+	Protocol PortProtocol    `json:"protocol"`
+}

internal/model/types.go

@@ -27,8 +27,10 @@ type MachineRecord struct {
 	Artifact       contracthost.ArtifactRef
 	SystemVolumeID contracthost.VolumeID
 	UserVolumeIDs  []contracthost.VolumeID
-	Phase          contracthost.MachinePhase
 	RuntimeHost    string
+	TapDevice      string
+	Ports          []contracthost.MachinePort
+	Phase          contracthost.MachinePhase
 	Error          string
 	CreatedAt      time.Time
 	StartedAt      *time.Time