Any agent workload is one of six shapes, built from two kinds of thing
The platform does not care what the agent does or which framework it uses. A definition is durable and reviewed. A run is a disposable instance of it. A long-running service agent is just the durable half, deployed the way any application is.
Principle honored
Definition durable, run ephemeral. Service agents reuse the existing application path, so nothing new is invented for them.
What changes
Today: an AgentDefinition YAML in git, schema-validated in CI.
Later: an Agent XRD so Tower generates a New Agent form from it, like every other XRD.
Triggers are part of the definition; each firing becomes an AgentRun.
Verify live
Run one agent of each shape, and one that should be refused (a delegated agent triggered by cron, which Clearance denies). The refusal is the more useful test.