Host bounded workspace observation through external-action settlement

[flyingrobots]

Outcome

Echo hosts the first domain-specific external-action adapter for workspace.snapshot.observe@1 and exposes a generic local witness consumable by an external Edict application.

Acceptance

• consume the exact compiler-emitted Edict Core and Target IR artifacts and capability closure without inventing a provisional request format;
• derive the Echo request identity, scope, basis, budget, schemas, input digest, and reconciliation law from admitted compiler data;
• commit REQUESTED before any workspace observation;
• commit one bounded CLAIMED attempt before adapter execution;
• authorize only a configured workspace root and relative path set;
• make byte budget, symlink policy, and source basis explicit and fail closed;
• reject absolute, parent-escaping, symlink-escaping, unauthorized, stale-basis, and over-budget observations before returning bytes;
• admit schema-bound bytes or content references plus basis evidence as settlement before deterministic resumption;
• preserve generic duplicate, conflicting, malformed, and unauthorized settlement refusal;
• recover unclaimed, claimed, succeeded, rejected, failed, and outcome_unknown postures without inventing an outcome;
• replay a settled request from WAL without rereading the workspace;
• expose deterministic evidence that the request commit preceded adapter execution and the settlement commit preceded resumption;
• retain the compiler/provider seam as capability-denied.

Test matrix

• golden bounded file observation;
• unauthorized and escaped paths;
• symlink escape;
• exact byte boundary and one-byte-over refusal;
• stale basis;
• duplicate identical and conflicting settlements;
• crash/restart from requested and claimed postures;
• ambiguous execution as outcome_unknown;
• replay with the source file removed or mutated, proving no reread;
• fixed-seed path/value property cases;
• bounded multi-request stress.

Dependencies

• Specify durable external-action request and settlement protocol #694 — durable request/claim/settlement protocol;
• Emit canonical external-request application artifacts edict#176 — public compiler-owned Core and Target IR application artifacts.

Non-goals

• application-specific vocabulary or callbacks;
• ambient filesystem, process, shell, or network imports;
• Git, GitHub, timer, model, or patch-application adapters;
• language-level suspension;
• re-executing a settled effect.

Consumer

Blocked consumer: flyingrobots/hello-echo#10.

Native blocked by edges are maintained through GraphQL.

[coderabbitai]

🔗 Related PRs

#672 - Implement Echo Edict provider lowerer [merged]
#673 - Implement the Echo Target IR semantic verifier [merged]
#688 - Route executable-operation Actions through scheduler-owned Ticks [merged]
#701 - Evaluate package-declared typed application results [open]
#704 - Add durable external-action settlement protocol [open]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!