Skip to content

Add Echo-owned file aperture - #540

Merged
flyingrobots merged 10 commits into
mainfrom
echo-owned-file-aperture
Jun 13, 2026
Merged

Add Echo-owned file aperture#540
flyingrobots merged 10 commits into
mainfrom
echo-owned-file-aperture

Conversation

@flyingrobots

@flyingrobots flyingrobots commented Jun 13, 2026

Copy link
Copy Markdown
Owner

Summary

Adds the Echo-owned file aperture slice for issue #533.

This PR preserves the previously pushed branch history from origin/chore/disable-markdown-line-length-lint by regular-merging it into a better-named branch from current origin/main.

What changed

  • Adds crates/echo-file-aperture as a workspace member.
  • Defines deterministic host-file observation, file-site identity posture, basis tokens, content proposal admission, stale-basis obstruction, and materialization verification.
  • Adds focused file aperture contract tests.
  • Adds docs/design/echo-owned-file-aperture.md linked to issue Echo-owned file aperture #533.
  • Updates Method/design-template docs for the GitHub-Issues-backed backlog flow.
  • Adds markdownlint config that disables line-length linting and ignores generated/dependency directories.

Validation

  • cargo fmt --check
  • git diff --check origin/main...HEAD
  • cargo check -p echo-file-aperture
  • cargo test -p echo-file-aperture
  • cargo clippy -p echo-file-aperture --all-targets -- -D warnings
  • pnpm exec markdownlint-cli2 METHOD.md docs/method/README.md docs/method/design-template.md docs/design/echo-owned-file-aperture.md crates/echo-file-aperture/README.md
  • scripts/check-no-app-nouns-in-core.sh
  • pre-push hook: cargo fmt --all -- --check, cargo check -p echo-file-aperture --quiet, focused echo-file-aperture tests, and Prettier on touched markdown

Closes #533.

Summary by CodeRabbit

  • New Features

    • Introduced file aperture component for deterministic file identity tracking, content verification, and materialization workflows.
  • Documentation

    • Added comprehensive design specification for file aperture contract and behaviors.
    • Updated process methodology and design template documentation.
    • Expanded technical teardown with new subsections on system architecture and workflows.
  • Chores

    • Updated workspace configuration and linting rules.

@coderabbitai

coderabbitai Bot commented Jun 13, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Warning

Review limit reached

@flyingrobots, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 47 minutes and 38 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more credits in the billing tab to continue.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 4a8d8822-1a48-4412-a8b9-900829486774

📥 Commits

Reviewing files that changed from the base of the PR and between 7a7e2ba and 1aa2a6d.

📒 Files selected for processing (4)
  • CHANGELOG.md
  • crates/echo-file-aperture/src/lib.rs
  • crates/echo-file-aperture/tests/file_aperture_tests.rs
  • docs/BEARING.md
📝 Walkthrough

Walkthrough

Introduces echo-file-aperture crate implementing deterministic host-file aperture contract with identity resolution (platform-stable/path-bound), content observation/proposal/verification, and in-memory state management. Adds PLATFORM-0533 design specification and evolves process doctrine: GitHub-issue-driven backlog lanes, comprehensive design templates with contract/posture sections, explicit "Witness" cycle requirement, and technical deep-dives on materialization flows.

Changes

Echo file aperture contract and in-memory implementation

Layer / File(s) Summary
Workspace integration and crate structure
.markdownlint-cli2.jsonc, Cargo.toml, crates/echo-file-aperture/Cargo.toml, crates/echo-file-aperture/README.md
Workspace registers new echo-file-aperture member with blake3/thiserror dependencies; linting disables line-length check and ignores node_modules/target.
File aperture identity and content digest types
crates/echo-file-aperture/src/lib.rs (FileSiteId–FileBasisToken, HostFileIdentity)
Deterministic FileSiteId derived from platform-identity or path-evidence; FileSiteIdentityPosture (PlatformStable/PathBound); HostFileIdentity validates non-empty path/platform evidence and resolves site posture.
Host file observation and verification contracts
crates/echo-file-aperture/src/lib.rs (HostFileMetadata–FileApertureError)
Deterministic metadata/fingerprint from bytes; snapshot bundling identity+bytes; observation postures (InitialImport/Unchanged/ExternalChange); proposal/verification receipts; centralized error enum (empty evidence, length overflow, unknown site, stale basis, identity mismatch).
InMemoryFileAperture implementation with state management
crates/echo-file-aperture/src/lib.rs (InMemoryFileAperture–helpers)
Four operations: observe records per-site state and computes posture; projection reads current state; propose_content validates basis and advances state on digest change; verify_materialization confirms site/basis and digests; internal FileState tracks generation/digest/posture/bytes; deterministic length/hash/hex helpers.
File aperture contract test suite
crates/echo-file-aperture/tests/file_aperture_tests.rs
Validates platform-identity stability across path moves, path-bound identity distinctness, platform-derivation path-independence, observation postures (initial/unchanged/external), content proposals with stale-basis rejection, materialization digest matching and mismatch; 15 test cases covering identity/observation/proposal/verification flows.

PLATFORM-0533 design specification

Layer / File(s) Summary
Echo-owned file aperture design document
docs/design/echo-owned-file-aperture.md
Comprehensive spec: YAML frontmatter, decision/sponsorship/hill/current truth, problem/scope/non-goals, UX open/save flows with drift/basis handling, runtime/API contract enums, in-memory data model, authority boundary, determinism/WAL/accessibility/localization/inspectability postures, linked invariants, design alternatives (Option A/B), chosen decision, implementation slices, first-to-write tests, acceptance criteria, validation commands, risks/mitigations, follow-on debt, retrospective.
Design signpost and navigation
docs/BEARING.md
Adds "Echo-owned file aperture" reference pointing to design spec.

Process evolution for backlog lanes, design templates, and cycle requirements

Layer / File(s) Summary
Backlog lanes and cycle loop with witness requirement
METHOD.md
GitHub-issue-driven backlog lanes (lane:inbox/asap/up-next/cool-ideas/bad-code/release); historical card archival rules; cycle loop adds explicit Witness stage for reproducible proof; naming conventions align branch slugs to issue titles and cycle IDs.
Design template and method documentation expansion
docs/method/design-template.md, docs/method/README.md
Design template completely rewritten with YAML frontmatter, decision/UX/contract/posture/invariant/alternative/slice/test/acceptance/validation/playback/risk/debt/retrospective sections; Method README mandates these sections for Design step, sources debt from GitHub lane:bad-code issues, directs closeout into GitHub Issues, clarifies cargo xtask method pull promotes legacy filesystem cards.
Technical documentation on tick, braids, and file materialization
docs/technical-teardown.md
Adds sections 17.6–17.8: GraphQL→Wesley→EINT→scheduler-tick→BTR walkthrough with boundaries, forks/strands/braids rules, file materialization/ingest covering opening/reading guarantees, drift admission, WAL-authorized fsync/atomic rename, effect tokens, crash recovery; updates System Mind Map, Glossary, Mental Model, Source of Truth Map, and Project Progress sections.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

  • flyingrobots/echo#369: Overlaps with METHOD.md backlog-lane doctrine and lane-matrix updates covering v0.1.0/milestone lane mappings.

Suggested labels

tooling

Poem

📦 A file opens—Echo watches,
Platform-stable, path-bound postures held,
Digest verified, basis true,
Witness required, method refined,
⚡ Materialization begins.

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title 'Add Echo-owned file aperture' is concise and directly describes the main change: adding a new crate with file aperture contract implementation.
Linked Issues check ✅ Passed All requirements from issue #533 are met: design document added, file aperture contract implemented with identity posture/basis/verification, and in-memory slice delivered.
Out of Scope Changes check ✅ Passed All changes directly support the file aperture implementation or related documentation (Method updates, markdownlint config, technical teardown). No unrelated work detected.
Docstring Coverage ✅ Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch echo-owned-file-aperture

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7a7e2ba9c0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread crates/echo-file-aperture/src/lib.rs

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (3)
docs/technical-teardown.md (1)

1706-1710: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Use warp-cli here, not echo-cli.

These examples conflict with the rest of the teardown, which consistently names the executable warp-cli and references crates/warp-cli/.... Keeping both names will mislead readers about the actual command surface.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/technical-teardown.md` around lines 1706 - 1710, The listed command
examples use the wrong executable name `echo-cli`; update each example to use
`warp-cli` instead (e.g., change `echo-cli verify <snapshot> ...` to `warp-cli
verify <snapshot> ...`, `echo-cli inspect` to `warp-cli inspect`, `echo-cli wal
doctor` to `warp-cli wal doctor`, `echo-cli wal submission-posture` to `warp-cli
wal submission-posture`, and `echo-cli bench` to `warp-cli bench`) so the
examples match the rest of the teardown that references `warp-cli`.
docs/method/README.md (1)

128-130: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Align branch naming with the cycle-id exception.

This rule is incomplete relative to METHOD.md: explicit cycle work can use cycle/<id>-<slug>, so “lowercase slugs of the issue title” is not the full naming rule.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/method/README.md` around lines 128 - 130, The branch-naming guidance is
incomplete: update the sentence that currently says "Branch names should be
lowercase slugs of the issue title" to also allow explicit cycle work using the
cycle/<id>-<slug> form per METHOD.md and clarify that lowercase slugging still
applies to the <slug> portion; mention the cycle/<id>-<slug> pattern and keep
the existing guidance about lowercase slugs and legend:* labels (or similar) so
readers know both styles are valid.
docs/design/echo-owned-file-aperture.md (1)

514-517: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Update the PR status line; it is stale.

The packet says the PR is not opened yet, but this change is in open PR #540. Please update this section to the current PR reference/state.

As per coding guidelines, docs under docs/**/*.md should prioritize factual accuracy and stale cross-reference detection.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/design/echo-owned-file-aperture.md` around lines 514 - 517, Replace the
stale PR status line "Not opened yet for this branch." (the PR: line in the
diff) with the current PR reference and state for the change (e.g., "Open in PR
`#540`" and include the PR URL); ensure the updated line accurately reflects the
open PR number and, optionally, a short status like "Open" or "Merged" as
appropriate and add the PR link for factual cross-reference.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/echo-file-aperture/src/lib.rs`:
- Around line 548-549: The code trusts snapshot.fingerprint.content_digest which
can be inconsistent with snapshot.bytes; recompute the content digest from
snapshot.bytes at the aperture boundary and use that computed value (not
snapshot.fingerprint.content_digest) when deciding posture/verification. In
practice: inside observe and verify_materialization, replace uses of
snapshot.fingerprint.content_digest with a freshly computed digest (e.g., let
computed_digest = compute_content_digest(&snapshot.bytes) or the existing digest
helper used elsewhere), update any local fingerprint/fingerprint-derived
variables from that computed_digest, and base the Unchanged/Verified comparisons
on the recomputed_digest; apply this same change in both observe and
verify_materialization call sites mentioned (the existing variables fingerprint
and posture logic).

In `@crates/echo-file-aperture/tests/file_aperture_tests.rs`:
- Around line 223-244: Add a regression test named
verification_digest_mismatch_returns_materialization_obstruction that constructs
an intentionally inconsistent HostFileSnapshot (mismatched bytes vs fingerprint)
and uses InMemoryFileAperture::observe and verify_materialization to ensure
digests are derived from the snapshot bytes; specifically, create an initial
snapshot via snapshot("/tmp/demo.txt", b"one")?, create a FileContentProposal
using the observed projection (FileContentProposal::new with initial.site_id and
initial.projection.basis), admit it via propose_content, then call
verify_materialization with a snapshot whose bytes differ from the expected
digest (e.g., snapshot("/tmp/demo.txt", b"not-three")?) and assert
MaterializationVerificationPosture::DigestMismatch and that expected_digest !=
observed_digest so the test prevents future reintroduction of digest/bytes
divergence.

In `@docs/BEARING.md`:
- Around line 27-29: Update the "Last updated" header in BEARING.md (the
document header field currently showing "2026-05-25") to the actual date the new
design pointer was added so the signpost metadata is not stale; only change the
header timestamp to the correct updated date and do not alter the new design
pointer entry text.

---

Outside diff comments:
In `@docs/design/echo-owned-file-aperture.md`:
- Around line 514-517: Replace the stale PR status line "Not opened yet for this
branch." (the PR: line in the diff) with the current PR reference and state for
the change (e.g., "Open in PR `#540`" and include the PR URL); ensure the updated
line accurately reflects the open PR number and, optionally, a short status like
"Open" or "Merged" as appropriate and add the PR link for factual
cross-reference.

In `@docs/method/README.md`:
- Around line 128-130: The branch-naming guidance is incomplete: update the
sentence that currently says "Branch names should be lowercase slugs of the
issue title" to also allow explicit cycle work using the cycle/<id>-<slug> form
per METHOD.md and clarify that lowercase slugging still applies to the <slug>
portion; mention the cycle/<id>-<slug> pattern and keep the existing guidance
about lowercase slugs and legend:* labels (or similar) so readers know both
styles are valid.

In `@docs/technical-teardown.md`:
- Around line 1706-1710: The listed command examples use the wrong executable
name `echo-cli`; update each example to use `warp-cli` instead (e.g., change
`echo-cli verify <snapshot> ...` to `warp-cli verify <snapshot> ...`, `echo-cli
inspect` to `warp-cli inspect`, `echo-cli wal doctor` to `warp-cli wal doctor`,
`echo-cli wal submission-posture` to `warp-cli wal submission-posture`, and
`echo-cli bench` to `warp-cli bench`) so the examples match the rest of the
teardown that references `warp-cli`.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: e56f8f53-b669-4faa-8a55-bcf4bc037345

📥 Commits

Reviewing files that changed from the base of the PR and between 3c4a3d0 and 7a7e2ba.

⛔ Files ignored due to path filters (1)
  • Cargo.lock is excluded by !**/*.lock
📒 Files selected for processing (12)
  • .markdownlint-cli2.jsonc
  • Cargo.toml
  • METHOD.md
  • crates/echo-file-aperture/Cargo.toml
  • crates/echo-file-aperture/README.md
  • crates/echo-file-aperture/src/lib.rs
  • crates/echo-file-aperture/tests/file_aperture_tests.rs
  • docs/BEARING.md
  • docs/design/echo-owned-file-aperture.md
  • docs/method/README.md
  • docs/method/design-template.md
  • docs/technical-teardown.md

Comment thread crates/echo-file-aperture/src/lib.rs
Comment thread crates/echo-file-aperture/tests/file_aperture_tests.rs
Comment thread docs/BEARING.md
@flyingrobots

Copy link
Copy Markdown
Owner Author

Code Lawyer Activity Summary

Deep self-audit found no additional independent issues beyond the review-thread findings below.

# Severity Source File(s) Commit Outcome
1 P1 PR review: Codex; CodeRabbit duplicate crates/echo-file-aperture/src/lib.rs, crates/echo-file-aperture/tests/file_aperture_tests.rs, CHANGELOG.md 422d8519 Fixed forged HostFileSnapshot bytes/fingerprint divergence by normalizing snapshot material at the aperture boundary; added deterministic regression coverage; review threads resolved.
2 P3 PR review: CodeRabbit docs/BEARING.md 1aa2a6d5 Refreshed the BEARING header date to 2026-06-03, matching the file-aperture design pointer addition; review thread resolved.

Validation executed:

  • cargo fmt --check
  • cargo check -p echo-file-aperture
  • cargo test -p echo-file-aperture
  • cargo clippy -p echo-file-aperture --all-targets -- -D warnings
  • pnpm exec markdownlint-cli2 METHOD.md docs/method/README.md docs/method/design-template.md docs/design/echo-owned-file-aperture.md crates/echo-file-aperture/README.md CHANGELOG.md
  • git diff --check origin/main...HEAD
  • scripts/check-no-app-nouns-in-core.sh
  • scripts/check_spdx.sh
  • test "$(sed -n '6p' docs/BEARING.md)" = "Last updated: 2026-06-03."
  • pnpm exec markdownlint-cli2 docs/BEARING.md
  • git diff --check

Review-thread state after fixes: 0 unresolved.

@flyingrobots
flyingrobots merged commit a0af251 into main Jun 13, 2026
36 checks passed
@flyingrobots
flyingrobots deleted the echo-owned-file-aperture branch June 13, 2026 06:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Echo-owned file aperture

1 participant