Add trusted installed-contract admission

[flyingrobots]

Summary

• add an Echo-owned trusted-host admission path for witnessed generated-contract submissions
• derive domain-separated admission evidence from witnessed submission and verified package identity
• keep caller-authored Optic tickets out of application contract hosts
• repair the canonical contract-path test slice feature set and update current docs

Verification

• cargo xtask test-slice contract-path-release
• cargo clippy -p warp-core --features native_rule_bootstrap,trusted_runtime,host_test --lib -- -D warnings
• cargo clippy -p warp-core --features native_rule_bootstrap,trusted_runtime,host_test --test trusted_runtime_host_loop_tests -- -D warnings

Documentation

Updated the local contract-host quickstart, Jim/Echo case study, and changelog to reflect the Echo-owned admission boundary.

Summary by CodeRabbit

• New Features

  • Trusted hosts can now admit witnessed installed-contract submissions without caller-provided ticket authority.
  • Resulting receipts are bound to verified installed-package evidence.
  • Explicit ticket-based staging remains available for Optic admissions.

• Documentation

  • Updated the local contract-host quickstart and Jim-and-Echo case study to describe the new admission flow.

• Tests

  • Added coverage confirming installed-contract submissions are admitted and applied successfully.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: d59c294d-ae37-45f1-8649-57fffd3f3dfc

📥 Commits

Reviewing files that changed from the base of the PR and between d8b5e4a and 90f63ae.

📒 Files selected for processing (7)

• CHANGELOG.md
• crates/warp-core/src/coordinator.rs
• crates/warp-core/src/trusted_runtime_host.rs
• crates/warp-core/tests/trusted_runtime_host_loop_tests.rs
• docs/case-studies/JimAndEcho.md
• docs/quickstart-local-contract-host.md
• xtask/src/main.rs

---

📝 Walkthrough

Walkthrough

TrustedRuntimeHost now admits witnessed installed-contract submissions by deriving a domain-separated digest from submission and package identity, then staging digest-based runtime ingress with installed-contract evidence. Runtime helpers, tests, documentation, changelog text, and the ContractPathRelease test slice are updated.

Changes

Installed-contract admission

Layer / File(s)	Summary
Digest-based ingress plumbing crates/warp-core/src/coordinator.rs	Runtime ingress helpers now receive admission digests directly and preserve installed-contract evidence lookup and staging.
Trusted host admission flow crates/warp-core/src/trusted_runtime_host.rs, crates/warp-core/tests/trusted_runtime_host_loop_tests.rs	TrustedRuntimeHost derives host admission digests, stages witnessed submissions, and tests receipt and contract evidence binding.
Surface and test-slice updates CHANGELOG.md, docs/case-studies/JimAndEcho.md, docs/quickstart-local-contract-host.md, xtask/src/main.rs	Documentation and changelog text describe the new host API, while ContractPathRelease includes the host_test feature and updated expectation.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant HostApplication
  participant TrustedRuntimeHost
  participant WorldlineRuntime
  participant InstalledContractEngine

  HostApplication->>TrustedRuntimeHost: submit witnessed installed-contract intent
  TrustedRuntimeHost->>TrustedRuntimeHost: decode operation and derive admission digest
  TrustedRuntimeHost->>InstalledContractEngine: fetch mutation evidence
  TrustedRuntimeHost->>WorldlineRuntime: admit submission with digest and evidence
  WorldlineRuntime-->>TrustedRuntimeHost: return staged ingress disposition
  TrustedRuntimeHost->>WorldlineRuntime: run until idle
  WorldlineRuntime-->>HostApplication: applied receipt with matching digest

Loading

Possibly related PRs

• flyingrobots/echo#360: Covers the ticketed-ingress staging and admission digest mechanics used by this change.
• flyingrobots/echo#368: Extends the installed-contract intent pipeline into ticketed-ingress handling.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the new trusted host admission path for installed-contract submissions.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch installed-contract-host-admission

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}