Wesley Footprint Honesty Artifact Attestation

[flyingrobots]

Migrated from Method backlog

This issue was created from a legacy filesystem backlog card. GitHub Issues are now the live work tracker; repository docs remain Method evidence.

Source backlog: docs/method/backlog/up-next/PLATFORM_wesley-footprint-honesty-artifact-attestation.md
Original lane: up-next
Original legend: PLATFORM

Original backlog card

Wesley Footprint Honesty Artifact Attestation

Status: planned generated-artifact hardening.

Depends on:

• Continuum proof family runtime cutover
• Contract-aware receipts and readings
• Authenticated Wesley intent admission posture

Why now

warp-core already has runtime footprint guards that catch executor reads and
writes outside a declared Footprint.
Those guards are the right safety net for debug builds, development, and
untrusted code paths.

For Wesley-compiled GraphQL contracts, Echo also needs a stronger generated
artifact story:

GraphQL footprint declaration
  -> Wesley compile-time access surface
  -> Rust/TypeScript generated artifacts
  -> artifact hash / certificate
  -> Echo load-time attestation
  -> release runtime may skip per-access footprint guards for trusted artifacts

The point is not to remove footprint honesty. The point is to move the primary
enforcement for trusted Wesley artifacts to compile time, then verify the
compiled artifact identity once when it is loaded.

What it should look like

Wesley should lower authored footprint directives into an artifact-level
footprint contract. Generated Rust should expose only the declared read/write
capabilities to the operation implementation. If the implementation reaches
outside its declared footprint, it should fail to compile.

Generated TypeScript should carry the same footprint metadata and artifact
fingerprint for toolchain and cross-runtime agreement. TypeScript cannot provide
the same hard boundary as Rust in every case, but it can still participate in
schema/hash parity, generated metadata checks, and fixture-level compile
verification.

The generated artifact should include a stable footprint certificate naming:

• contract family
• schema hash
• operation id and operation name
• declared read/write footprint
• generator identity and version
• Echo ABI or registry version
• generated Rust artifact hash
• generated TypeScript artifact hash, when present
• footprint certificate hash

At runtime, Echo or the host should compare the loaded artifact's certificate
hash and generated artifact hash with the trusted registry metadata on first
load. After that:

• trusted compile-time-certified artifacts may use the optimized release path
  without per-access footprint guards;
• debug builds and footprint_enforce_release may still run guards as a safety
  net;
• missing, mismatched, or unsupported certificates reject or fall back to an
  explicitly runtime-guarded posture according to host policy;
• no path silently treats an uncertified artifact as footprint-honest.

Acceptance criteria

• One Wesley-generated Rust proof slice exposes a declared footprint as typed
  capabilities.
• One valid generated Rust implementation compiles and runs through the Echo
  host path.
• One invalid implementation that reads or writes outside the declared
  footprint fails to compile.
• The generated Rust and TypeScript artifacts name the same schema hash,
  footprint certificate hash, and operation footprint metadata.
• Echo load-time registration compares the artifact hash or certificate hash
  before enabling the trusted optimized posture.
• A hash mismatch returns a typed rejection or obstruction, not a silent
  runtime downgrade.
• Runtime footprint guards remain available as debug / opt-in / untrusted-path
  enforcement.

Non-goals

• Do not remove FootprintGuard.
• Do not make TypeScript the sole hard enforcement boundary.
• Do not add app-specific footprint nouns to Echo core.
• Do not require IPA, Verkle, SNARK, STARK, or proof-carrying apertures.
• Do not skip runtime checks for artifacts whose hash or certificate was not
  verified.
• Do not trust generated source text without a stable compiled-artifact
  identity.

Notes

Initial Echo-side runway landed:

• echo-registry-api::OpDef can carry an optional no-std
  FootprintCertificate.
• echo-wesley-gen emits deterministic per-operation footprint artifact and
  certificate hashes from @wes_footprint metadata, operation argument shape,
  and the generated Rust artifact manifest hash.
• Generated registry consumers can compare a certificate hash at load time via
  OpDef::footprint_certificate_matches(...).
• Hosts can verify a generated registry artifact with
  echo_registry_api::verify_contract_artifact(...), which checks schema,
  codec, registry layout, expected footprint certificate hashes, optional
  generated artifact hashes, and a policy requiring mutation operations to be
  backed by expected certificates.

This is not the full closeout. The remaining hardening is the real
compile-time capability boundary and cross-artifact Rust/TypeScript compiled
artifact identity.

The expected posture vocabulary is:

CompileTimeCertified
RuntimeGuarded
UntrustedRejected
UnsupportedObstructed

This keeps release performance honest without weakening the safety model:
runtime checks become the fallback and development guardrail, while trusted
Wesley-compiled artifacts carry a load-time certificate that proves the
compile-time footprint boundary was the one Echo is about to execute.

[coderabbitai]

🔗 Related PRs

flyingrobots/echo#326 - Echo contract hosting roadmap [merged]
flyingrobots/echo#329 - Stack Witness 0001 fixture-backed jedit walking skeleton [merged]
flyingrobots/echo#344 - feat(wesley): consume canonical requirements artifacts [merged]
flyingrobots/echo#365 - feat(wesley): emit query observer host helpers [merged]
flyingrobots/echo#371 - feat(core): advance v0.1 contract evidence and retention [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[coderabbitai]

🔗 Related PRs

#472 - [codex] Advance Continuum inspectability and METHOD closeout [merged]
#497 - chore(release): v0.0.1 [merged]
#499 - test(stack): add Stack Witness 0001 fixture artifact shape [merged]
#504 - Compile runtime optic artifacts [merged]
#618 - feat: LE binary Rust codec emitter (le-binary-rust) + output-object codecs [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[flyingrobots]

Bookkeeping triage: restored the required scheduling-state label triage:requests. This issue remains valid intake, but it is not selected for a named release lane yet.

[flyingrobots]

Roadmap reconsideration after the Rust-native reset:

Closing this as not actionable in Wesley as written. The issue is a migrated card with Echo/Continuum/runtime-specific footprint attestation, generated artifact certificates, Echo load-time policy, and trusted optimized runtime posture.

Current boundary: Wesley can emit generic structural artifacts, operation facts, hashes, external target envelopes, and evidence inputs. Echo or another owning runtime must own load-time attestation, runtime posture names, registry trust policy, and operation execution semantics.

If Wesley still needs generic work here, it should be re-filed as narrow compiler/evidence slices, for example:

• operation artifact metadata fields,
• generated artifact hash manifest behavior,
• external target artifact-manifest validation,
• generic evidence schema coverage.

This card mixes too many owning repos and should not remain a Wesley roadmap task.