Execute basis-bound validated workspace patches

[flyingrobots]

Outcome

Echo durably coordinates one domain-specific validated workspace patch effect without granting Edict, a model, or the compiler/provider seam ambient filesystem authority.

Acceptance

• consumes the exact compiler-owned and independently verified Edict request representation;
• admits the request to the WAL before mutation and binds the exact observation basis, patch identity, writable aperture, policy identity, and budgets;
• grants only the admitted validated artifact and exact authority scope to a narrow no-follow workspace adapter;
• obstructs stale basis, escaped paths, policy-forbidden CI workflow paths, substituted grants, special files, and out-of-budget writes before mutation;
• admits terminal settlement before publication and binds request, attempt, precondition basis, resulting basis, and postcondition evidence;
• reconciles an ambiguous attempt by observing the postcondition or admits outcomeUnknown without repeating an unverified write;
• restart recovers requested, claimed, settled, and ambiguous postures;
• identical settlement retry is effect-free and conflicting settlement obstructs;
• replay consumes retained evidence and never reapplies the patch;
• no generic filesystem-write, shell, Git, network, or model callback is introduced;
• production code contains no Hello Echo, Graft, greeting, or application-specific vocabulary.

Dependency

Blocked by flyingrobots/edict#178. The native edge is maintained through GraphQL.

Downstream

Blocks flyingrobots/hello-echo#11.

[coderabbitai]

🔗 Related PRs

#683 - Execute admitted data-only operations in Echo [merged]
#688 - Route executable-operation Actions through scheduler-owned Ticks [merged]
#704 - Add durable external-action settlement protocol [merged]
#706 - Host bounded workspace observations [merged]
#710 - Admit observation uncertainty without workspace authority [open]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!