Emit canonical external-request application artifacts

[flyingrobots]

Outcome

The public application build emits the exact compiler-owned Core and Target IR bytes for a typed external-action application, preserving the complete source and capability closure for an Echo host.

Acceptance

• add an explicit external-action application build kind; no inference from consumer vocabulary;
• load the exact .edict source, capability manifest/exports, declarative target adapter, target profile, and target configuration through the existing public manifest boundary;
• validate the complete capability closure and selected Echo target generically;
• compile exact source into canonical Core and Target IR;
• require at least one typed external-action request and reject mixed callable-step/request execution in the first route;
• require every request operation in the exact digest-locked capability closure;
• emit exact core.cbor and target-ir.cbor bytes from the owning canonical encoders;
• publish the pair atomically and clear or refuse stale executable-operation outputs;
• preserve the existing executable-operation build path byte-for-byte;
• never invoke a native application callback or construct an Echo runtime result;
• keep runtime admission, adapter execution, settlement, recovery, and replay outside Edict.

Test matrix

• golden request-only application build;
• missing/floating/substituted capability closure;
• mixed request plus callable target step refusal;
• stale-output cleanup and atomic rollback on publication failure;
• exact byte equality with direct canonical Core/Target encoders;
• deterministic rerun;
• malformed manifest and path escape;
• fixed-seed request variants;
• bounded multi-request stress;
• existing executable-operation build regression suite.

Non-goals

• external execution authority;
• Echo request/claim/settlement admission;
• provider imports for filesystem, process, network, Git, GitHub, or model access;
• application-specific request coordinates;
• an Edict-owned Echo protocol encoder.

Consumer

Blocking producer for flyingrobots/echo#705 and flyingrobots/hello-echo#10.

Native blocked by edges are maintained through GraphQL.

[coderabbitai]

🔗 Related PRs

#108 - Freeze canonical Target IR artifacts [merged]
#167 - Add Edict executable-operation prerequisites [merged]
#170 - Build verified external applications through provider components [merged]
#174 - Preserve typed result projections for Echo targets [merged]
#175 - Declare typed external action requests [open]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!