[codex] Add Graft Echo readiness ASAP cards

[flyingrobots]

Summary

• Adds the Graft/Echo TypeScript integration requirements design packet.
• Adds four asap/ backlog cards for the Graft-only pre-Echo slices:
  • structural-history evidence label alignment
  • structural-history Echo package descriptor
  • fake Echo-shaped TypeScript witness
  • StructuralReadingPort generated-model parity
• Updates docs/BEARING.md to make the pre-Echo execution plan and Echo integration gate explicit.

Why

Graft can proceed through several schema-authority and adapter-boundary slices without changing Echo. These docs turn that boundary into visible backlog work and make the handoff point explicit before any future claim of real echo-native evidence.

Validation

Not run. This is a docs-only planning change, and local validation was not explicitly requested for this turn.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (8)

• docs/BEARING.md is excluded by !**/*.md
• docs/design/CORE_graft-echo-typescript-integration-requirements.md is excluded by !**/*.md
• docs/method/backlog/asap/CORE_graft-fake-echo-shaped-typescript-witness.md is excluded by !**/*.md
• docs/method/backlog/asap/CORE_graft-structural-history-echo-package-descriptor.md is excluded by !**/*.md
• docs/method/backlog/asap/CORE_structural-history-evidence-label-alignment.md is excluded by !**/*.md
• docs/method/backlog/asap/CORE_structural-reading-port-generated-model-parity.md is excluded by !**/*.md
• docs/method/backlog/dependency-dag.dot is excluded by !**/*.dot
• docs/method/backlog/dependency-dag.svg is excluded by !**/*.svg

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 60598bba-05f6-41ba-a991-1e71437d701d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/graft-echo-requirements-asap-cards

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2d8586d3e0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep package install out of the app-safe client

In this design packet the interface is explicitly the TypeScript-facing app-safe client, but installOrVerifyPackage gives that client package-install authority; the same document later forbids app packages from exporting package-install/runtime configuration authority. If implementers follow this interface literally for the fake witness or real adapter, Graft can end up depending on trusted-host capabilities in the app boundary the plan is trying to preserve, so split installation into a host-only API and leave only compatibility verification on this surface.

Useful? React with 👍 / 👎.

[flyingrobots]

@codex Self-Code Review findings for PR #63.

Severity	File	Lines	Infraction	Evidence	Recommended mitigation prompt
P2	docs/design/CORE_graft-echo-typescript-integration-requirements.md	137-144, 163-178	Authority-boundary contradiction	The app-facing EchoContractClient example includes installOrVerifyPackage?, but the same section later forbids package installation authority from the app-facing TypeScript surface and says trusted-host entry points should be physically separate.	"Repair the Echo TypeScript integration design so the app-safe client never exposes package installation authority. Split package verification from trusted-host installation, rename the app method to compatibility verification only, and document installation as trusted-host-only."
P2	docs/design/CORE_graft-echo-typescript-integration-requirements.md	8-16, 61-72, 617-641	Design packet is missing explicit top-level acceptance criteria and playback questions	The packet has ## Hill and ## Non-goals, then later ## Open Questions and ## Decision Record, but no top-level ## Acceptance Criteria or ## Playback Questions. This violates the repo design-packet doctrine and explains why the scoped Method drift saw zero playback questions for the cycle.	"Add top-level Acceptance Criteria and Playback Questions sections to the Graft Echo TypeScript integration requirements packet, covering the four Graft-only pre-Echo slices and the Echo integration gate."
P3	docs/design/CORE_graft-echo-typescript-integration-requirements.md	548-599	Suggested Graft planning cards drift from the actual ASAP cards	The design lists only three suggested Graft cards and names CORE_graft-fake-echo-shaped-contract-witness, but the PR adds four ASAP cards and the actual fake-witness card is CORE_graft-fake-echo-shaped-typescript-witness. The parity card is omitted from the suggested-card section.	"Update the Suggested Graft Planning Cards section so it exactly matches the four ASAP cards added in this PR, including the CORE_graft-fake-echo-shaped-typescript-witness slug and the CORE_structural-reading-port-generated-model-parity card."
P3	docs/method/backlog/asap/*.md	card frontmatter lines 1-18; docs/BEARING.md 122-149	Locked sequence is not machine-readable in backlog metadata	BEARING defines slices 1-4 as a locked execution plan, but the new ASAP card frontmatter only sets numeric priority and no dependency metadata. The regenerated DAG therefore shows all four ASAP cards as independent nodes, so Method tooling cannot enforce the documented order.	"Add machine-readable dependency metadata to the four ASAP cards, or explicitly document that the cards may be pulled independently. If order is required, encode evidence-label alignment before descriptor, descriptor before fake witness, and fake witness before generated-model parity, then regenerate the backlog DAG."

Status observed during review: worktree clean at lockdown, git fetch origin completed, gh auth valid, git diff --check origin/main...HEAD clean, PR #63 CI green on Node 20 and Node 22, CodeRabbit passing.

[chatgpt-codex-connector]

To use Codex here, create an environment for this repo.

[flyingrobots]

Self-review follow-up: all four findings from comment 4589637882 were addressed in commit 895d9c99.

Finding	Outcome
App-safe client exposed package install/verify ambiguity	Replaced with compatibility verification and documented package installation as trusted-host-only.
Design packet lacked top-level acceptance criteria/playback questions	Added ## Acceptance Criteria and ## Playback Questions.
Suggested Graft planning cards drifted from actual ASAP cards	Updated the section to match the four ASAP cards and corrected the fake-witness slug.
Locked slice order was not machine-readable	Added blocked_by metadata to encode the ASAP sequence and regenerated dependency-dag.dot / dependency-dag.svg.

CI has restarted for the new commit; Node 20 and Node 22 checks were pending when this update was posted.