[flyingrobots]

echo-cli wal submission-posture retained the complete receipt coordinate as canonical hex, but inspecting its components required decoding that byte string. Add receipt_coordinate JSON with named identity, worldline, tick, commit, submission, ticket, and receipt-content fields. Preserve the existing receipt_ref and text output.

The coordinate is null for pending, unknown, and conflicting-envelope submissions. Applied, rejected, and obstructed decisions can have receipts; this projection does not claim that a submission applied or grant authority. The CLI still reads recovered WAL evidence without changing it.

This finishes the structured CLI output from Jim's retained #659 work. The substantive receipt-history work was already ported and merged through #872. Current main also contains the retained canonical-parent, inverse-admission, correlation-membership, and duplicate-frame checks, so this PR does not replay those old branches. Related: #659, #660, #872.

Validation:

• RED: six submission-posture CLI cases failed because the new field was absent; two prior cases passed.
• GREEN: all eight submission-posture cases and all 27 CLI integration tests pass. A real trusted host produces the applied receipt, closes its filesystem WAL, and the CLI's recovered output is compared with every expected coordinate field. Pending, unknown, conflict, rejected, and obstructed cases are covered.
• Current mainline guarantees verified: 62 receipt-related core tests, all four external-consumer contract tests, the recovered-parent mismatch test, and the duplicate singular tick-evidence test pass. These include inverse rejection and receipt history across restart.
• Strict Clippy for all CLI targets, cargo check, Rust formatting, changed-document Markdown lint, whitespace checks, and signed-commit verification pass.
• Hosted CI is green at 0c326e6e, including the full core/workspace tests, provider-host contract, and independent build comparison.

The changelog is untouched because its four existing duplicate-heading lint failures are handled separately in #889. The edited CLI reference and WAL topic pass lint. No WAL codec, runtime admission/recovery behavior, application pin, or text output changed.

Summary by CodeRabbit

• New Features
  • The read-only submission-posture command now includes a structured receipt coordinate in JSON when a matching receipt is available, alongside the existing encoded receipt reference.
  • The coordinate is null when no matching receipt exists. Text output is unchanged.
• Documentation
  • Added guidance on inspecting receipt coordinates and when they appear.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: flyingrobots/echo/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: f3e74134-5273-4f64-bb40-d018d63520af

📥 Commits

Reviewing files that changed from the base of the PR and between 8f3f48f and 0c326e6.

📒 Files selected for processing: 4

• crates/warp-cli/README.md
• crates/warp-cli/src/wal.rs
• crates/warp-cli/tests/cli_integration.rs
• docs/topics/WAL.md

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The WAL submission-posture JSON output now includes an optional structured receipt coordinate derived from a matching receipt reference. Integration tests and documentation cover its fields and when it is null. Text output remains unchanged.

Changes: Receipt coordinate output

Layer / File(s)	Summary
Build and verify receipt coordinate output crates/warp-cli/src/wal.rs, crates/warp-cli/tests/cli_integration.rs, crates/warp-cli/README.md, docs/topics/WAL.md	The CLI converts a matching receipt reference into named coordinate fields. Tests check coordinate values for applied, obstructed, and rejected decisions, and check for null when no matching receipt exists. Documentation describes the fields and availability.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to 0c326

No actionable issue is established for the new JSON coordinate output; the change is mergeable after normal checks.

Security architecture risk: ⚪ Minimal · up to 0c326

The change presents existing receipt information in named JSON fields while preserving the canonical receipt reference and existing matching controls. The inspected changes do not add write access, grant authority, or treat a receipt as proof that a submission applied. No introduced or worsened security concern was identified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• observed — The changed exposure is the existing CLI JSON response for a user-selected WAL and submission. Named coordinate values are already encoded in receipt_ref, while identity_digest is deterministically derived from those bytes; the projection adds inspectability rather than additional underlying receipt information.

Trust Boundaries and Controls

• observed — Submission-ID and canonical-envelope matching occur before coordinate serialization. Core recovery retains rejection of conflicting acceptance records and conflicting receipt coordinates. These controls predate the PR and remain on the new projection's data path.
• observed — The command continues to recover with read-only access. The inspected recovery implementation excludes writable truncation in that mode, and receipt-reference possession does not itself grant authority. The added serialization introduces no shared-state transition or authority-granting call.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: exposing named receipt coordinates in WAL submission inspection.
Docstring Coverage		Docstring coverage is 88.89% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 9 functions across 2 files. (2 skipped: 2 u…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 88.89% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 9 functions across 2 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-18T21:38:48.159273Z	0c326e6	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.