Runtime Truth ratchet and Think-on-Echo model seam

.github/PULL_REQUEST_TEMPLATE.md

@@ -8,3 +8,12 @@
 - [ ] `npm run test:ports` passes
 - [ ] `npm run test:m1` passes
 - [ ] Docs updated if user-facing
+
+## Runtime Truth checklist
+
+- [ ] Core/domain code stays behind ports and adapters
+- [ ] Dependencies are injected from composition roots
+- [ ] Encoding/decoding stays at boundaries
+- [ ] Important runtime concepts use constructor-validated models
+- [ ] No new generic source `Error`/`TypeError` throws
+- [ ] No new strict-limit ratchet regressions

CHANGELOG.md

@@ -12,6 +12,11 @@ Release discipline:
 
 ## Unreleased
 
+- added a Runtime Truth ratchet to `npm run lint`, including strict-limit baseline enforcement and a generic source-error guard
+- added the Think-on-Echo proof seam with a model-derived GraphQL memory contract, Echo/Wesley capability probe, and pinned Think memory data model
+- fixed MCP capture to return after the raw local save when post-save graph follow-through is slow, matching the CLI trapdoor behavior
+- fixed graph migration commands to return a fast no-op when the graph model is already current
+- tightened PR review cleanup around lint arg forwarding, runtime ratchet hardening, Echo probe cleanup, and the Think memory contract timestamp scalar
 - fixed MCP tool result envelopes so structured content matches each registered output schema again
 - fixed checkpoint-backed reads to use public `@git-stunts/git-warp` package exports instead of private `node_modules` internals
 - fixed cached writer retries across raw capture follow-through, annotations, reflect writes, migrations, and enrichment patches

contracts/think-memory.graphql

@@ -0,0 +1,133 @@
+# Think-owned memory contract for the Echo proof.
+#
+# Source of truth:
+# docs/design/0068-think-memory-data-model/think-memory-data-model.md
+#
+# GraphQL expresses the Think memory model. Echo must only receive generated
+# generic intents and observation requests for this family.
+
+directive @wes_op(name: String!) on FIELD_DEFINITION
+directive @wes_footprint(reads: [String!], writes: [String!]) on FIELD_DEFINITION
+scalar DateTime
+
+enum ThoughtIngress {
+  CLI
+  MCP
+  MACOS
+  IMPORT
+  TEST
+  UNKNOWN
+}
+
+enum CausalRuntime {
+  ECHO
+  GIT_WARP
+  IMPORTED
+}
+
+enum RedactionState {
+  FULL
+  REDACTED
+  UNAVAILABLE
+}
+
+type ThoughtContent {
+  text: String!
+  mime: String!
+  digest: String!
+  length: Int
+  redactionState: RedactionState!
+}
+
+input ThoughtContentInput {
+  text: String!
+  mime: String!
+  digest: String!
+  length: Int
+}
+
+type CausalRef {
+  runtime: CausalRuntime!
+  coordinate: String
+  intentId: String
+  entryNodeId: String
+  basis: String
+  witness: String
+  migration: String
+}
+
+type ThoughtProvenance {
+  ingress: ThoughtIngress!
+  sourceApp: String
+  sourceUrl: String
+  ambientCwd: String
+  ambientGitRoot: String
+  ambientGitRemote: String
+  ambientGitBranch: String
+  importOrigin: String
+  repairOrigin: String
+}
+
+input ThoughtProvenanceInput {
+  ingress: ThoughtIngress!
+  sourceApp: String
+  sourceUrl: String
+  ambientCwd: String
+  ambientGitRoot: String
+  ambientGitRemote: String
+  ambientGitBranch: String
+  importOrigin: String
+  repairOrigin: String
+}
+
+type ThoughtCapture {
+  captureId: ID!
+  thoughtId: ID!
+  mindId: ID!
+  actorId: ID
+  writerId: ID
+  capturedAt: DateTime!
+  ingress: ThoughtIngress!
+  boundary: String
+  causalRef: CausalRef!
+}
+
+type ThoughtEntry {
+  thoughtId: ID!
+  mindId: ID!
+  capturedAt: DateTime!
+  content: ThoughtContent!
+  capture: ThoughtCapture!
+  provenance: ThoughtProvenance!
+  source: String
+  metadataJson: String
+  causalRef: CausalRef!
+}
+
+input CaptureThoughtInput {
+  mindId: ID!
+  actorId: ID
+  writerId: ID
+  capturedAt: DateTime!
+  content: ThoughtContentInput!
+  provenance: ThoughtProvenanceInput!
+  source: String
+  metadataJson: String
+}
+
+type CaptureThoughtResult {
+  entry: ThoughtEntry!
+  capture: ThoughtCapture!
+  causalRef: CausalRef!
+}
+
+type Query {
+  inspectThought(mindId: ID!, thoughtId: ID!): ThoughtEntry!
+    @wes_op(name: "InspectThought")
+}
+
+type Mutation {
+  captureThought(input: CaptureThoughtInput!): CaptureThoughtResult!
+    @wes_op(name: "CaptureThought")
+    @wes_footprint(reads: ["ThoughtEntry"], writes: ["ThoughtEntry"])
+}

docs/BEARING.md

@@ -12,20 +12,33 @@ timeline
 ## Active Gravity
 
 ### 0. Local Mind Repairability
+
 - Pulling `CORE_repair-v17-git-warp-minds` into cycle `0066`.
 - Making the git-warp v17 checkpoint repair path repeatable for local minds.
 - Keeping version-specific repair logic outside normal capture and read flows.
 
-### 1. Performance Hardening
+### 1. Think-on-Echo Runtime Proof
+
+- Proving raw capture plus exact inspect as a Think-owned application contract
+  hosted by Echo.
+- Keeping Think domain nouns in Think while Echo stays a generic dispatch and
+  observation substrate.
+- Using the proof to shape the next store boundary refactor without switching
+  production capture prematurely.
+
+### 2. Performance Hardening
+
 - Profiling CLI capture to identify Node startup and WARP graph bottlenecks.
 - Benchmark harness maturation for warm-path regression detection.
 - Sub-second capture latency as a non-negotiable target.
 
-### 2. Domain Integrity (SSJD)
+### 3. Domain Integrity (SSJD)
+
 - Refactoring the MCP service layer to move from "shape soup" to runtime-backed domain types.
 - Standardizing function signatures and boundary validation across the store and CLI layers.
 
-### 3. Orientation & Re-entry
+### 4. Orientation & Re-entry
+
 - Learning where the browse and remember surfaces fail through re-entry friction tracking.
 - Tuning hotkey ergonomics and macOS URL scheme reliability.
 
@@ -38,4 +51,7 @@ timeline
 
 ## Next Target
 
-The immediate focus is **Local Mind Repairability**: turn the manual git-warp v17 checkpoint recovery into an explicit, testable repair script for broken local minds.
+The immediate architecture focus is **Think-on-Echo contract proof**: prove raw
+capture plus exact inspect through Echo before any default production store
+switch. Local Mind Repairability remains the data-rescue lane for existing
+`git-warp` minds.