feat(keep): verify the experimental Echo content identity bridge

.github/workflows/echo-keep-experimental.yml

@@ -0,0 +1,57 @@
+# SPDX-License-Identifier: Apache-2.0
+# © James Ross Ω FLYING•ROBOTS <https://github.com/flyingrobots>
+name: Experimental Keep contract
+on:
+  pull_request:
+  push:
+    branches: [main]
+permissions:
+  contents: read
+jobs:
+  identity:
+    name: Echo–Keep experimental conformance
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      CARGO_INCREMENTAL: 0
+      CARGO_BUILD_JOBS: 2
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@1.96.0
+        with:
+          components: rustfmt, clippy
+      - run: cargo test --manifest-path experiments/echo-keep/Cargo.toml --locked
+      - run: cargo clippy --manifest-path experiments/echo-keep/Cargo.toml --locked --all-targets -- -D warnings
+      - run: cargo fmt --manifest-path experiments/echo-keep/Cargo.toml -- --check
+      - name: Verify dependency-tree failure handling
+        run: bash scripts/tests/keep_dependency_boundary_test.sh
+      - name: Preserve the default CAS toolchain and dependency boundary
+        run: |
+          rustup toolchain install 1.90.0 --profile minimal
+          cargo +1.90.0 check --locked -p echo-cas
+          dependency_tree=$(cargo tree --locked -p echo-cas)
+          if grep -q "keep v" <<< "$dependency_tree"; then exit 1; fi
+
+  dependency-policy:
+    name: Experimental Keep dependency policy
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - name: Generate and verify scoped source policy
+        run: |
+          python3 scripts/keep_deny_policy.py .echo-keep-deny.toml
+          python3 scripts/tests/keep_deny_policy_test.py
+      - uses: EmbarkStudios/cargo-deny-action@76cd80eb775d7bbbd2d80292136d74d39e1b4918 # v2.0.14
+        with:
+          manifest-path: experiments/echo-keep/Cargo.toml
+          rust-version: "1.96.0"
+          arguments: --locked --all-features
+          command-arguments: --config /github/workspace/.echo-keep-deny.toml
+      - name: Remove generated policy
+        if: always()
+        run: rm -f .echo-keep-deny.toml

.github/workflows/security-audit.yml

@@ -31,6 +31,8 @@ jobs:
           if ! command -v cargo-audit >/dev/null; then
             cargo install cargo-audit --locked
           fi
+      - name: Verify isolated lockfile audit coverage
+        run: bash scripts/tests/keep_audit_lockfiles_test.sh
       - name: Run cargo audit
         run: |
           set -euo pipefail

CHANGELOG.md

@@ -7,6 +7,8 @@
 
 ### Added
 
+- An isolated experimental Echo–Keep identity bridge checks both independent hash laws and exact byte length from one bounded stream. It leaves the default CAS dependency graph unchanged.
+
 - A fallible complete-object CAS port stages and verifies exact bytes before atomic destination promotion. Memory and disk adapters share conformance checks; existing APIs remain compatible and no durability or authenticated absence is claimed.
 
 ### Fixed

CONTRIBUTING.md

@@ -128,6 +128,8 @@ prioritize:
 
 ### Runtime and provider toolchains
 
+The isolated `experiments/echo-keep` workspace requires Rust 1.96.0 and remains outside default dependency resolution. Its manifest is part of the same explicit MSRV inventory; experimental packages do not bypass the version guard.
+
 The general toolchain is Rust 1.96.0 because `bunny-num` 0.6.0 requires it.
 Numerical consumers declare MSRV 1.96.0. Independent leaves retain the workspace
 default MSRV 1.90.0; [the explicit policy](scripts/rust-msrv-policy.tsv) enumerates

docs/architecture/echo-keep-physical-content-boundary.md

@@ -6,7 +6,7 @@
 - **Status:** Accepted for experimental conformance; production adoption is
   not accepted.
 - **Decision date:** 2026-08-09
-- **Implementation posture:** `echo-cas::physical_content` supplies a fallible complete-object port and MemoryTier/DiskTier adapters. Borrowed views authenticate exact bytes but certify no pinned generation, complete-view absence, retention, synchronization, or crash durability. No Keep backend adapter is implemented yet.
+- **Implementation posture:** `experiments/echo-keep` supplies a bounded dual-identity bridge against Keep revision `3165890e9291cfb5fe10e81a9d7cd151f3e59464` in a separate Rust 1.96 workspace. `echo-cas::physical_content` supplies the fallible complete-object port and MemoryTier/DiskTier adapters. Borrowed views certify no pinned filesystem generation, complete-view absence, retention, synchronization, or crash durability. No Keep backend adapter is implemented yet. Echo CAS remains the default.
 - **Refines:** [Retained reading storage and proof boundary](../adr/0020-retained-reading-storage-and-proof-boundary.md)
 - **Depends on:** [Durable external-action settlement](../adr/0026-durable-external-action-settlement.md)
 - **Related:** [Keep authenticated reconstruction contract](https://github.com/flyingrobots/keep/blob/3bf7b9179db41e90620e6d1875c2d40222a2330b/docs/architecture/authenticated-reconstruction-contract.md)