Fix: seal causal posture typestates

Author: flyingrobots

CHANGELOG.md

@@ -667,7 +667,9 @@ Applied, Rejected, Obstructed}` with receipt evidence and typed contract
   and `BraidMemberRef` so external consumers can handle public braid results.
 - `warp-core` shared-strand settlement handles now re-enter the live registry
   path before planning or settling, and crate-internal settlement helpers reject
-  stale handles that no longer match registered strand state.
+  stale handles that no longer match registered strand state. `CausalPostureState`
+  is sealed to Echo's marker types so external crates cannot add typestate
+  implementations outside the runtime posture gate.
 - `warp-wasm` settlement publication now maps non-`Shared` strand admission
   rejection to the stable `INVALID_STRAND` ABI error code instead of
   collapsing the lawful posture denial into `ENGINE_ERROR`.

crates/warp-core/src/revelation.rs

@@ -73,15 +73,25 @@ pub enum CausalPosture {
 #[deprecated(note = "Use CausalPosture")]
 pub type RevelationPosture = CausalPosture;
 
+mod posture_state_seal {
+    pub trait Sealed {}
+}
+
 /// Trait representing compile-time typestate for causal posture.
-pub trait CausalPostureState: Clone + std::fmt::Debug + PartialEq + Eq {
+///
+/// This trait is sealed to Echo's marker types. Runtime posture validation
+/// remains the authority for settlement admission.
+pub trait CausalPostureState:
+    Clone + std::fmt::Debug + PartialEq + Eq + posture_state_seal::Sealed
+{
     /// Returns the runtime CausalPosture value for this typestate, or None if dynamic.
     fn causal_posture() -> Option<CausalPosture>;
 }
 
 /// Marker struct representing the Shared causal posture.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub struct Shared;
+impl posture_state_seal::Sealed for Shared {}
 impl CausalPostureState for Shared {
     fn causal_posture() -> Option<CausalPosture> {
         Some(CausalPosture::Shared)
@@ -91,6 +101,7 @@ impl CausalPostureState for Shared {
 /// Marker struct representing the AuthorOnly causal posture.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub struct AuthorOnly;
+impl posture_state_seal::Sealed for AuthorOnly {}
 impl CausalPostureState for AuthorOnly {
     fn causal_posture() -> Option<CausalPosture> {
         Some(CausalPosture::AuthorOnly)
@@ -100,6 +111,7 @@ impl CausalPostureState for AuthorOnly {
 /// Marker struct representing the Scratch causal posture.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub struct Scratch;
+impl posture_state_seal::Sealed for Scratch {}
 impl CausalPostureState for Scratch {
     fn causal_posture() -> Option<CausalPosture> {
         Some(CausalPosture::Scratch)
@@ -109,6 +121,7 @@ impl CausalPostureState for Scratch {
 /// Representation of causal posture whose type is dynamic/erased at compile-time.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub struct DynamicPosture;
+impl posture_state_seal::Sealed for DynamicPosture {}
 impl CausalPostureState for DynamicPosture {
     fn causal_posture() -> Option<CausalPosture> {
         None

docs/design/0028-strand-typestates-proof-envelopes-and-evolving-braids/design.md

@@ -47,7 +47,13 @@ All four key gaps from the Echo codebase gap analysis now have current E1 surfac
 We define the typestate traits and marker structs to represent the four causal posture states:
 
 ```rust
-pub trait CausalPostureState: Clone + std::fmt::Debug + PartialEq + Eq {
+mod posture_state_seal {
+    pub trait Sealed {}
+}
+
+pub trait CausalPostureState:
+    Clone + std::fmt::Debug + PartialEq + Eq + posture_state_seal::Sealed
+{
     fn causal_posture() -> Option<CausalPosture>;
 }
 
@@ -56,24 +62,28 @@ pub struct AuthorOnly;
 pub struct Scratch;
 pub struct DynamicPosture;
 
+impl posture_state_seal::Sealed for Shared {}
 impl CausalPostureState for Shared {
     fn causal_posture() -> Option<CausalPosture> {
         Some(CausalPosture::Shared)
     }
 }
 
+impl posture_state_seal::Sealed for AuthorOnly {}
 impl CausalPostureState for AuthorOnly {
     fn causal_posture() -> Option<CausalPosture> {
         Some(CausalPosture::AuthorOnly)
     }
 }
 
+impl posture_state_seal::Sealed for Scratch {}
 impl CausalPostureState for Scratch {
     fn causal_posture() -> Option<CausalPosture> {
         Some(CausalPosture::Scratch)
     }
 }
 
+impl posture_state_seal::Sealed for DynamicPosture {}
 impl CausalPostureState for DynamicPosture {
     fn causal_posture() -> Option<CausalPosture> {
         None