feat(daemon): add graph sync + project graph read surface (#270)

* feat(daemon): add graph sync + project graph read surface

* style(daemon): gofumpt graph ledger sqlite

* fix(daemon): use eagle/graph after hawk-core-contracts rename

* fix(api): use OpenAPI 3.1 null type for graph read pagination cursor

* refactor: migrate to vendored ecosystem types across bridges, engine, and gateway

- Convert vendored sibling graph/review/verify types (kestrel, merlin,
  harrier, eyrie) to hawk's eagle contract types at boundary
- Use eyrie/llm, eyrie/tools, eyrie/graph for provider, session, and
  engine contracts post-vendoring
- Point shrike alias at vendored shrike root package
- Update go.mod pins to synced sibling main (vendored state)
- Relax testaudit eyrie facade rule to allow vendored llm/graph/tools

* chore: reconcile ecosystem manifest with vendored state

- Bump eagle_version to synced main (5877bed17503) so the contracts
  parity guard matches hawk's go.mod pin
- Mark eyrie/harrier/shrike/swift/kestrel/merlin as not tracking eagle's
  module: they vendored eagle's contract types and no longer require the
  eagle Go module; hawk is the sole eagle consumer
- gofumpt gateway files

* chore: allow vendored eyrie packages in engine boundary guard

check-eyrie-engine-boundary.sh forbade all eyrie imports below the
engine facade; hawk uses the full vendored eyrie/llm, eyrie/graph, and
eyrie/tools surfaces post-vendoring. Allow those packages, matching the
testaudit facade rule.

Author: Patel230

api/openapi.yaml

@@ -273,6 +273,77 @@ components:
           items:
             $ref: "#/components/schemas/GraphEvent"
 
+    GraphSyncRequest:
+      type: object
+      required: [syncId, projectId, graph]
+      properties:
+        syncId:
+          type: string
+          minLength: 1
+          maxLength: 256
+        projectId:
+          type: string
+          minLength: 1
+          maxLength: 128
+        sessionId:
+          type: string
+          maxLength: 128
+        graph:
+          $ref: "#/components/schemas/ExecutionGraph"
+
+    GraphSyncResponse:
+      type: object
+      required: [accepted, duplicate, graphDigest]
+      properties:
+        accepted:
+          type: boolean
+        duplicate:
+          type: boolean
+        graphDigest:
+          type: string
+          pattern: '^[a-f0-9]{64}$'
+        facts:
+          type: integer
+
+    GraphReadResponse:
+      type: object
+      required: [graph, limits, pagination]
+      properties:
+        graph:
+          type: object
+          properties:
+            schema_version:
+              type: string
+            generated_at:
+              type: string
+              format: date-time
+            scope:
+              type: object
+              additionalProperties:
+                type: string
+            nodes:
+              type: array
+              items:
+                type: object
+            edges:
+              type: array
+              items:
+                type: object
+            events:
+              type: array
+              items:
+                type: object
+        limits:
+          type: object
+          properties:
+            perFactType:
+              type: integer
+        pagination:
+          type: object
+          properties:
+            next_cursor:
+              type: [string, "null"]
+
     Message:
       type: object
       properties:
@@ -863,6 +934,105 @@ paths:
               schema:
                 $ref: "#/components/schemas/Error"
 
+  /v1/graph/sync:
+    post:
+      operationId: syncGraph
+      tags: [graphs]
+      summary: Ingest portable graph facts from a producer
+      description: |
+        Accepts a producer's portable `*.graph/v1` facts (e.g. from a future
+        ecosystem repo), validates them against the shared graph contract, and
+        acknowledges with an idempotency digest. Mirrors the cloud plane's
+        `/v1/graph/sync` so a producer can target either surface with the same
+        payload. The daemon retains an in-memory idempotency ledger; durable
+        retention is the cloud plane's job.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/GraphSyncRequest"
+      responses:
+        "202":
+          description: Graph accepted
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/GraphSyncResponse"
+        "200":
+          description: Graph accepted as a duplicate of a prior sync
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/GraphSyncResponse"
+        "400":
+          description: Invalid or non-portable graph
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Error"
+        "401":
+          description: Unauthorized
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Error"
+        "409":
+          description: Sync ID reused with different content
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Error"
+
+  /v1/projects/{projectId}/graph:
+    get:
+      operationId: getProjectGraph
+      tags: [graphs]
+      summary: Read back ingested portable graph facts for a project
+      description: |
+        Returns the portable graph facts previously accepted via
+        `POST /v1/graph/sync` for a project, mirroring the cloud plane's read
+        projection so a producer can verify what was ingested on either
+        surface. The daemon returns a single page per fact type.
+      parameters:
+        - name: projectId
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: sessionId
+          in: query
+          required: false
+          schema:
+            type: string
+        - name: limit
+          in: query
+          required: false
+          schema:
+            type: integer
+            default: 100
+            minimum: 1
+            maximum: 250
+      responses:
+        "200":
+          description: Portable graph facts for the project
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/GraphReadResponse"
+        "400":
+          description: Invalid project or session identifier
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Error"
+        "401":
+          description: Unauthorized
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Error"
+
   /v1/stats:
     get:
       operationId: getStats

ecosystem.yaml

@@ -5,7 +5,7 @@ schema_version: 1
 # records the user-facing capability. Tooling must consume this file instead of
 # carrying its own repo-name list.
 contracts:
-  eagle_version: v0.0.0-20260831121050-12ea8cc11b16
+  eagle_version: v0.0.0-20260902153929-5877bed17503
   portable_graph_schema: hawk.graph/v1
   cloud_graph_schema: graycode-cloud.graph/v1
   usage_event: usage.recorded.v1
@@ -45,7 +45,7 @@ repositories:
     language: go
     module: github.com/GrayCodeAI/eyrie
     workspace: true
-    tracks_eagle: true
+    tracks_eagle: false
     facade: github.com/GrayCodeAI/eyrie/engine
 
   - directory: harrier
@@ -55,7 +55,7 @@ repositories:
     language: go
     module: github.com/GrayCodeAI/harrier
     workspace: true
-    tracks_eagle: true
+    tracks_eagle: false
     facade: github.com/GrayCodeAI/harrier/engine
 
   - directory: shrike
@@ -65,7 +65,7 @@ repositories:
     language: go
     module: github.com/GrayCodeAI/shrike
     workspace: true
-    tracks_eagle: true
+    tracks_eagle: false
     facade: github.com/GrayCodeAI/shrike
 
   - directory: swift
@@ -75,7 +75,7 @@ repositories:
     language: go
     module: github.com/GrayCodeAI/swift
     workspace: true
-    tracks_eagle: true
+    tracks_eagle: false
     facade: github.com/GrayCodeAI/swift/cli
 
   - directory: kestrel
@@ -85,7 +85,7 @@ repositories:
     language: go
     module: github.com/GrayCodeAI/kestrel
     workspace: true
-    tracks_eagle: true
+    tracks_eagle: false
     facade: github.com/GrayCodeAI/kestrel
 
   - directory: merlin
@@ -95,7 +95,7 @@ repositories:
     language: go
     module: github.com/GrayCodeAI/merlin
     workspace: true
-    tracks_eagle: true
+    tracks_eagle: false
     facade: github.com/GrayCodeAI/merlin
 
   - directory: sparrow