[Soushi888]

SoushAI analysis. Drafted by Soushi's AI assistant, reviewed and posted by @Soushi888.

Intent

The UI has no hREA GraphQL adapter yet, and the one that matches hREA happ-0.5.0-beta.1 (0.700.0-rc.0) is not on npm (h-REA/hREA#412). Vendoring the tarball lets the hREA upgrade (#154) and the Holochain 0.7 work (#134) build on it now.

Changes

• The adapter is a vendored tarball. vendor/valueflows-vf-graphql-holochain-0.700.0-rc.0.tgz sits at the top-level vendor/, beside the vendor/hrea submodule rather than inside it, and the UI installs it through a file: dependency. Its sha256 (e64163912e87ca2271660806c263e95c8208dfd99a660042bfee5764fba3d2fe) is in the .sha256 file next to it. It was built from h-REA/hREA tag happ-0.5.0-beta.1 (commit 79c8d4fb98c4f7f9a8cf3f7dd69690d6d1334d85, modules/vf-graphql-holochain) and is the same file Requests and Offers vendors. vendor/README.md gives the rebuild command and how to drop the copy once npm publishes 0.700.
• bun.lock was produced by bun install; re-running it from the base plus this ui/package.json gives an identical lockfile.
• Docs: the UI stack documentation lists the vendored adapter.

What this layer cannot do alone

It only installs and type-checks the adapter, and no screen imports it. Adapter 0.700 needs @holochain/client ^0.21 and a Holochain 0.7 conductor, while the UI still pins @holochain/client ^0.20 and the hApp runs on 0.6 with vendor/hrea on Sensorica/hREA main-0.6. So bun installs a second, nested client 0.21.0 under the adapter, and nothing can call hREA through it until #154 and #134 land on top. graphql resolves only because the adapter hoists 15.8.0; whichever layer first imports graphql in UI code should declare it.

How to test

cd vendor && sha256sum -c valueflows-vf-graphql-holochain-0.700.0-rc.0.tgz.sha256
bun install --frozen-lockfile
cd packages/shared-types && bun run build && cd ../../ui && bunx svelte-kit sync && bun run check
cd ui && bunx vitest run --project server

The shared-types build and svelte-kit sync are prerequisites on the base branch too. Measured at 48aa2e0: install exits 0, svelte-check 0 errors, server project 1/1. The browser test project was not run locally (Playwright's chromium build is missing on the machine); CI covers it.

An independent rebuild of the module extracted outside the hREA workspace (git archive of the tag, then npm install --ignore-scripts, npm run build, npm pack, on node 24.13.0, npm 11.6.2, TypeScript 5.9.3) reproduced the tarball's sha256. That is the recipe vendor/README.md now gives; it compares the tar stream (gzip -dc <tgz> | sha256sum = fac8a221f0a4c07d643ff43068cf48e8391cad09285c36ea4eb843d1f1d0f00d), because the gzip layer can differ across node/npm builds.

Decisions

• The adapter is for read-only UI queries; every write stays zome-level. documentation/hREA/integration-strategy.md made hREA integration a Rust/HDK concern that bypasses GraphQL, because governance evaluation and PPR issuance must fire atomically with each economic event. A read fires neither, so querying hREA's ValueFlows graph from the UI is safe, and a mutation through the adapter is out of bounds. Both integration-strategy.md (Key Decision and "Why Zome-Level Integration") and vendor/README.md now state the bound (a26ba32).
• Vendored tarball, not npm. 0.700 is not published (chore: publish vf-graphql-holochain 0.700.x against @holochain/client 0.21 h-REA/hREA#412); R&O vendors the identical tarball (R&O #317), and vendor/README.md names the exit path once npm carries it.

Documentation

UI stack documentation updated in 48aa2e0; vendor/README.md added. documentation/hREA/integration-strategy.md bounds the GraphQL path to reads (a26ba32).

Pre-open review

Independent pre-open review at 48aa2e0: READY TO OPEN, no blocking finding. Maintainer review then found the original README rebuild recipe fails inside the hREA yarn workspace and overstated reproducibility; fixed in fd9c3b6, re-reviewed with the recipe run verbatim: READY. Measured head: fd9c3b6.

Re-run 2026-10-27 through PRReview: REQUEST CHANGES on one item, the adapter contradicted the strategy doc's "bypasses GraphQL entirely" decision with no bound stated. Soushi chose to bound it to read-only queries; fixed in a26ba32 with a Decisions block here, and the branch rebased onto dev (808fcd7). bun install --frozen-lockfile passes. Not superseded: chore/154-hrea-beta1 stacks on it, and the hREA beta.1 pin now lands with the Holochain 0.7 port in #130.

Related

• Closes chore(deps): vendor the hREA GraphQL adapter 0.700.0-rc.0 into the UI #153
• Blocks: chore(deps): move the hREA submodule to happ-0.5.0-beta.1 #154, chore(deps): upgrade Nondominium to Holochain 0.7 (blocked on hREA) #134
• See also: chore: publish vf-graphql-holochain 0.700.x against @holochain/client 0.21 h-REA/hREA#412