NO-PIN OGAR path deps + plug-and-play contract arming + roundtrip green light

.claude/board/EPIPHANIES.md

@@ -1,3 +1,10 @@
+## 2026-07-07 — E-HOTPLUG-MIGRATION-1 — the generic hot-plug pattern is the migration target for ALL consumers; migration doc is board discipline
+**Status:** RULING (operator, 2026-07-07; shipped OGAR #174/#175 + lance-graph #658 + tesseract-rs #13/#14)
+
+**Every consumer migrates onto the generic hot-plug pattern** — one `HOT_PLUG` const (socket type `lance_graph_contract::hotplug::HotPlug`) + one activation test against `ogar_vocab::capability_registry::resolve_hotplug`; the consumer tells OGAR which classids are hot-plugged and receives BOTH the vocab rows and the action surface. No bespoke per-consumer plug crates, no git pins (sibling path deps only), no ontology payload in lance-graph, contract stays zero-dep (member path deps kill CI workspace load — burned once), classid low u16 = APP prefix, never a shape ordinal.
+
+**Board discipline:** `.claude/knowledge/hotplug-consumer-migration.md` (mirrored in OGAR `.claude/knowledge/`) is MANDATORY READING before (a) migrating any consumer onto the capability surface, (b) adding a new authoritative domain table (thinking-styles next), (c) any cross-repo capability wiring. It carries the 5-step recipe, the 5 drift arms, the burned-once anti-pattern list, and the evaluated ruff synergies (ActionDef lift via `ogar-from-ruff::lift_actions` + a future C++ arm; `walk_enums` param fidelity; ontology plug-and-play over the exports→OGIT→imports tier; thinking-styles as a one-entry `domain_tables()` addition).
+
 ## 2026-07-07 — E-OCR-FACET-HOME-CORRECTION-1 — operator ruling: domain substrate does NOT live in agnostic lance-graph — textord facets removed; the facet producer is ruff→OGAR
 **Status:** RULING (operator-corrected same day; code removed in this commit)
 

.claude/board/LATEST_STATE.md

@@ -1,5 +1,17 @@
 # LATEST_STATE — What Just Shipped (read this FIRST)
 
+
+> **2026-07-07 — NO-PIN + plug-and-play OGAR arming:** all OGAR deps
+> (symbiont / lance-graph-ogar / cognitive-stack) switched from
+> `git+branch=main` (which always pins a rev in Cargo.lock) to PATH deps on
+> the local sibling `/home/user/OGAR` — operator policy: "wenn's knallt,
+> dann einmal — nicht 200 Pins monitoren". `lance-graph-contract` gained the
+> optional `ogar` feature (`ogar_codebook::armed`): arming pulls `ogar-vocab`
+> transitively and activates a contract-side compile-time `COUNT_FUSE`
+> (+ per-entry parity test). lance-graph-ogar arms it; the contract stays
+> zero-dep by default. Fuse verified green vs OGAR main `68d85f02` (84==84,
+> entry-for-entry).
+
 > **Auto-injected at session start via SessionStart hook.**
 > Updated after every merged PR.
 > **Last updated:** 2026-05-14 (PR #372 merged: sprint-10 spec sprint, 12-worker CCA2A fleet + Opus meta-review + 8 knowledge docs, governance-only (zero .rs changes), mirrors PR #365 pattern. Sprint-11 implementation wave gated on 5 spec patches + 4 user ratifications: CSI-1 CausalEdge64 bit-reclaim Option, OQ-1 Σ4-Σ5 banding, OQ-3 plasticity granularity, OQ-5 rayon vendor. **Major findings:** (1) dual `CausalEdge64` types in workspace — `causal_edge::CausalEdge64` SPO-palette layout ≠ `thinking_engine::layered::CausalEdge64` 8-channel cascade, same name different semantics, surfaced as duplication entry #13 in TYPE_DUPLICATION_MAP and E-META-7 in EPIPHANIES; (2) p64 drift origin pinpointed at `crates/lance-graph-planner/src/cache/convergence.rs:18-22 #[allow(unused_imports)]` annotation — wiring intended for hot-path convergence never finished; (3) three-zone hot-path mental model corrects prior framing — Zone-1 thinking-engine MatVec 200-500ns + AriGraph entity_index O(1) ~20-200ns is the actual cycle-speed path, not DataFusion. Prior: 2026-05-13 (PR #366 merged: sprint-7 7-worker implementation wave for the sprint-5/6 specs + AuditSink trait unification, ~5 KLOC across 5 crates +2 new (`lance-graph-supervisor`, `lance-graph-consumer-conformance`), ~70 new tests, workspace clippy --tests --no-deps -D warnings exits 0; Opus meta verdict 4A/2B/1B-minus; OQ-7-1/2/3 all locked pre-merge; `UnifiedAuditSink` D-SDR-4 placeholder dropped, all sinks unified on `AuditSink` trait; `UnifiedBridge::with_jsonl_audit()` ergonomic constructor added for MedCare-rs sprint-2 item 5. **Adjacent landings (same day):** MedCare-rs sprint-1 10-PR sweep (#113-#122) including E1-1 OQ-3 direct migration (6 RoleGroups) consuming our `0d725d4` decision. MedCare-rs sprint-2 (5 PRs) is queued on user "go" — item 5 consumes this PR's new constructor. Prior same-day: PR #365 (13 sprint-5/6 specs + meta). Prior: PR #364 (D-SDR-3/4/5 + sprint-log-4 governance + sprint-5-9 roadmap + codex P1/P2 fixes). lance-graph #364 ships D-SDR-3/4/5 + sprint-log-4 governance + sprint-5-9 roadmap + codex P1/P2 surgical fixes (OwlIdentity 3-byte canonical, UnifiedAuditEvent 26 bytes, OgitFamilyTable sparse `HashMap<u16, FamilyEntry>`, audit super_domain via AuditChain). MedCare-rs#112 (PR-B) wires `UnifiedBridge<MedcareBridge>` + medcare-rbac + medcare-realtime substrate (+2963 LOC, 17 files, §73 SGB V + BMV-Ä §57 + BtM regulatory tests). smb-office-rs#31 (PR-C) wires `UnifiedBridge<OgitBridge>` (+111 LOC). ndarray#142 ships VBMI gate for `permute_bytes` (P0 SIGILL fix on Skylake-X / Cascade Lake / Ice Lake-SP) + Inf clamp for `simd_exp_f32`. D-SDR-5 `UnifiedBridge` surface is now consumed end-to-end across MedCare + smb-office. Prior: 2026-05-07 (PR #354). Prior: 2026-05-07 (PR #353). Prior: 2026-05-07 (PR #352). Prior: 2026-05-06 (splat-osint-ingestion-v1 PR 1+2 of 6 in flight). Prior: 2026-04-21 post PR #243.

.claude/knowledge/hotplug-consumer-migration.md

@@ -0,0 +1,134 @@
+# Hot-Plug Consumer Migration — the generic plug-and-play pattern
+
+> READ BY: any session migrating a consumer (woa-rs, medcare-rs,
+> smb-office-rs, odoo-rs, tesseract-rs, osm-website-rs, …) onto the
+> OGAR-authoritative capability surface; any session adding a new
+> authoritative domain table (thinking-styles best practices, …);
+> integration-lead / baton-handoff-auditor before any cross-repo
+> capability wiring.
+>
+> Shipped 2026-07-07 (operator-ruled same day). Reference PRs:
+> OGAR #174 (ocr_actions) + #175 (resolve_hotplug), lance-graph #658
+> (hotplug socket + OgarAuthority + CI fuse gate), tesseract-rs #13/#14
+> (executor + HOT_PLUG migration — the template consumer).
+
+## The model — three roles, three homes, one binary
+
+Everything links into ONE binary (lance-graph + OGAR + consumer +
+ndarray). Nothing serializes; every check is a compile-time const or a
+test in the consumer's own suite. "Wenn's knallt, dann einmal — nicht
+200 Pins monitoren."
+
+| Role | Home | Surface |
+|---|---|---|
+| **SOCKET** (agnostic, zero-dep) | `lance_graph_contract::hotplug` | `HotPlug { consumer, classids, covered }`, `Activation`, `ActivationDrift`, trait `CapabilityAuthority` |
+| **AUTHORITY** (declares + resolves) | OGAR `ogar_vocab` | domain action tables (e.g. `ocr_actions`) + `capability_registry::{domain_tables, resolve_hotplug, HotplugDrift}` |
+| **BRIDGE** (socket ⇄ authority) | `lance-graph-ogar` (workspace-EXCLUDED) | `OgarAuthority: CapabilityAuthority`; also owns COUNT_FUSE + per-entry mirror parity + the roundtrip green light |
+| **CONSUMER** | your repo | ONE `HOT_PLUG` const + ONE activation test + your executor |
+
+The classid is the join key on BOTH sides: the consumer says "these
+canon-high ids are hot", the authority returns BOTH the vocab rows and
+every capability whose subject is one of those ids.
+
+## Migration recipe (per consumer, ~1 hour)
+
+1. **Authority side (OGAR PR #1):** declare your domain's action table
+   in `ogar-vocab` next to `ocr_actions` — one `ActionDef` per
+   capability on YOUR already-minted canon-high concepts (mint via the
+   normal codebook process if missing; hi u16 = concept, lo u16 = APP
+   render prefix, NEVER a shape ordinal). Export `<DOMAIN>_ACTION_NAMES`
+   (const fingerprint), `<DOMAIN>_SUBJECT_CLASSIDS`,
+   `<DOMAIN>_EXPECTED_EXECUTORS = ["<your-crate>"]`. Register ONE entry
+   in `capability_registry::domain_tables()` mapping
+   `(capability, subject classid)`. That's the whole authority change.
+2. **Consumer side:** add path deps (NO PINS — local siblings):
+   `ogar-vocab = { path = "<rel>/OGAR/crates/ogar-vocab" }` and
+   `lance-graph-contract = { path = "<rel>/lance-graph/crates/lance-graph-contract" }`.
+3. Declare the plug:
+   ```rust
+   pub const HOT_PLUG: lance_graph_contract::hotplug::HotPlug =
+       lance_graph_contract::hotplug::HotPlug {
+           consumer: "<your-crate>",
+           classids: ogar_vocab::<domain>_actions::<DOMAIN>_SUBJECT_CLASSIDS,
+           covered: COVERED_CAPABILITIES,   // your executor's arms
+       };
+   ```
+4. Close the loop with ONE test:
+   ```rust
+   let (concepts, capabilities) = ogar_vocab::capability_registry::resolve_hotplug(
+       HOT_PLUG.consumer, HOT_PLUG.classids, HOT_PLUG.covered,
+   ).expect("hot-plug drifted from the authoritative OGAR tables");
+   ```
+   (Or through the socket: `OgarAuthority.activate(&HOT_PLUG)` via
+   `dyn CapabilityAuthority` when you want authority-agnostic code.)
+5. **CI:** your workflows need the sibling checkouts (OGAR +
+   lance-graph), same as tesseract-rs `rust.yml` / lance-graph
+   `rust-test.yml`. Sibling layout: check the repo out into a subdir
+   (`path: <repo>`) so `path: OGAR` lands as a true sibling.
+
+## The drift arms (each one named bang, test-time, in YOUR binary)
+
+| Arm | Meaning |
+|---|---|
+| `UnknownClassid(id)` | plugged id not minted in the codebook |
+| `NoCapabilitiesFor(id)` | id resolves to no capability — the table/ontology was forgotten |
+| `UnexpectedConsumer` | you are not in the table's expected-executor list |
+| `Uncovered(cap)` | authority declares it, your executor has no arm |
+| `Undeclared(cap)` | your executor claims it, authority doesn't declare it |
+
+Plus, CI-side (lance-graph `rust-test.yml`): COUNT_FUSE + per-entry
+mirror parity + the roundtrip green light run against the real OGAR
+sibling on every push.
+
+## What NOT to do (each burned once, 2026-07-07)
+
+- **No bespoke per-consumer plug crate/mechanism.** The registration
+  surface is the `HOT_PLUG` const + one test. (tesseract-ogar's first
+  `CapabilityRegistration` draft was replaced for exactly this.)
+- **No path/optional deps on `lance-graph-contract` toward OGAR.** The
+  contract is a workspace MEMBER; any path dep there (even optional) is
+  resolved at workspace-load time and kills every CI cargo invocation.
+  The contract stays zero-dep; armed things live in excluded crates.
+- **No shape ordinals in the classid low u16.** Low half = APP render
+  prefix (`PortSpec::APP_PREFIX`). Distinct shapes are distinct hi-u16
+  concepts or ClassView payload readings.
+- **No ontology payload in lance-graph.** lance-graph carries the wire
+  mirror + the green light, nothing else. Authority checks live in OGAR.
+- **No git deps on OGAR.** git+branch always writes a rev pin into
+  Cargo.lock. Path deps to the sibling, always.
+
+## Future synergies (evaluated 2026-07-07 — next arcs, not shipped)
+
+1. **ActionDef plug-and-play from ruff (HIGH, near-term).**
+   `ogar-from-ruff::lift_actions` already lifts ActionDefs from
+   Rails/Python model graphs — the OCR table is hand-declared only
+   because tesseract has no AR source. The generic path: ruff harvest
+   (`ruff_*_spo`) → fuzzy-recipe codebook (`(verb, criteria)` recipes,
+   ruff `.claude/knowledge/fuzzy-recipe-codebook.md`) → `lift_actions` →
+   the domain table auto-derives instead of being hand-written; a
+   consumer migration then starts with a harvest, not an authorship
+   session. Missing piece: a C++ arm for `lift_actions` (ruff_cpp_spo
+   has walk_tu/walk_free_functions/walk_enums; an action-lift over the
+   method-body facts is the natural fourth arm) and a
+   `derive_domain_table!`-style bridge from lifted ActionDefs into
+   `domain_tables()`.
+2. **Param-enum fidelity via `walk_enums` (MEDIUM).** Capability params
+   that are C/C++ enums (PSM modes, connectivity 4/8, …) can carry
+   their variants from the ruff enum harvest instead of free-form
+   names — the same shapes-from-ruff discipline the dawg/dict arc used.
+3. **Ontology plug-and-play (MEDIUM, design needed).** Today
+   `resolve_hotplug` returns vocab rows + capability names. The same
+   join can return ONTOLOGY fragments per classid: OGAR's
+   `vocab/exports → OGIT promote → vocab/imports` pipeline already
+   stages TTL per domain, and `ogar-adapter-ttl` renders it. A
+   `resolve_hotplug_with_ontology` returning the OGIT NTO fragment
+   references for the plugged classids would let a consumer pull
+   concepts + actions + ontology in one activation — still zero
+   serialization in-binary; the TTL stays an OGAR-internal artifact
+   (imports/ tier), never hauled through lance-graph. Gate: needs the
+   imports/ tier populated for the domain (ontologies, not harvests —
+   harvests stay in the consumer repo).
+4. **Thinking-styles best practices (HIGH, planned all along).** One
+   `domain_tables()` entry + a `<STYLES>_EXPECTED_EXECUTORS` list arms
+   the thinking-style table for whichever engine executes styles —
+   same recipe as step 1 above, zero new machinery.

.github/workflows/build.yml

@@ -52,6 +52,10 @@ jobs:
         with:
           repository: AdaWorldAPI/ndarray
           path: ndarray
+      - uses: actions/checkout@v4
+        with:
+          repository: AdaWorldAPI/OGAR
+          path: OGAR
       - name: Setup rust toolchain
         run: |
           rustup toolchain install ${{ matrix.toolchain }}

.github/workflows/jc-proof.yml

@@ -23,6 +23,8 @@ jobs:
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
+      - name: Clone AdaWorldAPI/OGAR as parent-level sibling (NO-PIN path deps)
+        run: git clone --depth 1 https://github.com/AdaWorldAPI/OGAR ../OGAR
       - name: Setup Rust
         run: |
           rustup toolchain install stable

.github/workflows/release.yml

@@ -36,6 +36,8 @@ jobs:
 
     - name: Checkout repository
       uses: actions/checkout@v4
+      - name: Clone AdaWorldAPI/OGAR as parent-level sibling (NO-PIN path deps)
+        run: git clone --depth 1 https://github.com/AdaWorldAPI/OGAR ../OGAR
       with:
         ref: main
         token: ${{ secrets.LANCE_RELEASE_TOKEN }}

.github/workflows/rust-test.yml

@@ -64,6 +64,11 @@ jobs:
           # dequantize_i8_to_f32, quantize_f32_to_i2, dequantize_i2_to_f32
           # publicly (ndarray PR #115, merged 2026-04-30). Pin retired.
           path: ndarray
+      - name: Checkout AdaWorldAPI/OGAR (sibling dependency, NO-PIN path deps)
+        uses: actions/checkout@v4
+        with:
+          repository: AdaWorldAPI/OGAR
+          path: OGAR
       - name: Setup rust toolchain
         run: |
           rustup toolchain install ${{ matrix.toolchain }}
@@ -108,6 +113,14 @@ jobs:
         run: cargo test --manifest-path crates/lance-graph-contract/Cargo.toml --tests
       - name: Run contract doctests
         run: cargo test --manifest-path crates/lance-graph-contract/Cargo.toml --doc
+      # lance-graph-ogar is the workspace-EXCLUDED armed tier: it owns the
+      # mirror<->live-vocab fuses (COUNT_FUSE, per-entry parity, the
+      # authoritative-table roundtrip green light) against the OGAR sibling
+      # checked out above. Without this step those fuses only ever ran on a
+      # developer machine — a same-sized codebook remap would ship green
+      # (codex/coderabbit finding on PR #658). One scoped step closes it.
+      - name: Run lance-graph-ogar fuse tests (armed tier, OGAR sibling)
+        run: cargo test --manifest-path crates/lance-graph-ogar/Cargo.toml
       # deepnsm: standalone 0-dep codec crate, workspace-excluded, so the
       # lance-graph test steps above never reached it. ~217 lib + integration +
       # doctests, fast (no lance/datafusion/ndarray deps). Gating.
@@ -155,6 +168,11 @@ jobs:
           # dequantize_i8_to_f32, quantize_f32_to_i2, dequantize_i2_to_f32
           # publicly (ndarray PR #115, merged 2026-04-30). Pin retired.
           path: ndarray
+      - name: Checkout AdaWorldAPI/OGAR (sibling dependency, NO-PIN path deps)
+        uses: actions/checkout@v4
+        with:
+          repository: AdaWorldAPI/OGAR
+          path: OGAR
       - name: Setup rust toolchain
         run: |
           rustup toolchain install stable

.github/workflows/style.yml

@@ -49,6 +49,11 @@ jobs:
           # dequantize_i8_to_f32, quantize_f32_to_i2, dequantize_i2_to_f32
           # publicly (ndarray PR #115, merged 2026-04-30). Pin retired.
           path: ndarray
+      - name: Checkout AdaWorldAPI/OGAR (sibling dependency, NO-PIN path deps)
+        uses: actions/checkout@v4
+        with:
+          repository: AdaWorldAPI/OGAR
+          path: OGAR
       - name: Setup rust toolchain
         run: |
           rustup toolchain install stable
@@ -101,6 +106,11 @@ jobs:
           # dequantize_i8_to_f32, quantize_f32_to_i2, dequantize_i2_to_f32
           # publicly (ndarray PR #115, merged 2026-04-30). Pin retired.
           path: ndarray
+      - name: Checkout AdaWorldAPI/OGAR (sibling dependency, NO-PIN path deps)
+        uses: actions/checkout@v4
+        with:
+          repository: AdaWorldAPI/OGAR
+          path: OGAR
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
           components: rustfmt