From 0963523a3195019f71a6c36cc73556ff970726b2 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 5 Sep 2026 17:01:51 +0000 Subject: [PATCH] board: post-merge hygiene for #1185 (f8b629a3) PR_ARC_INVENTORY prepend + LATEST_STATE table row for the merged open-ideas-fetch-v1 arc: D-OIF-1 ruled A (SUPERSEDED, D-OIF-1-DEC withdrawn), the cross-repo reachability law and the three verdicts it struck, the kanban_actor.rs read-only-meta-awareness correction, and the CLAUDE.md pin catch-up to lance 11 / lancedb 0.38. Hygiene-only: per CLAUDE.md's termination clause this PR generates no further arc entry and no further LATEST_STATE row. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01DCfrD5y19cvFc4AoyydXYv --- .claude/board/LATEST_STATE.md | 41 +++++++++++++++++++++++++++++++ .claude/board/PR_ARC_INVENTORY.md | 10 ++++++++ 2 files changed, 51 insertions(+) diff --git a/.claude/board/LATEST_STATE.md b/.claude/board/LATEST_STATE.md index 4b57b2937..c594823d0 100644 --- a/.claude/board/LATEST_STATE.md +++ b/.claude/board/LATEST_STATE.md @@ -332,6 +332,47 @@ Also removed one dead declaration that blocked the sweep: `container_bs/mod.rs` (#1100 opened for the one-file subset of this and closed unmerged, superseded.) +--- +## 2026-09-05 — #1185 MERGED (f8b629a3): D-OIF-1 ruled SUPERSEDED + the cross-repo reachability law — DOC/BOARD ONLY + +| PR | merge | content | +|---|---|---| +| **#1185** | `f8b629a3` | `open-ideas-fetch-v1` (D-OIF-0..7): three stale `IDEAS.md` cards re-derived. **D-OIF-1 ruled A — SUPERSEDED**, `D-OIF-1-DEC` withdrawn: no hash is built because no deployed consumer reaches the DataFusion masking path. Records the cross-repo reachability law, the `kanban_actor.rs` read-only-meta-awareness correction, and (post-#1190) the CLAUDE.md pin ruling caught up to lance 11 / lancedb 0.38. | + +**Contract inventory net delta: none** (DOC/BOARD ONLY). No code, no hash, no +deletion; `policy.rs` and `rls.rs` are frozen grace-period, not removed. + +**The ruling.** `ColumnMaskRewriter`'s only non-test constructor in nine scanned +repos is MedCare `routes/patient.rs:150`, behind default-off `lance-phase2-rbac` +that no Dockerfile enables, behind `?source=lance`, ending in a decoder stub +returning `None`; and it redacts ABOVE the scan (`policy.rs:210` never writes +`TableScan.projection`). Operator ruling the same day: planning migrates to +`ogar-loco` / `ogar-r2il`, DataFusion is grace-period, nothing new migrates to +it — so a hash body was barred independently of the census. + +**Three verdicts struck mid-PR, and why that matters more than the ruling.** The +first census asked "who calls this inside lance-graph?" and read zero local call +sites as production absence — the same category error lance-graph-java #76 had +just corrected for `WideFieldMask` one layer down. Operator-corrected: **for a +cross-repo substrate, production reachability terminates at deployed consumers, +not at the repository boundary.** Struck: `try_advance_phase` "has no production +entry point" (bardioc `substrate-b`); `ogar-loco` "one live consumer" +(blockly-rs); `ogar-r2il` "probe-only" (the R2IL→loco bridge over r2sleigh's live +IR). The RBAC zero-caller finding is now *scoped* to the nine repos, never +stated globally. + +**Also corrected:** `kanban_actor.rs` is not a tombstone — the actor was deleted, +the FILE is live read-only meta-awareness (`PhaseCensus` / `mul_target` / +`parse_kanban_step`, re-exported at `lib.rs:82`, consumed by `cycle_driver.rs:805` +and named as precedent by `rubicon_witness.rs:32` and `rung_horizon.rs:5`). + +**Open, NOT closed by this PR:** field-level authorization has no enforced owner +on any scanned production path (`authorize`/`authorize_scoped`/`commit_via`/ +`OgarRbac` all zero non-test callers; `effective_mask` is not an identifier; no +`ogar-rbac` crate). Recorded as the missing implementation on the canonical +`ClassRbac × ClassView × WideFieldMask` path. `D-OIF-2-DEC` and `D-OIF-5-DEC` +remain operator decisions; no D-OIF worker has run. + --- ## 2026-09-05 — #1187 MERGED (a9d3da0a): D-LNC-1 — lance 9 → 10, lancedb 0.33 → 0.37.1 diff --git a/.claude/board/PR_ARC_INVENTORY.md b/.claude/board/PR_ARC_INVENTORY.md index cee54ca4e..e460b151a 100644 --- a/.claude/board/PR_ARC_INVENTORY.md +++ b/.claude/board/PR_ARC_INVENTORY.md @@ -1,3 +1,13 @@ +## 2026-09-05 — lance-graph PR #1185 (merged `f8b629a3`, branch `claude/open-ideas-fetch-v1`) — D-OIF-1 ruled SUPERSEDED; the cross-repo reachability law + +- **Added:** `.claude/plans/open-ideas-fetch-v1.md` (D-OIF-0..7, §2 = the D-OIF-1 retirement ruling with tree verdict / obligation table / remove-grace-retain cone / layer audit / stale-claim list); `EPIPHANIES` `E-A-COLUMN-OF-INDICES-INTO-A-CODEBOOK-THAT-DOES-NOT-EXIST-1` and `E-THE-UNFINISHED-FUNCTION-WAS-NOT-THE-DEBT-1`; `ISSUES` `ISS-PIN-RULING-PROSE-DRIFTS-BEHIND-THE-MANIFEST`; four `IDEAS.md` entries + three in-place status flips; `STATUS_BOARD` D-OIF-0..7 + three `-DEC` rows. +- **Ruled:** **D-OIF-1 = A, SUPERSEDED / retirement plan.** `D-OIF-1-DEC` (hash family + key) **withdrawn** — no hash chosen because no hash is built. First removal PR (later, its own) is `RedactionMode::Hash` + `NotYetWiredHashUdf` only; the rest of `policy.rs` / `rls.rs` is frozen grace-period until MedCare retires `lance-phase2-rbac`. +- **Corrected (the durable half):** the first census committed the repo-boundary error — zero call sites *inside lance-graph* read as production absence, for a deliberately cross-repo substrate. Three verdicts struck on operator input (Rubicon via bardioc `substrate-b`; `ogar-loco` via blockly-rs; `ogar-r2il` as the R2IL→loco bridge over r2sleigh), and the law recorded: **production reachability terminates at deployed consumers, not at the repository boundary.** Second correction: `kanban_actor.rs` is live read-only meta-awareness (`PhaseCensus`, rungs 0–9), not a tombstone — the ACTOR was deleted, the FILE is a consumer surface. +- **Also:** post-#1190, `CLAUDE.md` § Key Dependencies caught up to `lance = "=11.0.0"` / `lancedb = "=0.38.0"`; the E-PIN-LANCE9-… ruling regraded on its lance/lancedb coordinates only, its datafusion half verbatim. Two consecutive bumps had left the ruling lines stale across a full major. +- **Deferred:** `D-OIF-2-DEC` (σ provenance) and `D-OIF-5-DEC` (edge `M` source) — operator decisions; no worker dispatched. Field-level RBAC enforcement recorded as the missing implementation on the canonical path, deliberately not built here. +- **Docs:** `.claude/v3/{COMPONENT-MAP, knowledge/mailbox-kanban-model, knowledge/write-on-behalf}` regraded on the deleted-actor claim; `LATEST_STATE` dated correction on the `commit_via` / `OgarRbac` shipped-enforcement claim. +- **Confidence:** High on every existence/absence claim (each carries `file:line`; the census scope — nine repos — is stated in the plan, and the RBAC absence is scoped to it, never global). Medium on the grace-period cone's removal ORDER, which depends on a MedCare-side feature retirement this repo does not control. + ## 2026-09-05 — lance-graph PR #1187 (merged `a9d3da0a`, branch `claude/lance-10-bump`) — D-LNC-1: lance 9 → 10, lancedb 0.33 → 0.37.1 - **Added:** `lance*` / `lance-namespace` / `lance-arrow` `=9.0.0` → `=10.0.0` (root table + `lance-graph-catalog`, `lance-graph`, `holograph`); `lancedb` `=0.33.0` → `=0.37.1` (`default-features = false`). Exact pins stay exact because lancedb 0.37.1 itself demands `lance =10.0.0`; arrow 58 / datafusion 54 unchanged (the ceiling is lance-wide, #1182).