action handler: B2-lift — REST registration instance lift (capabilities)

Parse a deployed handler's REST registration into the concrete OGAR signatures
the *schema* half cannot supply. The OGIT ontology declares only that a
capability has mandatoryParameters/optionalParameters slots; the concrete
(name, mandatory, default) tuples live in a deployed handler's config. B2-lift
reads them from the live REST view, so the two halves compose: schema lift gives
the contract shape, instance lift gives the deployed values.

Producer stays parser-free (the crate-family split):
- ogar-from-schema/src/registration.rs — typed REST DTOs (RegisteredCapability /
  RegisteredParam / ModelFilter, Deserialize behind the existing `serde` feature)
  + the pure lift: lift_registration -> ConcreteCapability (concrete ActionParam[]),
  and model_filter_to_guard (arago ModelFilter{Var,Mode,Value} -> StateGuard,
  field-for-field). No serde_json, no I/O. 5 tests incl. the lifted signature
  driving action_ws::bind_parameters.
- ogar-action-handler — the runtime owns I/O: parse_capabilities does the
  serde_json read of a GET /capabilities body. Proven end-to-end by
  rest_registration_lifts_binds_and_runs (real JSON -> lift -> bind -> the
  NativeCommandExecutor runs the command).

Same producer-defines-types / runtime-does-I/O split the whole crate family
keeps: ogar-from-schema gains a REST front-end without gaining a parser dep.

Remaining for full B2-lift: the GET /applicabilities MapOfApplicabilities JSON
envelope read (the ModelFilter->StateGuard lift is already shipped).

Docs: ARAGO-ACTIONHANDLER-PARITY (B2-lift §3 bullet + two scorecard rows +
verdict + cross-refs), D-ACTIONHANDLER-B2LIFT discovery row, E-ACTIONHANDLER-B2LIFT
epiphany (the parser-free producer / runtime-does-the-read split).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EYvNjD8M8LMNYbRy3gq2FP

Author: claude

.claude/board/EPIPHANIES.md

@@ -7,6 +7,42 @@
 
 ---
 
+## 2026-06-24 — E-ACTIONHANDLER-B2LIFT — the producer stays parser-free even when lifting a JSON REST response: it defines the `Deserialize` DTOs + the pure lift, the runtime does the `from_str`
+
+**Status:** FINDING (`[G]` for capabilities; `[H]` for the applicabilities envelope).
+
+B2-lift (the REST registration instance lift) had to read a JSON `GET
+/capabilities` body — but `ogar-from-schema` is deliberately parser-free on its
+default path (a narrow line-oriented TTL walker; a hand-rolled JSON *encoder* in
+`action_ws`, never a decoder). The resolution kept the producer pure by splitting
+along the crate family's existing seam:
+
+- **Producer (`ogar-from-schema::registration`) defines the typed REST DTOs**
+  (`RegisteredCapability` / `RegisteredParam` / `ModelFilter`, `Deserialize` behind
+  the already-present `serde` feature) **and the pure lift mapping**
+  (`lift_registration → ConcreteCapability` with concrete `ActionParam[]`;
+  `model_filter_to_guard`: arago `ModelFilter{Var,Mode,Value}` → `KausalSpec::StateGuard`
+  field-for-field). No `serde_json`, no I/O.
+- **Runtime (`ogar-action-handler::parse_capabilities`) does the `serde_json::from_str`.**
+  The runtime crate already owns I/O (it runs commands); reading a REST response is
+  the same kind of work. `serde_json` lives there, never in the producer.
+
+This is the same producer-defines-types / runtime-does-I/O split the whole crate
+family keeps (schema lift defines `Class`; source-AST producers fill behavior; the
+runtime executes). The payoff is concrete: `ogar-from-schema` gains a REST front-end
+without gaining a parser dependency.
+
+**The lift fills a gap the schema cannot reach.** The OGIT ontology declares only
+*that* a capability has `mandatoryParameters` / `optionalParameters` slots
+(`CapabilitySlot`); the concrete `(name, mandatory, default)` tuples exist only in a
+*deployed* handler's config. B2-lift reads them from the live REST view — so the
+two halves compose: schema lift gives the contract shape, instance lift gives the
+deployed values, and the result drives `bind_parameters` → the executor. Proven by
+`rest_registration_lifts_binds_and_runs` (real JSON → lift → bind → run). The B2-lift
+rows in the parity scorecard + `D-ACTIONHANDLER-B2LIFT` in the discovery map.
+
+---
+
 ## 2026-06-24 — E-ACTIONHANDLER-UPLINK — the hard gate is wired to the executor without OGAR ever taking a `lance-graph` dep: OGAR owns the executor, rs-graph-llm owns the gate, one seam crate joins them
 
 **Status:** FINDING (`[G]`, 3 tests).

crates/ogar-action-handler/Cargo.toml

@@ -12,5 +12,10 @@ description = "OGAR-native HIRO ActionHandler runtime — CapabilityExecutor imp
 default = []
 
 [dependencies]
-ogar-from-schema = { path = "../ogar-from-schema" }
+ogar-from-schema = { path = "../ogar-from-schema", features = ["serde"] }
 ogar-vocab = { path = "../ogar-vocab" }
+# The runtime owns I/O: it reads the REST Action API registration response
+# (`GET /capabilities`), so it carries the JSON reader. The producer crate
+# (`ogar-from-schema`) stays parser-free — it defines the `Deserialize` DTOs +
+# the pure lift; this crate does the `from_str`. (B2-lift.)
+serde_json = "1.0"

crates/ogar-action-handler/src/lib.rs

@@ -41,6 +41,27 @@
 use std::process::Command;
 
 use ogar_from_schema::action_ws::CapabilityExecutor;
+use ogar_from_schema::registration::{
+    ConcreteCapability, RegisteredCapabilities, lift_registration,
+};
+
+/// Read a deployed handler's `GET /capabilities` REST response (a JSON
+/// `MapOfCapabilities`) and lift it into the concrete OGAR capability signatures
+/// — the **B2-lift** brick's I/O half (`ogar-from-schema::registration` owns the
+/// pure lift; this crate owns the JSON read, per the producer/runtime split).
+///
+/// Each [`ConcreteCapability`] carries the concrete `ActionParam[]` the schema
+/// half cannot supply — feed it to
+/// [`ogar_from_schema::action_ws::bind_parameters`] to validate an engine
+/// `submitAction`'s `parameters` before executing.
+///
+/// # Errors
+/// Returns the `serde_json` error message if the body is not a valid
+/// `MapOfCapabilities`.
+pub fn parse_capabilities(json: &str) -> Result<Vec<ConcreteCapability>, String> {
+    let caps: RegisteredCapabilities = serde_json::from_str(json).map_err(|e| e.to_string())?;
+    Ok(lift_registration(&caps))
+}
 
 /// Reference executor for the **native** target: runs a capability's command via
 /// the local POSIX shell (`sh -c`). The concrete B1 impl that makes "OGAR
@@ -140,6 +161,54 @@ mod tests {
         assert!(err.contains("ExecuteCommand"), "got: {err}");
     }
 
+    /// B2-lift end-to-end: a real `GET /capabilities` REST response (JSON)
+    /// parses → lifts to a concrete signature → the signature binds engine
+    /// parameters → the native executor runs the command. The deployed config
+    /// (not the schema) supplied the concrete `(name, mandatory, default)`.
+    #[test]
+    fn rest_registration_lifts_binds_and_runs() {
+        use ogar_from_schema::action_ws::bind_parameters;
+
+        // A deployed handler's GET /capabilities body (MapOfCapabilities).
+        let body = r#"{
+            "ExecuteCommand": {
+                "description": "run a command",
+                "mandatoryParameters": {
+                    "command": { "description": "the command" }
+                },
+                "optionalParameters": {
+                    "shell": { "description": "the shell", "default": "sh" }
+                }
+            }
+        }"#;
+
+        let lifted = parse_capabilities(body).expect("valid MapOfCapabilities");
+        assert_eq!(lifted.len(), 1);
+        let cap = &lifted[0];
+        assert_eq!(cap.name, "ExecuteCommand");
+        // The concrete signature the schema half could not produce:
+        assert_eq!(cap.params.len(), 2);
+        assert!(
+            cap.params
+                .iter()
+                .any(|p| p.name == "command" && p.mandatory)
+        );
+        assert!(
+            cap.params
+                .iter()
+                .any(|p| p.name == "shell" && !p.mandatory && p.default.as_deref() == Some("sh"))
+        );
+
+        // The lifted signature drives bind (optional `shell` default filled),
+        // and the bound command runs on the native executor.
+        let supplied = vec![("command".to_owned(), "echo lifted".to_owned())];
+        let bound = bind_parameters(&supplied, &cap.params).expect("binds");
+        let result = NativeCommandExecutor
+            .execute("ExecuteCommand", &bound)
+            .expect("runs");
+        assert_eq!(result[0], ("output".to_owned(), "lifted".to_owned()));
+    }
+
     /// End-to-end: the dispatch core + this executor run a real command and
     /// produce the `sendActionResult` — "OGAR running it here," native target.
     #[test]

crates/ogar-from-schema/src/lib.rs

@@ -59,6 +59,7 @@ use ogar_vocab::{Attribute, Class, EnumDecl, EnumSource, Language};
 
 pub mod action_ws;
 pub mod do_arm;
+pub mod registration;
 pub mod sgo;
 pub mod ttl;
 pub mod ttl_emit;