fix(contract): sync ogar_codebook to OGAR #110 (Auth 0x0B domain) — fixes lance-graph-ogar parity fuse

OGAR #110 minted the 0x0B AuthStore class family (auth_store / auth_zitadel /
auth_zanzibar / auth_ory_keto). After q2 #42 bumped the pinned ogar-vocab to
302c284, lance-graph-ogar's compile-time COUNT_FUSE + runtime
assert_codebook_parity() fired — the contract's zero-dep ogar_codebook mirror
had drifted (39 vs 43) — and broke the q2 Railway build (cockpit-server pulls
lance-graph-ogar).

Sync the mirror to match ogar_vocab::class_ids::ALL exactly:

contract::ogar_codebook (crates/lance-graph-contract):
- NEW ConceptDomain::Auth (0x0BXX) + canonical_concept_domain 0x0B => Auth.
- 4 CODEBOOK entries: auth_store 0x0B01, auth_zitadel 0x0B02,
  auth_zanzibar 0x0B03, auth_ory_keto 0x0B04 (mirror now 43 entries).
- Parity tests updated (domain_routes_on_high_byte, codebook_ids_match_ogar_vocab).

lance-graph-ogar (crates/lance-graph-ogar):
- parity::domains_agree gains the (O::Auth, C::Auth) arm — the
  #[non_exhaustive]-total match that intentionally trips on a new OGAR domain.

Verified: cargo build --manifest-path crates/lance-graph-ogar (COUNT_FUSE green);
cargo test --manifest-path crates/lance-graph-ogar (parity + 53 lib tests green);
cargo test -p lance-graph-contract (8 ogar_codebook green); contract clippy
-D warnings + fmt clean.

Board-hygiene: LATEST_STATE inventory entry (same commit).

Author: claude

.claude/board/LATEST_STATE.md

@@ -10,6 +10,12 @@
 
 ---
 
+## 2026-06-23 — IN PR (`claude/sync-ogar-codebook-auth-domain`) — `contract::ogar_codebook` synced to OGAR #110 (Auth domain `0x0B`) — fixes the codebook parity drift #42's ogar-vocab bump surfaced
+
+OGAR #110 minted the `0x0B` **AuthStore** class family; the contract's zero-dep mirror lagged (39 vs 43), so `lance-graph-ogar`'s compile-time `COUNT_FUSE` + runtime `assert_codebook_parity()` fired and **broke the q2 Railway build** (`cockpit-server` → `lance-graph-ogar`). Synced the mirror: **NEW** `ConceptDomain::Auth` (`0x0BXX`) + `0x0B => Auth` routing + 4 `CODEBOOK` entries (`auth_store` `0x0B01` / `auth_zitadel` `0x0B02` / `auth_zanzibar` `0x0B03` / `auth_ory_keto` `0x0B04`), and the `lance-graph-ogar::parity::domains_agree` `(O::Auth, C::Auth)` arm. Mirror is now **43** = `ogar_vocab::class_ids::ALL`. **Verified:** `cargo build --manifest-path crates/lance-graph-ogar` (COUNT_FUSE green, 36s); `cargo test --manifest-path crates/lance-graph-ogar` (`mirror_is_a_faithful_copy_of_ogar_codebook` + 53 lib tests green); `cargo test -p lance-graph-contract` (8 ogar_codebook tests green); contract clippy `-D warnings` + fmt clean. The parity guard worked as designed — the `#[non_exhaustive]`-total `domains_agree` match tripped on the new OGAR domain. Refs: q2 #41 (root `/Dockerfile`) + #42 (ogar-vocab lock bump → `302c284`); this is the contract-side completion that unblocks the live Rust deploy.
+
+---
+
 ## 2026-06-22 — MERGED #592 (merge `48794eaf`, `claude/contract-app-prefix-mirror`) — `contract::ogar_codebook` APP-prefix (hi-u16) mirror — closes `ISS-CONTRACT-APP-PREFIX-MIRROR`
 
 Membrane consumers can now pull BOTH halves of a render `classid` BBB-safely from `lance_graph_contract::ogar_codebook` — no hand-stamped `0x000N`. **NEW:** `AppPrefix` enum (the OGAR#95 §2 allocation table as typed data — `Core 0x0000` / OpenProject `0x0001` / Odoo `0x0002` / WoA `0x0003` / SMB `0x0004` / Healthcare `0x0005` / Redmine `0x0007`) with `prefix()` / `from_prefix()` / `render(concept)`; free fns `render_classid(prefix, concept)`, `render_classid_for_concept(AppPrefix, &str)`, `classid_app_prefix(classid)`, `classid_concept(classid)` — the wire-compat mirror of OGAR#97 `ogar_vocab::app` (`render_classid_for::<P>` / `app_of` / `concept_of`), **no `ogar-vocab` dependency**. Two parity tests: `app_prefixes_match_ogar_allocation_table` (pins the 6 prefixes vs OGAR `PortSpec::APP_PREFIX`) + `render_classid_composes_decomposes_and_preserves_the_concept_half` (pins the `0x0005_0901` MedCare-patient worked example, and that the render lens never perturbs the lo-u16 concept RBAC keys on). Follows the OGAR#98 `canonical_concept_name` mirror precedent. Closes the gap the #591 consumer spellbook surfaced. Contract lib **+2 tests** / +1 doctest; `cargo fmt -p lance-graph-contract --check` clean; `clippy -p lance-graph-contract --all-targets -D warnings` clean (also `--features guid-v2-tail`). (Incidental: the crate-wide `cargo fmt` pass also corrected pre-existing struct-literal/line-width drift in `content_store.rs` — same crate, no behavior change.) Refs: PR #592 (merged `48794eaf`), ISSUES `ISS-CONTRACT-APP-PREFIX-MIRROR` (RESOLVED), `.claude/knowledge/ogar-consumer-preflight.md` § Core-gap (CLOSED), OGAR#97/#98.

crates/lance-graph-contract/src/ogar_codebook.rs

@@ -54,7 +54,9 @@ pub enum ConceptDomain {
     Ocr,
     /// `0x09XX` — Health (clinical / patient / care; FMA anatomy lives here).
     Health,
-    /// Any high-byte slot not yet assigned a domain (`0x03XX`–`0x06XX`, `0x0AXX`+).
+    /// `0x0BXX` — Auth (identity / authz: AuthStore, Zitadel, Zanzibar, Ory Keto).
+    Auth,
+    /// Any high-byte slot not yet assigned a domain (`0x03XX`–`0x06XX`, `0x0AXX`, `0x0CXX`+).
     Unassigned,
 }
 
@@ -71,6 +73,7 @@ pub fn canonical_concept_domain(id: u16) -> ConceptDomain {
         0x07 => ConceptDomain::Osint,
         0x08 => ConceptDomain::Ocr,
         0x09 => ConceptDomain::Health,
+        0x0B => ConceptDomain::Auth,
         _ => ConceptDomain::Unassigned,
     }
 }
@@ -292,6 +295,11 @@ pub const CODEBOOK: &[(&str, u16)] = &[
     ("treatment", 0x0905),
     ("visit", 0x0906),
     ("vital_sign", 0x0907),
+    // ── 0x0BXX — Auth domain (identity / authz; OGAR's 0x0B AuthStore family) ──
+    ("auth_store", 0x0B01),
+    ("auth_zitadel", 0x0B02),
+    ("auth_zanzibar", 0x0B03),
+    ("auth_ory_keto", 0x0B04),
 ];
 
 /// Resolve a **canonical-concept** string to its stable `u16` codebook id via
@@ -363,6 +371,7 @@ mod tests {
         assert_eq!(canonical_concept_domain(0x0700), ConceptDomain::Osint);
         assert_eq!(canonical_concept_domain(0x0801), ConceptDomain::Ocr);
         assert_eq!(canonical_concept_domain(0x0901), ConceptDomain::Health);
+        assert_eq!(canonical_concept_domain(0x0B01), ConceptDomain::Auth);
         assert_eq!(canonical_concept_domain(0x0500), ConceptDomain::Unassigned);
     }
 
@@ -417,6 +426,11 @@ mod tests {
         assert_eq!(canonical_concept_id("commercial_line_item"), Some(0x0201));
         assert_eq!(canonical_concept_id("commercial_document"), Some(0x0202));
         assert_eq!(canonical_concept_id("currency_policy"), Some(0x0206));
+        // 0x09XX Health + 0x0BXX Auth (OGAR #110 minted the AuthStore family).
+        assert_eq!(canonical_concept_id("patient"), Some(0x0901));
+        assert_eq!(canonical_concept_id("vital_sign"), Some(0x0907));
+        assert_eq!(canonical_concept_id("auth_store"), Some(0x0B01));
+        assert_eq!(canonical_concept_id("auth_ory_keto"), Some(0x0B04));
         assert_eq!(canonical_concept_id("not_a_concept"), None);
     }
 

crates/lance-graph-ogar/src/lib.rs

@@ -134,6 +134,7 @@ pub mod parity {
                 | (O::Osint, C::Osint)
                 | (O::Ocr, C::Ocr)
                 | (O::Health, C::Health)
+                | (O::Auth, C::Auth)
                 | (O::Unassigned, C::Unassigned)
         )
     }