plan(super-domain-rbac-v1): §14-§17 — harvest meta-bridge, drift detection design arc, Zone 3 boundary, LanceDB+Flight SQL convergence

Four sections appended capturing the post-§13 architectural refinements
from the same session. APPEND-ONLY governance preserved — §1-§13 unchanged.

§14 — Harvest + Templates + Cross-Language Migration
- 3-step rhythm: harvest medcare_bridge + sharepoint_bridge → template
  woa-rs retrofit + new hubspot_bridge + new hiro_bridge → migrate existing
  consumers (MedCare-rs / smb-office-rs retrofit; MedCareV2 reshape per §17)
- Tier F (D-SDR-18 archaeology, D-SDR-19 MetaBridge extract) + Tier G
  (D-SDR-21..23 migrations)
- D-SDR-20 (custom Protobuf IDL) SUPERSEDED by §17.3 — Arrow Flight SQL
  has the wire layer

§15 — Multi-Implementation Drift Detection (initial framing)
- DriftableOutput + DriftReport + MetaBridgeVersion + BridgeImpl DTOs
- 12 cross-language byte-determinism rules (HashMap iter, FP summation,
  string hashing, decimal arithmetic, etc.)
- D-SDR-24 (MySQLAdapterBridge), D-SDR-25 (DriftDetectionBridge),
  D-SDR-26 (determinism test suite)
- Preserved as design arc — substantially refined by §16+§17

§16 — Zone 3 Drift Boundary + Two-Track Migration
- Pre-prod posture corrected: nothing in production, single one-shot
  import not persistent parallelbetrieb infrastructure
- Single 3DES cipher (well-known algorithm), not 3-cipher chain
- Zone 3 placement collapses determinism rules from 12 to ~3
- MerkleRoot-cleartext-beside-ciphertext: drift bridge compares without
  decrypting in steady-state, encryption uses random nonces (no GCM-SIV needed)
- Two-track model: John Doe (billing+tickets in WoA/Hiro databases, no 3DES) +
  3DES PHI (MedCare MySQL clinical columns)
- D-SDR-27 (3DES rewrap one-shot), D-SDR-28 (MerkleRoot beside ciphertext),
  D-SDR-29 (two-track runner), D-SDR-30 (3DES key destroy)
- §16.7 MedCare MySQL Struktur reality check: 104 tables, all VARCHAR/TEXT/
  DATETIME, app-layer 3DES not at-rest, schema purely clinical (billing/tickets
  live in separate WoA/Hiro databases). 38 pf_* tables are Patient
  substructure not 38 entities. Healthcare basin estimate ~30-50 slots used,
  comfortably within 256-slot ceiling.

§17 — DataFusion SQL inside LanceDB as unified persistence + access
- Convergence: MedCare-rs (in-process DataFusion) + MedCareV2 C# (Arrow
  Flight SQL gRPC) → same LanceDB tables via same logical plan layer
- Phase sequencing 0-4: import → dual-write → drift-clean → cutover
- D-SDR-20 RESOLUTION: Arrow Flight SQL replaces custom Protobuf IDL —
  Substrait extension types for OwlIdentity/MerkleRoot/SuperDomain
- Drift bridge bounded to Phase 2-3 window; retires to CI gate after Phase 4
- D-SDR-31 (Flight SQL server), D-SDR-32 (C# Flight SQL client),
  D-SDR-33 (Substrait extension types), D-SDR-34 (Phase-2 dual-write
  coordination)
- Dropped scope: MySQLAdapterBridge, persistent production drift infra,
  multi-trustee key escrow, C-ABI FFI option, custom Protobuf IDL
- §17.7 net architecture summary across §13+§14+§15+§16+§17

§18 deferred pending MCP scope expansion to AdaWorldAPI/MedCare + MedCareV2
for 3DES column inventory + transcoded shape grep. Will fold findings as
follow-up commit when scope lands.

INTEGRATION_PLANS.md second correction line appended per APPEND-ONLY governance.

Author: claude

.claude/board/INTEGRATION_PLANS.md

@@ -49,6 +49,8 @@
 
 **Correction (2026-05-13):** §13 refinements added (same session). (a) Enforcement composes onto shipped `lance-graph-callcenter::policy::PolicyRewriter` chain + `PolicyKind` taxonomy (RowFilter/ColumnMask/RowEncryption/DifferentialPrivacy/Audit) rather than introducing parallel path — ~30% Tier A LOC reduction. (b) Cross-tenant federation upgraded to A+B+C all accepted; Option C (`EncryptedViewAggregate`) viable now via LanceDB transparent encrypted views, not 2027+ R&D. (c) Audit chain integrity built-in via `MerkleRoot::from_fingerprint` + `ClamPath` from `graph/spo/merkle.rs` (the merkle/DN-path mixing already shipped). (d) Hard-lock requirement formalized: Healthcare ↔ OSINT (and 3 other pairs) get 3 layers of defense — predicate + per-super-domain merkle salt + super-domain-scoped HKDF key derivation. (e) `researcher` role hardened to anonymized-projection-only with k-anonymity floor + DP noise injection on aggregates. New deliverables D-SDR-13..17 added. Open questions on audit format + cross-tenant federation RESOLVED; new open questions on hard-lock partner matrix + per-super-domain DP epsilon + merkle salt rotation cadence.
 
+**Correction (2026-05-13, second commit):** §14-§17 refinements added (same session). (§14) Meta-bridge extracted from shipped medcare_bridge.rs + sharepoint_bridge.rs harvest, not designed clean-room. New bridges hubspot_bridge.rs + hiro_bridge.rs added as templates; woa_bridge.rs retrofit. Tier F (D-SDR-18..20, 23) + Tier G (D-SDR-21..22) deliverables. (§15) Drift detection initially framed as production parallelbetrieb infrastructure with 12 cross-language determinism rules — substantially refined by §16+§17. (§16) Pre-prod posture corrected per user clarification: nothing in production yet, single 3DES cipher (not 3-cipher chain), one-shot import tool not persistent infrastructure. Zone 3 boundary placement collapses determinism rules from 12 to ~3 (decimal + timestamp + FP aggregate). MerkleRoot-cleartext-beside-ciphertext insight: drift bridge compares without ever decrypting in steady-state production, so encryption uses random nonces (no need for AES-GCM-SIV). MedCare MySQL Struktur reality check (104 tables, all VARCHAR/TEXT/DATETIME, app-layer 3DES not at-rest, schema is purely clinical with billing/tickets in separate WoA/Hiro databases). New deliverables D-SDR-27..30. (§17) Convergence on LanceDB+DataFusion SQL as unified persistence; both Rust (in-process) and C# (Arrow Flight SQL gRPC) clients hit the same DataFusion logical plan layer. Custom Protobuf IDL (D-SDR-20) SUPERSEDED by Arrow Flight SQL — Substrait extension types for OwlIdentity/MerkleRoot/SuperDomain. Drift bridge bounded to Phase 2-3 cutover window, then retires to CI gate. New deliverables D-SDR-31..34. Dropped scope: MySQLAdapterBridge (D-SDR-24), persistent production drift infra, multi-trustee key escrow, C-ABI FFI option, custom Protobuf IDL. §18 deferred pending MCP scope expansion to AdaWorldAPI/MedCare + AdaWorldAPI/MedCareV2 for 3DES column inventory + transcoded shape grep.
+
 ---
 
 ## v1 — LF Integration Mapping (authored 2026-04-25)