impl(sprint-7): 7-worker implementation wave for sprint-5/6 specs + AuditSink trait unification

.claude/board/AGENT_ORCHESTRATION_LOG.md

@@ -1071,3 +1071,7 @@ Agent W1 delivered `.claude/specs/pr-d3a-lance-audit-sink.md` (~27 KB, 515 lines
 2026-05-13 W8 sprint-log-5-6 S6-W4: wrote .claude/specs/pr-e3-woa-rs-extract.md (~950 LOC woa-rs 3-subcrate spec: woa-rbac/woa-realtime/woa-analytics, WorkOrderBilling super-domain, SOX §404 tests, UnifiedBridge<WoaBridge> wiring, migration path from smb-office-rs customer-woa-bin)
 2026-05-13 META AGENT (Opus 4.7) sprint-log-5-6 DONE: .claude/board/sprint-log-5-6/meta-review.md (~24 KB) — combined M1 per-worker + M2 cross-spec synthesis across 12 specs. Verdict 3A/7B/2C/0D/0F. Top contradictions: CC-2 AuthOp lifecycle (W11×W2), CC-3 SuperDomain::System (W11×W6/W12), CC-7 phf zero-dep (W10 internal). Top user OQs: W3 parser extension (pick c), W10 phf→sorted-slice, W6 RoleGroup migration. Sequencing: D3A+D3B combined; E1/E2/E3 separate; G1→G2 sequential; F1 standalone. Coverage gaps PR-D5/E4/E5/H5/HSM deferred to sprint-7+.
 W13 | 2026-05-13 | pr-ogit-ttl-smb-hydration.md | DONE | 35009 bytes | §E: (1) ogit.SMB.bson: sub-namespace, (2) per-property annotations via ogit:marking, (3) existing SemanticType variants | sequencing: after W7 Batch B
+2026-05-13 S7-W7 DONE: extended family_registry.ttl (+17 entries: 3 SMB Foundry 0x80-0x82, 14 SMB.bson 0xA0-0xAD); updated parse_super_domain_name() to map "SMB"+"SMB.bson"→WorkOrderBilling; added 4 unit tests (U6-U9); 20/20 family_ + 9/9 hydration tests pass; enumerate("SMB")=3 invariant confirmed (no contamination).
+S7-W3 2026-05-13: Implemented lance-graph-supervisor crate (PR-G2/TD-RACTOR-SUPERVISOR-5): CallcenterSupervisor with ractor per-G actors, one-for-one supervision, backoff 100ms→30s, LifecycleAuditEvent separate from UnifiedAuditEvent (CC-2 fix), SuperDomain::System added with hard-lock exemption (CC-3 fix), all tests green, canonical_bytes 26-byte regression confirmed.
+2026-05-13 17:14 | S7-W6 | D3A+D3B | DONE | Files: audit_sink/{mod,composite,jsonl_sink,lance_sink}.rs + bin/audit_verify.rs | Tests: 11 new (11 pass) + 118 existing (all pass) | cargo check lance-sink,jsonl: OK | cargo test: 11/11 pass | cargo build audit-verify: OK
+2026-05-13 sprint-log-7 META (Opus 4.7): cross-implementation review across 7 worker outputs — 3A/3B/1B-minus, 32 KB at .claude/board/sprint-log-7/meta-review.md; single must-fix CC-7-1 (UnifiedAuditSink vs AuditSink trait split blocks W6 from bridge); 3-PR split recommended (A scaffold+W2+W3+W4, B hydration W1+W7, C gate+sinks W5+W6 with trait-family fix).

.claude/board/EPIPHANIES.md

@@ -65,6 +65,42 @@ stay as historical references.
 
 ## Entries (reverse chronological)
 
+## 2026-05-13 — DECISION: sprint-7 meta OQ-7-2 + OQ-7-3 resolved — AuditSink trait unification
+
+Post-sprint-7 implementation, Opus meta surfaced a critical cross-impl risk (CC-7-1) and two open questions blocking the sprint-7 PR open:
+
+- **OQ-7-2: AuditSink trait split.** `UnifiedBridge::audit_sink` was typed `Arc<dyn UnifiedAuditSink>` (D-SDR-4 placeholder trait at `unified_audit.rs:314`); sprint-7 W6 production sinks (`JsonlAuditSink`, `LanceAuditSink`, `CompositeSink`) implement `Arc<dyn AuditSink>` (new trait at `audit_sink/mod.rs:45`). The two traits had different signatures (`emit(&event)` vs `emit(event) -> Result<>`). W6 sinks shipped orphaned from the bridge. **Resolution: full migrate, drop UnifiedAuditSink, no adapter.** Per CLAUDE.md "no abstractions beyond what the task requires" — an adapter is permanent overhead to avoid one-time call-site churn. Landed in commit `bc530a4`. 6 files touched; `UnifiedAuditEvent::canonical_bytes` byte layout unchanged (still 26 bytes).
+
+- **OQ-7-3: UnifiedBridge::new() default sink behavior.** MedCare-rs sprint-2 item 5 expects "JSONL primary + optional Lance projection". **Resolution: keep `NoopAuditSink` as new() default; add ergonomic constructor `UnifiedBridge::with_jsonl_audit(super_domain, salt, base_path)` for explicit opt-in.** Silent default writes to disk are a surprise (the path would be implicit, log volume unbounded). Opt-in via the new constructor is more honest. MedCare-rs consumers wire JSONL when they construct the bridge; default-noop doesn't prevent that pattern. Available under `#[cfg(feature = "jsonl")]`.
+
+Also confirmed non-blocking:
+
+- **OQ-7-1: RoleGroup count.** MedCare-rs#119 ships 6 RoleGroups (Physician, Nurse, Cashier, Researcher, HipaaAudit, Admin); end-state matches our lance-graph decision regardless of "add 4" wording in the earlier EPIPHANY (4 additions = Nurse + 3 renames). No code change needed.
+- **W3 LifecycleAuditEvent ↔ W6 CompositeSink routing.** `LifecycleAuditEvent` (18 bytes) is intentionally separate from `UnifiedAuditEvent` (26 bytes) per sprint-5-6 meta CC-2 fix. They do NOT share the AuditSink trait — supervisor lifecycle audit is a parallel chain by design. If a future need to unify them surfaces, that's its own spec.
+
+Cross-ref: `.claude/board/sprint-log-7/meta-review.md` §1+§3, commit `bc530a4` (the trait migration).
+
+---
+
+## 2026-05-13 — DECISION: 4 PR #365 blocking OQs resolved — sprint-7 implementation can begin
+
+Post-#365 cross-session triage with the medcare-rs session resolved all four user-decision Open Questions that the Opus meta-review flagged as blocking sprint-7 implementation:
+
+- **OQ-1 (W3) TTL family-registry parser entry → new `parse_family_registry()` API.** Keeps `parse_ttl_directory_with_provenance` focused on ontology TTL; family-registry TTL is a different schema; mixing them via overload-by-naming is the wrong abstraction.
+- **OQ-2 (W10) `MANIFEST_METADATA` storage → sorted-slice + binary search.** `lance-graph-contract` zero-dep invariant in CLAUDE.md is iron. `phf` would be the first non-build dep on the contract crate. Binary search on sorted-slice is O(log n) and zero-dep. The C-grade meta finding for `pr-g1-manifest-modules.md §4.3` resolves by this change.
+- **OQ-3 (W6) `medcare_rbac::Role` migration → direct migration (rename `doctor → physician`, add `nurse / cashier / researcher / hipaa_audit`).** Per CLAUDE.md "Don't introduce abstractions beyond what the task requires." A bridge adapter is a permanent abstraction to avoid one-time call-site churn — wrong tradeoff. `super-domain-rbac-tenancy-v1.md §14` made canonical RoleGroups primary; aligning is mandatory, not optional. E1-1 LOC stays at ~180. medcare-rs session eats the call-site churn.
+- **OQ-4 (W13 §E.1) OGIT/NTO/SMB BSON namespace → `ogit.SMB.bson:` sub-namespace.** `registry.enumerate("SMB")` must return exactly 3 Foundry entities; mixing BSON into the same namespace breaks the `smb_projects_three_entities` test and corrupts the `OntologyRegistry` index.
+
+Cross-session boundary clarified (lance-graph side ↔ medcare-rs side):
+- **lance-graph (this session):** sprint-7 implementation fleet for W3 family-hydration (the cascade unblocker), W10 manifest-modules (with sorted-slice fix), W11 ractor-supervisor (with `LifecycleAuditEvent` split per meta CC-2), W12 conformance crate, W1 LanceAuditSink, W2 JsonlAuditSink + verify CLI, W9 thinking-engine wire.
+- **medcare-rs session:** PR-α (`MedcareOntology::from_registry` red-build fix), PR-β' (E1-1 wire `medcare_healthcare_policy()` + direct migration per OQ-3), PR-γ (FingerprintCodec re-export fold — Pattern N anti-pattern at `medcare-analytics/src/soa_mapping.rs`; ~20 LOC scope, delete enum + re-export from `lance_graph_contract::cam` / `bgz17`), PR-δ (AUTH_LEGACY_TRIPLEDES_MIGRATION audit vs PR #363 §18, doc-only).
+- **Both deferred:** E1-5 (HIPAA hard-lock cross-domain matrix, D-SDR-17, ~60 LOC) → sprint-8 compliance owns. E1-6 (JWT middleware stub for `praxis_id`, ~150 LOC) → blocked on DM-7 (`RlsRewriter::rewrite(LogicalPlan, &ActorContext)` per foundry-roadmap §2).
+- **E1-3 / E1-4** (`MedCareStack` composition + audit emission) → cascade-unblocks once W3 lands `parse_family_registry()` + seeds `OgitFamilyTable` for Healthcare basins 0x10..=0x19.
+
+Cross-ref: `.claude/board/sprint-log-5-6/meta-review.md` §6 (OQ triage), PR #365 body (OQs as checkboxes), `super-domain-rbac-tenancy-v1.md §14`.
+
+---
+
 ## 2026-05-13 — CORRECTION-OF sprint-4 framing: most worker specs partially duplicated existing `.claude/plans/` corpus — sprint-5 MUST grep `.claude/plans/*.md` before spawning any worker
 
 **Status:** FINDING (user surfaced prior plans 2026-05-13 evening)

.claude/board/LATEST_STATE.md

@@ -2,7 +2,7 @@
 
 > **Auto-injected at session start via SessionStart hook.**
 > Updated after every merged PR.
-> **Last updated:** 2026-05-13 (sprint-5 cross-repo landing complete: lance-graph PR #364 + MedCare-rs#112 + smb-office-rs#31 + ndarray#142 all merged the same day. lance-graph #364 ships D-SDR-3/4/5 + sprint-log-4 governance + sprint-5-9 roadmap + codex P1/P2 surgical fixes (OwlIdentity 3-byte canonical, UnifiedAuditEvent 26 bytes, OgitFamilyTable sparse `HashMap<u16, FamilyEntry>`, audit super_domain via AuditChain). MedCare-rs#112 (PR-B) wires `UnifiedBridge<MedcareBridge>` + medcare-rbac + medcare-realtime substrate (+2963 LOC, 17 files, §73 SGB V + BMV-Ä §57 + BtM regulatory tests). smb-office-rs#31 (PR-C) wires `UnifiedBridge<OgitBridge>` (+111 LOC). ndarray#142 ships VBMI gate for `permute_bytes` (P0 SIGILL fix on Skylake-X / Cascade Lake / Ice Lake-SP) + Inf clamp for `simd_exp_f32`. D-SDR-5 `UnifiedBridge` surface is now consumed end-to-end across MedCare + smb-office. Prior: 2026-05-07 (PR #354). Prior: 2026-05-07 (PR #353). Prior: 2026-05-07 (PR #352). Prior: 2026-05-06 (splat-osint-ingestion-v1 PR 1+2 of 6 in flight). Prior: 2026-04-21 post PR #243.
+> **Last updated:** 2026-05-13 (PR #365 merged: 13-worker parallel sprint-5/sprint-6 spec batch + Opus meta review — governance only, ~300 KB of PR-ready specs at .claude/specs/, ready to feed sprint-7 implementation workers; 4 blocking OQs pending user decision). Prior same-day: sprint-5 cross-repo landing complete — lance-graph PR #364 + MedCare-rs#112 + smb-office-rs#31 + ndarray#142 all merged the same day. lance-graph #364 ships D-SDR-3/4/5 + sprint-log-4 governance + sprint-5-9 roadmap + codex P1/P2 surgical fixes (OwlIdentity 3-byte canonical, UnifiedAuditEvent 26 bytes, OgitFamilyTable sparse `HashMap<u16, FamilyEntry>`, audit super_domain via AuditChain). MedCare-rs#112 (PR-B) wires `UnifiedBridge<MedcareBridge>` + medcare-rbac + medcare-realtime substrate (+2963 LOC, 17 files, §73 SGB V + BMV-Ä §57 + BtM regulatory tests). smb-office-rs#31 (PR-C) wires `UnifiedBridge<OgitBridge>` (+111 LOC). ndarray#142 ships VBMI gate for `permute_bytes` (P0 SIGILL fix on Skylake-X / Cascade Lake / Ice Lake-SP) + Inf clamp for `simd_exp_f32`. D-SDR-5 `UnifiedBridge` surface is now consumed end-to-end across MedCare + smb-office. Prior: 2026-05-07 (PR #354). Prior: 2026-05-07 (PR #353). Prior: 2026-05-07 (PR #352). Prior: 2026-05-06 (splat-osint-ingestion-v1 PR 1+2 of 6 in flight). Prior: 2026-04-21 post PR #243.
 >
 > Purpose: prevent new sessions from hallucinating structure that
 > already exists or proposing features already shipped. Read this
@@ -14,6 +14,7 @@
 
 | PR | Merged | Title | What it added |
 |---|---|---|---|
+| **#365** | 2026-05-13 | specs(sprint-5-6): 13-worker parallel batch + Opus meta review | Governance-only PR. **13 PR-ready specs at `.claude/specs/`** (~300 KB) from a 12-Sonnet-worker + 1-post-meta-Sonnet-worker + 1-Opus-meta-agent parallel batch. Spec grades: 3 A (W2 d3b-jsonl, W5 pr-graph, W12 conformance), 7 B, 2 C (W10 manifest-modules needs §4.3 sorted-slice rewrite; W11 ractor-supervisor needs LifecycleAuditEvent split). 24 KB Opus meta cross-spec review at `.claude/board/sprint-log-5-6/meta-review.md`. 4 blocking OQs (W3 parser entry, W10 phf vs sorted-slice, W6 Role migration, W13 BSON namespace). CCA2A 12+1+1 pattern validated at scale: ~300 KB of PR-ready output in under an hour wall-clock; 3 workers required respawns for permission denials (settings.json patched for `.claude/board/sprint-log-5-6/**`). |
 | **#364** | 2026-05-13 | D-SDR-3/4/5 + sprint-log-4 governance + sprint 5-9 roadmap + codex P1/P2 | Tier-A substrate close: **D-SDR-3** OgitFamilyTable + FamilyEntry codebook (~300 LOC), **D-SDR-4** merkle-chained UnifiedAuditEvent (~460 LOC, AuditMerkleRoot = u64 FNV-1a), **D-SDR-5** authorize_* through Policy::evaluate with audit emission (~300 LOC). **Codex P1 fix** (`3208743`): OwlIdentity widened u8→u16 slot → 3-byte canonical `[family, slot_lo, slot_hi]`; OgitFamilyTable → sparse `HashMap<u16, FamilyEntry>`; UnifiedAuditEvent canonical_bytes 25→26. **Codex P2 fix** (`e23ce89`): emit_audit uses AuditChain.super_domain() instead of static FAMILY_TO_SUPER_DOMAIN. **CI fix** (`a3c753f`): ndarray/hpc-extras opt-in for blake3. Sprint-log-4 governance corpus (12 worker specs + 2 meta reviews) + sprint-5-through-9 roadmap (70 agents = 60W + 10M across 5 sprints, mandatory 12-step plan-read-order in worker prompts). 97/97 callcenter lib tests pass. All 5 CI checks green on `c8176cb`. Adjacent: ndarray#142 (VBMI gate + Inf clamp) merged same day. |
 | **#354** | 2026-05-07 | gov: #353 post-merge + cross-repo adjacent-landings | Pure governance close-out. PR_ARC entry for #353 + LATEST_STATE row. Documents the 5-PR coordinated landing across 4 repos: lance-graph #352/#353/#354 + OGIT #2 (woa+medcare bridges unblocked for OGIT-O(1)) + woa-rs #2 (cross-repo `--features ontology` integration) + MedCare-rs #109 (`?source=lance` exercising Zone 2 → Zone 3 rewriter chain). Locks: append-only board hygiene durability across 4 sequential prepends; cross-repo coordinated-landing recipe. |
 | **#353** | 2026-05-07 | plan: palantir-parity-cascade v2 + SoA DTO entropy ledger + #352 post-merge governance | Three artifacts. **v2 capstone** (262 lines): integrates 4 prior Foundry parity docs. Pillar 0 carry-forward: Foundry parity IS SoA-as-canon parity. Column H (PR #272 SHIPPED) is already the Foundry Object Type bridge. 15 D-PARITY-V2 deliverables. **SoA DTO entropy ledger** (210 lines, append-only knowledge): 22 DTOs classified across 4 tiers (sensor → engine → contract → callcenter). Buckets: 9 bare-metal / 7 SoA-glue / 6 bridge-projection (3 OPEN). `ResonanceDto` IS the SoA. Codec cascade columns all OPEN today. **#352 post-merge governance**: PR_ARC + LATEST_STATE updates. |