The hazard (surfaced by a 5+3 council's meta-lens)
lance-graph-contract/src/action.rs independently declares ActionDef, ActionInvocation, and ActionState (action.rs:44,79,185), doc-commented "shaped per OGAR OGAR-AST-CONTRACT.md §1" (action.rs:7). OGAR also owns these as its IR types (ogar-vocab/src/lib.rs:389,508,669) — and they are deliberately different shapes (the contract carries the lean RBAC/MUL commit-gate view; ogar_vocab carries the full IR with kausal/body_source/effects). The concern-split is real and OGAR-sanctioned.
The gap: there is no shape-parity fuse guarding this boundary, while the sibling codebook mirror across the same OGAR↔lance-graph seam DOES have one (ogar-class-view/src/lib.rs:394, classid_order_agrees_with_lance_graph_contract_canon_high). So a same-named triple straddles the exact boundary that repeatedly gets conflated, with a doc-comment ("shaped per OGAR-AST-CONTRACT") that invites a reader to treat contract::action::ActionDef as the OGAR IR type — and nothing catches drift if the two shapes diverge in a way that matters.
This is a latent hazard, not a live bug: no current code depends on the two being identical (they're intentionally not). But the asymmetry (codebook mirror fused, action-type mirror unfused) plus the misleading doc-comment is exactly the layer-confusion surface that produced this session's wrong-repo issue.
Why it's an issue, not a fix
The right response is a design decision, not a quick edit:
- Option A — add an explicit "this is a LEANER, DIFFERENT type than
ogar_vocab::ActionDef; do not assume field parity" guard-comment + (if any fields must agree, e.g. ActionState discriminants) a drift-fuse test mirroring the codebook one.
- Option B — if nothing must agree, weaken the "shaped per OGAR-AST-CONTRACT §1" doc-comment so it stops implying identity.
Acceptance
Provenance: MedCare-rs E-MEDCARE-30 + AGENT_LOG (the 5+3 council run); CLAIM-E highest-residual-risk finding. Not urgent (P1/latent).
🤖 Generated with Claude Code
The hazard (surfaced by a 5+3 council's meta-lens)
lance-graph-contract/src/action.rsindependently declaresActionDef,ActionInvocation, andActionState(action.rs:44,79,185), doc-commented "shaped per OGAROGAR-AST-CONTRACT.md§1" (action.rs:7). OGAR also owns these as its IR types (ogar-vocab/src/lib.rs:389,508,669) — and they are deliberately different shapes (the contract carries the lean RBAC/MUL commit-gate view;ogar_vocabcarries the full IR withkausal/body_source/effects). The concern-split is real and OGAR-sanctioned.The gap: there is no shape-parity fuse guarding this boundary, while the sibling codebook mirror across the same OGAR↔lance-graph seam DOES have one (
ogar-class-view/src/lib.rs:394,classid_order_agrees_with_lance_graph_contract_canon_high). So a same-named triple straddles the exact boundary that repeatedly gets conflated, with a doc-comment ("shaped per OGAR-AST-CONTRACT") that invites a reader to treatcontract::action::ActionDefas the OGAR IR type — and nothing catches drift if the two shapes diverge in a way that matters.This is a latent hazard, not a live bug: no current code depends on the two being identical (they're intentionally not). But the asymmetry (codebook mirror fused, action-type mirror unfused) plus the misleading doc-comment is exactly the layer-confusion surface that produced this session's wrong-repo issue.
Why it's an issue, not a fix
The right response is a design decision, not a quick edit:
ogar_vocab::ActionDef; do not assume field parity" guard-comment + (if any fields must agree, e.g.ActionStatediscriminants) a drift-fuse test mirroring the codebook one.Acceptance
classid_order_agrees_with_lance_graph_contract_canon_high.Provenance: MedCare-rs E-MEDCARE-30 + AGENT_LOG (the 5+3 council run); CLAIM-E highest-residual-risk finding. Not urgent (P1/latent).
🤖 Generated with Claude Code