PR-FLOW-01: PowerShell command labels over ogar-loco (ogar-flow-m365) - #368

What

A new sibling crate, ogar-flow-m365. It maps PowerShell-style admin labels (Get-MgUser, Get-IamLicenseEvidence, Get-IamMembership, Where-Object, Select-Object, Export-Report, plus aliases) to typed operations. An admitted read-only pipeline subset is lowered into one ogar-loco Quads body, which the unchanged ogar_loco::Interpreter runs under a flow Dialect.

Get-MgUser -UserId "john.doe@example.test" | Get-IamLicenseEvidence |
    Select-Object DisplayName, Department, Licenses | Export-Report -Format JSON

This compiles to calls 0x90 0x91 0x94 0x95. Run against the synthetic fixture, it produces a deterministic JSON report containing the requested user, the three permitted fields, the license facts, the source id, the observed version, the applied scope, the policy version and a per-stage trace.

Litmus test

Get-MgUser was added without touching ogar-loco: git diff origin/main -- crates/ogar-loco is empty. There are no new opcodes and no changes to the ABI, the interpreter, the conformance rules or DOMAIN_FLOOR.

Design

• Adjacency table (adjacency.rs): label → OperationId → Operation. Each operation records its effect, capability, input/output shape, backend, call byte and concept binding. Aliases point at the same operation row. Mutating labels (Set-MgUser, Remove-MgUser, New-MgGroupMember, Set-MgUserLicense) and executing labels (Invoke-Expression/iex) are known but have no call byte, so they are refused. Unknown labels are refused.
• Vocabulary (vocab.rs): six domain bytes 0x90..=0x95. It passes ogar-loco conformance. Where-Object uses the shared-core EQ/NEQ/LIST_CONTAINS bytes as its comparison codebook. Select-Object packs a lance_graph_contract::class_view::FieldMask.
• Trust order: run_flow accepts only an ogar_auth::federation::VerifiedLogin. A ReportAuthority maps the canonical user to a ReportScope (tenant, capabilities, field mask, policy version) before anything runs. Host queries carry the scope's tenant, never one named in the pipeline. Filtering or selecting an unpermitted field is refused.

Implemented / mocked / deferred

• Implemented: adjacency, vocabulary, lowering, execution through the LOCO interpreter, the verified-login entry, the deterministic report.
• Mocked (behind the fixture feature, not security): directory observations, the report authority, the assertion verifier. The verifier still goes through the real establish.
• Deferred, gated: production RBAC via OgarRbac and registering the vocabulary under a body classid. Both need concept ids that ogar-vocab does not mint today: directory user, license assignment, group membership, report. That is an operator decision; this PR mints nothing.

Tests

cargo test -p ogar-flow-m365: 29 passed. These are falsifiers F1–F10 on synthetic data.

• The baseline ogar-loco suite has 84 passed, both before and after this change.
• cargo clippy -p ogar-flow-m365 --all-targets --features fixture -D warnings is clean, and cargo fmt --check is clean.
• Every guard was disabled once to confirm a test fails without it. The first round found three guards with no test pinning them; tests were added for them.
• One guard could not be reached (the export-boundary clip), so it was removed rather than left unpinned.
• The tests also caught two real issues during development:
  • @ inside bareword emails was wrongly refused.
  • The operation name project collided with the minted project concept 0x0101, so it was renamed to select_fields.

Dependency impact

ogar-loco is unchanged. The new crate pulls in ogar-auth for VerifiedLogin, and with it ogar-auth's crypto stack: 97 unique crates in the normal-dependency tree.

Next seam

PR-FLOW-02 wires ogar-az observations and the OGAR RBAC authority once the concepts are minted. PR-FLOW-03 adds the report-rs palette, built on compile for preview and run_flow with the session's VerifiedLogin. The crate README has the details.

Generated by Claude Code