Mint directory_user, directory_group, group_membership, license_assignment (0x0B06–0x0B09); flow body 0x1718 - #370

What

This adds four concepts to the IAM domain of ogar-vocab, placed after email (0x0B05):

These are the concepts that directory reads bind to. OgarRbac grants and field masks on directory data key on them. Each concept gets:

• a CODEBOOK row,
• a class_ids const and an entry in class_ids::ALL,
• a promoted Class builder,
• a row in the ogar-class-view registry.

The Auth-domain count goes from 5 to 9.

ogar-flow-m365 (PR-FLOW-01, #368) now binds its directory operations to these concepts with ConceptBinding::Minted:

• query_user, update_user, remove_user → directory_user
• read_membership, add_group_member → group_membership
• read_license_evidence, assign_license → license_assignment

It also declares the flow body's concept id, 0x1718, and adds vocab::plug_into so the vocabulary can be registered in a VocabularyRegistry. 0x1718 is a palette slot above blockly-rs's 0x1717, so it stays in the crate. The existing guard no_0x17xx_row_reached_the_globally_mirrored_codebook keeps it out of class_ids::ALL.

The ogar-dir-core dependency is dropped (it was only used for the old DirSchema binding). ogar-vocab moves from a dev-dependency to a normal dependency; it has no dependencies of its own.

Paired PR: merge this one first

The zero-dep mirror rows are in AdaWorldAPI/lance-graph (lance-graph-contract::ogar_codebook, PR linked below). That repo's lance-graph-ogar::assert_codebook_parity checks both directions against OGAR main. Whichever PR merges first, lance-graph's parity step stays red until the other one lands. The lance-graph PR's own check needs this one on main, so the order is: this PR, then the mirror.

Tests

• ogar-vocab: 175 passed. ogar-class-view: 14 passed. ogar-flow-m365: 31 passed. There are two new tests: every directory operation binds to its minted concept, and the vocabulary plugs into a registry under 0x1718. Changing one binding makes the first test fail.
• ogar-osm, ogar-adapter-csharp, ogar-adapter-python and ogar-rbac pass.
• clippy with -D warnings and fmt --all --check are clean.
• A full cargo test --workspace --no-fail-fast ran locally. The only failures:
  • 37 tests that need a sibling OGIT checkout, which this sandbox doesn't have and CI provides;
  • ogar-r2il::the_table_matches_r2il_s_own_enum (84 vs 82 opcodes). That one fails on main without this change: upstream r2sleigh added two opcodes.

Generated by Claude Code