NTO/Integration: Bardioc Connector Framework 2.0 schema

[boosc]

NTO/Integration -- Bardioc Connector Framework 2.0 schema

Summary

Adds the new top-level NTO/Integration/ namespace to OGIT. It is the
schema substrate for the Bardioc Connector Framework 2.0: the four
in-graph rule registries (Mapping, Netting, Conflict-Resolution,
Weaving) plus the Connector / ConnectorInstance / ConnectorRun
lifecycle entities, the provenance and audit vocabulary, the conflict
and identity-reconciliation decision records, and the Action concept.

The change is purely additive and isolated: all 257 changed files live
under NTO/Integration/, nothing outside it is touched, and there are
no deletions.

Scope

Item	Count
Entities	27 (17 core + 7 Decisions/PII + 3 Decisions/Audit)
Attributes	187
Verbs	39
READMEs	4 (NTO root + Decisions/, Decisions/PII/, Decisions/Audit/)
TTL files	253
Files total	257
Insertions	4549 (0 deletions)

What it models

• Registries (D7). MappingRule, NettingPolicy,
  ConflictResolutionRule, WeavingRule -- the four registries are
  graph entities, not config files.
• Lifecycle. Connector (blueprint), ConnectorInstance
  (deployed configuration, operatesIn -> ogit:DataScope),
  ConnectorRun (immutable-after-start, with ended_at as the single
  allowed post-create mutation per PLAN D28), ConnectorRunConfigSnapshot
  (run-invariant rule set).
• Provenance / conflict / identity. Authority (8-field provenance
  tuple, D24), Conflict, IdentityCandidate/IdentityCandidateOption,
  MergeJob, SplitJob, ConflictScoreModel (service-managed scoring,
  D23), Adjudicator.
• Action concept (D29-D36). ActionPolicy, ActionInvocation.
• PII vs Audit split. Decisions/PII/ holds the seven
  right-to-erasure target entities; Decisions/Audit/ holds the three
  audit-forever entities (ActionInvocation, SchemaDriftCandidate,
  ValueDriftCandidate). The split keeps GDPR Art. 17 erasure targets
  disjoint from audit-forever records.

Notable design points

• Polymorphic initiatedBy split into initiatedByActor +
  initiatedByRun (concrete edge targets; the validator rejects
  ogit:Entity as an edge target).
• ConflictLock carries a [DEPRECATED-ON-F9-LANDING] note -- it is a
  Phase-B-only construct, superseded once platform-level optimistic
  concurrency control lands.
• credentials_ref regex restricted to vault / aws-sm / gcp-sm /
  azure-kv / k8s-secret schemes; HTTP(S) is rejected.
• Seven machine-greppable framework-boundary marker prefixes in
  attribute descriptions: [PII-CONDITIONAL],
  [PII-PSEUDONYMISED-REQUIRED], [PII-BEARING], [PII-RESTRICTED],
  [PII-FORBIDDEN], [NULLED-ON-TERMINAL-STATE], [OPERATOR-IAM-REF],
  [SECRET-REF], [DENORMALISED-CACHE], plus transient
  [LEGAL-REVIEW-PENDING] and [RBAC-ENFORCEMENT-PENDING-KC-PR].

OGIT-convention compliance

• dcterms:creator "Almato AG" on every one of the 253 TTL files
  (post arago-Almato merger discipline; no individual creator strings).
• Closed-enum and bool attributes carry ogit:validation-type "fixed"
  • ogit:validation-parameter "<csv>" (35 fixed attributes, all with
    a parameter; open-range attributes intentionally omit it).
• READMEs follow the NTO/Auth convention: one at the NTO root and one
  per named sub-group, none in the attributes/entities/verbs leaf
  directories.

Validation

Local validation (the Java validator has a known Windows path bug;
rdflib-parse + a cross-reference check is the established local
alternative per the project QS checklist):

• rdflib parse: 253 TTL files, 2487 triples, 0 parse failures.
• Cross-reference check: 27 entities, 187 attributes, 39 verbs;
  0 orphan attribute files, 0 orphan verb files, 0 missing
  Integration: targets, 0 unknown ogit: refs.

The authoritative OGIT validator (bin/ogit-validator.jar) runs at
PR-merge-time CI; it can be run pre-merge under Docker
(eclipse-temurin:11-jre) per the directory-mode-not-recursive
discipline (enumerate every .ttl, do not pass the directory).

QS history

Six formal QS rounds plus a three-turn Opus-4.6 Dialog-QS. The Dialog-QS
converged on Turn 3 to 4/4/4/4 across Konsistenz / Funktionalitaet /
Sicherheit / Toter Code, which meets the two-model gate criterion.

One structural limitation is documented rather than schema-fixed: OGIT
today has no sensitivity vocabulary (ogit:sensitive,
ogit:pii-bearing, ogit:access-classification). Every PII / RBAC
contract in this PR is therefore framework-boundary-enforced, expressed
via the marker prefixes above and the "Framework-boundary contracts"
block (companion concept doc Section 6.2) with a residual-risk
acknowledgment. Moving these contracts from framework-boundary
enforcement to schema enforcement requires a separate OGIT
vocabulary-extension PR (listed under Follow-ups).

Follow-ups (not in this PR)

• OGIT sensitivity-vocabulary extension -- would let the PII/RBAC
  contracts be schema-enforced instead of framework-boundary-enforced.
• Knowledge Core RBAC PR for field-level RBAC on [PII-RESTRICTED]
  attributes (subject_identifier). Opens after this PR merges;
  production use of SubjectRequest is blocked until it lands.
• DPO + legal sign-off on the assigned_reviewer_id classification
  (currently [LEGAL-REVIEW-PENDING]).

Test plan

• bin/ogit-validator.jar over the full NTO/Integration/ tree
  (enumerated file list, not directory mode) -- expected 0 errors.
• singleTTL bundle build includes the new NTO/Integration/
  classes cleanly.
• PURL ID registration for the NTO/Integration/ namespace.
• Reviewer quorum sign-off: BOO (Chris Boos), VOS (Viktor Voss),
  BAR (Cy / Jens Bartsch); extended round: Andi, Pedro,
  OGIT maintainers.

Companion documents

Concept and architecture specification (Almato-internal, not part of
this PR): Bardioc Connector Framework 2.0 Overview, Multi-Source
Identity v2, Netting, Mapping DSL, OGIT Extensions (11_ogit_extensions.md,
document changelog v1.0 -> v1.3).