docs(plan): re-sequence v0.2+ streams — defer consumer integration, add OKF inbox showcase as next build

Ground-truth pass over the named flagship consumer (portfolio-optimiser's
'OKF-upload-inbox') found it does not exist as a seam: both optimiser siblings
are frozen at release, carry their own OKF layer, receive no external bundles,
and take no dependency on this guard. Defer consumer integration (stream 2)
until the guard is mature; mature it here first, Node-port-friendly. Next
concrete build is the in-repo OKF inbox showcase (mode-b import_bundle as a
receive/quarantine gate), spec'd under 'The OKF inbox showcase'.

docs/PLAN.md

@@ -172,36 +172,82 @@ evasion (2504.11168), EchoLeak (CVE-2025-32711), RAGShield (2604.00387), CaMeL
 (2503.18813), Dual-LLM (Willison), and the litellm supply-chain compromise (corroborates
 the minimal-dependency thesis).
 
-## v0.2+ stream sequencing (post-v0.1.0, decided 2026-07-06)
+## v0.2+ stream sequencing (revised 2026-07-06)
 
-v0.1.0 is tagged — the format-agnostic text core (modules 1–11, hardened at
+v0.1.0 and v0.2.0 are tagged: the format-agnostic text core (modules 1–11,
-`5397ba1`, released at `df30c7b`). Three forward streams, **all to be built**;
+`5397ba1` / released `df30c7b`) and the OKF adapter (stream 1, released
-the order is dependency-driven, not preference:
+`542ac92`). The forward order was **re-sequenced on 2026-07-06** after a
+ground-truth pass over the intended flagship consumer.
 
-1. **OKF v0.2 hardening** — the OKF adapter + the 8 tasks in
+**Finding that drove the change.** The named flagship — `portfolio-optimiser`'s
-   `docs/OKF-INGESTION-BRIEF.md` §8 (internal order T8 → T1–T4+T6 → T7 → T5).
+"OKF-upload-inbox" — does not exist as a seam. Both optimiser siblings are frozen
-2. **Wire consumers** — `claude-code-llm-wiki`, `ms-ai-architect`,
+at their release milestone, carry their *own* OKF layer (navigate + materialize
-   `portfolio-optimiser` (its OKF-upload-inbox is the flagship).
+from trusted manifests), receive no *external* bundles, and take no dependency on
-3. **Node/polyglot port** — one polyglot repo over the shared JSON lexicon
+this guard; the operator's own registered future work for them does not include
-   (BRIEF §13.5/§8); driver = `ms-ai-architect` convergence.
+it. Wiring an immature guard into two mature, spec-frozen repos would complicate
+them for a consumer that is not asking for it. **Consumer integration is therefore
+deferred until the guard is mature**; consumers are informed at the operator's
+timing, not pushed.
 
-**Why this order (dependencies, not taste):**
+Revised streams:
 
-- The flagship consumer (`portfolio-optimiser`'s OKF-upload-inbox) *is* an OKF
+1. **OKF v0.2 hardening** — shipped (adapter + brief §8 tasks; T5b/B deferred to a
-  surface. Wiring it before OKF hardening ships a knowingly-incomplete guard
+   consumer that owns corpus storage).
-  into the exact case that needs it → **stream 2 depends on stream 1**.
+2. **Mature the guard here, keeping it Node-port-friendly** — the near-term work.
-- The Node port must port a *settled* public surface. OKF v0.2 adds the
+   The lexicon is already shared JSON (polyglot-ready); keep the `text -> findings`
-  OKF-adapter surface; porting before it = porting a moving target and exactly
+   surface clean and free of Python-only cleverness in the OKF layer, so stream 3
-  the §13.3 split-drift the polyglot rule exists to forbid → **stream 3 after 1**.
+   is a *translation*, not a redesign. The centrepiece is the **OKF inbox
-- Within stream 1: **T8** (residual-risk docs, brief §7.2/§7.4) is the cheap,
+   showcase** (below): the guard demonstrating its own flagship use case
-  decision-free first step — it lands independently and makes the live README
+   end-to-end, in-repo.
-  honest about uncovered OKF surfaces before anything else is built. **T3/T4/T5
+3. **Node/polyglot port** — the strategic enabler of painless integration (many
-  are blocked on an OKF-spec confirmation pass** (brief §9 "operator premise":
+   OKF consumers are Node/JS; the lexicon seed was `.mjs`). One polyglot repo over
-  concept-ID=path-minus-`.md`, reserved `index.md`/`log.md`, the `resource`
+   the shared JSON lexicon; never split §13.3. Its API/lexicon contract should be
-  field, `description`→`index.md` were taken from the brief, not checked against
+   **scan-informed** (stream 4), not guessed.
-  `SPEC.md`).
+4. **Pre-adaptation scan (operator-timed)** — at the operator's chosen point, scan
+   every repo and plugin that uses or plans Google OKF, then adapt the guard's
+   surface in advance so a later integration is painless. The scan is the input to
+   the "painless" guarantee: it grounds both the Node port's contract and any
+   consumer-specific seams before they are locked.
+
+### The OKF inbox showcase (next concrete build, TDD)
+
+The flagship artifact we hand a consumer later — an in-repo end-to-end
+demonstration of the mode-b receive/quarantine gate, mirroring
+`tests/test_showcase.py` but for a *received external OKF bundle*. It composes the
+public `okf` surface exactly as an "upload inbox" consumer would, so it doubles as
+the README's OKF worked example. Every test is authored by us — the point is to
+prove intent, not to coincidentally pass.
+
+- **Composition** (`tests/test_okf_showcase.py`): an `_inbox(bundle)` helper
+  calling `okf.import_bundle(bundle, origin=Origin.EXTERNAL, channel=Channel.AUTOMATIC)`
+  and mapping the aggregate disposition — `WARN` → ADMIT, `QUARANTINE_REVIEW` →
+  HOLD, `FAIL_SECURE` → REJECT, any error → REJECT (fail-secure default).
+- **One poisoned bundle** planting one attack per OKF surface at once, each with a
+  label proving it was caught/rejected:
+  - body injection (T1 scan) and frontmatter `description` injection (T1
+    whole-concept scan);
+  - a non-`https` `resource:` URL (T3 → FAIL_SECURE);
+  - a path-traversal concept key `../x.md` (T4 → FAIL_SECURE) and a reserved-name
+    shadow `index.md` / `log.md` (T4);
+  - a dangerous frontmatter value (anchor / alias / explicit tag, T2 → FAIL_SECURE);
+  - a dangerous-scheme cross-link `[x](javascript:…)` (T5a → `links.rejected`);
+  - a dangling cross-link to an absent concept (§7.2 dormant signal →
+    `links.dangling`);
+  - a carrier/obfuscation-hidden body injection (zero-width / homoglyph / rot13 /
+    whole-string base64) routed through `scan_concept`.
+- **Assertions:** aggregate disposition is FAIL_SECURE; every planted OKF
+  vulnerability appears in the per-concept rejects / findings / link graph; a
+  **clean** bundle admits (WARN, no rejects, no dangling); `BundleResult.log()`
+  renders one line per concept with rejects marked. **Detach-proof:** neutering
+  `import_bundle` to always-admit makes the poison assertions fail.
+- **Honest scope:** demonstrates the *structural + known-pattern* OKF surface only
+  — semantic/factual poisoning stays out (README honest-limits), consistent with
+  the core showcase.
+
+**Deferred, unchanged:** T5b/B (the persisted cross-run link graph) waits for a
+consumer that owns corpus storage; §7.2 dormant cross-run links remain a
+documented residual until then.
 
 **Splittable early win (optional):** text-only consumers can be wired at v0.1.0
-today — for them the guard is already complete. Folded behind stream 1 by
+today — for them the guard is already complete. Deferred with stream 2 by default;
-default (editing other repos = context switch + weaker feedback than the
+pull forward only on explicit request.
-flagship). Pull forward only on explicit request.