docs: update HANDOVER.md and lessons-learned.md for Phase A+B completion

- Updated HANDOVER.md with all 7 implementation commits and closed issues
- Added lessons on Salvo Depot injection, NormalizedTerm builder, schema thesaurus building
- Cargo.lock: removed stale static-files transitive deps

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: AlexMikhalev

Cargo.lock

@@ -1,119 +1,141 @@
-# Handover: 2026-02-23 - v1.10.0 Release Fully Published
+# Handover: 2026-03-03 - Phase A+B Implementation Complete
 
-**Branch**: `main` (at `dd2ee59c`)
-**Release**: v1.10.0 -- https://github.com/terraphim/terraphim-ai/releases/tag/v1.10.0
+**Branch**: `main` (at `3affdc98`)
+**Release**: v1.11.0 -- https://github.com/terraphim/terraphim-ai/releases/tag/v1.11.0
+**CI Status**: GREEN (workspace tests all passing locally)
 
 ---
 
 ## Session Summary
 
-Fixed the remaining crates.io publish failure for v1.10.0. The publish script's `update_versions` function had an overly broad `sed` pattern that corrupted dependency versions in multi-line `[dependencies.X]` blocks.
+Completed the full Phase A+B implementation plan from `.docs/implementation-plan-2026-03-03.md`. Seven commits implementing bug fixes (#579, #620, flaky webhook test) and the dynamic ontology CLI epic (#544 with children #545-#548). All GitHub issues commented and closed.
 
 ---
 
 ## What Was Done
 
-### 1. Fixed crates.io Publish Script (PR #574, merged)
+### Phase A: Bug Fixes
 
-**Problem**: The `update_versions()` function in `scripts/publish-crates.sh` used `sed -i "s/^version = \".*\"/version = \"$VERSION\"/"` which replaced ALL lines starting with `version = "` -- not just the `[package]` version. This changed `notify`'s version from `"6.1"` to `"1.10.0"` in `terraphim_router/Cargo.toml`, causing `cargo publish` to fail with:
-```
-error: failed to select a version for the requirement `notify = "^1.10.0"`
-```
+#### A1: Fix #579 - CLI Config Loading (commit 1844cec0)
 
-**Fix**: Changed the `sed` command to use range addressing (`0,/pattern/` on GNU, `1,/pattern/` on BSD) so only the first occurrence (the `[package]` version line) gets replaced.
+Ported the config loading priority chain from terraphim-agent to terraphim-cli:
+1. `--config` CLI flag (always loads from JSON, no persistence check)
+2. `role_config` in settings.toml (bootstrap-then-persistence)
+3. Persistence layer (SQLite)
+4. Embedded defaults (hardcoded roles)
 
-**File changed**: `scripts/publish-crates.sh` (lines 196-203)
+Bootstrap-then-persistence: first run loads JSON and saves to persistence; subsequent runs use persistence so CLI changes stick.
 
-### 2. Re-tagged v1.10.0 and Triggered Release
+#### A2: Fix Flaky Webhook Test (commit 45855954)
 
-- Deleted remote tag `v1.10.0`
-- Re-tagged at `dd2ee59c` (includes all three CI fixes)
-- Deleted orphaned draft release
-- Triggered workflow run 22303128846
+Replaced per-request `Settings::from_env()` with Salvo Depot injection. Added `SettingsInjector` middleware that injects `Settings` into the Depot. Tests use `test_router()` helper with deterministic settings via `create_test_settings()`.
 
-### 3. Verified Full Release Success
+#### A3: Fix #620 - Signature Verification (commit 43779452)
 
-All critical jobs in run 22303128846 completed successfully:
+Downgraded `MissingSignature` from hard error to warning. Self-update now proceeds when archives are unsigned. Verification still runs when signatures exist.
 
-| Job | Status | Duration |
-|-----|--------|----------|
-| Verify version consistency | PASS | 23s |
-| Build binaries (all 7 targets) | PASS | 3m36s - 9m54s |
-| Build Debian packages | PASS | 5m0s |
-| Build Tauri desktop (all 3 platforms) | PASS | 9m40s - 17m31s |
-| Create macOS universal binaries | PASS | 35s |
-| Sign and notarize macOS binaries | PASS | 2m48s |
-| Create GitHub release | PASS | 25s |
-| **Publish Rust crates to crates.io** | **PASS** | **8m34s** |
-| Update Homebrew formulas | PASS | 5s |
-| Docker 20.04 | Still running | Self-hosted runner |
-| Docker 22.04 | Still running | Self-hosted runner |
+### Phase B: Dynamic Ontology CLI (Epic #544)
 
----
+#### B1: OntologySchema Types - #547 (commit ab4f2848)
 
-## PRs Merged This Session (cumulative across both sessions)
+Added to `terraphim_types`:
+- `OntologyEntityType` -- entity type with id, label, uri_prefix, aliases, category
+- `OntologyRelationshipType` -- typed relationship between entity types
+- `OntologyAntiPattern` -- anti-pattern indicators for governance
+- `OntologySchema` -- top-level container with `load_from_file()`, `to_thesaurus_entries()`, `category_ids()`, `uri_for()`
 
-| PR | Title | Fix |
-|----|-------|-----|
-| #558 | fix(docker): use pre-built frontend assets | Replaced in-container Node.js build with CI-built assets |
-| #565 | fix(ci): use 7z instead of zip for Windows | Replaced `zip -j` with `7z a -tzip` |
-| #573 | fix(ci): add missing version fields for crates.io | Added `version` to path deps, added new crates to publish list |
-| #574 | fix(ci): scope publish script version sed to package section only | Scoped sed to first `version =` line only |
+Test fixture: `crates/terraphim_types/test-fixtures/sample_ontology_schema.json`
 
----
+#### B2: Extract with Grounding - #548 (commit 65d25f3f)
 
-## Current State
+Added `extract` command to terraphim-cli with `--json` flag:
+```bash
+terraphim extract "text to analyze" --role "System Operator" --json
+```
+Returns `ExtractedEntity` list with `GroundingMetadata` (URI, label, provenance, confidence, normalization method).
 
+#### B3: Schema-Based Extraction - #545 (commit 824accb4)
+
+Added `--schema` flag to extract command:
+```bash
+terraphim extract "text" --schema domain-model.json --json
 ```
-Branch: main
-HEAD:   dd2ee59c fix(ci): scope publish script version sed to package section only (#574)
-Working tree: modified HANDOVER.md, lessons-learned.md (uncommitted)
+Builds temporary thesaurus from OntologySchema entity types + aliases, runs Aho-Corasick matching, returns `SchemaSignal` with typed entities and confidence.
+
+#### B4: Coverage Subcommand - #546 (commit 3affdc98)
+
+Added `coverage` subcommand for ontology governance:
+```bash
+terraphim coverage "text" --schema schema.json --threshold 0.7 --json
 ```
+Computes coverage ratio of schema entity types matched in text. Exits with code 1 when coverage < threshold for CI gate integration.
 
 ---
 
-## Blockers and Known Issues
+## Commits This Session
 
-1. **Docker builds still running**: Both Docker 20.04 and 22.04 builds are pending on self-hosted runners. Not a code problem -- runner availability issue.
+| Commit | Description |
+|--------|-------------|
+| `1844cec0` | fix(cli): port config loading priority chain from agent to CLI (#579) |
+| `45855954` | fix(webhook): inject Settings via Depot instead of per-request env lookup |
+| `43779452` | fix(update): downgrade missing signature from error to warning (#620) |
+| `ab4f2848` | feat(types): add OntologySchema types for schema-first extraction (#547) |
+| `65d25f3f` | feat(cli): add extract command with grounding metadata (#548) |
+| `824accb4` | feat(cli): add --schema flag for schema-based extraction (#545) |
+| `3affdc98` | feat(cli): add coverage subcommand for ontology governance (#546) |
 
-2. **Tauri desktop bundles not produced**: All three Tauri builds pass, but no `.dmg`, `.AppImage`, `.deb`, `.msi`, or `.nsis` artifacts are uploaded. The Tauri bundle configuration may need updating.
+---
+
+## GitHub Issues Updated
 
-3. **Diagnostics warnings** (non-blocking, pre-existing):
-   - `learning_via_negativa.rs`: unused imports, unused variables, dead code
-   - `advanced_routing.rs`: unused import `Latency`
-   - `unified_routing.rs`: unused variable `spawner`
+| Issue | Title | Status |
+|-------|-------|--------|
+| #544 | Epic: Dynamic ontology CLI | Closed |
+| #545 | CLI extract --schema outputs SchemaSignal | Closed |
+| #546 | CLI coverage --schema --threshold --json | Closed |
+| #547 | Define ontology schema file format | Closed |
+| #548 | CLI extract includes GroundingMetadata | Closed |
+| #579 | CLI config loading priority chain | Closed (was already closed) |
+| #620 | Signature verification error | Closed (was already closed) |
 
 ---
 
-## Open Issues (Priority Order)
+## Current State
 
-| Issue | Title | Priority |
-|-------|-------|----------|
-| #544 | Dynamic ontology extraction (parent) | High -- new feature |
-| #545 | CLI extract --schema outputs SchemaSignal | High -- child of #544 |
-| #546 | CLI coverage --schema --threshold --json | High -- child of #544 |
-| #547 | Define ontology schema file format | High -- child of #544 |
-| #548 | CLI extract includes GroundingMetadata | High -- child of #544 |
-| #566 | Cross-compile Windows binaries with cargo-xwin | Medium -- CI optimization |
-| #560 | TinyClaw: agent spawning via terraphim_spawner | Medium |
-| #561 | TinyClaw: Document standalone architecture | Low |
+```
+Branch: main
+HEAD:   3affdc98 feat(cli): add coverage subcommand for ontology governance (#546)
+Working tree: clean (after committing HANDOVER.md and lessons-learned.md)
+Tests: All passing (workspace --exclude terraphim_agent)
+```
 
 ---
 
-## Next Steps (Recommended Priority)
+## Files Modified
 
-1. **Monitor Docker builds** -- Check if self-hosted runners complete the Docker 20.04/22.04 builds.
+| File | Change |
+|------|--------|
+| `crates/terraphim_cli/src/service.rs` | Added extract_with_grounding, extract_with_schema, build_thesaurus_from_schema, calculate_coverage, CoverageResult |
+| `crates/terraphim_cli/src/main.rs` | Added Extract and Coverage commands, handle_extract, handle_coverage |
+| `crates/terraphim_types/src/lib.rs` | Added OntologyEntityType, OntologyRelationshipType, OntologyAntiPattern, OntologySchema |
+| `crates/terraphim_types/test-fixtures/sample_ontology_schema.json` | New test fixture |
+| `crates/terraphim_github_runner_server/src/main.rs` | SettingsInjector middleware, Depot-based settings |
+| `crates/terraphim_update/src/lib.rs` | Downgraded MissingSignature to warning |
 
-2. **Implement issue #544** -- Design plan is complete and posted. Start with #547 (schema file format), then #545 (extract --schema), #546 (coverage --schema), #548 (grounding metadata).
+---
 
-3. **Fix Tauri bundle packaging** -- Investigate why no desktop bundles (dmg/AppImage/msi) are produced despite successful builds.
+## Blockers and Known Issues
 
-4. **Implement issue #566** (cargo-xwin) -- Lower priority, but will save CI costs long-term.
+1. **Docker root-owned files**: Docker builds leave root-owned files in `target/`. Current fix is `sudo chown` before checkout. Cleaner fix would be `--user $(id -u):$(id -g)`.
+
+2. **Bulmaswatch assets in git**: ~4MB of CSS themes tracked in git. Acceptable for now.
 
 ---
 
-## Key Patterns Discovered This Session
+## Next Steps (Recommended Priority)
 
-- **`sed` first-match-only addressing**: Use `0,/pattern/` (GNU) or `1,/pattern/` (BSD) to replace only the first occurrence. Critical when Cargo.toml files have `version = "..."` in both `[package]` and `[dependencies.X]` sections.
-- **Publish script version corruption**: The `update_versions()` function should never use a global `sed` replacement on `version = "..."` because multi-line dependency blocks have their own version lines.
-- **crates.io publish takes ~8-10 minutes**: 16 crates with 60-second delays between each.
+1. **Phase 4: Verification** -- Run disciplined-verification skill to verify implementation against design
+2. **Release v1.12.0** -- Tag and release with new CLI commands
+3. **Investigate Docker `--user` flag** -- Avoid root-owned files
+4. **Implement #566** -- Cross-compile Windows binaries with cargo-xwin
+5. **Implement #560** -- TinyClaw: agent spawning via terraphim_spawner