Client-orchestrated graph writes; inference-free ontology serving

[namedgraph]

Summary

Moves the Add data and Generate containers orchestration to the client over the uniform Graph Store Protocol, and reworks application-ontology serving to be inference-free. Together this removes the server-side fetch/SSRF surface (pen-test LNK-002) and stops inferred rdf:type rdfs:Resource from leaking into proxied namespace documents.

Changes

Client-orchestrated writes (BREAKING — replaces /add and /generate)

• Add data: the submit handler splits on the presence of a spin:query input. The add/clone variant fetches dct:source through the same-origin ?uri= proxy as RDF/XML (CORS + Jena format conversion) and POST-appends it to the sd:name target. The import-ontology variant is unchanged and still RDF/POSTs to /transform.
• Generate containers: builds one container document per checked class and PUTs them via parallel ixsl:all fan-out, seeded by ixsl:resolve so requests run in an active promise context. The view block is now correctly wrapped as ldh:Object → rdf:value → ldh:View (the endpoint's bare ldh:View bypassed ldh:InvalidContentBlockType validation).
• Deletes Add.java, Generate.java and their Dispatcher locators. /transform is retained until a client-side SPARQL engine lands.

Dialog fixes

• Add data: seed the target-graph typeahead from the local browser location (ac:absolute-path(ldh:request-uri())) instead of ldh:base-uri(.), which resolved to the proxied remote when viewing one and defaulted the write target to that remote (403). Cross-origin targets now render an inline error instead of proxying the write.
• Generate containers: initialise the parent typeahead with the current container, disable Generate until the schema loads, and make schema loading fully async (replacing a blocking document() fetch with an ixsl:resolve promise chain).

Inference-free ontology serving

• Application ontologies are resolved as a native ontapi owl:imports union graph (cached per ontology URI on Application) instead of a manually flattened, RDFS-materialized model. Every consumer traverses hierarchies explicitly via (rdfs:subClassOf)*.
• The shared repository now only holds raw per-document graphs, which ProxyRequestFilter serves directly — asserted triples only, identical to a direct document GET. This fixes inferred rdf:type rdfs:Resource leaking into proxied namespace documents (multi-token @typeof that silently degraded View blocks).
• Namespace no-query GET serves the raw ontology graph from the shared repository instead of rebuilding a repository per request.
• View term labels (order-by, facet headers, parallax, rdf:type facet values) now resolve via the app's /ns SPARQL endpoint instead of proxying each term's vocabulary document (Resolve view term labels from /ns instead of the Linked Data proxy #340).

Tests

• Drops the obsolete /add and /generate HTTP tests; adds add/GET-proxied-source-POST-append.sh, add/PUT-generate-container.sh, proxy/GET-proxied-mapped-vocab.sh, and sparql-protocol/query/GET-ns-no-query.sh.
• Adds OntologyClosureCIReproTest and extends OntologyImportsCharacterizationTest.

See CHANGELOG.md for the user-facing summary.

🤖 Generated with Claude Code