Federation Phase 1: registry engine + lokf registry CLI

[nicholsn]

Second slice of meta-lokf (builds on #22, SPEC §11). The offline engine that resolves a cross-bundle IRI to its owning bundle — no central database, no network.

What ships

lokf.registry

• Registry / RepoEntry / Resolution; load_registry() parses lokf-registry.yaml with plain YAML (no LinkML on the read path).
• owner(iri) — longest-base_iri-prefix routing, the exact inverse of Bundle.iri() minting, with an explicit-id exact-match fallback (prefix always wins). resolve() returns owner + Concept ID + source URL as pure offline string math.
• add() guards — base_iri must end in a separator (/ or #), may not capture the vocabulary namespace, and may not duplicate or nest another member.
• entry_for_bundle() — derives base_iri/title from a local bundle, computes a VoID index (triple + per-type counts) and an id_index of explicit ids that diverge from base_iri + Concept ID, and validates every concept IRI is routable.

lokf registry CLI — init, add, list, resolve, all offline:

$ lokf registry init -r lokf-registry.yaml
$ lokf registry add examples/acme-knowledge --source-base https://…/main
registered https://acme.example/knowledge/ (86 triples) in lokf-registry.yaml
$ lokf registry resolve https://acme.example/knowledge/tables/user-events
  owner:      https://acme.example/knowledge/ (Acme Knowledge Bundle)
  concept_id: tables/user-events
  source_url: https://…/main/tables/user-events.md
  via:        prefix

Hardened by an adversarial review pass

Ran a multi-agent review over the diff; every CONFIRMED finding is fixed and regression-tested:

• null/hand-edited manifest (id_index:/void:/repos: left null) no longer crashes lookups;
• unanchored prefix match no longer mis-routes/false-rejects siblings (…/team/ vs …/team-archive/) — enforced separator boundary;
• id_index is a true fallback (a stale entry can't hijack a more-specific prefix owner);
• vocabulary namespace protected against ancestor registration, not just exact match;
• resolving a bare base_iri no longer emits a bogus …/.md URL;
• entry_for_bundle trimmed of unused params (YAGNI); _entry_dict is default-aware.

Verification

• 156 tests pass (21 in test_registry.py, incl. the review regressions).
• End-to-end init → add → list → resolve verified against the acme example; docs site builds and documents lokf.registry in the API reference.

Next

Phase 2 (fetch.py + read_document offline degrade chain) reads the source docs a resolution points at.