Fixes 36182: Validate captured native ontology releases

.github/java-tests/impact-map.json

@@ -1,4 +1,4 @@
 {
   "version": 2,
   "prHeading": "#### Backend integration tests",
   "maven": {
@@ -712,7 +712,9 @@
         "openmetadata-service/src/main/resources/json/data/ontology/**",
         "openmetadata-spec/src/main/resources/json/schema/api/data/*Ontology*",
         "openmetadata-spec/src/main/resources/json/schema/api/data/ontology*",
-        "openmetadata-integration-tests/src/test/java/org/openmetadata/it/tests/Ontology*IT.java"
+        "openmetadata-integration-tests/src/test/java/org/openmetadata/it/tests/Ontology*IT.java",
+        "openmetadata-integration-tests/src/test/java/org/openmetadata/it/tests/IndependentOntologyReleaseValidationIT.java",
+        "openmetadata-service/src/test/java/org/openmetadata/service/ontology/OntologyReleaseValidationTest.java"
       ],
       "tests": [
         "*Ontology*IT",
@@ -732,7 +734,11 @@
         "openmetadata-spec/src/main/resources/json/schema/api/rdf/**",
         "openmetadata-spec/src/main/resources/json/schema/api/data/rdf*",
         "openmetadata-spec/src/main/resources/rdf/**",
-        "openmetadata-integration-tests/src/test/java/org/openmetadata/it/tests/Rdf*IT.java"
+        "openmetadata-integration-tests/src/test/java/org/openmetadata/it/tests/Rdf*IT.java",
+        "openmetadata-service/src/test/java/org/openmetadata/service/rdf/RdfShaclReportMapperTest.java",
+        "openmetadata-service/src/test/java/org/openmetadata/service/rdf/NativeOntologyShapesTest.java",
+        "openmetadata-service/src/test/java/org/openmetadata/service/rdf/OntologyReleaseProjectionTest.java",
+        "openmetadata-service/src/test/resources/rdf/shapes/malformed-native-test.ttl"
       ],
       "tests": [
         "*Rdf*IT",

docs/decisions/2026-10-23-native-ontology-release-validation-binds-captured-targets.md

@@ -0,0 +1,23 @@
+# Native release validation binds SHACL targets to captured definitions
+
+- **Status:** Accepted
+- **Revisions:** v1 2026-10-23 (initial)
+- **Deciders:** Harsha
+- **Guard:** `NativeOntologyShapesTest`, `OntologyReleaseProjectionTest`, `OntologyReleaseValidationTest`, `IndependentOntologyReleaseValidationIT`
+- **Related:** ADR:2026-10-14-ontology-definitions-have-independent-entity-storage
+
+## Context
+
+The release RDF projection declares referenced classes and properties, including IRIs from other ontologies. Raw SHACL shapes target every `owl:Class` or `owl:DatatypeProperty` declaration. Applying those targets unchanged to a captured release would report missing labels on referenced classes that the release does not own.
+
+## Decision
+
+The raw native shapes keep standard `sh:targetClass` declarations. A release validation request copies the shapes graph and replaces those targets with the captured OWL class and DATA property IRIs. The request does not change shared shapes or the export projection.
+
+`GET /api/v1/ontologyReleases/{id}/validation` combines structure findings, native SHACL findings, and current authorized impact for definitions newly deprecated against the literal captured base. It reports `logicalCheck: NOT_RUN`. Warnings do not make the report invalid.
+
+The server verifies and authorizes both complete release manifests on every call. It caches only serialized structure and native findings by verified content digest, with at most 256 entries and 131,072 UTF-16 code units per entry. Release IDs are restored on detached structure reports. Base comparison, captured direct dependencies, and current visible bindings are resolved on every call. Missing current concepts or ontologies retain the binding resolver's 404; authorization failures retain 403.
+
+## Consequences
+
+A historical validation read can return 404 after a newly deprecated current concept is deleted. The report does not turn that missing impact into an empty binding list. Cache hits still read and authorize the manifests, so the cache does not bypass access changes. The impact reads every page of visible bindings, following each `after` cursor until it is null, before it sets `boundAssetCount`.

docs/generated/api-reference.md

@@ -1,4 +1,4 @@
 <!-- GENERATED FILE — DO NOT EDIT. Run `make generate-api-reference`. -->
 
 # API Reference (endpoint index)
 
@@ -13,7 +13,7 @@
 - Source is the annotations, **not** `openapi.yml` (a config stub with no endpoints; the
   full spec is assembled at runtime by Dropwizard).
 
-**1989 endpoints** across 75 resource packages · 1979 carry a summary.
+**1990 endpoints** across 75 resource packages · 1980 carry a summary.
 
 ## (root)
 
@@ -1452,6 +1452,7 @@
 | `GET` | `/v1/ontologyReleases/{id}/members/{kind}/{memberId}` | Read an immutable release member |
 | `GET` | `/v1/ontologyReleases/{id}/review` | Read this release's review as the calling user sees it |
 | `GET` | `/v1/ontologyReleases/{id}/structure` | Check property declarations and axiom structure in a sealed release |
+| `GET` | `/v1/ontologyReleases/{id}/validation` | Validate a sealed ontology release |
 | `GET` | `/v1/ontologyReleases/{id}/versions/{version}` | Read the release header version submitted to an approval workflow |
 | `GET` | `/v1/relationshipTypes` | List relationship types |
 | `POST` | `/v1/relationshipTypes` | Create a relationship type |