@astrale-os/kernel-core 0.9.0-beta.20 → 0.9.0-beta.23

package/CHANGELOG.md

@@ -6,6 +6,112 @@
 
 * remove endpoint, route, serving issuer, Publication ETag, and View placement properties from the
   Function and UI schema; graph projection now contains declaration meaning only
+## [0.9.0-beta.23](https://github.com/astrale-os/kernel/compare/kernel-core-v0.9.0-beta.22...kernel-core-v0.9.0-beta.23) (2026-08-29)
+
+
+### Features
+
+* **api:** carry view iframe requirements ([#531](https://github.com/astrale-os/kernel/issues/531)) ([4eedb0b](https://github.com/astrale-os/kernel/commit/4eedb0b3430f5f642942e913cf1c5806e09b7cf1))
+
+## [0.9.0-beta.22](https://github.com/astrale-os/kernel/compare/kernel-core-v0.9.0-beta.21...kernel-core-v0.9.0-beta.22) (2026-08-29)
+
+
+### ⚠ BREAKING CHANGES
+
+* View declarations now contain only target and optional description. Legacy View.auth fields are rejected; callable authorization, View.resolve admission, Policies, and Shell handshakes remain independent.
+* **dsl:** make edge direction explicit
+
+### Features
+
+* add aliased domain dependency projection ([afb799b](https://github.com/astrale-os/kernel/commit/afb799b0d61fd6f7436fe659f558a6a62ef1e7a1))
+* add aliased Domain dependency projection ([9c4c4fb](https://github.com/astrale-os/kernel/commit/9c4c4fb4f942c0c5e3961faf4428ed299d42f847))
+* add compiled remote domain serving ([ac9e365](https://github.com/astrale-os/kernel/commit/ac9e36538982a91359712e4cbbc68353ea2cc1a2))
+* add compiled remote Domain serving ([6149628](https://github.com/astrale-os/kernel/commit/6149628820d1294981156ff5b50ceaa522ea0403))
+* add source-qualified Invocation identity ([#331](https://github.com/astrale-os/kernel/issues/331)) ([ac87f3c](https://github.com/astrale-os/kernel/commit/ac87f3c67907290f43b21ca1efe2c3b51541c73d))
+* **callable:** preserve native binary streams and status ([d14c6f1](https://github.com/astrale-os/kernel/commit/d14c6f13492c14a3363b2c4af59c738034752fa2))
+* **core:** refine class and binding authoring ([0c9349d](https://github.com/astrale-os/kernel/commit/0c9349dcad4bb8519736e21242a6dee54bfa1c40))
+* **core:** refine class and binding authoring ([b4b0f2e](https://github.com/astrale-os/kernel/commit/b4b0f2ea6af67752309ee4f9570af8c3b508860a))
+* **core:** support identities without authentication ([#490](https://github.com/astrale-os/kernel/issues/490)) ([b22f726](https://github.com/astrale-os/kernel/commit/b22f7261342cbe071d0c8f35710f6db7a83e12fa))
+* **dsl:** authorize Edge value reads with policies ([#502](https://github.com/astrale-os/kernel/issues/502)) ([a27e129](https://github.com/astrale-os/kernel/commit/a27e129378ff64e69031a011cbfa21299998a35e))
+* **dsl:** make edge direction explicit ([3f05bf5](https://github.com/astrale-os/kernel/commit/3f05bf52ce5b20e9f549ec0fd98cb0e4e03de1ea))
+* **graph:** accept direct node targets in authoring facades ([d370356](https://github.com/astrale-os/kernel/commit/d370356fb441857681c531078d4888d853e1d5c7))
+* **graph:** accept direct node targets in authoring facades ([762e88d](https://github.com/astrale-os/kernel/commit/762e88db1509f8fd2b733b8c43a0ad692bb89ff6))
+* **operations:** scope schema replay by principal ([#330](https://github.com/astrale-os/kernel/issues/330)) ([b97bfd5](https://github.com/astrale-os/kernel/commit/b97bfd5a2101696121e1aef0ffe821ea0edb78e5))
+* remove Property visibility and cut DSL V2 ([#518](https://github.com/astrale-os/kernel/issues/518)) ([4d99e8f](https://github.com/astrale-os/kernel/commit/4d99e8f0837136cf6be257ab3a6df666b62e06b5))
+* remove View authentication declarations ([4a5bfe0](https://github.com/astrale-os/kernel/commit/4a5bfe016717267d31257748f95e7f646782f876))
+* **runtime:** support buffered and streaming binary ([fcd73f9](https://github.com/astrale-os/kernel/commit/fcd73f99c75963257b595449b1a0e0e4e234a05d))
+* **schema:** make atomic installs convergent ([ed198fb](https://github.com/astrale-os/kernel/commit/ed198fba6d8d9d4e0092cd1bc64f454b717851e5))
+* **schema:** split inspection and add convergence ([6afbd39](https://github.com/astrale-os/kernel/commit/6afbd39506b8a9e37225aded1c02f94ffa64e54b))
+* **schema:** split ready reads and make atomic installs convergent ([dd96d3e](https://github.com/astrale-os/kernel/commit/dd96d3ed13c374b0db19f7edbfeff1dc65ae03f9))
+
+
+### Bug Fixes
+
+* align the official kernel package cohort ([#371](https://github.com/astrale-os/kernel/issues/371)) ([30fda63](https://github.com/astrale-os/kernel/commit/30fda63157bbaf756af2d46efed4e2fc5bc17d4b))
+* **api:** retain visibility-free DSL as V1 ([#526](https://github.com/astrale-os/kernel/issues/526)) ([e24c1ea](https://github.com/astrale-os/kernel/commit/e24c1ea257e8567d9bd33c6ada0de63bb346a496))
+* **ci:** enforce the official Kernel cohort ([#469](https://github.com/astrale-os/kernel/issues/469)) ([f6ea87a](https://github.com/astrale-os/kernel/commit/f6ea87a47f7b1f9c415e404dc1a09b480a2a3f5f))
+* **core:** clarify Path anchor diagnostic ([#335](https://github.com/astrale-os/kernel/issues/335)) ([5c72368](https://github.com/astrale-os/kernel/commit/5c72368b95d1a734c9e2bbe991418e98772fe26f))
+* **core:** preserve callable identity and runtime boundaries ([#394](https://github.com/astrale-os/kernel/issues/394)) ([ad67dad](https://github.com/astrale-os/kernel/commit/ad67dad84aef3c8b79f769009595ea1f1229026b))
+* **core:** reject legacy definition query sources ([afd2067](https://github.com/astrale-os/kernel/commit/afd2067b02fdc21a2c414638ebf40e2f217b9f2b))
+* **deps:** refresh the Kernel dependency cohort ([#393](https://github.com/astrale-os/kernel/issues/393)) ([883e7bb](https://github.com/astrale-os/kernel/commit/883e7bb7ce17eecb7dad1c94ad2089c576ba3746))
+* **dsl:** close semantic qualification gaps ([4a48cd7](https://github.com/astrale-os/kernel/commit/4a48cd729bcaf839ceda880b26ade064d6505fe2))
+* **dsl:** keep schema projections declaration-nameable ([#432](https://github.com/astrale-os/kernel/issues/432)) ([448d23d](https://github.com/astrale-os/kernel/commit/448d23d58fc2b564ef93be4a54dc8ebd385b5066))
+* **dsl:** make schema declarations portable ([55e13c0](https://github.com/astrale-os/kernel/commit/55e13c06896eb5d6cf195607aec10f176b585504))
+* **dsl:** make schema declarations portable ([90c04ac](https://github.com/astrale-os/kernel/commit/90c04acfa5af714c70a92dc90999675d53f159bc))
+* **graph:** validate undirected endpoint pairs ([dc363db](https://github.com/astrale-os/kernel/commit/dc363db646e7e61d972e7747579e6e1ee7062cc8))
+* **packages:** keep workspace guard private ([e0ba76c](https://github.com/astrale-os/kernel/commit/e0ba76c5ae163245e31115e2a72e0663db0f5320))
+* **packages:** keep workspace guard private ([d260a52](https://github.com/astrale-os/kernel/commit/d260a52329cde5ce4b0260c43a3bbf28cb78f408))
+* **packages:** keep workspace guard private ([a3e82ec](https://github.com/astrale-os/kernel/commit/a3e82ec671f07252a5966b4de988e275e4078b8c))
+* publish a TypeScript-compatible cohort ([#406](https://github.com/astrale-os/kernel/issues/406)) ([f1a0cd0](https://github.com/astrale-os/kernel/commit/f1a0cd09f2f0b4498f9fa8924b2e319cac6552b7))
+* **release:** add package repository metadata ([8238077](https://github.com/astrale-os/kernel/commit/8238077d47a96c0f7b50a1bae8769fe4faab45b7))
+* **release:** align the published beta cohort ([8f2dc4a](https://github.com/astrale-os/kernel/commit/8f2dc4a7156aeee4dc9034624d2ffa2b3583d5b8))
+* **release:** publish exact Kernel cohort edges ([04629b8](https://github.com/astrale-os/kernel/commit/04629b89515aa665ede2f9fe058888bad45ab896))
+* **release:** publish exact Kernel cohort edges ([14f2c52](https://github.com/astrale-os/kernel/commit/14f2c52329874fdad43114a964521599c8313eab))
+* **runtime:** clarify Domain transition Foundation without narrowing behavior ([bce2184](https://github.com/astrale-os/kernel/commit/bce21848e645d2570cf056d56cc0d4489c656d14))
+* **runtime:** close domain transition foundation drift ([310f95f](https://github.com/astrale-os/kernel/commit/310f95fadfb1a85fb19ac52b69a58427d22a5788))
+* **runtime:** qualify local Domain production journey ([d35b1be](https://github.com/astrale-os/kernel/commit/d35b1be05b2463eb51a6d93f8ea1811fd489a7ab))
+* **runtime:** qualify local Domain production journey ([396351a](https://github.com/astrale-os/kernel/commit/396351ae2fcfe67ef49f624e4ef0214bad2448c3))
+* stabilize governed Kernel integration ([#347](https://github.com/astrale-os/kernel/issues/347)) ([6869e3f](https://github.com/astrale-os/kernel/commit/6869e3fc4de1e73ff701bb38383e89c934ddfdf2))
+* **system:** clear Codegraph diagnostic debt ([f7a8e1f](https://github.com/astrale-os/kernel/commit/f7a8e1f5c5694d9c3c45d95fde184f0d5f2c7343))
+* **system:** clear Codegraph diagnostic debt ([45f86a9](https://github.com/astrale-os/kernel/commit/45f86a9ce14a224efed0e07966a5df8d7a892078))
+
+
+### Performance Improvements
+
+* **operations:** release only the Host production closure ([3f9d61a](https://github.com/astrale-os/kernel/commit/3f9d61afe6b4f19f4dfd0bd5e454e38f951aaf2a))
+* **server:** cache successful CORS preflights ([#514](https://github.com/astrale-os/kernel/issues/514)) ([a9a3d7c](https://github.com/astrale-os/kernel/commit/a9a3d7ccb4c6e5ca763e5d0798a3c905f5936b28))
+
+
+### Documentation
+
+* **release:** align kernel beta changelogs ([ad59dbc](https://github.com/astrale-os/kernel/commit/ad59dbc8df458d8bd025692d594b0b4666cd2e1f))
+
+
+### Dependencies
+
+* The following workspace dependencies were updated
+  * dependencies
+    * @astrale-os/kernel-dsl bumped to 0.2.0-beta.17
+
+## [0.9.0-beta.21](https://github.com/astrale-os/kernel/compare/kernel-core-v0.9.0-beta.20...kernel-core-v0.9.0-beta.21) (2026-08-29)
+
+
+### Features
+
+* remove Property visibility and cut DSL V2 ([#518](https://github.com/astrale-os/kernel/issues/518)) ([4d99e8f](https://github.com/astrale-os/kernel/commit/4d99e8f0837136cf6be257ab3a6df666b62e06b5))
+
+
+### Bug Fixes
+
+* **api:** retain visibility-free DSL as V1 ([#526](https://github.com/astrale-os/kernel/issues/526)) ([e24c1ea](https://github.com/astrale-os/kernel/commit/e24c1ea257e8567d9bd33c6ada0de63bb346a496))
+
+
+### Dependencies
+
+* The following workspace dependencies were updated
+  * dependencies
+    * @astrale-os/kernel-dsl bumped to 0.2.0-beta.16
+
 ## [0.9.0-beta.20](https://github.com/astrale-os/kernel/compare/kernel-core-v0.9.0-beta.19...kernel-core-v0.9.0-beta.20) (2026-08-28)
 
 

package/dist/auth/authority/admission/admission.js

@@ -94,13 +94,6 @@ function admit(input, path, locals, subjectBound, depth) {
                 class: classRef(value.class, `${path}/class`),
                 evidence: evidence(value.evidence, `${path}/evidence`),
             };
-        case 'domain-control':
-            exact(value, ['identity', 'op', 'origin'], path);
-            return {
-                op: 'domain-control',
-                identity: term(value.identity, `${path}/identity`, locals, subjectBound),
-                origin: domainOrigin(value.origin, `${path}/origin`),
-            };
         default:
             invalid(`${path}/op`, 'Unsupported authority operation');
     }

package/dist/auth/authority/language/predicate.d.ts

@@ -1,7 +1,7 @@
 import type { ClassRef, CoreRef, Key } from '@astrale-os/kernel-dsl/v1/addressing';
 import type { NodeId } from '../../../graph/node/index.js';
 import type { Grant } from '../../grant/index.js';
-export declare const AUTHORITY_PREDICATE_VERSION: 5;
+export declare const AUTHORITY_PREDICATE_VERSION: 6;
 export type Operation = 'create' | 'read' | 'traverse' | 'update' | 'delete';
 export type Input = 'object' | 'source' | 'target';
 export type { ClassRef } from '@astrale-os/kernel-dsl/v1/addressing';
@@ -34,17 +34,13 @@ export interface LocalDeclaration {
     readonly id: number;
     readonly class: ClassRef;
 }
-export type Requirement = {
+export interface Requirement {
     readonly op: 'class-authority';
     readonly identity: Term;
     readonly operation: Operation;
     readonly class: ClassRef;
     readonly evidence: 'allowed' | 'owner';
-} | {
-    readonly op: 'domain-control';
-    readonly identity: Term;
-    readonly origin: Key.Origin;
-};
+}
 export type AuthorityExpr = {
     readonly op: 'true';
 } | {

package/dist/auth/authority/language/predicate.js

@@ -1 +1 @@
-export const AUTHORITY_PREDICATE_VERSION = 5;
+export const AUTHORITY_PREDICATE_VERSION = 6;

package/dist/auth/authority/normalization/normalize.js

@@ -71,12 +71,6 @@ function normalize(expr, path, locals, subjectBound) {
                 class: Object.freeze({ ...expr.class }),
                 evidence: expr.evidence,
             });
-        case 'domain-control':
-            return Object.freeze({
-                op: 'domain-control',
-                identity: normalizeTerm(expr.identity),
-                origin: expr.origin,
-            });
     }
 }
 function normalizeBoolean(op, input, path, locals, subjectBound) {

package/dist/schema/authority/governed-by.js

@@ -9,7 +9,7 @@ export const GovernedBy = edgeClass.directed({
     description: 'The protected projection of one Class read or traverse Policy assignment.',
     extends: [Edge],
     properties: {
-        operations: property({ enum: [['read'], ['traverse'], ['read', 'traverse']] }, { visibility: 'private' }),
+        operations: property({ enum: [['read'], ['traverse'], ['read', 'traverse']] }, {}),
     },
     constraints: { noSelf: true },
 });

package/dist/schema/callables/method-of.js

@@ -9,7 +9,7 @@ export const MethodOf = edgeClass.directed({
     description: 'A Function declaration belongs to one Class for dispatch.',
     extends: [Edge],
     properties: {
-        name: property({ type: 'string', minLength: 1 }, { visibility: 'private' }),
-        static: property({ type: 'boolean' }, { visibility: 'private' }),
+        name: property({ type: 'string', minLength: 1 }, {}),
+        static: property({ type: 'boolean' }, {}),
     },
 });

package/dist/schema/callables/view.d.ts

@@ -42,6 +42,10 @@ export declare const View: builder.NodeClass<{
                     };
                     href: string;
                     handshake: "none" | "shell";
+                    iframe?: {
+                        sandbox?: string[] | undefined;
+                        allow?: string[] | undefined;
+                    } | undefined;
                     issuer: string;
                     etag: string;
                     revision: string;
@@ -81,6 +85,10 @@ export declare const View: builder.NodeClass<{
                 };
                 href: string;
                 handshake: "none" | "shell";
+                iframe?: {
+                    sandbox?: string[] | undefined;
+                    allow?: string[] | undefined;
+                } | undefined;
                 issuer: string;
                 etag: string;
                 revision: string;

package/dist/schema/domain/domain.js

@@ -9,8 +9,8 @@ export const Domain = nodeClass({
             type: 'string',
             pattern: '[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+',
         },
-        dependencyContext: property({ type: 'array', items: { type: 'object' } }, { visibility: 'private', required: false }),
-        schema: property({ type: 'object' }, { visibility: 'private' }),
-        schemaRevision: property({ type: 'string', pattern: 'sha256:[0-9a-f]{64}' }, { visibility: 'private' }),
+        dependencyContext: property({ type: 'array', items: { type: 'object' } }, { required: false }),
+        schema: property({ type: 'object' }, {}),
+        schemaRevision: property({ type: 'string', pattern: 'sha256:[0-9a-f]{64}' }, {}),
     },
 });

package/dist/schema/domain/of-domain.js

@@ -9,6 +9,6 @@ export const OfDomain = edgeClass.directed({
     extends: [Edge],
     constraints: { noSelf: true },
     properties: {
-        member: property({ type: 'string', minLength: 3 }, { visibility: 'private' }),
+        member: property({ type: 'string', minLength: 3 }, {}),
     },
 });

package/dist/schema/identity/identity.js

@@ -9,10 +9,9 @@ export const Identity = nodeClass({
     properties: {
         iss: property({ type: 'string', minLength: 1 }, { required: false }),
         sub: property({ type: 'string', minLength: 1 }, { required: false }),
-        frozen: property({ type: 'boolean' }, { required: false, visibility: 'private' }),
+        frozen: property({ type: 'boolean' }, { required: false }),
         requiredClaims: property(requiredClaimsSchema, {
             required: false,
-            visibility: 'private',
         }),
     },
     methods: IdentityMethods,

package/dist/schema/kernel/schema.d.ts

@@ -4269,6 +4269,10 @@ declare const KernelDefinitions: {
                             };
                             href: string;
                             handshake: "none" | "shell";
+                            iframe?: {
+                                sandbox?: string[] | undefined;
+                                allow?: string[] | undefined;
+                            } | undefined;
                             issuer: string;
                             etag: string;
                             revision: string;
@@ -4308,6 +4312,10 @@ declare const KernelDefinitions: {
                         };
                         href: string;
                         handshake: "none" | "shell";
+                        iframe?: {
+                            sandbox?: string[] | undefined;
+                            allow?: string[] | undefined;
+                        } | undefined;
                         issuer: string;
                         etag: string;
                         revision: string;
@@ -5614,16 +5622,6 @@ export declare const AuthorityRelations: Readonly<{
 }>;
 /** Exact authorized Kernel Functions for which pristine Root receives direct can_use authority. */
 export declare const KernelRootFunctions: readonly ((import("@astrale-os/kernel-dsl/v1").ResolvedFunction<{
-    kind: "bundle" | "inspect";
-    origin: string;
-}, {
-    readonly mode: 'binary';
-}, "authenticated", import("@astrale-os/kernel-dsl/v1").PolicyCheckExpression<import("@astrale-os/kernel-dsl/v1").PolicyRef, import("@astrale-os/kernel-dsl/v1/language").PolicyCheckObject>> & {
-    readonly ref: import("@astrale-os/kernel-dsl/v1").FunctionRef<"introspect"> & {
-        readonly origin: "kernel.astrale.ai";
-    };
-    readonly key: "kernel.astrale.ai:function.introspect";
-}) | (import("@astrale-os/kernel-dsl/v1").ResolvedFunction<{
     operation: string;
     domains: ({
         artifact: {
@@ -5648,6 +5646,16 @@ export declare const KernelRootFunctions: readonly ((import("@astrale-os/kernel-
         readonly origin: "kernel.astrale.ai";
     };
     readonly key: "kernel.astrale.ai:function.install";
+}) | (import("@astrale-os/kernel-dsl/v1").ResolvedFunction<{
+    kind: "bundle" | "inspect";
+    origin: string;
+}, {
+    readonly mode: 'binary';
+}, "authenticated", import("@astrale-os/kernel-dsl/v1").PolicyCheckExpression<import("@astrale-os/kernel-dsl/v1").PolicyRef, import("@astrale-os/kernel-dsl/v1/language").PolicyCheckObject>> & {
+    readonly ref: import("@astrale-os/kernel-dsl/v1").FunctionRef<"introspect"> & {
+        readonly origin: "kernel.astrale.ai";
+    };
+    readonly key: "kernel.astrale.ai:function.introspect";
 }) | (import("@astrale-os/kernel-dsl/v1").ResolvedFunction<{
     invocation?: {
         source: string;
@@ -6508,6 +6516,10 @@ export declare const KernelRootFunctions: readonly ((import("@astrale-os/kernel-
             };
             href: string;
             handshake: "none" | "shell";
+            iframe?: {
+                sandbox?: string[] | undefined;
+                allow?: string[] | undefined;
+            } | undefined;
             issuer: string;
             etag: string;
             revision: string;

package/dist/schema/kernel/syscalls/contracts/view-resolve.d.ts

@@ -24,6 +24,10 @@ export declare const viewResolveOutput: z.ZodObject<{
             none: "none";
             shell: "shell";
         }>;
+        iframe: z.ZodOptional<z.ZodObject<{
+            sandbox: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
         issuer: z.ZodString;
         etag: z.ZodString;
         revision: z.ZodString;

package/dist/schema/kernel/syscalls/contracts/view-resolve.js

@@ -13,6 +13,10 @@ const declaration = z.strictObject({
         z.strictObject({ kind: z.literal('definition'), definitions: z.array(definition).min(1) }),
     ]),
 });
+const iframeRequirements = z.strictObject({
+    sandbox: z.array(z.string()).optional(),
+    allow: z.array(z.string()).optional(),
+});
 export const viewResolveInput = z.strictObject({ target: z.string().min(1) });
 export const viewResolveOutput = z.strictObject({
     snapshot: z.string().min(1),
@@ -21,6 +25,7 @@ export const viewResolveOutput = z.strictObject({
         declaration,
         href: z.string().min(1),
         handshake: z.enum(['shell', 'none']),
+        iframe: iframeRequirements.optional(),
         issuer: z.string().min(1),
         etag: z.string().min(1),
         revision: z.string().min(1),

package/dist/schema/kernel/syscalls/declarations/index.d.ts

@@ -922,6 +922,10 @@ export declare const ViewMethods: Readonly<{
                 };
                 href: string;
                 handshake: "none" | "shell";
+                iframe?: {
+                    sandbox?: string[] | undefined;
+                    allow?: string[] | undefined;
+                } | undefined;
                 issuer: string;
                 etag: string;
                 revision: string;

package/dist/schema/kernel/syscalls/declarations/view-resolve.d.ts

@@ -22,6 +22,10 @@ export declare const ViewResolve: builder.Method<builder.CallableProjection<{
             };
             href: string;
             handshake: "none" | "shell";
+            iframe?: {
+                sandbox?: string[] | undefined;
+                allow?: string[] | undefined;
+            } | undefined;
             issuer: string;
             etag: string;
             revision: string;

package/dist/schema/kernel/syscalls/descriptors/results/view-resolution.d.ts

@@ -6,10 +6,15 @@ export interface ResolvedView {
     readonly declaration: ViewDeclaration;
     readonly href: string;
     readonly handshake: 'shell' | 'none';
+    readonly iframe?: IframeRequirements;
     readonly issuer: IssuerId;
     readonly etag: `sha256:${string}`;
     readonly revision: Revision;
 }
+export interface IframeRequirements {
+    readonly sandbox?: readonly string[];
+    readonly allow?: readonly string[];
+}
 type ViewDeclaration = Omit<ViewDefinition, 'ref'>;
 export interface ViewResolution {
     readonly snapshot: `sha256:${string}`;

package/dist/schema/kernel/syscalls/descriptors/results/view-resolution.js

@@ -23,11 +23,13 @@ export function acceptViewResolution(input) {
         if (!issuer.is(view.issuer))
             invalid(`Resolved View ${index} issuer is not canonical.`);
         const declaration = acceptDeclaration(view.declaration, index);
+        const iframe = acceptIframeRequirements(view.iframe, view.handshake, index);
         return Object.freeze({
             key,
             declaration,
             href: view.href,
             handshake: view.handshake,
+            ...(iframe === undefined ? {} : { iframe }),
             issuer: view.issuer,
             etag: digest(view.etag, `Resolved View ${index} ETag`),
             revision: digest(view.revision, `Resolved View ${index} revision`),
@@ -43,6 +45,85 @@ export function acceptViewResolution(input) {
         views: Object.freeze(views),
     });
 }
+const IFRAME_TOKEN = /^[a-z][a-z0-9-]*$/u;
+function acceptIframeRequirements(input, handshake, viewIndex) {
+    if (input === undefined)
+        return undefined;
+    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+        invalid(`Resolved View ${viewIndex} iframe requirements are invalid.`);
+    }
+    const prototype = Object.getPrototypeOf(input);
+    if (prototype !== Object.prototype && prototype !== null) {
+        invalid(`Resolved View ${viewIndex} iframe requirements are invalid.`);
+    }
+    const value = input;
+    if (Reflect.ownKeys(value).some((key) => key !== 'sandbox' && key !== 'allow')) {
+        invalid(`Resolved View ${viewIndex} iframe requirements contain unknown fields.`);
+    }
+    const sandbox = acceptTokens(dataValue(value, 'sandbox', viewIndex), viewIndex, 'sandbox');
+    const allow = acceptTokens(dataValue(value, 'allow', viewIndex), viewIndex, 'allow');
+    const baselineSandbox = new Set(handshake === 'shell' ? ['allow-same-origin', 'allow-scripts'] : ['allow-scripts']);
+    const baselineAllow = new Set(handshake === 'shell' ? ['clipboard-write'] : []);
+    if (sandbox.some((token) => baselineSandbox.has(token)) ||
+        allow.some((token) => baselineAllow.has(token))) {
+        invalid(`Resolved View ${viewIndex} iframe requirements repeat a fixed handshake baseline.`);
+    }
+    const tokens = new Set(sandbox);
+    if (tokens.has('allow-popups-to-escape-sandbox') && !tokens.has('allow-popups')) {
+        invalid(`Resolved View ${viewIndex} popup escape requires popup authority.`);
+    }
+    if (tokens.has('allow-top-navigation') && tokens.has('allow-top-navigation-by-user-activation')) {
+        invalid(`Resolved View ${viewIndex} iframe navigation requirements are redundant.`);
+    }
+    if (tokens.has('allow-top-navigation-to-custom-protocols') &&
+        (tokens.has('allow-top-navigation') || tokens.has('allow-popups'))) {
+        invalid(`Resolved View ${viewIndex} custom-protocol requirements are redundant.`);
+    }
+    if (sandbox.length === 0 && allow.length === 0) {
+        invalid(`Resolved View ${viewIndex} empty iframe requirements must be omitted.`);
+    }
+    return Object.freeze({ sandbox: Object.freeze(sandbox), allow: Object.freeze(allow) });
+}
+function dataValue(input, key, viewIndex) {
+    const descriptor = Object.getOwnPropertyDescriptor(input, key);
+    if (descriptor === undefined)
+        return undefined;
+    if (!('value' in descriptor)) {
+        invalid(`Resolved View ${viewIndex} iframe requirements are invalid.`);
+    }
+    return descriptor.value;
+}
+function acceptTokens(input, viewIndex, field) {
+    if (input === undefined)
+        return [];
+    if (!Array.isArray(input))
+        invalid(`Resolved View ${viewIndex} iframe ${field} is invalid.`);
+    const descriptors = Object.getOwnPropertyDescriptors(input);
+    const values = [];
+    for (let index = 0; index < input.length; index += 1) {
+        const descriptor = descriptors[String(index)];
+        if (descriptor === undefined ||
+            !('value' in descriptor) ||
+            typeof descriptor.value !== 'string' ||
+            !IFRAME_TOKEN.test(descriptor.value)) {
+            invalid(`Resolved View ${viewIndex} iframe ${field} contains an invalid token.`);
+        }
+        values.push(descriptor.value);
+    }
+    for (const key of Reflect.ownKeys(descriptors)) {
+        if (key === 'length')
+            continue;
+        if (typeof key !== 'string' || !/^(0|[1-9][0-9]*)$/u.test(key) || Number(key) >= input.length) {
+            invalid(`Resolved View ${viewIndex} iframe ${field} is invalid.`);
+        }
+    }
+    for (let index = 1; index < values.length; index += 1) {
+        if (values[index - 1] >= values[index]) {
+            invalid(`Resolved View ${viewIndex} iframe ${field} is not in strict canonical order.`);
+        }
+    }
+    return values;
+}
 function acceptDeclaration(input, viewIndex) {
     if (input.target.kind === 'domain') {
         return Object.freeze({

package/dist/schema/kernel/syscalls/descriptors/view.d.ts

@@ -26,6 +26,10 @@ export declare const resolve: import("./model.js").MethodSyscall<Readonly<{
             };
             href: string;
             handshake: "none" | "shell";
+            iframe?: {
+                sandbox?: string[] | undefined;
+                allow?: string[] | undefined;
+            } | undefined;
             issuer: string;
             etag: string;
             revision: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/kernel-core",
-  "version": "0.9.0-beta.20",
+  "version": "0.9.0-beta.23",
   "description": "Astrale Kernel Core - Types, Invariants, and Pure Logic",
   "license": "Apache-2.0",
   "repository": {
@@ -160,7 +160,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@astrale-os/kernel-dsl": "0.2.0-beta.15",
+    "@astrale-os/kernel-dsl": "0.2.0-beta.17",
     "@noble/hashes": "2.3.0",
     "@types/json-schema": "^7.0.15",
     "dequal": "2.0.3"