@githolon/dsl 0.100.0 → 0.100.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.100.0",
+  "version": "0.100.2",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/codegen_proof.ts

@@ -14,8 +14,8 @@
  * counts (the same composed modules every other emitter sees) and emits a
  * domain-shaped live proof:
  *
- *   throwaway workspace → deploy `build/<name>.deploy.json` → connect via the
- *   GENERATED typed client → fetch-TRAPPED offline dispatch of the first `.creates`
+ *   signed session home → connect via the GENERATED typed client →
+ *   fetch-TRAPPED offline dispatch of the first `.creates`
  *   directive (payload synthesized from its zod schema) → first declared query +
  *   first count answered LOCALLY → sync (edge admission) → the CLOUD answers →
  *   two-client AddWins concurrency (when the law has the shape for it) →
@@ -30,8 +30,7 @@
  * the remedy — the compile then SKIPS the proof (the law still ships) and says why.
  *
  * Deterministic codegen: the emitted bytes are a pure function of the modules +
- * package name + domain hash — no timestamps, no randomness (the proof picks its
- * throwaway workspace name at RUN time, not at generation time).
+ * package name + domain hash — no timestamps or generation-time randomness.
  */
 import type { z } from "zod";
 
@@ -2148,7 +2147,7 @@ export interface TsProofOptions {
  *   · `standalone-provable`  — a `.creates` write proven offline (dispatch → declared query/count locally).
  *   · `child-birth-provable` — a `.births()` directive proven END-TO-END into the child it births.
  *   · `relation-bootstrap-provable` — a `.requires(R)`-gated write proven to SUCCEED after granting R (seed-then-prove).
- *   · `live-cloud-provable`  — the full cloud loop (the `.mts` `--live` lane) completes (the primary domain). */
+ *   · `live-cloud-provable`  — the same generated application proof completes in durable cloud custody. */
 export type ProofKind = "compile-valid" | "standalone-provable" | "child-birth-provable" | "relation-bootstrap-provable" | "live-cloud-provable";
 
 /** The machine-readable OFFLINE legs for ONE domain (the `@nomos-proof-legs`
@@ -2534,52 +2533,34 @@ export function proofLegsIndex(modules: readonly DomainModule[]): { default: str
 // ── shared `.mts` fragments (the v2 contract — G1: no host secret; deploy is OPEN + kernel-gated) ─────────
 
 /**
- * THE V2 PREAMBLE (G1, gap 4): create a throwaway workspace (NO secret comes back — ownership is a ledger
- * fact), then deploy YOUR compiled law via the OPEN lane (`POST /domains`, no Bearer; write-authority is
- * kernel-judged at the offer gate). Identity rides `x-nomos-principal` (transitional bare-uid lane), the
- * same header `cli/src/cloud.ts deploy()` + the 0.18 host-strip lane present. Declares `fail`/`ok`/`deploy`/
- * `r`/`d`/`runError`/`PRINCIPAL` and opens the `try {` (closed by {@link v2CatchFinally}).
+ * THE LIVE PREAMBLE: `githolon proof --live` has already established the signed session home and deployed
+ * this package into it. Generated proof code receives only that ready session and drives the application verb.
+ * The old raw create/deploy lane was a second product model and could only create registry/custody orphans.
  */
 function v2IdentityAndCleanupPreamble(opts: TsProofOptions, hashConst: string, n: () => number): string[] {
+  void opts;
+  void hashConst;
   return [
-    `// IDENTITY NOTE: this proof uses the bare x-nomos-principal lane so it is SELF-CONTAINED (a throwaway`,
-    `// workspace, no stored credentials). Real apps use \`githolon login --agent\` (a VERIFIED identity)`,
-    `// + \`githolon ws create/deploy\`. (G1: a create returns NO workspaceSecret — ownership is a ledger`,
-    `// fact; deploy is OPEN + kernel-gated, authenticated by the principal, not a host secret.)`,
+    `// Nomos prepared this signed home and installed the package before entering generated application code.`,
+    `// The application proof supplies business facts only; identity/custody/law selection stay underneath.`,
     `const fail: (m: string) => never = (m) => { throw new Error(m); };`,
     `const ok = (m: string) => console.log("✓ " + m);`,
     `const PRINCIPAL = process.env.NOMOS_PRINCIPAL || "githolon-proof";`,
+    `const AUTHOR_SECRET = process.env.NOMOS_AUTHOR_SECRET || "";`,
     ``,
-    `const deploy = JSON.parse(readFileSync(new URL(${JSON.stringify(`./${opts.packageName}.deploy.json`)}, import.meta.url), "utf8"));`,
-    ``,
-    `// CLEANUP CONTRACT: the throwaway workspace is RETIRED on every exit (green or jammed) — a proof never`,
-    `// leaves orphans. PROOF_KEEP=1 (githolon proof --live --keep) keeps it and prints the persist command.`,
+    `let d: any;`,
     `let runError: unknown = null;`,
-    `let born_ws = false;`,
     `try {`,
     ``,
-    `// ${n()}. a throwaway workspace — born by the create (G1: NO secret is returned; ownership is a ledger fact)`,
-    `let r = await fetch(\`\${CLOUD}/v2/workspaces/\${WS}\`, { method: "POST", headers: { "x-nomos-principal": PRINCIPAL } });`,
-    `let d = await r.json();`,
-    `if (!d.ok) fail(\`create workspace: \${JSON.stringify(d)}\`);`,
-    `born_ws = true;`,
-    `ok(\`workspace \${WS} created (no host secret — ownership is a ledger fact; PROOF_KEEP=1 keeps it)\`);`,
-    ``,
-    `// ${n()}. deploy YOUR compiled law via the OPEN lane (POST /domains, no Bearer — kernel-judged authority,`,
-    `//    authenticated as PRINCIPAL via x-nomos-principal; a refusal answers as a TYPED kernel verdict 422)`,
-    `r = await fetch(\`\${CLOUD}/v2/workspaces/\${WS}/domains\`, { method: "POST", headers: { "content-type": "application/json", "x-nomos-principal": PRINCIPAL }, body: JSON.stringify(deploy) });`,
-    `d = await r.json();`,
-    `if (!d.ok || d.installation?.[0]?.data?.["status.phase"] !== "Active") fail(\`deploy: \${JSON.stringify(d)}\`);`,
-    `if (d.domainHash !== ${hashConst}) fail(\`deploy hash \${d.domainHash} != the generated client's \${${hashConst}}\`);`,
-    `ok(\`law deployed Active — \${${hashConst}.slice(0, 12)}… (the content hash baked into your typed client)\`);`,
+    `// ${n()}. the one managed entry: the logged-in user's durable Nomos home`,
+    `if (process.env.NOMOS_PROOF_MANAGED !== "1" || !AUTHOR_SECRET) fail("run this cloud proof through: githolon proof --live");`,
+    `ok(\`Nomos home ready — \${WS}\`);`,
   ];
 }
 
 /**
- * THE V2 CATCH/FINALLY (G1, gap 4 · 0.34.1): retirement is a SIGNED governance offer — the open self-retire
- * lane is DEAD post-warrant-flip, so the proof itself never retires. Under `githolon proof --live`
- * (NOMOS_PROOF_MANAGED=1) the CLI created the workspace REGISTERED and retires it lawfully after exit;
- * standalone, the proof warns LOUDLY and names the manual command. PROOF_KEEP=1 keeps it.
+ * The generated cloud proof only owns its application call. Its durable signed home is framework state,
+ * so there is no parallel throwaway-provisioning or cleanup protocol to expose here.
  */
 function v2CatchFinally(): string[] {
   return [
@@ -2587,19 +2568,6 @@ function v2CatchFinally(): string[] {
     `  runError = e;`,
     `  console.error("✗ " + ((e as Error)?.message ?? e));`,
     `} finally {`,
-    `  // THE CLEANUP CONTRACT: never a SILENTLY orphaned cloud workspace. Retirement is a SIGNED`,
-    `  // governance offer (retireOwnWorkspace at the parent) — the old open-lane POST /retire is dead`,
-    `  // post-warrant-flip. \`githolon proof --live\` orchestrates it (NOMOS_PROOF_MANAGED=1: it created`,
-    `  // the workspace REGISTERED and retires it after this process exits). Run standalone, this proof`,
-    `  // cannot lawfully retire (no signing key) — so it says so LOUDLY and names the exact command.`,
-    `  if (born_ws && process.env.PROOF_KEEP === "1") {`,
-    `    console.log(\`workspace \${WS} KEPT — retire it when done: githolon ws retire \${WS}\`);`,
-    `  } else if (born_ws && process.env.NOMOS_PROOF_MANAGED === "1") {`,
-    `    console.log(\`  workspace \${WS} — retirement handled by githolon proof --live (signed retireOwnWorkspace)\`);`,
-    `  } else if (born_ws) {`,
-    `    console.error(\`⚠ THROWAWAY WORKSPACE NOT RETIRED: \${WS} (retirement is a signed governance offer this standalone proof cannot author)\`);`,
-    `    console.error(\`⚠ retire it manually: githolon ws retire \${WS}   (run the managed lane next time: githolon proof --live)\`);`,
-    `  }`,
     `  process.exit(runError ? 1 : 0);`,
     `}`,
   ];
@@ -2672,6 +2640,39 @@ function liveAuthorityChainLines(setup: RelationBootstrapLeg, actorVar: string,
   return lines;
 }
 
+function liveBusinessBirthLegLines(cb: ChildBirthLeg, factory: string, n: () => number): string[] {
+  const businessPayload = Object.fromEntries(
+    Object.entries(cb.birthPayload).filter(([field]) => !["principal", "bornAt", "ownerKeyHash", "birthCert"].includes(field)),
+  );
+  return [
+    `// ${n()}. THE APPLICATION SURFACE: one generated business birth`,
+    `{`,
+    `  const holon = await connect({ cloud: CLOUD, workspace: WS, clientId: "business-birth-proof", principal: PRINCIPAL, authorSecret: AUTHOR_SECRET });`,
+    `  const app = ${factory}(holon, { actor: PRINCIPAL });`,
+    `  const facts: Record<string, unknown> = ${JSON.stringify(businessPayload)};`,
+    `  const run = Date.now().toString(36) + Math.random().toString(36).slice(2, 8);`,
+    `  for (const [field, value] of Object.entries(facts)) {`,
+    `    if (typeof value === "string" && value.startsWith("sample-") && value.length > 7) {`,
+    `      facts[field] = ("sample-" + run).slice(0, value.length);`,
+    `    }`,
+    `  }`,
+    `  const born = await app.birth(facts as never);`,
+    `  const childWs = born.workspace;`,
+    `  if (!childWs) fail("app.birth committed without returning the born workspace");`,
+    `  ok(\`app.birth(${cb.businessAggregateId}) — business facts became \${childWs}\`);`,
+    `  ok("identity, provenance, persistence and recovery verified before app.birth resolved");`,
+    ...(cb.childSeedInstanceId !== undefined
+      ? [
+          `  const restored = await fetch(\`\${CLOUD}/v2/workspaces/\${childWs}/aggregates/\${encodeURIComponent(${JSON.stringify(cb.childSeedInstanceId)})}\`).then((r) => r.json());`,
+          `  if (!(restored.rows?.length >= 1)) fail(\`recovered ${cb.businessAggregateId} has no business root: \${JSON.stringify(restored)}\`);`,
+          `  ok("business root read back from durable custody");`,
+        ]
+      : []),
+    `}`,
+    ``,
+  ];
+}
+
 function liveChildBirthLegLines(cb: ChildBirthLeg, opts: TsProofOptions, n: () => number): string[] {
   const hashConst = tsHashConstName(opts.packageName);
   // The birth payload literal: the synthesized values + the REAL hashes onto the discovered fields + the
@@ -2807,11 +2808,10 @@ function generateBirthOnlyProof(
     `// recompile, and this proof reshapes itself — no test rewriting. Run it:`,
     `//`,
     `//   npx githolon proof        (offline legs on a local holon)`,
-    `//   npx githolon proof --live (or: npx tsx build/${opts.packageName}.proof.mts — the full cloud loop)`,
+    `//   npx githolon proof --live (the same application proof in durable Nomos custody)`,
     `//`,
     `// Regenerated on every compile; do not edit.`,
     `// @nomos-proof-legs ${legsMarker}`,
-    `import { readFileSync } from "node:fs";`,
     `import { connect, encodeIntentOfferBytes } from "@githolon/client";`,
     `import { ${factory}, ${hashConst} } from "./${opts.packageName}.client.ts";`,
     `void connect; void encodeIntentOfferBytes; void ${factory};`,
@@ -2821,7 +2821,9 @@ function generateBirthOnlyProof(
     ``,
     ...v2IdentityAndCleanupPreamble(opts, hashConst, n),
     ``,
-    ...liveChildBirthLegLines(cb, opts, n),
+    ...(cb.businessAggregateId !== undefined
+      ? liveBusinessBirthLegLines(cb, factory, n)
+      : liveChildBirthLegLines(cb, opts, n)),
     // THE RELATION-BOOTSTRAP LEG (incl. LAYER 4 born-context): a birth-only domain may ALSO carry a gated
     // non-birth directive whose authority is established by the birth genesis (co2 home's updateHomeProfile
     // via birthHome→seedHomeCreator). Emit it so the birth-only proof names it (the born-context proof itself
@@ -2871,7 +2873,7 @@ function generateBootstrapOnlyProof(
     `// law, recompile, and this proof reshapes itself — no test rewriting. Run it:`,
     `//`,
     `//   npx githolon proof        (offline legs on a local holon)`,
-    `//   npx githolon proof --live (or: npx tsx build/${opts.packageName}.proof.mts — the full cloud loop)`,
+    `//   npx githolon proof --live (the same application proof in durable Nomos custody)`,
     `//`,
     `// Regenerated on every compile; do not edit.`,
     `// @nomos-proof-legs ${legsMarker}`,
@@ -2886,7 +2888,7 @@ function generateBootstrapOnlyProof(
     ...v2IdentityAndCleanupPreamble(opts, hashConst, n),
     ``,
     `// ${n()}. connect + bind the GENERATED typed client (the relation-bootstrap leg drives it with an actor)`,
-    `const holon = await connect({ cloud: CLOUD, workspace: WS, clientId: "proof-1" });`,
+    `const holon = await connect({ cloud: CLOUD, workspace: WS, clientId: "proof-1", principal: PRINCIPAL, authorSecret: AUTHOR_SECRET });`,
     `ok(\`web client connected — ${factory} bound (replica \${holon.replica.slice(0, 6)}…)\`);`,
     ``,
     // The SAME relation-bootstrap emitter the standalone proof uses — seed authority, then prove the GATED
@@ -3037,7 +3039,6 @@ export function generateTsProof(modules: readonly DomainModule[], opts: TsProofO
     `// The flow mirrors the scaffold's test/e2e.mts (docs/ in a scaffolded app explains`,
     `// every call — start at docs/01-mental-model.md). Regenerated on every compile; do not edit.`,
     `// @nomos-proof-legs ${legsMarker}`,
-    `import { readFileSync } from "node:fs";`,
     `import { connect, encodeIntentOfferBytes } from "@githolon/client";`,
     `import { ${factory}, ${hashConst} } from "./${opts.packageName}.client.ts";`,
     ``,
@@ -3047,7 +3048,7 @@ export function generateTsProof(modules: readonly DomainModule[], opts: TsProofO
     ...v2IdentityAndCleanupPreamble(opts, hashConst, n),
     ``,
     `// ${n()}. connect + bind the GENERATED typed client`,
-    `const holon = await connect({ cloud: CLOUD, workspace: WS, clientId: "proof-1" });`,
+    `const holon = await connect({ cloud: CLOUD, workspace: WS, clientId: "proof-1", principal: PRINCIPAL, authorSecret: AUTHOR_SECRET });`,
     `const app = ${factory}(holon);`,
     `ok(\`web client connected — ${factory} bound (replica \${holon.replica.slice(0, 6)}…)\`);`,
     ``,
@@ -3213,8 +3214,8 @@ export function generateTsProof(modules: readonly DomainModule[], opts: TsProofO
       `// ${n()}. CONCURRENCY — two writers, two clientIds, BLIND to each other: each adds to`,
       `//    the AddWins set \`${agg.id}.${setField}\` via \`${domain}/${cd.id}\` offline; admission`,
       `//    merges both and the union keeps every add.`,
-      `const writerA = await connect({ cloud: CLOUD, workspace: WS, clientId: "proof-a" });`,
-      `const writerB = await connect({ cloud: CLOUD, workspace: WS, clientId: "proof-b" });`,
+      `const writerA = await connect({ cloud: CLOUD, workspace: WS, clientId: "proof-a", principal: PRINCIPAL, authorSecret: AUTHOR_SECRET });`,
+      `const writerB = await connect({ cloud: CLOUD, workspace: WS, clientId: "proof-b", principal: PRINCIPAL, authorSecret: AUTHOR_SECRET });`,
       `await ${factory}(writerA).${cd.id}(${concPayload("a")});`,
       `await ${factory}(writerB).${cd.id}(${concPayload("b")});`,
       `await writerA.sync();`,

package/src/codegen_ts.ts

@@ -1069,6 +1069,8 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
     `  principal?: string;`,
     `  /** Persist local custody and reconcile its configured remote. Business birth awaits this when available. */`,
     `  sync?(): Promise<unknown>;`,
+    `  /** Complete durable custody and cold-chain verification for a newly born aggregate. */`,
+    `  settleBirth?(workspace: string, opts?: { timeoutMs?: number; pollMs?: number }): Promise<unknown>;`,
     ...(encPresent
       ? [
           `  /** \`keys\` (E2E sealing): the reader's held scope keys, injected so encrypted fields decrypt;`,
@@ -1946,6 +1948,8 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
           `      const born = typeof result === "object" && result !== null && Array.isArray(result.born) ? result.born[0] : undefined;`,
           `      if (typeof born !== "object" || born === null || typeof born.workspace !== "string" || !born.workspace) throw new Error("birth() committed without returning the born workspace");`,
           `      await holon.sync?.();`,
+          `      if (!holon.settleBirth) throw new Error("birth() requires the current @githolon/client to complete durable recovery");`,
+          `      await holon.settleBirth(born.workspace);`,
           `      return { workspace: born.workspace, type: ${JSON.stringify(businessBirth.aggregateId)}, id: ${JSON.stringify(businessBirth.rootId)} };`,
           `    },`,
         );

package/src/framework/workspaces.ts

@@ -156,7 +156,8 @@ export const workspaceSelfWriteOnce = workspaceInvariant("WorkspaceSelfWriteOnce
 // and the ONE wasm gate runs `engine.check(schema, "workspace:self", relation, principal)` over the
 // pre-apply folded relation tuples — refusing any author who does not HOLD the relation. The schema +
 // the `.requires` together arm the gate (the `nomosRelations` + `nomosRelationGate` era keys); the
-// bespoke `workspaceInvariant` authz gates are GONE (this IS their replacement, as real native law).
+// static governance roles use the native relation gate. Creation posture is deliberately dynamic law:
+// open/unset admits any proven author, invite checks `creator`, and closed checks `admin`.
 //
 // THE CONTROL-PLANE CARVE-OUT — LEAF-ONLY (`allow: [user(), key()]`, never a userset/wildcard). A
 // `workspace:self#admin@<group>#member` or `@<type>:*` would let a group/wildcard escalate to admin
@@ -164,8 +165,8 @@ export const workspaceSelfWriteOnce = workspaceInvariant("WorkspaceSelfWriteOnce
 // side) DISCARDED at evaluation. Each relation is a flat `self()` (directly-stored tuples) — NO rewrite
 // algebra (no computed/from/union): control-plane authority is direct membership only.
 //   * admin           — grantAdmin/revokeAdmin + every admin-mutating governance directive.
-//   * creator         — THE birth authority: createWorkspace + birthChild (leaf OR platform). The tier
-//                       collapsed onto this one relation (2026-06-24); a subject is user: or key:.
+//   * creator         — the invite-posture birth role for createWorkspace + birthChild. Open posture needs
+//                       no pre-seated role; closed posture uses admin. A subject is user: or key:.
 //   * platformCreator — VESTIGIAL: its directives (birthPlatform/grant·revokePlatformCreation) are removed;
 //                       no .requires references it. Kept until the #58 disposition pass (with kind/role).
 // SELF-RELATIVE: custody guarantees a workspace only ever folds its OWN relations table, so
@@ -370,9 +371,8 @@ export const CloudPolicy = aggregate("CloudPolicy", {
    * The workspace-CREATION posture dial (cloud_sovereignty.md S6) —
    * `"open"` (anyone creates), `"invite"` (an active CreationGrant key
    * required), or `"closed"` (admins only). OPTIONAL: absent keeps the
-   * implicit posture the cloud has always had (zero active CreationGrants ⇒
-   * open, any ⇒ invite-governed) — pre-dial chains and policies behave
-   * exactly as before.
+   * implicit open posture. Invite and closed are explicit law facts; merely
+   * granting somebody authority never changes the door for everybody else.
    */
   creationPosture: t.string().merge(Lww).optional(),
   /** Who last set the policy (attribution). */
@@ -400,8 +400,8 @@ export const QuotaGrant = aggregate("QuotaGrant", {
 
 /**
  * PlatformGrant — legacy audit surface for platform invites. Platform creation now rides
- * {@link birthChild} with genesis data and is gated by `#creator`; any remaining PlatformGrant rows are
- * inert compatibility/audit data, never a worker config.
+ * {@link birthChild} with genesis data under the same open/invite/closed creation posture as every birth;
+ * any remaining PlatformGrant rows are inert compatibility/audit data, never a worker config.
  */
 export const PlatformGrant = aggregate("PlatformGrant", {
   /** The auth-provider principal uid invited to create platforms. */
@@ -466,8 +466,8 @@ export const CapabilityBinding = aggregate("CapabilityBinding", {
 // and seeds the genesis. Absent ⇒ a plain lineage record, materialized by boot-on-touch (never drained).
 // `kind` is set PURELY as a derived label off genesis presence — a vestige for old readers; NOTHING decides
 // on it (the host now keys off foundingAdminHash, not the label). There is NO node-class: a platform is just
-// a workspace whose birth order carried a genesis. (`birthChild` is the one unified directive — the tier
-// was collapsed onto `#creator`; `birthPlatform`/`createWorkspace` remain only as deprecated compat aliases.)
+// a workspace whose birth order carried a genesis. (`birthChild` is the one unified directive;
+// `createWorkspace` remains only as a deprecated compatibility alias.)
 // Returns the record builder so a caller (birthChild) can author the law-authored genesis chain onto it.
 function planBirthRecord(
   p: {
@@ -708,7 +708,7 @@ function quotaVerdict(
  * worker provisions and authors {@link provisionWorkspace}.
  *
  * @deprecated SUPERSEDED by {@link birthChild} (the `kind`-collapse) — a plain birth is `birthChild`
- * with no genesis. Kept as a compat alias (same `#creator` gate) during migration; the host still
+ * with no genesis. Kept as a compat alias (same creation-posture law) during migration; the host still
  * authors it by name for namespaced-child + upload births. Retire once those callers move to birthChild.
  */
 export const createWorkspace = directive("createWorkspace")
@@ -746,8 +746,7 @@ export const createWorkspace = directive("createWorkspace")
     planBirthRecord(p);
     return [];
   })
-  .reads(workspacesByPrincipal, quotaByPrincipal, cloudPolicy) // arm the captured-read invariant gate (S2)
-  .requires("creator"); // posture-gated creation: only a #creator holder may request a workspace
+  .reads(workspacesByPrincipal, quotaByPrincipal, cloudPolicy); // quota + creation posture are law invariants
 
 /**
  * birthCloud — THE CLOUD'S OWN BIRTH INTENT. Root authors this once, into its own
@@ -892,7 +891,7 @@ export const retireWorkspace = directive("retireWorkspace")
 
 /**
  * retireOwnWorkspace — SELF-SERVICE retirement: the principal who CREATED a workspace may retire it (you
- * made it, you can withdraw it — e.g. `githolon proof --live` cleaning up its throwaway workspace). Same
+ * made it, you can withdraw it — e.g. an operator removing an obsolete sandbox). Same
  * effect as {@link retireWorkspace} (status → retired, custody untouched) but gated by `creator` (the birth
  * authority) and SCOPED by {@link retireOwnOnly} to records THIS principal created — so a creator can only
  * retire its OWN workspaces, never another's. Admins keep the unrestricted {@link retireWorkspace}.
@@ -1205,11 +1204,11 @@ export const rebirthConsentByWorkspace = query("rebirthConsentByWorkspace")
   .returns(RebirthConsent);
 
 // ─────────────────────────── BIRTH AS A NOMOS PRIMITIVE ──────────────────────────────────────────────
-// (birthPlatform is GONE — the tier collapsed onto #creator; birthChild is the one birth directive.)
+// (birthPlatform is GONE; birthChild is the one birth directive.)
 // THE RECORD IS THE OBLIGATION (architecture/githolon_host_contract.md "Birth is a capability" +
 // provisioning_as_obligations.md). Birth is an IMPURE capability: the parent ORDERS (the law-gated
 // birthChild mints a CloudWorkspace at status:requested carrying foundingAdminHash + the LAW-AUTHORED
-// genesisChain — gated by .requires("creator")), the BIRTH CAPABILITY PROVIDER fulfils it (materialize:
+// genesisChain under the parent's creation posture), the BIRTH CAPABILITY PROVIDER fulfils it (materialize:
 // install the parent's law + REPLAY the genesisChain opaquely — the child's OWN kernel admitting each), and
 // authors provisionWorkspace (the receipt) the parent TRUSTS. No separate obligation aggregate — the minted
 // CloudWorkspace IS the order. The provider owns only the impure boot + replay; the LAW owns the recipe (P1)
@@ -1219,13 +1218,13 @@ export const rebirthConsentByWorkspace = query("rebirthConsentByWorkspace")
 // ─────────────────────────── birthChild — THE ONE BIRTH DIRECTIVE (the `kind`-collapse) ───────────────
 // "There are only workspaces, all equal until a domain is installed." birthChild is the SINGLE directive
 // that births any child — a plain leaf OR a platform; the difference is the GENESIS DATA the payload carries,
-// never a node-class. THE TIER IS COLLAPSED (Jack, 2026-06-24): `#creator` is THE one birth authority — a
-// creator may spawn a leaf AND a platform (the prior `#platformCreator` second tier is retired; platform
-// birth under root is still invite-only because `creator` on root is admin-granted, just renamed/unified).
+// never a node-class. The same creation posture governs leaf and platform births: open/unset admits any
+// proven author, invite requires `#creator`, and closed requires `#admin`. The prior `#platformCreator`
+// second tier is retired.
 //   • genesis ABSENT  → a plain lineage record (no foundingAdminHash); boot-on-touch, never drained.
 //   • genesis PRESENT → carries {foundingAdminHash, pool}: the birth capability provider drains it
 //                       (the order carries a foundingAdminHash) → materialize + seed genesis. A platform.
-// Self-relative: the gate is `workspace:self#creator`, so the SAME directive on root births a platform and
+// Self-relative: the posture reads `workspace:self`, so the SAME directive on root births a platform and
 // on a platform births a child — no per-level host code (the recursion is the law). Supersedes
 // createWorkspace + birthPlatform (kept as compat aliases during migration). See
 // architecture/provisioning_as_obligations.md "The `kind`-collapse".
@@ -1311,8 +1310,7 @@ export const birthChild = directive("birthChild")
     return [];
   })
   .reads(workspacesByPrincipal, quotaByPrincipal, cloudPolicy) // arm the WorkspaceQuota captured-read gate (S2)
-  .births() // BIRTH IS A DECLARED KERNEL PRIMITIVE (G3): emits the `nomosBirthGate` era key; the kernel folds the carried recipe
-  .requires("creator"); // THE ONE birth authority — a #creator may birth a leaf OR a platform (tier collapsed)
+  .births(); // BIRTH IS A DECLARED KERNEL PRIMITIVE (G3): the kernel folds the carried recipe; posture is invariant law
 
 /** workspacesByStatus — the birth provider drains `requested` CloudWorkspaces that CARRY A foundingAdminHash
  *  (a genesis order, no ownerGrantHash) → materialize → provisionWorkspace. Plain requested records (no
@@ -1751,15 +1749,13 @@ export const capabilityBindingByKeyHash = query("capabilityBindingByKeyHash")
 export { relationTuplesByObject } from "./relations.js";
 export { RelationTuple };
 
-// ── GOVERNANCE WRITE-AUTHZ IS NATIVE ZANZIBAR — the ONE gate, no bespoke predicates ───────────────────
-// The bespoke `workspaceInvariant` authz gates (AuthorHoldsAdmin / CreationGate / PlatformCreationGate)
-// are DELETED. Their job is now done by the full-native relation gate: each governance directive carries
-// `.requires("<relation>")` (above), the compiler emits `nomosRelations` (the schema) + `nomosRelationGate`
-// (directive→relation), and the ONE wasm gate runs `engine.check(schema, "workspace:self", relation,
-// principal)` over the PRE-APPLY folded relation tuples — refusing any author who does not HOLD the
-// relation, on every door (author / edge admission / verify_chain replay). The author is the CAPTURED
-// principal (`key:<sha256(bearer)>` for admin/creator, `user:<uid>` for platformCreator), pinned to the
-// sealed Attribution.actor on every peer — so "who may grant" is a LAW fact, never a host pre-check. The
+// ── GOVERNANCE WRITE-AUTHZ: NATIVE ROLES + DYNAMIC CREATION POSTURE ───────────────────────────────────
+// Static governance requirements use the full-native relation gate: a directive carrying
+// `.requires("<relation>")` is checked by the ONE wasm gate over PRE-APPLY tuples on every door (author /
+// edge admission / verify_chain replay). Workspace creation is the intentional exception because it is a
+// three-posture policy, not one static role: the invariant below admits a proven author under open/unset,
+// checks `#creator` under invite, and checks `#admin` under closed. The captured author principal is pinned
+// to the sealed Attribution.actor on every peer — so "who may grant or create" is LAW, never a host pre-check. The
 // pre-apply roster means `grantAdmin(@key:self)` cannot self-grant (the not-yet-written subject is absent
 // in the pre-apply state). SELF-RELATIVE: custody guarantees a workspace only folds its OWN tuples, so the
 // SAME law governs root and every born platform. The host's `_adminOk`/`_creationLawOk`/`_platformCheck`
@@ -1859,6 +1855,76 @@ export const reclaimRequiresRetired = workspaceInvariant("ReclaimRequiresRetired
   });
 
 // ── THE WORKSPACE-QUOTA GATE (S2 — THE QUOTA LAW, ENFORCED) ────────────────────────────────────────────
+// The native `.requires("creator")` replacement accidentally collapsed a THREE-POSTURE law into one
+// permanently invite-only door. Creation is not a static role check: open/unset admits any PROVEN author;
+// invite admits #creator; closed admits #admin. Keep that policy in an invariant over the committed prefix,
+// while the native relation evaluator remains the one meaning of "holds #creator/#admin" everywhere else.
+//
+// The same invariant binds quota/lineage identity to the proven author. Without it, an open caller could
+// charge births to a victim principal (or evade its own quota) by changing two payload strings. A historical
+// bare uid and its canonical `user:<uid>` subject are the same identity; a self-authenticating `key:<hash>`
+// must match byte-for-byte.
+const CREATOR_TUPLE_ID = "pre:" + relationTupleInstanceId(SELF_ADMIN_OBJECT, "creator");
+const ADMIN_TUPLE_ID = "pre:" + relationTupleInstanceId(SELF_ADMIN_OBJECT, "admin");
+const CREATION_POLICY_ID = "pre:cloud-policy:cloud";
+
+function canonicalBirthIdentity(value: unknown): string {
+  const s = String(value ?? "").trim();
+  return s.startsWith("user:") ? s.slice("user:".length) : s;
+}
+
+function activeRelationSubject(row: unknown, subject: string): boolean {
+  let leaf = ((row as { subjects?: Record<string, unknown> } | undefined)?.subjects ?? {})[subject];
+  if (typeof leaf === "string") {
+    try { leaf = JSON.parse(leaf) as unknown; } catch { return false; }
+  }
+  return !!leaf && (leaf as { status?: string }).status === "active";
+}
+
+function creationPostureVerdict(
+  snapshots: Record<string, Record<string, unknown>>,
+  ctx?: { intent: Record<string, unknown>; principal?: string },
+): WorkspaceInvariantVerdict {
+  const actor = String(ctx?.principal ?? "").trim();
+  const claimed = canonicalBirthIdentity(ctx?.intent?.principal);
+  const requestedBy = canonicalBirthIdentity(ctx?.intent?.requestedBy);
+  const proven = canonicalBirthIdentity(actor);
+  if (actor === "" || claimed === "" || requestedBy === "" || claimed !== proven || requestedBy !== proven) {
+    return { reject: "creation.identity-mismatch" };
+  }
+  const posture = String((snapshots.policy as { creationPosture?: string } | undefined)?.creationPosture ?? "open");
+  if (posture === "open" || posture === "") return { accept: true };
+  if (posture === "invite") {
+    return activeRelationSubject(snapshots.creators, actor)
+      ? { accept: true }
+      : { reject: "creation.not-invited" };
+  }
+  if (posture === "closed") {
+    return activeRelationSubject(snapshots.admins, actor)
+      ? { accept: true }
+      : { reject: "creation.closed" };
+  }
+  return { reject: "creation.invalid-posture" };
+}
+
+const creationPostureReads = () => [
+  refAs("policy", "CloudPolicy", CREATION_POLICY_ID),
+  refAs("creators", "RelationTuple", CREATOR_TUPLE_ID),
+  refAs("admins", "RelationTuple", ADMIN_TUPLE_ID),
+];
+
+/** Compatibility create: open/unset ⇒ proven author; invite ⇒ creator; closed ⇒ admin. */
+export const creationPostureCreate = workspaceInvariant("CreationPostureCreate")
+  .on("createWorkspace")
+  .reads(creationPostureReads)
+  .assert(creationPostureVerdict);
+
+/** Unified child birth: exactly the same posture and identity law as compatibility create. */
+export const creationPostureBirth = workspaceInvariant("CreationPostureBirth")
+  .on("birthChild")
+  .reads(creationPostureReads)
+  .assert(creationPostureVerdict);
+
 // The CloudPolicy/QuotaGrant law-state used to be enforced by NOBODY — `createWorkspace`/`birthChild` were
 // gated only by `.requires("creator")`, so a single #creator could mint unbounded workspaces. NOW the
 // COUNT quota is REAL law at the gate: each birth directive CAPTURES (via the #58 captured-read lane,