@githolon/dsl 0.100.5 → 0.101.0

package/src/framework/auth_provider_law.ts

@@ -12,6 +12,8 @@ import { t } from "../fields.js";
 import { Lww } from "../drivers.js";
 import { set, withMarker } from "../ops.js";
 import { query } from "../query.js";
+import { GENESIS_WARRANT_ID } from "./genesis.js";
+import { refAs, workspaceInvariant } from "./workspace_invariant.js";
 
 const epochMs = z.number().int().nonnegative();
 
@@ -67,16 +69,13 @@ export const AuthProvider = aggregate("AuthProvider", {
   setBy: t.string().merge(Lww),
   /** Epoch-ms it was set (caller-stamped). */
   setAt: t.int().merge(Lww),
-});
+}).public();
 
 /**
  * setAuthProvider — declare (or amend) the platform's identity provider. An
  * Ensure on the singleton; every change is an attributed, replayable intent.
  */
-export const setAuthProvider = directive("setAuthProvider")
-  .ensures(AuthProvider)
-  .payload(
-    z.object({
+const authProviderPayload = z.object({
       // NOT z.url(): zod's url() needs the URL global, which the sealed
       // deterministic engine does not provide — a regex keeps the plan pure.
       issuer: z.string().regex(/^https?:\/\/\S+$/, "expected an http(s) URL"),
@@ -96,26 +95,54 @@ export const setAuthProvider = directive("setAuthProvider")
       label: z.string().min(1),
       setBy: z.string().min(1),
       setAt: epochMs,
-    }),
-  )
-  .plan((p) => {
-    const ap = instance(AuthProvider, AUTH_PROVIDER_ID);
-    return [
-      withMarker(set(ap, "scope", "platform"), "ensures"),
-      set(ap, "issuer", p.issuer),
-      set(ap, "jwksUrl", p.jwksUrl),
-      ...(p.audience ? [set(ap, "audience", p.audience)] : []),
-      ...(p.keys ? [set(ap, "keys", p.keys)] : []),
-      ...(p.principalClaim ? [set(ap, "principalClaim", p.principalClaim)] : []),
-      ...(p.rootCert ? [set(ap, "rootCert", p.rootCert)] : []),
-      ...(p.deviceBindingClaim ? [set(ap, "deviceBindingClaim", p.deviceBindingClaim)] : []),
-      ...(p.requireDeviceBinding ? [set(ap, "requireDeviceBinding", p.requireDeviceBinding)] : []),
-      set(ap, "label", p.label),
-      set(ap, "setBy", p.setBy),
-      set(ap, "setAt", p.setAt),
-    ];
-  })
+    });
+
+type AuthProviderPayload = z.infer<typeof authProviderPayload>;
+function writeAuthProvider(p: AuthProviderPayload) {
+  const ap = instance(AuthProvider, AUTH_PROVIDER_ID);
+  return [
+    withMarker(set(ap, "scope", "platform"), "ensures"),
+    set(ap, "issuer", p.issuer),
+    set(ap, "jwksUrl", p.jwksUrl),
+    ...(p.audience ? [set(ap, "audience", p.audience)] : []),
+    ...(p.keys ? [set(ap, "keys", p.keys)] : []),
+    ...(p.principalClaim ? [set(ap, "principalClaim", p.principalClaim)] : []),
+    ...(p.rootCert ? [set(ap, "rootCert", p.rootCert)] : []),
+    ...(p.deviceBindingClaim ? [set(ap, "deviceBindingClaim", p.deviceBindingClaim)] : []),
+    ...(p.requireDeviceBinding ? [set(ap, "requireDeviceBinding", p.requireDeviceBinding)] : []),
+    set(ap, "label", p.label),
+    set(ap, "setBy", p.setBy),
+    set(ap, "setAt", p.setAt),
+  ];
+}
+
+export const setAuthProvider = directive("setAuthProvider")
+  .ensures(AuthProvider)
+  .payload(authProviderPayload)
+  .plan(writeAuthProvider)
   .requires("admin");
 
+/**
+ * Private child-genesis twin of {@link setAuthProvider}. It deliberately has no role requirement because
+ * roles do not exist yet while the child's genesis is folding. Its invariant admits it only while the
+ * GenesisWarrant is absent; the kernel appends that warrant last, permanently closing this lane before the
+ * workspace becomes servable. Later verifier changes can only use the role-gated maintenance directive.
+ */
+export const seedAuthProvider = directive("seedAuthProvider")
+  .ensures(AuthProvider)
+  .payload(authProviderPayload)
+  .plan(writeAuthProvider);
+
+export const authProviderSeedBeforeWarrant = workspaceInvariant("AuthProviderSeedBeforeWarrant")
+  .on("seedAuthProvider")
+  .reads(() => [refAs("warrant", "GenesisWarrant", GENESIS_WARRANT_ID)])
+  .assert(({ warrant }) => {
+    // Missing invariant refs are represented as an empty snapshot by the executor, not necessarily null.
+    const principal = (warrant as { principal?: unknown } | null | undefined)?.principal;
+    return typeof principal !== "string" || principal.length === 0
+      ? { accept: true }
+      : { reject: "seedAuthProvider is a child-genesis primitive; use the role-gated setAuthProvider after birth" };
+  });
+
 /** The declared read serving a workspace's OWN AuthProvider row (and birthHome's inheritance capture). */
 export const authProvider = query("authProvider").key("scope").returns(AuthProvider);

package/src/framework/business_corrections.ts

@@ -0,0 +1,170 @@
+// NOMOS — framework-owned business corrections.
+// Tenant code sees generated `corrections.undo(reason)` / `corrections.redo(reason)` only.
+
+import { z } from "zod";
+import { aggregate, instance, type AggregateHandle } from "../aggregate.js";
+import { directive } from "../directive.js";
+import { Lww } from "../drivers.js";
+import { attributionField, t } from "../fields.js";
+import { set, strike } from "../ops.js";
+import type { DomainModule } from "../codegen_dart.js";
+
+/** Obscure stable law ids: deliberately absent from ordinary directive/aggregate codegen. */
+export const BUSINESS_CORRECTION_AGGREGATE = "nomos_internal_CorrectionRecord_a91e73";
+export const BUSINESS_CORRECTION_DIRECTIVE = "nomos_internal_record_business_correction_a91e73";
+
+const correctionRecord = aggregate(BUSINESS_CORRECTION_AGGREGATE, {
+  recordId: t.string().merge(Lww),
+  kind: t.enum(["undo", "redo"] as const).merge(Lww),
+  target: t.string().merge(Lww),
+  reason: t.string().merge(Lww),
+  correctedBy: attributionField(t.string().merge(Lww)),
+  correctedAt: t.string().merge(Lww),
+}).public();
+
+const correction = directive(BUSINESS_CORRECTION_DIRECTIVE)
+  .ensures(correctionRecord)
+  .payload(z.object({
+    recordId: z.string().min(1),
+    target: z.string().min(1),
+    kind: z.enum(["undo", "redo"]),
+    reason: z.string().trim().min(1),
+    correctedAt: z.string().min(1),
+  }))
+  .plan((p, ctx) => {
+    const record = instance(correctionRecord, p.recordId);
+    return [
+      // Retraction and testimony are one verified intent. There is no state-only correction lane.
+      strike(p.target),
+      set(record, "recordId", p.recordId),
+      set(record, "kind", p.kind),
+      set(record, "target", p.target),
+      set(record, "reason", p.reason),
+      set(record, "correctedBy", ctx.principal().asAttribution()),
+      set(record, "correctedAt", p.correctedAt),
+    ];
+  });
+
+export const businessCorrectionRecord = {
+  ...correctionRecord,
+  businessBirthInternal: true as const,
+};
+export const recordBusinessCorrection = {
+  ...correction,
+  businessBirthInternal: true as const,
+};
+
+const RECORD_EXPORT = "__nomos_business_correction_record_a91e73";
+const DIRECTIVE_EXPORT = "__nomos_business_correction_a91e73";
+
+function declarationsOf(mod: Record<string, unknown>): unknown[] {
+  return Object.values(mod).flatMap((value) => Array.isArray(value) ? value : [value]);
+}
+
+function reservedCollision(concept: string): never {
+  throw new Error(
+    `Nomos internal concept '${concept}' is already taken by the framework. Sorry mate, Nomos will not ` +
+      "silently overwrite or reroute the tenant declaration; give the business concept a different name.",
+  );
+}
+
+function isDirective(value: unknown): value is { id: string; payloadSchema: unknown; businessBirthInternal?: true } {
+  return value !== null
+    && typeof value === "object"
+    && typeof (value as { id?: unknown }).id === "string"
+    && (value as { payloadSchema?: unknown }).payloadSchema !== undefined
+    && typeof (value as { plan?: unknown }).plan === "function";
+}
+
+/**
+ * Every domain with at least one public business verb carries the same private correction primitive.
+ * The package and sealed engine call this at their shared merge seam, so generated availability can
+ * never drift from installed law. Stable id/export collisions fail loudly instead of becoming magic.
+ */
+export function withBusinessCorrectionExports<M extends Record<string, unknown>>(mod: M): Record<string, unknown> {
+  const declarations = declarationsOf(mod);
+  const hasBusinessVerb = declarations.some(
+    (value) => isDirective(value) && value.businessBirthInternal !== true,
+  );
+  if (!hasBusinessVerb) return mod;
+
+  if (Object.prototype.hasOwnProperty.call(mod, RECORD_EXPORT) && mod[RECORD_EXPORT] !== businessCorrectionRecord) {
+    reservedCollision(RECORD_EXPORT);
+  }
+  if (Object.prototype.hasOwnProperty.call(mod, DIRECTIVE_EXPORT) && mod[DIRECTIVE_EXPORT] !== recordBusinessCorrection) {
+    reservedCollision(DIRECTIVE_EXPORT);
+  }
+  for (const value of declarations) {
+    if (
+      value !== businessCorrectionRecord
+      && value !== null
+      && typeof value === "object"
+      && (value as { id?: unknown }).id === BUSINESS_CORRECTION_AGGREGATE
+    ) {
+      reservedCollision(BUSINESS_CORRECTION_AGGREGATE);
+    }
+    if (
+      value !== recordBusinessCorrection
+      && isDirective(value)
+      && value.id === BUSINESS_CORRECTION_DIRECTIVE
+    ) {
+      reservedCollision(BUSINESS_CORRECTION_DIRECTIVE);
+    }
+  }
+
+  return {
+    ...mod,
+    [RECORD_EXPORT]: businessCorrectionRecord,
+    [DIRECTIVE_EXPORT]: recordBusinessCorrection,
+  };
+}
+
+/**
+ * Layered USD lowers each authored module separately, beneath `composeDomainModule`'s normal
+ * framework-expansion seam. Carry the universal correction law once, in the weakest layer, so
+ * flatten-after-lower remains byte-identical to lower-after-compose. An already-composed layer is
+ * left alone; partial or tenant-owned declarations of either reserved id fail loudly.
+ */
+export function withBusinessCorrectionLayer(
+  modules: readonly DomainModule[],
+): readonly DomainModule[] {
+  const hasBusinessVerb = modules.some((module) =>
+    module.directives.some((value) => (value as { businessBirthInternal?: true }).businessBirthInternal !== true),
+  );
+  if (!hasBusinessVerb) return modules;
+
+  const correctionAggregates = modules.flatMap((module) =>
+    module.aggregates.filter((value) => value.id === BUSINESS_CORRECTION_AGGREGATE),
+  );
+  const correctionDirectives = modules.flatMap((module) =>
+    module.directives.filter((value) => value.id === BUSINESS_CORRECTION_DIRECTIVE),
+  );
+  if (correctionAggregates.some(
+    (value) => (value as AggregateHandle & { businessBirthInternal?: true }).businessBirthInternal !== true,
+  )) {
+    reservedCollision(BUSINESS_CORRECTION_AGGREGATE);
+  }
+  if (correctionDirectives.some(
+    (value) => (value as typeof value & { businessBirthInternal?: true }).businessBirthInternal !== true,
+  )) {
+    reservedCollision(BUSINESS_CORRECTION_DIRECTIVE);
+  }
+  if ((correctionAggregates.length === 0) !== (correctionDirectives.length === 0)) {
+    throw new Error(
+      "Nomos internal business-correction law is only partially present in the layered domain; " +
+        "refusing to emit a law whose testimony and retraction halves can drift.",
+    );
+  }
+  if (correctionAggregates.length > 0) return modules;
+
+  const [weakest, ...stronger] = modules;
+  if (weakest === undefined) return modules;
+  return [
+    {
+      ...weakest,
+      aggregates: [...weakest.aggregates, businessCorrectionRecord],
+      directives: [...weakest.directives, recordBusinessCorrection],
+    },
+    ...stronger,
+  ];
+}

package/src/framework/disclosure.ts

@@ -62,7 +62,7 @@ export const Disclosure = aggregate("Disclosure", {
   purpose: t.string().merge(Lww), // why (audit metadata)
   generatedBy: t.string().merge(Lww), // authoring actor
   generatedAt: t.string().merge(Lww), // ISO-8601
-});
+}).public();
 
 /**
  * `recordDisclosure` — `.creates` a Disclosure (instance-bound by

package/src/framework/domain_lifecycle.ts

@@ -12,13 +12,15 @@
  *   * `PolicyBundle` is the content-addressed package object (`policy:{hash}.bundle`);
  *   * `DomainInstallation` is the workspace resource with spec/status/phase;
  *   * `installDomain` writes BOTH in one intent and declares the `installDomain`
- *     capability. This is the richer controller API; bootstrap exposes a thinner
- *     intent with the same name and payload shape for stage-zero install.
+ *     capability. `stageDomain` writes the same content as Pending without serving it;
+ *     `promoteDomain` and `rollbackDomain` are phase changes whose admission is judged
+ *     against the staged package. This is the richer controller API; bootstrap exposes
+ *     a thinner install-only intent for stage-zero.
  */
 import { z } from "zod";
 import { aggregate, instance } from "../aggregate.js";
 import { Lww, MapOf } from "../drivers.js";
-import { t } from "../fields.js";
+import { attributionField, t } from "../fields.js";
 import { directive } from "../directive.js";
 import { set, withMarker, addToSet, type PlannedOp } from "../ops.js";
 
@@ -35,7 +37,7 @@ export type DomainInstallationPhase = (typeof DOMAIN_INSTALLATION_PHASES)[number
 
 export const PolicyBundle = aggregate("PolicyBundle", {
   bundle: t.string().merge(Lww),
-});
+}).public();
 
 export const DomainInstallation = aggregate("DomainInstallation", {
   "spec.domainHash": t.string().merge(Lww),
@@ -51,7 +53,39 @@ export const DomainInstallation = aggregate("DomainInstallation", {
   "status.observedGeneration": t.int().merge(Lww),
   "status.supersededBy": t.string().merge(Lww).optional(),
   "status.conditions": t.map(t.json()).merge(MapOf(Lww)),
-});
+}).public();
+
+/**
+ * The accepted, exact-history evidence for one activation. This is deliberately an
+ * obscure framework concept: tenant models never author or name it. The generated
+ * lifecycle client runs pre-flight and folds this receipt in the SAME intent that
+ * activates the candidate, so recording evidence cannot make its own head anchor stale.
+ */
+export const RELEASE_RECEIPT_AGGREGATE = "nomos_internal_ReleaseReceipt_6f0d3a";
+export const RELEASE_RECEIPT_PREFIX = "nomos-release-receipt:";
+
+export const ReleaseReceipt = aggregate(RELEASE_RECEIPT_AGGREGATE, {
+  candidateHash: t.string().merge(Lww),
+  fromHash: t.string().merge(Lww).optional(),
+  domain: t.string().merge(Lww),
+  atHash: t.string().merge(Lww),
+  atStateRoot: t.string().merge(Lww),
+  historyHash: t.string().merge(Lww),
+  reportHash: t.string().merge(Lww),
+  reportJson: t.string().merge(Lww),
+  complete: t.bool(),
+  evolveOk: t.bool(),
+  rawPromotable: t.bool(),
+  projectionEqual: t.bool(),
+  replayedIntents: t.int().merge(Lww),
+  candidateIntents: t.int().merge(Lww),
+  divergenceCount: t.int().merge(Lww),
+  baselineRoot: t.string().merge(Lww),
+  candidateRoot: t.string().merge(Lww),
+  acceptanceReason: t.string().merge(Lww).optional(),
+  acceptedBy: attributionField(t.string().merge(Lww)),
+  acceptedAt: t.int().merge(Lww),
+}).public();
 
 export function policyAggregateId(domainHash: string): string {
   return `policy:${domainHash}`;
@@ -69,16 +103,66 @@ function domainInstallationInstance(domainHash: string) {
   return instance(DomainInstallation, domainInstallationAggregateId(domainHash));
 }
 
+export function releaseReceiptAggregateId(reportHash: string): string {
+  return `${RELEASE_RECEIPT_PREFIX}${reportHash}`;
+}
+
+function releaseReceiptInstance(reportHash: string) {
+  return instance(ReleaseReceipt, releaseReceiptAggregateId(reportHash));
+}
+
+const dispositions = z.object({
+  retired: z.array(z.string()).optional(),
+  retyped: z.record(z.string(), z.string()).optional(),
+  rebinds: z.record(z.string(), z.string()).optional(),
+  ackBy: z.string().optional(),
+}).optional();
+
+const lowerHex64 = z.string().regex(/^[0-9a-f]{64}$/);
+const gitOid = z.string().regex(/^[0-9a-f]{40}$/);
+const preflightReceipt = z.object({
+  candidateHash: lowerHex64,
+  domain: z.string().min(1),
+  atHash: gitOid,
+  atStateRoot: lowerHex64,
+  historyHash: lowerHex64,
+  reportHash: lowerHex64,
+  reportJson: z.string().min(2),
+  complete: z.literal(true),
+  evolveOk: z.literal(true),
+  rawPromotable: z.boolean(),
+  projectionEqual: z.boolean(),
+  replayedIntents: z.number().int().nonnegative(),
+  candidateIntents: z.number().int().nonnegative(),
+  divergenceCount: z.number().int().nonnegative(),
+  baselineRoot: lowerHex64,
+  candidateRoot: lowerHex64,
+  acceptanceReason: z.string().trim().min(1).optional(),
+}).superRefine((receipt, ctx) => {
+  if (!receipt.rawPromotable && receipt.acceptanceReason === undefined) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["acceptanceReason"],
+      message: "a divergent but complete report needs an explicit business acceptance reason",
+    });
+  }
+});
+
+const packagePayload = {
+  domainHash: z.string(),
+  packageUsda: z.string(),
+  installedBy: z.string(),
+  authorityScope: z.string().default("workspace/root"),
+  dependencies: z.array(z.string()).default([]),
+  supersedes: z.string().optional(),
+  finalizers: z.array(z.string()).default([]),
+};
+
 export const installDomain = directive("installDomain")
   .ensures(DomainInstallation)
   .payload(
     z.object({
-      domainHash: z.string(),
-      packageUsda: z.string(),
-      installedBy: z.string(),
-      authorityScope: z.string().default("workspace/root"),
-      dependencies: z.array(z.string()).default([]),
-      supersedes: z.string().optional(),
+      ...packagePayload,
       // THE FRONTIER TRANSITION (install-lifecycle): `replaces` names a PRIOR install this
       // deploy makes current UNEQUIVOCALLY — the prior install is flipped out of the served
       // frontier (`Superseded`, or `Retired` when `retireReplaced`) and gets the reverse
@@ -86,7 +170,10 @@ export const installDomain = directive("installDomain")
       // byte-identical ops to the pre-lifecycle plan). `replaces` also sets `spec.supersedes`.
       replaces: z.string().optional(),
       retireReplaced: z.boolean().default(false),
-      finalizers: z.array(z.string()).default([]),
+      dispositions,
+    }).refine((p) => p.replaces === undefined || p.replaces !== p.domainHash, {
+      message: "a domain package cannot replace itself",
+      path: ["replaces"],
     }),
   )
   .plan((p): PlannedOp[] => {
@@ -103,8 +190,8 @@ export const installDomain = directive("installDomain")
       set(install, "status.phase", "Active"),
       set(install, "status.observedGeneration", 1),
     ];
-    if (p.dependencies.length > 0) {
-      ops.push(addToSet(install, "spec.dependencies", p.dependencies));
+    if ((p.dependencies ?? []).length > 0) {
+      ops.push(addToSet(install, "spec.dependencies", p.dependencies ?? []));
     }
     // The predecessor back-link: `supersedes` (explicit) or `replaces` (the actionable form).
     const supersedes = p.supersedes ?? p.replaces;
@@ -119,9 +206,156 @@ export const installDomain = directive("installDomain")
       );
       ops.push(set(replaced, "status.supersededBy", p.domainHash));
     }
-    if (p.finalizers.length > 0) {
-      ops.push(addToSet(install, "spec.finalizers", p.finalizers));
+    if ((p.finalizers ?? []).length > 0) {
+      ops.push(addToSet(install, "spec.finalizers", p.finalizers ?? []));
+    }
+    return ops;
+  })
+  .requires("installDomain");
+
+/** Store candidate law in the ledger without changing the served law frontier. The
+ *  kernel content-verifies the package and lifecycle pair, while the Pending phase is
+ *  deliberately invisible to dispatch, reads and replay's current-law map. */
+export const stageDomain = directive("stageDomain")
+  .ensures(DomainInstallation)
+  .payload(z.object({ ...packagePayload }).refine(
+    (p) => p.supersedes === undefined || p.supersedes !== p.domainHash,
+    { message: "a staged domain package cannot supersede itself", path: ["supersedes"] },
+  ))
+  .plan((p): PlannedOp[] => {
+    const policy = policyBundleInstance(p.domainHash);
+    const install = domainInstallationInstance(p.domainHash);
+    const ops: PlannedOp[] = [
+      withMarker(set(policy, "bundle", p.packageUsda), "ensures"),
+      set(install, "spec.domainHash", p.domainHash),
+      set(install, "spec.packageHash", p.domainHash),
+      set(install, "spec.policyAggregate", policyAggregateId(p.domainHash)),
+      set(install, "spec.authorityScope", p.authorityScope),
+      set(install, "spec.installedBy", p.installedBy),
+      set(install, "metadata.generation", 1),
+      set(install, "status.phase", "Pending"),
+      set(install, "status.observedGeneration", 0),
+    ];
+    if ((p.dependencies ?? []).length > 0) ops.push(addToSet(install, "spec.dependencies", p.dependencies ?? []));
+    if (p.supersedes !== undefined) ops.push(set(install, "spec.supersedes", p.supersedes));
+    if ((p.finalizers ?? []).length > 0) ops.push(addToSet(install, "spec.finalizers", p.finalizers ?? []));
+    return ops;
+  })
+  .requires("installDomain");
+
+/** Make a staged package current. The package bytes are already committed; the kernel
+ *  re-loads them from prefix state and runs the evolve gate on this phase transition.
+ *  The prior version stays Active by default so gradual-rollout clients can still have
+ *  their declared era checked; the newer activation stamp alone makes this law current. */
+export const promoteDomain = directive("promoteDomain")
+  .mutates(DomainInstallation)
+  .payload(z.object({
+    domainHash: z.string(),
+    replaces: z.string().optional(),
+    retireReplaced: z.boolean().default(false),
+    dispositions,
+    preflight: preflightReceipt,
+  }).refine((p) => p.replaces === undefined || p.replaces !== p.domainHash, {
+    message: "a promoted domain package cannot replace itself",
+    path: ["replaces"],
+  }).refine((p) => p.preflight.candidateHash === p.domainHash, {
+    message: "the pre-flight receipt must name the package being promoted",
+    path: ["preflight", "candidateHash"],
+  }))
+  .plan((p, ctx): PlannedOp[] => {
+    const promoted = domainInstallationInstance(p.domainHash);
+    const receipt = releaseReceiptInstance(p.preflight.reportHash);
+    const ops: PlannedOp[] = [
+      set(promoted, "status.phase", "Active"),
+      set(promoted, "status.observedGeneration", 1),
+      withMarker(set(receipt, "candidateHash", p.domainHash), "ensures"),
+      ...(p.replaces !== undefined ? [set(receipt, "fromHash", p.replaces)] : []),
+      set(receipt, "domain", p.preflight.domain),
+      set(receipt, "atHash", p.preflight.atHash),
+      set(receipt, "atStateRoot", p.preflight.atStateRoot),
+      set(receipt, "historyHash", p.preflight.historyHash),
+      set(receipt, "reportHash", p.preflight.reportHash),
+      set(receipt, "reportJson", p.preflight.reportJson),
+      set(receipt, "complete", true),
+      set(receipt, "evolveOk", true),
+      set(receipt, "rawPromotable", p.preflight.rawPromotable),
+      set(receipt, "projectionEqual", p.preflight.projectionEqual),
+      set(receipt, "replayedIntents", p.preflight.replayedIntents),
+      set(receipt, "candidateIntents", p.preflight.candidateIntents),
+      set(receipt, "divergenceCount", p.preflight.divergenceCount),
+      set(receipt, "baselineRoot", p.preflight.baselineRoot),
+      set(receipt, "candidateRoot", p.preflight.candidateRoot),
+      ...(p.preflight.acceptanceReason !== undefined
+        ? [set(receipt, "acceptanceReason", p.preflight.acceptanceReason)]
+        : []),
+      set(receipt, "acceptedBy", ctx.principal().asAttribution()),
+      set(receipt, "acceptedAt", ctx.clock().physical),
+    ];
+    if (p.replaces !== undefined) {
+      const replaced = domainInstallationInstance(p.replaces);
+      ops.push(set(promoted, "spec.supersedes", p.replaces));
+      if (p.retireReplaced) {
+        ops.push(set(replaced, "status.phase", "Retired"));
+        ops.push(set(replaced, "status.supersededBy", p.domainHash));
+      }
     }
     return ops;
   })
+  .alsoEnsures(ReleaseReceipt)
+  .requires("installDomain");
+
+/** Rollback is a new governed transition, never a history-pointer rewind. The prior
+ *  package is promoted from committed custody and the failed candidate becomes Disabled;
+ *  the kernel applies the same evolve judgment in the reverse direction. */
+export const rollbackDomain = directive("rollbackDomain")
+  .mutates(DomainInstallation)
+  .payload(z.object({
+    candidateHash: z.string(),
+    priorHash: z.string(),
+    dispositions,
+    preflight: preflightReceipt,
+  }).refine((p) => p.candidateHash !== p.priorHash, {
+    message: "rollback candidate and prior package must differ",
+    path: ["priorHash"],
+  }).refine((p) => p.preflight.candidateHash === p.priorHash, {
+    message: "the rollback pre-flight receipt must name the prior package being restored",
+    path: ["preflight", "candidateHash"],
+  }).refine((p) => (p.preflight.acceptanceReason ?? "").trim().length > 0, {
+    message: "restoring previous law needs an attributed business reason",
+    path: ["preflight", "acceptanceReason"],
+  }))
+  .plan((p, ctx): PlannedOp[] => {
+    const candidate = domainInstallationInstance(p.candidateHash);
+    const prior = domainInstallationInstance(p.priorHash);
+    const receipt = releaseReceiptInstance(p.preflight.reportHash);
+    return [
+      set(candidate, "status.phase", "Disabled"),
+      set(candidate, "status.supersededBy", p.priorHash),
+      set(prior, "status.phase", "Active"),
+      set(prior, "status.observedGeneration", 1),
+      withMarker(set(receipt, "candidateHash", p.priorHash), "ensures"),
+      set(receipt, "fromHash", p.candidateHash),
+      set(receipt, "domain", p.preflight.domain),
+      set(receipt, "atHash", p.preflight.atHash),
+      set(receipt, "atStateRoot", p.preflight.atStateRoot),
+      set(receipt, "historyHash", p.preflight.historyHash),
+      set(receipt, "reportHash", p.preflight.reportHash),
+      set(receipt, "reportJson", p.preflight.reportJson),
+      set(receipt, "complete", true),
+      set(receipt, "evolveOk", true),
+      set(receipt, "rawPromotable", p.preflight.rawPromotable),
+      set(receipt, "projectionEqual", p.preflight.projectionEqual),
+      set(receipt, "replayedIntents", p.preflight.replayedIntents),
+      set(receipt, "candidateIntents", p.preflight.candidateIntents),
+      set(receipt, "divergenceCount", p.preflight.divergenceCount),
+      set(receipt, "baselineRoot", p.preflight.baselineRoot),
+      set(receipt, "candidateRoot", p.preflight.candidateRoot),
+      ...(p.preflight.acceptanceReason !== undefined
+        ? [set(receipt, "acceptanceReason", p.preflight.acceptanceReason)]
+        : []),
+      set(receipt, "acceptedBy", ctx.principal().asAttribution()),
+      set(receipt, "acceptedAt", ctx.clock().physical),
+    ];
+  })
+  .alsoEnsures(ReleaseReceipt)
   .requires("installDomain");

package/src/framework/encryption_identity.ts

@@ -50,7 +50,7 @@ export const EncKey = aggregate("EncKey", {
   principal: t.string().merge(Lww),
   encPublicKey: t.string().merge(Lww), // base64 X25519 (32 bytes)
   publishedAt: t.string().merge(Lww), // ISO-8601, caller-stamped (determinism)
-});
+}).public();
 export type EncKeyHandle = typeof EncKey;
 
 /** Deterministic per-principal instance id — `enc-key-<principal>`. */