@githolon/dsl 0.100.6 → 0.101.0

package/src/framework/owned_custody.ts

@@ -0,0 +1,561 @@
+// NOMOS — framework-owned multi-device custody for `.owned()` business state.
+// Tenant code sees only generated `devices.request()` / `devices.approve(request)`.
+
+import { z } from "zod";
+import { OWNED_KEY_RELATION, OWNED_READ_RELATION, aggregate, instance, ownedKeyObject, type AggregateHandle } from "../aggregate.js";
+import { Lww } from "../drivers.js";
+import { directive } from "../directive.js";
+import { endorsementOf } from "../principal_evidence.js";
+import { isRelationTypeDecl } from "../relation_schema.js";
+import { t } from "../fields.js";
+import { set, withMarker } from "../ops.js";
+import { query } from "../query.js";
+import {
+  KeyScope,
+  WrappedKey,
+  keyScopeByScope,
+  wrappedKeysByRecipient,
+  writeKeyEpoch,
+  writeWrap,
+} from "./encryption_scope.js";
+import { GenesisWarrant, seedGenesis } from "./genesis.js";
+import { RelationTuple, __qualifyAggregateType, removeTuple, writeTuple } from "./relations.js";
+import { SIGNER_RELATION, enrollSigner, signerObject, identityRelations } from "./signing_identity.js";
+import { impureCapability, impureCapabilityAggregate } from "./impure_capability.js";
+
+/** Obscure stable law id: deliberately unavailable as a generated tenant directive method. */
+export const OWNED_DEVICE_APPROVAL_DIRECTIVE = "nomos_internal_approve_owned_device_7c1f5e";
+export const OWNED_INITIALIZE_DIRECTIVE = "nomos_internal_initialize_owned_identity_7c1f5e";
+export const OWNED_RECOVERY_RELATION = "nomos_internal_owned_recovery_principal_7c1f5e";
+export const OWNED_RECOVERY_PROTECT_DIRECTIVE = "nomos_internal_protect_owned_identity_7c1f5e";
+export const OWNED_RECOVERY_REQUEST_DIRECTIVE = "nomos_internal_request_owned_recovery_7c1f5e";
+export const OWNED_RECOVERY_COMPLETE_DIRECTIVE = "nomos_internal_complete_owned_recovery_7c1f5e";
+export const OWNED_RECOVERY_ACCEPT_DIRECTIVE = "nomos_internal_accept_owned_recovery_7c1f5e";
+const OWNED_RECOVERY_FAIL_DIRECTIVE = "nomos_internal_fail_owned_recovery_7c1f5e";
+const OWNED_RECOVERY_BLOCK_DIRECTIVE = "nomos_internal_block_owned_recovery_7c1f5e";
+const OWNED_RECOVERY_DEAD_LETTER_DIRECTIVE = "nomos_internal_dead_letter_owned_recovery_7c1f5e";
+const keySubject = z.string().regex(/^key:[0-9a-f]{64}$/);
+const principal = z.string().regex(/^user:[A-Za-z0-9][A-Za-z0-9_.-]*$/);
+const b64 = z.string().regex(/^[A-Za-z0-9+/]+={0,2}$/);
+const hidden = <T extends object>(value: T): T & { readonly businessBirthInternal: true } =>
+  ({ ...value, businessBirthInternal: true });
+
+/** The recovery principal can recover this workspace's owned root, never the operator by default. */
+export function ownedRecoveryScope(owner: string): string {
+  return `${ownedKeyObject(owner)}#${OWNED_RECOVERY_RELATION}`;
+}
+
+export function ownedRecoveryPolicyId(owner: string): string {
+  return `nomos-owned-recovery-policy:${ownedKeyObject(owner).slice("nomos-owned-principal:".length)}`;
+}
+
+/** Auditable policy fact. The secret is absent: only the owner-root commitment and designated peer live here. */
+export const OwnedRecoveryPolicy = aggregate("NomosOwnedRecoveryPolicy", {
+  ownerPrincipal: t.string().merge(Lww),
+  recoveryPrincipal: t.string().merge(Lww),
+  scope: t.string().merge(Lww),
+  keyCommitment: t.string().merge(Lww),
+  protectedAt: t.string().merge(Lww),
+  status: t.string().merge(Lww),
+}).public();
+
+const recoveryOrderParams = {
+  ownerPrincipal: t.string().merge(Lww),
+  recoveryPrincipal: t.string().merge(Lww),
+  deviceRequest: t.string().merge(Lww),
+};
+
+/** Private framework Order -> Receipt journal. Generated business clients never expose this aggregate. */
+export const OwnedRecoveryOrder = impureCapabilityAggregate("NomosOwnedRecoveryOrder", recoveryOrderParams);
+const ownedRecoveryLifecycle = impureCapability({
+  aggregateId: OwnedRecoveryOrder.id,
+  obligationDirectiveId: OWNED_RECOVERY_REQUEST_DIRECTIVE,
+  completeDirectiveId: OWNED_RECOVERY_COMPLETE_DIRECTIVE,
+  failDirectiveId: OWNED_RECOVERY_FAIL_DIRECTIVE,
+  blockDirectiveId: OWNED_RECOVERY_BLOCK_DIRECTIVE,
+  deadLetterDirectiveId: OWNED_RECOVERY_DEAD_LETTER_DIRECTIVE,
+  params: recoveryOrderParams,
+  paramsSchema: {
+    ownerPrincipal: principal,
+    recoveryPrincipal: principal,
+    deviceRequest: z.string().min(1),
+  },
+  writeParams: (id, p) => [
+    set(instance(OwnedRecoveryOrder, id), "ownerPrincipal", p.ownerPrincipal),
+    set(instance(OwnedRecoveryOrder, id), "recoveryPrincipal", p.recoveryPrincipal),
+    set(instance(OwnedRecoveryOrder, id), "deviceRequest", p.deviceRequest),
+  ],
+});
+
+export const ownedRecoveryOrdersByRecoveryPrincipal = query("nomosOwnedRecoveryOrdersByRecoveryPrincipal")
+  .key("recoveryPrincipal")
+  .returns(OwnedRecoveryOrder);
+
+/** Opt in once. Retrying the same policy is idempotent; replacing the principal is refused by the kernel. */
+const protectOwnedIdentity = Object.assign(
+  directive(OWNED_RECOVERY_PROTECT_DIRECTIVE)
+    .ensures(OwnedRecoveryPolicy)
+    .payload(z.object({
+      recoveryPrincipal: principal,
+      recipientPubKey: b64,
+      hpkeEpk: b64,
+      ct: b64,
+      keyCommitment: z.string().regex(/^[0-9a-f]{64}$/),
+      protectedAt: z.string().min(1),
+    }))
+    .plan((p, ctx) => {
+      const me = ctx.principal().asAuthoritySubject<string>("designate my owned-data recovery principal");
+      const owner = endorsementOf(me)?.principal ?? "";
+      const scope = ownedRecoveryScope(owner);
+      const policy = instance(OwnedRecoveryPolicy, ownedRecoveryPolicyId(owner));
+      return [
+        withMarker(set(policy, "ownerPrincipal", owner), "ensures"),
+        set(policy, "recoveryPrincipal", p.recoveryPrincipal),
+        set(policy, "scope", scope),
+        set(policy, "keyCommitment", p.keyCommitment),
+        set(policy, "protectedAt", p.protectedAt),
+        set(policy, "status", "protected"),
+        ...writeTuple({
+          object: ownedKeyObject(owner),
+          relation: OWNED_RECOVERY_RELATION,
+          subject: p.recoveryPrincipal,
+          grantedBy: ctx.principal().asAttribution(),
+          grantedAt: p.protectedAt,
+        }),
+        ...writeKeyEpoch(scope, 0, p.protectedAt, [{
+          recipientPrincipal: p.recoveryPrincipal,
+          recipientPubKey: p.recipientPubKey,
+          hpkeEpk: p.hpkeEpk,
+          ct: p.ct,
+        }]),
+      ];
+    })
+    .alsoEnsures(RelationTuple)
+    .alsoEnsures(KeyScope)
+    .alsoEnsures(WrappedKey),
+  { businessBirthInternal: true as const },
+);
+
+const acceptOwnedRecovery = Object.assign(
+  directive(OWNED_RECOVERY_ACCEPT_DIRECTIVE)
+    .ensures(RelationTuple)
+    .payload(z.object({
+      requestId: z.string().min(1),
+      newKeySubject: keySubject,
+      ownedCustody: z.string().min(1),
+      recoveredAt: z.string().min(1),
+    }))
+    .plan((p, ctx) => {
+      const me = ctx.principal().asAuthoritySubject<string>("accept my designated recovery handoff");
+      const owner = endorsementOf(me)?.principal ?? "";
+      return writeTuple({
+        object: ownedKeyObject(owner),
+        relation: OWNED_KEY_RELATION,
+        subject: p.newKeySubject,
+        grantedBy: ctx.principal().asAttribution(),
+        grantedAt: p.recoveredAt,
+        ownedCustody: p.ownedCustody,
+      });
+    }),
+  { businessBirthInternal: true as const },
+);
+
+const hiddenRecoveryLifecycle = {
+  aggregate: hidden(OwnedRecoveryOrder),
+  obligation: hidden(ownedRecoveryLifecycle.obligation),
+  complete: hidden(ownedRecoveryLifecycle.complete),
+  fail: hidden(ownedRecoveryLifecycle.fail),
+  block: hidden(ownedRecoveryLifecycle.block),
+  deadLetter: hidden(ownedRecoveryLifecycle.deadLetter),
+};
+
+export type OwnedRecordAction = "share" | "unshare" | "transfer";
+
+/** One collision-resistant framework id per aggregate/action. Tenant code never sees these ids. */
+export function ownedRecordActionDirectiveId(action: OwnedRecordAction, aggregateId: string): string {
+  let encoded = "";
+  for (let i = 0; i < aggregateId.length; i += 1) encoded += aggregateId.charCodeAt(i).toString(16).padStart(4, "0");
+  return `nomos_internal_${action}_owned_record_${encoded}_7c1f5e`;
+}
+
+const OWNED_ACTION_PREFIX = "nomos_internal_";
+const OWNED_ACTION_MARKER = "_owned_record_";
+
+const wrap = z.object({
+  recipientPrincipal: principal,
+  recipientPubKey: b64,
+  hpkeEpk: b64,
+  ct: b64,
+});
+const historicWrap = wrap.extend({ epoch: z.number().int().nonnegative() });
+
+/**
+ * One atomic framework act: enroll the requesting signing key and add its encrypted handoff to the
+ * owned-device roster. The executor independently proves the opaque request, the same-device
+ * Ed25519->X25519 binding, approver provenance, current key commitment and exact two tuple writes.
+ */
+const approval = directive(OWNED_DEVICE_APPROVAL_DIRECTIVE)
+  .ensures(RelationTuple)
+  .payload(z.object({
+    newKeySubject: keySubject,
+    ownedCustody: z.string().min(1),
+    verifiedVia: z.string().min(1),
+    validFromEpoch: z.number().int().nonnegative(),
+    approvedAt: z.string().min(1),
+  }))
+  .plan((p, ctx) => {
+    const me = ctx.principal().asAuthoritySubject<string>(
+      "approve another device for my own Nomos business state",
+    );
+    const principal = endorsementOf(me)?.principal ?? "";
+    return [
+      ...writeTuple({
+        object: signerObject(principal),
+        relation: SIGNER_RELATION,
+        subject: p.newKeySubject,
+        grantedBy: ctx.principal().asAttribution(),
+        grantedAt: p.approvedAt,
+        verifiedVia: p.verifiedVia,
+        validFromEpoch: p.validFromEpoch,
+      }),
+      ...writeTuple({
+        object: ownedKeyObject(principal),
+        relation: OWNED_KEY_RELATION,
+        subject: p.newKeySubject,
+        grantedBy: ctx.principal().asAttribution(),
+        grantedAt: p.approvedAt,
+        ownedCustody: p.ownedCustody,
+      }),
+    ];
+  });
+
+/** Branded internal so ordinary directive codegen never exposes its cryptographic payload. */
+export const approveOwnedDevice = Object.assign(approval, {
+  businessBirthInternal: true as const,
+});
+
+/** Establish this principal's shared owned-data root before another principal shares to them. */
+const initializeOwnedIdentity = Object.assign(
+  directive(OWNED_INITIALIZE_DIRECTIVE)
+    .ensures(RelationTuple)
+    .payload(z.object({
+      newKeySubject: keySubject,
+      ownedCustody: z.string().min(1),
+      initializedAt: z.string().min(1),
+    }))
+    .plan((p, ctx) => {
+      const me = ctx.principal().asAuthoritySubject<string>(
+        "initialize my framework-owned private-data identity",
+      );
+      const raw = endorsementOf(me)?.principal ?? "";
+      return writeTuple({
+        object: ownedKeyObject(raw),
+        relation: OWNED_KEY_RELATION,
+        subject: p.newKeySubject,
+        grantedBy: ctx.principal().asAttribution(),
+        grantedAt: p.initializedAt,
+        ownedCustody: p.ownedCustody,
+      });
+    }),
+  { businessBirthInternal: true as const },
+);
+
+function recordScope(aggregate: AggregateHandle, recordId: string): string {
+  return `${__qualifyAggregateType(aggregate.id)}:${recordId}#${OWNED_READ_RELATION}`;
+}
+
+function recordObject(aggregate: AggregateHandle, recordId: string): string {
+  return `${__qualifyAggregateType(aggregate.id)}:${recordId}`;
+}
+
+function ownedRecordActionDirectives(aggregate: AggregateHandle) {
+  const share = Object.assign(
+    directive(ownedRecordActionDirectiveId("share", aggregate.id))
+      .ensures(WrappedKey)
+      .payload(z.object({
+        recordId: z.string().min(1),
+        peer: principal,
+        epoch: z.number().int().nonnegative(),
+        sharedAt: z.string().min(1),
+        wraps: z.array(historicWrap),
+      }))
+      .plan((p, ctx) => [
+        ...writeTuple({
+          object: recordObject(aggregate, p.recordId),
+          relation: OWNED_READ_RELATION,
+          subject: p.peer,
+          grantedBy: ctx.principal().asAttribution(),
+          grantedAt: p.sharedAt,
+        }),
+        ...p.wraps.flatMap((entry) => writeWrap(recordScope(aggregate, p.recordId), entry.epoch, entry)),
+      ]),
+    { businessBirthInternal: true as const },
+  );
+
+  const unshare = Object.assign(
+    directive(ownedRecordActionDirectiveId("unshare", aggregate.id))
+      .ensures(KeyScope)
+      .payload(z.object({
+        recordId: z.string().min(1),
+        peer: principal,
+        epoch: z.number().int().positive(),
+        changedAt: z.string().min(1),
+        wraps: z.array(wrap),
+      }))
+      .plan((p, ctx) => [
+        ...removeTuple({
+          object: recordObject(aggregate, p.recordId),
+          relation: OWNED_READ_RELATION,
+          subject: p.peer,
+          grantedBy: ctx.principal().asAttribution(),
+          grantedAt: p.changedAt,
+          revokedBy: endorsementOf(ctx.principal().asAttribution())?.principal ?? "",
+          revokedAt: p.changedAt,
+        }),
+        ...writeKeyEpoch(recordScope(aggregate, p.recordId), p.epoch, p.changedAt, p.wraps),
+      ]),
+    { businessBirthInternal: true as const },
+  );
+
+  const ownerField = aggregate.audience?.kind === "owned" ? aggregate.audience.ownerField : "";
+  const transfer = Object.assign(
+    directive(ownedRecordActionDirectiveId("transfer", aggregate.id))
+      .ensures(KeyScope)
+      .payload(z.object({
+        recordId: z.string().min(1),
+        newOwner: principal,
+        previousReaders: z.array(principal),
+        epoch: z.number().int().positive(),
+        changedAt: z.string().min(1),
+        historicWraps: z.array(historicWrap),
+      }))
+      .plan((p, ctx) => {
+        const object = recordObject(aggregate, p.recordId);
+        const scope = recordScope(aggregate, p.recordId);
+        const ops = p.previousReaders
+          .filter((reader) => reader !== p.newOwner)
+          .flatMap((reader) => removeTuple({
+            object,
+            relation: OWNED_READ_RELATION,
+            subject: reader,
+            grantedBy: ctx.principal().asAttribution(),
+            grantedAt: p.changedAt,
+            revokedBy: endorsementOf(ctx.principal().asAttribution())?.principal ?? "",
+            revokedAt: p.changedAt,
+          }));
+        ops.push(...writeTuple({
+          object,
+          relation: OWNED_READ_RELATION,
+          subject: p.newOwner,
+          grantedBy: ctx.principal().asAttribution(),
+          grantedAt: p.changedAt,
+        }));
+        ops.push(set(instance(aggregate, p.recordId), ownerField as never, p.newOwner as never));
+        ops.push(...writeKeyEpoch(scope, p.epoch, p.changedAt, []));
+        for (const entry of p.historicWraps) ops.push(...writeWrap(scope, entry.epoch, entry));
+        return ops;
+      }),
+    { businessBirthInternal: true as const },
+  );
+
+  return { share, unshare, transfer };
+}
+
+const APPROVAL_EXPORT = "__nomos_owned_device_approval_7c1f5e";
+const IDENTITY_EXPORT = "__nomos_owned_identity_relations_7c1f5e";
+const WARRANT_EXPORT = "__nomos_owned_genesis_warrant_7c1f5e";
+const SEED_EXPORT = "__nomos_owned_seed_genesis_7c1f5e";
+const ENROLL_EXPORT = "__nomos_owned_enroll_signer_7c1f5e";
+const INITIALIZE_EXPORT = "__nomos_owned_initialize_identity_7c1f5e";
+const KEY_SCOPE_EXPORT = "__nomos_owned_key_scope_7c1f5e";
+const WRAPPED_KEY_EXPORT = "__nomos_owned_wrapped_key_7c1f5e";
+const KEY_SCOPE_QUERY_EXPORT = "__nomos_owned_key_scope_query_7c1f5e";
+const WRAPS_QUERY_EXPORT = "__nomos_owned_wraps_query_7c1f5e";
+const RECOVERY_POLICY_EXPORT = "__nomos_owned_recovery_policy_7c1f5e";
+const RECOVERY_PROTECT_EXPORT = "__nomos_owned_recovery_protect_7c1f5e";
+const RECOVERY_ACCEPT_EXPORT = "__nomos_owned_recovery_accept_7c1f5e";
+const RECOVERY_ORDER_EXPORT = "__nomos_owned_recovery_order_7c1f5e";
+const RECOVERY_REQUEST_EXPORT = "__nomos_owned_recovery_request_7c1f5e";
+const RECOVERY_COMPLETE_EXPORT = "__nomos_owned_recovery_complete_7c1f5e";
+const RECOVERY_FAIL_EXPORT = "__nomos_owned_recovery_fail_7c1f5e";
+const RECOVERY_BLOCK_EXPORT = "__nomos_owned_recovery_block_7c1f5e";
+const RECOVERY_DEAD_LETTER_EXPORT = "__nomos_owned_recovery_dead_letter_7c1f5e";
+const RECOVERY_QUERY_EXPORT = "__nomos_owned_recovery_query_7c1f5e";
+
+const ownedGenesisWarrant = hidden(GenesisWarrant);
+const ownedSeedGenesis = hidden(seedGenesis);
+const ownedEnrollSigner = hidden(enrollSigner);
+const ownedIdentityRelations = hidden(identityRelations);
+
+/**
+ * The published CLI bundles its compiler while a tenant module imports declarations from the separately
+ * installed @githolon/dsl tarball. Object identity therefore cannot identify framework declarations at this
+ * seam. The compiler's existing private brand + stable law identity can: ordinary same-named tenant values
+ * do not carry the brand and still fail loudly.
+ */
+function sameFrameworkDeclaration(existing: unknown, generated: unknown): boolean {
+  if (existing === generated) return true;
+  if (
+    existing === null || typeof existing !== "object"
+    || generated === null || typeof generated !== "object"
+    || (existing as { businessBirthInternal?: unknown }).businessBirthInternal !== true
+    || (generated as { businessBirthInternal?: unknown }).businessBirthInternal !== true
+  ) return false;
+  const existingId = (existing as { id?: unknown }).id;
+  const generatedId = (generated as { id?: unknown }).id;
+  if (typeof existingId === "string" || typeof generatedId === "string") return existingId === generatedId;
+  if (isRelationTypeDecl(existing) && isRelationTypeDecl(generated)) {
+    return existing.type === generated.type && existing.global === generated.global;
+  }
+  return false;
+}
+
+function declarationsOf(mod: Record<string, unknown>): unknown[] {
+  return Object.values(mod).flatMap((value) => Array.isArray(value) ? value : [value]);
+}
+
+function reservedCollision(concept: string): never {
+  throw new Error(
+    `Nomos internal concept '${concept}' is already taken by the framework. Sorry mate, Nomos will not ` +
+      "silently overwrite or reroute the tenant declaration; give the business concept a different name.",
+  );
+}
+
+/**
+ * Add the approval mechanism only to domains that actually declare owned business state. This runs
+ * at the same compile/runtime merge seams as the other framework conveniences, preserving one law.
+ */
+export function withOwnedCustodyExports<M extends Record<string, unknown>>(mod: M): Record<string, unknown> {
+  const ownedAggregates = Object.values(mod).filter((value): value is AggregateHandle =>
+    value !== null
+    && typeof value === "object"
+    && (value as { __isAggregateHandle?: unknown }).__isAggregateHandle === true
+    && (value as { audience?: { kind?: unknown } }).audience?.kind === "owned"
+    && ((value as { encryptedFields?: readonly unknown[] }).encryptedFields?.length ?? 0) > 0
+  );
+  if (ownedAggregates.length === 0) return mod;
+  const actions = ownedAggregates.map((aggregate) => ({ aggregate, ...ownedRecordActionDirectives(aggregate) }));
+  const recoveryInjections = [
+    [RECOVERY_POLICY_EXPORT, hidden(OwnedRecoveryPolicy)],
+    [RECOVERY_PROTECT_EXPORT, protectOwnedIdentity],
+    [RECOVERY_ACCEPT_EXPORT, acceptOwnedRecovery],
+    [RECOVERY_ORDER_EXPORT, hiddenRecoveryLifecycle.aggregate],
+    [RECOVERY_REQUEST_EXPORT, hiddenRecoveryLifecycle.obligation],
+    [RECOVERY_COMPLETE_EXPORT, hiddenRecoveryLifecycle.complete],
+    [RECOVERY_FAIL_EXPORT, hiddenRecoveryLifecycle.fail],
+    [RECOVERY_BLOCK_EXPORT, hiddenRecoveryLifecycle.block],
+    [RECOVERY_DEAD_LETTER_EXPORT, hiddenRecoveryLifecycle.deadLetter],
+    [RECOVERY_QUERY_EXPORT, hidden(ownedRecoveryOrdersByRecoveryPrincipal)],
+  ] as const;
+
+  // These names are deliberately obscure, not magical. A tenant can still reach one accidentally or
+  // deliberately, and stable ids can collide under a completely different JS export. Both cases fail
+  // loudly: framework injection must never turn the tenant's declaration into some other concept.
+  if (Object.prototype.hasOwnProperty.call(mod, APPROVAL_EXPORT)
+      && !sameFrameworkDeclaration(mod[APPROVAL_EXPORT], approveOwnedDevice)) {
+    reservedCollision(APPROVAL_EXPORT);
+  }
+  if (Object.prototype.hasOwnProperty.call(mod, IDENTITY_EXPORT)
+      && !sameFrameworkDeclaration(mod[IDENTITY_EXPORT], ownedIdentityRelations)) {
+    reservedCollision(IDENTITY_EXPORT);
+  }
+  for (const [key, generated] of recoveryInjections) {
+    if (Object.prototype.hasOwnProperty.call(mod, key) && !sameFrameworkDeclaration(mod[key], generated)) {
+      reservedCollision(key);
+    }
+  }
+  for (const [key, generated] of [
+    [WARRANT_EXPORT, ownedGenesisWarrant],
+    [SEED_EXPORT, ownedSeedGenesis],
+    [ENROLL_EXPORT, ownedEnrollSigner],
+  ] as const) {
+    if (Object.prototype.hasOwnProperty.call(mod, key) && !sameFrameworkDeclaration(mod[key], generated)) {
+      reservedCollision(key);
+    }
+  }
+  for (const value of declarationsOf(mod)) {
+    if (
+      !sameFrameworkDeclaration(value, approveOwnedDevice)
+      && value !== null
+      && typeof value === "object"
+      && (value as { id?: unknown }).id === OWNED_DEVICE_APPROVAL_DIRECTIVE
+    ) {
+      reservedCollision(OWNED_DEVICE_APPROVAL_DIRECTIVE);
+    }
+    for (const [, generated] of recoveryInjections) {
+      if (
+        !sameFrameworkDeclaration(value, generated)
+        && value !== null
+        && typeof value === "object"
+        && typeof (generated as { id?: unknown }).id === "string"
+        && (value as { id?: unknown }).id === (generated as { id: string }).id
+      ) {
+        reservedCollision((generated as { id: string }).id);
+      }
+    }
+    for (const [framework, generated] of [
+      [GenesisWarrant, ownedGenesisWarrant],
+      [seedGenesis, ownedSeedGenesis],
+      [enrollSigner, ownedEnrollSigner],
+    ] as const) {
+      if (
+        !sameFrameworkDeclaration(value, framework)
+        && !sameFrameworkDeclaration(value, generated)
+        && value !== null
+        && typeof value === "object"
+        && (value as { id?: unknown }).id === framework.id
+      ) {
+        reservedCollision(framework.id);
+      }
+    }
+    if (
+      !sameFrameworkDeclaration(value, ownedIdentityRelations)
+      && isRelationTypeDecl(value)
+      && value.global === true
+      && value.type === identityRelations.type
+    ) {
+      reservedCollision(`global relation type '${identityRelations.type}'`);
+    }
+    if (value !== null && typeof value === "object" && typeof (value as { id?: unknown }).id === "string") {
+      const id = (value as { id: string }).id;
+      const generated = actions.flatMap((entry) => [entry.share, entry.unshare, entry.transfer]);
+      if (id.startsWith(OWNED_ACTION_PREFIX) && id.includes(OWNED_ACTION_MARKER)
+          && !generated.some((candidate) => sameFrameworkDeclaration(value, candidate))) {
+        reservedCollision(id);
+      }
+    }
+  }
+  const result: Record<string, unknown> = {
+    ...mod,
+    [APPROVAL_EXPORT]: approveOwnedDevice,
+    [INITIALIZE_EXPORT]: initializeOwnedIdentity,
+    [IDENTITY_EXPORT]: ownedIdentityRelations,
+    [KEY_SCOPE_EXPORT]: hidden(KeyScope),
+    [WRAPPED_KEY_EXPORT]: hidden(WrappedKey),
+    [KEY_SCOPE_QUERY_EXPORT]: hidden(keyScopeByScope),
+    [WRAPS_QUERY_EXPORT]: hidden(wrappedKeysByRecipient),
+    [RECOVERY_POLICY_EXPORT]: hidden(OwnedRecoveryPolicy),
+    [RECOVERY_PROTECT_EXPORT]: protectOwnedIdentity,
+    [RECOVERY_ACCEPT_EXPORT]: acceptOwnedRecovery,
+    [RECOVERY_ORDER_EXPORT]: hiddenRecoveryLifecycle.aggregate,
+    [RECOVERY_REQUEST_EXPORT]: hiddenRecoveryLifecycle.obligation,
+    [RECOVERY_COMPLETE_EXPORT]: hiddenRecoveryLifecycle.complete,
+    [RECOVERY_FAIL_EXPORT]: hiddenRecoveryLifecycle.fail,
+    [RECOVERY_BLOCK_EXPORT]: hiddenRecoveryLifecycle.block,
+    [RECOVERY_DEAD_LETTER_EXPORT]: hiddenRecoveryLifecycle.deadLetter,
+    [RECOVERY_QUERY_EXPORT]: hidden(ownedRecoveryOrdersByRecoveryPrincipal),
+    // A local law test starts from an empty root, while production business state is normally born into a
+    // warranted child. Keep the same lawful bootstrap machinery available in both cases, but framework-only:
+    // the harness can seat its test identity and warrant the root without adding a tenant-facing lane.
+    [WARRANT_EXPORT]: ownedGenesisWarrant,
+    [SEED_EXPORT]: ownedSeedGenesis,
+    [ENROLL_EXPORT]: ownedEnrollSigner,
+  };
+  for (const { aggregate, share, unshare, transfer } of actions) {
+    const suffix = ownedRecordActionDirectiveId("share", aggregate.id).split("_owned_record_")[1]!;
+    result[`__nomos_owned_share_${suffix}`] = share;
+    result[`__nomos_owned_unshare_${suffix}`] = unshare;
+    result[`__nomos_owned_transfer_${suffix}`] = transfer;
+  }
+  return result;
+}

package/src/framework/platform_admin.ts

@@ -191,7 +191,7 @@ export function seedPlatformAdmin(opts: SeedPlatformAdminOptions): PlatformAdmin
     // GLOBAL (read-projection namespacing opt-out): a dynamically-named framework aggregate —
     // platform governance law deploys under differing domain keys (root vs each platform), and the
     // founder singleton's bare identity must stay stable across them.
-  }, { global: true });
+  }, { global: true }).public();
 
   /**
    * GENESIS SEED 1 — stamp the founder singleton at the fixed id. Authored by the platform's birth/genesis

package/src/framework/relations.ts

@@ -191,7 +191,7 @@ export const RelationTuple = aggregate("RelationTuple", {
   object: t.string().merge(Lww),
   relation: t.string().merge(Lww),
   subjects: t.map(t.json()).merge(MapOf(Lww)),
-});
+}).public();
 export type RelationTupleHandle = typeof RelationTuple;
 
 /** The per-subject leaf the `subjects` map stores (JSON-encoded). Frozen wire shape. */
@@ -215,6 +215,11 @@ export interface RelationSubjectLeaf {
    * every lane. OMITTED when absent (legacy / unverified enrollment) so existing chains stay byte-identical.
    */
   verifiedVia?: string;
+  /**
+   * Secure-by-default owned-data device handoff. Framework-reserved and omitted from every ordinary
+   * relation leaf; the opaque JSON is independently verified by the kernel before it may land.
+   */
+  ownedCustody?: string;
 }
 
 /** Strip undefined keys so the JSON leaf is byte-stable (no dropped-slot `"k":undefined`). */
@@ -247,6 +252,8 @@ interface WriteTupleInput {
   validFromEpoch?: number;
   /** VA-core: the IdP/issuer that vouched for the enrolling principal (signer relations only; omitted otherwise). */
   verifiedVia?: string;
+  /** Framework-internal encrypted owned-data handoff (owned device relation only). */
+  ownedCustody?: string;
 }
 
 /** Lower a tuple write to plan ops. The first op MATERIALIZES the (object, relation)
@@ -283,6 +290,7 @@ function lowerTuple(
     // (these never set) stays byte-identical to a pre-VA leaf (the era rule on the wire shape).
     validFromEpoch: p.validFromEpoch,
     verifiedVia: p.verifiedVia,
+    ownedCustody: p.ownedCustody,
   });
   const subjectEntry = setEntry(rt, "subjects", subjectRaw, JSON.stringify(leaf));
   return [

package/src/framework/repair.ts

@@ -91,7 +91,7 @@ export const RepairRecord = aggregate("RepairRecord", {
   revertedBy: t.string().merge(Lww),
   /** Epoch-ms the repair was authored. */
   revertedAt: t.int().merge(Lww),
-});
+}).public();
 
 // ── `revert` directive ──────────────────────────────────────────────────────
 

package/src/framework/signing_identity.ts

@@ -100,7 +100,7 @@ export const SIGNER_EPOCH_ID = "signer-epoch:self";
 export const SignerEpoch = aggregate("SignerEpoch", {
   scope: t.string().merge(Lww), // singleton key — always "self" (mirrors KeyScope.scope; the query key)
   currentEpoch: t.int().merge(Lww),
-});
+}).public();
 export type SignerEpochHandle = typeof SignerEpoch;
 
 /** The current signer epoch (advisory read; the strict-increment law is the workspaceInvariant below). */
@@ -446,7 +446,7 @@ export const SignerDelegation = aggregate("SignerDelegation", {
   certJson: t.string().merge(Lww),
   /** ISO-8601, caller-stamped (determinism — no clock in the plan). */
   enrolledAt: t.string().merge(Lww),
-});
+}).public();
 export type SignerDelegationHandle = typeof SignerDelegation;
 
 /** The deterministic singleton id of a user's signer delegation (the kernel reads THIS id by-user). */

package/src/framework/source_roster.ts

@@ -55,7 +55,7 @@ export const NomosSourceRoster = aggregate("NomosSourceRoster", {
   rosterJson: t.json().merge(Lww),
   /** The source's `SignerEpoch` at the attested sync. */
   currentEpoch: t.int().merge(Lww),
-});
+}).public();
 
 /** One roster row as the source's `attestorRoster` query answers it. */
 interface AttestorRosterRow {