@githolon/dsl 0.101.5 → 0.102.0

package/src/framework/impure_capability.ts

@@ -74,6 +74,7 @@ import { directive, type RequirableDirective } from "../directive.js";
 import { executeDirectiveToIntent } from "../wire_encode.js";
 import type { WireIntent } from "../wire.js";
 import type { Ports } from "../ctx.js";
+import { idOf } from "../value_object.js";
 
 /**
  * The impure-capability lifecycle vocabulary — framework-fixed. A task is `requested` when
@@ -455,6 +456,12 @@ export function impureCapability<
    * the Rust reactor's `result_fields` (`HandlerSuccess::with_result_field`).
    */
   completeResult?: (taskInstanceId: string, resultRef: string) => PlannedOp[];
+  /**
+   * OPTIONAL validation for the result reference before the plan runs. Typed capabilities use this
+   * to make malformed encoded receipts impossible to admit at the payload boundary; receipt-free
+   * capabilities retain the ordinary opaque-string result reference.
+   */
+  completeResultSchema?: z.ZodString;
   /**
    * OPTIONAL: the capability-credential name the provider host must hold a
    * law-state `CapabilityBinding` for (see {@link ImpureCapability.capability}).
@@ -463,9 +470,19 @@ export function impureCapability<
   capability?: string;
 }): ImpureCapability<Id, ParamsShape, F> {
   const taskAggregate = impureCapabilityAggregate(spec.aggregateId, spec.params);
-
-  // The obligation payload = the framework provenance/timing envelope ⊕ the tenant's params.
-  const obligationPayload = obligationEnvelopeSchema.extend(spec.paramsSchema);
+  const typedRequestId = { requestId: idOf(taskAggregate) };
+  const obligationPayloadBase = obligationEnvelopeSchema.extend(spec.paramsSchema);
+  // `idOf()` deliberately has the same parsed value (`string`) as the schema it
+  // replaces; its extra aggregate identity lives in Zod metadata for lint/codegen.
+  // Preserve the generic payload type while installing that richer runtime schema.
+  const obligationPayload = obligationPayloadBase.extend(typedRequestId) as typeof obligationPayloadBase;
+  const typedCompleteBase = completeSchema.extend(typedRequestId);
+  const typedCompleteSchema = spec.completeResultSchema !== undefined
+    ? typedCompleteBase.extend({ resultRef: spec.completeResultSchema })
+    : typedCompleteBase;
+  const typedFailSchema = failSchema.extend(typedRequestId);
+  const typedBlockSchema = blockSchema.extend(typedRequestId);
+  const typedDeadLetterSchema = deadLetterSchema.extend(typedRequestId);
 
   const obligation: RequirableDirective<ObligationPayload<ParamsShape>> = directive(
     spec.obligationDirectiveId,
@@ -488,7 +505,7 @@ export function impureCapability<
 
   const complete = directive(spec.completeDirectiveId)
     .mutates(taskAggregate)
-    .payload(completeSchema)
+    .payload(typedCompleteSchema)
     .plan((p) =>
       completeOps(
         spec.aggregateId,
@@ -500,17 +517,17 @@ export function impureCapability<
 
   const fail = directive(spec.failDirectiveId)
     .mutates(taskAggregate)
-    .payload(failSchema)
+    .payload(typedFailSchema)
     .plan((p) => failOps(spec.aggregateId, p));
 
   const block = directive(spec.blockDirectiveId)
     .mutates(taskAggregate)
-    .payload(blockSchema)
+    .payload(typedBlockSchema)
     .plan((p) => blockOps(spec.aggregateId, p));
 
   const deadLetter = directive(spec.deadLetterDirectiveId)
     .mutates(taskAggregate)
-    .payload(deadLetterSchema)
+    .payload(typedDeadLetterSchema)
     .plan((p) => deadLetterOps(spec.aggregateId, p));
 
   return {

package/src/framework/relations.ts

@@ -244,7 +244,10 @@ interface WriteTupleInput {
    * un-endorsed identity (`asAttribution()`) cannot be a subject (it won't typecheck), so identity
    * never SILENTLY decides a grant.
    */
-  subject: string | EndorsedAuthority<string>;
+  /** A principal/userset wire subject, endorsed current principal, or an object token for a typed parent
+   * edge. `objectOf(Relations, id)` is the canonical parent-reference form: Nomos qualifies its type to the
+   * dispatching domain, so law authors never hand-assemble a namespaced relation identity. */
+  subject: string | EndorsedAuthority<string> | RelationObjectToken;
   /** ATTRIBUTION (free): who recorded the grant. A plain string OR `ctx.principal().asAttribution()`. */
   grantedBy: string | AttributionPrincipal;
   grantedAt: string;
@@ -261,7 +264,7 @@ interface WriteTupleInput {
 function lowerTuple(
   p: WriteTupleInput & {
     status: RelationStatus;
-    revokedBy?: string | undefined;
+    revokedBy?: string | AttributionPrincipal | undefined;
     revokedAt?: string | undefined;
   },
 ): PlannedOp[] {
@@ -278,13 +281,18 @@ function lowerTuple(
   // host-stamped actor — the SAME form the write gate parses via `Subject::parse`), so an endorsed
   // authority subject lowers to that leaf verbatim and the gate's `engine.check` matches it.
   const subjectE = endorsementOf(p.subject);
-  const subjectRaw = subjectE ? subjectE.principal : (p.subject as string);
+  const subjectRaw = subjectE
+    ? subjectE.principal
+    : isRelationObjectToken(p.subject)
+      ? resolveTupleObject(p.subject, p.relation)
+      : p.subject as string;
   const grantedByRaw = endorsementOf(p.grantedBy)?.principal ?? (p.grantedBy as string);
+  const revokedByRaw = endorsementOf(p.revokedBy)?.principal ?? (p.revokedBy as string | undefined);
   const leaf = compact({
     status: p.status,
     grantedBy: grantedByRaw,
     grantedAt: p.grantedAt,
-    revokedBy: p.revokedBy,
+    revokedBy: revokedByRaw,
     revokedAt: p.revokedAt,
     // VA-core signer-provenance leaf fields — `compact` strips an `undefined`, so a non-signer relation
     // (these never set) stays byte-identical to a pre-VA leaf (the era rule on the wire shape).
@@ -316,7 +324,7 @@ export function writeTuple(p: WriteTupleInput): PlannedOp[] {
  * gate's remove-wins check (slice 4) refuses a later re-grant of an ever-revoked subject.
  */
 export function removeTuple(
-  p: WriteTupleInput & { revokedBy: string; revokedAt: string },
+  p: WriteTupleInput & { revokedBy: string | AttributionPrincipal; revokedAt: string },
 ): PlannedOp[] {
   return lowerTuple({
     ...p,

package/src/framework/workspaces.ts

@@ -78,6 +78,7 @@ import { workspaceInvariant, refAs, type WorkspaceInvariantVerdict } from "./wor
 import { writeTuple, removeTuple, RelationTuple, relationTupleInstanceId } from "./relations.js";
 import { relationType, self, user, key } from "../relation_schema.js";
 import { GENESIS_WARRANT_ID } from "./genesis.js";
+import { idOf } from "../value_object.js";
 import { signerObject, SIGNER_RELATION } from "./signing_identity.js";
 // THE GENESIS BOOTSTRAP (platform-birth genesis bootstrap, Approach A): governance carries the
 // warrant-flip primitives so the birth door can lawfully bootstrap a virgin platform's founding admin —
@@ -812,7 +813,7 @@ export const provisionWorkspace = directive("provisionWorkspace")
   .mutates(CloudWorkspace)
   .payload(
     z.object({
-      workspaceId: z.string().min(1),
+      workspaceId: idOf(CloudWorkspace),
       ownerGrantHash: sha256Hex,
       provisionedAt: epochMs,
       provisionedBy: z.string().min(1),
@@ -836,7 +837,7 @@ export const rotateWorkspaceOwner = directive("rotateWorkspaceOwner")
   .mutates(CloudWorkspace)
   .payload(
     z.object({
-      workspaceId: z.string().min(1),
+      workspaceId: idOf(CloudWorkspace),
       ownerGrantHash: sha256Hex,
       rotatedBy: z.string().min(1),
       rotatedAt: epochMs,
@@ -857,7 +858,7 @@ export const setWorkspaceTier = directive("setWorkspaceTier")
   .mutates(CloudWorkspace)
   .payload(
     z.object({
-      workspaceId: z.string().min(1),
+      workspaceId: idOf(CloudWorkspace),
       tier: z.enum(WORKSPACE_TIERS),
       changedBy: z.string().min(1),
       changedAt: epochMs,
@@ -878,7 +879,7 @@ export const retireWorkspace = directive("retireWorkspace")
   .mutates(CloudWorkspace)
   .payload(
     z.object({
-      workspaceId: z.string().min(1),
+      workspaceId: idOf(CloudWorkspace),
       retiredBy: z.string().min(1),
       retiredAt: epochMs,
     }),
@@ -900,7 +901,7 @@ export const retireOwnWorkspace = directive("retireOwnWorkspace")
   .mutates(CloudWorkspace)
   .payload(
     z.object({
-      workspaceId: z.string().min(1),
+      workspaceId: idOf(CloudWorkspace),
       retiredBy: z.string().min(1),
       retiredAt: epochMs,
     }),
@@ -956,7 +957,7 @@ export const reclaimWorkspace = directive("reclaimWorkspace")
   .mutates(CloudWorkspace)
   .payload(
     z.object({
-      workspaceId: z.string().min(1),
+      workspaceId: idOf(CloudWorkspace),
       reclaimedBy: z.string().min(1),
       reclaimedAt: epochMs,
     }),
@@ -994,7 +995,7 @@ export const rebirthWorkspace = directive("rebirthWorkspace")
   .payload(
     z.object({
       /** The target CloudWorkspace AGGREGATE id (the minted lineage-record id; root-custody registry). */
-      workspaceId: z.string().min(1),
+      workspaceId: idOf(CloudWorkspace),
       /** MANDATORY — the custodian's justification for superseding this chain (audit, on the ledger forever). */
       reason: z.string().min(1),
       /** Epoch-ms the supersession was authored (caller-stamped — the timestamp doctrine). Its presence on the
@@ -1322,7 +1323,7 @@ export const setPlatformPool = directive("setPlatformPool")
   .mutates(CloudWorkspace)
   .payload(
     z.object({
-      workspaceId: z.string().min(1),
+      workspaceId: idOf(CloudWorkspace),
       pool: z.number().int().positive(),
       setBy: z.string().min(1),
       setAt: epochMs,
@@ -1437,7 +1438,7 @@ export const releaseHostname = directive("releaseHostname")
   .mutates(HostnameClaim)
   .payload(
     z.object({
-      claimId: z.string().min(1),
+      claimId: idOf(HostnameClaim),
       releasedBy: z.string().min(1),
       releasedAt: epochMs,
     }),
@@ -1499,7 +1500,7 @@ export const revokeCapability = directive("revokeCapability")
   .mutates(CapabilityBinding)
   .payload(
     z.object({
-      bindingId: z.string().min(1),
+      bindingId: idOf(CapabilityBinding),
       revokedBy: z.string().min(1),
       revokedAt: epochMs,
     }),
@@ -1574,7 +1575,7 @@ export const setWorkspaceByteCap = directive("setWorkspaceByteCap")
   .mutates(CloudWorkspace)
   .payload(
     z.object({
-      workspaceId: z.string().min(1),
+      workspaceId: idOf(CloudWorkspace),
       byteCap: z.number().int().positive(),
       setBy: z.string().min(1),
       setAt: epochMs,
@@ -1807,7 +1808,7 @@ export const founderSignerWriteOnce = workspaceInvariant("FounderSignerWriteOnce
     refAs(
       "tuple",
       "RelationTuple",
-      "pre:" + relationTupleInstanceId(signerObject(String((ctx.intent ?? {}).principal ?? "")), SIGNER_RELATION),
+      "pre:" + relationTupleInstanceId(signerObject(String(ctx.principal ?? "")), SIGNER_RELATION),
     ),
   ])
   .assert(({ tuple }, ctx) => {

package/src/generated_client_names.ts

@@ -16,7 +16,45 @@ type ClientDomain = {
 const camel = (value: string): string =>
   value.replace(/[_\s-]+(\w)/g, (_match, letter: string) => letter.toUpperCase());
 
-/** Refuse tenant callables that would overwrite the generated `model` adoption concept. */
+const lowerFirst = (value: string): string =>
+  value.length === 0 ? value : value[0]!.toLowerCase() + value.slice(1);
+
+/** One shared public collection spelling for generators and their generated proof (`Entry` -> `entries`). */
+export function generatedAggregateCollectionName(aggregateId: string): string {
+  const name = camel(aggregateId);
+  const plural = /[^aeiou]y$/i.test(name)
+    ? `${name.slice(0, -1)}ies`
+    : /(?:s|x|z|ch|sh)$/i.test(name)
+      ? `${name}es`
+      : `${name}s`;
+  return lowerFirst(plural);
+}
+
+const GENERATED_APPLICATION_MEMBERS = new Set([
+  "domain",
+  "domainHash",
+  "interface",
+  "model",
+  "encryption",
+  "recovery",
+  "devices",
+  "share",
+  "unshare",
+  "transfer",
+  "corrections",
+  "conflicts",
+  "past",
+  "watchActivity",
+  "activityLog",
+  "describe",
+  "describeHistory",
+  "currentStatus",
+  "watchStatus",
+  "currentUser",
+  "refresh",
+]);
+
+/** Refuse tenant callables that would overwrite a generated application concept. */
 export function assertModelClientMemberAvailable(mod: ClientDomain): void {
   const domain = mod.domain ?? mod.name;
   const surfaces: readonly [string, readonly Named[]][] = [
@@ -28,9 +66,10 @@ export function assertModelClientMemberAvailable(mod: ClientDomain): void {
   ];
   for (const [kind, entries] of surfaces) {
     for (const entry of entries) {
-      if (typeof entry.id !== "string" || camel(entry.id) !== "model") continue;
+      if (typeof entry.id !== "string" || !GENERATED_APPLICATION_MEMBERS.has(camel(entry.id))) continue;
+      const reserved = camel(entry.id);
       throw new Error(
-        `Nomos generated client concept 'model' is already taken, but business ${kind} ` +
+        `Nomos generated application concept '${reserved}' is already taken, but business ${kind} ` +
         `'${entry.id}' in domain '${domain}' would use the same name. Sorry mate: Nomos will not ` +
         `silently reinterpret either concept; rename the business ${kind}.`,
       );

package/src/idof_lint.ts

@@ -8,11 +8,11 @@
 /**
  * THE PAYLOAD-REF idOf LINT (`architecture/dart_codegen_parity.md` P2 — ref ergonomics). A
  * `t.ref(Target)` / `t.foreignRef(Target)` field on the AGGREGATE/read-model side already
- * generates a TYPED id class (`SiteId`, `codegen_dart.ts`). Nothing enforced the payload SIDE
+ * generates a canonical `NomosRef<Site>`. Nothing enforced the payload SIDE
  * carried the matching brand — a directive author can write `siteId: z.string()` in the
  * payload and never discover `idOf(Site)` exists, so the generated Dart payload class carries a
- * raw `String` while the read model carries `SiteId`: an asymmetry that forces manual
- * `.value` unwrap/rewrap at the UI boundary and lets a mistyped id compile silently.
+ * raw `String` while the read model carries `NomosRef<Site>`: an asymmetry that forces manual
+ * identity reconstruction at the UI boundary and lets a mistyped id compile silently.
  *
  * THIS PASS closes that gap at COMPILE time: for every directive, plan-PROBE it (reusing the
  * exact primitive the proof generator's own discovery legs use — `probePlanOps` /
@@ -37,17 +37,15 @@
  *   - A directive whose plan can't be probed (unsynthesizable payload, or the plan throws under
  *     the synthesized sample) is SKIPPED — best-effort, matching every other plan-probe
  *     consumer in `codegen_proof.ts` (never a false refusal from an exotic shape).
- *   - `idOf(Agg)` AND `brandedId(Name)` both satisfy the lint (either brand types the Dart/TS
- *     side); only a truly BARE `z.string()` (through `.optional()`/`.default()`/`.nullable()`)
- *     refuses.
+ *   - Only `idOf(the exact target aggregate)` satisfies a reference edge. A standalone
+ *     `brandedId(Name)` is intentionally insufficient because it has no workspace or aggregate type.
  *
  * NOT era-gated: this is a pure Dart/TS-codegen build-time guard (like the domain-contracts
  * circular-import guard in `compile_package_main.ts`) — it has no wire/manifest/kernel effect,
  * changes no hash, and never touches already-deployed law. It only judges whether `nomos-compile`
  * accepts a directive's SOURCE shape, exactly the same posture as that circular-dependency guard.
- * A domain already using `idOf`/`brandedId` (or one with no ref-fed payload field at all) compiles
- * exactly as before; only a directive whose payload feeds a ref field with a provably-bare string
- * newly refuses — which is the intended fail-closed behaviour, not an accidental regression.
+ * A domain already using the exact `idOf(Target)` (or one with no ref-fed payload field at all) compiles
+ * exactly as before; bare strings, standalone brands and `idOf(AnotherAggregate)` refuse.
  */
 import type { z } from "zod";
 
@@ -101,6 +99,12 @@ function refTargetOf(op: FieldOp): string | undefined {
  * (unsynthesizable payload / plan throws) is silently skipped — best-effort, no false refusal.
  */
 export function assertIdOfLintForDirective(dir: Directive<unknown>, where: string): void {
+  // Framework-authored implementation directives deliberately carry wire-level record ids.
+  // They are never emitted into the generated tenant API, whose public wrapper accepts and
+  // validates NomosRef<TAggregate> before privately lowering it to this payload. Applying the
+  // tenant-facing idOf lint here would force framework wire schemas to masquerade as public
+  // application schemas and, worse, reject every aggregate that opts into owned custody.
+  if ((dir as { businessBirthInternal?: unknown }).businessBirthInternal === true) return;
   const probed = probePlanOps(dir, where);
   if (probed === undefined) return;
   let shape: Record<string, z.ZodTypeAny>;
@@ -117,6 +121,31 @@ export function assertIdOfLintForDirective(dir: Directive<unknown>, where: strin
     if (typeof value === "string") byValue.set(value, name);
   }
   for (const op of probed.ops) {
+    // A bound mutation addresses one existing aggregate instance. The payload field carrying that
+    // address is therefore not "some string" or merely "some branded id": it must be idOf(the exact
+    // aggregate being mutated). This is the identity spine of the generated application API. Without
+    // this guard a model can compile `entryId: z.string()`, after which every generated caller can mix
+    // unrelated record ids and is encouraged to reconstruct identity as application state.
+    const effectiveMarker = op.marker ?? (op.aggregateType === dir.aggregateId ? dir.marker : "mutates");
+    if (op.aggregateType !== undefined && (effectiveMarker === "mutates" || effectiveMarker === "archives")) {
+      const payloadField = byValue.get(op.aggregateId);
+      if (payloadField !== undefined) {
+        const fieldSchema = shape[payloadField];
+        const actualTarget = fieldSchema === undefined ? undefined : idOfMetaOf(fieldSchema);
+        if (actualTarget !== op.aggregateType) {
+          const expected = shortAggName(op.aggregateType);
+          const actual = actualTarget === undefined
+            ? "an untyped string"
+            : `idOf(${shortAggName(actualTarget)})`;
+          const verb = effectiveMarker === "archives" ? "archive" : "mutate";
+          throw new IdOfLintError(
+              `directive '${dir.id}': payload field '${payloadField}' selects the ${expected} record to ${verb} ` +
+              `but carries ${actual} — declare it as idOf(${expected}) so create, update, find and watch use ` +
+              `the same generated NomosRef<${expected}>.`,
+          );
+        }
+      }
+    }
     if (op.kind !== "set" && op.kind !== "setEntry") continue;
     if (typeof op.value !== "string") continue;
     const targetAgg = refTargetOf(op);
@@ -124,13 +153,23 @@ export function assertIdOfLintForDirective(dir: Directive<unknown>, where: strin
     const payloadField = byValue.get(op.value);
     if (payloadField === undefined) continue; // not traceable to a top-level payload field — no verdict
     const fieldSchema = shape[payloadField];
-    if (fieldSchema === undefined || !isBareString(fieldSchema)) continue; // already idOf/brandedId — fine
+    if (fieldSchema === undefined) continue;
     const onAgg = shortAggName(op.aggregateType ?? op.aggregateId);
     const targetName = shortAggName(targetAgg);
+    const actualTarget = idOfMetaOf(fieldSchema);
+    if (actualTarget === targetAgg) continue;
+    if (actualTarget !== undefined) {
+      throw new IdOfLintError(
+        `directive '${dir.id}': payload field '${payloadField}' feeds ref field '${onAgg}.${op.field}' ` +
+          `(-> ${targetName}) but carries idOf(${shortAggName(actualTarget)}) — declare it as ` +
+          `idOf(${targetName}) so generated callers carry NomosRef<${targetName}>.`,
+      );
+    }
+    if (!isBareString(fieldSchema) && brandedIdMetaOf(fieldSchema) === undefined) continue;
     throw new IdOfLintError(
       `directive '${dir.id}': payload field '${payloadField}' feeds ref field '${onAgg}.${op.field}' ` +
-        `(-> ${targetName}) but is a plain z.string() — wrap it as idOf(${targetName}) so the generated ` +
-        `Dart/TS carry the typed id, matching the read model. (dart_codegen_parity.md P2)`,
+        `(-> ${targetName}) but is not idOf(${targetName}) — declare it as idOf(${targetName}) so generated ` +
+        `Dart/TS carry NomosRef<${targetName}>, matching the read model. (dart_codegen_parity.md P2)`,
     );
   }
 }
@@ -138,7 +177,20 @@ export function assertIdOfLintForDirective(dir: Directive<unknown>, where: strin
 /** Run the idOf lint over every directive in a domain. `domain` names the module for the probe's
  *  error-context strings (`synthesizePayload`'s `where`). Throws on the FIRST violation. */
 export function assertIdOfLint(directives: readonly Directive<unknown>[], domain: string): void {
+  const violations: string[] = [];
   for (const dir of directives) {
-    assertIdOfLintForDirective(dir, `${domain}/${dir.id}`);
+    try {
+      assertIdOfLintForDirective(dir, `${domain}/${dir.id}`);
+    } catch (error) {
+      if (!(error instanceof IdOfLintError)) throw error;
+      violations.push(error.message);
+    }
+  }
+  if (violations.length === 1) throw new IdOfLintError(violations[0]!);
+  if (violations.length > 1) {
+    throw new IdOfLintError(
+      `${violations.length} typed identity violations in domain '${domain}':\n` +
+        violations.map((message) => `  - ${message}`).join("\n"),
+    );
   }
 }

package/src/index.ts

@@ -60,6 +60,7 @@ export {
   unit,
   idOf,
   idOfMetaOf,
+  idOfTargetKindOf,
   brandedId,
   brandedIdMetaOf,
   voMetaOf,
@@ -110,6 +111,32 @@ export {
   type ConflictPolicy,
   type ConflictRule,
 } from "./conflicts.js";
+export {
+  intent,
+  language,
+  isBusinessIntent,
+  isApplicationLanguage,
+  applicationLanguageOf,
+  executableDirectivesForLanguage,
+  assertApplicationLanguageCoversAuthoredDirectives,
+  remapWorkspaceInvariantsForLanguage,
+  type BusinessIntent,
+  type IntentContract,
+  type IntentContractDeclaration,
+  type IntentStep,
+  type ApplicationLanguage,
+} from "./intent.js";
+export {
+  workspaceSharing,
+  type WorkspaceSharingOptions,
+  type WorkspaceSharingPolicy,
+  type WorkspaceSharingReceipt,
+} from "./workspace_sharing.js";
+export {
+  recipient,
+  recipientMetaOf,
+  NOMOS_RECIPIENT_BRAND,
+} from "./recipient.js";
 export {
   set,
   clear,
@@ -131,6 +158,7 @@ export {
 export { clearDirectiveId, makeClearDirective, withClearDirectives } from "./clear_directive.js";
 export {
   directive,
+  nomosImplementationDetail,
   recordObject,
   type Directive,
   type ReferentialMarker,
@@ -148,7 +176,7 @@ export {
 // — naming no id. A directive's `.plan` calls these and returns `[]` (the recorded graph is the write
 // surface). The dev never sees a "prim" — that is the GitHolon's internal OpenUSD IR.
 export { create, existing, ensure, type AggregateRef } from "./authoring.js";
-export { contract, isContractHandle, satisfiesContract, type ContractHandle, type ContractField, type ContractSatisfaction } from "./contract.js";
+export { recordContract, isContractHandle, satisfiesContract, type ContractHandle, type ContractField, type ContractSatisfaction } from "./contract.js";
 export { normalizeActivity, renderActivityTemplate, activityKey, type ActivityInput, type ActivityDescriptor, type ActivityRefInput, type ActivitySeverity } from "./activity.js";
 // The REBIRTH-boundary repair DSL (architecture/repair_dsl.md) — distinct from framework/repair.js (the
 // IN-CHAIN compensating-intent lane): repair() binds a typed replay refusal to a declared re-fold remedy.
@@ -444,22 +472,28 @@ export {
   setAuthProvider,
   authProvider,
 } from "./framework/auth_provider_law.js";
-// THE HOME HOLON (home_holons_and_cross_custody.md §4) — the identity-role law: the shared-with-me access
-// index + the owner lane to maintain it (the key directory is the `signer` relation above).
+// THE RECEIVING-GROUP HOLON — the framework-private shared signer roster + access manifest.
 export {
   SharedWithMe,
   recordShare,
   pruneShare,
   sharedByWorkspace,
-  HomeOwner,
-  HOME_OWNER_ID,
-  HOME_NAME_PREFIX,
-  HOME_NAME_HASH_LEN,
-  seedHomeOwner,
-  writeHomeOwner,
-  homeNameBindsOwner,
-  homeNameOf,
-  birthHome,
+  ReceivingGroup,
+  ReceivingGroupPolicy,
+  RECEIVING_GROUP_ID,
+  RECEIVING_GROUP_NAME_PREFIX,
+  RECEIVING_GROUP_NAME_HASH_LEN,
+  RECEIVING_GROUP_POLICY_ID,
+  DEFAULT_RECEIVING_GROUP_POLICY,
+  seedReceivingGroup,
+  seedReceivingGroupPolicy,
+  writeReceivingGroup,
+  receivingGroupNameBindsPrincipal,
+  receivingGroupRejectsKeylessAdditionalDevice,
+  receivingGroupAdditionalDeviceFollowsPolicy,
+  receivingGroupRevocationFollowsPolicy,
+  receivingGroupNameOf,
+  birthReceivingGroup,
   // THE PEER-SOVEREIGN ROOT-OF-TRUST (the BirthAttestation cert chain).
   BirthAttestation,
   BIRTH_ATTESTATION_ID,