@githolon/dsl 0.101.6 → 0.102.0

package/src/evolve_preview.ts

@@ -36,6 +36,7 @@ import { domainInterface } from "./shape_compat.js";
 import type { StableIds } from "./stable_ids_types.js";
 import type { DomainModule } from "./codegen_dart.js";
 import type { WireSchema } from "./wire.js";
+import { parseUsdaDocument } from "./usd_layers.js";
 
 // ── the normalized law shape both sides of the diff speak ──────────────────────────
 
@@ -142,20 +143,10 @@ export interface DeployJson {
   packageUsda?: string;
 }
 
-/** Extract the embedded USD-IR JSON from a `.package.usda` bundle (the `nomos:usdJsonHex` field —
- *  the SAME substring contract executor/src/law58.rs::usd_json_from_package uses). */
+/** Reconstruct the effective law directly from a native `.package.usda` stage. */
 export function usdJsonFromPackage(bundle: string): unknown | undefined {
-  const key = 'nomos:usdJsonHex = "';
-  const start = bundle.indexOf(key);
-  if (start < 0) return undefined;
-  const from = start + key.length;
-  const end = bundle.indexOf('"', from);
-  if (end < 0) return undefined;
-  const hex = bundle.slice(from, end);
-  if (hex.length % 2 !== 0) return undefined;
   try {
-    const bytes = Buffer.from(hex, "hex");
-    return JSON.parse(bytes.toString("utf8"));
+    return parseUsdaDocument(bundle);
   } catch {
     return undefined;
   }

package/src/framework/application_home.ts

@@ -22,17 +22,22 @@ import {
 import { GenesisWarrant, seedGenesis } from "./genesis.js";
 import {
   BirthAttestation,
-  HomeOwner,
+  ReceivingGroup,
+  ReceivingGroupPolicy,
   SharedWithMe,
   birthAttestation,
-  birthHomeForDomain,
-  homeNameBindsOwner,
-  homeRelations,
+  birthReceivingGroupForDomain,
   parentAttestedBirth,
   pruneShare,
+  receivingGroupNameBindsPrincipal,
+  receivingGroupAdditionalDeviceFollowsPolicy,
+  receivingGroupRejectsKeylessAdditionalDevice,
+  receivingGroupRelations,
+  receivingGroupRevocationFollowsPolicy,
   recordShare,
   seedBirthAttestation,
-  seedHomeOwner,
+  seedReceivingGroup,
+  seedReceivingGroupPolicy,
   sharedByWorkspace,
 } from "./home.js";
 import { RelationTuple, relationTuplesByObject } from "./relations.js";
@@ -46,6 +51,8 @@ import {
   enrollSignerSelf,
   enrollSignerSelfRequiresVerified,
   identityRelations,
+  revokeSigner,
+  revokeSignerEpochStrictlyIncreases,
   signerDelegationByUser,
   signerEpochCurrent,
   signerEpochStrictlyIncreases,
@@ -63,11 +70,16 @@ const directive = <P>(value: Directive<P>): Internal<Directive<P>> => internal(v
 const query = (value: QueryDecl): Internal<QueryDecl> => internal(value);
 
 // Parent primitive + the law its born home uses.
-export const __nomos_birthHome = directive(birthHomeForDomain(APPLICATION_HOME_DOMAIN));
-export const __nomos_HomeOwner = aggregate(HomeOwner);
-export const __nomos_seedHomeOwner = directive(seedHomeOwner);
-export const __nomos_homeNameBindsOwner = internal(homeNameBindsOwner);
-export const __nomos_homeRelations = internal(homeRelations);
+export const __nomos_birthReceivingGroup = directive(birthReceivingGroupForDomain(APPLICATION_HOME_DOMAIN));
+export const __nomos_ReceivingGroup = aggregate(ReceivingGroup);
+export const __nomos_seedReceivingGroup = directive(seedReceivingGroup);
+export const __nomos_ReceivingGroupPolicy = aggregate(ReceivingGroupPolicy);
+export const __nomos_seedReceivingGroupPolicy = directive(seedReceivingGroupPolicy);
+export const __nomos_receivingGroupNameBindsPrincipal = internal(receivingGroupNameBindsPrincipal);
+export const __nomos_receivingGroupRejectsKeylessAdditionalDevice = internal(receivingGroupRejectsKeylessAdditionalDevice);
+export const __nomos_receivingGroupAdditionalDeviceFollowsPolicy = internal(receivingGroupAdditionalDeviceFollowsPolicy);
+export const __nomos_receivingGroupRevocationFollowsPolicy = internal(receivingGroupRevocationFollowsPolicy);
+export const __nomos_receivingGroupRelations = internal(receivingGroupRelations);
 
 // Subject-side discovery/share custody.
 export const __nomos_SharedWithMe = aggregate(SharedWithMe);
@@ -89,6 +101,8 @@ export const __nomos_enrollSigner = directive(enrollSigner);
 export const __nomos_enrollFirstDevice = directive(enrollFirstDevice);
 export const __nomos_enrollSignerSelf = directive(enrollSignerSelf);
 export const __nomos_enrollSignerSelfRequiresVerified = internal(enrollSignerSelfRequiresVerified);
+export const __nomos_revokeSigner = directive(revokeSigner);
+export const __nomos_revokeSignerEpochStrictlyIncreases = internal(revokeSignerEpochStrictlyIncreases);
 export const __nomos_SignerEpoch = aggregate(SignerEpoch);
 export const __nomos_signerEpochCurrent = query(signerEpochCurrent);
 export const __nomos_advanceSignerEpoch = directive(advanceSignerEpoch);

package/src/framework/capability.ts

@@ -175,6 +175,17 @@ export function capability<
     Object.entries(receipt).map(([k, f]) => [k, f.zod]),
   ) as { [K in keyof Rec]: Rec[K]["zod"] };
   const receiptEntries = Object.entries(receipt) as [string, Field][];
+  const decodeReceipt = (resultRef: string): Record<string, unknown> => {
+    const decoded = JSON.parse(resultRef) as unknown;
+    if (decoded === null || typeof decoded !== "object" || Array.isArray(decoded)) {
+      throw new Error("a typed capability receipt must encode a JSON object");
+    }
+    const values = decoded as Record<string, unknown>;
+    for (const [k, f] of receiptEntries) {
+      if (values[k] !== undefined) f.zod.parse(values[k]);
+    }
+    return values;
+  };
 
   const quartet = impureCapability({
     aggregateId,
@@ -198,8 +209,11 @@ export function capability<
     // discipline), present keys must validate.
     ...(receiptEntries.length > 0
       ? {
+          completeResultSchema: z.string().refine((value) => {
+            try { decodeReceipt(value); return true; } catch { return false; }
+          }, "must encode a valid typed capability receipt JSON object"),
           completeResult: (taskId: string, resultRef: string): PlannedOp[] => {
-            const decoded = JSON.parse(resultRef) as Record<string, unknown>;
+            const decoded = decodeReceipt(resultRef);
             const ops: PlannedOp[] = [];
             for (const [k, f] of receiptEntries) {
               if (decoded[k] === undefined) continue;

package/src/framework/domain_lifecycle.ts

@@ -23,6 +23,14 @@ import { Lww, MapOf } from "../drivers.js";
 import { attributionField, t } from "../fields.js";
 import { directive } from "../directive.js";
 import { set, withMarker, addToSet, type PlannedOp } from "../ops.js";
+import { key, relationType, self, user } from "../relation_schema.js";
+
+/** Framework-global authority to install or roll out a model in this workspace.
+ * The verified founder receives the first leaf in `seedGenesis`; every later
+ * delegation remains an ordinary, replayable Zanzibar edge. */
+export const modelLifecycleRelations = relationType("workspace")
+  .asGlobal()
+  .relation("installDomain", { rewrite: self(), allow: [user(), key()] });
 
 export const DOMAIN_INSTALLATION_PHASES = [
   "Pending",

package/src/framework/framework_aggregates.ts

@@ -36,13 +36,13 @@ import { nomosSourceFrontierEnsure } from "../attested.js";
 import * as birthMeter from "../birth_meter.js";
 import * as birthMeterEnsure from "../birth_meter_ensure.js";
 import * as birthMeterFramework from "./birth_meter.js";
+import * as authProviderLaw from "./auth_provider_law.js";
 import * as disclosure from "./disclosure.js";
 import * as domainLifecycle from "./domain_lifecycle.js";
 import * as encryptionIdentity from "./encryption_identity.js";
 import * as encryptionScope from "./encryption_scope.js";
 import * as genesis from "./genesis.js";
 import * as home from "./home.js";
-import * as identity from "./identity.js";
 import * as ownedCustody from "./owned_custody.js";
 import * as relations from "./relations.js";
 import * as repair from "./repair.js";
@@ -59,13 +59,13 @@ const FRAMEWORK_NAMESPACES: ReadonlyArray<Record<string, unknown>> = [
   birthMeter,
   birthMeterEnsure,
   birthMeterFramework,
+  authProviderLaw,
   disclosure,
   domainLifecycle,
   encryptionIdentity,
   encryptionScope,
   genesis,
   home,
-  identity,
   ownedCustody,
   relations,
   repair,

package/src/framework/genesis.ts

@@ -32,6 +32,7 @@ import { t } from "../fields.js";
 import { Lww } from "../drivers.js";
 import { directive } from "../directive.js";
 import { set, type PlannedOp } from "../ops.js";
+import { writeTuple } from "./relations.js";
 
 /**
  * Deterministic singleton id of the founding warrant — MUST equal
@@ -94,4 +95,13 @@ export const seedGenesis = directive("seedGenesis")
       bornAt: z.string().min(1),
     }),
   )
-  .plan((p) => writeGenesisWarrant(p));
+  .plan((p) => [
+    ...writeGenesisWarrant(p),
+    ...writeTuple({
+      object: "workspace:self",
+      relation: "installDomain",
+      subject: /^(user|key):/.test(p.principal) ? p.principal : `user:${p.principal}`,
+      grantedBy: p.principal,
+      grantedAt: p.bornAt,
+    }),
+  ]);

package/src/framework/home.ts

@@ -25,13 +25,13 @@
  * the result, and the owner-authored lane to maintain it.)
  */
 import { z } from "zod";
-import { aggregate, instance } from "../aggregate.js";
+import { aggregate, instance, OWNED_READ_RELATION } from "../aggregate.js";
 // The device-key-hash wire shape (same validator signing_identity/workspaces use module-locally).
 const sha256Hex = z.string().regex(/^[0-9a-f]{64}$/, "expected lowercase sha256 hex (the owner's device pubkey hash)");
 import { t } from "../fields.js";
 import { Lww } from "../drivers.js";
 import { directive } from "../directive.js";
-import { create } from "../authoring.js";
+import { ensure } from "../authoring.js";
 import { set, type PlannedOp } from "../ops.js";
 import { query } from "../query.js";
 import { birth } from "../births.js";
@@ -43,6 +43,7 @@ import { writeTuple } from "./relations.js";
 import { relationType, self, user, selfObject } from "../relation_schema.js";
 import { requireParentAttestedBirth, type ParentAttestedBirthMarker } from "../births.js";
 import { GenesisWarrant, seedGenesis } from "./genesis.js";
+import { idOf } from "../value_object.js";
 
 // `nomos.sha256` — the TRUSTLESS, pure hash computed IN the githolon (Rust sha2 bound in the sealed engine;
 // see deterministic-rquickjs). Available as a global to plans + invariant predicates (like `nomos.mint`); it
@@ -60,56 +61,96 @@ export { identityRelations };
 export { GenesisWarrant, seedGenesis };
 
 /**
- * THE HOME OWNER (home_holons §5 — the owner stamp). A home holon is born UNWARRANTED (the subject may
- * never have logged in — a share can be delivered to a stranger's lazily-born home, before they hold any
- * device key, so there is no signed-author regime yet). This singleton records WHO the home belongs to: the
- * §3 cross-custody gate binds a delivered quote's subject to THIS principal (`executor::HOME_OWNER_ID`), so
- * a quote signed for anyone else fails closed. Seeded ONCE at birth by the host (the control-plane
- * `seedHomeOwner`, kept off the open session lane), so a tenant cannot forge ownership.
+ * THE RECEIVING GROUP — one sovereign framework identity whose enrolled devices clone this same holon.
+ * It is not a tenant Person, an IdP account or a host-owned account. The native global
+ * `identity:<principal>#signer@key:<hash>` relation is its device roster; this singleton binds the group's
+ * stable principal to the workspace that carries that roster and its access manifest.
+ *
+ * The wire identifiers are deliberately obscure framework names. Tenant business packages may model their
+ * own `ReceivingGroup`, `home` or `group` concepts without silently colliding with this implementation.
  */
-export const HOME_OWNER_ID = "home-owner:self";
-/** A home holon's SELF-COMMITTED NAME prefix — `home-<sha256(subject)>` (the client's `homeNameOf` + the
- *  squat invariant both derive it). The home's chain commits to its own routing name, so the bailiff can
- *  bind the name to the CONTENT (custody) while the LAW guarantees the name hashes its owner. */
-export const HOME_NAME_PREFIX = "home-";
-export const HOME_NAME_HASH_LEN = 40;
-export const HomeOwner = aggregate("HomeOwner", {
-  /** The identity this home belongs to — the canonical `user:<uid>` subject the §3 gate binds quotes to. */
+export const RECEIVING_GROUP_ID = "nomos-internal-receiving-group-7c1f5e:self";
+/** A receiving group's self-committed workspace-name prefix. */
+export const RECEIVING_GROUP_NAME_PREFIX = "nomos-rg-";
+export const RECEIVING_GROUP_NAME_HASH_LEN = 40;
+export const RECEIVING_GROUP_POLICY_ID = "nomos-internal-receiving-group-policy-7c1f5e:self";
+export const ReceivingGroup = aggregate("NomosInternalReceivingGroup7c1f5e", {
+  /** The stable Zanzibar principal represented by this group. Credentials may locate it but do not own it. */
   principal: t.string().merge(Lww),
-  /** THE HOME'S SELF-COMMITTED NAME (`home-<sha256(principal)>`) — the squat invariant asserts it hashes the
-   *  owner, so the chain's claimed name can ONLY be its rightful owner's slot (home_holons §5). */
-  homeName: t.string().merge(Lww),
+  /** The group's self-committed workspace name, deterministically bound to its stable principal. */
+  workspaceName: t.string().merge(Lww),
   /** ISO-8601, caller-stamped (determinism — no clock in the plan). */
   bornAt: t.string().merge(Lww),
-}).public();
+}, { cap: 1 }).public();
 
 /**
- * THE HOME-OWNER RELATION (the ReBAC authority spine, co2 ask #1). The {@link HomeOwner} aggregate is the
- * ownership RECORD; this relation is the AUTHORIZATION spine a tenant can compute from. `seedHomeOwner` seats
- * `(home:self, homeOwner, user:<owner>)` ATOMICALLY inside the same child genesis (before the warrant closes
- * bootstrap), so a canonical `birthHome` yields a home whose owner passes role gates from intent 0 — a tenant
- * declares `projectCreator = computed(homeOwner)` WITHOUT copying birth mechanics. Self-bound (object `home:
- * self`, subject the owner) — the {@link homeNameBindsOwner} squat invariant already proves the owner is the
- * rightful one, so no separate grant is needed.
+ * The framework-owned device lifecycle policy for one receiving group. This is deliberately data, not a
+ * client-side branch: every peer replays the same rule. The first supported posture is intentionally small
+ * and secure: a live, verified device may add or revoke another device; keyless IdP enrolment is only the
+ * pre-group bootstrap lane; all-device-loss recovery requires guardians and remains fail-closed until that
+ * proof ceremony is installed.
  */
-export const homeRelations = relationType("home").relation("homeOwner", {
+export const ReceivingGroupPolicy = aggregate("NomosInternalReceivingGroupPolicy7c1f5e", {
+  additionalDevice: t.string().merge(Lww),
+  revocation: t.string().merge(Lww),
+  recovery: t.string().merge(Lww),
+  guardianQuorum: t.int().merge(Lww),
+  setAt: t.string().merge(Lww),
+}, { cap: 1 }).public();
+
+export const DEFAULT_RECEIVING_GROUP_POLICY = {
+  additionalDevice: "current-device",
+  revocation: "current-device",
+  recovery: "guardian-quorum",
+  guardianQuorum: 1,
+} as const;
+
+function writeReceivingGroupPolicy(p: { setAt: string }): PlannedOp[] {
+  const policy = instance(ReceivingGroupPolicy, RECEIVING_GROUP_POLICY_ID);
+  return [
+    set(policy, "additionalDevice", DEFAULT_RECEIVING_GROUP_POLICY.additionalDevice),
+    set(policy, "revocation", DEFAULT_RECEIVING_GROUP_POLICY.revocation),
+    set(policy, "recovery", DEFAULT_RECEIVING_GROUP_POLICY.recovery),
+    set(policy, "guardianQuorum", DEFAULT_RECEIVING_GROUP_POLICY.guardianQuorum),
+    set(policy, "setAt", p.setAt),
+  ];
+}
+
+/** Genesis-only default policy. Policy changes become a separate, guardian-aware ceremony. */
+export const seedReceivingGroupPolicy = directive("nomosInternalSeedReceivingGroupPolicy7c1f5e")
+  .ensures(ReceivingGroupPolicy)
+  .payload(z.object({ setAt: z.string().min(1) }))
+  .plan((p) => writeReceivingGroupPolicy(p));
+
+/**
+ * The group's controller relation binds its stable principal inside the same genesis. Business representation
+ * remains separate Zanzibar edges; this relation only establishes who controls this receiving-group holon.
+ */
+export const receivingGroupRelations = relationType("nomos.internal.receiving-group.7c1f5e").relation("controller", {
   rewrite: self(),
   allow: [user()],
 });
 
-/** The framework PRIMITIVE plan: stamp the home's owner + its self-committed name (singleton at the fixed id),
- *  AND atomically seat the canonical `homeOwner` relation tuple for the same self-bound principal (co2 #1). */
-export function writeHomeOwner(p: { principal: string; homeName: string; bornAt: string }): PlannedOp[] {
-  const h = instance(HomeOwner, HOME_OWNER_ID);
+/** Stamp the receiving group and atomically seat its controller relation. */
+export function writeReceivingGroup(p: { principal: string; workspaceName: string; bornAt: string }): PlannedOp[] {
+  const h = instance(ReceivingGroup, RECEIVING_GROUP_ID);
   return [
     set(h, "principal", p.principal),
-    set(h, "homeName", p.homeName),
+    set(h, "workspaceName", p.workspaceName),
     set(h, "bornAt", p.bornAt),
-    // ATOMIC ReBAC seat — the owner subject is the canonical `user:<uid>` on HomeOwner.principal; grantedBy is
-    // the owner itself (self-bound, no external granter) and grantedAt rides the caller-stamped bornAt.
     ...writeTuple({
-      object: selfObject(homeRelations),
-      relation: "homeOwner",
+      object: selfObject(receivingGroupRelations),
+      relation: "controller",
+      subject: p.principal,
+      grantedBy: p.principal,
+      grantedAt: p.bornAt,
+    }),
+    // A device clones the encrypted workspace before record-level ownership can be evaluated locally.
+    // Seat the group's controller for that ciphertext transport in the same genesis; individual owned
+    // records still require their own per-record reader edge before they decrypt or appear in reads.
+    ...writeTuple({
+      object: "workspace:self",
+      relation: OWNED_READ_RELATION,
       subject: p.principal,
       grantedBy: p.principal,
       grantedAt: p.bornAt,
@@ -118,16 +159,12 @@ export function writeHomeOwner(p: { principal: string; homeName: string; bornAt:
 }
 
 /**
- * `seedHomeOwner` — the genesis directive that stamps the home's owner + its self-committed `homeName` at
- * the fixed singleton id. It is authored by the birth/genesis chain and structurally refused on the open
- * session lane. `.ensures` (a deterministic-keyed singleton). The `homeName`
- * is caller-supplied but the {@link homeNameBindsOwner} invariant proves it `== home-<sha256(principal)>`,
- * so a squatter cannot claim a name slot that doesn't hash to ITS own owner.
+ * Genesis-only receiving-group stamp. The name is caller-supplied but the invariant below re-derives it.
  */
-export const seedHomeOwner = directive("seedHomeOwner")
-  .ensures(HomeOwner)
-  .payload(z.object({ principal: z.string().min(1), homeName: z.string().min(1), bornAt: z.string().min(1) }))
-  .plan((p) => writeHomeOwner(p));
+export const seedReceivingGroup = directive("nomosInternalSeedReceivingGroup7c1f5e")
+  .ensures(ReceivingGroup)
+  .payload(z.object({ principal: z.string().min(1), workspaceName: z.string().min(1), bornAt: z.string().min(1) }))
+  .plan((p) => writeReceivingGroup(p));
 
 /**
  * THE SQUAT INVARIANT (home_holons §5) — a home holon's self-committed `homeName` MUST be the hash of its
@@ -137,22 +174,62 @@ export const seedHomeOwner = directive("seedHomeOwner")
  * never by a host check. The host only routes the chain to the name it commits to (custody). `nomos.sha256`
  * re-derives the hash in-law on every peer, so the verdict is identical everywhere.
  */
-export const homeNameBindsOwner = workspaceInvariant("HomeNameBindsOwner")
-  .on("seedHomeOwner")
-  .reads(() => [refAs("owner", "HomeOwner", HOME_OWNER_ID)])
-  .assert(({ owner }) => {
-    const o = (owner ?? {}) as { principal?: string; homeName?: string };
-    const expected = HOME_NAME_PREFIX + nomos.sha256(String(o.principal ?? "")).slice(0, HOME_NAME_HASH_LEN);
-    return o.homeName === expected
+export const receivingGroupNameBindsPrincipal = workspaceInvariant("ReceivingGroupNameBindsPrincipal")
+  .on("nomosInternalSeedReceivingGroup7c1f5e")
+  .reads(() => [refAs("group", "NomosInternalReceivingGroup7c1f5e", RECEIVING_GROUP_ID)])
+  .assert(({ group }) => {
+    const g = (group ?? {}) as { principal?: string; workspaceName?: string };
+    const expected = RECEIVING_GROUP_NAME_PREFIX
+      + nomos.sha256(String(g.principal ?? "")).slice(0, RECEIVING_GROUP_NAME_HASH_LEN);
+    return g.workspaceName === expected
       ? { accept: true }
-      : { reject: "a home's name must hash its owner (home-<sha256(principal)>) — refusing a squatted home" };
+      : { reject: "a receiving group's workspace name must hash its stable principal" };
   });
 
-/** Re-derive a subject's home slot name IN-LAW (`home-<sha256(subject)>`) — the SAME formula the client's
- *  `homeNameOf` and the {@link homeNameBindsOwner} invariant use. `nomos.sha256` is the trustless pure hash
- *  bound in the sealed engine, so every replaying peer derives the identical name. */
-export function homeNameOf(subject: string): string {
-  return HOME_NAME_PREFIX + nomos.sha256(String(subject)).slice(0, HOME_NAME_HASH_LEN);
+const receivingGroupPolicyRefs = () => [
+  refAs("group", "NomosInternalReceivingGroup7c1f5e", RECEIVING_GROUP_ID),
+  refAs("policy", "NomosInternalReceivingGroupPolicy7c1f5e", RECEIVING_GROUP_POLICY_ID),
+];
+
+/** An IdP token may bootstrap the parent before the group exists; it may never bypass an existing group's
+ * device policy. A new group device must be approved by a current device or, later, guardian evidence. */
+export const receivingGroupRejectsKeylessAdditionalDevice = workspaceInvariant("ReceivingGroupRejectsKeylessAdditionalDevice")
+  .on("enrollFirstDevice")
+  .reads(receivingGroupPolicyRefs)
+  .assert(({ group }) => typeof group?.principal !== "string" || group.principal.length === 0
+    ? { accept: true }
+    : { reject: "receiving-group-additional-device-requires-current-device-or-guardian" });
+
+/** The shipped additional-device policy: an already enrolled, verified device signs the self-bound enrol. */
+export const receivingGroupAdditionalDeviceFollowsPolicy = workspaceInvariant("ReceivingGroupAdditionalDeviceFollowsPolicy")
+  .on("enrollSignerSelf")
+  .reads(receivingGroupPolicyRefs)
+  .declassify("device lifecycle policy intentionally branches on principal_verified")
+  .assert(({ group, policy }, ctx) => {
+    if (typeof group?.principal !== "string" || group.principal.length === 0) return { accept: true };
+    const p = policy as { additionalDevice?: string } | undefined;
+    return p?.additionalDevice === "current-device" && ctx?.principalVerified === true
+      ? { accept: true }
+      : { reject: "receiving-group-additional-device-policy-refused" };
+  });
+
+/** The shipped revocation policy: a live verified group device authors the remove-wins signer change. */
+export const receivingGroupRevocationFollowsPolicy = workspaceInvariant("ReceivingGroupRevocationFollowsPolicy")
+  .on("revokeSigner")
+  .reads(receivingGroupPolicyRefs)
+  .declassify("device lifecycle policy intentionally branches on principal_verified")
+  .assert(({ group, policy }, ctx) => {
+    if (typeof group?.principal !== "string" || group.principal.length === 0) return { accept: true };
+    const p = policy as { revocation?: string } | undefined;
+    return p?.revocation === "current-device" && ctx?.principalVerified === true
+      ? { accept: true }
+      : { reject: "receiving-group-revocation-policy-refused" };
+  });
+
+/** Re-derive a receiving group's workspace name in-law. */
+export function receivingGroupNameOf(principal: string): string {
+  return RECEIVING_GROUP_NAME_PREFIX
+    + nomos.sha256(String(principal)).slice(0, RECEIVING_GROUP_NAME_HASH_LEN);
 }
 
 /**
@@ -184,7 +261,9 @@ export function homeNameOf(subject: string): string {
  * so HomeOwner is seeded and `homeNameBindsOwner` passes (a birth without it would be an invalid, un-owned
  * home).
  */
-export const HOME_LAW_DOMAIN = "home";
+// The kernel's era-0 birth-seed resolver retains `home` as its fallback dispatch domain for standalone
+// framework laws. Compiler-composed business applications use the obscure APPLICATION_HOME_DOMAIN instead.
+export const RECEIVING_GROUP_LAW_DOMAIN = "home";
 /**
  * Build the private home-birth primitive for the domain key that carries the home law.
  *
@@ -193,10 +272,12 @@ export const HOME_LAW_DOMAIN = "home";
  * tenant remains free to model a business concept called "home". The key is closed over
  * here and written into every child-genesis step; it is never a tenant payload field.
  */
-export function birthHomeForDomain(homeLawDomain: string) {
-  if (homeLawDomain.length === 0) throw new Error("birthHomeForDomain requires a non-empty home-law domain");
-  return directive("birthHome")
-  .creates(HomeOwner) // the birth's law-declared touched type — the child's HomeOwner is what this offer seeds
+export function birthReceivingGroupForDomain(groupLawDomain: string) {
+  if (groupLawDomain.length === 0) {
+    throw new Error("birthReceivingGroupForDomain requires a non-empty receiving-group law domain");
+  }
+  return directive("nomosInternalBirthReceivingGroup7c1f5e")
+  .creates(ReceivingGroup)
   .payload(
     z.object({
       /** The identity this home belongs to (a `user:<uid>` subject). The workspace name + seeded homeName are
@@ -240,7 +321,7 @@ export function birthHomeForDomain(homeLawDomain: string) {
   )
   .plan((p) => {
     const founder = p.owner; // the actor for the child's own genesis steps (its self-bound owner subject)
-    const homeName = homeNameOf(p.owner); // workspace name == seeded homeName — derived from the SAME owner
+    const groupName = receivingGroupNameOf(p.owner);
     // THE PARENT'S DECLARED VERIFIER (one captured read serves BOTH consumers below): the inherited
     // `setAuthProvider` genesis step AND the enroll step's `verifiedVia` provenance stamp. Read it up
     // front so the enroll step (which precedes the inheritance step in the chain) can see the issuer.
@@ -270,9 +351,20 @@ export function birthHomeForDomain(homeLawDomain: string) {
       // from the parent's custody when it folds the birth; never the host). Matches buildGenesisChain's shape.
       { domain: "bootstrap", directiveId: "installDomain", actor: founder, payload: { domainHash: p.frameworkHash }, domainHash: p.frameworkHash, domainPackageB64: "" },
       { domain: "nomos", directiveId: "installDomain", actor: founder, payload: { domainHash: p.lawHash }, domainHash: p.lawHash, domainPackageB64: "" },
+      {
+        domain: groupLawDomain,
+        directiveId: "nomosInternalSeedReceivingGroupPolicy7c1f5e",
+        actor: founder,
+        payload: { setAt: p.bornAt },
+      },
       // SEED THE OWNER — the home is born OWNED; the homeNameBindsOwner invariant in the child's law proves
       // homeName == home-<sha256(owner)> at the child's own gate, so the slot can ONLY be its rightful owner's.
-      { domain: homeLawDomain, directiveId: "seedHomeOwner", actor: founder, payload: { principal: p.owner, homeName, bornAt: p.bornAt } },
+      {
+        domain: groupLawDomain,
+        directiveId: "nomosInternalSeedReceivingGroup7c1f5e",
+        actor: founder,
+        payload: { principal: p.owner, workspaceName: groupName, bornAt: p.bornAt },
+      },
       // ENROL THE OWNER'S DEVICE on the warrant-free prefix (when supplied) — enrollSigner self-binds to
       // ctx.principal() (the owner), so this binds `ownerKeyHash` as the owner's signer BEFORE the warrant
       // closes bootstrap. This is what makes the born home SIGNER-READY (able to sign + self-serve-birth its own
@@ -282,7 +374,7 @@ export function birthHomeForDomain(homeLawDomain: string) {
       // ladder: every seed runs UNSIGNED on the still-warrant-free prefix; the warrant closes it). ERA-SAFE: a
       // home born earlier (pre-feature law, no such step in its recipe) replays byte-identical — the era rule
       // rides the LAW hash, not this branch.
-      { domain: homeLawDomain, directiveId: "enrollSigner", actor: founder, payload: { keyHash: p.ownerKeyHash, grantedBy: p.owner, grantedAt: 1, ...(verifiedVia !== undefined ? { verifiedVia } : {}) } },
+      { domain: groupLawDomain, directiveId: "enrollSigner", actor: founder, payload: { keyHash: p.ownerKeyHash, grantedBy: p.owner, grantedAt: 1, ...(verifiedVia !== undefined ? { verifiedVia } : {}) } },
     ];
     // AUTHPROVIDER INHERITANCE (default ON — see the payload doc): copy the parent's declared provider
     // (the up-front captured read above) AS DATA into the child genesis. The child owns the copy as its
@@ -292,7 +384,7 @@ export function birthHomeForDomain(homeLawDomain: string) {
       const issuer = str("issuer");
       if (issuer !== undefined) {
         genesisChain.push({
-          domain: homeLawDomain,
+          domain: groupLawDomain,
           directiveId: "seedAuthProvider",
           actor: founder,
           payload: {
@@ -314,14 +406,14 @@ export function birthHomeForDomain(homeLawDomain: string) {
     // THE DECLARED BIRTH EFFECT (the unix model): the recipe rides the committed intent as a declared output
     // (captured_ports.births). The kernel — reading the `.births()` declaration off the law manifest — takes
     // the recipe and spawns + self-validates the child through the child's OWN gate (each step self-verifies).
-    birth({ workspace: homeName, genesisChain });
+    birth({ workspace: groupName, genesisChain });
     return [];
   })
   .reads(authProviderQuery) // the parent-side AuthProvider capture the inheritance copies (the #58 lane)
   .births(); // BIRTH IS A DECLARED KERNEL PRIMITIVE — emits the `nomosBirthGate` era key; the kernel folds the recipe
 }
 
-export const birthHome = birthHomeForDomain(HOME_LAW_DOMAIN);
+export const birthReceivingGroup = birthReceivingGroupForDomain(RECEIVING_GROUP_LAW_DOMAIN);
 
 /**
  * THE SHARED-WITH-ME INDEX (§5) — one record per cross-custody attestation delivered to this home holon:
@@ -345,6 +437,15 @@ export const SharedWithMe = aggregate("SharedWithMe", {
   prunedAt: t.string().merge(Lww),
 }).public();
 
+/** One idempotent access-manifest row per source edge in this home. Delivery is at-least-once: a retry,
+ * reconnect or source outbox replay must update the same bookmark rather than manufacture another thing the
+ * recipient appears to have access to. The home itself scopes the recipient, so the edge coordinate is the
+ * source workspace + protected object + granted relation. */
+export function sharedWithMeId(asserterWorkspace: string, object: string, relation: string): string {
+  const coordinate = JSON.stringify([asserterWorkspace, object, relation]);
+  return `SharedWithMe_${nomos.sha256(coordinate)}`;
+}
+
 /**
  * `recordShare` — index a cross-custody share into the home holon's access list. AUTHORED on the home
  * holon (the identity's own subject-side root). The payload carries the §3 CROSS-CUSTODY ATTESTATION — a
@@ -357,7 +458,7 @@ export const SharedWithMe = aggregate("SharedWithMe", {
  * asserter when the identity opens it (§5 fail-safe); a stale/forged quote can't enter the list at all.
  */
 export const recordShare = directive("recordShare")
-  .creates(SharedWithMe)
+  .ensures(SharedWithMe)
   .payload(
     z.object({
       asserterWorkspace: z.string().min(1),
@@ -372,7 +473,9 @@ export const recordShare = directive("recordShare")
     }),
   )
   .plan((p) => {
-    create(SharedWithMe)
+    // ENSURE, never CREATE: signed delivery is retryable and therefore at-least-once. Re-delivery (including
+    // a later re-grant after prune) refreshes this exact access edge and makes it live again.
+    ensure(SharedWithMe, sharedWithMeId(p.asserterWorkspace, p.object, p.relation))
       .set("asserterWorkspace", p.asserterWorkspace)
       .set("object", p.object)
       .set("relation", p.relation)
@@ -385,7 +488,7 @@ export const recordShare = directive("recordShare")
   // into the `nomosAttestationGate` era key) — the one gate verifies it against the home's owner (the
   // LAW-DECLARED owner-source below, NOT a kernel-hardcoded id) + pins the principal to the attestation key,
   // so the bailiff delivers it host-free to an OFFLINE subject (no device key, no author block).
-  .attestationAuthorized({ ownerObject: HOME_OWNER_ID, ownerField: "principal" });
+  .attestationAuthorized({ ownerObject: RECEIVING_GROUP_ID, ownerField: "principal" });
 
 /**
  * `pruneShare` — fail-safe drop of a hint whose forward `Check` denied (the asserter revoked it). The row
@@ -394,7 +497,7 @@ export const recordShare = directive("recordShare")
  */
 export const pruneShare = directive("pruneShare")
   .mutates(SharedWithMe)
-  .payload(z.object({ shareId: z.string().min(1), prunedAt: z.string().min(1) }))
+  .payload(z.object({ shareId: idOf(SharedWithMe), prunedAt: z.string().min(1) }))
   .plan((p) => [set(instance(SharedWithMe, p.shareId), "prunedAt", p.prunedAt)]);
 
 /** "Show me everything <asserter> shared with me" — an indexed probe over the local access list. */
@@ -485,7 +588,7 @@ export const parentAttestedBirth: ParentAttestedBirthMarker = {
   // DECLARE the owner + cert locators so the KERNEL reads them (it names neither): the home owner lives at
   // the `HomeOwner` singleton's `principal`, the travelling cert at the `BirthAttestation` singleton's
   // `certChain`. Mirrors how `.attestationAuthorized()` declares its owner-source — the kernel hardcodes none.
-  ownerObject: HOME_OWNER_ID,
+  ownerObject: RECEIVING_GROUP_ID,
   ownerField: "principal",
   certObject: BIRTH_ATTESTATION_ID,
   certField: "certChain",