@githolon/dsl 0.102.4 → 0.103.0

package/src/framework/auth_provider_law.ts

@@ -13,7 +13,7 @@ import { Lww } from "../drivers.js";
 import { set, withMarker } from "../ops.js";
 import { query } from "../query.js";
 import { GENESIS_WARRANT_ID } from "./genesis.js";
-import { refAs, workspaceInvariant } from "./workspace_invariant.js";
+import { readRef, readSet, refAs, workspaceInvariant } from "./workspace_invariant.js";
 
 const epochMs = z.number().int().nonnegative();
 
@@ -135,7 +135,7 @@ export const seedAuthProvider = directive("seedAuthProvider")
 
 export const authProviderSeedBeforeWarrant = workspaceInvariant("AuthProviderSeedBeforeWarrant")
   .on("seedAuthProvider")
-  .reads(() => [refAs("warrant", "GenesisWarrant", GENESIS_WARRANT_ID)])
+  .reads(readSet(readRef("warrant", "GenesisWarrant").at(GENESIS_WARRANT_ID)))
   .assert(({ warrant }) => {
     // Missing invariant refs are represented as an empty snapshot by the executor, not necessarily null.
     const principal = (warrant as { principal?: unknown } | null | undefined)?.principal;

package/src/framework/birth_meter.ts

@@ -27,7 +27,7 @@ import { z } from "zod";
 import { instance } from "../aggregate.js";
 import { directive } from "../directive.js";
 import { set, type PlannedOp } from "../ops.js";
-import { refAs, workspaceInvariant } from "./workspace_invariant.js";
+import { readRef, readSet, refAs, workspaceInvariant } from "./workspace_invariant.js";
 import {
   BirthPolicy,
   BirthGrant,
@@ -149,9 +149,7 @@ export const reclaimChildAsAdmin = directive("reclaimChildAsAdmin")
 /** Reclaim is two-phase; a child must first be explicitly withdrawn. */
 export const reclaimChildRequiresRetired = workspaceInvariant("ReclaimChildRequiresRetired")
   .on("reclaimChild")
-  .reads((ctx) => [
-    refAs("record", "NomosChildLifecycle", "pre:" + childLifecycleId(String(ctx.intent.child ?? ""))),
-  ])
+  .reads(readSet(readRef("record", NomosChildLifecycle).pre().fromPayload("child", { prefix: "nomos-child-lifecycle:" })))
   .assert(({ record }, ctx) =>
     (record as { status?: string; principal?: string } | undefined)?.status === "retired"
       && sameLifecyclePrincipal((record as { principal?: string }).principal, ctx?.principal)
@@ -162,9 +160,7 @@ export const reclaimChildRequiresRetired = workspaceInvariant("ReclaimChildRequi
 /** Operator recovery has the same two-phase law, without depending on the broken creator credential. */
 export const reclaimChildAsAdminRequiresRetired = workspaceInvariant("ReclaimChildAsAdminRequiresRetired")
   .on("reclaimChildAsAdmin")
-  .reads((ctx) => [
-    refAs("record", "NomosChildLifecycle", "pre:" + childLifecycleId(String(ctx.intent.child ?? ""))),
-  ])
+  .reads(readSet(readRef("record", NomosChildLifecycle).pre().fromPayload("child", { prefix: "nomos-child-lifecycle:" })))
   .assert(({ record }) =>
     (record as { status?: string } | undefined)?.status === "retired"
       ? { accept: true }
@@ -174,9 +170,7 @@ export const reclaimChildAsAdminRequiresRetired = workspaceInvariant("ReclaimChi
 /** Reclaimed is permanent: retirement cannot move a child back out of the terminal state. */
 export const retireChildNotReclaimed = workspaceInvariant("RetireChildNotReclaimed")
   .on("retireChild")
-  .reads((ctx) => [
-    refAs("record", "NomosChildLifecycle", "pre:" + childLifecycleId(String(ctx.intent.child ?? ""))),
-  ])
+  .reads(readSet(readRef("record", NomosChildLifecycle).pre().fromPayload("child", { prefix: "nomos-child-lifecycle:" })))
   .assert(({ record }) =>
     (record as { status?: string } | undefined)?.status === "reclaimed"
       ? { reject: "reclaimed-child-is-terminal" }
@@ -186,9 +180,7 @@ export const retireChildNotReclaimed = workspaceInvariant("RetireChildNotReclaim
 /** Reclaimed is terminal for operator recovery too. */
 export const retireChildAsAdminNotReclaimed = workspaceInvariant("RetireChildAsAdminNotReclaimed")
   .on("retireChildAsAdmin")
-  .reads((ctx) => [
-    refAs("record", "NomosChildLifecycle", "pre:" + childLifecycleId(String(ctx.intent.child ?? ""))),
-  ])
+  .reads(readSet(readRef("record", NomosChildLifecycle).pre().fromPayload("child", { prefix: "nomos-child-lifecycle:" })))
   .assert(({ record }) =>
     (record as { status?: string } | undefined)?.status === "reclaimed"
       ? { reject: "reclaimed-child-is-terminal" }
@@ -198,9 +190,7 @@ export const retireChildAsAdminNotReclaimed = workspaceInvariant("RetireChildAsA
 /** A lifecycle cannot mint authority for arbitrary custody: retirement must name its exact birth witness. */
 export const retireChildRequiresBirth = workspaceInvariant("RetireChildRequiresBirth")
   .on("retireChild")
-  .reads((ctx) => [
-    refAs("birth", "NomosBirthRecord", "pre:" + birthRecordId(String(ctx.intent.child ?? ""))),
-  ])
+  .reads(readSet(readRef("birth", NomosBirthRecord).pre().fromPayload("child", { prefix: "nomos-birth-record:" })))
   .assert(({ birth }, ctx) => {
     const record = birth as { child?: string; principal?: string } | undefined;
     const intent = ctx?.intent as { child?: string; principal?: string } | undefined;
@@ -214,9 +204,7 @@ export const retireChildRequiresBirth = workspaceInvariant("RetireChildRequiresB
 /** Admin recovery may act for the recorded creator, but still cannot invent or retarget custody. */
 export const retireChildAsAdminRequiresBirth = workspaceInvariant("RetireChildAsAdminRequiresBirth")
   .on("retireChildAsAdmin")
-  .reads((ctx) => [
-    refAs("birth", "NomosBirthRecord", "pre:" + birthRecordId(String(ctx.intent.child ?? ""))),
-  ])
+  .reads(readSet(readRef("birth", NomosBirthRecord).pre().fromPayload("child", { prefix: "nomos-birth-record:" })))
   .assert(({ birth }, ctx) => {
     const record = birth as { child?: string; principal?: string } | undefined;
     const intent = ctx?.intent as { child?: string; principal?: string } | undefined;

package/src/framework/bootstrap.ts

@@ -16,7 +16,5 @@
 
 export {
   DomainInstallation,
-  PolicyBundle,
   installDomain,
-  policyAggregateId,
 } from "./domain_lifecycle.js";

package/src/framework/business_corrections.ts

@@ -22,8 +22,16 @@ const correctionRecord = aggregate(BUSINESS_CORRECTION_AGGREGATE, {
   correctedAt: t.string().merge(Lww),
 }).public();
 
+export const businessCorrectionRecord = {
+  ...correctionRecord,
+  businessBirthInternal: true as const,
+};
+
 const correction = directive(BUSINESS_CORRECTION_DIRECTIVE)
-  .ensures(correctionRecord)
+  // The directive's typed aggregate handle is followed by composeDomainModule. It must be the same
+  // framework-private singleton that is exported below; pointing at the unbranded construction
+  // intermediate lets that handle overwrite the branded one during typed target closure.
+  .ensures(businessCorrectionRecord)
   .payload(z.object({
     recordId: z.string().min(1),
     target: z.string().min(1),
@@ -45,10 +53,6 @@ const correction = directive(BUSINESS_CORRECTION_DIRECTIVE)
     ];
   });
 
-export const businessCorrectionRecord = {
-  ...correctionRecord,
-  businessBirthInternal: true as const,
-};
 export const recordBusinessCorrection = {
   ...correction,
   businessBirthInternal: true as const,

package/src/framework/domain_lifecycle.ts

@@ -9,10 +9,10 @@
  * The `nomos` lifecycle/controller surface.
  *
  * This is the Kubernetes CRD/API-server split in Nomos terms:
- *   * `PolicyBundle` is the content-addressed package object (`policy:{hash}.bundle`);
- *   * `DomainInstallation` is the workspace resource with spec/status/phase;
- *   * `installDomain` writes BOTH in one intent and declares the `installDomain`
- *     capability. `stageDomain` writes the same content as Pending without serving it;
+ *   * the kernel-custodied USDA closure is the content-addressed law object;
+ *   * `DomainInstallation` is the small workspace resource with spec/status/phase;
+ *   * `installDomain` writes that reference in one intent and declares the `installDomain`
+ *     capability. `stageDomain` records the same closure as Pending without serving it;
  *     `promoteDomain` and `rollbackDomain` are phase changes whose admission is judged
  *     against the staged package. This is the richer controller API; bootstrap exposes
  *     a thinner install-only intent for stage-zero.
@@ -43,16 +43,12 @@ export const DOMAIN_INSTALLATION_PHASES = [
 ] as const;
 export type DomainInstallationPhase = (typeof DOMAIN_INSTALLATION_PHASES)[number];
 
-export const PolicyBundle = aggregate("PolicyBundle", {
-  bundle: t.string().merge(Lww),
-}).public();
-
 export const DomainInstallation = aggregate("DomainInstallation", {
   "spec.domainHash": t.string().merge(Lww),
   "spec.packageHash": t.string().merge(Lww),
-  "spec.policyAggregate": t.string().merge(Lww),
   "spec.authorityScope": t.string().merge(Lww),
   "spec.installedBy": t.string().merge(Lww),
+  "spec.lawClosureIdentity": t.string().merge(Lww),
   "spec.dependencies": t.set(t.string()),
   "spec.supersedes": t.string().merge(Lww).optional(),
   "spec.finalizers": t.set(t.string()),
@@ -95,18 +91,10 @@ export const ReleaseReceipt = aggregate(RELEASE_RECEIPT_AGGREGATE, {
   acceptedAt: t.int().merge(Lww),
 }).public();
 
-export function policyAggregateId(domainHash: string): string {
-  return `policy:${domainHash}`;
-}
-
 export function domainInstallationAggregateId(domainHash: string): string {
   return `domain-installation:${domainHash}`;
 }
 
-function policyBundleInstance(domainHash: string) {
-  return instance(PolicyBundle, policyAggregateId(domainHash));
-}
-
 function domainInstallationInstance(domainHash: string) {
   return instance(DomainInstallation, domainInstallationAggregateId(domainHash));
 }
@@ -157,13 +145,15 @@ const preflightReceipt = z.object({
 });
 
 const packagePayload = {
-  domainHash: z.string(),
-  packageUsda: z.string(),
+  domainHash: lowerHex64,
   installedBy: z.string(),
+  lawClosureIdentity: lowerHex64,
   authorityScope: z.string().default("workspace/root"),
-  dependencies: z.array(z.string()).default([]),
+  // Omission means the empty set; keep that in the plan instead of encoding a composite default
+  // into canonical USDA merely to save `?? []` at runtime.
+  dependencies: z.array(z.string()).optional(),
   supersedes: z.string().optional(),
-  finalizers: z.array(z.string()).default([]),
+  finalizers: z.array(z.string()).optional(),
 };
 
 export const installDomain = directive("installDomain")
@@ -185,15 +175,13 @@ export const installDomain = directive("installDomain")
     }),
   )
   .plan((p): PlannedOp[] => {
-    const policy = policyBundleInstance(p.domainHash);
     const install = domainInstallationInstance(p.domainHash);
     const ops: PlannedOp[] = [
-      withMarker(set(policy, "bundle", p.packageUsda), "ensures"),
-      set(install, "spec.domainHash", p.domainHash),
+      withMarker(set(install, "spec.domainHash", p.domainHash), "ensures"),
       set(install, "spec.packageHash", p.domainHash),
-      set(install, "spec.policyAggregate", policyAggregateId(p.domainHash)),
       set(install, "spec.authorityScope", p.authorityScope),
       set(install, "spec.installedBy", p.installedBy),
+      set(install, "spec.lawClosureIdentity", p.lawClosureIdentity),
       set(install, "metadata.generation", 1),
       set(install, "status.phase", "Active"),
       set(install, "status.observedGeneration", 1),
@@ -231,15 +219,13 @@ export const stageDomain = directive("stageDomain")
     { message: "a staged domain package cannot supersede itself", path: ["supersedes"] },
   ))
   .plan((p): PlannedOp[] => {
-    const policy = policyBundleInstance(p.domainHash);
     const install = domainInstallationInstance(p.domainHash);
     const ops: PlannedOp[] = [
-      withMarker(set(policy, "bundle", p.packageUsda), "ensures"),
-      set(install, "spec.domainHash", p.domainHash),
+      withMarker(set(install, "spec.domainHash", p.domainHash), "ensures"),
       set(install, "spec.packageHash", p.domainHash),
-      set(install, "spec.policyAggregate", policyAggregateId(p.domainHash)),
       set(install, "spec.authorityScope", p.authorityScope),
       set(install, "spec.installedBy", p.installedBy),
+      set(install, "spec.lawClosureIdentity", p.lawClosureIdentity),
       set(install, "metadata.generation", 1),
       set(install, "status.phase", "Pending"),
       set(install, "status.observedGeneration", 0),

package/src/framework/encryption_scope.ts

@@ -146,7 +146,8 @@ export const advanceKeyEpoch = directive("advanceKeyEpoch")
       wraps: z.array(wrapEntrySchema),
     }),
   )
-  .plan((p) => writeKeyEpoch(p.scope, p.epoch, p.openedAt, p.wraps));
+  .plan((p) => writeKeyEpoch(p.scope, p.epoch, p.openedAt, p.wraps))
+  .alsoEnsuresMany(WrappedKey);
 
 /**
  * `wrapKey` — write ONE wrap (the single-member handoff). Beyond its use as a primitive,

package/src/framework/framework_aggregates.ts

@@ -36,6 +36,7 @@ import { nomosSourceFrontierEnsure } from "../attested.js";
 import * as birthMeter from "../birth_meter.js";
 import * as birthMeterEnsure from "../birth_meter_ensure.js";
 import * as birthMeterFramework from "./birth_meter.js";
+import * as businessCorrections from "./business_corrections.js";
 import * as authProviderLaw from "./auth_provider_law.js";
 import * as disclosure from "./disclosure.js";
 import * as domainLifecycle from "./domain_lifecycle.js";
@@ -59,6 +60,7 @@ const FRAMEWORK_NAMESPACES: ReadonlyArray<Record<string, unknown>> = [
   birthMeter,
   birthMeterEnsure,
   birthMeterFramework,
+  businessCorrections,
   authProviderLaw,
   disclosure,
   domainLifecycle,

package/src/framework/genesis.ts

@@ -9,18 +9,19 @@
  *
  * THE BOOTSTRAP PARADOX: the relation gate refuses a founding control-plane grant
  * on a VIRGIN chain (an empty `#admin`/`#creator`/… roster) — there is no admin yet
- * to gate the first admin. Resolved LAWFULLY (not by a host bypass): at birth the
- * host verifies the `x-nomos-auth` token ONCE and records the verified principal as
- * an in-history fact — this `GenesisWarrant`. The gate's GENESIS CLAUSE
+ * to gate the first admin. Resolved LAWFULLY (not by a host bypass): the root
+ * `seedGenesis` is signed by the self-authenticating key principal it installs; a
+ * child receives its warrant only from the kernel's already-admitted parent-birth
+ * effect and the carried birth certificate rooted at K_root. The gate's GENESIS CLAUSE
  * (`executor::genesis_admits`) then admits a founding grant on a virgin object IFF
  * the warrant binds the chain to the captured principal. Strictly additive (only an
  * otherwise-`Unauthorized` virgin grant), so every sealed chain replays unchanged.
  *
- * CONTROL-PLANE: `seedGenesis` is authored by the BIRTH DOOR (the host, after the
- * one-time token verification), NOT by the open session lane — the session lane
- * structurally refuses control-plane intents, so a tenant cannot forge a warrant for
- * a principal it does not own. The warrant is the host's recorded verification, not
- * a host authority decision: every replaying peer re-reads the chain fact.
+ * CONTROL-PLANE: `seedGenesis` is never a host assertion. At the root it carries an
+ * author block whose public key derives the claimed `key:<sha256>` principal and whose
+ * signature binds the exact workspace id. For descendants it is emitted only by the
+ * kernel after verifying the parent's admitted birth and K_root-rooted certificate.
+ * Every replaying peer re-verifies those cryptographic facts from custody.
  *
  * SINGLETON per chain: one founding principal per home/workspace, so the warrant is
  * a singleton keyed `genesis-warrant:self`. `seedGenesis` is create-once — a second
@@ -32,7 +33,7 @@ import { t } from "../fields.js";
 import { Lww } from "../drivers.js";
 import { directive } from "../directive.js";
 import { set, type PlannedOp } from "../ops.js";
-import { writeTuple } from "./relations.js";
+import { RelationTuple, writeTuple } from "./relations.js";
 
 /**
  * Deterministic singleton id of the founding warrant — MUST equal
@@ -42,16 +43,16 @@ export const GENESIS_WARRANT_ID = "genesis-warrant:self";
 
 /**
  * The founding-warrant record. It does THREE jobs at once:
- *  - `principal` — the x-nomos-auth-verified OWNER (the genesis clause binds the founding grant to it);
+ *  - `principal` — the cryptographically proven founder (the genesis clause binds the founding grant to it);
  *  - `workspaceId` — this workspace's UNIQUE SELF-ID (the source binding the author signature covers,
  *    re-derived locally by the gate — NOT the shared/deterministic genesis commit, which is identical
  *    across all workspaces and so bound nothing);
  *  - its mere PRESENCE — the SIGNED-AUTHOR REGIME signal (the "era"): a workspace with a warrant
- *    REQUIRES a verified author block (forge closed); one without falls back to the legacy
- *    host-stamped principal (pre-feature chains replay green, per-position).
+ *    REQUIRES a verified author block (forge closed). A root seed proves itself against
+ *    its own workspace-bound key; descendants additionally carry their parent-attested lineage.
  */
 export const GenesisWarrant = aggregate("GenesisWarrant", {
-  principal: t.string().merge(Lww), // the x-nomos-auth-verified owner, recorded at birth
+  principal: t.string().merge(Lww), // the cryptographically proven founder, recorded at birth
   workspaceId: t.string().merge(Lww), // this workspace's unique self-id (the author-signature source binding)
   bornAt: t.string().merge(Lww), // ISO-8601, caller-stamped (determinism)
 }).public();
@@ -104,4 +105,5 @@ export const seedGenesis = directive("seedGenesis")
       grantedBy: p.principal,
       grantedAt: p.bornAt,
     }),
-  ]);
+  ])
+  .alsoEnsures(RelationTuple);

package/src/framework/home.ts

@@ -37,9 +37,9 @@ import { query } from "../query.js";
 import { birth } from "../births.js";
 import { readFrameworkDeclared } from "../read.js";
 import { authProvider as authProviderQuery, seedAuthProvider } from "./auth_provider_law.js";
-import { workspaceInvariant, refAs } from "./workspace_invariant.js";
+import { readRef, readSet, workspaceInvariant, refAs } from "./workspace_invariant.js";
 import { identityRelations } from "./signing_identity.js";
-import { writeTuple } from "./relations.js";
+import { RelationTuple, writeTuple } from "./relations.js";
 import { relationType, self, user, selfObject } from "../relation_schema.js";
 import { requireParentAttestedBirth, type ParentAttestedBirthMarker } from "../births.js";
 import { GenesisWarrant, seedGenesis } from "./genesis.js";
@@ -168,7 +168,8 @@ export function writeReceivingGroup(p: { principal: string; workspaceName: strin
 export const seedReceivingGroup = directive("nomosInternalSeedReceivingGroup7c1f5e")
   .ensures(ReceivingGroup)
   .payload(z.object({ principal: z.string().min(1), workspaceName: z.string().min(1), bornAt: z.string().min(1) }))
-  .plan((p) => writeReceivingGroup(p));
+  .plan((p) => writeReceivingGroup(p))
+  .alsoEnsures(RelationTuple);
 
 /**
  * THE SQUAT INVARIANT (home_holons §5) — a home holon's self-committed `homeName` MUST be the hash of its
@@ -180,7 +181,7 @@ export const seedReceivingGroup = directive("nomosInternalSeedReceivingGroup7c1f
  */
 export const receivingGroupNameBindsPrincipal = workspaceInvariant("ReceivingGroupNameBindsPrincipal")
   .on("nomosInternalSeedReceivingGroup7c1f5e")
-  .reads(() => [refAs("group", "NomosInternalReceivingGroup7c1f5e", RECEIVING_GROUP_ID)])
+  .reads(readSet(readRef("group", ReceivingGroup).at(RECEIVING_GROUP_ID)))
   .declassify("the receiving-group address is a public hash of its stable principal; refusing a mismatch reveals no private field")
   .assert(({ group }) => {
     const g = (group ?? {}) as { principal?: string; workspaceName?: string };
@@ -191,10 +192,10 @@ export const receivingGroupNameBindsPrincipal = workspaceInvariant("ReceivingGro
       : { reject: "a receiving group's workspace name must hash its stable principal" };
   });
 
-const receivingGroupPolicyRefs = () => [
-  refAs("group", "NomosInternalReceivingGroup7c1f5e", RECEIVING_GROUP_ID),
-  refAs("policy", "NomosInternalReceivingGroupPolicy7c1f5e", RECEIVING_GROUP_POLICY_ID),
-];
+const receivingGroupPolicyRefs = readSet(
+  readRef("group", ReceivingGroup).at(RECEIVING_GROUP_ID),
+  readRef("policy", ReceivingGroupPolicy).at(RECEIVING_GROUP_POLICY_ID),
+);
 
 /** An IdP token may bootstrap the parent before the group exists; it may never bypass an existing group's
  * device policy. A new group device must be approved by a current device or, later, guardian evidence. */
@@ -259,7 +260,7 @@ export function receivingGroupNameOf(principal: string): string {
  *      (no anonymous home birth); the offer principal IS the auth boundary (the tenant's setAuthProvider).
  *
  * The genesis chain it authors (reusing the order-declares-the-law install shape — bytes resolved by hash
- * from the parent's custody, `domainPackageB64: ""`):
+ * from the parent's typed USDA closure custody):
  *   [ bootstrap/installDomain(frameworkHash), nomos/home installDomain(lawHash), seedHomeOwner(owner, …) ]
  * `frameworkHash` (the bootstrap controller hash) + `lawHash` (the HOME law package domainHash) are
  * tenant-PINNED at their governance compile (mirroring `birthChild`) — the end-user app supplies neither;
@@ -352,11 +353,11 @@ export function birthReceivingGroupForDomain(groupLawDomain: string) {
     let certVerified = false;
     try { certVerified = p.homeCert !== undefined && JSON.parse(p.homeCert).verified === true; } catch { /* malformed cert ⇒ unverified (the gate will refuse the birth anyway) */ }
     const verifiedVia = certVerified ? apStr("issuer") : undefined;
-    const genesisChain: Array<{ domain: string; directiveId: string; actor: string; payload: Record<string, unknown>; domainHash?: string; domainPackageB64?: string }> = [
-      // THE ORDER-DECLARED LAW INSTALL: two layers, bytes-by-hash (empty package — the kernel resolves them
-      // from the parent's custody when it folds the birth; never the host). Matches buildGenesisChain's shape.
-      { domain: "bootstrap", directiveId: "installDomain", actor: founder, payload: { domainHash: p.frameworkHash }, domainHash: p.frameworkHash, domainPackageB64: "" },
-      { domain: "nomos", directiveId: "installDomain", actor: founder, payload: { domainHash: p.lawHash }, domainHash: p.lawHash, domainPackageB64: "" },
+    const genesisChain: Array<{ domain: string; directiveId: string; actor: string; payload: Record<string, unknown>; domainHash?: string }> = [
+      // THE ORDER-DECLARED LAW INSTALL: two typed closure identities. The kernel resolves each
+      // closure from the parent's custody when it folds the birth; law bytes never ride the intent.
+      { domain: "bootstrap", directiveId: "installDomain", actor: founder, payload: { domainHash: p.frameworkHash }, domainHash: p.frameworkHash },
+      { domain: "nomos", directiveId: "installDomain", actor: founder, payload: { domainHash: p.lawHash }, domainHash: p.lawHash },
       {
         domain: groupLawDomain,
         directiveId: "nomosInternalSeedReceivingGroupPolicy7c1f5e",
@@ -509,6 +510,11 @@ export const pruneShare = directive("pruneShare")
 /** "Show me everything <asserter> shared with me" — an indexed probe over the local access list. */
 export const sharedByWorkspace = query("sharedByWorkspace").key("asserterWorkspace").returns(SharedWithMe);
 
+/** "Show me every share for this protected object" — the indexed access-list probe used by generated
+ * application discovery. A home commonly has a very large installed law, so discovery must never fall back
+ * to the generic `aggregatesByType(SharedWithMe)` scan merely to find whole-workspace shares. */
+export const sharedByObject = query("sharedByObject").key("object").returns(SharedWithMe);
+
 // ─────────────────── THE PEER-SOVEREIGN ROOT-OF-TRUST (the BirthAttestation cert chain) ───────────────────
 
 /**

package/src/framework/owned_custody.ts

@@ -288,7 +288,8 @@ function ownedRecordActionDirectives(aggregate: AggregateHandle) {
           grantedAt: p.sharedAt,
         }),
         ...p.wraps.flatMap((entry) => writeWrap(recordScope(aggregate, p.recordId), entry.epoch, entry)),
-      ]),
+      ])
+      .alsoEnsures(RelationTuple),
     { businessBirthInternal: true as const },
   );
 
@@ -313,7 +314,9 @@ function ownedRecordActionDirectives(aggregate: AggregateHandle) {
           revokedAt: p.changedAt,
         }),
         ...writeKeyEpoch(recordScope(aggregate, p.recordId), p.epoch, p.changedAt, p.wraps),
-      ]),
+      ])
+      .alsoEnsures(RelationTuple)
+      .alsoEnsuresMany(WrappedKey),
     { businessBirthInternal: true as const },
   );
 
@@ -354,7 +357,10 @@ function ownedRecordActionDirectives(aggregate: AggregateHandle) {
         ops.push(...writeKeyEpoch(scope, p.epoch, p.changedAt, []));
         for (const entry of p.historicWraps) ops.push(...writeWrap(scope, entry.epoch, entry));
         return ops;
-      }),
+      })
+      .alsoEnsuresMany(RelationTuple)
+      .alsoMutates(aggregate)
+      .alsoEnsuresMany(WrappedKey),
     { businessBirthInternal: true as const },
   );
 

package/src/framework/platform_admin.ts

@@ -102,7 +102,7 @@ import { directive, type RequirableDirective } from "../directive.js";
 import { set } from "../ops.js";
 import { query, type QueryDecl } from "../query.js";
 import { writeTuple, RelationTuple } from "./relations.js";
-import { workspaceInvariant, refAs, type WorkspaceInvariantDecl } from "./workspace_invariant.js";
+import { readRef, readSet, workspaceInvariant, refAs, type WorkspaceInvariantDecl } from "./workspace_invariant.js";
 
 /** The founder singleton's stable instance id — one founder per platform workspace (`workspace:self`). */
 export const PLATFORM_FOUNDER_ID = "platform-founder:self";
@@ -215,7 +215,7 @@ export function seedPlatformAdmin(opts: SeedPlatformAdminOptions): PlatformAdmin
    */
   const platformFounderWriteOnce = workspaceInvariant(writeOnceInvariantId)
     .on(founderDirectiveId)
-    .reads(() => [refAs("prior", founderAggregateId, "pre:" + PLATFORM_FOUNDER_ID)])
+    .reads(readSet(readRef("prior", founderAggregateId).pre().at(PLATFORM_FOUNDER_ID)))
     .assert(({ prior }, ctx) => {
       const seated = (prior ?? {}) as { principal?: string };
       // WRITE-ONCE: a founder already recorded ⇒ refuse a re-seat (the seat is immutable after genesis).
@@ -260,7 +260,7 @@ export function seedPlatformAdmin(opts: SeedPlatformAdminOptions): PlatformAdmin
    */
   const platformAdminBindsFounder = workspaceInvariant(bindsInvariantId)
     .on(seatDirectiveId)
-    .reads(() => [refAs("founder", founderAggregateId, PLATFORM_FOUNDER_ID)])
+    .reads(readSet(readRef("founder", founderAggregateId).at(PLATFORM_FOUNDER_ID)))
     .assert(({ founder }, ctx) => {
       const rec = (founder ?? {}) as { principal?: string };
       const intent = (ctx?.intent ?? {}) as { founder?: string };

package/src/framework/relations.ts

@@ -15,7 +15,7 @@
  * ── The aggregate (object-keyed) ─────────────────────────────────────────────
  * `RelationTuple` is keyed `reltuple-<object>-<relation>` — ONE aggregate per
  * (object, relation) pair — carrying a `subjects: MapOf(Lww)` map of `subject → leaf`,
- * where each leaf is a JSON `{ status }` ("active" | "revoked"). The projection folds an
+ * where each leaf is a typed `RelationshipSubject` (`active` | `revoked`). The projection folds an
  * ACTIVE subject into a `relations(object, relation, subject)` row; a revoked subject
  * yields no row (Check fails closed).
  *
@@ -41,7 +41,7 @@
  */
 import { z } from "zod";
 import { aggregate, instance } from "../aggregate.js";
-import { t } from "../fields.js";
+import { t, type JsonValue } from "../fields.js";
 import { Lww, MapOf } from "../drivers.js";
 import { directive } from "../directive.js";
 import { set, setEntry, withMarker, type PlannedOp } from "../ops.js";
@@ -70,6 +70,11 @@ import { qualifyReadProjectionType } from "../read_projection_namespace.js";
 interface DispatchContext {
   /** The dispatching domain key — the qualifier (`module.domain === intent.domain`). */
   readonly domain: string;
+  /**
+   * The durable Zanzibar namespace for this domain. Canonical USDA uses the domain's stable identity
+   * (`d_<sid>`), not its mutable dispatch label. Older/test engines may omit this and retain the label.
+   */
+  readonly relationNamespace?: string;
   /** `<type>#<relation>` for every LOCAL non-global authored relation of this domain — the qualify set. */
   readonly qualifiable: ReadonlySet<string>;
   /**
@@ -122,14 +127,14 @@ function resolveTupleObject(object: string | RelationObjectToken, relation: stri
           "qualify by). Tokens (selfWorkspace()/selfObject()) resolve only inside a directive plan.",
       );
     }
-    return `${qualifyRelationType(_ctx.domain, object.type)}:${object.id}`;
+    return `${qualifyRelationType(_ctx.relationNamespace ?? _ctx.domain, object.type)}:${object.id}`;
   }
   // A PLAIN STRING is classified by `(type, relation)` against the dispatching domain's schema.
   const colon = object.indexOf(":");
   if (colon < 0 || _ctx === undefined) return object; // malformed / no context ⇒ verbatim
   const type = object.slice(0, colon);
   if (_ctx.qualifiable.has(`${type}#${relation}`)) {
-    return `${qualifyRelationType(_ctx.domain, type)}${object.slice(colon)}`;
+    return `${qualifyRelationType(_ctx.relationNamespace ?? _ctx.domain, type)}${object.slice(colon)}`;
   }
   return object; // global / unknown / per-record ⇒ BARE
 }
@@ -185,7 +190,7 @@ export function relationTupleInstanceId(object: string, relation: string): strin
  *
  *  - object    Lww (the address, materialised on first relate so the aggregate exists)
  *  - relation  Lww (the edge label)
- *  - subjects  MapOf(Lww) — subject → JSON `{status}` leaf (active drops to a tuple row)
+ *  - subjects  MapOf(Lww) — subject → typed `RelationshipSubject` runtime leaf
  */
 export const RelationTuple = aggregate("RelationTuple", {
   object: t.string().merge(Lww),
@@ -194,7 +199,7 @@ export const RelationTuple = aggregate("RelationTuple", {
 }).public();
 export type RelationTupleHandle = typeof RelationTuple;
 
-/** The per-subject leaf the `subjects` map stores (JSON-encoded). Frozen wire shape. */
+/** The per-subject leaf the `subjects` map stores as a typed kernel value. */
 export interface RelationSubjectLeaf {
   status: RelationStatus;
   grantedBy: string;
@@ -222,11 +227,11 @@ export interface RelationSubjectLeaf {
   ownedCustody?: string;
 }
 
-/** Strip undefined keys so the JSON leaf is byte-stable (no dropped-slot `"k":undefined`). */
-function compact(obj: Record<string, unknown>): RelationSubjectLeaf {
+/** Strip undefined keys so the typed leaf has one stable optional-field shape. */
+function compact(obj: Record<string, unknown>): RelationSubjectLeaf & Record<string, JsonValue> {
   const out: Record<string, unknown> = {};
   for (const [k, v] of Object.entries(obj)) if (v !== undefined) out[k] = v;
-  return out as unknown as RelationSubjectLeaf;
+  return out as RelationSubjectLeaf & Record<string, JsonValue>;
 }
 
 interface WriteTupleInput {
@@ -277,9 +282,9 @@ function lowerTuple(
   // subject's endorsement is recorded on the setEntry op so the discovery harvest lifts it into
   // nomosFlowGate.endorse; grantedBy is free attribution (materialised, not gated).
   //
-  // The captured authoring principal IS already a wire-form subject (`user:<uid>` / `key:<hash>`, the
-  // host-stamped actor — the SAME form the write gate parses via `Subject::parse`), so an endorsed
-  // authority subject lowers to that leaf verbatim and the gate's `engine.check` matches it.
+  // The captured authoring principal IS already a kernel-proven wire-form subject (`user:<uid>` /
+  // `key:<hash>` — the SAME form the write gate parses via `Subject::parse`), so an endorsed authority
+  // subject lowers to that leaf verbatim and the gate's `engine.check` matches it.
   const subjectE = endorsementOf(p.subject);
   const subjectRaw = subjectE
     ? subjectE.principal
@@ -300,7 +305,10 @@ function lowerTuple(
     verifiedVia: p.verifiedVia,
     ownedCustody: p.ownedCustody,
   });
-  const subjectEntry = setEntry(rt, "subjects", subjectRaw, JSON.stringify(leaf));
+  const subjectEntry = {
+    ...setEntry(rt, "subjects", subjectRaw, leaf),
+    kernelValue: { RelationshipSubject: leaf },
+  };
   return [
     // upsert the aggregate head (first relate creates it); without this the referential
     // gate would reject a setEntry on an absent id.