@githolon/dsl 0.102.4 → 0.103.0

package/src/framework/signing_identity.ts

@@ -49,7 +49,7 @@ import { directive } from "../directive.js";
 import { set, withMarker, type PlannedOp } from "../ops.js";
 import { query } from "../query.js";
 import { relationType, self, key } from "../relation_schema.js";
-import { workspaceInvariant, ref } from "./workspace_invariant.js";
+import { readRef, readSet, workspaceInvariant, ref } from "./workspace_invariant.js";
 import { endorsementOf, type EndorsedAuthority } from "../principal_evidence.js";
 import {
   writeTuple,
@@ -144,7 +144,7 @@ export const advanceSignerEpoch = directive("advanceSignerEpoch")
  */
 export const signerEpochStrictlyIncreases = workspaceInvariant("SignerEpochStrictlyIncreases")
   .on("advanceSignerEpoch")
-  .reads(() => [ref("SignerEpoch", SIGNER_EPOCH_ID)])
+  .reads(readSet(readRef("signerEpoch", SignerEpoch).at(SIGNER_EPOCH_ID)))
   .assert((snap, ctx) => {
     const applied = snap["signerEpoch"] as { currentEpoch?: number } | undefined;
     const declared = Number((ctx?.intent as { epoch?: number } | undefined)?.epoch ?? NaN);
@@ -166,7 +166,7 @@ export const signerEpochStrictlyIncreases = workspaceInvariant("SignerEpochStric
  */
 export const revokeSignerEpochStrictlyIncreases = workspaceInvariant("RevokeSignerEpochStrictlyIncreases")
   .on("revokeSigner")
-  .reads(() => [ref("SignerEpoch", SIGNER_EPOCH_ID)])
+  .reads(readSet(readRef("signerEpoch", SignerEpoch).at(SIGNER_EPOCH_ID)))
   .assert((snap, ctx) => {
     const applied = snap["signerEpoch"] as { currentEpoch?: number } | undefined;
     const declared = Number((ctx?.intent as { newEpoch?: number } | undefined)?.newEpoch ?? NaN);
@@ -289,7 +289,7 @@ export const enrollSignerSelf = directive("enrollSignerSelf")
  */
 export const enrollSignerSelfRequiresVerified = workspaceInvariant("EnrollSignerSelfRequiresVerified")
   .on("enrollSignerSelf")
-  .reads(() => []) // no aggregate snapshot needed — the verdict is over the captured principal-verified flag
+  .reads(readSet()) // no aggregate snapshot needed — the verdict is over the captured principal-verified flag
   .declassify("the self-enroll gate intentionally branches on principal_verified (an authz fact, not a secret read)")
   .assert((_snap, ctx) =>
     ctx?.principalVerified === true
@@ -297,6 +297,44 @@ export const enrollSignerSelfRequiresVerified = workspaceInvariant("EnrollSigner
       : { reject: "enroll-signer-self-requires-verified-principal" },
   );
 
+// ─────────────────── THE ENROLL-ONCE DELEGATION CERT (the peer-sovereign root-of-trust) ───────────────────
+
+/**
+ * THE SIGNER DELEGATION (the enroll-once delegation cert, `executor::birth_cert`). When the TENANT verifies a
+ * user U's IdP token at U's live enroll gate, the tenant's onboarding signer `S_P` signs — ONCE — a
+ * DELEGATION CERT binding U's device key `P_U` to the tenant's lineage: a `BirthCert {founder: U,
+ * parent_key: P_U, …}` signed by `S_P`. This singleton (keyed by U) records it in the PLATFORM's folded
+ * state, so the kernel's birth offer-effect reads U's delegation by-user (trusted, not from the payload) when
+ * it assembles U's home cert chain. The cert is OPAQUE on-chain (a JSON `BirthCert`); the kernel parses +
+ * verifies it as one chain link (signed by S_P, whose pubkey is attested by the platform's own chain).
+ *
+ * SELF-BOUND / control-plane: enrolled by the tenant onboarding lane (composed into the tenant's governance
+ * law, off the open session lane), so a tenant cannot forge a delegation for a user another tenant verified.
+ * The delegation's `founder` IS the gate's binding — the kernel asserts the home cert's founder equals the
+ * delegation's founder (the crux founder-binding), so a delegation enrolled for A cannot mint a home for V.
+ *
+ * Declared before `enrollFirstDevice` because that directive's typed effect signature and optional plan arm
+ * both refer to this aggregate during module initialisation.
+ */
+export const SIGNER_DELEGATION_PREFIX = "signer-delegation:";
+export const SignerDelegation = aggregate("SignerDelegation", {
+  /** The user (a `user:<uid>` subject) this delegation enrolls — the key of the singleton. */
+  user: t.string().merge(Lww),
+  /** The user's device PUBLIC KEY (base64) the delegation binds — `P_U`, the home_cert's signer. */
+  deviceKey: t.string().merge(Lww),
+  /** THE DELEGATION CERT (JSON `executor::birth_cert::BirthCert`), signed by the tenant's `S_P`. Opaque
+   *  on-chain; the kernel parses + verifies it as the `links[1]` delegation in U's travelling chain. */
+  certJson: t.string().merge(Lww),
+  /** ISO-8601, caller-stamped (determinism — no clock in the plan). */
+  enrolledAt: t.string().merge(Lww),
+}).public();
+export type SignerDelegationHandle = typeof SignerDelegation;
+
+/** The deterministic singleton id of a user's signer delegation (the kernel reads THIS id by-user). */
+export function signerDelegationInstanceId(user: string): string {
+  return SIGNER_DELEGATION_PREFIX + user;
+}
+
 /**
  * `enrollFirstDevice` (architecture/keyless_verified_onboard.md) — THE KEYLESS VERIFIED FIRST-DEVICE
  * self-onboard. A brand-new principal (an IdP-verified user with NO enrolled signer key) bootstraps its
@@ -377,6 +415,7 @@ export const enrollFirstDevice = directive("enrollFirstDevice")
     ];
     return [...tupleOps, ...delegationOps];
   })
+  .alsoEnsures(SignerDelegation)
   // THE KEYLESS GATE DECLARATION: the carried device-bound `idpToken` IS this directive's authorization
   // (re-verified against the workspace AuthProvider on every lane), not a pre-enrolled signer. This lowers
   // the per-directive payload FIELD MAPPING into the `nomosVerifiedFirstEnroll` era key, so the KERNEL reads
@@ -417,42 +456,8 @@ export const revokeSigner = directive("revokeSigner")
       // bump the signer epoch so the revoked key ages out (the live-epoch backdate is phase 4).
       ...writeSignerEpoch(p.newEpoch),
     ];
-  });
-
-// ─────────────────── THE ENROLL-ONCE DELEGATION CERT (the peer-sovereign root-of-trust) ───────────────────
-
-/**
- * THE SIGNER DELEGATION (the enroll-once delegation cert, `executor::birth_cert`). When the TENANT verifies a
- * user U's IdP token at U's live enroll gate, the tenant's onboarding signer `S_P` signs — ONCE — a
- * DELEGATION CERT binding U's device key `P_U` to the tenant's lineage: a `BirthCert {founder: U,
- * parent_key: P_U, …}` signed by `S_P`. This singleton (keyed by U) records it in the PLATFORM's folded
- * state, so the kernel's birth offer-effect reads U's delegation by-user (trusted, not from the payload) when
- * it assembles U's home cert chain. The cert is OPAQUE on-chain (a JSON `BirthCert`); the kernel parses +
- * verifies it as one chain link (signed by S_P, whose pubkey is attested by the platform's own chain).
- *
- * SELF-BOUND / control-plane: enrolled by the tenant onboarding lane (composed into the tenant's governance
- * law, off the open session lane), so a tenant cannot forge a delegation for a user another tenant verified.
- * The delegation's `founder` IS the gate's binding — the kernel asserts the home cert's founder equals the
- * delegation's founder (the crux founder-binding), so a delegation enrolled for A cannot mint a home for V.
- */
-export const SIGNER_DELEGATION_PREFIX = "signer-delegation:";
-export const SignerDelegation = aggregate("SignerDelegation", {
-  /** The user (a `user:<uid>` subject) this delegation enrolls — the key of the singleton. */
-  user: t.string().merge(Lww),
-  /** The user's device PUBLIC KEY (base64) the delegation binds — `P_U`, the home_cert's signer. */
-  deviceKey: t.string().merge(Lww),
-  /** THE DELEGATION CERT (JSON `executor::birth_cert::BirthCert`), signed by the tenant's `S_P`. Opaque
-   *  on-chain; the kernel parses + verifies it as the `links[1]` delegation in U's travelling chain. */
-  certJson: t.string().merge(Lww),
-  /** ISO-8601, caller-stamped (determinism — no clock in the plan). */
-  enrolledAt: t.string().merge(Lww),
-}).public();
-export type SignerDelegationHandle = typeof SignerDelegation;
-
-/** The deterministic singleton id of a user's signer delegation (the kernel reads THIS id by-user). */
-export function signerDelegationInstanceId(user: string): string {
-  return SIGNER_DELEGATION_PREFIX + user;
-}
+  })
+  .alsoEnsures(SignerEpoch);
 
 /**
  * `enrollDelegation` — record a user's tenant-signed delegation cert (the enroll-once lane). The tenant's

package/src/framework/workspace_invariant.ts

@@ -35,6 +35,8 @@
  * workspace scan / projection read / ambient "current world" read — only the declared refs.
  */
 
+import type { PointGuardSpec } from "../point_guard.js";
+
 /** A TYPED verdict — identical shape to the aggregate invariant (the engine parses both). */
 export type WorkspaceInvariantVerdict = { accept: true } | { reject: string };
 
@@ -51,6 +53,240 @@ export interface InvariantRef {
   readonly id: string;
 }
 
+/** A native point-read recipe. This is authored in TypeScript, custodied as typed USDA, and
+ * interpreted by Rust. It is data, not an executable JavaScript read selector. */
+export type InvariantReadTransform = "none" | "row-key" | "stable-id";
+
+export type InvariantReadIdPart =
+  | { readonly source: "literal"; readonly value: string }
+  | { readonly source: "payload" | "item"; readonly path: readonly string[]; readonly transform: InvariantReadTransform };
+
+export type InvariantReadId =
+  | { readonly source: "literal"; readonly value: string }
+  | {
+      readonly source: "payload";
+      readonly path: readonly string[];
+      readonly prefix: string;
+      readonly suffix: string;
+      readonly optional: boolean;
+    }
+  | { readonly source: "template"; readonly parts: readonly InvariantReadIdPart[]; readonly optional: boolean };
+
+export interface InvariantReadBinding {
+  readonly binding: string;
+  readonly aggregate: string;
+  readonly state: "pre" | "post";
+  readonly eachPayloadPath?: readonly string[];
+  readonly id: InvariantReadId;
+}
+
+function readPath(path: string | readonly string[]): readonly string[] {
+  return typeof path === "string" ? path.split(".").filter(Boolean) : [...path];
+}
+
+export function idLiteral(value: string): InvariantReadIdPart {
+  return { source: "literal", value };
+}
+
+export function idPayload(
+  path: string | readonly string[],
+  transform: InvariantReadTransform = "none",
+): InvariantReadIdPart {
+  return { source: "payload", path: readPath(path), transform };
+}
+
+export function idItem(
+  path: string | readonly string[] = [],
+  transform: InvariantReadTransform = "none",
+): InvariantReadIdPart {
+  return { source: "item", path: readPath(path), transform };
+}
+
+export function idTemplate(
+  ...parts: readonly (InvariantReadIdPart | string)[]
+): readonly InvariantReadIdPart[] {
+  return parts.map((part) => typeof part === "string" ? idLiteral(part) : part);
+}
+
+const NATIVE_READ_SET = Symbol.for("nomos.workspaceInvariant.nativeReadSet.v1");
+
+type NativeReadSet = WorkspaceInvariantReads & {
+  readonly [NATIVE_READ_SET]: readonly InvariantReadBinding[];
+};
+
+function aggregateName(aggregate: { readonly id: string } | string): string {
+  return typeof aggregate === "string" ? aggregate : aggregate.id;
+}
+
+/** Begin one typed, bounded aggregate read. Prefer an aggregate handle; strings remain available
+ * for framework composition where the declaration is intentionally late-bound. */
+export function readRef(
+  binding: string,
+  aggregate: { readonly id: string } | string,
+): {
+  at(id: string): InvariantReadBinding;
+  fromPayload(path: string | readonly string[], options?: { readonly prefix?: string; readonly suffix?: string }): InvariantReadBinding;
+  fromOptionalPayload(path: string | readonly string[], options?: { readonly prefix?: string; readonly suffix?: string }): InvariantReadBinding;
+  fromTemplate(parts: readonly InvariantReadIdPart[], options?: { readonly optional?: boolean }): InvariantReadBinding;
+  forEach(
+    path: string | readonly string[],
+    parts: readonly InvariantReadIdPart[],
+    options?: { readonly optional?: boolean },
+  ): InvariantReadBinding;
+  pre(): ReturnType<typeof readRef>;
+  post(): ReturnType<typeof readRef>;
+} {
+  const build = (state: "pre" | "post") => ({
+    at(id: string): InvariantReadBinding {
+      return { binding, aggregate: aggregateName(aggregate), state, id: { source: "literal", value: id } };
+    },
+    fromPayload(
+      path: string | readonly string[],
+      options: { readonly prefix?: string; readonly suffix?: string } = {},
+    ): InvariantReadBinding {
+      return {
+        binding,
+        aggregate: aggregateName(aggregate),
+        state,
+        id: {
+          source: "payload",
+          path: readPath(path),
+          prefix: options.prefix ?? "",
+          suffix: options.suffix ?? "",
+          optional: false,
+        },
+      };
+    },
+    fromOptionalPayload(
+      path: string | readonly string[],
+      options: { readonly prefix?: string; readonly suffix?: string } = {},
+    ): InvariantReadBinding {
+      const binding = build(state).fromPayload(path, options);
+      if (binding.id.source !== "payload") return binding;
+      return { ...binding, id: { ...binding.id, optional: true } };
+    },
+    fromTemplate(
+      parts: readonly InvariantReadIdPart[],
+      options: { readonly optional?: boolean } = {},
+    ): InvariantReadBinding {
+      return {
+        binding,
+        aggregate: aggregateName(aggregate),
+        state,
+        id: { source: "template", parts: [...parts], optional: options.optional ?? false },
+      };
+    },
+    forEach(
+      path: string | readonly string[],
+      parts: readonly InvariantReadIdPart[],
+      options: { readonly optional?: boolean } = {},
+    ): InvariantReadBinding {
+      return {
+        ...build(state).fromTemplate(parts, options),
+        eachPayloadPath: readPath(path),
+      };
+    },
+    pre: () => build("pre"),
+    post: () => build("post"),
+  });
+  return build("post");
+}
+
+function valueAtPath(value: unknown, path: readonly string[]): unknown {
+  let current = value;
+  for (const part of path) {
+    if (current === null || typeof current !== "object") return undefined;
+    current = (current as Record<string, unknown>)[part];
+  }
+  return current;
+}
+
+function transformReadPart(value: string, transform: InvariantReadTransform): string {
+  if (transform === "row-key") {
+    return value.replace(/%/g, "%25").replace(/_/g, "%5F").replace(/\|/g, "%7C");
+  }
+  if (transform === "stable-id") return value.replace(/[^A-Za-z0-9.@/-]/g, "-");
+  return value;
+}
+
+function resolveTemplate(
+  parts: readonly InvariantReadIdPart[],
+  intent: Record<string, unknown>,
+  item: unknown,
+): string | undefined {
+  let result = "";
+  for (const part of parts) {
+    if (part.source === "literal") {
+      result += part.value;
+      continue;
+    }
+    const value = valueAtPath(part.source === "payload" ? intent : item, part.path);
+    if (value === undefined || value === null) return undefined;
+    if (typeof value !== "string" && typeof value !== "number") return undefined;
+    result += transformReadPart(String(value), part.transform);
+  }
+  return result;
+}
+
+/** Resolve a typed read-id expression for authoring-time probes and precondition planning.
+ * Runtime admission evaluates the custodied twin directly in Rust. */
+export function resolveInvariantReadId(
+  id: InvariantReadId,
+  intent: Record<string, unknown>,
+  item?: unknown,
+): string | undefined {
+  if (id.source === "literal") return id.value;
+  if (id.source === "payload") {
+    const value = valueAtPath(intent, id.path);
+    if (value === undefined || value === null || value === "") return id.optional ? undefined : "";
+    if (typeof value !== "string" && typeof value !== "number") return id.optional ? undefined : "";
+    return `${id.prefix}${String(value)}${id.suffix}`;
+  }
+  return resolveTemplate(id.parts, intent, item);
+}
+
+/** Declare a bounded set of generic point reads. The returned callable keeps authoring-time tests
+ * ergonomic, while the non-enumerable metadata is what the compiler lowers into USDA. */
+export function readSet(...bindings: readonly InvariantReadBinding[]): WorkspaceInvariantReads {
+  const selector = ((ctx: { intent: Record<string, unknown> }) => {
+    const refs: InvariantRef[] = [];
+    for (const binding of bindings) {
+      const repeated = binding.eachPayloadPath === undefined
+        ? [undefined]
+        : valueAtPath(ctx.intent, binding.eachPayloadPath);
+      if (!Array.isArray(repeated)) {
+        if (binding.eachPayloadPath !== undefined && binding.id.source === "template" && binding.id.optional) continue;
+        if (binding.eachPayloadPath !== undefined) continue;
+      }
+      const items: readonly unknown[] = Array.isArray(repeated) ? repeated : [undefined];
+      for (let index = 0; index < items.length; index += 1) {
+      let id = resolveInvariantReadId(binding.id, ctx.intent, items[index]);
+      if (id === undefined && binding.id.source !== "literal" && binding.id.optional) continue;
+      id ??= "";
+      refs.push({
+        name: binding.eachPayloadPath === undefined ? binding.binding : `${binding.binding}${index}`,
+        aggregate: binding.aggregate,
+        id: binding.state === "pre" ? `pre:${id}` : id,
+      });
+      }
+    }
+    return refs;
+  }) as NativeReadSet;
+  Object.defineProperty(selector, NATIVE_READ_SET, {
+    value: bindings.map((binding) => ({ ...binding })),
+    enumerable: false,
+    writable: false,
+  });
+  return selector;
+}
+
+/** Compiler-only access to a native read set. Ordinary callbacks deliberately return undefined. */
+export function nativeReadBindings(
+  reads: WorkspaceInvariantReads,
+): readonly InvariantReadBinding[] | undefined {
+  return (reads as Partial<NativeReadSet>)[NATIVE_READ_SET];
+}
+
 /** `inventory.Item` → `item`; `layout.FloorPlan` → `floorPlan` (short segment, first-lower). */
 function deriveName(aggregateType: string): string {
   const short = aggregateType.includes(".")
@@ -140,6 +376,8 @@ export interface WorkspaceInvariantDecl {
   readonly on: string;
   /** The executable declared read-set — ships in the engine bundle, NOT the manifest. */
   readonly reads: WorkspaceInvariantReads;
+  /** Typed generic read recipes lowered into USDA. Absent only for not-yet-migrated callbacks. */
+  readonly __nomosReadBindings?: readonly InvariantReadBinding[];
   /** The executable predicate — ships in the engine bundle, NOT the manifest. */
   readonly assert: WorkspaceInvariantAssert;
   /**
@@ -150,6 +388,11 @@ export interface WorkspaceInvariantDecl {
    * a secret-correlated refusal.
    */
   readonly declassify?: string;
+  /** Framework-owned evaluator whose complete semantics are part of the named kernel ABI.
+   * Tenant-authored invariants omit this and execute their sealed USDA plan. */
+  readonly __nomosEvaluator?: "birth-quota-v1" | "founder-signer-write-once-v1" | "point-guard-v1";
+  /** Typed point-state law consumed directly by the kernel when evaluator is `point-guard-v1`. */
+  readonly __nomosPointGuard?: PointGuardSpec;
   /** Framework-only provenance used to keep compiler errors on the tenant-authored surface. */
   readonly __nomosGenerated?: "directive-precondition";
   /** Brand so a plain object is never mistaken for a declaration. */
@@ -173,10 +416,12 @@ export function workspaceInvariant(id: string): {
 } {
   const finish = (directiveId: string, reads: WorkspaceInvariantReads, declassify: string | undefined) => ({
     assert(assert: WorkspaceInvariantAssert): WorkspaceInvariantDecl {
+      const readBindings = nativeReadBindings(reads);
       return {
         id,
         on: directiveId,
         reads,
+        ...(readBindings === undefined ? {} : { __nomosReadBindings: readBindings }),
         assert,
         ...(declassify !== undefined ? { declassify } : {}),
         __isWorkspaceInvariant: true as const,

package/src/framework/workspaces.ts

@@ -74,7 +74,7 @@ import { t } from "../fields.js";
 import { set, withMarker } from "../ops.js";
 import { query } from "../query.js";
 import { read } from "../read.js";
-import { workspaceInvariant, refAs, type WorkspaceInvariantVerdict } from "./workspace_invariant.js";
+import { readRef, readSet, workspaceInvariant, refAs, type WorkspaceInvariantVerdict } from "./workspace_invariant.js";
 import { writeTuple, removeTuple, RelationTuple, relationTupleInstanceId } from "./relations.js";
 import { relationType, self, user, key } from "../relation_schema.js";
 import { GENESIS_WARRANT_ID } from "./genesis.js";
@@ -143,7 +143,7 @@ export const workspaceSelfWriteOnce = workspaceInvariant("WorkspaceSelfWriteOnce
   // NEVER match the bare runtime id ⇒ the gate stays silently INERT (the #266 side-door bug,
   // 2026-06-15). Bare matches — exactly the convention the sharding invariants already fire under.
   .on("ensureWorkspaceSelf")
-  .reads(() => [refAs("self", "WorkspaceSelf", "pre:" + WORKSPACE_SELF_ID)])
+  .reads(readSet(readRef("self", WorkspaceSelf).pre().at(WORKSPACE_SELF_ID)))
   // WRITE-ONCE on the self-record's PRESENCE via `name` (not the vestigial `role`). At genesis name + role
   // were always co-written, so an existing born workspace has `name` ⇒ behaviour preserved; a fresh one has
   // neither ⇒ first set admitted.
@@ -542,15 +542,14 @@ export function buildGenesisChain(p: {
   rebornFrom?: string;
 }): string {
   const founder = "user:" + p.principal;
-  // THE ORDER-DECLARED LAW INSTALL (G3): the child installs the EXACT law the order names — bytes are NOT in
-  // the recipe (the kernel resolves them by hash from its own custody when it folds the birth, never the
-  // host). `domainHash` names the law; `domainPackageB64` stays empty here (the kernel supplies bytes-by-hash
-  // for the in-chain install). Two layers, matching the genesis bootstrap: bootstrap controller, then law.
+  // THE ORDER-DECLARED LAW INSTALL (G3): the child installs the EXACT typed USDA closures the order names.
+  // Bytes are NOT in the recipe; the kernel resolves each identity from its own custody when it folds the
+  // birth. Two layers, matching the genesis bootstrap: bootstrap controller, then law.
   const installSteps =
     p.frameworkHash && p.lawHash
       ? [
-          { domain: "bootstrap", directiveId: "installDomain", actor: founder, payload: { domainHash: p.frameworkHash }, domainHash: p.frameworkHash, domainPackageB64: "" },
-          { domain: "nomos", directiveId: "installDomain", actor: founder, payload: { domainHash: p.lawHash }, domainHash: p.lawHash, domainPackageB64: "" },
+          { domain: "bootstrap", directiveId: "installDomain", actor: founder, payload: { domainHash: p.frameworkHash }, domainHash: p.frameworkHash },
+          { domain: "nomos", directiveId: "installDomain", actor: founder, payload: { domainHash: p.lawHash }, domainHash: p.lawHash },
         ]
       : [];
   // THE LINEAGE-AUTHORIZATION BINDING (proof-friendly): the child's birthCloud records who authorized it, so
@@ -800,7 +799,8 @@ export const birthCloud = directive("birthCloud")
     // the born marker; `role` is no longer written (vestigial node-class — see WorkspaceSelf).
     ensure(WorkspaceSelf, WORKSPACE_SELF_ID).set("name", p.name);
     return [];
-  });
+  })
+  .alsoEnsures(WorkspaceSelf);
 
 /**
  * provisionWorkspace — the worker's RETURN RECEIPT: authored AFTER it physically
@@ -917,9 +917,7 @@ export const retireOwnWorkspace = directive("retireOwnWorkspace")
  *  so the read manifest is unchanged (era-/evolve-safe). */
 export const retireOwnOnly = workspaceInvariant("RetireOwnOnly")
   .on("retireOwnWorkspace")
-  .reads((ctx) => [
-    refAs("target", "CloudWorkspace", "pre:" + String((ctx?.intent ?? {}).workspaceId ?? "")),
-  ])
+  .reads(readSet(readRef("target", CloudWorkspace).pre().fromPayload("workspaceId")))
   .assert((refs, ctx) => {
     const target = (refs as { target?: { principal?: string; createdBy?: string } }).target;
     // The captured, VERIFIED author rides as a SUBJECT (`user:<uid>`); the record's creator fields
@@ -1031,9 +1029,7 @@ export const rebirthWorkspace = directive("rebirthWorkspace")
  */
 export const rebirthNotRoot = workspaceInvariant("RebirthNotRoot")
   .on("rebirthWorkspace")
-  .reads((ctx) => [
-    refAs("target", "CloudWorkspace", "pre:" + String((ctx?.intent ?? {}).workspaceId ?? "")),
-  ])
+  .reads(readSet(readRef("target", CloudWorkspace).pre().fromPayload("workspaceId")))
   .assert((refs) => {
     const target = (refs as { target?: { name?: string } }).target;
     return target?.name === "root"
@@ -1051,9 +1047,7 @@ export const rebirthNotRoot = workspaceInvariant("RebirthNotRoot")
  */
 export const rebirthRetainsLineage = workspaceInvariant("RebirthRetainsLineage")
   .on("rebirthWorkspace")
-  .reads((ctx) => [
-    refAs("target", "CloudWorkspace", "pre:" + String((ctx?.intent ?? {}).workspaceId ?? "")),
-  ])
+  .reads(readSet(readRef("target", CloudWorkspace).pre().fromPayload("workspaceId")))
   .assert((refs, ctx) => {
     const target = (refs as { target?: { parent?: string } }).target;
     const claimed = (ctx?.intent as { parent?: string } | undefined)?.parent;
@@ -1788,7 +1782,7 @@ export { RelationTuple };
  *  owner-rebind the host session-lane used to refuse — is rejected. */
 export const genesisWarrantWriteOnce = workspaceInvariant("GenesisWarrantWriteOnce")
   .on("seedGenesis")
-  .reads(() => [refAs("warrant", "GenesisWarrant", "pre:" + GENESIS_WARRANT_ID)])
+  .reads(readSet(readRef("warrant", "GenesisWarrant").pre().at(GENESIS_WARRANT_ID)))
   .assert(({ warrant }, ctx) => {
     const cur = warrant as { principal?: string; workspaceId?: string } | undefined;
     if (!cur?.principal) return { accept: true }; // virgin — genesis may seed the founding warrant
@@ -1823,7 +1817,7 @@ export const founderSignerWriteOnce = workspaceInvariant("FounderSignerWriteOnce
  *  WorkspaceSelf.role exists. Genesis births on a role-less chain; materialize births each child once. */
 export const birthCloudOnce = workspaceInvariant("BirthCloudOnce")
   .on("birthCloud")
-  .reads(() => [refAs("self", "WorkspaceSelf", "pre:" + WORKSPACE_SELF_ID)])
+  .reads(readSet(readRef("self", WorkspaceSelf).pre().at(WORKSPACE_SELF_ID)))
   // WRITE-ONCE on the self-record's PRESENCE via `name` (not the vestigial `role`) — a workspace is born once.
   .assert(({ self }) =>
     (self as { name?: string })?.name ? { reject: "cloud-already-born" } : { accept: true },
@@ -1837,7 +1831,7 @@ export const birthCloudOnce = workspaceInvariant("BirthCloudOnce")
  *  rest. (Worker authors ownerGrantHash=foundingAdminHash for platforms, sha256(freshSecret) for plain.) */
 export const provisionReceiptGuard = workspaceInvariant("ProvisionReceiptGuard")
   .on("provisionWorkspace")
-  .reads((ctx) => [refAs("ws", "CloudWorkspace", "pre:" + String((ctx.intent ?? {}).workspaceId ?? ""))])
+  .reads(readSet(readRef("ws", CloudWorkspace).pre().fromPayload("workspaceId")))
   .assert(({ ws }, ctx) => {
     const rec = ws as { status?: string; foundingAdminHash?: string } | undefined;
     if (!rec || rec.status !== "requested") return { reject: "provision-requires-requested-workspace" };
@@ -1856,7 +1850,7 @@ export const provisionReceiptGuard = workspaceInvariant("ProvisionReceiptGuard")
  *  refuses reclaiming itself; this guards children.) */
 export const reclaimRequiresRetired = workspaceInvariant("ReclaimRequiresRetired")
   .on("reclaimWorkspace")
-  .reads((ctx) => [refAs("ws", "CloudWorkspace", "pre:" + String((ctx.intent ?? {}).workspaceId ?? ""))])
+  .reads(readSet(readRef("ws", CloudWorkspace).pre().fromPayload("workspaceId")))
   .assert(({ ws }) => {
     const rec = ws as { status?: string } | undefined;
     return rec?.status === "retired" ? { accept: true } : { reject: "reclaim-requires-retired" };
@@ -1915,11 +1909,11 @@ function creationPostureVerdict(
   return { reject: "creation.invalid-posture" };
 }
 
-const creationPostureReads = () => [
-  refAs("policy", "CloudPolicy", CREATION_POLICY_ID),
-  refAs("creators", "RelationTuple", CREATOR_TUPLE_ID),
-  refAs("admins", "RelationTuple", ADMIN_TUPLE_ID),
-];
+const creationPostureReads = readSet(
+  readRef("policy", CloudPolicy).at(CREATION_POLICY_ID),
+  readRef("creators", RelationTuple).at(CREATOR_TUPLE_ID),
+  readRef("admins", RelationTuple).at(ADMIN_TUPLE_ID),
+);
 
 /** Compatibility create: open/unset ⇒ proven author; invite ⇒ creator; closed ⇒ admin. */
 export const creationPostureCreate = workspaceInvariant("CreationPostureCreate")
@@ -1961,7 +1955,7 @@ export const workspaceQuotaCreate = workspaceInvariant("WorkspaceQuota")
   .on("createWorkspace")
   // The snapshot ref-set is EMPTY — the count comes from the captured reads (ctx.reads), which the standard
   // ref-resolution cannot produce (it resolves single instances by id, never an enumeration).
-  .reads(() => [])
+  .reads(readSet())
   .assert((_snapshots, ctx) =>
     quotaVerdict(ctx?.reads ?? [], String((ctx?.intent ?? {}).principal ?? "")),
   );
@@ -1969,7 +1963,7 @@ export const workspaceQuotaCreate = workspaceInvariant("WorkspaceQuota")
 /** birthChild: the SAME count quota (a leaf or platform birth draws on the principal's allowance). */
 export const workspaceQuotaBirth = workspaceInvariant("WorkspaceQuotaBirth")
   .on("birthChild")
-  .reads(() => [])
+  .reads(readSet())
   .assert((_snapshots, ctx) =>
     quotaVerdict(ctx?.reads ?? [], String((ctx?.intent ?? {}).principal ?? "")),
   );