@githolon/dsl 0.102.5 → 0.103.0

package/src/fields.ts

@@ -142,6 +142,74 @@ export interface EvidenceRefValue {
   storageClass: "git" | "external";
 }
 
+/** One portable address inside Nomos custody. This is identity and routing, never authority. */
+export interface NomosRefValue {
+  readonly workspace: string;
+  readonly type: string;
+  readonly id: string;
+}
+
+/** An immutable version pin plus the stable series whose law names the current version. */
+export interface VersionedNomosRefValue {
+  readonly pinned: NomosRefValue;
+  readonly series: NomosRefValue;
+}
+
+/** A SHA-256 digest encoded as exactly 64 lowercase hexadecimal characters.
+ *
+ * This is nominal at author/client compile time and remains a plain string on the
+ * wire. Construct values through {@link sha256Digest}; never cast a string into it.
+ */
+export type Sha256Digest = string & { readonly __nomosSha256Digest: unique symbol };
+
+/** Codegen marker for the semantic SHA-256 string type. The marker is deliberately
+ * non-enumerable: Zod remains the runtime/admission schema, while emitters recover
+ * the stronger client type without adding a parallel manifest representation. */
+export const NOMOS_SHA256_DIGEST_BRAND: unique symbol = Symbol.for("nomos.sha256Digest");
+
+const SHA256_DIGEST_RE = /^[0-9a-f]{64}$/;
+
+/** Declare and validate a lowercase hexadecimal SHA-256 digest payload value. */
+export function sha256Digest(): z.ZodType<Sha256Digest> {
+  const schema = z.string().regex(SHA256_DIGEST_RE, "expected a lowercase hexadecimal SHA-256 digest");
+  Object.defineProperty(schema, NOMOS_SHA256_DIGEST_BRAND, { value: true, enumerable: false });
+  return schema as unknown as z.ZodType<Sha256Digest>;
+}
+
+/** Recover the SHA-256 semantic marker through omission/null wrappers. */
+export function isSha256DigestSchema(schema: z.ZodTypeAny): boolean {
+  let current: z.ZodTypeAny | undefined = schema;
+  for (let hops = 0; current !== undefined && hops < 16; hops++) {
+    if ((current as unknown as Record<symbol, unknown>)[NOMOS_SHA256_DIGEST_BRAND] === true) {
+      return true;
+    }
+    const raw = current as unknown as {
+      _def?: { type?: unknown; innerType?: z.ZodTypeAny };
+      def?: { type?: unknown; innerType?: z.ZodTypeAny };
+    };
+    const def = raw._def ?? raw.def;
+    const kind = def?.type;
+    const name = (current as unknown as { _def?: { typeName?: string } })._def?.typeName;
+    if (kind !== "optional" && kind !== "default" && kind !== "nullable" &&
+        name !== "ZodOptional" && name !== "ZodDefault" && name !== "ZodNullable") {
+      return false;
+    }
+    current = def?.innerType;
+  }
+  return false;
+}
+
+export const nomosRefValueSchema: z.ZodType<NomosRefValue> = z.object({
+  workspace: z.string().min(1),
+  type: z.string().min(1),
+  id: z.string().min(1),
+}).strict();
+
+export const versionedNomosRefValueSchema: z.ZodType<VersionedNomosRefValue> = z.object({
+  pinned: nomosRefValueSchema,
+  series: nomosRefValueSchema,
+}).strict();
+
 /** The Zod schema for an authored `EvidenceRefValue` — the single source of truth. */
 export const evidenceRefSchema: z.ZodType<EvidenceRefValue> = z.object({
   hash: z.string(),
@@ -174,6 +242,8 @@ export type ValueObjectFieldDescriptor =
   | {
       readonly type: "string";
       readonly brand?: string;
+      /** A framework semantic string whose generated client type validates its canonical spelling. */
+      readonly digest?: "sha256";
       readonly idOf?: string;
       /** Present only for an `idOf(recordContract(...))` target. Aggregate is the default. */
       readonly idOfContract?: true;
@@ -285,6 +355,9 @@ export interface Field<T = unknown, K extends FieldKind = FieldKind> {
    *  absent the clear lane is ungated (and `law_check` WARNs if sibling writes ARE gated). Compose/codegen
    *  metadata — the REAL law is the generated directive's `requiresRelationGate` (hashed there, not here). */
   readonly clearRequires?: string;
+  /** Static Zanzibar object paired with `clearRequires`. Non-workspace clear lanes must state this so
+   *  generated directives cannot silently fall back to the wrong authorization namespace. */
+  readonly clearRequiresObject?: string;
   /** For `t.ref` cross-workspace edges: the foreign workspace id, if any. */
   readonly refWorkspace?: string;
   /**
@@ -306,6 +379,21 @@ export interface Field<T = unknown, K extends FieldKind = FieldKind> {
      *  the target's concrete implementation. */
     readonly targetIsContract?: boolean;
   };
+  /** First-class atomic custody address. Kept in the reference kind so query/read routing remains a ref. */
+  readonly nomosRef?: {
+    readonly targetAggregateId: string;
+    readonly targetIsContract?: boolean;
+  };
+  /** Immutable publication pin + stable series, with the current pointer selected by compiled law. */
+  readonly versionedForeignRef?: {
+    readonly targetAggregateId: string;
+    readonly targetIsContract?: boolean;
+    readonly seriesAggregateId: string;
+    readonly seriesIsContract?: boolean;
+    readonly currentField: string;
+    /** Owning domain for cross-domain target, series and current-field law references. */
+    readonly targetDomain?: string;
+  };
   /** For `t.ref` (the target) AND `t.hasMany` (the child type): the related aggregate's wire id. */
   readonly refAggregateId?: string;
   /** For `t.hasMany(Child).via(backref)`: the back-reference field NAME on the child. Virtual. */
@@ -399,6 +487,8 @@ export interface Field<T = unknown, K extends FieldKind = FieldKind> {
    * Flag named `isMeta` — the `meta()` METHOD sets it, mirroring `encrypted()`/`optional()`.
    */
   readonly isMeta?: true;
+  /** ZD6 — this encrypted field carries a blind-index equality token (the `blindIndexed()` METHOD sets it). */
+  readonly isBlindIndexed?: true;
   /**
    * THE INTEGRITY/CONFIDENTIALITY FACET (security_model.md — the endorse model). Set by the
    * `authorityField`/`attributionField`/`standingField`/`secretField`/`publicField` wrappers (or the
@@ -418,6 +508,15 @@ export interface Field<T = unknown, K extends FieldKind = FieldKind> {
   withFacet<Fa extends FieldFacet>(facet: Fa): Field<T, K> & { readonly facet: Fa };
   /** Mark this field's value ENCRYPTED (sets {@link Field.isEncrypted}). Chainable + non-destructive. */
   encrypted(): Field<T, K>;
+  /**
+   * ZD6 BLIND INDEX (encrypted_merge_model.md — the CipherSweet pattern): opt THIS encrypted field
+   * into EDGE-SERVED EQUALITY lookups. The sealing client attaches a scope-key-derived HMAC token
+   * (`bidx`) beside the ciphertext; key holders compute the same token query-side; the operator can
+   * observe equality/frequency among the opted-in rows but can never invert a token. Requires
+   * `.encrypted()` (aggregate() refuses otherwise) — a DELIBERATE, DECLARED equality leak, rotated
+   * with the scope epoch. Sets {@link Field.isBlindIndexed}.
+   */
+  blindIndexed(): Field<T, K>;
   /** Keep AUTHOR PROVENANCE beside this field's folded value (sets {@link Field.isAttributed}) —
    *  `<field>Provenance` accessors are generated on the read models. Lww-class scalars only. */
   attributed(): Field<T, K>;
@@ -441,7 +540,7 @@ export interface Field<T = unknown, K extends FieldKind = FieldKind> {
   withNull(semantic: NullSemantic, reason?: string): Field<T, K>;
   /** INTERNAL (`t.clearable` calls this): mark this field EXPLICIT-CLEARABLE (sets {@link Field.isClearable}
    *  + optional {@link Field.clearRequires}). Threaded through merge/optional like every other flag. */
-  clearable(requires?: string): Field<T, K> & { readonly isClearable: true };
+  clearable(requires?: string, object?: string): Field<T, K> & { readonly isClearable: true };
   /** Declare how values authored by an earlier field contract become this field's current
    * business value. With no function, the compiler proves identity widening. With a function,
    * the source must be finite (enum/boolean/literal union), so Nomos can exhaustively compile
@@ -458,6 +557,14 @@ function makeField<T, K extends FieldKind = FieldKind>(
   extra: {
     refWorkspace?: string;
     foreignRef?: { workspaceField: string; targetAggregateId: string; targetDomain?: string; targetIsContract?: boolean };
+    nomosRef?: { targetAggregateId: string; targetIsContract?: boolean };
+    versionedForeignRef?: {
+      targetAggregateId: string;
+      targetIsContract?: boolean;
+      seriesAggregateId: string;
+      seriesIsContract?: boolean;
+      currentField: string;
+    };
     refAggregateId?: string;
     /** LAZY target resolution — `t.ref(() => Agg)` / `t.hasMany(() => Agg)`. Breaks a BIDIRECTIONAL
      *  declaration cycle (a Parent's `hasMany(Child)` ⇄ a Child's `ref(Parent)`): the thunk is stored and
@@ -473,6 +580,7 @@ function makeField<T, K extends FieldKind = FieldKind>(
     valueObject?: ValueObjectFieldMeta;
     mapValueVo?: ValueObjectFieldMeta;
     encrypted?: true;
+    blindIndexed?: true;
     attributed?: true;
     meta?: true;
     facet?: FieldFacet;
@@ -480,6 +588,7 @@ function makeField<T, K extends FieldKind = FieldKind>(
     nullReason?: string;
     isClearable?: true;
     clearRequires?: string;
+    clearRequiresObject?: string;
     evolutions?: readonly FieldEvolutionDeclaration[];
   } = {},
 ): Field<T, K> {
@@ -493,12 +602,15 @@ function makeField<T, K extends FieldKind = FieldKind>(
     ...(extra.refWorkspace !== undefined ? { refWorkspace: extra.refWorkspace } : {}),
     ...(extra.refAggregateId !== undefined ? { refAggregateId: extra.refAggregateId } : {}),
     ...(extra.foreignRef !== undefined ? { foreignRef: extra.foreignRef } : {}),
+    ...(extra.nomosRef !== undefined ? { nomosRef: extra.nomosRef } : {}),
+    ...(extra.versionedForeignRef !== undefined ? { versionedForeignRef: extra.versionedForeignRef } : {}),
     ...(extra.viaField !== undefined ? { viaField: extra.viaField } : {}),
     ...(extra.mapValueKind !== undefined ? { mapValueKind: extra.mapValueKind } : {}),
     ...(extra.jsonShape !== undefined ? { jsonShape: extra.jsonShape } : {}),
     ...(extra.valueObject !== undefined ? { valueObject: extra.valueObject } : {}),
     ...(extra.mapValueVo !== undefined ? { mapValueVo: extra.mapValueVo } : {}),
     ...(extra.encrypted ? { isEncrypted: true as const } : {}),
+    ...(extra.blindIndexed ? { isBlindIndexed: true as const } : {}),
     ...(extra.attributed ? { isAttributed: true as const } : {}),
     ...(extra.meta ? { isMeta: true as const } : {}),
     ...(extra.fromBirth ? { isFromBirth: true as const } : {}),
@@ -506,6 +618,7 @@ function makeField<T, K extends FieldKind = FieldKind>(
     ...(extra.nullReason !== undefined ? { nullReason: extra.nullReason } : {}),
     ...(extra.isClearable ? { isClearable: true as const } : {}),
     ...(extra.clearRequires !== undefined ? { clearRequires: extra.clearRequires } : {}),
+    ...(extra.clearRequiresObject !== undefined ? { clearRequiresObject: extra.clearRequiresObject } : {}),
     ...(extra.evolutions !== undefined && extra.evolutions.length > 0
       ? { evolutions: extra.evolutions }
       : {}),
@@ -549,11 +662,12 @@ function makeField<T, K extends FieldKind = FieldKind>(
         ...(reason !== undefined ? { nullReason: reason } : {}),
       });
     },
-    clearable(requires?: string): Field<T, K> & { readonly isClearable: true } {
+    clearable(requires?: string, object?: string): Field<T, K> & { readonly isClearable: true } {
       return makeField<T, K>(kind, zod, driver, {
         ...extra,
         isClearable: true,
         ...(requires !== undefined ? { clearRequires: requires } : {}),
+        ...(object !== undefined ? { clearRequiresObject: object } : {}),
       }) as Field<T, K> & { readonly isClearable: true };
     },
     evolvesFrom<From>(source: Field<From>, project?: (value: From) => T): Field<T, K> {
@@ -600,6 +714,11 @@ function makeField<T, K extends FieldKind = FieldKind>(
       // `nomosEncryption` era key, built by aggregate()/manifest, is what carries the fact.
       return makeField<T, K>(kind, zod, driver, { ...extra, encrypted: true });
     },
+    blindIndexed(): Field<T, K> {
+      // ZD6 — carried through merge/optional like encrypted(); aggregate() enforces the
+      // encrypted-only rule (a plaintext field needs no blind index — index it directly).
+      return makeField<T, K>(kind, zod, driver, { ...extra, blindIndexed: true });
+    },
     attributed(): Field<T, K> {
       // Carry the flag through merge/optional (extra is threaded), so `.merge(Lww).attributed()`
       // and `.attributed().merge(Lww)` agree. aggregate() validates Lww-class eligibility and
@@ -771,6 +890,11 @@ export const t = {
     }
     return makeField("string", schema, FirstWriterWins);
   },
+  /** A SHA-256 digest with one canonical wire spelling: 64 lowercase hex characters.
+   * Generated clients surface [Sha256Digest], not a bare string. */
+  sha256Digest(): Field<Sha256Digest, "string"> {
+    return makeField<Sha256Digest, "string">("string", sha256Digest(), FirstWriterWins);
+  },
   int(rules: IntRules = {}): Field<number, "int"> {
     for (const [name, value] of [["minimum", rules.minimum], ["maximum", rules.maximum]] as const) {
       if (value !== undefined && !Number.isSafeInteger(value)) {
@@ -904,10 +1028,13 @@ export const t = {
    */
   clearable<T, K extends FieldKind>(
     field: Field<T, K>,
-    opts?: { requires?: string },
+    opts?: { requires?: string; object?: string },
   ): Field<T, K> & { readonly isClearable: true } {
     assertNullEligible(field, "clearable");
-    return field.clearable(opts?.requires);
+    if (opts?.object !== undefined && opts.requires === undefined) {
+      throw new Error("t.clearable(..., { object }) also requires an authorization relation");
+    }
+    return field.clearable(opts?.requires, opts?.object);
   },
   /**
    * `t.nullable(field, { reason })` — null IS a real domain value on this field (`architecture/
@@ -977,6 +1104,58 @@ export const t = {
       },
     });
   },
+  /** A first-class, atomic portable custody address. Unlike legacy `foreignRef`, there is no sibling
+   * workspace field which can tear under merge; workspace, aggregate type and id are one Lww value. */
+  nomosRef(
+    target: AggregateHandle<string, Record<string, Field>> | ContractHandle,
+  ): Field<NomosRefValue, "ref"> {
+    const isContract = (target as { __isContract?: unknown }).__isContract === true;
+    return makeField<NomosRefValue, "ref">("ref", nomosRefValueSchema, FirstWriterWins, {
+      refAggregateId: target.id,
+      nomosRef: {
+        targetAggregateId: target.id,
+        ...(isContract ? { targetIsContract: true } : {}),
+      },
+    });
+  },
+  /** A version pin whose freshness is checked against one law-declared current pointer on a stable series.
+   * The declaration fails immediately if `series.current` is not an atomic ref to `target`. */
+  versionedForeignRef(opts: {
+    target: AggregateHandle<string, Record<string, Field>> | ContractHandle;
+    series: AggregateHandle<string, Record<string, Field>> | ContractHandle;
+    current: string;
+    domain?: string;
+  }): Field<VersionedNomosRefValue, "ref"> {
+    const current = (opts.series.fields as Record<string, Field>)[opts.current];
+    if (current === undefined) {
+      throw new Error(
+        `t.versionedForeignRef: series '${opts.series.id}' has no current field '${opts.current}'`,
+      );
+    }
+    if (current.nomosRef?.targetAggregateId !== opts.target.id) {
+      throw new Error(
+        `t.versionedForeignRef: '${opts.series.id}.${opts.current}' must be ` +
+          `t.nomosRef(${opts.target.id}); it is the O(1) current pointer used for freshness`,
+      );
+    }
+    const targetIsContract = (opts.target as { __isContract?: unknown }).__isContract === true;
+    const seriesIsContract = (opts.series as { __isContract?: unknown }).__isContract === true;
+    return makeField<VersionedNomosRefValue, "ref">(
+      "ref",
+      versionedNomosRefValueSchema,
+      FirstWriterWins,
+      {
+        versionedForeignRef: {
+          targetAggregateId: opts.target.id,
+          ...(targetIsContract ? { targetIsContract: true } : {}),
+          seriesAggregateId: opts.series.id,
+          ...(seriesIsContract ? { seriesIsContract: true } : {}),
+          currentField: opts.current,
+          ...(opts.domain === undefined ? {} : { targetDomain: opts.domain }),
+        },
+      },
+    );
+  },
   /**
    * A 1:N INVERSE relation — the read side of a `t.ref` on the child (`aggregate_lifecycle_and_relations.md`).
    * `t.hasMany(Child).via("parent")` on a Parent declares "the Children whose `parent` ref points here".

package/src/flow_gate.ts

@@ -15,7 +15,11 @@
 // Integrity (who may WRITE) is gated natively at admission by `.requires(relation)`;
 // the integrity-flow dual + rule 4 (secret-correlated refusal) + `declassify` + the
 // `nomosFlowGate` era key are the next slices.
-import type { CanonicalManifest } from "./manifest.js";
+import type { DomainModule } from "./codegen_dart.js";
+import { finishCount } from "./count.js";
+import { existsAsCount } from "./exists.js";
+import { finishExtremum } from "./extremum.js";
+import { finishSum } from "./sum.js";
 import type { CanonicalPred } from "./predicate.js";
 
 /** A read projection, read structurally — every read kind (query / count / sum / extremum /
@@ -32,6 +36,26 @@ type Projection = {
   readonly where?: CanonicalPred;
 };
 
+/** The finite facts the information-flow proof consumes. A canonical manifest satisfies this
+ * structurally for legacy callers; the production compiler derives it straight from typed declarations. */
+export interface FlowLaw {
+  readonly aggregates: readonly {
+    readonly id: string;
+    readonly encryptedFields?: readonly string[];
+    readonly requiresRead?: string;
+  }[];
+  readonly directives: readonly {
+    readonly id: string;
+    readonly capturedReads?: readonly { readonly queryId: string; readonly returns: string }[];
+  }[];
+  readonly queries?: readonly Projection[];
+  readonly counts?: readonly Projection[];
+  readonly sums?: readonly Projection[];
+  readonly mins?: readonly Projection[];
+  readonly maxes?: readonly Projection[];
+  readonly orderedReads?: readonly Projection[];
+}
+
 /** The raw module bits rule 4 needs that the canonical manifest strips (the executable
  *  invariant `.reads` + the declassify waivers). Read structurally — no coupling to DomainModule. */
 type FlowModule = {
@@ -82,7 +106,7 @@ function predFields(p: CanonicalPred | undefined): string[] {
  * {@link FlowGateError} on the first violation (a typed compile error). Pure over
  * manifest IR — no side effects, no AST.
  */
-export function assertFlowGate(m: CanonicalManifest, mod?: FlowModule): void {
+export function assertFlowGate(m: FlowLaw, mod?: FlowModule): void {
   // ── RULE 1 — NO ENCRYPT-THEN-INDEX ──────────────────────────────────────────
   // A field that is .encrypted() (operator-blind ciphertext) MUST NOT appear in any
   // read's group-by / key / value / where over its own type: grouping/indexing/
@@ -233,3 +257,52 @@ export function assertFlowGate(m: CanonicalManifest, mod?: FlowModule): void {
     }
   }
 }
+
+/**
+ * Production compiler entry: prove information flow directly from the live typed declarations.
+ * This deliberately does not build, serialize or hash the retired canonical JSON manifest.
+ */
+export function assertFlowGateModule(mod: DomainModule): void {
+  const counts = [
+    ...(mod.counts ?? []).map(finishCount),
+    ...(mod.exists_ ?? []).map(existsAsCount),
+  ];
+  const facts: FlowLaw = {
+    aggregates: mod.aggregates.map((aggregate) => ({
+      id: aggregate.id,
+      ...(aggregate.encryptedFields === undefined ? {} : { encryptedFields: aggregate.encryptedFields }),
+      ...(aggregate.visibility === undefined ? {} : { requiresRead: aggregate.visibility.requires }),
+    })),
+    directives: mod.directives.map((directive) => ({
+      id: directive.id,
+      ...((directive.declaredQueryReads ?? []).length === 0
+        ? {}
+        : {
+            capturedReads: (directive.declaredQueryReads ?? []).map((read) => ({
+              queryId: read.id,
+              returns: read.returns,
+            })),
+          }),
+    })),
+    ...(mod.queries === undefined ? {} : { queries: mod.queries }),
+    ...(counts.length === 0 ? {} : { counts }),
+    ...(mod.sums === undefined
+      ? {}
+      : {
+          sums: mod.sums.map((raw) => {
+            const sum = finishSum(raw);
+            return {
+              id: sum.id,
+              of: sum.of,
+              valueField: sum.sumField,
+              ...(sum.by === undefined ? {} : { by: sum.by }),
+              ...(sum.where === undefined ? {} : { where: sum.where }),
+            };
+          }),
+        }),
+    ...(mod.mins === undefined ? {} : { mins: mod.mins.map(finishExtremum) }),
+    ...(mod.maxes === undefined ? {} : { maxes: mod.maxes.map(finishExtremum) }),
+    ...(mod.orderedReads === undefined ? {} : { orderedReads: mod.orderedReads }),
+  };
+  assertFlowGate(facts, mod);
+}

package/src/framework/application_home.ts

@@ -38,6 +38,7 @@ import {
   seedBirthAttestation,
   seedReceivingGroup,
   seedReceivingGroupPolicy,
+  sharedByObject,
   sharedByWorkspace,
 } from "./home.js";
 import { RelationTuple, relationTuplesByObject } from "./relations.js";
@@ -86,6 +87,7 @@ export const __nomos_SharedWithMe = aggregate(SharedWithMe);
 export const __nomos_recordShare = directive(recordShare);
 export const __nomos_pruneShare = directive(pruneShare);
 export const __nomos_sharedByWorkspace = query(sharedByWorkspace);
+export const __nomos_sharedByObject = query(sharedByObject);
 
 // Warrant, provenance, signer seating, recovery and verifier state.
 export const __nomos_GenesisWarrant = aggregate(GenesisWarrant);

package/src/framework/auth_provider_law.ts

@@ -13,7 +13,7 @@ import { Lww } from "../drivers.js";
 import { set, withMarker } from "../ops.js";
 import { query } from "../query.js";
 import { GENESIS_WARRANT_ID } from "./genesis.js";
-import { refAs, workspaceInvariant } from "./workspace_invariant.js";
+import { readRef, readSet, refAs, workspaceInvariant } from "./workspace_invariant.js";
 
 const epochMs = z.number().int().nonnegative();
 
@@ -135,7 +135,7 @@ export const seedAuthProvider = directive("seedAuthProvider")
 
 export const authProviderSeedBeforeWarrant = workspaceInvariant("AuthProviderSeedBeforeWarrant")
   .on("seedAuthProvider")
-  .reads(() => [refAs("warrant", "GenesisWarrant", GENESIS_WARRANT_ID)])
+  .reads(readSet(readRef("warrant", "GenesisWarrant").at(GENESIS_WARRANT_ID)))
   .assert(({ warrant }) => {
     // Missing invariant refs are represented as an empty snapshot by the executor, not necessarily null.
     const principal = (warrant as { principal?: unknown } | null | undefined)?.principal;

package/src/framework/birth_meter.ts

@@ -27,7 +27,7 @@ import { z } from "zod";
 import { instance } from "../aggregate.js";
 import { directive } from "../directive.js";
 import { set, type PlannedOp } from "../ops.js";
-import { refAs, workspaceInvariant } from "./workspace_invariant.js";
+import { readRef, readSet, refAs, workspaceInvariant } from "./workspace_invariant.js";
 import {
   BirthPolicy,
   BirthGrant,
@@ -149,9 +149,7 @@ export const reclaimChildAsAdmin = directive("reclaimChildAsAdmin")
 /** Reclaim is two-phase; a child must first be explicitly withdrawn. */
 export const reclaimChildRequiresRetired = workspaceInvariant("ReclaimChildRequiresRetired")
   .on("reclaimChild")
-  .reads((ctx) => [
-    refAs("record", "NomosChildLifecycle", "pre:" + childLifecycleId(String(ctx.intent.child ?? ""))),
-  ])
+  .reads(readSet(readRef("record", NomosChildLifecycle).pre().fromPayload("child", { prefix: "nomos-child-lifecycle:" })))
   .assert(({ record }, ctx) =>
     (record as { status?: string; principal?: string } | undefined)?.status === "retired"
       && sameLifecyclePrincipal((record as { principal?: string }).principal, ctx?.principal)
@@ -162,9 +160,7 @@ export const reclaimChildRequiresRetired = workspaceInvariant("ReclaimChildRequi
 /** Operator recovery has the same two-phase law, without depending on the broken creator credential. */
 export const reclaimChildAsAdminRequiresRetired = workspaceInvariant("ReclaimChildAsAdminRequiresRetired")
   .on("reclaimChildAsAdmin")
-  .reads((ctx) => [
-    refAs("record", "NomosChildLifecycle", "pre:" + childLifecycleId(String(ctx.intent.child ?? ""))),
-  ])
+  .reads(readSet(readRef("record", NomosChildLifecycle).pre().fromPayload("child", { prefix: "nomos-child-lifecycle:" })))
   .assert(({ record }) =>
     (record as { status?: string } | undefined)?.status === "retired"
       ? { accept: true }
@@ -174,9 +170,7 @@ export const reclaimChildAsAdminRequiresRetired = workspaceInvariant("ReclaimChi
 /** Reclaimed is permanent: retirement cannot move a child back out of the terminal state. */
 export const retireChildNotReclaimed = workspaceInvariant("RetireChildNotReclaimed")
   .on("retireChild")
-  .reads((ctx) => [
-    refAs("record", "NomosChildLifecycle", "pre:" + childLifecycleId(String(ctx.intent.child ?? ""))),
-  ])
+  .reads(readSet(readRef("record", NomosChildLifecycle).pre().fromPayload("child", { prefix: "nomos-child-lifecycle:" })))
   .assert(({ record }) =>
     (record as { status?: string } | undefined)?.status === "reclaimed"
       ? { reject: "reclaimed-child-is-terminal" }
@@ -186,9 +180,7 @@ export const retireChildNotReclaimed = workspaceInvariant("RetireChildNotReclaim
 /** Reclaimed is terminal for operator recovery too. */
 export const retireChildAsAdminNotReclaimed = workspaceInvariant("RetireChildAsAdminNotReclaimed")
   .on("retireChildAsAdmin")
-  .reads((ctx) => [
-    refAs("record", "NomosChildLifecycle", "pre:" + childLifecycleId(String(ctx.intent.child ?? ""))),
-  ])
+  .reads(readSet(readRef("record", NomosChildLifecycle).pre().fromPayload("child", { prefix: "nomos-child-lifecycle:" })))
   .assert(({ record }) =>
     (record as { status?: string } | undefined)?.status === "reclaimed"
       ? { reject: "reclaimed-child-is-terminal" }
@@ -198,9 +190,7 @@ export const retireChildAsAdminNotReclaimed = workspaceInvariant("RetireChildAsA
 /** A lifecycle cannot mint authority for arbitrary custody: retirement must name its exact birth witness. */
 export const retireChildRequiresBirth = workspaceInvariant("RetireChildRequiresBirth")
   .on("retireChild")
-  .reads((ctx) => [
-    refAs("birth", "NomosBirthRecord", "pre:" + birthRecordId(String(ctx.intent.child ?? ""))),
-  ])
+  .reads(readSet(readRef("birth", NomosBirthRecord).pre().fromPayload("child", { prefix: "nomos-birth-record:" })))
   .assert(({ birth }, ctx) => {
     const record = birth as { child?: string; principal?: string } | undefined;
     const intent = ctx?.intent as { child?: string; principal?: string } | undefined;
@@ -214,9 +204,7 @@ export const retireChildRequiresBirth = workspaceInvariant("RetireChildRequiresB
 /** Admin recovery may act for the recorded creator, but still cannot invent or retarget custody. */
 export const retireChildAsAdminRequiresBirth = workspaceInvariant("RetireChildAsAdminRequiresBirth")
   .on("retireChildAsAdmin")
-  .reads((ctx) => [
-    refAs("birth", "NomosBirthRecord", "pre:" + birthRecordId(String(ctx.intent.child ?? ""))),
-  ])
+  .reads(readSet(readRef("birth", NomosBirthRecord).pre().fromPayload("child", { prefix: "nomos-birth-record:" })))
   .assert(({ birth }, ctx) => {
     const record = birth as { child?: string; principal?: string } | undefined;
     const intent = ctx?.intent as { child?: string; principal?: string } | undefined;

package/src/framework/bootstrap.ts

@@ -16,7 +16,5 @@
 
 export {
   DomainInstallation,
-  PolicyBundle,
   installDomain,
-  policyAggregateId,
 } from "./domain_lifecycle.js";

package/src/framework/business_corrections.ts

@@ -22,8 +22,16 @@ const correctionRecord = aggregate(BUSINESS_CORRECTION_AGGREGATE, {
   correctedAt: t.string().merge(Lww),
 }).public();
 
+export const businessCorrectionRecord = {
+  ...correctionRecord,
+  businessBirthInternal: true as const,
+};
+
 const correction = directive(BUSINESS_CORRECTION_DIRECTIVE)
-  .ensures(correctionRecord)
+  // The directive's typed aggregate handle is followed by composeDomainModule. It must be the same
+  // framework-private singleton that is exported below; pointing at the unbranded construction
+  // intermediate lets that handle overwrite the branded one during typed target closure.
+  .ensures(businessCorrectionRecord)
   .payload(z.object({
     recordId: z.string().min(1),
     target: z.string().min(1),
@@ -45,10 +53,6 @@ const correction = directive(BUSINESS_CORRECTION_DIRECTIVE)
     ];
   });
 
-export const businessCorrectionRecord = {
-  ...correctionRecord,
-  businessBirthInternal: true as const,
-};
 export const recordBusinessCorrection = {
   ...correction,
   businessBirthInternal: true as const,