@githolon/dsl 0.102.5 → 0.103.0

package/src/framework/domain_lifecycle.ts

@@ -9,10 +9,10 @@
  * The `nomos` lifecycle/controller surface.
  *
  * This is the Kubernetes CRD/API-server split in Nomos terms:
- *   * `PolicyBundle` is the content-addressed package object (`policy:{hash}.bundle`);
- *   * `DomainInstallation` is the workspace resource with spec/status/phase;
- *   * `installDomain` writes BOTH in one intent and declares the `installDomain`
- *     capability. `stageDomain` writes the same content as Pending without serving it;
+ *   * the kernel-custodied USDA closure is the content-addressed law object;
+ *   * `DomainInstallation` is the small workspace resource with spec/status/phase;
+ *   * `installDomain` writes that reference in one intent and declares the `installDomain`
+ *     capability. `stageDomain` records the same closure as Pending without serving it;
  *     `promoteDomain` and `rollbackDomain` are phase changes whose admission is judged
  *     against the staged package. This is the richer controller API; bootstrap exposes
  *     a thinner install-only intent for stage-zero.
@@ -43,16 +43,12 @@ export const DOMAIN_INSTALLATION_PHASES = [
 ] as const;
 export type DomainInstallationPhase = (typeof DOMAIN_INSTALLATION_PHASES)[number];
 
-export const PolicyBundle = aggregate("PolicyBundle", {
-  bundle: t.string().merge(Lww),
-}).public();
-
 export const DomainInstallation = aggregate("DomainInstallation", {
   "spec.domainHash": t.string().merge(Lww),
   "spec.packageHash": t.string().merge(Lww),
-  "spec.policyAggregate": t.string().merge(Lww),
   "spec.authorityScope": t.string().merge(Lww),
   "spec.installedBy": t.string().merge(Lww),
+  "spec.lawClosureIdentity": t.string().merge(Lww),
   "spec.dependencies": t.set(t.string()),
   "spec.supersedes": t.string().merge(Lww).optional(),
   "spec.finalizers": t.set(t.string()),
@@ -95,18 +91,10 @@ export const ReleaseReceipt = aggregate(RELEASE_RECEIPT_AGGREGATE, {
   acceptedAt: t.int().merge(Lww),
 }).public();
 
-export function policyAggregateId(domainHash: string): string {
-  return `policy:${domainHash}`;
-}
-
 export function domainInstallationAggregateId(domainHash: string): string {
   return `domain-installation:${domainHash}`;
 }
 
-function policyBundleInstance(domainHash: string) {
-  return instance(PolicyBundle, policyAggregateId(domainHash));
-}
-
 function domainInstallationInstance(domainHash: string) {
   return instance(DomainInstallation, domainInstallationAggregateId(domainHash));
 }
@@ -157,13 +145,15 @@ const preflightReceipt = z.object({
 });
 
 const packagePayload = {
-  domainHash: z.string(),
-  packageUsda: z.string(),
+  domainHash: lowerHex64,
   installedBy: z.string(),
+  lawClosureIdentity: lowerHex64,
   authorityScope: z.string().default("workspace/root"),
-  dependencies: z.array(z.string()).default([]),
+  // Omission means the empty set; keep that in the plan instead of encoding a composite default
+  // into canonical USDA merely to save `?? []` at runtime.
+  dependencies: z.array(z.string()).optional(),
   supersedes: z.string().optional(),
-  finalizers: z.array(z.string()).default([]),
+  finalizers: z.array(z.string()).optional(),
 };
 
 export const installDomain = directive("installDomain")
@@ -185,15 +175,13 @@ export const installDomain = directive("installDomain")
     }),
   )
   .plan((p): PlannedOp[] => {
-    const policy = policyBundleInstance(p.domainHash);
     const install = domainInstallationInstance(p.domainHash);
     const ops: PlannedOp[] = [
-      withMarker(set(policy, "bundle", p.packageUsda), "ensures"),
-      set(install, "spec.domainHash", p.domainHash),
+      withMarker(set(install, "spec.domainHash", p.domainHash), "ensures"),
       set(install, "spec.packageHash", p.domainHash),
-      set(install, "spec.policyAggregate", policyAggregateId(p.domainHash)),
       set(install, "spec.authorityScope", p.authorityScope),
       set(install, "spec.installedBy", p.installedBy),
+      set(install, "spec.lawClosureIdentity", p.lawClosureIdentity),
       set(install, "metadata.generation", 1),
       set(install, "status.phase", "Active"),
       set(install, "status.observedGeneration", 1),
@@ -231,15 +219,13 @@ export const stageDomain = directive("stageDomain")
     { message: "a staged domain package cannot supersede itself", path: ["supersedes"] },
   ))
   .plan((p): PlannedOp[] => {
-    const policy = policyBundleInstance(p.domainHash);
     const install = domainInstallationInstance(p.domainHash);
     const ops: PlannedOp[] = [
-      withMarker(set(policy, "bundle", p.packageUsda), "ensures"),
-      set(install, "spec.domainHash", p.domainHash),
+      withMarker(set(install, "spec.domainHash", p.domainHash), "ensures"),
       set(install, "spec.packageHash", p.domainHash),
-      set(install, "spec.policyAggregate", policyAggregateId(p.domainHash)),
       set(install, "spec.authorityScope", p.authorityScope),
       set(install, "spec.installedBy", p.installedBy),
+      set(install, "spec.lawClosureIdentity", p.lawClosureIdentity),
       set(install, "metadata.generation", 1),
       set(install, "status.phase", "Pending"),
       set(install, "status.observedGeneration", 0),

package/src/framework/encryption_scope.ts

@@ -146,7 +146,8 @@ export const advanceKeyEpoch = directive("advanceKeyEpoch")
       wraps: z.array(wrapEntrySchema),
     }),
   )
-  .plan((p) => writeKeyEpoch(p.scope, p.epoch, p.openedAt, p.wraps));
+  .plan((p) => writeKeyEpoch(p.scope, p.epoch, p.openedAt, p.wraps))
+  .alsoEnsuresMany(WrappedKey);
 
 /**
  * `wrapKey` — write ONE wrap (the single-member handoff). Beyond its use as a primitive,

package/src/framework/framework_aggregates.ts

@@ -36,6 +36,7 @@ import { nomosSourceFrontierEnsure } from "../attested.js";
 import * as birthMeter from "../birth_meter.js";
 import * as birthMeterEnsure from "../birth_meter_ensure.js";
 import * as birthMeterFramework from "./birth_meter.js";
+import * as businessCorrections from "./business_corrections.js";
 import * as authProviderLaw from "./auth_provider_law.js";
 import * as disclosure from "./disclosure.js";
 import * as domainLifecycle from "./domain_lifecycle.js";
@@ -59,6 +60,7 @@ const FRAMEWORK_NAMESPACES: ReadonlyArray<Record<string, unknown>> = [
   birthMeter,
   birthMeterEnsure,
   birthMeterFramework,
+  businessCorrections,
   authProviderLaw,
   disclosure,
   domainLifecycle,

package/src/framework/genesis.ts

@@ -9,18 +9,19 @@
  *
  * THE BOOTSTRAP PARADOX: the relation gate refuses a founding control-plane grant
  * on a VIRGIN chain (an empty `#admin`/`#creator`/… roster) — there is no admin yet
- * to gate the first admin. Resolved LAWFULLY (not by a host bypass): at birth the
- * host verifies the `x-nomos-auth` token ONCE and records the verified principal as
- * an in-history fact — this `GenesisWarrant`. The gate's GENESIS CLAUSE
+ * to gate the first admin. Resolved LAWFULLY (not by a host bypass): the root
+ * `seedGenesis` is signed by the self-authenticating key principal it installs; a
+ * child receives its warrant only from the kernel's already-admitted parent-birth
+ * effect and the carried birth certificate rooted at K_root. The gate's GENESIS CLAUSE
  * (`executor::genesis_admits`) then admits a founding grant on a virgin object IFF
  * the warrant binds the chain to the captured principal. Strictly additive (only an
  * otherwise-`Unauthorized` virgin grant), so every sealed chain replays unchanged.
  *
- * CONTROL-PLANE: `seedGenesis` is authored by the BIRTH DOOR (the host, after the
- * one-time token verification), NOT by the open session lane — the session lane
- * structurally refuses control-plane intents, so a tenant cannot forge a warrant for
- * a principal it does not own. The warrant is the host's recorded verification, not
- * a host authority decision: every replaying peer re-reads the chain fact.
+ * CONTROL-PLANE: `seedGenesis` is never a host assertion. At the root it carries an
+ * author block whose public key derives the claimed `key:<sha256>` principal and whose
+ * signature binds the exact workspace id. For descendants it is emitted only by the
+ * kernel after verifying the parent's admitted birth and K_root-rooted certificate.
+ * Every replaying peer re-verifies those cryptographic facts from custody.
  *
  * SINGLETON per chain: one founding principal per home/workspace, so the warrant is
  * a singleton keyed `genesis-warrant:self`. `seedGenesis` is create-once — a second
@@ -32,7 +33,7 @@ import { t } from "../fields.js";
 import { Lww } from "../drivers.js";
 import { directive } from "../directive.js";
 import { set, type PlannedOp } from "../ops.js";
-import { writeTuple } from "./relations.js";
+import { RelationTuple, writeTuple } from "./relations.js";
 
 /**
  * Deterministic singleton id of the founding warrant — MUST equal
@@ -42,16 +43,16 @@ export const GENESIS_WARRANT_ID = "genesis-warrant:self";
 
 /**
  * The founding-warrant record. It does THREE jobs at once:
- *  - `principal` — the x-nomos-auth-verified OWNER (the genesis clause binds the founding grant to it);
+ *  - `principal` — the cryptographically proven founder (the genesis clause binds the founding grant to it);
  *  - `workspaceId` — this workspace's UNIQUE SELF-ID (the source binding the author signature covers,
  *    re-derived locally by the gate — NOT the shared/deterministic genesis commit, which is identical
  *    across all workspaces and so bound nothing);
  *  - its mere PRESENCE — the SIGNED-AUTHOR REGIME signal (the "era"): a workspace with a warrant
- *    REQUIRES a verified author block (forge closed); one without falls back to the legacy
- *    host-stamped principal (pre-feature chains replay green, per-position).
+ *    REQUIRES a verified author block (forge closed). A root seed proves itself against
+ *    its own workspace-bound key; descendants additionally carry their parent-attested lineage.
  */
 export const GenesisWarrant = aggregate("GenesisWarrant", {
-  principal: t.string().merge(Lww), // the x-nomos-auth-verified owner, recorded at birth
+  principal: t.string().merge(Lww), // the cryptographically proven founder, recorded at birth
   workspaceId: t.string().merge(Lww), // this workspace's unique self-id (the author-signature source binding)
   bornAt: t.string().merge(Lww), // ISO-8601, caller-stamped (determinism)
 }).public();
@@ -104,4 +105,5 @@ export const seedGenesis = directive("seedGenesis")
       grantedBy: p.principal,
       grantedAt: p.bornAt,
     }),
-  ]);
+  ])
+  .alsoEnsures(RelationTuple);

package/src/framework/home.ts

@@ -37,9 +37,9 @@ import { query } from "../query.js";
 import { birth } from "../births.js";
 import { readFrameworkDeclared } from "../read.js";
 import { authProvider as authProviderQuery, seedAuthProvider } from "./auth_provider_law.js";
-import { workspaceInvariant, refAs } from "./workspace_invariant.js";
+import { readRef, readSet, workspaceInvariant, refAs } from "./workspace_invariant.js";
 import { identityRelations } from "./signing_identity.js";
-import { writeTuple } from "./relations.js";
+import { RelationTuple, writeTuple } from "./relations.js";
 import { relationType, self, user, selfObject } from "../relation_schema.js";
 import { requireParentAttestedBirth, type ParentAttestedBirthMarker } from "../births.js";
 import { GenesisWarrant, seedGenesis } from "./genesis.js";
@@ -168,7 +168,8 @@ export function writeReceivingGroup(p: { principal: string; workspaceName: strin
 export const seedReceivingGroup = directive("nomosInternalSeedReceivingGroup7c1f5e")
   .ensures(ReceivingGroup)
   .payload(z.object({ principal: z.string().min(1), workspaceName: z.string().min(1), bornAt: z.string().min(1) }))
-  .plan((p) => writeReceivingGroup(p));
+  .plan((p) => writeReceivingGroup(p))
+  .alsoEnsures(RelationTuple);
 
 /**
  * THE SQUAT INVARIANT (home_holons §5) — a home holon's self-committed `homeName` MUST be the hash of its
@@ -180,7 +181,7 @@ export const seedReceivingGroup = directive("nomosInternalSeedReceivingGroup7c1f
  */
 export const receivingGroupNameBindsPrincipal = workspaceInvariant("ReceivingGroupNameBindsPrincipal")
   .on("nomosInternalSeedReceivingGroup7c1f5e")
-  .reads(() => [refAs("group", "NomosInternalReceivingGroup7c1f5e", RECEIVING_GROUP_ID)])
+  .reads(readSet(readRef("group", ReceivingGroup).at(RECEIVING_GROUP_ID)))
   .declassify("the receiving-group address is a public hash of its stable principal; refusing a mismatch reveals no private field")
   .assert(({ group }) => {
     const g = (group ?? {}) as { principal?: string; workspaceName?: string };
@@ -191,10 +192,10 @@ export const receivingGroupNameBindsPrincipal = workspaceInvariant("ReceivingGro
       : { reject: "a receiving group's workspace name must hash its stable principal" };
   });
 
-const receivingGroupPolicyRefs = () => [
-  refAs("group", "NomosInternalReceivingGroup7c1f5e", RECEIVING_GROUP_ID),
-  refAs("policy", "NomosInternalReceivingGroupPolicy7c1f5e", RECEIVING_GROUP_POLICY_ID),
-];
+const receivingGroupPolicyRefs = readSet(
+  readRef("group", ReceivingGroup).at(RECEIVING_GROUP_ID),
+  readRef("policy", ReceivingGroupPolicy).at(RECEIVING_GROUP_POLICY_ID),
+);
 
 /** An IdP token may bootstrap the parent before the group exists; it may never bypass an existing group's
  * device policy. A new group device must be approved by a current device or, later, guardian evidence. */
@@ -259,7 +260,7 @@ export function receivingGroupNameOf(principal: string): string {
  *      (no anonymous home birth); the offer principal IS the auth boundary (the tenant's setAuthProvider).
  *
  * The genesis chain it authors (reusing the order-declares-the-law install shape — bytes resolved by hash
- * from the parent's custody, `domainPackageB64: ""`):
+ * from the parent's typed USDA closure custody):
  *   [ bootstrap/installDomain(frameworkHash), nomos/home installDomain(lawHash), seedHomeOwner(owner, …) ]
  * `frameworkHash` (the bootstrap controller hash) + `lawHash` (the HOME law package domainHash) are
  * tenant-PINNED at their governance compile (mirroring `birthChild`) — the end-user app supplies neither;
@@ -352,11 +353,11 @@ export function birthReceivingGroupForDomain(groupLawDomain: string) {
     let certVerified = false;
     try { certVerified = p.homeCert !== undefined && JSON.parse(p.homeCert).verified === true; } catch { /* malformed cert ⇒ unverified (the gate will refuse the birth anyway) */ }
     const verifiedVia = certVerified ? apStr("issuer") : undefined;
-    const genesisChain: Array<{ domain: string; directiveId: string; actor: string; payload: Record<string, unknown>; domainHash?: string; domainPackageB64?: string }> = [
-      // THE ORDER-DECLARED LAW INSTALL: two layers, bytes-by-hash (empty package — the kernel resolves them
-      // from the parent's custody when it folds the birth; never the host). Matches buildGenesisChain's shape.
-      { domain: "bootstrap", directiveId: "installDomain", actor: founder, payload: { domainHash: p.frameworkHash }, domainHash: p.frameworkHash, domainPackageB64: "" },
-      { domain: "nomos", directiveId: "installDomain", actor: founder, payload: { domainHash: p.lawHash }, domainHash: p.lawHash, domainPackageB64: "" },
+    const genesisChain: Array<{ domain: string; directiveId: string; actor: string; payload: Record<string, unknown>; domainHash?: string }> = [
+      // THE ORDER-DECLARED LAW INSTALL: two typed closure identities. The kernel resolves each
+      // closure from the parent's custody when it folds the birth; law bytes never ride the intent.
+      { domain: "bootstrap", directiveId: "installDomain", actor: founder, payload: { domainHash: p.frameworkHash }, domainHash: p.frameworkHash },
+      { domain: "nomos", directiveId: "installDomain", actor: founder, payload: { domainHash: p.lawHash }, domainHash: p.lawHash },
       {
         domain: groupLawDomain,
         directiveId: "nomosInternalSeedReceivingGroupPolicy7c1f5e",
@@ -509,6 +510,11 @@ export const pruneShare = directive("pruneShare")
 /** "Show me everything <asserter> shared with me" — an indexed probe over the local access list. */
 export const sharedByWorkspace = query("sharedByWorkspace").key("asserterWorkspace").returns(SharedWithMe);
 
+/** "Show me every share for this protected object" — the indexed access-list probe used by generated
+ * application discovery. A home commonly has a very large installed law, so discovery must never fall back
+ * to the generic `aggregatesByType(SharedWithMe)` scan merely to find whole-workspace shares. */
+export const sharedByObject = query("sharedByObject").key("object").returns(SharedWithMe);
+
 // ─────────────────── THE PEER-SOVEREIGN ROOT-OF-TRUST (the BirthAttestation cert chain) ───────────────────
 
 /**

package/src/framework/owned_custody.ts

@@ -288,7 +288,8 @@ function ownedRecordActionDirectives(aggregate: AggregateHandle) {
           grantedAt: p.sharedAt,
         }),
         ...p.wraps.flatMap((entry) => writeWrap(recordScope(aggregate, p.recordId), entry.epoch, entry)),
-      ]),
+      ])
+      .alsoEnsures(RelationTuple),
     { businessBirthInternal: true as const },
   );
 
@@ -313,7 +314,9 @@ function ownedRecordActionDirectives(aggregate: AggregateHandle) {
           revokedAt: p.changedAt,
         }),
         ...writeKeyEpoch(recordScope(aggregate, p.recordId), p.epoch, p.changedAt, p.wraps),
-      ]),
+      ])
+      .alsoEnsures(RelationTuple)
+      .alsoEnsuresMany(WrappedKey),
     { businessBirthInternal: true as const },
   );
 
@@ -354,7 +357,10 @@ function ownedRecordActionDirectives(aggregate: AggregateHandle) {
         ops.push(...writeKeyEpoch(scope, p.epoch, p.changedAt, []));
         for (const entry of p.historicWraps) ops.push(...writeWrap(scope, entry.epoch, entry));
         return ops;
-      }),
+      })
+      .alsoEnsuresMany(RelationTuple)
+      .alsoMutates(aggregate)
+      .alsoEnsuresMany(WrappedKey),
     { businessBirthInternal: true as const },
   );
 

package/src/framework/platform_admin.ts

@@ -102,7 +102,7 @@ import { directive, type RequirableDirective } from "../directive.js";
 import { set } from "../ops.js";
 import { query, type QueryDecl } from "../query.js";
 import { writeTuple, RelationTuple } from "./relations.js";
-import { workspaceInvariant, refAs, type WorkspaceInvariantDecl } from "./workspace_invariant.js";
+import { readRef, readSet, workspaceInvariant, refAs, type WorkspaceInvariantDecl } from "./workspace_invariant.js";
 
 /** The founder singleton's stable instance id — one founder per platform workspace (`workspace:self`). */
 export const PLATFORM_FOUNDER_ID = "platform-founder:self";
@@ -215,7 +215,7 @@ export function seedPlatformAdmin(opts: SeedPlatformAdminOptions): PlatformAdmin
    */
   const platformFounderWriteOnce = workspaceInvariant(writeOnceInvariantId)
     .on(founderDirectiveId)
-    .reads(() => [refAs("prior", founderAggregateId, "pre:" + PLATFORM_FOUNDER_ID)])
+    .reads(readSet(readRef("prior", founderAggregateId).pre().at(PLATFORM_FOUNDER_ID)))
     .assert(({ prior }, ctx) => {
       const seated = (prior ?? {}) as { principal?: string };
       // WRITE-ONCE: a founder already recorded ⇒ refuse a re-seat (the seat is immutable after genesis).
@@ -260,7 +260,7 @@ export function seedPlatformAdmin(opts: SeedPlatformAdminOptions): PlatformAdmin
    */
   const platformAdminBindsFounder = workspaceInvariant(bindsInvariantId)
     .on(seatDirectiveId)
-    .reads(() => [refAs("founder", founderAggregateId, PLATFORM_FOUNDER_ID)])
+    .reads(readSet(readRef("founder", founderAggregateId).at(PLATFORM_FOUNDER_ID)))
     .assert(({ founder }, ctx) => {
       const rec = (founder ?? {}) as { principal?: string };
       const intent = (ctx?.intent ?? {}) as { founder?: string };

package/src/framework/relations.ts

@@ -15,7 +15,7 @@
  * ── The aggregate (object-keyed) ─────────────────────────────────────────────
  * `RelationTuple` is keyed `reltuple-<object>-<relation>` — ONE aggregate per
  * (object, relation) pair — carrying a `subjects: MapOf(Lww)` map of `subject → leaf`,
- * where each leaf is a JSON `{ status }` ("active" | "revoked"). The projection folds an
+ * where each leaf is a typed `RelationshipSubject` (`active` | `revoked`). The projection folds an
  * ACTIVE subject into a `relations(object, relation, subject)` row; a revoked subject
  * yields no row (Check fails closed).
  *
@@ -41,7 +41,7 @@
  */
 import { z } from "zod";
 import { aggregate, instance } from "../aggregate.js";
-import { t } from "../fields.js";
+import { t, type JsonValue } from "../fields.js";
 import { Lww, MapOf } from "../drivers.js";
 import { directive } from "../directive.js";
 import { set, setEntry, withMarker, type PlannedOp } from "../ops.js";
@@ -70,6 +70,11 @@ import { qualifyReadProjectionType } from "../read_projection_namespace.js";
 interface DispatchContext {
   /** The dispatching domain key — the qualifier (`module.domain === intent.domain`). */
   readonly domain: string;
+  /**
+   * The durable Zanzibar namespace for this domain. Canonical USDA uses the domain's stable identity
+   * (`d_<sid>`), not its mutable dispatch label. Older/test engines may omit this and retain the label.
+   */
+  readonly relationNamespace?: string;
   /** `<type>#<relation>` for every LOCAL non-global authored relation of this domain — the qualify set. */
   readonly qualifiable: ReadonlySet<string>;
   /**
@@ -122,14 +127,14 @@ function resolveTupleObject(object: string | RelationObjectToken, relation: stri
           "qualify by). Tokens (selfWorkspace()/selfObject()) resolve only inside a directive plan.",
       );
     }
-    return `${qualifyRelationType(_ctx.domain, object.type)}:${object.id}`;
+    return `${qualifyRelationType(_ctx.relationNamespace ?? _ctx.domain, object.type)}:${object.id}`;
   }
   // A PLAIN STRING is classified by `(type, relation)` against the dispatching domain's schema.
   const colon = object.indexOf(":");
   if (colon < 0 || _ctx === undefined) return object; // malformed / no context ⇒ verbatim
   const type = object.slice(0, colon);
   if (_ctx.qualifiable.has(`${type}#${relation}`)) {
-    return `${qualifyRelationType(_ctx.domain, type)}${object.slice(colon)}`;
+    return `${qualifyRelationType(_ctx.relationNamespace ?? _ctx.domain, type)}${object.slice(colon)}`;
   }
   return object; // global / unknown / per-record ⇒ BARE
 }
@@ -185,7 +190,7 @@ export function relationTupleInstanceId(object: string, relation: string): strin
  *
  *  - object    Lww (the address, materialised on first relate so the aggregate exists)
  *  - relation  Lww (the edge label)
- *  - subjects  MapOf(Lww) — subject → JSON `{status}` leaf (active drops to a tuple row)
+ *  - subjects  MapOf(Lww) — subject → typed `RelationshipSubject` runtime leaf
  */
 export const RelationTuple = aggregate("RelationTuple", {
   object: t.string().merge(Lww),
@@ -194,7 +199,7 @@ export const RelationTuple = aggregate("RelationTuple", {
 }).public();
 export type RelationTupleHandle = typeof RelationTuple;
 
-/** The per-subject leaf the `subjects` map stores (JSON-encoded). Frozen wire shape. */
+/** The per-subject leaf the `subjects` map stores as a typed kernel value. */
 export interface RelationSubjectLeaf {
   status: RelationStatus;
   grantedBy: string;
@@ -222,11 +227,11 @@ export interface RelationSubjectLeaf {
   ownedCustody?: string;
 }
 
-/** Strip undefined keys so the JSON leaf is byte-stable (no dropped-slot `"k":undefined`). */
-function compact(obj: Record<string, unknown>): RelationSubjectLeaf {
+/** Strip undefined keys so the typed leaf has one stable optional-field shape. */
+function compact(obj: Record<string, unknown>): RelationSubjectLeaf & Record<string, JsonValue> {
   const out: Record<string, unknown> = {};
   for (const [k, v] of Object.entries(obj)) if (v !== undefined) out[k] = v;
-  return out as unknown as RelationSubjectLeaf;
+  return out as RelationSubjectLeaf & Record<string, JsonValue>;
 }
 
 interface WriteTupleInput {
@@ -277,9 +282,9 @@ function lowerTuple(
   // subject's endorsement is recorded on the setEntry op so the discovery harvest lifts it into
   // nomosFlowGate.endorse; grantedBy is free attribution (materialised, not gated).
   //
-  // The captured authoring principal IS already a wire-form subject (`user:<uid>` / `key:<hash>`, the
-  // host-stamped actor — the SAME form the write gate parses via `Subject::parse`), so an endorsed
-  // authority subject lowers to that leaf verbatim and the gate's `engine.check` matches it.
+  // The captured authoring principal IS already a kernel-proven wire-form subject (`user:<uid>` /
+  // `key:<hash>` — the SAME form the write gate parses via `Subject::parse`), so an endorsed authority
+  // subject lowers to that leaf verbatim and the gate's `engine.check` matches it.
   const subjectE = endorsementOf(p.subject);
   const subjectRaw = subjectE
     ? subjectE.principal
@@ -300,7 +305,10 @@ function lowerTuple(
     verifiedVia: p.verifiedVia,
     ownedCustody: p.ownedCustody,
   });
-  const subjectEntry = setEntry(rt, "subjects", subjectRaw, JSON.stringify(leaf));
+  const subjectEntry = {
+    ...setEntry(rt, "subjects", subjectRaw, leaf),
+    kernelValue: { RelationshipSubject: leaf },
+  };
   return [
     // upsert the aggregate head (first relate creates it); without this the referential
     // gate would reject a setEntry on an absent id.

package/src/framework/signing_identity.ts

@@ -49,7 +49,7 @@ import { directive } from "../directive.js";
 import { set, withMarker, type PlannedOp } from "../ops.js";
 import { query } from "../query.js";
 import { relationType, self, key } from "../relation_schema.js";
-import { workspaceInvariant, ref } from "./workspace_invariant.js";
+import { readRef, readSet, workspaceInvariant, ref } from "./workspace_invariant.js";
 import { endorsementOf, type EndorsedAuthority } from "../principal_evidence.js";
 import {
   writeTuple,
@@ -144,7 +144,7 @@ export const advanceSignerEpoch = directive("advanceSignerEpoch")
  */
 export const signerEpochStrictlyIncreases = workspaceInvariant("SignerEpochStrictlyIncreases")
   .on("advanceSignerEpoch")
-  .reads(() => [ref("SignerEpoch", SIGNER_EPOCH_ID)])
+  .reads(readSet(readRef("signerEpoch", SignerEpoch).at(SIGNER_EPOCH_ID)))
   .assert((snap, ctx) => {
     const applied = snap["signerEpoch"] as { currentEpoch?: number } | undefined;
     const declared = Number((ctx?.intent as { epoch?: number } | undefined)?.epoch ?? NaN);
@@ -166,7 +166,7 @@ export const signerEpochStrictlyIncreases = workspaceInvariant("SignerEpochStric
  */
 export const revokeSignerEpochStrictlyIncreases = workspaceInvariant("RevokeSignerEpochStrictlyIncreases")
   .on("revokeSigner")
-  .reads(() => [ref("SignerEpoch", SIGNER_EPOCH_ID)])
+  .reads(readSet(readRef("signerEpoch", SignerEpoch).at(SIGNER_EPOCH_ID)))
   .assert((snap, ctx) => {
     const applied = snap["signerEpoch"] as { currentEpoch?: number } | undefined;
     const declared = Number((ctx?.intent as { newEpoch?: number } | undefined)?.newEpoch ?? NaN);
@@ -289,7 +289,7 @@ export const enrollSignerSelf = directive("enrollSignerSelf")
  */
 export const enrollSignerSelfRequiresVerified = workspaceInvariant("EnrollSignerSelfRequiresVerified")
   .on("enrollSignerSelf")
-  .reads(() => []) // no aggregate snapshot needed — the verdict is over the captured principal-verified flag
+  .reads(readSet()) // no aggregate snapshot needed — the verdict is over the captured principal-verified flag
   .declassify("the self-enroll gate intentionally branches on principal_verified (an authz fact, not a secret read)")
   .assert((_snap, ctx) =>
     ctx?.principalVerified === true
@@ -297,6 +297,44 @@ export const enrollSignerSelfRequiresVerified = workspaceInvariant("EnrollSigner
       : { reject: "enroll-signer-self-requires-verified-principal" },
   );
 
+// ─────────────────── THE ENROLL-ONCE DELEGATION CERT (the peer-sovereign root-of-trust) ───────────────────
+
+/**
+ * THE SIGNER DELEGATION (the enroll-once delegation cert, `executor::birth_cert`). When the TENANT verifies a
+ * user U's IdP token at U's live enroll gate, the tenant's onboarding signer `S_P` signs — ONCE — a
+ * DELEGATION CERT binding U's device key `P_U` to the tenant's lineage: a `BirthCert {founder: U,
+ * parent_key: P_U, …}` signed by `S_P`. This singleton (keyed by U) records it in the PLATFORM's folded
+ * state, so the kernel's birth offer-effect reads U's delegation by-user (trusted, not from the payload) when
+ * it assembles U's home cert chain. The cert is OPAQUE on-chain (a JSON `BirthCert`); the kernel parses +
+ * verifies it as one chain link (signed by S_P, whose pubkey is attested by the platform's own chain).
+ *
+ * SELF-BOUND / control-plane: enrolled by the tenant onboarding lane (composed into the tenant's governance
+ * law, off the open session lane), so a tenant cannot forge a delegation for a user another tenant verified.
+ * The delegation's `founder` IS the gate's binding — the kernel asserts the home cert's founder equals the
+ * delegation's founder (the crux founder-binding), so a delegation enrolled for A cannot mint a home for V.
+ *
+ * Declared before `enrollFirstDevice` because that directive's typed effect signature and optional plan arm
+ * both refer to this aggregate during module initialisation.
+ */
+export const SIGNER_DELEGATION_PREFIX = "signer-delegation:";
+export const SignerDelegation = aggregate("SignerDelegation", {
+  /** The user (a `user:<uid>` subject) this delegation enrolls — the key of the singleton. */
+  user: t.string().merge(Lww),
+  /** The user's device PUBLIC KEY (base64) the delegation binds — `P_U`, the home_cert's signer. */
+  deviceKey: t.string().merge(Lww),
+  /** THE DELEGATION CERT (JSON `executor::birth_cert::BirthCert`), signed by the tenant's `S_P`. Opaque
+   *  on-chain; the kernel parses + verifies it as the `links[1]` delegation in U's travelling chain. */
+  certJson: t.string().merge(Lww),
+  /** ISO-8601, caller-stamped (determinism — no clock in the plan). */
+  enrolledAt: t.string().merge(Lww),
+}).public();
+export type SignerDelegationHandle = typeof SignerDelegation;
+
+/** The deterministic singleton id of a user's signer delegation (the kernel reads THIS id by-user). */
+export function signerDelegationInstanceId(user: string): string {
+  return SIGNER_DELEGATION_PREFIX + user;
+}
+
 /**
  * `enrollFirstDevice` (architecture/keyless_verified_onboard.md) — THE KEYLESS VERIFIED FIRST-DEVICE
  * self-onboard. A brand-new principal (an IdP-verified user with NO enrolled signer key) bootstraps its
@@ -377,6 +415,7 @@ export const enrollFirstDevice = directive("enrollFirstDevice")
     ];
     return [...tupleOps, ...delegationOps];
   })
+  .alsoEnsures(SignerDelegation)
   // THE KEYLESS GATE DECLARATION: the carried device-bound `idpToken` IS this directive's authorization
   // (re-verified against the workspace AuthProvider on every lane), not a pre-enrolled signer. This lowers
   // the per-directive payload FIELD MAPPING into the `nomosVerifiedFirstEnroll` era key, so the KERNEL reads
@@ -417,42 +456,8 @@ export const revokeSigner = directive("revokeSigner")
       // bump the signer epoch so the revoked key ages out (the live-epoch backdate is phase 4).
       ...writeSignerEpoch(p.newEpoch),
     ];
-  });
-
-// ─────────────────── THE ENROLL-ONCE DELEGATION CERT (the peer-sovereign root-of-trust) ───────────────────
-
-/**
- * THE SIGNER DELEGATION (the enroll-once delegation cert, `executor::birth_cert`). When the TENANT verifies a
- * user U's IdP token at U's live enroll gate, the tenant's onboarding signer `S_P` signs — ONCE — a
- * DELEGATION CERT binding U's device key `P_U` to the tenant's lineage: a `BirthCert {founder: U,
- * parent_key: P_U, …}` signed by `S_P`. This singleton (keyed by U) records it in the PLATFORM's folded
- * state, so the kernel's birth offer-effect reads U's delegation by-user (trusted, not from the payload) when
- * it assembles U's home cert chain. The cert is OPAQUE on-chain (a JSON `BirthCert`); the kernel parses +
- * verifies it as one chain link (signed by S_P, whose pubkey is attested by the platform's own chain).
- *
- * SELF-BOUND / control-plane: enrolled by the tenant onboarding lane (composed into the tenant's governance
- * law, off the open session lane), so a tenant cannot forge a delegation for a user another tenant verified.
- * The delegation's `founder` IS the gate's binding — the kernel asserts the home cert's founder equals the
- * delegation's founder (the crux founder-binding), so a delegation enrolled for A cannot mint a home for V.
- */
-export const SIGNER_DELEGATION_PREFIX = "signer-delegation:";
-export const SignerDelegation = aggregate("SignerDelegation", {
-  /** The user (a `user:<uid>` subject) this delegation enrolls — the key of the singleton. */
-  user: t.string().merge(Lww),
-  /** The user's device PUBLIC KEY (base64) the delegation binds — `P_U`, the home_cert's signer. */
-  deviceKey: t.string().merge(Lww),
-  /** THE DELEGATION CERT (JSON `executor::birth_cert::BirthCert`), signed by the tenant's `S_P`. Opaque
-   *  on-chain; the kernel parses + verifies it as the `links[1]` delegation in U's travelling chain. */
-  certJson: t.string().merge(Lww),
-  /** ISO-8601, caller-stamped (determinism — no clock in the plan). */
-  enrolledAt: t.string().merge(Lww),
-}).public();
-export type SignerDelegationHandle = typeof SignerDelegation;
-
-/** The deterministic singleton id of a user's signer delegation (the kernel reads THIS id by-user). */
-export function signerDelegationInstanceId(user: string): string {
-  return SIGNER_DELEGATION_PREFIX + user;
-}
+  })
+  .alsoEnsures(SignerEpoch);
 
 /**
  * `enrollDelegation` — record a user's tenant-signed delegation cert (the enroll-once lane). The tenant's