@githolon/dsl 0.103.0 → 0.103.2

package/dart/CHANGELOG.md

@@ -1,3 +1,17 @@
+## 0.64.4
+
+- Require generated applications to seed explicit child-birth and workspace policies before first use;
+  missing law remains a typed kernel refusal instead of a compiled allowance or creation fallback.
+- Keep application startup single-flight and bounded through authentication, custody restore, law install
+  and client binding so concurrent UI consumers share one lifecycle and one actionable result.
+
+## 0.64.3
+
+- Single-flight generated child-workspace acquisition and continuous sync so concurrent references share one
+  open, one lifecycle result and one error rather than cloning or registering the same workspace twice.
+- Generate separate shared-workspace reads so applications can render denormalized owned-workspace cards
+  without eagerly opening every founded child merely to discover genuinely shared lives.
+
 ## 0.64.2
 
 - Execute generated applications through the typed USDA-native kernel boundary, including native read

package/dart/lib/src/dev_cloud.dart

@@ -126,6 +126,7 @@ class NomosTestCloud {
     /// goes last and is retained as the explicit law used to birth a receiving group. A payload package is
     /// not made current on the parent merely to make it available to a child.
     List<String> lawUsdzPaths = const [],
+    int? applicationMaxChildWorkspacesPerUser,
     Duration readyTimeout = const Duration(seconds: 30),
     void Function(String line)? onDiagnostic,
   }) async {
@@ -137,6 +138,10 @@ class NomosTestCloud {
       if (ephemeral) '--ephemeral',
       if (dataDir != null) ...['--data', dataDir],
       if (platform != null) ...['--platform', platform],
+      if (applicationMaxChildWorkspacesPerUser != null) ...[
+        '--application-max-child-workspaces-per-user',
+        '$applicationMaxChildWorkspacesPerUser',
+      ],
       for (final deploy in [
         ...lawUsdzPaths,
         if (lawUsdzPath != null && !lawUsdzPaths.contains(lawUsdzPath))

package/dart/lib/src/runner/node-entry.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // <define:__NOMOS_KERNEL_RELEASE__>
-var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "efe619cbabba8f5d9d1a1309e7ab60feb489ddb4794ce5a6a95f35c7e7ae5928", version: "kernel-efe619cb", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"], protocol: 1 }, testMint: { hash: "0a801b8f40a17d3a1534d1452f0dc990f160299f6db55fe9c0c39d7aa726730b", version: "kernel-0a801b8f", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"], protocol: 1 } };
+var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "4bf8f2709135d729475c4dfbabb2014f8d1e10ff506506da1ee0299a808c415e", version: "kernel-4bf8f270", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"], protocol: 1 }, testMint: { hash: "c83316d63542760b76df0588e42c1ec34367536790bb73775694c6d167a8a87e", version: "kernel-c83316d6", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"], protocol: 1 } };
 
 // runner/node-entry.ts
 import { createInterface } from "node:readline";
@@ -16,6 +16,43 @@ var RUNNER_BUNDLE_VERSION = typeof __NOMOS_BUNDLE_VERSION__ !== "undefined" ? __
 var plainObject = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : null;
 var errorMessage = (e, fallback = "nomos runtime error") => String(e?.message ?? e ?? fallback);
 var compact = (o) => Object.fromEntries(Object.entries(o).filter(([, v]) => v !== void 0 && v !== null && v !== ""));
+var PERF_COMPONENT_LIMIT = 12;
+var PERF_PHASE_LIMIT = 16;
+var PERF_NOTE_LIMIT = 12;
+var numericEntries = (value, limit) => {
+  const entries = Object.entries(plainObject(value) || {}).filter(([, v]) => typeof v === "number" && Number.isFinite(v) && v !== 0).map(([name, n]) => [name, n]).sort((a, b) => Math.abs(b[1]) - Math.abs(a[1]));
+  return {
+    values: Object.fromEntries(entries.slice(0, limit)),
+    omitted: Math.max(0, entries.length - limit)
+  };
+};
+function boundedKernelSpans(value) {
+  const root = plainObject(value);
+  if (!root) return value;
+  const ranked = Object.entries(root).map(([name, raw]) => {
+    const row = plainObject(raw) || {};
+    const phases = numericEntries(row.phases, PERF_PHASE_LIMIT);
+    const notes = numericEntries(row.notes, PERF_NOTE_LIMIT);
+    const flat = numericEntries(row, PERF_PHASE_LIMIT);
+    const totalUs = typeof row.totalUs === "number" && Number.isFinite(row.totalUs) ? row.totalUs : Object.values(flat.values).reduce((sum, n) => sum + Number(n), 0);
+    const shaped = plainObject(row.phases) || plainObject(row.notes) || row.totalUs !== void 0 ? compact({
+      totalUs,
+      phases: Object.keys(phases.values).length ? phases.values : void 0,
+      notes: Object.keys(notes.values).length ? notes.values : void 0,
+      omittedPhases: phases.omitted || void 0,
+      omittedNotes: notes.omitted || void 0
+    }) : compact({
+      ...flat.values,
+      omittedMetrics: flat.omitted || void 0
+    });
+    return { name, totalUs, shaped };
+  }).sort((a, b) => b.totalUs - a.totalUs);
+  const kept = ranked.slice(0, PERF_COMPONENT_LIMIT);
+  return {
+    ...Object.fromEntries(kept.map(({ name, shaped }) => [name, shaped])),
+    ...ranked.length > PERF_COMPONENT_LIMIT ? { _summary: { omittedComponents: ranked.length - PERF_COMPONENT_LIMIT } } : {}
+  };
+}
 var errorInfo = (e, req = {}, component = "nomos.webview.runner") => {
   const err = e;
   const existing = plainObject(err?.errorInfo) || plainObject(err?.info);
@@ -99,6 +136,7 @@ function createWebviewRunner({ post: post2, openRealm: openRealm2 }) {
   const spanStarts = /* @__PURE__ */ new Map();
   const forwardSpan = (session, raw) => {
     const s = plainObject(raw) ?? {};
+    const presented = s.kernelSpans === void 0 ? s : { ...s, kernelSpans: boundedKernelSpans(s.kernelSpans) };
     const id = String(s.id ?? "");
     if (s.phase === "begin" && id) {
       spanStarts.set(id, s);
@@ -115,13 +153,13 @@ function createWebviewRunner({ post: post2, openRealm: openRealm2 }) {
           elapsedMs,
           domain: s.domain,
           directiveId: s.directiveId,
-          kernelSpans: s.kernelSpans,
+          kernelSpans: presented.kernelSpans,
           born: s.born,
           birthOutcomes: s.birthOutcomes
         }))}`);
       }
     }
-    post2({ v: WEBVIEW_BRIDGE_VERSION, event: "span", session, span: raw });
+    post2({ v: WEBVIEW_BRIDGE_VERSION, event: "span", session, span: presented });
   };
   const pendingCustodyAsks = /* @__PURE__ */ new Map();
   let connectGate = Promise.resolve();
@@ -566,7 +604,12 @@ function createWebviewRunner({ post: post2, openRealm: openRealm2 }) {
       return await (await need(a)).__nomosPrepareOwnedRecordAction({ action: a.action, scope: a.scope, record: a.record, peer: a.peer });
     },
     async cryptoOwnedBirthScopeKey(a) {
-      return await (await need(a)).__nomosOwnedBirthScopeKey({ scope: a.scope, namespace: a.namespace, key: a.key, record: a.record });
+      return await (await need(a)).__nomosOwnedBirthScopeKey({
+        scope: a.scope,
+        namespace: a.namespace,
+        key: a.key,
+        ...a.record !== void 0 ? { record: a.record } : {}
+      });
     },
     async cryptoOwnedDeviceRequest(a) {
       return { request: await (await need(a)).__nomosOwnedDeviceRequest({ scope: a.scope }) };

package/dart/lib/src/runner/offline-install.mjs

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 };
 
 // <define:__NOMOS_KERNEL_RELEASE__>
-var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "efe619cbabba8f5d9d1a1309e7ab60feb489ddb4794ce5a6a95f35c7e7ae5928", version: "kernel-efe619cb", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"], protocol: 1 }, testMint: { hash: "0a801b8f40a17d3a1534d1452f0dc990f160299f6db55fe9c0c39d7aa726730b", version: "kernel-0a801b8f", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"], protocol: 1 } };
+var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "4bf8f2709135d729475c4dfbabb2014f8d1e10ff506506da1ee0299a808c415e", version: "kernel-4bf8f270", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"], protocol: 1 }, testMint: { hash: "c83316d63542760b76df0588e42c1ec34367536790bb73775694c6d167a8a87e", version: "kernel-c83316d6", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"], protocol: 1 } };
 
 // runner/offline-install.ts
 import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync } from "node:fs";

package/dart/lib/src/test_harness.dart

@@ -519,6 +519,7 @@ class NomosTestHarness {
   /// [autoTearDown] — when true (default) and [registerTearDown] is given, registers [dispose] as a teardown.
   static Future<NomosTestHarness> ephemeral({
     required List<String> lawUsdzPaths,
+    int? applicationMaxChildWorkspacesPerUser,
     String? ownerSubject,
     String workspace = 'test-ws',
     String clientId = 'test-runner',
@@ -670,6 +671,14 @@ class NomosTestHarness {
         ),
       );
       if (birthsApplicationHome) {
+        final maxChildWorkspaces = applicationMaxChildWorkspacesPerUser;
+        if (maxChildWorkspaces == null || maxChildWorkspaces < 0) {
+          throw NomosTestHarnessException(
+            'a generated application scenario must carry its law-declared '
+            'application.maxChildWorkspacesPerUser into the test ceremony; '
+            'Nomos has no test-only birth-policy fallback',
+          );
+        }
         final devicePublic = info['devicePublic']?.toString();
         final deviceSecret = info['deviceSecret']?.toString();
         final framework = info['frameworkHash']?.toString();
@@ -689,6 +698,29 @@ class NomosTestHarness {
           );
         }
         final keyHash = sha256.convert(base64Decode(devicePublic)).toString();
+        final bornAt = DateTime.now().toUtc().toIso8601String();
+        await _phased(
+          phase: 'application: establish the parent birth policy',
+          workspace: installWorkspace,
+          awaiting: 'law-declared seedBirthPolicy offer',
+          timeout: phaseTimeout ?? _kOtherDeadline,
+          onDiagnostic: onDiagnostic,
+          // This throwaway parent is still on its warrant-free founding prefix. The generated
+          // scenario carries the value from the same package declaration that compiled the
+          // receiving-group plan; the harness does not choose or default it. The ordinary
+          // seed offer crosses the kernel author gate before the first birth is attempted.
+          run: () => plane.session(installWorkspace).offerOutcome(
+            domain: '__nomos_application_home_v1',
+            directiveId: 'seedBirthPolicy',
+            actor: owner,
+            authorSecret: deviceSecret,
+            payload: <String, Object?>{
+              'maxBirthsPerPrincipal': maxChildWorkspaces,
+              'setBy': owner,
+              'setAt': bornAt,
+            },
+          ),
+        );
         final outcome = await _phased(
           phase: 'application: birth the signed-in application',
           workspace: workspace,
@@ -707,7 +739,7 @@ class NomosTestHarness {
               // Ordered application deployment is reference packages first, deferred child payload last.
               // The parent serves the references; the receiving group is born with only its payload law.
               'lawHash': laws.last,
-              'bornAt': DateTime.now().toUtc().toIso8601String(),
+              'bornAt': bornAt,
             },
           ),
         );

package/dart/lib/src/webview_bridge.dart

@@ -1039,6 +1039,11 @@ class NomosBridge {
   // [acquireSession]'s per-workspace single-flight: workspace → the in-flight open every concurrent
   // acquirer joins (removed when it completes; a live session then hits the fast path instead).
   final Map<String, Future<NomosSession>> _acquiring = {};
+  // Every workspace opened as part of one stateful application participates in continuous custody exchange.
+  // Starting that lifecycle is itself single-flight: generated navigation may discover the same child through
+  // several references, but the runner gets one autoSync registration for that session.
+  final Set<String> _autoSyncSessions = {};
+  final Map<String, Future<void>> _autoSyncStarting = {};
   int _seq = 0;
   final String _traceId = _newTraceId();
   late final StreamSubscription<Map<String, Object?>> _sub;
@@ -1875,14 +1880,34 @@ class NomosBridge {
       plane._sessionPrincipals[workspace] = sourcePrincipal;
     }
 
+    Future<NomosSession> ready(NomosSession opened) async {
+      inheritPrincipal();
+      if (!plane._autoSyncSessions.contains(workspace)) {
+        final start = plane._autoSyncStarting.putIfAbsent(workspace, () async {
+          await opened.autoSync();
+          plane._autoSyncSessions.add(workspace);
+        });
+        try {
+          await start;
+        } finally {
+          if (identical(plane._autoSyncStarting[workspace], start)) {
+            plane._autoSyncStarting.remove(workspace);
+          }
+        }
+      }
+      return opened;
+    }
+
     if (plane._sessionNames.contains(workspace)) {
       inheritPrincipal();
-      return Future.value(session(workspace));
+      return ready(session(workspace));
     }
     // SINGLE-FLIGHT: one in-flight open per workspace per plane; concurrent callers join it.
     return plane._acquiring.putIfAbsent(workspace, () async {
       try {
-        if (plane._sessionNames.contains(workspace)) return session(workspace);
+        if (plane._sessionNames.contains(workspace)) {
+          return ready(session(workspace));
+        }
         // Consult the plane's TRUTHFUL registry (mounted ∪ parked ∪ resident custody — the runner's
         // realm.list()): anything the device already holds opens locally, no cloud, no credentials.
         var resident = false;
@@ -1898,8 +1923,7 @@ class NomosBridge {
               session: workspace,
               allowUnborn: true,
               authorSecret: authorSecret);
-          inheritPrincipal();
-          return session(workspace);
+          return ready(session(workspace));
         }
         if (ifAbsentCredentials == null) {
           throw StateError(
@@ -1916,8 +1940,7 @@ class NomosBridge {
           authorSecret: c.authorSecret ?? authorSecret,
           allowUnborn: c.allowUnborn,
         );
-        inheritPrincipal();
-        return session(workspace);
+        return ready(session(workspace));
       } finally {
         // completed (either way) — the next acquire re-evaluates fresh (a live session hits the fast path).
         plane._acquiring.remove(workspace);
@@ -1935,11 +1958,12 @@ class NomosBridge {
   /// @internal The immutable genesis of a sibling custody chain. This is observational metadata used to
   /// compose an ordinary source-enrolment offer; the kernel still reopens and proves every foreign read.
   Future<String> nomosWorkspaceGenesis(String workspace,
-      {String? session}) async =>
+          {String? session}) async =>
       (_asMap(await _call('nomosWorkspaceGenesis', {
-        'workspace': workspace,
-        if (session != null) 'session': session,
-      }))['genesis'] ?? '')
+                'workspace': workspace,
+                if (session != null) 'session': session,
+              }))['genesis'] ??
+              '')
           .toString();
 
   /// UNDO the most-recent action via the kernel STRIKE primitive (the fold drops the struck intent by parity).
@@ -2452,7 +2476,8 @@ class NomosBridge {
   /// Compare an immutable publication pin with the stable series' one compiled
   /// current pointer. This is an O(current-state) check: it neither resolves the
   /// pinned publication nor reconstructs aggregate history.
-  Future<ReferenceFreshness<TVersion>> checkReferenceFreshness<TVersion, TSeries>(
+  Future<ReferenceFreshness<TVersion>>
+      checkReferenceFreshness<TVersion, TSeries>(
     VersionedNomosRef<TVersion, TSeries> reference,
   ) async {
     final result = _asMap(await _call('checkRefFreshness', {
@@ -2460,8 +2485,7 @@ class NomosBridge {
         {
           'pinned': NmsInternalNomosRefs.toJson(reference.pinned),
           'series': NmsInternalNomosRefs.toJson(reference.series),
-          'currentField':
-              NmsInternalVersionedNomosRefs.currentField(reference),
+          'currentField': NmsInternalVersionedNomosRefs.currentField(reference),
         },
       ],
     }));
@@ -2666,8 +2690,8 @@ class NomosBridge {
       }));
 
   /// FRAMEWORK-INTERNAL business birth: derive the unborn child's owned key from its deterministic address.
-  Future<NomosScopeKey> nomosOwnedBirthScopeKey(
-      String scope, String namespace, Object? key, String recordType, String recordId) async {
+  Future<NomosScopeKey> nomosOwnedBirthScopeKey(String scope, String namespace,
+      Object? key, String recordType, String recordId) async {
     final out = _asMap(await _call('cryptoOwnedBirthScopeKey', {
       'scope': scope,
       'namespace': namespace,
@@ -2799,14 +2823,20 @@ class NomosBridge {
   /// Each round arrives on [syncEvents] as `{ event:'sync', reason, result }`; socket state as `{event:'link'}`.
   /// Call once after [connect] — then the app never polls.
   Future<void> autoSync(
-          {int? debounceMs, int? fallbackMs, String? signalId}) async =>
-      await _call('autoSync', {
-        if (debounceMs != null) 'debounceMs': debounceMs,
-        if (fallbackMs != null) 'fallbackMs': fallbackMs,
-        if (signalId != null) 'signalId': signalId
-      });
+      {int? debounceMs, int? fallbackMs, String? signalId}) async {
+    await _call('autoSync', {
+      if (debounceMs != null) 'debounceMs': debounceMs,
+      if (fallbackMs != null) 'fallbackMs': fallbackMs,
+      if (signalId != null) 'signalId': signalId
+    });
+    final workspace = _sessionName;
+    if (workspace != null) _eventPlane._autoSyncSessions.add(workspace);
+  }
+
   Future<void> stopAutoSync() async {
     await _call('stopAutoSync');
+    final workspace = _sessionName;
+    if (workspace != null) _eventPlane._autoSyncSessions.remove(workspace);
   }
 
   /// Background-sync telemetry: each autoSync round (`event:'sync'`) and doorbell socket state (`event:'link'`).

package/dart/pubspec.lock

@@ -191,7 +191,7 @@ packages:
       path: "../dart_types"
       relative: true
     source: path
-    version: "0.8.1"
+    version: "0.8.2"
   package_config:
     dependency: "direct main"
     description:

package/dart/pubspec.yaml

@@ -8,7 +8,7 @@ description: >-
   Nomos 2 Dart frontend types — the hand-written kernel wire types plus the
   code-generated per-domain aggregate + directive-payload types. (De)serializes
   the EXACT serde JSON the Rust kernel + projection produce/consume.
-version: 0.64.2
+version: 0.64.4
 
 environment:
   sdk: ^3.5.0
@@ -17,7 +17,7 @@ dependencies:
   # The pure-data core (wire types, offer codec, NomosReads, schema validation, error
   # info). nomos_client depends on and re-exports it, so existing imports are unchanged.
   # For local monorepo dev, pubspec_overrides.yaml points this at ../dart_types.
-  nomos_types: ^0.8.1
+  nomos_types: ^0.8.2
   json_schema: ^5.2.2
   crypto: ^3.0.0
   package_config: ^2.1.0

package/dart/test/acquire_session_test.dart

@@ -25,6 +25,11 @@ class FakeRunner implements BridgeTransport {
   }
 
   int get connectCount => sent.where((m) => m['op'] == 'connect').length;
+  int autoSyncCount(String workspace) => sent
+      .where((m) =>
+          m['op'] == 'autoSync' &&
+          ((m['args'] as Map)['session']).toString() == workspace)
+      .length;
   Map<String, Object?> connectArgs(int i) =>
       (sent.where((m) => m['op'] == 'connect').elementAt(i)['args'] as Map)
           .cast<String, Object?>();
@@ -89,6 +94,8 @@ void main() {
             fail('credentials must not be requested for a mounted session'));
     expect(identical(s, bridge.session('home')), isTrue);
     expect(runner.connectCount, 1, reason: 'no re-connect for a live session');
+    expect(runner.autoSyncCount('home'), 1,
+        reason: 'an acquired application workspace continuously syncs');
     await bridge.dispose();
   });
 
@@ -140,6 +147,8 @@ void main() {
         reason: 'ONE connect for three concurrent acquires');
     expect(identical(results[0], results[1]), isTrue);
     expect(identical(results[1], results[2]), isTrue);
+    expect(runner.autoSyncCount('cloudy'), 1,
+        reason: 'the workspace lifecycle is single-flight too');
     final args = runner.connectArgs(0);
     expect(args['cloud'], 'https://cloud.example');
     expect(args['authToken'], 'tok');

package/dart/test/first_app_gauntlet_test.dart

@@ -148,6 +148,21 @@ void main() {
       final home = harness.session('home');
       final bornEstate = await _leg(
           'leg 2: internal CO2 law setup (Estate → Site → Asset)', () async {
+        // This is an internal framework-conformance setup, so declare its parent allowance explicitly
+        // through the same offer a compiled application ceremony uses. There is deliberately no harness
+        // or kernel fallback for a birth-capable workspace with missing policy.
+        final bornAt = DateTime.now().toUtc().toIso8601String();
+        await home.offerOutcome(
+          domain: 'co2',
+          directiveId: 'seedBirthPolicy',
+          payload: {
+            'maxBirthsPerPrincipal': 1,
+            'setBy': _owner,
+            'setAt': bornAt,
+          },
+          actor: _owner,
+          authorSecret: harness.deviceSecret(home.workspace),
+        );
         final birth = await home.offerOutcome(
           domain: 'co2',
           directiveId: 'nomosBirthEstate',
@@ -157,7 +172,7 @@ void main() {
             'country': 'GB',
             'baselineTonnesCo2e': 4200,
             'principal': _owner,
-            'bornAt': DateTime.now().toUtc().toIso8601String(),
+            'bornAt': bornAt,
           },
           actor: _owner,
         );

package/dart_types/CHANGELOG.md

@@ -1,3 +1,8 @@
+## 0.8.2
+
+- Carry the typed bounded-startup, missing-law and governed child-policy errors used by the USDA-native
+  application lifecycle, preserving kernel refusals as actionable frontend states.
+
 ## 0.8.1
 
 - Carry the typed USDA-native kernel protocol, plan diagnostics, reference freshness and application

package/dart_types/pubspec.yaml

@@ -9,7 +9,7 @@ description: >-
   Pure kernel wire/data types for Nomos Dart frontends — no transport, no bridge,
   no runtime. The hand-written serde-JSON-compatible types plus the offer codec,
   reactive read engine, schema validation, and data-only error/trace types.
-version: 0.8.1
+version: 0.8.2
 
 environment:
   sdk: ^3.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.103.0",
+  "version": "0.103.2",
   "type": "module",
   "sideEffects": false,
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",

package/src/application_home_genesis.ts

@@ -0,0 +1,73 @@
+// NOMOS — explicit application-home founding ceremony.
+
+import type { Directive } from "./directive.js";
+
+const APPLICATION_HOME_GENESIS_BRAND = "__nomos_application_home_genesis_v1" as const;
+
+/** Facts fixed by the canonical receiving-group birth. Tenant law may derive founding offers
+ * from these facts; the host supplies none of them and cannot append an initializer. */
+export interface ApplicationHomeGenesisFacts {
+  readonly owner: string;
+  readonly workspaceName: string;
+  readonly bornAt: string;
+}
+
+export interface ApplicationHomeGenesisStep<
+  P extends Record<string, unknown> = Record<string, unknown>,
+> {
+  readonly domain: string;
+  readonly directive: Directive<P>;
+  readonly payload: (facts: ApplicationHomeGenesisFacts) => P;
+}
+
+export interface ApplicationHomeGenesis {
+  readonly [APPLICATION_HOME_GENESIS_BRAND]: true;
+  readonly steps: readonly ApplicationHomeGenesisStep<any>[];
+}
+
+/** Declare one ordinary offer which must run during application-home genesis. The directive's
+ * own schema and invariants remain the authority over its payload; this helper only binds the
+ * canonical founder facts to that offer and names the law namespace which owns it. */
+export function offerAtHomeGenesis<P extends Record<string, unknown>>(
+  domain: string,
+  directive: Directive<P>,
+  payload: (facts: ApplicationHomeGenesisFacts) => P,
+): ApplicationHomeGenesisStep<P> {
+  const namespace = domain.trim();
+  if (!/^[a-z][a-z0-9_-]*$/.test(namespace)) {
+    throw new Error(`offerAtHomeGenesis: '${domain}' is not a law domain name`);
+  }
+  if (directive === null || typeof directive !== "object" || typeof directive.id !== "string") {
+    throw new Error("offerAtHomeGenesis expects a finished intent or directive");
+  }
+  return Object.freeze({ domain: namespace, directive, payload });
+}
+
+/** The complete tenant-declared extension to the canonical application-home ceremony.
+ * An empty declaration is deliberate; omission means there are no tenant founding offers. */
+export function applicationHomeGenesis<
+  const Steps extends readonly ApplicationHomeGenesisStep<any>[],
+>(
+  ...steps: Steps
+): ApplicationHomeGenesis {
+  const seen = new Set<string>();
+  for (const step of steps) {
+    const key = `${step.domain}\u001f${step.directive.id}`;
+    if (seen.has(key)) {
+      throw new Error(
+        `applicationHomeGenesis repeats '${step.domain}/${step.directive.id}'; ` +
+          "one founding offer must have one accountable position",
+      );
+    }
+    seen.add(key);
+  }
+  return Object.freeze({
+    [APPLICATION_HOME_GENESIS_BRAND]: true,
+    steps: Object.freeze([...steps]),
+  });
+}
+
+export function isApplicationHomeGenesis(value: unknown): value is ApplicationHomeGenesis {
+  return value !== null && typeof value === "object" &&
+    (value as Record<string, unknown>)[APPLICATION_HOME_GENESIS_BRAND] === true;
+}

package/src/birth_meter.ts

@@ -28,7 +28,8 @@
  *       CAS-re-derived on every lane), and a synthesized framework `workspaceInvariant` (the exact
  *       WorkspaceQuota shape) refuses `birth-quota-exceeded` once the subject already holds its
  *       allowance. Allowance resolution: the latest {@link BirthGrant} for the subject if any, else
- *       the workspace's {@link BirthPolicy} singleton, else {@link DEFAULT_MAX_BIRTHS_PER_PRINCIPAL}.
+ *       the workspace's REQUIRED {@link BirthPolicy} singleton. There is no compiled allowance:
+ *       missing policy is invalid state and fails closed as `birth-policy-not-configured`.
  *
  *  A3 — THE POOL CHAINS TO ROOT. A parent births a child WITH the child's own descendant budget
  *       (`buildGenesisChain`'s `descendantPool` threads a `seedBirthPolicy` genesis step), so every
@@ -164,15 +165,6 @@ export const BIRTH_FRAMEWORK_QUERIES: readonly QueryDecl[] = [
   childLifecyclesByStatus,
 ];
 
-/**
- * THE DEFAULT BIRTH ALLOWANCE when a workspace carries neither a BirthPolicy singleton nor a grant
- * for the subject: a CONSERVATIVE floor for non-root workspaces (a home births a handful of estate
- * children; a platform that needs more seeds a BirthPolicy at its own genesis — the A3 induction —
- * or grants per-subject allowances). Root/platform governance already carries the 50-workspace
- * `WorkspaceQuota`; THIS default only ever binds law that never set its own policy.
- */
-export const DEFAULT_MAX_BIRTHS_PER_PRINCIPAL = 5;
-
 // ── the meter subject + the auto-record/auto-capture halves the `.births()` lane calls ─────────────
 
 /** The payload-carried birth SUBJECT the meter counts under: `principal`, else `owner`, else `""`
@@ -257,9 +249,9 @@ type MeterRow = { id?: string; data?: Record<string, unknown> };
  * THE BIRTH-QUOTA VERDICT — the PURE predicate over the COMMITTED captured reads (the same
  * `{queryId,args,result}` the plan recorded, CAS-re-derived on every lane). Counts the subject's
  * birth records and compares against its allowance (the latest BirthGrant.maxBirths if any, else
- * BirthPolicy.maxBirthsPerPrincipal, else {@link DEFAULT_MAX_BIRTHS_PER_PRINCIPAL}). The NEW birth's
- * record is NOT yet in the pre-apply state, so `count < allowance` (strict) is the correct test. A
- * subject-less birth fails CLOSED. Identical on author, edge admission, and verify_chain.
+ * BirthPolicy.maxBirthsPerPrincipal). The NEW birth's record is NOT yet in the pre-apply state, so
+ * `count < allowance` (strict) is the correct test. A subject-less birth and a workspace with no
+ * configured policy both fail CLOSED. Identical on author, edge admission, and verify_chain.
  */
 export function birthQuotaVerdict(
   reads: readonly { queryId: string; args: Record<string, string>; result: unknown }[],
@@ -277,7 +269,7 @@ export function birthQuotaVerdict(
     .filter((r) => r.data?.status === "retired" || r.data?.status === "reclaimed")
     .length;
   const count = Math.max(0, born - terminal);
-  // ALLOWANCE: the LATEST BirthGrant (max grantedAt) wins; else the BirthPolicy singleton; else the floor.
+  // ALLOWANCE: the LATEST BirthGrant (max grantedAt) wins; else the REQUIRED BirthPolicy singleton.
   let allowance: number | undefined;
   let latestGrantedAt = -Infinity;
   for (const g of rowsOf(birthGrantByPrincipal.id, "principal", subject)) {
@@ -293,7 +285,7 @@ export function birthQuotaVerdict(
     const max = Number(policyRows[0]?.data?.maxBirthsPerPrincipal ?? NaN);
     if (Number.isFinite(max)) allowance = max;
   }
-  if (allowance === undefined) allowance = DEFAULT_MAX_BIRTHS_PER_PRINCIPAL;
+  if (allowance === undefined) return { reject: "birth-policy-not-configured" };
   return count < allowance ? { accept: true } : { reject: "birth-quota-exceeded" };
 }
 

package/src/birth_meter_ensure.ts

@@ -31,6 +31,7 @@ import {
   BirthGrant,
 } from "./birth_meter.js";
 import {
+  grantBirthAllowance,
   reclaimChild,
   reclaimChildAsAdmin,
   reclaimChildAsAdminRequiresRetired,
@@ -41,6 +42,8 @@ import {
   retireChildAsAdminRequiresBirth,
   retireChildRequiresBirth,
   retireChildNotReclaimed,
+  seedBirthPolicy,
+  setBirthPolicy,
 } from "./framework/birth_meter.js";
 import { RelationTuple, relationTupleInstanceId, relationTuplesByObject } from "./framework/relations.js";
 import { GENESIS_WARRANT_ID, GenesisWarrant, seedGenesis } from "./framework/genesis.js";
@@ -236,6 +239,12 @@ export function withBirthMeterExports<M extends Record<string, unknown>>(mod: M)
   internalize("__nomos_NomosChildLifecycle", NomosChildLifecycle);
   internalize("__nomos_BirthPolicy", BirthPolicy);
   internalize("__nomos_BirthGrant", BirthGrant);
+  // A birth-capable workspace is never allowed to depend on a compiled allowance. Its law must
+  // carry both the genesis seed and the governed amendment verbs; presentation codegen keeps these
+  // framework controls private while the kernel can still route and authorize them normally.
+  internalize("__nomos_seedBirthPolicy", seedBirthPolicy);
+  internalize("__nomos_setBirthPolicy", setBirthPolicy);
+  internalize("__nomos_grantBirthAllowance", grantBirthAllowance);
   internalize("__nomos_retireChild", retireChild);
   internalize("__nomos_reclaimChild", reclaimChild);
   internalize("__nomos_retireChildAsAdmin", retireChildAsAdmin);