@githolon/dsl 0.103.0 → 0.103.2

package/src/births.ts

@@ -84,6 +84,11 @@ export interface BusinessBirthDecl<
   readonly founderRoles: readonly string[];
   /** The business noun those founder roles govern. */
   readonly founderScope: string;
+  /** Explicit policy inherited by the BORN workspace. Zero declares a leaf workspace. */
+  readonly maxChildWorkspacesPerUser: number;
+  /** @internal Compiler-derived namespaces installed into the born workspace. The declaration owns
+   * the value; this list only repeats that value wherever the composed law requires its own state. */
+  __nomosBirthPolicyDomains?: readonly string[];
   /** Optional business noun used only to make the durable address readable. Defaults to the aggregate id. */
   readonly namespace?: string;
   /** Owning business domain, needed only when another domain composes this birth into a wider intent. */
@@ -114,6 +119,11 @@ export interface BusinessBirthSpec<F extends Record<string, Field>> {
     /** Business noun governed by those roles. Defaults to the born aggregate noun. */
     readonly scope?: string;
   };
+  /** Law for the workspace being born. This is mandatory because silence must not become a
+   * compiler-chosen quota; zero explicitly declares that the born workspace is a leaf. */
+  readonly children: {
+    readonly maxWorkspacesPerUser: number;
+  };
   /** Additional atomic business initialization which belongs to the same birth. */
   readonly initialise?: (
     root: AggregateRef<F>,
@@ -174,6 +184,13 @@ export function birth<F extends Record<string, Field>>(
         `birth(${aggregate.id}): founder scope '${founderScope}' is not a business noun`,
       );
     }
+    const maxChildWorkspacesPerUser = spec.children?.maxWorkspacesPerUser;
+    if (!Number.isInteger(maxChildWorkspacesPerUser) || maxChildWorkspacesPerUser < 0) {
+      throw new Error(
+        `birth(${aggregate.id}): children.maxWorkspacesPerUser must be an explicit non-negative integer; ` +
+          "zero declares a leaf workspace and Nomos has no compiled fallback",
+      );
+    }
     type Payload = BusinessBirthPayload<F>;
     const declaration = {
       __isBusinessBirth: true,
@@ -188,6 +205,7 @@ export function birth<F extends Record<string, Field>>(
       },
       founderRoles,
       founderScope,
+      maxChildWorkspacesPerUser,
       ...(spec.namespace !== undefined ? { namespace: spec.namespace } : {}),
     };
     const inDomain = (domain: string): BusinessBirthDecl<Payload, F> => {

package/src/business_birth.ts

@@ -51,6 +51,8 @@ import {
 
 /** Private recipe selectors. The kernel resolves these against the parent's current installed law. */
 export const CURRENT_LAW_PREFIX = "nomos:current-law:";
+/** @internal Compiler-only domain enumeration. It carries no allowance or authority. */
+export const BUSINESS_BIRTH_POLICY_DOMAINS_EXPORT = "__nomos_birth_policy_domains_c9f14a";
 
 export interface BusinessBirthMetadata {
   readonly aggregateId: string;
@@ -124,6 +126,7 @@ const applicationIntentOnlyBirths = new WeakSet<object>();
 function lowerOne<P extends Record<string, unknown>, F extends Record<string, Field>>(
   decl: BusinessBirthDecl<P, F>,
   domain: string,
+  initialBirthPolicyDomains: readonly string[] = [domain],
 ): Record<string, unknown> {
   const fields = (decl.payloadSchema as z.ZodObject<z.ZodRawShape>).shape;
   for (const field of INTERNAL_FIELDS) {
@@ -245,6 +248,16 @@ function lowerOne<P extends Record<string, unknown>, F extends Record<string, Fi
           payload: { domainHash: `${CURRENT_LAW_PREFIX}${domain}` },
           domainHash: `${CURRENT_LAW_PREFIX}${domain}`,
         },
+        ...(decl.__nomosBirthPolicyDomains ?? initialBirthPolicyDomains).map((policyDomain) => ({
+          domain: policyDomain,
+          directiveId: "seedBirthPolicy",
+          actor: founder,
+          payload: {
+            maxBirthsPerPrincipal: decl.maxChildWorkspacesPerUser,
+            setBy: founder,
+            setAt: p.bornAt,
+          },
+        })),
         {
           domain,
           directiveId: seedId,
@@ -396,10 +409,29 @@ export function businessBirthConsequence<
   return lowered;
 }
 
+/** @internal Bind the compiler-derived composed-law namespaces to declarations already captured by
+ * wider business intents. This chooses no policy value; it only repeats the tenant-declared value
+ * across the namespaces whose USDA says they can birth. */
+export function bindBusinessBirthPolicyDomains(
+  mod: Record<string, unknown>,
+  domains: readonly string[],
+): void {
+  const declarations = businessBirthsOf(mod);
+  if (declarations.length === 0) return;
+  const unique = [...new Set(domains)];
+  if (unique.length === 0 || unique.some((value) => value.trim().length === 0)) {
+    throw new Error("birth policy namespaces must be a non-empty list of domain names");
+  }
+  for (const declaration of declarations) {
+    declaration.__nomosBirthPolicyDomains = unique;
+  }
+}
+
 /** Lower the one tenant-facing birth declaration into ordinary, gate-visible framework directives. */
 export function expandBusinessBirthExports<M extends Record<string, unknown>>(
   mod: M,
   domain: string,
+  birthPolicyDomains?: readonly string[],
 ): Record<string, unknown> {
   const declarations = businessBirthsOf(mod);
   if (declarations.length === 0) return mod;
@@ -409,7 +441,18 @@ export function expandBusinessBirthExports<M extends Record<string, unknown>>(
         "ambiguous — model one born aggregate root per domain",
     );
   }
-  const lowered = lowerOne(declarations[0]!, domain);
+  const compiledDomains = mod[BUSINESS_BIRTH_POLICY_DOMAINS_EXPORT];
+  const selectedDomains = birthPolicyDomains ?? (
+    Array.isArray(compiledDomains) && compiledDomains.every((value) => typeof value === "string")
+      ? compiledDomains as string[]
+      : [domain]
+  );
+  const policyDomains = [...new Set(selectedDomains)];
+  if (policyDomains.length === 0 || policyDomains.some((value) => value.trim().length === 0)) {
+    throw new Error(`birth(${declarations[0]!.aggregate.id}): compiled law declares no policy namespaces`);
+  }
+  bindBusinessBirthPolicyDomains(mod, policyDomains);
+  const lowered = lowerOne(declarations[0]!, domain, policyDomains);
   for (const [key, generated] of Object.entries(lowered)) {
     if (!Object.prototype.hasOwnProperty.call(mod, key)) continue;
     const existing = mod[key];

package/src/codegen_dart_application.ts

@@ -405,6 +405,7 @@ export function generateDartApplication(
     applicationMembers.set(name, owner);
   };
   claimApplicationMember("activity", "the generated business history");
+  claimApplicationMember("model", "the generated model lifecycle");
   const collectionLines = new Map<string, string[]>();
   const collectionMembers = new Map<string, Set<string>>();
   const siblingImports = new Map<string, Set<string>>();
@@ -1168,6 +1169,18 @@ export function generateDartApplication(
           `    for (final record in records) {`,
           `      seen.add(NmsInternalRecordOrigins.require(record).workspace);`,
           `    }`,
+          `    for (final record in await shared()) {`,
+          `      final workspace = NmsInternalRecordOrigins.require(record).workspace;`,
+          `      if (seen.add(workspace)) records.add(record);`,
+          `    }`,
+          `    return records;`,
+          `  }`,
+          ``,
+          `  /// The ${birth.aggregateId} lives shared with the signed-in person.`,
+          `  /// Unlike [available], this does not open lives founded by that person.`,
+          `  Future<List<${rootModel}>> shared() async {`,
+          `    final records = <${rootModel}>[];`,
+          `    final seen = <String>{};`,
           `    final shares = await _client.bridge.query('sharedByObject', {'object': 'workspace:self'}, null, _client.actor);`,
           `    for (final row in shares) {`,
           `      final raw = row['data'];`,
@@ -1191,6 +1204,12 @@ export function generateDartApplication(
           `    return records;`,
           `  }`,
           ``,
+          `  /// React when this person's shared ${birth.aggregateId} lives change.`,
+          `  Stream<List<${rootModel}>> watchShared() =>`,
+          `      _client.bridge`,
+          `          .watch('sharedByObject', {'object': 'workspace:self'}, null, _client.actor, 60000)`,
+          `          .asyncMap((_) => shared());`,
+          ``,
           `  /// React when this person's available ${birth.aggregateId} lives change.`,
           `  Stream<List<${rootModel}>> watchAvailable() =>`,
           `      Stream<List<${rootModel}>>.multi((events) {`,
@@ -1904,7 +1923,9 @@ export function generateDartApplication(
                 `import 'package:nomos_flutter/src/application_status.dart' show ApplicationSignIn, ApplicationStatus;`,
               ]
             : []),
-          `import 'package:nomos_flutter/src/generated_application_host.dart' show NmsInternalApplicationUserBinding${
+          `import 'package:nomos_flutter/src/generated_application_host.dart' show ${
+            tenantRoot ? "NomosApplicationStartupState, " : ""
+          }NmsInternalApplicationUserBinding${
             tenantRoot || sharingPolicies.length > 0
               ? ", NmsInternalApplicationHost"
               : ""
@@ -1954,6 +1975,9 @@ export function generateDartApplication(
     `  ${application}._(${client} client${
       tenantRoot ? ", User currentUser" : ""
     }) : ${applicationInitializers.join(", ")};`,
+    ``,
+    `  /// Prove, adopt or restore the law this application was generated against.`,
+    `  NomosModel get model => _client.model;`,
     ...(opts.flutterHost === true && tenantRoot
       ? [
           ``,
@@ -1977,10 +2001,12 @@ export function generateDartApplication(
           `    required Widget Function(BuildContext context, ${application} application) builder,`,
           `    Widget Function(BuildContext context)? loadingBuilder,`,
           `    Widget Function(BuildContext context, Object error, VoidCallback retry)? errorBuilder,`,
+          `    ValueChanged<NomosApplicationStartupState>? onStartupStateChanged,`,
           `  }) => NmsInternalApplicationHost.home<${application}>(`,
           `    key: key, cloud: cloud, application: application, signIn: signIn,`,
           `    bind: nomosInternalBind${application}, builder: builder,`,
           `    loadingBuilder: loadingBuilder, errorBuilder: errorBuilder,`,
+          `    onStartupStateChanged: onStartupStateChanged,`,
           `  );`,
         ]
       : []),

package/src/codegen_dart_scenario.ts

@@ -90,6 +90,7 @@ export function generateDartScenario(
     readonly surfaceName?: string;
     readonly applicationFile?: string;
     readonly applicationModules?: readonly DomainModule[];
+    readonly applicationMaxChildWorkspacesPerUser?: number;
   } = {},
 ): string {
   const domain = options.surfaceName ?? mod.domain ?? mod.name;
@@ -195,6 +196,9 @@ export function generateDartScenario(
     `    final packageFiles = await _applicationPackages();`,
     `    final environment = await NomosTestHarness.ephemeral(`,
     `      lawUsdzPaths: packageFiles.map((file) => file.path).toList(growable: false),`,
+    ...(options.applicationMaxChildWorkspacesPerUser === undefined
+      ? []
+      : [`      applicationMaxChildWorkspacesPerUser: ${options.applicationMaxChildWorkspacesPerUser},`]),
     `      ownerSubject: person._principal,`,
     `      workspace: nmsInternalReceivingGroupNameOf(person._principal),`,
     `      nodeEntry: Platform.environment['NOMOS_NODE_ENTRY'],`,
@@ -224,6 +228,9 @@ export function generateDartScenario(
     `    final cloud = await NomosTestCloud.start(`,
     `      serverEntry: serverEntry, platform: applicationName,`,
     `      lawUsdzPaths: packageFiles.map((file) => file.path).toList(growable: false),`,
+    ...(options.applicationMaxChildWorkspacesPerUser === undefined
+      ? []
+      : [`      applicationMaxChildWorkspacesPerUser: ${options.applicationMaxChildWorkspacesPerUser},`]),
     `      onDiagnostic: Platform.environment['NOMOS_TEST_DIAGNOSTICS'] == '1' ? stderr.writeln : null,`,
     `    );`,
     `    late final NomosTestHarness environment;`,

package/src/codegen_proof.ts

@@ -2441,6 +2441,9 @@ export interface TsProofOptions {
   readonly domainHash: string;
   /** Stable-id structural interface used to teach the offline harness the hidden owned-birth seal slots. */
   readonly interface?: Readonly<Record<string, DomainInterface>>;
+  /** Compiled application-home child allowance. The local proof cloud seeds this exact law fact before
+   * warranting its throwaway platform; absent means this is a domain package, not an application root. */
+  readonly applicationMaxChildWorkspacesPerUser?: number;
 }
 
 /** THE PROOF TAXONOMY (co2 feedback): which legs a domain carries.
@@ -2455,6 +2458,8 @@ export type ProofKind = "compile-valid" | "standalone-provable" | "child-birth-p
  *  marker shape; the `proof-legs.json` index is a map of these by domain key). */
 export interface ProofLegs {
   readonly domain: string;
+  /** Application policy carried to the local proof ceremony; never a runner default. */
+  readonly applicationMaxChildWorkspacesPerUser?: number;
   /** THE TAXONOMY (co2 feedback) — the legs this domain has, in proof order. EVERY domain has at least
    *  `compile-valid`. OPTIONAL + ADDITIVE: an older-compiler legs file without it is treated as
    *  `["standalone-provable"]` (it only emitted standalone-provable domains). */
@@ -3223,7 +3228,12 @@ function generateSealedApplicationProof(
   const domain = mod.domain ?? mod.name;
   const applicationName = tsApplicationName(opts.packageName);
   const opener = `open${applicationName}`;
-  const marker = JSON.stringify(primaryLegs);
+  const marker = JSON.stringify({
+    ...primaryLegs,
+    ...(opts.applicationMaxChildWorkspacesPerUser === undefined
+      ? {}
+      : { applicationMaxChildWorkspacesPerUser: opts.applicationMaxChildWorkspacesPerUser }),
+  });
   const standalone = orderedStandaloneCreates(mod)[0];
   const businessBirth = primaryLegs.childBirth?.businessAggregateId !== undefined
     ? primaryLegs.childBirth

package/src/compile_package_main.ts

@@ -103,7 +103,11 @@ import {
 import { synthesizePreconditionInvariants } from "./precondition.js";
 import { BIRTH_FRAMEWORK_QUERIES, synthesizeBirthQuotaInvariants } from "./birth_meter.js";
 import { withBirthMeterExports } from "./birth_meter_ensure.js";
-import { expandBusinessBirthExports } from "./business_birth.js";
+import {
+  BUSINESS_BIRTH_POLICY_DOMAINS_EXPORT,
+  bindBusinessBirthPolicyDomains,
+  expandBusinessBirthExports,
+} from "./business_birth.js";
 import { withOwnedCustodyExports } from "./framework/owned_custody.js";
 import { expandRoleExports, rolesOf } from "./role.js";
 import { collectEngineRouting } from "./engine_entry.js";
@@ -158,6 +162,8 @@ import { checkDomainModules, formatFindings, hasRefusal } from "./law_check.js";
 import type { NomosCompat } from "./compat_manifest.js";
 import { requiredKernelFeatures, type FeatureProbeModule } from "./kernel_capabilities.js";
 import { APPLICATION_HOME_DOMAIN } from "./framework/application_home_domain.js";
+import { applicationHomePolicyLaw } from "./framework/application_home.js";
+import { isApplicationHomeGenesis } from "./application_home_genesis.js";
 import { resolveApplicationTopology } from "./application_topology.js";
 import { isBusinessIntent } from "./intent.js";
 import {
@@ -1603,8 +1609,8 @@ const NOMOS_TYPES_DEP = "^0.8.0";
 // 0.48.x: session-bound clients (XClient.bind/NomosClientInterface/DomainClientSessionMismatch/
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
-const NOMOS_CLIENT_DEP = "^0.64.1";
-const NOMOS_FLUTTER_DEP = "^0.63.1";
+const NOMOS_CLIENT_DEP = "^0.64.3";
+const NOMOS_FLUTTER_DEP = "^0.63.4";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in dsl/dart/pubspec.yaml
 // and dsl/dart_types/pubspec.yaml — a Dart release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).
@@ -1805,6 +1811,10 @@ function generatedPackageApplication(
   const invitationPolicies = members.flatMap(({ domain, invitationPolicies }) =>
     invitationPolicies.map((policy) => ({ domain, ...policy })));
   const hasInvitations = invitationPolicies.length > 0;
+  const rootMember = members.find(({ domain }) => domain === homeDomain);
+  if (rootMember === undefined) {
+    throw new Error(`generated Dart package application cannot expose the model for home domain '${homeDomain}'`);
+  }
   const duplicate = members.find((candidate, index) =>
     members.findIndex((other) => other.member === candidate.member) !== index);
   if (duplicate !== undefined) {
@@ -1817,6 +1827,7 @@ function generatedPackageApplication(
     ["currentUser", "the generated signed-in application participant"],
     ["currentStatus", "the generated application status"],
     ["watchStatus", "the generated application status watch"],
+    ["model", "the generated model lifecycle"],
     ["recipient", "the generated typed recipient boundary"],
     ["createInvitation", "the generated invitation capability"],
     ["redeemInvitation", "the generated invitation redemption"],
@@ -1836,7 +1847,7 @@ function generatedPackageApplication(
     `import 'package:flutter/widgets.dart';`,
     `import 'package:nomos_flutter/src/application_status.dart' show ApplicationSignIn, ApplicationStatus;`,
     `import 'package:nomos_client/src/nms_generated_runtime.dart' show NmsInternalUsers, NomosSession, User${hasInvitations ? ", Invitation, Recipient" : ""};`,
-    `import 'package:nomos_flutter/src/generated_application_host.dart' show NmsInternalApplicationHost, NmsInternalApplicationUserBinding${hasInvitations ? ", NmsInternalInvitationPolicy" : ""};`,
+    `import 'package:nomos_flutter/src/generated_application_host.dart' show NomosApplicationStartupState, NmsInternalApplicationHost, NmsInternalApplicationUserBinding${hasInvitations ? ", NmsInternalInvitationPolicy" : ""};`,
     ...members.map(({ file, prefix }) =>
       `import '${file}.application.dart' as ${prefix};`),
     ``,
@@ -1866,6 +1877,9 @@ function generatedPackageApplication(
     ]),
     `  const ${application}._({required NomosSession nmsSession, ${hasInvitations ? "required NmsInternalApplicationUserBinding nmsUser, " : ""}required this.currentUser, ${members.map(({ member }) => `required this.${member}`).join(", ")}}) : _nmsSession = nmsSession${hasInvitations ? ", _nmsUser = nmsUser" : ""};`,
     ``,
+    `  /// Prove, adopt or restore the package law against this workspace's exact history.`,
+    `  ${rootMember.prefix}.NomosModel get model => ${rootMember.member}.model;`,
+    ``,
     `  /// Current durability and convergence across this business application.`,
     `  ApplicationStatus get currentStatus => NmsInternalApplicationHost.currentStatus(_nmsSession);`,
     ``,
@@ -1916,10 +1930,12 @@ function generatedPackageApplication(
     `    required Widget Function(BuildContext context, ${application} application) builder,`,
     `    Widget Function(BuildContext context)? loadingBuilder,`,
     `    Widget Function(BuildContext context, Object error, VoidCallback retry)? errorBuilder,`,
+    `    ValueChanged<NomosApplicationStartupState>? onStartupStateChanged,`,
     `  }) => NmsInternalApplicationHost.home<${application}>(`,
     `    key: key, cloud: cloud, application: application, signIn: signIn,`,
     `    bind: nomosInternalBind${application}, builder: builder,`,
     `    loadingBuilder: loadingBuilder, errorBuilder: errorBuilder,`,
+    `    onStartupStateChanged: onStartupStateChanged,`,
     `  );`,
     `}`,
     ``,
@@ -2085,6 +2101,7 @@ function emitDartPackages(
   compat?: NomosCompat,
   describePackageName = packages.client,
   lawUsdzPath?: string,
+  applicationMaxChildWorkspacesPerUser?: number,
 ): { written: string[]; cursed: string[] } {
   for (const [role, name] of Object.entries(packages)) {
     if (typeof name !== "string" || !isPubPackageName(name)) {
@@ -2547,6 +2564,9 @@ function emitDartPackages(
             surfaceName,
             applicationFile,
             applicationModules: perDomain.map(({ dd: candidate }) => candidate.modForDart),
+            ...(applicationMaxChildWorkspacesPerUser === undefined
+              ? {}
+              : { applicationMaxChildWorkspacesPerUser }),
           },
         ),
         "utf8",
@@ -2765,6 +2785,52 @@ async function main(): Promise<void> {
         `rename the tenant domain (Nomos will not silently overwrite or reroute it)`,
     );
   }
+  if (cfg.rootPart !== undefined && cfg.application === undefined) {
+    fail(
+      "published application packages must declare application: { maxChildWorkspacesPerUser }; " +
+        "Nomos will not compile a birth-capable home with an implicit quota",
+    );
+  }
+  // A born application home may carry several co-resident law namespaces. BirthPolicy is namespaced
+  // law-state, so genesis must seed every domain that can itself birth; seeding only the private home
+  // domain would leave (for example) `home/birthEstate` correctly refusing its first offer. Discover the
+  // set from the authored modules and bake it into the private genesis plan. The host never supplies it.
+  const applicationBirthPolicyDomains: string[] = [];
+  let applicationHomeGenesisSource:
+    | { readonly modulePath: string; readonly exportName: string }
+    | undefined;
+  if (cfg.rootPart !== undefined) {
+    applicationBirthPolicyDomains.push(APPLICATION_HOME_DOMAIN);
+  }
+  for (const domain of cfg.domains) {
+    let authored: Mod = {};
+    for (const rel of domain.modules) {
+      const abs = path.resolve(cfgDir, rel);
+      if (!existsSync(abs)) fail(`domain '${domain.key}': module not found: ${abs}`);
+      const imported = await import(pathToFileURL(abs).href) as Mod;
+      authored = { ...authored, ...imported };
+      for (const [exportName, value] of Object.entries(imported)) {
+        if (value !== cfg.application?.homeGenesis || !isApplicationHomeGenesis(value)) continue;
+        if (applicationHomeGenesisSource !== undefined) {
+          fail(
+            "application.homeGenesis is exported from more than one configured law module; " +
+              "keep one canonical declaration",
+          );
+        }
+        applicationHomeGenesisSource = { modulePath: abs, exportName };
+      }
+    }
+    const expanded = expandBusinessBirthExports(authored, domain.key);
+    if (directivesOf(expanded).some((dir) => dir.birthsChild === true)) {
+      applicationBirthPolicyDomains.push(domain.key);
+    }
+  }
+  if (cfg.application?.homeGenesis !== undefined && applicationHomeGenesisSource === undefined) {
+    fail(
+      "application.homeGenesis must be exported by one configured law module; " +
+        "genesis is custody law, not an inline compiler-only callback",
+    );
+  }
   const domainsToCompile: DomainConfig[] = [
     ...cfg.domains,
     ...(cfg.rootPart === undefined
@@ -2944,9 +3010,39 @@ async function main(): Promise<void> {
         }
       }
     }
+    if (mods.some((mod) => Object.prototype.hasOwnProperty.call(mod, BUSINESS_BIRTH_POLICY_DOMAINS_EXPORT))) {
+      fail(
+        `domain '${d.key}' exports reserved compiler binding '${BUSINESS_BIRTH_POLICY_DOMAINS_EXPORT}'; ` +
+          "rename the tenant export",
+      );
+    }
+    if (d.key === APPLICATION_HOME_DOMAIN) {
+      const max = cfg.application?.maxChildWorkspacesPerUser;
+      if (max === undefined) {
+        fail("the private application home has no declared maxChildWorkspacesPerUser policy");
+      }
+      const homeGenesis = cfg.application?.homeGenesis;
+      const policyMod = applicationHomePolicyLaw(
+        max,
+        applicationBirthPolicyDomains,
+        homeGenesis,
+      ) as Mod;
+      mods.push(policyMod);
+      sourceExprs.push(
+        `() => require(${JSON.stringify(path.join(DSL_DIR, "src", "framework", "application_home.ts"))})` +
+          `.applicationHomePolicyLaw(` +
+          `${JSON.stringify(max)}, ${JSON.stringify(applicationBirthPolicyDomains)}, ` +
+          (applicationHomeGenesisSource === undefined
+            ? `undefined)`
+            : `require(${JSON.stringify(applicationHomeGenesisSource.modulePath)})` +
+              `[${JSON.stringify(applicationHomeGenesisSource.exportName)}])`),
+      );
+    }
     let merged: Mod = {};
     for (const m of mods) merged = { ...merged, ...m };
-    merged = expandBusinessBirthExports(merged, d.key);
+    merged[BUSINESS_BIRTH_POLICY_DOMAINS_EXPORT] = applicationBirthPolicyDomains;
+    bindBusinessBirthPolicyDomains(merged, applicationBirthPolicyDomains);
+    merged = expandBusinessBirthExports(merged, d.key, applicationBirthPolicyDomains);
     merged = withOwnedCustodyExports(merged);
     // `capability()` bundles expand into discoverable entries (the CLI plane's
     // merge point) — queries/sums/sid-minting/manifests all see the pieces.
@@ -3055,6 +3151,10 @@ async function main(): Promise<void> {
       }
     }
 
+    sourceExprs.push(
+      `() => ({ ${JSON.stringify(BUSINESS_BIRTH_POLICY_DOMAINS_EXPORT)}: ` +
+        `${JSON.stringify(applicationBirthPolicyDomains)} })`,
+    );
     const domainSource = `    ${JSON.stringify(d.key)}: [${sourceExprs.join(", ")}],`;
     entryDomainSourceByKey.set(d.key, domainSource);
     entryGeneratedSourceExprsByKey.set(d.key, sourceExprs.slice(d.modules.length));
@@ -3562,6 +3662,15 @@ async function main(): Promise<void> {
     // clients/interfaces; using the pre-closure executable module here published a USDA-only `birth` route.
     const graphModule = closedDomainModulesByName.get(mod.name) ?? mod;
     const discoveredGraph = discoverLawGraph(graphModule, continuity, nextIdentity);
+    for (const node of discoveredGraph.graph.nodes) {
+      if (node.kind === "intent" && node.births && node.birthPolicySeed === undefined) {
+        fail(
+          `domain '${identityName}' birth intent '${node.entity.label}' has no declared birth-policy ` +
+            "genesis verb; Nomos will not compile a birth-capable law whose children can enter " +
+            "custody without explicit policy",
+        );
+      }
+    }
     nextIdentity = discoveredGraph.registry;
     nextLock.identity = nextIdentity;
     typedLawGraphs.set(identityName, discoveredGraph.graph);
@@ -4864,7 +4973,14 @@ async function main(): Promise<void> {
   let birthWarnings: string[] = [];
   let proofNotes: string[] = [];
   try {
-    const proofSrc = generateTsProof(presentationDomainModules, { packageName: cfg.name, domainHash, interface: packageInterface });
+    const proofSrc = generateTsProof(presentationDomainModules, {
+      packageName: cfg.name,
+      domainHash,
+      interface: packageInterface,
+      ...(cfg.application?.maxChildWorkspacesPerUser === undefined
+        ? {}
+        : { applicationMaxChildWorkspacesPerUser: cfg.application.maxChildWorkspacesPerUser }),
+    });
     proofPath = path.join(outDir, `${cfg.name}.proof.mts`);
     writeFileSync(proofPath, proofSrc, "utf8");
     // THE PER-DOMAIN LEGS INDEX: every domain with a creating write, so
@@ -5269,7 +5385,7 @@ async function main(): Promise<void> {
     if (dartPackages !== undefined) {
       const r = emitDartPackages(
         presentationDomainModules, dartOut, domainHash, packageInterface, dartPackages,
-        dartNames, nomosCompat, cfg.name, lawUsdzPath,
+        dartNames, nomosCompat, cfg.name, lawUsdzPath, cfg.application?.maxChildWorkspacesPerUser,
       );
       dartFiles = r.written;
       dartCursedHints = r.cursed;

package/src/directive.ts

@@ -447,6 +447,14 @@ export interface Directive<P = unknown> {
    * `attestationAuthorizedGate`/`.attestationAuthorized()` naming convention; the declaration is the noun.)
    */
   readonly birthsChild?: boolean;
+  /** Additional ordinary offers which the born workspace's typed law requires in genesis.
+   * This is compiler/runtime metadata attached only to a birthing directive. It contains no
+   * payload or fallback value: the kernel checks that the re-derived recipe invokes each named
+   * law verb exactly once after installation. */
+  readonly birthGenesisRequirements?: readonly {
+    readonly domain: string;
+    readonly directiveId: string;
+  }[];
   /**
    * PROOF-TOOLING PRODUCER MARKER (relation-seed leg). Declares that this directive ESTABLISHES the named
    * relation(s) — i.e. its `plan` folds a `writeTuple` that grants the relation. Purely a static hint for

package/src/framework/application_home.ts

@@ -9,6 +9,7 @@
 // routable through the runtime OpenAPI, while TS/Dart/OpenAPI business surfaces omit it.
 
 import type { AggregateHandle } from "../aggregate.js";
+import type { ApplicationHomeGenesis } from "../application_home_genesis.js";
 import type { Directive } from "../directive.js";
 import type { QueryDecl } from "../query.js";
 import { APPLICATION_HOME_DOMAIN } from "./application_home_domain.js";
@@ -70,8 +71,24 @@ const aggregate = (value: AggregateHandle): Internal<AggregateHandle> => interna
 const directive = <P>(value: Directive<P>): Internal<Directive<P>> => internal(value);
 const query = (value: QueryDecl): Internal<QueryDecl> => internal(value);
 
-// Parent primitive + the law its born home uses.
-export const __nomos_birthReceivingGroup = directive(birthReceivingGroupForDomain(APPLICATION_HOME_DOMAIN));
+// Parent primitive + the law its born home uses. The compiler supplies the application's explicit
+// allowance through this factory; there is deliberately no static/default route to discover.
+export function applicationHomePolicyLaw(
+  maxChildWorkspacesPerUser: number,
+  birthPolicyDomains: readonly string[],
+  homeGenesis?: ApplicationHomeGenesis,
+) {
+  return {
+    __nomos_birthReceivingGroup: directive(
+      birthReceivingGroupForDomain(
+        APPLICATION_HOME_DOMAIN,
+        maxChildWorkspacesPerUser,
+        birthPolicyDomains,
+        homeGenesis,
+      ),
+    ),
+  };
+}
 export const __nomos_ReceivingGroup = aggregate(ReceivingGroup);
 export const __nomos_seedReceivingGroup = directive(seedReceivingGroup);
 export const __nomos_ReceivingGroupPolicy = aggregate(ReceivingGroupPolicy);

package/src/framework/birth_meter.ts

@@ -8,7 +8,7 @@
  *
  * The meter's STRUCTURE (record + queries + quota invariant + auto-capture) is auto-ensured on every
  * `.births()` law — see `../birth_meter.ts`. THIS module is the part a tenant COMPOSES IN when they
- * want to GOVERN the allowance instead of living on the conservative default:
+ * uses to govern its required, explicitly seeded allowance:
  *
  *   - {@link setBirthPolicy}      — set/amend the workspace's default allowance (admin-gated).
  *   - {@link grantBirthAllowance} — a per-subject override (admin-gated; latest grant wins).
@@ -56,7 +56,6 @@ export {
   childLifecyclesByStatus,
   birthPolicy,
   birthGrantByPrincipal,
-  DEFAULT_MAX_BIRTHS_PER_PRINCIPAL,
   birthQuotaVerdict,
   birthQuotaInvariantId,
 } from "../birth_meter.js";
@@ -238,7 +237,7 @@ export const setBirthPolicy = directive("setBirthPolicy")
   .ensures(BirthPolicy)
   .payload(
     z.object({
-      maxBirthsPerPrincipal: z.number().int().positive(),
+      maxBirthsPerPrincipal: z.number().int().nonnegative(),
       setBy: z.string().min(1),
       /** Caller-stamped (the timestamp doctrine). */
       setAt: z.string().min(1),
@@ -257,7 +256,7 @@ export const seedBirthPolicy = directive("seedBirthPolicy")
   .ensures(BirthPolicy)
   .payload(
     z.object({
-      maxBirthsPerPrincipal: z.number().int().positive(),
+      maxBirthsPerPrincipal: z.number().int().nonnegative(),
       setBy: z.string().min(1),
       setAt: z.string().min(1),
     }),
@@ -274,7 +273,7 @@ export const grantBirthAllowance = directive("grantBirthAllowance")
   .payload(
     z.object({
       principal: z.string().min(1),
-      maxBirths: z.number().int().positive(),
+      maxBirths: z.number().int().nonnegative(),
       grantedBy: z.string().min(1),
       /** epoch-ms — the recency tiebreak (latest grant wins), caller-stamped. */
       grantedAt: z.number().int().nonnegative(),