@githolon/dsl 0.103.1 → 0.103.3

package/src/framework/workspaces.ts

@@ -158,7 +158,7 @@ export const workspaceSelfWriteOnce = workspaceInvariant("WorkspaceSelfWriteOnce
 // pre-apply folded relation tuples — refusing any author who does not HOLD the relation. The schema +
 // the `.requires` together arm the gate (the `nomosRelations` + `nomosRelationGate` era keys); the
 // static governance roles use the native relation gate. Creation posture is deliberately dynamic law:
-// open/unset admits any proven author, invite checks `creator`, and closed checks `admin`.
+// open admits any proven author, invite checks `creator`, closed checks `admin`, and unset fails closed.
 //
 // THE CONTROL-PLANE CARVE-OUT — LEAF-ONLY (`allow: [user(), key()]`, never a userset/wildcard). A
 // `workspace:self#admin@<group>#member` or `@<type>:*` would let a group/wildcard escalate to admin
@@ -371,8 +371,8 @@ export const CloudPolicy = aggregate("CloudPolicy", {
   /**
    * The workspace-CREATION posture dial (cloud_sovereignty.md S6) —
    * `"open"` (anyone creates), `"invite"` (an active CreationGrant key
-   * required), or `"closed"` (admins only). OPTIONAL: absent keeps the
-   * implicit open posture. Invite and closed are explicit law facts; merely
+   * required), or `"closed"` (admins only). OPTIONAL in the storage schema for
+   * historical replay, but absence fails closed for new births. Merely
    * granting somebody authority never changes the door for everybody else.
    */
   creationPosture: t.string().merge(Lww).optional(),
@@ -529,13 +529,9 @@ export function buildGenesisChain(p: {
    *  from there. Absent ⇒ the recipe resolves an already-installed law by shape (pre-G3 / test lanes). */
   frameworkHash?: string;
   lawHash?: string;
-  /**
-   * METERED BIRTH (slice A3 — the descendant budget). When present, the child's genesis includes a
-   * `seedBirthPolicy` step so it is BORN BOUNDED (its own default birth allowance per subject).
-   * OPT-IN: thread it only when the `lawHash` the order names carries `seedBirthPolicy` (a governance
-   * package compiled under the metered-birth DSL) — see the poolSteps note below.
-   */
-  descendantPool?: number;
+  /** METERED BIRTH (slice A3 — the descendant budget). Required: a governance child may not be
+   * born without explicit BirthPolicy state. Zero is a legitimate declared "cannot birth" policy. */
+  descendantPool: number;
   /** LINEAGE CONTINUITY (rebirth genesis only): the superseded incarnation's genesis oid. Threads onto the
    *  child's birthCloud record (`rebornFrom`) + the bornUnder commitment — the reborn holon testifies to its
    *  ancestry while `parent` stays the SUPERSEDED record's parent (a rebirth may never reparent). */
@@ -566,26 +562,23 @@ export function buildGenesisChain(p: {
     parentHead: "",
     ...(p.rebornFrom ? { rebornFrom: p.rebornFrom } : {}),
   });
-  // METERED BIRTH (slice A3 — THE POOL CHAINS TO ROOT): when the order carries a `descendantPool`, the
-  // child is BORN BOUNDED — a `seedBirthPolicy` genesis step writes the child's own BirthPolicy singleton
-  // (its default birth allowance) BEFORE the warrant lands, exactly like every other genesis seed (the
-  // still-warrant-free prefix runs unsigned). Root bounds platforms (this pool), platforms bound homes,
-  // homes bound projects — the tree meters by induction, with zero cross-workspace reads on any gate.
-  // OPT-IN (deliberate): the step folds through the CHILD'S OWN gate under the law hash the order names,
-  // so it may only be threaded when that law carries `seedBirthPolicy` (a law compiled under this DSL) —
-  // an unconditional default would refuse the genesis of every birth pinning an OLDER law hash. V1
-  // BOUNDARY: each node enforces its own count-quota; cross-level pool CONSERVATION arithmetic is v2.
-  const poolSteps =
-    p.descendantPool !== undefined
-      ? [
-          {
-            domain: "workspaces",
-            directiveId: "seedBirthPolicy",
-            actor: founder,
-            payload: { maxBirthsPerPrincipal: p.descendantPool, setBy: p.principal, setAt: p.bornAt },
-          },
-        ]
-      : [];
+  if (!Number.isInteger(p.descendantPool) || p.descendantPool < 0) {
+    throw new Error(
+      "buildGenesisChain requires an explicit non-negative descendantPool; " +
+        "Nomos has no compiled birth-policy fallback",
+    );
+  }
+  // METERED BIRTH (slice A3 — THE POOL CHAINS TO ROOT): every governance child is BORN BOUNDED.
+  // Historical chains keep replaying under their historical law; this constructor authors only the
+  // current law, whose seedBirthPolicy directive is compiler-carried. Missing policy is invalid genesis.
+  const poolSteps = [
+    {
+      domain: "workspaces",
+      directiveId: "seedBirthPolicy",
+      actor: founder,
+      payload: { maxBirthsPerPrincipal: p.descendantPool, setBy: p.principal, setAt: p.bornAt },
+    },
+  ];
   return JSON.stringify([
     ...installSteps,
     ...poolSteps,
@@ -634,9 +627,6 @@ export const quotaByPrincipal = query("quotaByPrincipal")
   .key("principal")
   .returns(QuotaGrant);
 
-/** THE DEFAULT WORKSPACE ALLOWANCE — the CLAUDE.md / CloudPolicy figure when no grant + no policy row. */
-export const DEFAULT_MAX_WORKSPACES_PER_PRINCIPAL = 50;
-
 /** A captured-read row as `derive_captured_read` shapes it: `{id, data:{field:value}}`. */
 type QuotaRow = { id?: string; data?: Record<string, unknown> };
 
@@ -656,8 +646,8 @@ function countQuotaReads(principal: string): void {
  * THE WORKSPACE-QUOTA VERDICT — the PURE predicate the {@link workspaceQuota} invariant runs over the
  * COMMITTED captured reads (the same `{queryId,args,result}` the plan recorded, CAS-re-derived on every
  * lane). Counts the principal's LIVE (non-retired/-reclaimed) CloudWorkspaces and compares against its
- * allowance (the latest QuotaGrant.maxWorkspaces if any, else CloudPolicy.maxWorkspacesPerPrincipal, else
- * the {@link DEFAULT_MAX_WORKSPACES_PER_PRINCIPAL} floor). The NEW workspace is NOT yet in the pre-apply
+ * allowance (the latest QuotaGrant.maxWorkspaces if any, else CloudPolicy.maxWorkspacesPerPrincipal).
+ * Missing policy is a typed refusal: quota is law, never a compiled allowance. The NEW workspace is NOT yet in the pre-apply
  * state, so `liveCount < allowance` (strict) is the correct test: the principal may hold AT MOST
  * `allowance`, so a fresh birth is admitted iff it already holds fewer. A principal-less call (should be
  * impossible after S3) fails CLOSED. The verdict is a pure function of the captured reads ⇒ identical on
@@ -678,8 +668,8 @@ function quotaVerdict(
     const status = (row.data?.status ?? "") as string;
     return status !== "retired" && status !== "reclaimed";
   }).length;
-  // ALLOWANCE: the LATEST QuotaGrant for the principal (max grantedAt) wins; else the CloudPolicy default;
-  // else the hard floor. `derive_captured_read` decodes t.int() as a JSON number.
+  // ALLOWANCE: the LATEST QuotaGrant for the principal (max grantedAt) wins; else the explicit
+  // CloudPolicy default. `derive_captured_read` decodes t.int() as a JSON number.
   const grants = rowsOf(quotaByPrincipal.id);
   let allowance: number | undefined;
   let latestGrantedAt = -Infinity;
@@ -697,7 +687,7 @@ function quotaVerdict(
     const max = Number(policyRows[0]?.data?.maxWorkspacesPerPrincipal ?? NaN);
     if (Number.isFinite(max)) allowance = max;
   }
-  if (allowance === undefined) allowance = DEFAULT_MAX_WORKSPACES_PER_PRINCIPAL;
+  if (allowance === undefined) return { reject: "workspace-quota-policy-not-configured" };
   return liveCount < allowance ? { accept: true } : { reject: "workspace-quota-exceeded" };
 }
 
@@ -1213,7 +1203,7 @@ export const rebirthConsentByWorkspace = query("rebirthConsentByWorkspace")
 // ─────────────────────────── birthChild — THE ONE BIRTH DIRECTIVE (the `kind`-collapse) ───────────────
 // "There are only workspaces, all equal until a domain is installed." birthChild is the SINGLE directive
 // that births any child — a plain leaf OR a platform; the difference is the GENESIS DATA the payload carries,
-// never a node-class. The same creation posture governs leaf and platform births: open/unset admits any
+// never a node-class. The same creation posture governs leaf and platform births: open admits any
 // proven author, invite requires `#creator`, and closed requires `#admin`. The prior `#platformCreator`
 // second tier is retired.
 //   • genesis ABSENT  → a plain lineage record (no foundingAdminHash); boot-on-touch, never drained.
@@ -1245,8 +1235,9 @@ export const birthChild = directive("birthChild")
         /** GENESIS (optional): present ⇒ this child is born running the governance law (a platform). The
          *  sha256 of the founding-admin key the requester presented — the provider grants admin to the hash. */
         foundingAdminHash: sha256Hex.optional(),
-        /** PLATFORM POOL: how many live children the born platform may parent. Only meaningful with genesis. */
-        pool: z.number().int().positive().default(50),
+        /** PLATFORM POOL: explicit law-state for how many live children the born platform may parent.
+         * Required with genesis. There is no framework default. Zero deliberately disables births. */
+        pool: z.number().int().nonnegative().optional(),
         /** GENESIS birth time as an ISO string (caller-stamped — the timestamp doctrine). Arms the warrant
          *  in the law-authored genesis chain; required for (and only used by) a genesis birth. */
         bornAt: z.string().optional(),
@@ -1264,11 +1255,6 @@ export const birthChild = directive("birthChild")
          *  LAST into the child's genesis. REQUIRED for a genesis birth to complete — a birth without a
          *  valid cert is refused atomically (no unwarranted platform lane survives era 0). */
         platformCert: z.string().optional(),
-        /** METERED BIRTH (slice A3): the child's own descendant budget — when present, the genesis
-         *  recipe seeds the child's BirthPolicy (`seedBirthPolicy`) so it is BORN BOUNDED. OPT-IN:
-         *  only pass it when the `lawHash` the order names carries `seedBirthPolicy` (a governance
-         *  package compiled under the metered-birth DSL). Only meaningful with a genesis. */
-        descendantPool: z.number().int().positive().optional(),
         /** GOVERNANCE POSTURE (governance_postures.md) — the born child's declared posture; default
          *  `managed`. Mirrored onto its lineage record so root's bailiff can consult it on the hot path
          *  (the tenant's own {@link GovernancePosture} singleton is authoritative). Additive/era-safe. */
@@ -1276,22 +1262,22 @@ export const birthChild = directive("birthChild")
       })
       // A genesis birth (a platform) must carry a principal AND a bornAt — it owns a subtree, a lineage
       // anchor, and a law-authored genesis chain whose warrant is stamped at bornAt.
-      .refine((d) => !d.foundingAdminHash || (d.principal.length > 0 && !!d.bornAt), {
-        message: "a genesis birth (foundingAdminHash present) requires a non-empty principal and bornAt (ISO)",
-        path: ["principal"],
+      .refine((d) => !d.foundingAdminHash || (d.principal.length > 0 && !!d.bornAt && d.pool !== undefined), {
+        message: "a genesis birth (foundingAdminHash present) requires a non-empty principal, bornAt (ISO), and explicit pool",
+        path: ["pool"],
       }),
   )
   .plan((p) => {
     // THE WORKSPACE-QUOTA CAPTURED READS (#58 / S2) — same unconditional capture as createWorkspace, so the
     // WorkspaceQuota invariant counts this principal's live workspaces against its allowance on every lane.
     countQuotaReads(p.principal);
-    const rec = planBirthRecord(p, p.foundingAdminHash ? { foundingAdminHash: p.foundingAdminHash, pool: p.pool } : undefined);
+    const rec = planBirthRecord(p, p.foundingAdminHash ? { foundingAdminHash: p.foundingAdminHash, pool: p.pool as number } : undefined);
     // LAW AUTHORS THE GENESIS RECIPE (P1): a genesis birth carries its child's [installDomain×2 →]
     // seedGenesis→grantAdmin→birthCloud chain. (refine guarantees principal + bornAt here.)
     if (p.foundingAdminHash) {
       // ERA 0 — every governance/platform birth is WARRANTED (no compat hatch to thread; buildGenesisChain
       // always records the real self-id).
-      const genesisChain = buildGenesisChain({ name: p.name, principal: p.principal, parent: p.parent, tier: p.tier, foundingAdminHash: p.foundingAdminHash, bornAt: p.bornAt as string, requestedAt: p.requestedAt, ...(p.frameworkHash ? { frameworkHash: p.frameworkHash } : {}), ...(p.lawHash ? { lawHash: p.lawHash } : {}), ...(p.descendantPool !== undefined ? { descendantPool: p.descendantPool } : {}) });
+      const genesisChain = buildGenesisChain({ name: p.name, principal: p.principal, parent: p.parent, tier: p.tier, foundingAdminHash: p.foundingAdminHash, bornAt: p.bornAt as string, requestedAt: p.requestedAt, descendantPool: p.pool as number, ...(p.frameworkHash ? { frameworkHash: p.frameworkHash } : {}), ...(p.lawHash ? { lawHash: p.lawHash } : {}) });
       // THE GENESIS RECIPE IS ALSO A LINEAGE/AUDIT FACT on the parent's chain (the parent records what it
       // ORDERED — law naming law, legitimate). The kernel does NOT read this field to detect the birth.
       rec.set("genesisChain", genesisChain);
@@ -1642,7 +1628,7 @@ export const revokeAdmin = directive("revokeAdmin")
  */
 // grantCreation — creation authority IS the self-relative `#creator` tuple the CreationGate reads.
 // Writes `workspace:self#creator@key:<keyHash>` (no CreationGrant aggregate). Under posture invite/closed
-// the gate admits only holders of an active #creator subject; under open/unset it admits anyone.
+// the gate admits only holders of an active #creator subject; under explicit open it admits anyone.
 // #creator is ONE relation over ONE principal graph; a subject is `key:<hash>` (proof by holding a secret —
 // a Bearer) OR `user:<uid>` (proof of identity — an auth-provider token). The relation allows BOTH
 // (allow:[user(),key()]); these are not two authorities, just two ways a principal authenticates. So
@@ -1755,7 +1741,7 @@ export { RelationTuple };
 // Static governance requirements use the full-native relation gate: a directive carrying
 // `.requires("<relation>")` is checked by the ONE wasm gate over PRE-APPLY tuples on every door (author /
 // edge admission / verify_chain replay). Workspace creation is the intentional exception because it is a
-// three-posture policy, not one static role: the invariant below admits a proven author under open/unset,
+// three-posture policy, not one static role: the invariant below admits a proven author under explicit open,
 // checks `#creator` under invite, and checks `#admin` under closed. The captured author principal is pinned
 // to the sealed Attribution.actor on every peer — so "who may grant or create" is LAW, never a host pre-check. The
 // pre-apply roster means `grantAdmin(@key:self)` cannot self-grant (the not-yet-written subject is absent
@@ -1858,7 +1844,7 @@ export const reclaimRequiresRetired = workspaceInvariant("ReclaimRequiresRetired
 
 // ── THE WORKSPACE-QUOTA GATE (S2 — THE QUOTA LAW, ENFORCED) ────────────────────────────────────────────
 // The native `.requires("creator")` replacement accidentally collapsed a THREE-POSTURE law into one
-// permanently invite-only door. Creation is not a static role check: open/unset admits any PROVEN author;
+// permanently invite-only door. Creation is not a static role check: open admits any PROVEN author;
 // invite admits #creator; closed admits #admin. Keep that policy in an invariant over the committed prefix,
 // while the native relation evaluator remains the one meaning of "holds #creator/#admin" everywhere else.
 //
@@ -1894,8 +1880,9 @@ function creationPostureVerdict(
   if (actor === "" || claimed === "" || requestedBy === "" || claimed !== proven || requestedBy !== proven) {
     return { reject: "creation.identity-mismatch" };
   }
-  const posture = String((snapshots.policy as { creationPosture?: string } | undefined)?.creationPosture ?? "open");
-  if (posture === "open" || posture === "") return { accept: true };
+  const posture = String((snapshots.policy as { creationPosture?: string } | undefined)?.creationPosture ?? "");
+  if (posture === "") return { reject: "creation.policy-not-configured" };
+  if (posture === "open") return { accept: true };
   if (posture === "invite") {
     return activeRelationSubject(snapshots.creators, actor)
       ? { accept: true }
@@ -1915,7 +1902,7 @@ const creationPostureReads = readSet(
   readRef("admins", RelationTuple).at(ADMIN_TUPLE_ID),
 );
 
-/** Compatibility create: open/unset ⇒ proven author; invite ⇒ creator; closed ⇒ admin. */
+/** Compatibility create: open ⇒ proven author; invite ⇒ creator; closed ⇒ admin; unset ⇒ refuse. */
 export const creationPostureCreate = workspaceInvariant("CreationPostureCreate")
   .on("createWorkspace")
   .reads(creationPostureReads)

package/src/index.ts

@@ -16,6 +16,13 @@ export {
   type NomosPackageDefinition,
   type NomosPackageDomainConfig,
 } from "./package_config.js";
+export {
+  applicationHomeGenesis,
+  offerAtHomeGenesis,
+  type ApplicationHomeGenesis,
+  type ApplicationHomeGenesisFacts,
+  type ApplicationHomeGenesisStep,
+} from "./application_home_genesis.js";
 export type { RuntimePackageDependency } from "./package_dependencies.js";
 export {
   aggregate,
@@ -538,7 +545,6 @@ export {
   childLifecyclesByStatus,
   birthPolicy,
   birthGrantByPrincipal,
-  DEFAULT_MAX_BIRTHS_PER_PRINCIPAL,
   birthQuotaVerdict,
   birthQuotaInvariantId,
   setBirthPolicy,

package/src/law_graph.ts

@@ -545,6 +545,13 @@ export interface LawIntentNode {
   readonly births: boolean;
   readonly birthRecord?: LawRef<"aggregate">;
   readonly birthPrefix?: string;
+  /** The law-declared genesis verb that establishes this workspace's birth policy. This is a
+   * relationship to executable law, never a compiler/runtime allowance value: the kernel uses it
+   * only to require an explicit matching step in child genesis before custody can be created. */
+  readonly birthPolicySeed?: LawRef<"intent">;
+  /** Additional law verbs which this birth requires the child genesis to offer. Cross-domain
+   * targets remain typed closure references and are resolved to USDA paths during composition. */
+  readonly birthGenesisRequires: readonly LawTargetRef<"intent">[];
   readonly attestation?: {
     readonly ownerObject: string;
     readonly ownerField: string;
@@ -1362,6 +1369,22 @@ export function discoverLawGraph(
         birthRecord: ref(aggregateByLabel.get("NomosBirthRecord")!.node.entity),
         birthPrefix: "nomos-birth-record:",
       }),
+      ...(intent.birthsChild !== true || intentEntities.get("seedBirthPolicy") === undefined ? {} : {
+        birthPolicySeed: ref(intentEntities.get("seedBirthPolicy")!),
+      }),
+      birthGenesisRequires: (intent.birthGenesisRequirements ?? []).map((requirement) => {
+        const local = requirement.domain === module.name
+          ? intentEntities.get(requirement.directiveId)
+          : undefined;
+        return local === undefined
+          ? {
+              kind: "dependency-export" as const,
+              entityKind: "intent" as const,
+              label: requirement.directiveId,
+              domain: requirement.domain,
+            }
+          : ref(local);
+      }),
       ...(intent.attestationAuthorizedGate === undefined ? {} : {
         attestation: {
           ownerObject: intent.attestationAuthorizedGate.ownerObject,

package/src/law_graph_usda.ts

@@ -971,6 +971,16 @@ function emitIntent(
       `${pad}custom uniform string nomos:birthPrefix = ${quote(intent.birthPrefix ?? "")}`,
     );
   }
+  if (intent.birthPolicySeed !== undefined) {
+    body.push(
+      `${pad}custom rel nomos:birthPolicySeed = <${requiredPath(intent.birthPolicySeed.id, paths)}>`,
+    );
+  }
+  if (intent.birthGenesisRequires.length > 0) {
+    body.push(
+      `${pad}custom rel nomos:birthGenesisRequires = ${targets(intent.birthGenesisRequires, paths, resolveDependency)}`,
+    );
+  }
   if (intent.attestation !== undefined) {
     body.push(
       `${pad}custom uniform string nomos:attestationOwnerObject = ${quote(intent.attestation.ownerObject)}`,
@@ -1756,7 +1766,7 @@ function emitContainer<T extends { readonly entity: { readonly id: string } }>(
 }
 
 function targets(
-  refs: readonly LawTargetRef<"aggregate" | "contract" | "relation" | "policy" | "read">[],
+  refs: readonly LawTargetRef<"aggregate" | "contract" | "relation" | "policy" | "read" | "intent">[],
   paths: ReadonlyMap<string, string>,
   resolveDependency: ResolveDependency,
 ): string {

package/src/package_config.ts

@@ -4,6 +4,10 @@ import {
   normalizeRuntimePackageDependencies,
   type RuntimePackageDependency,
 } from "./package_dependencies.js";
+import {
+  isApplicationHomeGenesis,
+  type ApplicationHomeGenesis,
+} from "./application_home_genesis.js";
 
 /** The source modules which compose one domain exported by a Nomos package. */
 export interface NomosPackageDomainConfig {
@@ -21,6 +25,14 @@ export interface NomosPackageDomainConfig {
 export interface NomosPackageConfig {
   readonly name: string;
   readonly domains: readonly NomosPackageDomainConfig[];
+  /** Application-root policy compiled into the private receiving-group law.
+   * Required for a published application: Nomos never invents a child-workspace allowance. */
+  readonly application?: {
+    readonly maxChildWorkspacesPerUser: number;
+    /** Tenant law which must hold from the application's first usable home state. Every entry is
+     * an ordinary offer executed through the child's gate; omission declares no tenant ceremony. */
+    readonly homeGenesis?: ApplicationHomeGenesis;
+  };
   /** Separately installed law required at runtime; USDA composition arcs do not belong here. */
   readonly dependencies?: readonly RuntimePackageDependency[];
 }
@@ -95,6 +107,24 @@ export function validateNomosPackageConfig(value: unknown): {
   if (config.dependencies !== undefined && !Array.isArray(config.dependencies)) {
     throw new Error("package dependencies must be an array");
   }
+  if (config.application !== undefined) {
+    const max = config.application.maxChildWorkspacesPerUser;
+    if (!Number.isInteger(max) || max < 0) {
+      throw new Error(
+        "application.maxChildWorkspacesPerUser must be a non-negative integer; " +
+          "Nomos has no compiled birth-policy fallback",
+      );
+    }
+    if (
+      config.application.homeGenesis !== undefined &&
+      !isApplicationHomeGenesis(config.application.homeGenesis)
+    ) {
+      throw new Error(
+        "application.homeGenesis must be declared with applicationHomeGenesis(...); " +
+          "Nomos will not reinterpret an untyped genesis recipe",
+      );
+    }
+  }
   const runtimeDependencies = normalizeRuntimePackageDependencies(
     config.name,
     config.dependencies ?? [],