@githolon/dsl 0.103.3 → 0.103.5

package/src/framework/domain_lifecycle.ts

@@ -20,42 +20,119 @@
 import { z } from "zod";
 import { aggregate, instance } from "../aggregate.js";
 import { Lww, MapOf } from "../drivers.js";
-import { attributionField, t } from "../fields.js";
+import {
+  attributionField,
+  gitObjectId,
+  sha256Digest,
+  t,
+  type Sha256Digest,
+} from "../fields.js";
 import { directive } from "../directive.js";
 import { set, withMarker, addToSet, type PlannedOp } from "../ops.js";
-import { key, relationType, self, user } from "../relation_schema.js";
+import { key, relationRef, relationType, self, user } from "../relation_schema.js";
+
+/** The two authenticated capabilities which may execute a lifecycle install.
+ * Callers choose a role; the serialized USDA route is an implementation detail. */
+export enum DomainInstallExecutor {
+  StageZero = "bootstrap",
+  LifecycleController = "nomos",
+}
+
+/** One typed vocabulary shared by declaration, gate, genesis seat and generated clients. */
+export const MODEL_LIFECYCLE_AUTHORITY = relationRef("installDomain");
+export const DOMAIN_LIFECYCLE_DIRECTIVES = {
+  Install: "installDomain",
+  Stage: "stageDomain",
+  Promote: "promoteDomain",
+  Rollback: "rollbackDomain",
+} as const;
+export type DomainLifecycleDirectiveId =
+  (typeof DOMAIN_LIFECYCLE_DIRECTIVES)[keyof typeof DOMAIN_LIFECYCLE_DIRECTIVES];
+export const INSTALL_DOMAIN_DIRECTIVE = DOMAIN_LIFECYCLE_DIRECTIVES.Install;
+
+/** A symbolic reference resolved by the kernel against the parent's active law frontier. */
+export type CurrentLawReference = string & { readonly __nomosCurrentLawReference: unique symbol };
+export type LawClosureReference = Sha256Digest | CurrentLawReference;
+
+const CURRENT_LAW_PREFIX = "nomos:current-law:";
+
+/** Construct the only symbolic law reference admitted in a child genesis recipe. */
+export function currentLawReference(domain: string): CurrentLawReference {
+  const name = domain.trim();
+  if (name.length === 0) throw new TypeError("a current-law reference requires a non-empty domain");
+  return `${CURRENT_LAW_PREFIX}${name}` as CurrentLawReference;
+}
+
+/** One complete, contract-shaped law-install call in a child genesis sequence. Keeping this
+ * constructor beside the directive schema makes omission of required install provenance a type
+ * error at every framework birth site instead of a late kernel repair. */
+export interface DomainInstallGenesisOffer extends Readonly<Record<string, unknown>> {
+  readonly domain: DomainInstallExecutor;
+  readonly directiveId: typeof INSTALL_DOMAIN_DIRECTIVE;
+  readonly actor: string;
+  readonly payload: {
+    readonly domainHash: LawClosureReference;
+    readonly installedBy: string;
+    readonly lawClosureIdentity: LawClosureReference;
+  };
+  readonly domainHash: LawClosureReference;
+}
+
+export function domainInstallGenesisOffer(
+  domain: DomainInstallExecutor,
+  domainHash: LawClosureReference,
+  actor: string,
+): DomainInstallGenesisOffer {
+  return {
+    domain,
+    directiveId: INSTALL_DOMAIN_DIRECTIVE,
+    actor,
+    payload: { domainHash, installedBy: actor, lawClosureIdentity: domainHash },
+    domainHash,
+  };
+}
 
 /** Framework-global authority to install or roll out a model in this workspace.
  * The verified founder receives the first leaf in `seedGenesis`; every later
  * delegation remains an ordinary, replayable Zanzibar edge. */
 export const modelLifecycleRelations = relationType("workspace")
   .asGlobal()
-  .relation("installDomain", { rewrite: self(), allow: [user(), key()] });
+  .relation(MODEL_LIFECYCLE_AUTHORITY, { rewrite: self(), allow: [user(), key()] });
+
+/** The lifecycle state machine is a framework type, not a bag of coincidentally matching strings. */
+export enum DomainInstallationPhase {
+  Pending = "Pending",
+  Active = "Active",
+  Disabled = "Disabled",
+  Superseded = "Superseded",
+  Retiring = "Retiring",
+  Retired = "Retired",
+  Failed = "Failed",
+}
 
 export const DOMAIN_INSTALLATION_PHASES = [
-  "Pending",
-  "Active",
-  "Disabled",
-  "Superseded",
-  "Retiring",
-  "Retired",
-  "Failed",
+  DomainInstallationPhase.Pending,
+  DomainInstallationPhase.Active,
+  DomainInstallationPhase.Disabled,
+  DomainInstallationPhase.Superseded,
+  DomainInstallationPhase.Retiring,
+  DomainInstallationPhase.Retired,
+  DomainInstallationPhase.Failed,
 ] as const;
-export type DomainInstallationPhase = (typeof DOMAIN_INSTALLATION_PHASES)[number];
 
 export const DomainInstallation = aggregate("DomainInstallation", {
-  "spec.domainHash": t.string().merge(Lww),
-  "spec.packageHash": t.string().merge(Lww),
+  "spec.domainHash": t.sha256Digest().merge(Lww),
+  "spec.packageHash": t.sha256Digest().merge(Lww),
   "spec.authorityScope": t.string().merge(Lww),
   "spec.installedBy": t.string().merge(Lww),
-  "spec.lawClosureIdentity": t.string().merge(Lww),
+  "spec.lawClosureIdentity": t.sha256Digest().merge(Lww),
   "spec.dependencies": t.set(t.string()),
-  "spec.supersedes": t.string().merge(Lww).optional(),
+  "spec.supersedes": t.sha256Digest().merge(Lww).optional(),
   "spec.finalizers": t.set(t.string()),
   "metadata.generation": t.int().merge(Lww),
   "status.phase": t.enum(DOMAIN_INSTALLATION_PHASES).merge(Lww),
   "status.observedGeneration": t.int().merge(Lww),
-  "status.supersededBy": t.string().merge(Lww).optional(),
+  "status.supersededBy": t.sha256Digest().merge(Lww).optional(),
   "status.conditions": t.map(t.json()).merge(MapOf(Lww)),
 }).public();
 
@@ -69,13 +146,13 @@ export const RELEASE_RECEIPT_AGGREGATE = "nomos_internal_ReleaseReceipt_6f0d3a";
 export const RELEASE_RECEIPT_PREFIX = "nomos-release-receipt:";
 
 export const ReleaseReceipt = aggregate(RELEASE_RECEIPT_AGGREGATE, {
-  candidateHash: t.string().merge(Lww),
-  fromHash: t.string().merge(Lww).optional(),
+  candidateHash: t.sha256Digest().merge(Lww),
+  fromHash: t.sha256Digest().merge(Lww).optional(),
   domain: t.string().merge(Lww),
-  atHash: t.string().merge(Lww),
-  atStateRoot: t.string().merge(Lww),
-  historyHash: t.string().merge(Lww),
-  reportHash: t.string().merge(Lww),
+  atHash: t.gitObjectId().merge(Lww),
+  atStateRoot: t.gitObjectId().merge(Lww),
+  historyHash: t.sha256Digest().merge(Lww),
+  reportHash: t.sha256Digest().merge(Lww),
   reportJson: t.string().merge(Lww),
   complete: t.bool(),
   evolveOk: t.bool(),
@@ -84,26 +161,26 @@ export const ReleaseReceipt = aggregate(RELEASE_RECEIPT_AGGREGATE, {
   replayedIntents: t.int().merge(Lww),
   candidateIntents: t.int().merge(Lww),
   divergenceCount: t.int().merge(Lww),
-  baselineRoot: t.string().merge(Lww),
-  candidateRoot: t.string().merge(Lww),
+  baselineRoot: t.sha256Digest().merge(Lww),
+  candidateRoot: t.sha256Digest().merge(Lww),
   acceptanceReason: t.string().merge(Lww).optional(),
   acceptedBy: attributionField(t.string().merge(Lww)),
   acceptedAt: t.int().merge(Lww),
 }).public();
 
-export function domainInstallationAggregateId(domainHash: string): string {
+export function domainInstallationAggregateId(domainHash: Sha256Digest): string {
   return `domain-installation:${domainHash}`;
 }
 
-function domainInstallationInstance(domainHash: string) {
+function domainInstallationInstance(domainHash: Sha256Digest) {
   return instance(DomainInstallation, domainInstallationAggregateId(domainHash));
 }
 
-export function releaseReceiptAggregateId(reportHash: string): string {
+export function releaseReceiptAggregateId(reportHash: Sha256Digest): string {
   return `${RELEASE_RECEIPT_PREFIX}${reportHash}`;
 }
 
-function releaseReceiptInstance(reportHash: string) {
+function releaseReceiptInstance(reportHash: Sha256Digest) {
   return instance(ReleaseReceipt, releaseReceiptAggregateId(reportHash));
 }
 
@@ -114,13 +191,13 @@ const dispositions = z.object({
   ackBy: z.string().optional(),
 }).optional();
 
-const lowerHex64 = z.string().regex(/^[0-9a-f]{64}$/);
-const gitOid = z.string().regex(/^[0-9a-f]{40}$/);
+const lowerHex64 = sha256Digest();
+const gitOid = gitObjectId();
 const preflightReceipt = z.object({
   candidateHash: lowerHex64,
   domain: z.string().min(1),
   atHash: gitOid,
-  atStateRoot: lowerHex64,
+  atStateRoot: gitOid,
   historyHash: lowerHex64,
   reportHash: lowerHex64,
   reportJson: z.string().min(2),
@@ -144,36 +221,29 @@ const preflightReceipt = z.object({
   }
 });
 
-const packagePayload = {
+const installPackagePayload = {
   domainHash: lowerHex64,
   installedBy: z.string(),
   lawClosureIdentity: lowerHex64,
   authorityScope: z.string().default("workspace/root"),
   // Omission means the empty set; keep that in the plan instead of encoding a composite default
   // into canonical USDA merely to save `?? []` at runtime.
-  dependencies: z.array(z.string()).optional(),
-  supersedes: z.string().optional(),
-  finalizers: z.array(z.string()).optional(),
+  dependencies: z.array(sha256Digest()).optional(),
+  finalizers: z.array(sha256Digest()).optional(),
+};
+
+const stagedPackagePayload = {
+  ...installPackagePayload,
+  supersedes: sha256Digest().optional(),
 };
 
-export const installDomain = directive("installDomain")
+export const installDomain = directive(DOMAIN_LIFECYCLE_DIRECTIVES.Install)
   .ensures(DomainInstallation)
-  .payload(
-    z.object({
-      ...packagePayload,
-      // THE FRONTIER TRANSITION (install-lifecycle): `replaces` names a PRIOR install this
-      // deploy makes current UNEQUIVOCALLY — the prior install is flipped out of the served
-      // frontier (`Superseded`, or `Retired` when `retireReplaced`) and gets the reverse
-      // `status.supersededBy` edge to this install. Absent ⇒ install-BESIDE (backward-compat:
-      // byte-identical ops to the pre-lifecycle plan). `replaces` also sets `spec.supersedes`.
-      replaces: z.string().optional(),
-      retireReplaced: z.boolean().default(false),
-      dispositions,
-    }).refine((p) => p.replaces === undefined || p.replaces !== p.domainHash, {
-      message: "a domain package cannot replace itself",
-      path: ["replaces"],
-    }),
-  )
+  // Installation adds law for domain keys that are not currently served. Replacement is a
+  // different operation with different evidence: stageDomain followed by promoteDomain. Keeping
+  // predecessor/retirement fields out of this type makes bypassing that state machine impossible
+  // for generated clients instead of relying on callers to remember a convention.
+  .payload(z.object({ ...installPackagePayload }).strict())
   .plan((p): PlannedOp[] => {
     const install = domainInstallationInstance(p.domainHash);
     const ops: PlannedOp[] = [
@@ -183,38 +253,25 @@ export const installDomain = directive("installDomain")
       set(install, "spec.installedBy", p.installedBy),
       set(install, "spec.lawClosureIdentity", p.lawClosureIdentity),
       set(install, "metadata.generation", 1),
-      set(install, "status.phase", "Active"),
+      set(install, "status.phase", DomainInstallationPhase.Active),
       set(install, "status.observedGeneration", 1),
     ];
     if ((p.dependencies ?? []).length > 0) {
       ops.push(addToSet(install, "spec.dependencies", p.dependencies ?? []));
     }
-    // The predecessor back-link: `supersedes` (explicit) or `replaces` (the actionable form).
-    const supersedes = p.supersedes ?? p.replaces;
-    if (supersedes !== undefined) {
-      ops.push(set(install, "spec.supersedes", supersedes));
-    }
-    // The transition on the PRIOR install: drop it from the served frontier + point it here.
-    if (p.replaces !== undefined) {
-      const replaced = domainInstallationInstance(p.replaces);
-      ops.push(
-        set(replaced, "status.phase", p.retireReplaced ? "Retired" : "Superseded"),
-      );
-      ops.push(set(replaced, "status.supersededBy", p.domainHash));
-    }
     if ((p.finalizers ?? []).length > 0) {
       ops.push(addToSet(install, "spec.finalizers", p.finalizers ?? []));
     }
     return ops;
   })
-  .requires("installDomain");
+  .requires(MODEL_LIFECYCLE_AUTHORITY);
 
 /** Store candidate law in the ledger without changing the served law frontier. The
  *  kernel content-verifies the package and lifecycle pair, while the Pending phase is
  *  deliberately invisible to dispatch, reads and replay's current-law map. */
-export const stageDomain = directive("stageDomain")
+export const stageDomain = directive(DOMAIN_LIFECYCLE_DIRECTIVES.Stage)
   .ensures(DomainInstallation)
-  .payload(z.object({ ...packagePayload }).refine(
+  .payload(z.object({ ...stagedPackagePayload }).refine(
     (p) => p.supersedes === undefined || p.supersedes !== p.domainHash,
     { message: "a staged domain package cannot supersede itself", path: ["supersedes"] },
   ))
@@ -227,7 +284,7 @@ export const stageDomain = directive("stageDomain")
       set(install, "spec.installedBy", p.installedBy),
       set(install, "spec.lawClosureIdentity", p.lawClosureIdentity),
       set(install, "metadata.generation", 1),
-      set(install, "status.phase", "Pending"),
+      set(install, "status.phase", DomainInstallationPhase.Pending),
       set(install, "status.observedGeneration", 0),
     ];
     if ((p.dependencies ?? []).length > 0) ops.push(addToSet(install, "spec.dependencies", p.dependencies ?? []));
@@ -235,17 +292,17 @@ export const stageDomain = directive("stageDomain")
     if ((p.finalizers ?? []).length > 0) ops.push(addToSet(install, "spec.finalizers", p.finalizers ?? []));
     return ops;
   })
-  .requires("installDomain");
+  .requires(MODEL_LIFECYCLE_AUTHORITY);
 
 /** Make a staged package current. The package bytes are already committed; the kernel
  *  re-loads them from prefix state and runs the evolve gate on this phase transition.
  *  The prior version stays Active by default so gradual-rollout clients can still have
  *  their declared era checked; the newer activation stamp alone makes this law current. */
-export const promoteDomain = directive("promoteDomain")
+export const promoteDomain = directive(DOMAIN_LIFECYCLE_DIRECTIVES.Promote)
   .mutates(DomainInstallation)
   .payload(z.object({
-    domainHash: z.string(),
-    replaces: z.string().optional(),
+    domainHash: sha256Digest(),
+    replaces: sha256Digest().optional(),
     retireReplaced: z.boolean().default(false),
     dispositions,
     preflight: preflightReceipt,
@@ -260,7 +317,7 @@ export const promoteDomain = directive("promoteDomain")
     const promoted = domainInstallationInstance(p.domainHash);
     const receipt = releaseReceiptInstance(p.preflight.reportHash);
     const ops: PlannedOp[] = [
-      set(promoted, "status.phase", "Active"),
+      set(promoted, "status.phase", DomainInstallationPhase.Active),
       set(promoted, "status.observedGeneration", 1),
       withMarker(set(receipt, "candidateHash", p.domainHash), "ensures"),
       ...(p.replaces !== undefined ? [set(receipt, "fromHash", p.replaces)] : []),
@@ -289,23 +346,23 @@ export const promoteDomain = directive("promoteDomain")
       const replaced = domainInstallationInstance(p.replaces);
       ops.push(set(promoted, "spec.supersedes", p.replaces));
       if (p.retireReplaced) {
-        ops.push(set(replaced, "status.phase", "Retired"));
+        ops.push(set(replaced, "status.phase", DomainInstallationPhase.Retired));
         ops.push(set(replaced, "status.supersededBy", p.domainHash));
       }
     }
     return ops;
   })
   .alsoEnsures(ReleaseReceipt)
-  .requires("installDomain");
+  .requires(MODEL_LIFECYCLE_AUTHORITY);
 
 /** Rollback is a new governed transition, never a history-pointer rewind. The prior
  *  package is promoted from committed custody and the failed candidate becomes Disabled;
  *  the kernel applies the same evolve judgment in the reverse direction. */
-export const rollbackDomain = directive("rollbackDomain")
+export const rollbackDomain = directive(DOMAIN_LIFECYCLE_DIRECTIVES.Rollback)
   .mutates(DomainInstallation)
   .payload(z.object({
-    candidateHash: z.string(),
-    priorHash: z.string(),
+    candidateHash: sha256Digest(),
+    priorHash: sha256Digest(),
     dispositions,
     preflight: preflightReceipt,
   }).refine((p) => p.candidateHash !== p.priorHash, {
@@ -323,9 +380,9 @@ export const rollbackDomain = directive("rollbackDomain")
     const prior = domainInstallationInstance(p.priorHash);
     const receipt = releaseReceiptInstance(p.preflight.reportHash);
     return [
-      set(candidate, "status.phase", "Disabled"),
+      set(candidate, "status.phase", DomainInstallationPhase.Disabled),
       set(candidate, "status.supersededBy", p.priorHash),
-      set(prior, "status.phase", "Active"),
+      set(prior, "status.phase", DomainInstallationPhase.Active),
       set(prior, "status.observedGeneration", 1),
       withMarker(set(receipt, "candidateHash", p.priorHash), "ensures"),
       set(receipt, "fromHash", p.candidateHash),
@@ -352,4 +409,4 @@ export const rollbackDomain = directive("rollbackDomain")
     ];
   })
   .alsoEnsures(ReleaseReceipt)
-  .requires("installDomain");
+  .requires(MODEL_LIFECYCLE_AUTHORITY);

package/src/framework/genesis.ts

@@ -34,6 +34,7 @@ import { Lww } from "../drivers.js";
 import { directive } from "../directive.js";
 import { set, type PlannedOp } from "../ops.js";
 import { RelationTuple, writeTuple } from "./relations.js";
+import { MODEL_LIFECYCLE_AUTHORITY } from "./domain_lifecycle.js";
 
 /**
  * Deterministic singleton id of the founding warrant — MUST equal
@@ -100,7 +101,7 @@ export const seedGenesis = directive("seedGenesis")
     ...writeGenesisWarrant(p),
     ...writeTuple({
       object: "workspace:self",
-      relation: "installDomain",
+      relation: MODEL_LIFECYCLE_AUTHORITY,
       subject: /^(user|key):/.test(p.principal) ? p.principal : `user:${p.principal}`,
       grantedBy: p.principal,
       grantedAt: p.bornAt,

package/src/framework/home.ts

@@ -27,9 +27,7 @@
 import { z } from "zod";
 import type { ApplicationHomeGenesis } from "../application_home_genesis.js";
 import { aggregate, instance, OWNED_READ_RELATION } from "../aggregate.js";
-// The device-key-hash wire shape (same validator signing_identity/workspaces use module-locally).
-const sha256Hex = z.string().regex(/^[0-9a-f]{64}$/, "expected lowercase sha256 hex (the owner's device pubkey hash)");
-import { t } from "../fields.js";
+import { sha256Digest, t } from "../fields.js";
 import { Lww } from "../drivers.js";
 import { directive } from "../directive.js";
 import { ensure } from "../authoring.js";
@@ -45,6 +43,10 @@ import { relationType, self, user, selfObject } from "../relation_schema.js";
 import { requireParentAttestedBirth, type ParentAttestedBirthMarker } from "../births.js";
 import { GenesisWarrant, seedGenesis } from "./genesis.js";
 import { idOf } from "../value_object.js";
+import {
+  DomainInstallExecutor,
+  domainInstallGenesisOffer,
+} from "./domain_lifecycle.js";
 
 // `nomos.sha256` — the TRUSTLESS, pure hash computed IN the githolon (Rust sha2 bound in the sealed engine;
 // see deterministic-rquickjs). Available as a global to plans + invariant predicates (like `nomos.mint`); it
@@ -315,27 +317,11 @@ export function birthReceivingGroupForDomain(
       owner: z.string().min(1),
       /** The bootstrap framework controller content hash — tenant-pinned at governance compile (the child
        *  installs it IN-CHAIN as intent 0; the kernel resolves the bytes by hash from the parent's custody). */
-      frameworkHash: z.string().min(1),
+      frameworkHash: sha256Digest(),
       /** The HOME law package domainHash — tenant-pinned at governance compile (the child's second install). */
-      lawHash: z.string().min(1),
+      lawHash: sha256Digest(),
       /** ISO-8601 birth time, caller-stamped (the timestamp doctrine — the plan reads no clock). */
       bornAt: z.string().min(1),
-      /** THE OWNER'S DEVICE KEY HASH (sha256hex of the ed25519 public half — the SAME key `homeCert` is signed
-       *  by and the `signer` relation enrols). The platform holds it from the user's onboarding and ENROLS it
-       *  in the home's genesis, so the born home is SIGNER-READY: it can sign + birth its own children (estates,
-       *  catalogues) from intent 0. WITHOUT this the home is born warranted + owned but signer-less — it can
-       *  never act (the co2 estate-birth bug). Mirrors `buildGenesisChain`'s `enrollSigner` for a platform.
-       *  REQUIRED — a payload without it refuses at compile/validation, not an hour into a live deploy with a
-       *  bricked signer-less home. (The kernel injecting it from the verified cert's `parent_key` is the
-       *  eventual generalization; until then the field is loud.) */
-      ownerKeyHash: sha256Hex,
-      /** THE DEVICE-SIGNED HOME CERT (JSON `executor::birth_cert::BirthCert`), signed CLIENT-SIDE by the
-       *  owner's device key `S_U` (the SAME key `ownerKeyHash` hashes + the `signer` relation enrols). The
-       *  kernel's birth offer-effect VERIFIES this cert's signature against U's enrolled signer pubkey `P_U`
-       *  AND that its `founder == ctx.principal()` (the gate verdict, CAS-as-law) BEFORE accepting it as
-       *  `links[0]` of the travelling chain — the kernel signs nothing (it holds no secret; it only verifies).
-       *  Optional: absent ⇒ the era stays inert for this birth (pre-feature lane). */
-      homeCert: z.string().optional(),
       /** AUTHPROVIDER INHERITANCE — DEFAULT ON, opt out with `false`. Verification is PER-WORKSPACE (the
        *  kernel never walks up to the parent), so a PRIVATE child born without its own AuthProvider cannot
        *  verify any token — its own owner is locked out of verified reads (the co2 phase-6 wall). By
@@ -352,9 +338,9 @@ export function birthReceivingGroupForDomain(
   .plan((p) => {
     const founder = p.owner; // the actor for the child's own genesis steps (its self-bound owner subject)
     const groupName = receivingGroupNameOf(p.owner);
-    // THE PARENT'S DECLARED VERIFIER (one captured read serves BOTH consumers below): the inherited
-    // `setAuthProvider` genesis step AND the enroll step's `verifiedVia` provenance stamp. Read it up
-    // front so the enroll step (which precedes the inheritance step in the chain) can see the issuer.
+    // THE PARENT'S DECLARED VERIFIER. This captured read supplies the inherited provider seed.
+    // Birth-certificate verification and founding-signer enrollment belong to the kernel-owned
+    // attestation step, so neither fact is duplicated in this tenant plan or payload.
     const apRows = p.inheritAuthProvider !== false
       ? readFrameworkDeclared<Array<Record<string, unknown>>>("authProvider", { scope: "platform" })
       : undefined;
@@ -367,20 +353,19 @@ export function birthReceivingGroupForDomain(
       const v = ap?.[k];
       return typeof v === "string" && v.length > 0 ? v : undefined;
     };
-    // PROVENANCE (the verified-lineage thread, 2026-07-16): the kernel derives every later write's
-    // `principal_verified` from the ENROLL LEAF's `verifiedVia` — so a verified birth must stamp it or the
-    // born home's owner writes UNVERIFIED forever (and its own children are then born `verified:false`,
-    // whose chains refuse `verify_to_root`). The cert's `verified` IS the gate verdict post-admission
-    // (assemble_birth_attestation CAS-refuses a mismatch), so reading it in-plan is trustworthy — a lying
-    // cert never reaches this fold. An unverified birth stamps nothing (the unverified lane stays honest).
-    let certVerified = false;
-    try { certVerified = p.homeCert !== undefined && JSON.parse(p.homeCert).verified === true; } catch { /* malformed cert ⇒ unverified (the gate will refuse the birth anyway) */ }
-    const verifiedVia = certVerified ? apStr("issuer") : undefined;
     const genesisChain: Array<{ domain: string; directiveId: string; actor: string; payload: Record<string, unknown>; domainHash?: string }> = [
       // THE ORDER-DECLARED LAW INSTALL: two typed closure identities. The kernel resolves each
       // closure from the parent's custody when it folds the birth; law bytes never ride the intent.
-      { domain: "bootstrap", directiveId: "installDomain", actor: founder, payload: { domainHash: p.frameworkHash }, domainHash: p.frameworkHash },
-      { domain: "nomos", directiveId: "installDomain", actor: founder, payload: { domainHash: p.lawHash }, domainHash: p.lawHash },
+      domainInstallGenesisOffer(
+        DomainInstallExecutor.StageZero,
+        p.frameworkHash,
+        founder,
+      ),
+      domainInstallGenesisOffer(
+        DomainInstallExecutor.LifecycleController,
+        p.lawHash,
+        founder,
+      ),
       {
         domain: groupLawDomain,
         directiveId: "nomosInternalSeedReceivingGroupPolicy7c1f5e",
@@ -421,16 +406,6 @@ export function birthReceivingGroupForDomain(
           bornAt: p.bornAt,
         })),
       })),
-      // ENROL THE OWNER'S DEVICE on the warrant-free prefix (when supplied) — enrollSigner self-binds to
-      // ctx.principal() (the owner), so this binds `ownerKeyHash` as the owner's signer BEFORE the warrant
-      // closes bootstrap. This is what makes the born home SIGNER-READY (able to sign + self-serve-birth its own
-      // estates/catalogues). Mirrors buildGenesisChain's founding-admin enrollSigner for a platform — homes were
-      // the inconsistent one. THE GENESIS ORDER IS THE CONTRACT (BREAK 1): the parent's offer-effect APPENDS
-      // `seedBirthAttestation` + `seedGenesis` (the WARRANT) AFTER these steps — the warrant lands LAST (E→W
-      // ladder: every seed runs UNSIGNED on the still-warrant-free prefix; the warrant closes it). ERA-SAFE: a
-      // home born earlier (pre-feature law, no such step in its recipe) replays byte-identical — the era rule
-      // rides the LAW hash, not this branch.
-      { domain: groupLawDomain, directiveId: "enrollSigner", actor: founder, payload: { keyHash: p.ownerKeyHash, grantedBy: p.owner, grantedAt: 1, ...(verifiedVia !== undefined ? { verifiedVia } : {}) } },
     ];
     // AUTHPROVIDER INHERITANCE (default ON — see the payload doc): copy the parent's declared provider
     // (the up-front captured read above) AS DATA into the child genesis. The child owns the copy as its