@githolon/dsl 0.103.3 → 0.103.5

package/src/framework/workspaces.ts

@@ -68,9 +68,9 @@ import { z } from "zod";
 import { aggregate, instance } from "../aggregate.js";
 import { create, ensure } from "../authoring.js";
 import { birth } from "../births.js";
-import { directive } from "../directive.js";
+import { directive, type Directive } from "../directive.js";
 import { Lww } from "../drivers.js";
-import { t } from "../fields.js";
+import { sha256Digest, t, type Sha256Digest } from "../fields.js";
 import { set, withMarker } from "../ops.js";
 import { query } from "../query.js";
 import { read } from "../read.js";
@@ -79,7 +79,12 @@ import { writeTuple, removeTuple, RelationTuple, relationTupleInstanceId } from
 import { relationType, self, user, key } from "../relation_schema.js";
 import { GENESIS_WARRANT_ID } from "./genesis.js";
 import { idOf } from "../value_object.js";
-import { signerObject, SIGNER_RELATION } from "./signing_identity.js";
+import { enrollSigner, signerObject, SIGNER_RELATION } from "./signing_identity.js";
+import { seedBirthPolicy } from "./birth_meter.js";
+import {
+  DomainInstallExecutor,
+  domainInstallGenesisOffer,
+} from "./domain_lifecycle.js";
 // THE GENESIS BOOTSTRAP (platform-birth genesis bootstrap, Approach A): governance carries the
 // warrant-flip primitives so the birth door can lawfully bootstrap a virgin platform's founding admin —
 // E `enrollSigner` (the founding signer tuple) → W `seedGenesis` (the GenesisWarrant) → A signed
@@ -88,7 +93,7 @@ import { signerObject, SIGNER_RELATION } from "./signing_identity.js";
 export { GenesisWarrant, seedGenesis } from "./genesis.js";
 export { identityRelations, enrollSigner } from "./signing_identity.js";
 // ERA 0 — the keyless verified first-device door rides the GOVERNANCE law too: a freshly BORN platform
-// has a virgin roster and a cert-ATTESTED AuthProvider (the S_root-signed platformCert), so its founder's
+// has a virgin roster and a cert-ATTESTED AuthProvider (the S_root-signed birth witness), so its founder's
 // FIRST action is `enrollFirstDevice` (token-verified against the attested provider) followed by a SIGNED
 // self-`grantAdmin` (admitted by the kernel genesis clause). Without this export a born platform is
 // un-administrable — the admin bootstrap has no door.
@@ -105,6 +110,10 @@ export { BIRTH_ATTESTATION_ID, BirthAttestation, birthAttestation, seedBirthAtte
 // onboarding signer S_P) so the kernel reads it at `signer-delegation:<user>` when assembling a home's chain.
 export { SignerDelegation, enrollDelegation, signerDelegationByUser } from "./signing_identity.js";
 
+/** Canonical governance-law namespace. Genesis routes refer to this declaration, never a repeated
+ * string literal, so renaming the module cannot silently strand part of the founding ceremony. */
+export const WORKSPACES_DOMAIN = "workspaces" as const;
+
 // ── WORKSPACE SELF-IDENTITY (the law reads its OWN install-context) ──────────────────────────────────
 // The governance bundle runs on root AND every born platform. A workspace knows its ROLE via this
 // singleton, at a CONSTANT fixed instance id (the RelationTuple discipline — a literal, never minted, so
@@ -191,6 +200,10 @@ export const workspaceRelations = relationType("workspace")
 /** Where a workspace's holon runs: an edge DO or the dedicated 12GiB container. */
 export const WORKSPACE_TIERS = ["edge", "heavy"] as const;
 
+/** The only cloud-level creation postures. This vocabulary is shared by the stored law field,
+ * directive payload and operator tooling so an unknown posture cannot survive as an arbitrary string. */
+export const CLOUD_CREATION_POSTURES = ["open", "invite", "closed"] as const;
+
 /**
  * GOVERNANCE POSTURE (architecture/governance_postures.md) — every platform DECLARES how the operator may
  * act in its subtree. `managed` (the default when absent) folds an OperatorGrant: the operator may run
@@ -224,7 +237,7 @@ export const WORKSPACE_STATUSES = [
 export const GRANT_STATUSES = ["active", "revoked"] as const;
 
 /** sha256 hex — the ONLY shape a credential may take inside the law. */
-const sha256Hex = z.string().regex(/^[0-9a-f]{64}$/, "expected lowercase sha256 hex");
+const sha256Hex = sha256Digest();
 
 /** Epoch-ms, caller-stamped (a plan never reads a clock). */
 const epochMs = z.number().int().nonnegative();
@@ -375,7 +388,7 @@ export const CloudPolicy = aggregate("CloudPolicy", {
    * historical replay, but absence fails closed for new births. Merely
    * granting somebody authority never changes the door for everybody else.
    */
-  creationPosture: t.string().merge(Lww).optional(),
+  creationPosture: t.enum(CLOUD_CREATION_POSTURES).merge(Lww).optional(),
   /** Who last set the policy (attribution). */
   setBy: t.string().merge(Lww),
   /** Epoch-ms the policy was last set (caller-stamped). */
@@ -527,8 +540,8 @@ export function buildGenesisChain(p: {
    *  the recipe PREPENDS `bootstrap/installDomain(framework)` + `nomos/installDomain(law)` — the two-layer
    *  install the genesis bootstrap does — so the child installs ITS OWN law as intent 0 and self-validates
    *  from there. Absent ⇒ the recipe resolves an already-installed law by shape (pre-G3 / test lanes). */
-  frameworkHash?: string;
-  lawHash?: string;
+  frameworkHash?: Sha256Digest;
+  lawHash?: Sha256Digest;
   /** METERED BIRTH (slice A3 — the descendant budget). Required: a governance child may not be
    * born without explicit BirthPolicy state. Zero is a legitimate declared "cannot birth" policy. */
   descendantPool: number;
@@ -537,15 +550,23 @@ export function buildGenesisChain(p: {
    *  ancestry while `parent` stays the SUPERSEDED record's parent (a rebirth may never reparent). */
   rebornFrom?: string;
 }): string {
-  const founder = "user:" + p.principal;
+  const founder: `user:${string}` = `user:${p.principal}`;
   // THE ORDER-DECLARED LAW INSTALL (G3): the child installs the EXACT typed USDA closures the order names.
   // Bytes are NOT in the recipe; the kernel resolves each identity from its own custody when it folds the
   // birth. Two layers, matching the genesis bootstrap: bootstrap controller, then law.
   const installSteps =
     p.frameworkHash && p.lawHash
       ? [
-          { domain: "bootstrap", directiveId: "installDomain", actor: founder, payload: { domainHash: p.frameworkHash }, domainHash: p.frameworkHash },
-          { domain: "nomos", directiveId: "installDomain", actor: founder, payload: { domainHash: p.lawHash }, domainHash: p.lawHash },
+          domainInstallGenesisOffer(
+            DomainInstallExecutor.StageZero,
+            p.frameworkHash,
+            founder,
+          ),
+          domainInstallGenesisOffer(
+            DomainInstallExecutor.LifecycleController,
+            p.lawHash,
+            founder,
+          ),
         ]
       : [];
   // THE LINEAGE-AUTHORIZATION BINDING (proof-friendly): the child's birthCloud records who authorized it, so
@@ -571,20 +592,28 @@ export function buildGenesisChain(p: {
   // METERED BIRTH (slice A3 — THE POOL CHAINS TO ROOT): every governance child is BORN BOUNDED.
   // Historical chains keep replaying under their historical law; this constructor authors only the
   // current law, whose seedBirthPolicy directive is compiler-carried. Missing policy is invalid genesis.
+  const governanceGenesisStep = <P extends Record<string, unknown>>(
+    declaration: Directive<P>,
+    payload: P,
+  ) => ({
+    domain: WORKSPACES_DOMAIN,
+    directiveId: declaration.id,
+    actor: founder,
+    payload,
+  });
   const poolSteps = [
-    {
-      domain: "workspaces",
-      directiveId: "seedBirthPolicy",
-      actor: founder,
-      payload: { maxBirthsPerPrincipal: p.descendantPool, setBy: p.principal, setAt: p.bornAt },
-    },
+    governanceGenesisStep(seedBirthPolicy, {
+      maxBirthsPerPrincipal: p.descendantPool,
+      setBy: p.principal,
+      setAt: p.bornAt,
+    }),
   ];
   return JSON.stringify([
     ...installSteps,
     ...poolSteps,
     // ERA 0 — THE GENESIS-ORDER CONTRACT (the birthHome ordering, unified): every recipe seed below runs
     // UNSIGNED on the still-WARRANT-FREE prefix; the recipe carries NO seedGenesis and NO grantAdmin. The
-    // KERNEL's birth effect — after verifying the offer's S_root-signed platformCert against the pinned
+    // KERNEL's birth effect — after verifying the offer's typed S_root-signed certificate against the pinned
     // K_root — appends `seedBirthAttestation` (the travelling cert) and THEN `seedGenesis` (the warrant,
     // self-id == name) LAST, so the platform is born WARRANTED + ATTESTED and every post-genesis write is
     // signed AND cert-gated. A birth whose cert fails verification seeds neither and is REFUSED atomically
@@ -598,11 +627,22 @@ export function buildGenesisChain(p: {
     // (`genesis_admits`: a virgin #admin roster + the warrant binding the captured principal). A baked
     // in-genesis grantAdmin can never fold (post-warrant writes need a signature the birth effect cannot
     // produce — the pre-era-0 recipe was structurally unbornable); pre-warrant enroll + post-birth signed
-    // self-grant is the lawful shape. (The keyless variant — enrollFirstDevice against the platformCert's
+    // self-grant is the lawful shape. (The keyless variant — enrollFirstDevice against the birth certificate's
     // ATTESTED AuthProvider — remains for founders with an IdP instead of a key.)
-    { domain: "workspaces", directiveId: "enrollSigner", actor: founder, payload: { keyHash: p.foundingAdminHash, grantedBy: p.principal, grantedAt: p.requestedAt } },
+    governanceGenesisStep(enrollSigner, {
+      keyHash: p.foundingAdminHash,
+      grantedBy: p.principal,
+      grantedAt: p.requestedAt,
+    }),
     // No `role` — it was a vestigial node-class label (collapsed with `kind`); birthCloud ignores it now.
-    { domain: "workspaces", directiveId: "birthCloud", actor: "", payload: { principal: p.principal, name: p.name, tier: p.tier, bornAt: p.requestedAt, bornUnder, ...(p.rebornFrom ? { rebornFrom: p.rebornFrom } : {}) } },
+    governanceGenesisStep(birthCloud, {
+      principal: p.principal,
+      name: p.name,
+      tier: p.tier,
+      bornAt: p.requestedAt,
+      bornUnder,
+      ...(p.rebornFrom ? { rebornFrom: p.rebornFrom } : {}),
+    }),
   ]);
 }
 
@@ -1248,13 +1288,6 @@ export const birthChild = directive("birthChild")
          *  own custody (never the host). Absent ⇒ the recipe resolves an already-installed law by shape. */
         frameworkHash: sha256Hex.optional(),
         lawHash: sha256Hex.optional(),
-        /** THE PLATFORM ATTESTATION (era 0 — one attested birth lane for every holon kind): the 1-link
-         *  platform_cert JSON (`executor::birth_cert::BirthCert`), SIGNED OFFLINE BY S_root (the K_root
-         *  holder). The kernel's birth effect VERIFIES it (child == name, founder == `user:<principal>`,
-         *  signature vs the pinned K_root) and injects `seedBirthAttestation` + `seedGenesis` (the warrant)
-         *  LAST into the child's genesis. REQUIRED for a genesis birth to complete — a birth without a
-         *  valid cert is refused atomically (no unwarranted platform lane survives era 0). */
-        platformCert: z.string().optional(),
         /** GOVERNANCE POSTURE (governance_postures.md) — the born child's declared posture; default
          *  `managed`. Mirrored onto its lineage record so root's bailiff can consult it on the hot path
          *  (the tenant's own {@link GovernancePosture} singleton is authoritative). Additive/era-safe. */
@@ -1505,7 +1538,7 @@ export const setCloudPolicy = directive("setCloudPolicy")
       // The creation-posture dial (cloud_sovereignty.md S6). Optional:
       // omitted leaves the field untouched (a partial amend never silently
       // resets the door).
-      creationPosture: z.enum(["open", "invite", "closed"]).optional(),
+      creationPosture: z.enum(CLOUD_CREATION_POSTURES).optional(),
       setBy: z.string().min(1),
       setAt: epochMs,
     }),

package/src/idof_lint.ts

@@ -105,72 +105,86 @@ export function assertIdOfLintForDirective(dir: Directive<unknown>, where: strin
   // tenant-facing idOf lint here would force framework wire schemas to masquerade as public
   // application schemas and, worse, reject every aggregate that opts into owned custody.
   if ((dir as { businessBirthInternal?: unknown }).businessBirthInternal === true) return;
-  const probed = probePlanOps(dir, where);
-  if (probed === undefined) return;
   let shape: Record<string, z.ZodTypeAny>;
   try {
     shape = zodObjectShape(dir.payloadSchema as z.ZodTypeAny);
   } catch {
     return;
   }
-  // Reverse index: sampled STRING value → the top-level payload field name(s) that produced it.
-  // `synthesizePayload` gives every string-kind field a DISTINCT `"sample-<field>"` value (or a
-  // schema-constrained fallback), so an exact match is unambiguous in practice.
-  const byValue = new Map<string, string>();
-  for (const [name, value] of Object.entries(probed.synth.value)) {
-    if (typeof value === "string") byValue.set(value, name);
-  }
-  for (const op of probed.ops) {
-    // A bound mutation addresses one existing aggregate instance. The payload field carrying that
-    // address is therefore not "some string" or merely "some branded id": it must be idOf(the exact
-    // aggregate being mutated). This is the identity spine of the generated application API. Without
-    // this guard a model can compile `entryId: z.string()`, after which every generated caller can mix
-    // unrelated record ids and is encouraged to reconstruct identity as application state.
-    const effectiveMarker = op.marker ?? (op.aggregateType === dir.aggregateId ? dir.marker : "mutates");
-    if (op.aggregateType !== undefined && (effectiveMarker === "mutates" || effectiveMarker === "archives")) {
-      const payloadField = byValue.get(op.aggregateId);
-      if (payloadField !== undefined) {
-        const fieldSchema = shape[payloadField];
-        const actualTarget = fieldSchema === undefined ? undefined : idOfMetaOf(fieldSchema);
-        if (actualTarget !== op.aggregateType) {
-          const expected = shortAggName(op.aggregateType);
-          const actual = actualTarget === undefined
-            ? "an untyped string"
-            : `idOf(${shortAggName(actualTarget)})`;
-          const verb = effectiveMarker === "archives" ? "archive" : "mutate";
-          throw new IdOfLintError(
+  // Probe both payload presences. The ordinary proof deliberately omits optional fields, but that
+  // would make `optional().setOptional(...)` invisible to the identity lint: exactly the shape that
+  // can smuggle a business string into a typed aggregate reference. The second probe includes every
+  // sampleable top-level optional and deliberately ignores a possibly sparse author example. It is
+  // lint-only; all existing proof/effect consumers retain the ordinary omitted-optional semantics.
+  const probedVariants = [
+    probePlanOps(dir, where),
+    probePlanOps(dir, `${where} (optional fields present)`, {
+      includeOptionalTopLevel: true,
+      useDirectiveExample: false,
+    }),
+  ];
+  if (probedVariants.every((variant) => variant === undefined)) return;
+  for (const probed of probedVariants) {
+    if (probed === undefined) continue;
+    // Reverse index: sampled STRING value → the top-level payload field name(s) that produced it.
+    // `synthesizePayload` gives every string-kind field a DISTINCT `"sample-<field>"` value (or a
+    // schema-constrained fallback), so an exact match is unambiguous in practice.
+    const byValue = new Map<string, string>();
+    for (const [name, value] of Object.entries(probed.synth.value)) {
+      if (typeof value === "string") byValue.set(value, name);
+    }
+    for (const op of probed.ops) {
+      // A bound mutation addresses one existing aggregate instance. The payload field carrying that
+      // address is therefore not "some string" or merely "some branded id": it must be idOf(the exact
+      // aggregate being mutated). This is the identity spine of the generated application API. Without
+      // this guard a model can compile `entryId: z.string()`, after which every generated caller can mix
+      // unrelated record ids and is encouraged to reconstruct identity as application state.
+      const effectiveMarker = op.marker ?? (op.aggregateType === dir.aggregateId ? dir.marker : "mutates");
+      if (op.aggregateType !== undefined && (effectiveMarker === "mutates" || effectiveMarker === "archives")) {
+        const payloadField = byValue.get(op.aggregateId);
+        if (payloadField !== undefined) {
+          const fieldSchema = shape[payloadField];
+          const actualTarget = fieldSchema === undefined ? undefined : idOfMetaOf(fieldSchema);
+          if (actualTarget !== op.aggregateType) {
+            const expected = shortAggName(op.aggregateType);
+            const actual = actualTarget === undefined
+              ? "an untyped string"
+              : `idOf(${shortAggName(actualTarget)})`;
+            const verb = effectiveMarker === "archives" ? "archive" : "mutate";
+            throw new IdOfLintError(
               `directive '${dir.id}': payload field '${payloadField}' selects the ${expected} record to ${verb} ` +
               `but carries ${actual} — declare it as idOf(${expected}) so create, update, find and watch use ` +
               `the same generated NomosRef<${expected}>.`,
-          );
+            );
+          }
         }
       }
-    }
-    if (op.kind !== "set" && op.kind !== "setEntry") continue;
-    if (typeof op.value !== "string") continue;
-    const targetAgg = refTargetOf(op);
-    if (targetAgg === undefined) continue; // not a ref-kind field (or one the DSL can't name a target for)
-    const payloadField = byValue.get(op.value);
-    if (payloadField === undefined) continue; // not traceable to a top-level payload field — no verdict
-    const fieldSchema = shape[payloadField];
-    if (fieldSchema === undefined) continue;
-    const onAgg = shortAggName(op.aggregateType ?? op.aggregateId);
-    const targetName = shortAggName(targetAgg);
-    const actualTarget = idOfMetaOf(fieldSchema);
-    if (actualTarget === targetAgg) continue;
-    if (actualTarget !== undefined) {
+      if (op.kind !== "set" && op.kind !== "setEntry") continue;
+      if (typeof op.value !== "string") continue;
+      const targetAgg = refTargetOf(op);
+      if (targetAgg === undefined) continue; // not a ref-kind field (or one the DSL can't name a target for)
+      const payloadField = byValue.get(op.value);
+      if (payloadField === undefined) continue; // not traceable to a top-level payload field — no verdict
+      const fieldSchema = shape[payloadField];
+      if (fieldSchema === undefined) continue;
+      const onAgg = shortAggName(op.aggregateType ?? op.aggregateId);
+      const targetName = shortAggName(targetAgg);
+      const actualTarget = idOfMetaOf(fieldSchema);
+      if (actualTarget === targetAgg) continue;
+      if (actualTarget !== undefined) {
+        throw new IdOfLintError(
+          `directive '${dir.id}': payload field '${payloadField}' feeds ref field '${onAgg}.${op.field}' ` +
+            `(-> ${targetName}) but carries idOf(${shortAggName(actualTarget)}) — declare it as ` +
+            `idOf(${targetName}) so generated callers carry NomosRef<${targetName}>.`,
+        );
+      }
+      if (!isBareString(fieldSchema) && brandedIdMetaOf(fieldSchema) === undefined) continue;
       throw new IdOfLintError(
         `directive '${dir.id}': payload field '${payloadField}' feeds ref field '${onAgg}.${op.field}' ` +
-          `(-> ${targetName}) but carries idOf(${shortAggName(actualTarget)}) — declare it as ` +
-          `idOf(${targetName}) so generated callers carry NomosRef<${targetName}>.`,
+          `(-> ${targetName}) but is not idOf(${targetName}) — declare it as idOf(${targetName}) so generated ` +
+          `Dart/TS carry NomosRef<${targetName}>, matching the read model. (dart_codegen_parity.md P2)`,
       );
     }
-    if (!isBareString(fieldSchema) && brandedIdMetaOf(fieldSchema) === undefined) continue;
-    throw new IdOfLintError(
-      `directive '${dir.id}': payload field '${payloadField}' feeds ref field '${onAgg}.${op.field}' ` +
-        `(-> ${targetName}) but is not idOf(${targetName}) — declare it as idOf(${targetName}) so generated ` +
-        `Dart/TS carry NomosRef<${targetName}>, matching the read model. (dart_codegen_parity.md P2)`,
-    );
   }
 }
 

package/src/index.ts

@@ -56,10 +56,16 @@ export {
   jsonWithNullSchema,
   type EvidenceRefValue,
   evidenceRefSchema,
+  type NomosRefValue,
+  nomosRefValueSchema,
   type Sha256Digest,
+  type GitObjectId,
   sha256Digest,
+  gitObjectId,
   isSha256DigestSchema,
+  isGitObjectIdSchema,
   NOMOS_SHA256_DIGEST_BRAND,
+  NOMOS_GIT_OBJECT_ID_BRAND,
   // FIELD FACETS (the endorse model — security_model.md): authority/standing/attribution gate
   // set() acceptance of PrincipalEvidence; secret/public are the confidentiality lattice.
   authorityField,
@@ -80,6 +86,8 @@ export {
   idOf,
   idOfMetaOf,
   idOfTargetKindOf,
+  refOf,
+  refOfMetaOf,
   versionedRefOf,
   versionedRefOfMetaOf,
   brandedId,
@@ -87,7 +95,9 @@ export {
   voMetaOf,
   voSample,
   NOMOS_VO_BRAND,
+  NOMOS_REFOF_BRAND,
   NOMOS_VERSIONED_REF_BRAND,
+  type RefOfMeta,
   type VersionedRefOfMeta,
   geo,
   type ValueObject,
@@ -617,13 +627,21 @@ export {
 } from "./framework/capability.js";
 export {
   DOMAIN_INSTALLATION_PHASES,
+  DOMAIN_LIFECYCLE_DIRECTIVES,
+  MODEL_LIFECYCLE_AUTHORITY,
   DomainInstallation,
+  DomainInstallExecutor,
+  DomainInstallationPhase,
+  currentLawReference,
+  domainInstallGenesisOffer,
   domainInstallationAggregateId,
   installDomain,
   stageDomain,
   promoteDomain,
   rollbackDomain,
-  type DomainInstallationPhase,
+  type DomainLifecycleDirectiveId,
+  type CurrentLawReference,
+  type LawClosureReference,
 } from "./framework/domain_lifecycle.js";
 export {
   WORKSPACE_SYNC_DIRECTIONS,
@@ -666,6 +684,7 @@ export {
 // NATIVE ZANZIBAR RELATION SCHEMA (P1) — the userset-rewrite law as pure data.
 export {
   relationType,
+  relationRef,
   isRelationTypeDecl,
   validateRelationType,
   self,
@@ -691,6 +710,7 @@ export {
   selfObject,
   objectOf,
   type RelationObjectToken,
+  type RelationRef,
   type RelationTypeDecl,
   type RelationTypeBuilder,
   type RelationDefAst,

package/src/intent.ts

@@ -24,7 +24,11 @@ import type {
   InvariantReadIdPart,
   WorkspaceInvariantDecl,
 } from "./framework/workspace_invariant.js";
-import { businessBirthConsequence, type BusinessBirthDirective } from "./business_birth.js";
+import {
+  BUSINESS_BIRTH_POLICY_BINDING,
+  businessBirthConsequence,
+  type BusinessBirthDirective,
+} from "./business_birth.js";
 import type { BusinessBirthDecl } from "./births.js";
 import type { WorkspaceSharingPolicy } from "./workspace_sharing.js";
 
@@ -164,6 +168,7 @@ function remapNativeReads(
 
 export interface BusinessIntent<I = unknown> extends Directive<I> {
   readonly [INTENT_BRAND]: true;
+  readonly [BUSINESS_BIRTH_POLICY_BINDING]?: (domains: readonly string[]) => void;
   readonly steps: readonly IntentStep<I, any>[];
   /** The complete public business boundary. Runtime lowering still uses Directive.payloadSchema privately. */
   readonly contract: IntentContract<I>;
@@ -433,6 +438,8 @@ class IntentBuilder<I> {
     };
 
     const businessBirth = (birthSteps[0]?.directive as BusinessBirthDirective | undefined)?.businessBirth;
+    const bindBusinessBirthPolicy =
+      (birthSteps[0]?.directive as BusinessBirthDirective | undefined)?.[BUSINESS_BIRTH_POLICY_BINDING];
     return {
       [INTENT_BRAND]: true,
       id: this.id,
@@ -472,6 +479,9 @@ class IntentBuilder<I> {
         ? {}
         : {
             birthsChild: true,
+            ...(bindBusinessBirthPolicy === undefined
+              ? {}
+              : { [BUSINESS_BIRTH_POLICY_BINDING]: bindBusinessBirthPolicy }),
             businessBirth: {
               ...businessBirth,
               publicPayloadSchema: this.contractDeclaration.accepts,

package/src/law_graph.ts

@@ -31,6 +31,7 @@ import {
   lowerLawValueType,
   type LawConstant,
   type LawLiteral,
+  type LawValueMember,
   type LawValueConstraint,
   type LawValueType,
 } from "./law_value_type.js";
@@ -176,6 +177,47 @@ export interface LawPayloadContractNode {
   readonly fields: readonly LawStructuralRef<"value-field">[];
 }
 
+/** Compiler-owned facts used to author `.owned()` effects. These are part of the
+ * internal typed USDA call contract, never the tenant-facing business contract. */
+const OWNED_AUTHORING_PAYLOAD_MEMBERS = [
+  {
+    name: OWNED_KEY_PAYLOAD_FIELD,
+    required: false,
+    value: { kind: "string", constraints: [] },
+  },
+  {
+    name: OWNED_CUSTODY_PAYLOAD_FIELD,
+    required: false,
+    value: { kind: "string", constraints: [] },
+  },
+  {
+    name: OWNED_PREMINTED_RECORDS_PAYLOAD_FIELD,
+    required: false,
+    value: {
+      kind: "list",
+      element: {
+        kind: "record",
+        fields: [
+          { name: "type", required: true, value: { kind: "string", constraints: [] } },
+          { name: "id", required: true, value: { kind: "string", constraints: [] } },
+        ],
+      },
+    },
+  },
+] as const satisfies readonly LawValueMember[];
+
+function internalPayloadContract(
+  tenantContract: LawValueType,
+  capabilities: ReadonlySet<"owned-authoring">,
+): LawValueType {
+  if (tenantContract.kind !== "record") return tenantContract;
+  if (!capabilities.has("owned-authoring")) return tenantContract;
+  return {
+    kind: "record",
+    fields: [...tenantContract.fields, ...OWNED_AUTHORING_PAYLOAD_MEMBERS],
+  };
+}
+
 export interface LawReadParameter {
   readonly name: string;
   readonly field?: LawFieldPathRef;
@@ -1112,7 +1154,7 @@ export function discoverLawGraph(
   const intentNodes: LawIntentNode[] = intents.map((intent) => {
     const intentEntity = intentEntities.get(intent.id)!;
     const businessBirth = (intent as {
-      businessBirth?: { publicPayloadSchema?: z.ZodTypeAny };
+      businessBirth?: { publicPayloadSchema?: z.ZodTypeAny; owned?: boolean };
     }).businessBirth;
     const payloadContractEntity = ownedEntity(
       "contract",
@@ -1122,21 +1164,32 @@ export function discoverLawGraph(
       `${intent.id}#accepts`,
       options.source?.("intent", intent.id, module.name),
     );
-    const payloadShape = lowerAnonymousContractFields(
-      lowerLawValueType(isBusinessIntent(intent) ? intent.contract.accepts : intent.payloadSchema),
-      payloadContractEntity,
+    // A business birth has two deliberately different typed boundaries:
+    //
+    //   * `contract.accepts` / `businessBirth.publicPayloadSchema` is the tenant-facing input;
+    //   * `payloadSchema` is the executable call contract after Nomos has added its private
+    //     principal, timestamp and (when needed) sealed-genesis facts.
+    //
+    // Collapsing both to `contract.accepts` made the generated client author the correct private
+    // facts into a USDA call whose `nomos:accepts` contract did not declare them. Keep ordinary
+    // compound intents on their public contract because they have no framework-only birth carrier;
+    // only a declared business birth owns this second typed boundary.
+    const tenantPayloadContract = lowerLawValueType(
+      isBusinessIntent(intent) && businessBirth === undefined
+        ? intent.contract.accepts
+        : intent.payloadSchema,
     );
-    for (const node of payloadShape.nodes) anonymousValueNodes.set(node.entity.id, node);
-    for (const fieldRef of payloadShape.fields) {
-      const field = anonymousValueNodes.get(fieldRef.id);
-      if (field?.structuralKind !== "value-field") continue;
-      const reserved = [
+    if (tenantPayloadContract.kind !== "record") {
+      fail(`directive '${intent.id}': payload must lower to a record`);
+    }
+    for (const field of tenantPayloadContract.fields) {
+      const reserved = new Set<string>([
         OWNED_KEY_PAYLOAD_FIELD,
         OWNED_CUSTODY_PAYLOAD_FIELD,
         OWNED_PREMINTED_RECORDS_PAYLOAD_FIELD,
         BUSINESS_BIRTH_SEED_PAYLOAD_FIELD,
-      ];
-      if (!reserved.includes(field.name)) continue;
+      ]);
+      if (!reserved.has(field.name)) continue;
       const frameworkBirthCarrier = field.name === BUSINESS_BIRTH_SEED_PAYLOAD_FIELD && businessBirth !== undefined;
       if (frameworkBirthCarrier) continue;
       fail(
@@ -1145,6 +1198,23 @@ export function discoverLawGraph(
           `a different name.`,
       );
     }
+    const affectedAggregateIds = [
+      intent.aggregateId,
+      ...(intent.secondaryOutputs ?? []).map((output) => output.aggregateId),
+    ];
+    const frameworkCapabilities = new Set<"owned-authoring">();
+    if (
+      businessBirth?.owned === true ||
+      affectedAggregateIds.some((aggregateId) =>
+        aggregateByLabel.get(aggregateId)?.node.ownerField !== undefined)
+    ) {
+      frameworkCapabilities.add("owned-authoring");
+    }
+    const payloadShape = lowerAnonymousContractFields(
+      internalPayloadContract(tenantPayloadContract, frameworkCapabilities),
+      payloadContractEntity,
+    );
+    for (const node of payloadShape.nodes) anonymousValueNodes.set(node.entity.id, node);
     payloadContractNodes.push({
       kind: "payload-contract",
       entity: payloadContractEntity,