@githolon/dsl 0.103.4 → 0.103.6

package/src/framework/domain_lifecycle.ts

@@ -20,10 +20,16 @@
 import { z } from "zod";
 import { aggregate, instance } from "../aggregate.js";
 import { Lww, MapOf } from "../drivers.js";
-import { attributionField, t } from "../fields.js";
+import {
+  attributionField,
+  gitObjectId,
+  sha256Digest,
+  t,
+  type Sha256Digest,
+} from "../fields.js";
 import { directive } from "../directive.js";
 import { set, withMarker, addToSet, type PlannedOp } from "../ops.js";
-import { key, relationType, self, user } from "../relation_schema.js";
+import { key, relationRef, relationType, self, user } from "../relation_schema.js";
 
 /** The two authenticated capabilities which may execute a lifecycle install.
  * Callers choose a role; the serialized USDA route is an implementation detail. */
@@ -31,7 +37,31 @@ export enum DomainInstallExecutor {
   StageZero = "bootstrap",
   LifecycleController = "nomos",
 }
-export const INSTALL_DOMAIN_DIRECTIVE = "installDomain" as const;
+
+/** One typed vocabulary shared by declaration, gate, genesis seat and generated clients. */
+export const MODEL_LIFECYCLE_AUTHORITY = relationRef("installDomain");
+export const DOMAIN_LIFECYCLE_DIRECTIVES = {
+  Install: "installDomain",
+  Stage: "stageDomain",
+  Promote: "promoteDomain",
+  Rollback: "rollbackDomain",
+} as const;
+export type DomainLifecycleDirectiveId =
+  (typeof DOMAIN_LIFECYCLE_DIRECTIVES)[keyof typeof DOMAIN_LIFECYCLE_DIRECTIVES];
+export const INSTALL_DOMAIN_DIRECTIVE = DOMAIN_LIFECYCLE_DIRECTIVES.Install;
+
+/** A symbolic reference resolved by the kernel against the parent's active law frontier. */
+export type CurrentLawReference = string & { readonly __nomosCurrentLawReference: unique symbol };
+export type LawClosureReference = Sha256Digest | CurrentLawReference;
+
+const CURRENT_LAW_PREFIX = "nomos:current-law:";
+
+/** Construct the only symbolic law reference admitted in a child genesis recipe. */
+export function currentLawReference(domain: string): CurrentLawReference {
+  const name = domain.trim();
+  if (name.length === 0) throw new TypeError("a current-law reference requires a non-empty domain");
+  return `${CURRENT_LAW_PREFIX}${name}` as CurrentLawReference;
+}
 
 /** One complete, contract-shaped law-install call in a child genesis sequence. Keeping this
  * constructor beside the directive schema makes omission of required install provenance a type
@@ -41,16 +71,16 @@ export interface DomainInstallGenesisOffer extends Readonly<Record<string, unkno
   readonly directiveId: typeof INSTALL_DOMAIN_DIRECTIVE;
   readonly actor: string;
   readonly payload: {
-    readonly domainHash: string;
+    readonly domainHash: LawClosureReference;
     readonly installedBy: string;
-    readonly lawClosureIdentity: string;
+    readonly lawClosureIdentity: LawClosureReference;
   };
-  readonly domainHash: string;
+  readonly domainHash: LawClosureReference;
 }
 
 export function domainInstallGenesisOffer(
   domain: DomainInstallExecutor,
-  domainHash: string,
+  domainHash: LawClosureReference,
   actor: string,
 ): DomainInstallGenesisOffer {
   return {
@@ -67,32 +97,42 @@ export function domainInstallGenesisOffer(
  * delegation remains an ordinary, replayable Zanzibar edge. */
 export const modelLifecycleRelations = relationType("workspace")
   .asGlobal()
-  .relation("installDomain", { rewrite: self(), allow: [user(), key()] });
+  .relation(MODEL_LIFECYCLE_AUTHORITY, { rewrite: self(), allow: [user(), key()] });
+
+/** The lifecycle state machine is a framework type, not a bag of coincidentally matching strings. */
+export enum DomainInstallationPhase {
+  Pending = "Pending",
+  Active = "Active",
+  Disabled = "Disabled",
+  Superseded = "Superseded",
+  Retiring = "Retiring",
+  Retired = "Retired",
+  Failed = "Failed",
+}
 
 export const DOMAIN_INSTALLATION_PHASES = [
-  "Pending",
-  "Active",
-  "Disabled",
-  "Superseded",
-  "Retiring",
-  "Retired",
-  "Failed",
+  DomainInstallationPhase.Pending,
+  DomainInstallationPhase.Active,
+  DomainInstallationPhase.Disabled,
+  DomainInstallationPhase.Superseded,
+  DomainInstallationPhase.Retiring,
+  DomainInstallationPhase.Retired,
+  DomainInstallationPhase.Failed,
 ] as const;
-export type DomainInstallationPhase = (typeof DOMAIN_INSTALLATION_PHASES)[number];
 
 export const DomainInstallation = aggregate("DomainInstallation", {
-  "spec.domainHash": t.string().merge(Lww),
-  "spec.packageHash": t.string().merge(Lww),
+  "spec.domainHash": t.sha256Digest().merge(Lww),
+  "spec.packageHash": t.sha256Digest().merge(Lww),
   "spec.authorityScope": t.string().merge(Lww),
   "spec.installedBy": t.string().merge(Lww),
-  "spec.lawClosureIdentity": t.string().merge(Lww),
+  "spec.lawClosureIdentity": t.sha256Digest().merge(Lww),
   "spec.dependencies": t.set(t.string()),
-  "spec.supersedes": t.string().merge(Lww).optional(),
+  "spec.supersedes": t.sha256Digest().merge(Lww).optional(),
   "spec.finalizers": t.set(t.string()),
   "metadata.generation": t.int().merge(Lww),
   "status.phase": t.enum(DOMAIN_INSTALLATION_PHASES).merge(Lww),
   "status.observedGeneration": t.int().merge(Lww),
-  "status.supersededBy": t.string().merge(Lww).optional(),
+  "status.supersededBy": t.sha256Digest().merge(Lww).optional(),
   "status.conditions": t.map(t.json()).merge(MapOf(Lww)),
 }).public();
 
@@ -106,13 +146,13 @@ export const RELEASE_RECEIPT_AGGREGATE = "nomos_internal_ReleaseReceipt_6f0d3a";
 export const RELEASE_RECEIPT_PREFIX = "nomos-release-receipt:";
 
 export const ReleaseReceipt = aggregate(RELEASE_RECEIPT_AGGREGATE, {
-  candidateHash: t.string().merge(Lww),
-  fromHash: t.string().merge(Lww).optional(),
+  candidateHash: t.sha256Digest().merge(Lww),
+  fromHash: t.sha256Digest().merge(Lww).optional(),
   domain: t.string().merge(Lww),
-  atHash: t.string().merge(Lww),
-  atStateRoot: t.string().merge(Lww),
-  historyHash: t.string().merge(Lww),
-  reportHash: t.string().merge(Lww),
+  atHash: t.gitObjectId().merge(Lww),
+  atStateRoot: t.gitObjectId().merge(Lww),
+  historyHash: t.sha256Digest().merge(Lww),
+  reportHash: t.sha256Digest().merge(Lww),
   reportJson: t.string().merge(Lww),
   complete: t.bool(),
   evolveOk: t.bool(),
@@ -121,26 +161,26 @@ export const ReleaseReceipt = aggregate(RELEASE_RECEIPT_AGGREGATE, {
   replayedIntents: t.int().merge(Lww),
   candidateIntents: t.int().merge(Lww),
   divergenceCount: t.int().merge(Lww),
-  baselineRoot: t.string().merge(Lww),
-  candidateRoot: t.string().merge(Lww),
+  baselineRoot: t.sha256Digest().merge(Lww),
+  candidateRoot: t.sha256Digest().merge(Lww),
   acceptanceReason: t.string().merge(Lww).optional(),
   acceptedBy: attributionField(t.string().merge(Lww)),
   acceptedAt: t.int().merge(Lww),
 }).public();
 
-export function domainInstallationAggregateId(domainHash: string): string {
+export function domainInstallationAggregateId(domainHash: Sha256Digest): string {
   return `domain-installation:${domainHash}`;
 }
 
-function domainInstallationInstance(domainHash: string) {
+function domainInstallationInstance(domainHash: Sha256Digest) {
   return instance(DomainInstallation, domainInstallationAggregateId(domainHash));
 }
 
-export function releaseReceiptAggregateId(reportHash: string): string {
+export function releaseReceiptAggregateId(reportHash: Sha256Digest): string {
   return `${RELEASE_RECEIPT_PREFIX}${reportHash}`;
 }
 
-function releaseReceiptInstance(reportHash: string) {
+function releaseReceiptInstance(reportHash: Sha256Digest) {
   return instance(ReleaseReceipt, releaseReceiptAggregateId(reportHash));
 }
 
@@ -151,13 +191,13 @@ const dispositions = z.object({
   ackBy: z.string().optional(),
 }).optional();
 
-const lowerHex64 = z.string().regex(/^[0-9a-f]{64}$/);
-const gitOid = z.string().regex(/^[0-9a-f]{40}$/);
+const lowerHex64 = sha256Digest();
+const gitOid = gitObjectId();
 const preflightReceipt = z.object({
   candidateHash: lowerHex64,
   domain: z.string().min(1),
   atHash: gitOid,
-  atStateRoot: lowerHex64,
+  atStateRoot: gitOid,
   historyHash: lowerHex64,
   reportHash: lowerHex64,
   reportJson: z.string().min(2),
@@ -181,36 +221,29 @@ const preflightReceipt = z.object({
   }
 });
 
-const packagePayload = {
+const installPackagePayload = {
   domainHash: lowerHex64,
   installedBy: z.string(),
   lawClosureIdentity: lowerHex64,
   authorityScope: z.string().default("workspace/root"),
   // Omission means the empty set; keep that in the plan instead of encoding a composite default
   // into canonical USDA merely to save `?? []` at runtime.
-  dependencies: z.array(z.string()).optional(),
-  supersedes: z.string().optional(),
-  finalizers: z.array(z.string()).optional(),
+  dependencies: z.array(sha256Digest()).optional(),
+  finalizers: z.array(sha256Digest()).optional(),
 };
 
-export const installDomain = directive("installDomain")
+const stagedPackagePayload = {
+  ...installPackagePayload,
+  supersedes: sha256Digest().optional(),
+};
+
+export const installDomain = directive(DOMAIN_LIFECYCLE_DIRECTIVES.Install)
   .ensures(DomainInstallation)
-  .payload(
-    z.object({
-      ...packagePayload,
-      // THE FRONTIER TRANSITION (install-lifecycle): `replaces` names a PRIOR install this
-      // deploy makes current UNEQUIVOCALLY — the prior install is flipped out of the served
-      // frontier (`Superseded`, or `Retired` when `retireReplaced`) and gets the reverse
-      // `status.supersededBy` edge to this install. Absent ⇒ install-BESIDE (backward-compat:
-      // byte-identical ops to the pre-lifecycle plan). `replaces` also sets `spec.supersedes`.
-      replaces: z.string().optional(),
-      retireReplaced: z.boolean().default(false),
-      dispositions,
-    }).refine((p) => p.replaces === undefined || p.replaces !== p.domainHash, {
-      message: "a domain package cannot replace itself",
-      path: ["replaces"],
-    }),
-  )
+  // Installation adds law for domain keys that are not currently served. Replacement is a
+  // different operation with different evidence: stageDomain followed by promoteDomain. Keeping
+  // predecessor/retirement fields out of this type makes bypassing that state machine impossible
+  // for generated clients instead of relying on callers to remember a convention.
+  .payload(z.object({ ...installPackagePayload }).strict())
   .plan((p): PlannedOp[] => {
     const install = domainInstallationInstance(p.domainHash);
     const ops: PlannedOp[] = [
@@ -220,38 +253,25 @@ export const installDomain = directive("installDomain")
       set(install, "spec.installedBy", p.installedBy),
       set(install, "spec.lawClosureIdentity", p.lawClosureIdentity),
       set(install, "metadata.generation", 1),
-      set(install, "status.phase", "Active"),
+      set(install, "status.phase", DomainInstallationPhase.Active),
       set(install, "status.observedGeneration", 1),
     ];
     if ((p.dependencies ?? []).length > 0) {
       ops.push(addToSet(install, "spec.dependencies", p.dependencies ?? []));
     }
-    // The predecessor back-link: `supersedes` (explicit) or `replaces` (the actionable form).
-    const supersedes = p.supersedes ?? p.replaces;
-    if (supersedes !== undefined) {
-      ops.push(set(install, "spec.supersedes", supersedes));
-    }
-    // The transition on the PRIOR install: drop it from the served frontier + point it here.
-    if (p.replaces !== undefined) {
-      const replaced = domainInstallationInstance(p.replaces);
-      ops.push(
-        set(replaced, "status.phase", p.retireReplaced ? "Retired" : "Superseded"),
-      );
-      ops.push(set(replaced, "status.supersededBy", p.domainHash));
-    }
     if ((p.finalizers ?? []).length > 0) {
       ops.push(addToSet(install, "spec.finalizers", p.finalizers ?? []));
     }
     return ops;
   })
-  .requires("installDomain");
+  .requires(MODEL_LIFECYCLE_AUTHORITY);
 
 /** Store candidate law in the ledger without changing the served law frontier. The
  *  kernel content-verifies the package and lifecycle pair, while the Pending phase is
  *  deliberately invisible to dispatch, reads and replay's current-law map. */
-export const stageDomain = directive("stageDomain")
+export const stageDomain = directive(DOMAIN_LIFECYCLE_DIRECTIVES.Stage)
   .ensures(DomainInstallation)
-  .payload(z.object({ ...packagePayload }).refine(
+  .payload(z.object({ ...stagedPackagePayload }).refine(
     (p) => p.supersedes === undefined || p.supersedes !== p.domainHash,
     { message: "a staged domain package cannot supersede itself", path: ["supersedes"] },
   ))
@@ -264,7 +284,7 @@ export const stageDomain = directive("stageDomain")
       set(install, "spec.installedBy", p.installedBy),
       set(install, "spec.lawClosureIdentity", p.lawClosureIdentity),
       set(install, "metadata.generation", 1),
-      set(install, "status.phase", "Pending"),
+      set(install, "status.phase", DomainInstallationPhase.Pending),
       set(install, "status.observedGeneration", 0),
     ];
     if ((p.dependencies ?? []).length > 0) ops.push(addToSet(install, "spec.dependencies", p.dependencies ?? []));
@@ -272,17 +292,17 @@ export const stageDomain = directive("stageDomain")
     if ((p.finalizers ?? []).length > 0) ops.push(addToSet(install, "spec.finalizers", p.finalizers ?? []));
     return ops;
   })
-  .requires("installDomain");
+  .requires(MODEL_LIFECYCLE_AUTHORITY);
 
 /** Make a staged package current. The package bytes are already committed; the kernel
  *  re-loads them from prefix state and runs the evolve gate on this phase transition.
  *  The prior version stays Active by default so gradual-rollout clients can still have
  *  their declared era checked; the newer activation stamp alone makes this law current. */
-export const promoteDomain = directive("promoteDomain")
+export const promoteDomain = directive(DOMAIN_LIFECYCLE_DIRECTIVES.Promote)
   .mutates(DomainInstallation)
   .payload(z.object({
-    domainHash: z.string(),
-    replaces: z.string().optional(),
+    domainHash: sha256Digest(),
+    replaces: sha256Digest().optional(),
     retireReplaced: z.boolean().default(false),
     dispositions,
     preflight: preflightReceipt,
@@ -297,7 +317,7 @@ export const promoteDomain = directive("promoteDomain")
     const promoted = domainInstallationInstance(p.domainHash);
     const receipt = releaseReceiptInstance(p.preflight.reportHash);
     const ops: PlannedOp[] = [
-      set(promoted, "status.phase", "Active"),
+      set(promoted, "status.phase", DomainInstallationPhase.Active),
       set(promoted, "status.observedGeneration", 1),
       withMarker(set(receipt, "candidateHash", p.domainHash), "ensures"),
       ...(p.replaces !== undefined ? [set(receipt, "fromHash", p.replaces)] : []),
@@ -326,23 +346,23 @@ export const promoteDomain = directive("promoteDomain")
       const replaced = domainInstallationInstance(p.replaces);
       ops.push(set(promoted, "spec.supersedes", p.replaces));
       if (p.retireReplaced) {
-        ops.push(set(replaced, "status.phase", "Retired"));
+        ops.push(set(replaced, "status.phase", DomainInstallationPhase.Retired));
         ops.push(set(replaced, "status.supersededBy", p.domainHash));
       }
     }
     return ops;
   })
   .alsoEnsures(ReleaseReceipt)
-  .requires("installDomain");
+  .requires(MODEL_LIFECYCLE_AUTHORITY);
 
 /** Rollback is a new governed transition, never a history-pointer rewind. The prior
  *  package is promoted from committed custody and the failed candidate becomes Disabled;
  *  the kernel applies the same evolve judgment in the reverse direction. */
-export const rollbackDomain = directive("rollbackDomain")
+export const rollbackDomain = directive(DOMAIN_LIFECYCLE_DIRECTIVES.Rollback)
   .mutates(DomainInstallation)
   .payload(z.object({
-    candidateHash: z.string(),
-    priorHash: z.string(),
+    candidateHash: sha256Digest(),
+    priorHash: sha256Digest(),
     dispositions,
     preflight: preflightReceipt,
   }).refine((p) => p.candidateHash !== p.priorHash, {
@@ -360,9 +380,9 @@ export const rollbackDomain = directive("rollbackDomain")
     const prior = domainInstallationInstance(p.priorHash);
     const receipt = releaseReceiptInstance(p.preflight.reportHash);
     return [
-      set(candidate, "status.phase", "Disabled"),
+      set(candidate, "status.phase", DomainInstallationPhase.Disabled),
       set(candidate, "status.supersededBy", p.priorHash),
-      set(prior, "status.phase", "Active"),
+      set(prior, "status.phase", DomainInstallationPhase.Active),
       set(prior, "status.observedGeneration", 1),
       withMarker(set(receipt, "candidateHash", p.priorHash), "ensures"),
       set(receipt, "fromHash", p.candidateHash),
@@ -389,4 +409,4 @@ export const rollbackDomain = directive("rollbackDomain")
     ];
   })
   .alsoEnsures(ReleaseReceipt)
-  .requires("installDomain");
+  .requires(MODEL_LIFECYCLE_AUTHORITY);

package/src/framework/genesis.ts

@@ -34,6 +34,7 @@ import { Lww } from "../drivers.js";
 import { directive } from "../directive.js";
 import { set, type PlannedOp } from "../ops.js";
 import { RelationTuple, writeTuple } from "./relations.js";
+import { MODEL_LIFECYCLE_AUTHORITY } from "./domain_lifecycle.js";
 
 /**
  * Deterministic singleton id of the founding warrant — MUST equal
@@ -100,7 +101,7 @@ export const seedGenesis = directive("seedGenesis")
     ...writeGenesisWarrant(p),
     ...writeTuple({
       object: "workspace:self",
-      relation: "installDomain",
+      relation: MODEL_LIFECYCLE_AUTHORITY,
       subject: /^(user|key):/.test(p.principal) ? p.principal : `user:${p.principal}`,
       grantedBy: p.principal,
       grantedAt: p.bornAt,

package/src/framework/home.ts

@@ -27,9 +27,7 @@
 import { z } from "zod";
 import type { ApplicationHomeGenesis } from "../application_home_genesis.js";
 import { aggregate, instance, OWNED_READ_RELATION } from "../aggregate.js";
-// The device-key-hash wire shape (same validator signing_identity/workspaces use module-locally).
-const sha256Hex = z.string().regex(/^[0-9a-f]{64}$/, "expected lowercase sha256 hex (the owner's device pubkey hash)");
-import { t } from "../fields.js";
+import { sha256Digest, t } from "../fields.js";
 import { Lww } from "../drivers.js";
 import { directive } from "../directive.js";
 import { ensure } from "../authoring.js";
@@ -319,27 +317,11 @@ export function birthReceivingGroupForDomain(
       owner: z.string().min(1),
       /** The bootstrap framework controller content hash — tenant-pinned at governance compile (the child
        *  installs it IN-CHAIN as intent 0; the kernel resolves the bytes by hash from the parent's custody). */
-      frameworkHash: z.string().min(1),
+      frameworkHash: sha256Digest(),
       /** The HOME law package domainHash — tenant-pinned at governance compile (the child's second install). */
-      lawHash: z.string().min(1),
+      lawHash: sha256Digest(),
       /** ISO-8601 birth time, caller-stamped (the timestamp doctrine — the plan reads no clock). */
       bornAt: z.string().min(1),
-      /** THE OWNER'S DEVICE KEY HASH (sha256hex of the ed25519 public half — the SAME key `homeCert` is signed
-       *  by and the `signer` relation enrols). The platform holds it from the user's onboarding and ENROLS it
-       *  in the home's genesis, so the born home is SIGNER-READY: it can sign + birth its own children (estates,
-       *  catalogues) from intent 0. WITHOUT this the home is born warranted + owned but signer-less — it can
-       *  never act (the co2 estate-birth bug). Mirrors `buildGenesisChain`'s `enrollSigner` for a platform.
-       *  REQUIRED — a payload without it refuses at compile/validation, not an hour into a live deploy with a
-       *  bricked signer-less home. (The kernel injecting it from the verified cert's `parent_key` is the
-       *  eventual generalization; until then the field is loud.) */
-      ownerKeyHash: sha256Hex,
-      /** THE DEVICE-SIGNED HOME CERT (JSON `executor::birth_cert::BirthCert`), signed CLIENT-SIDE by the
-       *  owner's device key `S_U` (the SAME key `ownerKeyHash` hashes + the `signer` relation enrols). The
-       *  kernel's birth offer-effect VERIFIES this cert's signature against U's enrolled signer pubkey `P_U`
-       *  AND that its `founder == ctx.principal()` (the gate verdict, CAS-as-law) BEFORE accepting it as
-       *  `links[0]` of the travelling chain — the kernel signs nothing (it holds no secret; it only verifies).
-       *  Optional: absent ⇒ the era stays inert for this birth (pre-feature lane). */
-      homeCert: z.string().optional(),
       /** AUTHPROVIDER INHERITANCE — DEFAULT ON, opt out with `false`. Verification is PER-WORKSPACE (the
        *  kernel never walks up to the parent), so a PRIVATE child born without its own AuthProvider cannot
        *  verify any token — its own owner is locked out of verified reads (the co2 phase-6 wall). By
@@ -356,9 +338,9 @@ export function birthReceivingGroupForDomain(
   .plan((p) => {
     const founder = p.owner; // the actor for the child's own genesis steps (its self-bound owner subject)
     const groupName = receivingGroupNameOf(p.owner);
-    // THE PARENT'S DECLARED VERIFIER (one captured read serves BOTH consumers below): the inherited
-    // `setAuthProvider` genesis step AND the enroll step's `verifiedVia` provenance stamp. Read it up
-    // front so the enroll step (which precedes the inheritance step in the chain) can see the issuer.
+    // THE PARENT'S DECLARED VERIFIER. This captured read supplies the inherited provider seed.
+    // Birth-certificate verification and founding-signer enrollment belong to the kernel-owned
+    // attestation step, so neither fact is duplicated in this tenant plan or payload.
     const apRows = p.inheritAuthProvider !== false
       ? readFrameworkDeclared<Array<Record<string, unknown>>>("authProvider", { scope: "platform" })
       : undefined;
@@ -371,15 +353,6 @@ export function birthReceivingGroupForDomain(
       const v = ap?.[k];
       return typeof v === "string" && v.length > 0 ? v : undefined;
     };
-    // PROVENANCE (the verified-lineage thread, 2026-07-16): the kernel derives every later write's
-    // `principal_verified` from the ENROLL LEAF's `verifiedVia` — so a verified birth must stamp it or the
-    // born home's owner writes UNVERIFIED forever (and its own children are then born `verified:false`,
-    // whose chains refuse `verify_to_root`). The cert's `verified` IS the gate verdict post-admission
-    // (assemble_birth_attestation CAS-refuses a mismatch), so reading it in-plan is trustworthy — a lying
-    // cert never reaches this fold. An unverified birth stamps nothing (the unverified lane stays honest).
-    let certVerified = false;
-    try { certVerified = p.homeCert !== undefined && JSON.parse(p.homeCert).verified === true; } catch { /* malformed cert ⇒ unverified (the gate will refuse the birth anyway) */ }
-    const verifiedVia = certVerified ? apStr("issuer") : undefined;
     const genesisChain: Array<{ domain: string; directiveId: string; actor: string; payload: Record<string, unknown>; domainHash?: string }> = [
       // THE ORDER-DECLARED LAW INSTALL: two typed closure identities. The kernel resolves each
       // closure from the parent's custody when it folds the birth; law bytes never ride the intent.
@@ -433,16 +406,6 @@ export function birthReceivingGroupForDomain(
           bornAt: p.bornAt,
         })),
       })),
-      // ENROL THE OWNER'S DEVICE on the warrant-free prefix (when supplied) — enrollSigner self-binds to
-      // ctx.principal() (the owner), so this binds `ownerKeyHash` as the owner's signer BEFORE the warrant
-      // closes bootstrap. This is what makes the born home SIGNER-READY (able to sign + self-serve-birth its own
-      // estates/catalogues). Mirrors buildGenesisChain's founding-admin enrollSigner for a platform — homes were
-      // the inconsistent one. THE GENESIS ORDER IS THE CONTRACT (BREAK 1): the parent's offer-effect APPENDS
-      // `seedBirthAttestation` + `seedGenesis` (the WARRANT) AFTER these steps — the warrant lands LAST (E→W
-      // ladder: every seed runs UNSIGNED on the still-warrant-free prefix; the warrant closes it). ERA-SAFE: a
-      // home born earlier (pre-feature law, no such step in its recipe) replays byte-identical — the era rule
-      // rides the LAW hash, not this branch.
-      { domain: groupLawDomain, directiveId: "enrollSigner", actor: founder, payload: { keyHash: p.ownerKeyHash, grantedBy: p.owner, grantedAt: 1, ...(verifiedVia !== undefined ? { verifiedVia } : {}) } },
     ];
     // AUTHPROVIDER INHERITANCE (default ON — see the payload doc): copy the parent's declared provider
     // (the up-front captured read above) AS DATA into the child genesis. The child owns the copy as its

package/src/framework/workspaces.ts

@@ -68,9 +68,9 @@ import { z } from "zod";
 import { aggregate, instance } from "../aggregate.js";
 import { create, ensure } from "../authoring.js";
 import { birth } from "../births.js";
-import { directive } from "../directive.js";
+import { directive, type Directive } from "../directive.js";
 import { Lww } from "../drivers.js";
-import { t } from "../fields.js";
+import { sha256Digest, t, type Sha256Digest } from "../fields.js";
 import { set, withMarker } from "../ops.js";
 import { query } from "../query.js";
 import { read } from "../read.js";
@@ -79,7 +79,8 @@ import { writeTuple, removeTuple, RelationTuple, relationTupleInstanceId } from
 import { relationType, self, user, key } from "../relation_schema.js";
 import { GENESIS_WARRANT_ID } from "./genesis.js";
 import { idOf } from "../value_object.js";
-import { signerObject, SIGNER_RELATION } from "./signing_identity.js";
+import { enrollSigner, signerObject, SIGNER_RELATION } from "./signing_identity.js";
+import { seedBirthPolicy } from "./birth_meter.js";
 import {
   DomainInstallExecutor,
   domainInstallGenesisOffer,
@@ -92,7 +93,7 @@ import {
 export { GenesisWarrant, seedGenesis } from "./genesis.js";
 export { identityRelations, enrollSigner } from "./signing_identity.js";
 // ERA 0 — the keyless verified first-device door rides the GOVERNANCE law too: a freshly BORN platform
-// has a virgin roster and a cert-ATTESTED AuthProvider (the S_root-signed platformCert), so its founder's
+// has a virgin roster and a cert-ATTESTED AuthProvider (the S_root-signed birth witness), so its founder's
 // FIRST action is `enrollFirstDevice` (token-verified against the attested provider) followed by a SIGNED
 // self-`grantAdmin` (admitted by the kernel genesis clause). Without this export a born platform is
 // un-administrable — the admin bootstrap has no door.
@@ -109,6 +110,10 @@ export { BIRTH_ATTESTATION_ID, BirthAttestation, birthAttestation, seedBirthAtte
 // onboarding signer S_P) so the kernel reads it at `signer-delegation:<user>` when assembling a home's chain.
 export { SignerDelegation, enrollDelegation, signerDelegationByUser } from "./signing_identity.js";
 
+/** Canonical governance-law namespace. Genesis routes refer to this declaration, never a repeated
+ * string literal, so renaming the module cannot silently strand part of the founding ceremony. */
+export const WORKSPACES_DOMAIN = "workspaces" as const;
+
 // ── WORKSPACE SELF-IDENTITY (the law reads its OWN install-context) ──────────────────────────────────
 // The governance bundle runs on root AND every born platform. A workspace knows its ROLE via this
 // singleton, at a CONSTANT fixed instance id (the RelationTuple discipline — a literal, never minted, so
@@ -232,7 +237,7 @@ export const WORKSPACE_STATUSES = [
 export const GRANT_STATUSES = ["active", "revoked"] as const;
 
 /** sha256 hex — the ONLY shape a credential may take inside the law. */
-const sha256Hex = z.string().regex(/^[0-9a-f]{64}$/, "expected lowercase sha256 hex");
+const sha256Hex = sha256Digest();
 
 /** Epoch-ms, caller-stamped (a plan never reads a clock). */
 const epochMs = z.number().int().nonnegative();
@@ -535,8 +540,8 @@ export function buildGenesisChain(p: {
    *  the recipe PREPENDS `bootstrap/installDomain(framework)` + `nomos/installDomain(law)` — the two-layer
    *  install the genesis bootstrap does — so the child installs ITS OWN law as intent 0 and self-validates
    *  from there. Absent ⇒ the recipe resolves an already-installed law by shape (pre-G3 / test lanes). */
-  frameworkHash?: string;
-  lawHash?: string;
+  frameworkHash?: Sha256Digest;
+  lawHash?: Sha256Digest;
   /** METERED BIRTH (slice A3 — the descendant budget). Required: a governance child may not be
    * born without explicit BirthPolicy state. Zero is a legitimate declared "cannot birth" policy. */
   descendantPool: number;
@@ -545,7 +550,7 @@ export function buildGenesisChain(p: {
    *  ancestry while `parent` stays the SUPERSEDED record's parent (a rebirth may never reparent). */
   rebornFrom?: string;
 }): string {
-  const founder = "user:" + p.principal;
+  const founder: `user:${string}` = `user:${p.principal}`;
   // THE ORDER-DECLARED LAW INSTALL (G3): the child installs the EXACT typed USDA closures the order names.
   // Bytes are NOT in the recipe; the kernel resolves each identity from its own custody when it folds the
   // birth. Two layers, matching the genesis bootstrap: bootstrap controller, then law.
@@ -587,20 +592,28 @@ export function buildGenesisChain(p: {
   // METERED BIRTH (slice A3 — THE POOL CHAINS TO ROOT): every governance child is BORN BOUNDED.
   // Historical chains keep replaying under their historical law; this constructor authors only the
   // current law, whose seedBirthPolicy directive is compiler-carried. Missing policy is invalid genesis.
+  const governanceGenesisStep = <P extends Record<string, unknown>>(
+    declaration: Directive<P>,
+    payload: P,
+  ) => ({
+    domain: WORKSPACES_DOMAIN,
+    directiveId: declaration.id,
+    actor: founder,
+    payload,
+  });
   const poolSteps = [
-    {
-      domain: "workspaces",
-      directiveId: "seedBirthPolicy",
-      actor: founder,
-      payload: { maxBirthsPerPrincipal: p.descendantPool, setBy: p.principal, setAt: p.bornAt },
-    },
+    governanceGenesisStep(seedBirthPolicy, {
+      maxBirthsPerPrincipal: p.descendantPool,
+      setBy: p.principal,
+      setAt: p.bornAt,
+    }),
   ];
   return JSON.stringify([
     ...installSteps,
     ...poolSteps,
     // ERA 0 — THE GENESIS-ORDER CONTRACT (the birthHome ordering, unified): every recipe seed below runs
     // UNSIGNED on the still-WARRANT-FREE prefix; the recipe carries NO seedGenesis and NO grantAdmin. The
-    // KERNEL's birth effect — after verifying the offer's S_root-signed platformCert against the pinned
+    // KERNEL's birth effect — after verifying the offer's typed S_root-signed certificate against the pinned
     // K_root — appends `seedBirthAttestation` (the travelling cert) and THEN `seedGenesis` (the warrant,
     // self-id == name) LAST, so the platform is born WARRANTED + ATTESTED and every post-genesis write is
     // signed AND cert-gated. A birth whose cert fails verification seeds neither and is REFUSED atomically
@@ -614,11 +627,22 @@ export function buildGenesisChain(p: {
     // (`genesis_admits`: a virgin #admin roster + the warrant binding the captured principal). A baked
     // in-genesis grantAdmin can never fold (post-warrant writes need a signature the birth effect cannot
     // produce — the pre-era-0 recipe was structurally unbornable); pre-warrant enroll + post-birth signed
-    // self-grant is the lawful shape. (The keyless variant — enrollFirstDevice against the platformCert's
+    // self-grant is the lawful shape. (The keyless variant — enrollFirstDevice against the birth certificate's
     // ATTESTED AuthProvider — remains for founders with an IdP instead of a key.)
-    { domain: "workspaces", directiveId: "enrollSigner", actor: founder, payload: { keyHash: p.foundingAdminHash, grantedBy: p.principal, grantedAt: p.requestedAt } },
+    governanceGenesisStep(enrollSigner, {
+      keyHash: p.foundingAdminHash,
+      grantedBy: p.principal,
+      grantedAt: p.requestedAt,
+    }),
     // No `role` — it was a vestigial node-class label (collapsed with `kind`); birthCloud ignores it now.
-    { domain: "workspaces", directiveId: "birthCloud", actor: "", payload: { principal: p.principal, name: p.name, tier: p.tier, bornAt: p.requestedAt, bornUnder, ...(p.rebornFrom ? { rebornFrom: p.rebornFrom } : {}) } },
+    governanceGenesisStep(birthCloud, {
+      principal: p.principal,
+      name: p.name,
+      tier: p.tier,
+      bornAt: p.requestedAt,
+      bornUnder,
+      ...(p.rebornFrom ? { rebornFrom: p.rebornFrom } : {}),
+    }),
   ]);
 }
 
@@ -1264,13 +1288,6 @@ export const birthChild = directive("birthChild")
          *  own custody (never the host). Absent ⇒ the recipe resolves an already-installed law by shape. */
         frameworkHash: sha256Hex.optional(),
         lawHash: sha256Hex.optional(),
-        /** THE PLATFORM ATTESTATION (era 0 — one attested birth lane for every holon kind): the 1-link
-         *  platform_cert JSON (`executor::birth_cert::BirthCert`), SIGNED OFFLINE BY S_root (the K_root
-         *  holder). The kernel's birth effect VERIFIES it (child == name, founder == `user:<principal>`,
-         *  signature vs the pinned K_root) and injects `seedBirthAttestation` + `seedGenesis` (the warrant)
-         *  LAST into the child's genesis. REQUIRED for a genesis birth to complete — a birth without a
-         *  valid cert is refused atomically (no unwarranted platform lane survives era 0). */
-        platformCert: z.string().optional(),
         /** GOVERNANCE POSTURE (governance_postures.md) — the born child's declared posture; default
          *  `managed`. Mirrored onto its lineage record so root's bailiff can consult it on the hot path
          *  (the tenant's own {@link GovernancePosture} singleton is authoritative). Additive/era-safe. */