@githolon/dsl 0.105.6 → 0.105.7

package/dart/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 0.64.24
+
+- Restaged with the current kernel candidate: regenerated vendored assets (kernel release identity is baked into them). Published pub.dev archives are immutable, so regenerated bytes ride their own version.
+
 ## 0.64.23
 
 - Rebuild the self-contained runner without the retired structural-interface sidecar assumption;

package/dart/lib/src/runner/node-entry.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // <define:__NOMOS_KERNEL_RELEASE__>
-var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "796e512cf4549c7fadbb4e56248ec076bca3992258a1b5282d678cb56bf24f35", version: "kernel-796e512c", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 }, testMint: { hash: "beaabafa0d30eb83f1e49cc9f26251996ea3ef302e24ae36180a686145b41588", version: "kernel-beaabafa", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 } };
+var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "08719339b0ecfb39b75543bf40422e84832153cc463b00283c0e84f6e38ce359", version: "kernel-08719339", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 }, testMint: { hash: "ab5c45c029a57b39711a559d803ed7d23e8eb94c11bbba652df7f8b3abd3c6df", version: "kernel-ab5c45c0", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 } };
 
 // runner/node-entry.ts
 import { createInterface } from "node:readline";
@@ -7596,7 +7596,10 @@ async function pushPack(remote, headers = {}, { updates = [], pack = null } = {}
 var RELEASE_RECEIPT_PREFIX = "nomos-release-receipt:";
 function prepareManagedPromotion(report, candidateHash, domain, opts = {}) {
   if (!report.sourceVerified || !report.complete || !report.evolve?.ok) {
-    const reason = !report.sourceVerified ? "the source ledger did not verify" : !report.complete ? "some historical premises could not be re-derived" : "the candidate fails deterministic schema evolution";
+    const reason = !report.sourceVerified ? "the source ledger did not verify" : !report.complete ? "some historical premises could not be re-derived" : [
+      "the candidate fails deterministic schema evolution",
+      ...report.evolve.violations.map((violation) => violation.detail)
+    ].join(": ");
     return { ok: false, stage: "preflight", report, error: `promotion refused: ${reason}` };
   }
   const acceptanceReason = opts.acceptanceReason?.trim();

package/dart/lib/src/runner/offline-install.mjs

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 };
 
 // <define:__NOMOS_KERNEL_RELEASE__>
-var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "796e512cf4549c7fadbb4e56248ec076bca3992258a1b5282d678cb56bf24f35", version: "kernel-796e512c", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 }, testMint: { hash: "beaabafa0d30eb83f1e49cc9f26251996ea3ef302e24ae36180a686145b41588", version: "kernel-beaabafa", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 } };
+var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "08719339b0ecfb39b75543bf40422e84832153cc463b00283c0e84f6e38ce359", version: "kernel-08719339", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 }, testMint: { hash: "ab5c45c029a57b39711a559d803ed7d23e8eb94c11bbba652df7f8b3abd3c6df", version: "kernel-ab5c45c0", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 } };
 
 // runner/offline-install.ts
 import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync } from "node:fs";
@@ -1938,7 +1938,10 @@ async function pushPack(remote, headers = {}, { updates = [], pack = null } = {}
 var RELEASE_RECEIPT_PREFIX = "nomos-release-receipt:";
 function prepareManagedPromotion(report, candidateHash, domain, opts = {}) {
   if (!report.sourceVerified || !report.complete || !report.evolve?.ok) {
-    const reason = !report.sourceVerified ? "the source ledger did not verify" : !report.complete ? "some historical premises could not be re-derived" : "the candidate fails deterministic schema evolution";
+    const reason = !report.sourceVerified ? "the source ledger did not verify" : !report.complete ? "some historical premises could not be re-derived" : [
+      "the candidate fails deterministic schema evolution",
+      ...report.evolve.violations.map((violation) => violation.detail)
+    ].join(": ");
     return { ok: false, stage: "preflight", report, error: `promotion refused: ${reason}` };
   }
   const acceptanceReason = opts.acceptanceReason?.trim();
@@ -5899,17 +5902,18 @@ var protoAuthority = (principal = "", keys = [], authToken = "", nowUnix = 0, au
   }))
 });
 function applicationQueryProto(eng2, ws, query2, options = {}) {
+  const hasAuthority = options.principal !== void 0 || options.keys !== void 0 || options.authToken !== void 0 || options.nowUnix !== void 0 || options.authorSecret !== void 0;
   const response = callProto(eng2.ex, {
     case: "query",
     value: create(QueryRequestSchema, {
       target: protoTarget(ws, options.branch ?? BRANCH),
-      authority: protoAuthority(
+      authority: hasAuthority ? protoAuthority(
         options.principal,
         options.keys,
         options.authToken,
         options.nowUnix,
         options.authorSecret
-      ),
+      ) : void 0,
       spans: options.spans ?? false,
       query: query2
     })
@@ -7843,12 +7847,10 @@ var cryptoOwnedScopeKey = (eng2, workspace2, authorSecret, scope, principal = ""
   const recordObject = record === void 0 ? void 0 : `${record.type}:${record.id}`;
   const derived = namedQueryProto(eng2, workspace2, QueryOperation.CRYPTO_OWNED_SCOPE_KEY, {
     custodyWorkspace: workspace2,
-    principal,
-    authorSecret,
     scope,
     ...recordObject === void 0 ? {} : { recordObject, recordEpoch },
     ...recordWrap === void 0 ? {} : { recordWrap }
-  });
+  }, { principal, authorSecret });
   const ownedKeySubject = String(derived.ownedKeySubject || "");
   if (!requireSeat) {
     return {
@@ -7865,7 +7867,16 @@ var cryptoOwnedScopeKey = (eng2, workspace2, authorSecret, scope, principal = ""
     let hex = "";
     for (const byte of enc3.encode(principal)) hex += byte.toString(16).padStart(2, "0");
     const object = `nomos-owned-principal:${hex || "00"}`;
-    const rows = qById(eng2, workspace2, `reltuple-${object}-nomos_internal_owned_device_key_7c1f5e`);
+    const rows = qById(
+      eng2,
+      workspace2,
+      `reltuple-${object}-nomos_internal_owned_device_key_7c1f5e`,
+      principal,
+      [],
+      "",
+      0,
+      authorSecret
+    );
     const row = Array.isArray(rows) ? rows[0] : rows?.rows?.[0];
     const leaves = row?.data?.subjects ?? row?.subjects ?? {};
     const leaf = (raw) => {
@@ -7896,14 +7907,12 @@ var cryptoOwnedScopeKey = (eng2, workspace2, authorSecret, scope, principal = ""
     const custody = String(leaf(leaves[ownedKeySubject]).ownedCustody || "");
     if (!custody) throw new Error("the approved device has no owned-data handoff");
     const opened = namedQueryProto(eng2, workspace2, QueryOperation.CRYPTO_OWNED_SCOPE_KEY, {
-      workspace: workspace2,
-      principal,
-      authorSecret,
+      custodyWorkspace: workspace2,
       scope,
       ownedCustody: custody,
       ...recordObject === void 0 ? {} : { recordObject, recordEpoch },
       ...recordWrap === void 0 ? {} : { recordWrap }
-    });
+    }, { principal, authorSecret });
     return {
       scope: String(opened.scope || scope),
       epoch: Number(opened.epoch) || 0,
@@ -7924,11 +7933,8 @@ var cryptoOwnedScopeKey = (eng2, workspace2, authorSecret, scope, principal = ""
   };
 };
 var cryptoOwnedDeviceRequest = (eng2, workspace2, principal, authorSecret, scope) => String(namedQueryProto(eng2, workspace2, QueryOperation.CRYPTO_OWNED_DEVICE_REQUEST, {
-  workspace: workspace2,
-  principal,
-  authorSecret,
   scope
-}).request || "");
+}, { principal, authorSecret }).request || "");
 var cryptoOwnedPrepareApproval = (eng2, args) => namedQueryProto(eng2, args.workspace, QueryOperation.CRYPTO_OWNED_PREPARE_APPROVAL, args);
 var cryptoOwnedPrepareRecovery = (eng2, args) => namedQueryProto(eng2, args.workspace, QueryOperation.CRYPTO_OWNED_PREPARE_RECOVERY, args);
 var cryptoKeygen = (eng2) => namedQueryProto(eng2, "root", QueryOperation.CRYPTO_KEYGEN);
@@ -7969,7 +7975,10 @@ var certSign = (eng2, {
   ...authProviderJwks !== void 0 ? { authProviderJwks } : {},
   ...authProviderAudience !== void 0 ? { authProviderAudience } : {}
 }).cert;
-var cryptoWrapKey = (eng2, { recipientPub, scopeKey }) => namedQueryProto(eng2, "root", QueryOperation.CRYPTO_WRAP_KEY, { recipientPub, scopeKey });
+var cryptoWrapKey = (eng2, { recipientPub, scopeKey }) => {
+  const result = namedQueryProto(eng2, "root", QueryOperation.CRYPTO_WRAP_KEY, { recipientPub, scopeKey });
+  return { hpkeEpk: String(result.hpkeEpk ?? ""), ct: String(result.ct ?? "") };
+};
 var cryptoUnwrapKey = (eng2, { secret, hpkeEpk, ct }) => namedQueryProto(eng2, "root", QueryOperation.CRYPTO_UNWRAP_KEY, { secret, hpkeEpk, ct }).scopeKey;
 var readPosture = (eng2, ws, principal = "", authToken = "", nowUnix = 0, authorSecret = "") => namedQueryProto(
   eng2,

package/dart/lib/src/webview_bridge.dart

@@ -1254,6 +1254,14 @@ class NomosBridge {
   final Map<String, SyncStatus> _statusBySession = {};
   final Map<String, StreamController<SyncStatus>> _syncStatusBySession = {};
   Timer? _metricsTimer;
+  // The zone this bridge was CONSTRUCTED in. The metrics poll belongs to the
+  // bridge (a long-lived, often file-shared object in tests), yet it used to be
+  // created in whichever zone the first status LISTENER attached from — in
+  // widget tests that is a per-test FakeAsync zone, so a file-shared bridge's
+  // periodic poll became a fake timer owned by ONE test and tripped
+  // flutter_test's '!timersPending' invariant at that test's teardown. Timers
+  // run in their owner's zone, not their caller's.
+  final Zone _creationZone = Zone.current;
   Future<void>? _metricsPoll;
   bool _metricsPollAgain = false;
   final Completer<void> _ready = Completer<void>();
@@ -3579,8 +3587,12 @@ class NomosBridge {
     // metrics snapshot.
     if (!_syncStatusCtrl.isClosed) _syncStatusCtrl.add(_status);
     _pollMetricsOnce();
-    _metricsTimer ??=
-        Timer.periodic(const Duration(seconds: 4), (_) => _pollMetricsOnce());
+    _metricsTimer ??= _creationZone.run(
+      () => Timer.periodic(
+        const Duration(seconds: 4),
+        (_) => _creationZone.run(_pollMetricsOnce),
+      ),
+    );
   }
 
   void _startSessionStatusPoll(String session) {
@@ -3589,8 +3601,12 @@ class NomosBridge {
       controller.add(_currentSessionStatus(session));
     }
     _pollMetricsOnce();
-    _metricsTimer ??=
-        Timer.periodic(const Duration(seconds: 4), (_) => _pollMetricsOnce());
+    _metricsTimer ??= _creationZone.run(
+      () => Timer.periodic(
+        const Duration(seconds: 4),
+        (_) => _creationZone.run(_pollMetricsOnce),
+      ),
+    );
   }
 
   void _stopStatusPollIfUnused() {

package/dart/pubspec.yaml

@@ -7,7 +7,7 @@ repository: https://github.com/Captain-App/nomos2
 description: >-
   Nomos 2 Dart client — generated domain values, intent payloads and application
   lifecycle types over the typed Nomos kernel protocol and USDA custody model.
-version: 0.64.23
+version: 0.64.24
 
 environment:
   sdk: ^3.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.105.6",
+  "version": "0.105.7",
   "type": "module",
   "sideEffects": false,
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",

package/runtime/generated-application-host.js

@@ -6627,7 +6627,10 @@ async function pushPack(remote, headers = {}, { updates = [], pack = null } = {}
 var RELEASE_RECEIPT_PREFIX = "nomos-release-receipt:";
 function prepareManagedPromotion(report, candidateHash, domain, opts = {}) {
   if (!report.sourceVerified || !report.complete || !report.evolve?.ok) {
-    const reason = !report.sourceVerified ? "the source ledger did not verify" : !report.complete ? "some historical premises could not be re-derived" : "the candidate fails deterministic schema evolution";
+    const reason = !report.sourceVerified ? "the source ledger did not verify" : !report.complete ? "some historical premises could not be re-derived" : [
+      "the candidate fails deterministic schema evolution",
+      ...report.evolve.violations.map((violation) => violation.detail)
+    ].join(": ");
     return { ok: false, stage: "preflight", report, error: `promotion refused: ${reason}` };
   }
   const acceptanceReason = opts.acceptanceReason?.trim();

package/src/aggregate.ts

@@ -84,6 +84,7 @@ export type Audience =
 export const OWNER_FIELD = "__nomos_owner_principal_7c1f5e";
 export const OWNED_READ_RELATION = "nomos_internal_owned_reader_7c1f5e";
 export const OWNED_KEY_RELATION = "nomos_internal_owned_device_key_7c1f5e";
+export const OWNED_PRINCIPAL_OBJECT_TYPE = "nomos-owned-principal";
 export const OWNED_KEY_PAYLOAD_FIELD = "__nomos_owned_device_key_subject_7c1f5e";
 export const OWNED_CUSTODY_PAYLOAD_FIELD = "__nomos_owned_device_custody_7c1f5e";
 /** Framework-carried record identities reserved by the client before an owned create is planned.
@@ -114,7 +115,7 @@ export function ownedKeyObject(principal: string): string {
           : [0xf0 | (cp >> 18), 0x80 | ((cp >> 12) & 0x3f), 0x80 | ((cp >> 6) & 0x3f), 0x80 | (cp & 0x3f)];
     for (const byte of bytes) hex += byte.toString(16).padStart(2, "0");
   }
-  return `nomos-owned-principal:${hex || "00"}`;
+  return `${OWNED_PRINCIPAL_OBJECT_TYPE}:${hex || "00"}`;
 }
 
 /**

package/src/birth_meter_ensure.ts

@@ -58,6 +58,8 @@ import {
   SignerDelegation,
   enrollDelegation,
   enrollSigner,
+  enrollSignerSelf,
+  enrollSignerSelfRequiresVerified,
   identityRelations,
   signerDelegationByUser,
   signerObject,
@@ -70,6 +72,7 @@ import {
   setAuthProvider,
 } from "./framework/auth_provider_law.js";
 import { refAs, workspaceInvariant } from "./framework/workspace_invariant.js";
+import { isRelationTypeDecl, type RelationTypeDecl } from "./relation_schema.js";
 
 /** Lightweight copy of the framework's founding-signer guard, kept here to avoid importing the whole
  * governance module (whose unrelated captured-read laws would otherwise survive into every child lump). */
@@ -201,6 +204,34 @@ export function withBirthMeterExports<M extends Record<string, unknown>>(mod: M)
     }
     if (!found) out[key] = internal(canonical);
   };
+  /** Relation schemas have a typed object address rather than an `id`. Treat an explicit re-export
+   * of the canonical framework singleton exactly like `internalize()` treats directives: replace
+   * every canonical binding with one branded copy, but never annex a tenant-authored fragment that
+   * merely happens to extend the same object type. */
+  const internalizeRelationType = (key: string, canonical: RelationTypeDecl): void => {
+    if (hasOwn(key)) {
+      const existing = out[key];
+      const sameGeneratedType =
+        isGeneratedInternal(existing) &&
+        isRelationTypeDecl(existing) &&
+        existing.type === canonical.type &&
+        existing.global === canonical.global;
+      if (existing !== canonical && !sameGeneratedType) throw reservedNameError(key);
+    }
+    let found = false;
+    for (const [exportName, value] of Object.entries(out)) {
+      if (value === canonical || (
+        isGeneratedInternal(value) &&
+        isRelationTypeDecl(value) &&
+        value.type === canonical.type &&
+        value.global === canonical.global
+      )) {
+        out[exportName] = internal(value as RelationTypeDecl);
+        found = true;
+      }
+    }
+    if (!found) out[key] = internal(canonical);
+  };
   if (governsBirth && !declaresBirth && !acceptsBirth) {
     if (exportedDirectiveIds.has("setBirthPolicy")) internalize("__nomos_BirthPolicy", BirthPolicy);
     if (exportedDirectiveIds.has("grantBirthAllowance")) internalize("__nomos_BirthGrant", BirthGrant);
@@ -210,8 +241,14 @@ export function withBirthMeterExports<M extends Record<string, unknown>>(mod: M)
   // Carry the law needed to judge that internal step in every possible child, plus the write-once guard that
   // keeps the founding lane a genesis primitive. These declarations are certified but never tenant-facing.
   internalize("__nomos_RelationTuple", RelationTuple);
-  reserve("__nomos_identityRelations", identityRelations);
+  // Keep the framework brand when this declaration is injected under a second private export key.
+  // Owned-custody law already carries the same signer schema under its own internal key; an unbranded
+  // clone makes the relation merger correctly treat it as a tenant-authored duplicate and refuse the
+  // package. Two framework paths naming one byte-identical relation are one declaration, not two authors.
+  internalizeRelationType("__nomos_identityRelations", identityRelations);
   internalize("__nomos_enrollSigner", enrollSigner);
+  internalize("__nomos_enrollSignerSelf", enrollSignerSelf);
+  internalize("__nomos_enrollSignerSelfRequiresVerified", enrollSignerSelfRequiresVerified);
   internalize("__nomos_relationTuplesByObject", relationTuplesByObject);
   internalize("__nomos_GenesisWarrant", GenesisWarrant);
   internalize("__nomos_seedGenesis", seedGenesis);

package/src/codegen_ts.ts

@@ -2090,6 +2090,25 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       `  return read(keys);`,
       `};`,
       ``,
+      `/** Owned bounded reads perform the same record-key-aware second pass without erasing`,
+      ` *  the page envelope. Keeping this distinct from the array helper makes cursor semantics explicit. */`,
+      `const _readPageWithOwnedKeys = async <T>(`,
+      `  holon: NomosHolon,`,
+      `  keyStore: NomosKeyStore | undefined,`,
+      `  scopes: readonly { scope: string; owned?: true }[],`,
+      `  read: (keys: readonly NomosScopeKey[] | undefined) => Promise<{ rows: T[]; cursor: string | null; done: boolean }>,`,
+      `): Promise<{ rows: T[]; cursor: string | null; done: boolean }> => {`,
+      `  const firstKeys = await _readKeys(holon, keyStore, scopes);`,
+      `  const first = await read(firstKeys);`,
+      `  if (!scopes.some((scope) => scope.owned === true) || first.rows.length === 0) return first;`,
+      `  const records = first.rows.map((row) => {`,
+      `    const raw = row as T & { type: string; id: string };`,
+      `    return { type: raw.type, id: raw.id };`,
+      `  });`,
+      `  const keys = await _readKeys(holon, keyStore, scopes, records);`,
+      `  return read(keys);`,
+      `};`,
+      ``,
       `/** Reactive owned reads use the exact same two-pass, record-key-aware read as one-shot reads.`,
       ` *  The raw watch is only a local change signal; ciphertext rows never reach application callbacks. */`,
       `const _watchWithOwnedKeys = <T>(`,
@@ -3375,7 +3394,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       );
       const queryPageCall = qScopes.length
         ? qOwned
-          ? `_readWithOwnedKeys(holon, keyStore, ${qScopeJson}, (keys) => (holon.queryPage ?? (() => { throw new Error("bounded reads need a current @githolon/client"); }))(${JSON.stringify(q.id)}, ${wireParams}, page, keys) as Promise<{ rows: Row<${q.returns}>[]; cursor: string | null; done: boolean }>)`
+          ? `_readPageWithOwnedKeys(holon, keyStore, ${qScopeJson}, (keys) => (holon.queryPage ?? (() => { throw new Error("bounded reads need a current @githolon/client"); }))(${JSON.stringify(q.id)}, ${wireParams}, page, keys) as Promise<{ rows: Row<${q.returns}>[]; cursor: string | null; done: boolean }>)`
           : `(holon.queryPage ?? (() => { throw new Error("bounded reads need a current @githolon/client"); }))(${JSON.stringify(q.id)}, ${wireParams}, page, await _readKeys(holon, keyStore, ${qScopeJson})) as Promise<{ rows: Row<${q.returns}>[]; cursor: string | null; done: boolean }>`
         : `(holon.queryPage ?? (() => { throw new Error("bounded reads need a current @githolon/client"); }))(${JSON.stringify(q.id)}, ${wireParams}, page) as Promise<{ rows: Row<${q.returns}>[]; cursor: string | null; done: boolean }>`;
       methods.push(

package/src/compile_package_main.ts

@@ -1660,8 +1660,8 @@ const NOMOS_TYPES_DEP = "^0.8.7";
 // 0.48.x: session-bound clients (XClient.bind/NomosClientInterface/DomainClientSessionMismatch/
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
-const NOMOS_CLIENT_DEP = "^0.64.23";
-const NOMOS_FLUTTER_DEP = "^0.63.44";
+const NOMOS_CLIENT_DEP = "^0.64.24";
+const NOMOS_FLUTTER_DEP = "^0.63.45";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in dsl/dart/pubspec.yaml
 // and dsl/dart_types/pubspec.yaml — a Dart release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).

package/src/framework/owned_custody.ts

@@ -2,11 +2,11 @@
 // Tenant code sees only generated `devices.request()` / `devices.approve(request)`.
 
 import { z } from "zod";
-import { OWNED_KEY_RELATION, OWNED_READ_RELATION, aggregate, instance, ownedKeyObject, type AggregateHandle } from "../aggregate.js";
+import { OWNED_KEY_RELATION, OWNED_PRINCIPAL_OBJECT_TYPE, OWNED_READ_RELATION, aggregate, instance, ownedKeyObject, type AggregateHandle } from "../aggregate.js";
 import { Lww } from "../drivers.js";
 import { directive } from "../directive.js";
 import { endorsementOf } from "../principal_evidence.js";
-import { isRelationTypeDecl } from "../relation_schema.js";
+import { isRelationTypeDecl, key, relationType, self, user } from "../relation_schema.js";
 import { t } from "../fields.js";
 import { set, withMarker } from "../ops.js";
 import { query } from "../query.js";
@@ -19,6 +19,7 @@ import {
   writeWrap,
 } from "./encryption_scope.js";
 import { GenesisWarrant, seedGenesis } from "./genesis.js";
+import { BirthAttestation, seedBirthAttestation } from "./home.js";
 import { RelationTuple, __qualifyAggregateType, removeTuple, writeTuple } from "./relations.js";
 import { SIGNER_RELATION, enrollSigner, signerObject, identityRelations } from "./signing_identity.js";
 import { impureCapability, impureCapabilityAggregate } from "./impure_capability.js";
@@ -27,6 +28,10 @@ import { impureCapability, impureCapabilityAggregate } from "./impure_capability
 export const OWNED_DEVICE_APPROVAL_DIRECTIVE = "nomos_internal_approve_owned_device_7c1f5e";
 export const OWNED_INITIALIZE_DIRECTIVE = "nomos_internal_initialize_owned_identity_7c1f5e";
 export const OWNED_RECOVERY_RELATION = "nomos_internal_owned_recovery_principal_7c1f5e";
+export const ownedCustodyRelations = relationType(OWNED_PRINCIPAL_OBJECT_TYPE)
+  .asGlobal()
+  .relation(OWNED_KEY_RELATION, { rewrite: self(), allow: [key()] })
+  .relation(OWNED_RECOVERY_RELATION, { rewrite: self(), allow: [user()] });
 export const OWNED_RECOVERY_PROTECT_DIRECTIVE = "nomos_internal_protect_owned_identity_7c1f5e";
 export const OWNED_RECOVERY_REQUEST_DIRECTIVE = "nomos_internal_request_owned_recovery_7c1f5e";
 export const OWNED_RECOVERY_COMPLETE_DIRECTIVE = "nomos_internal_complete_owned_recovery_7c1f5e";
@@ -109,7 +114,33 @@ const ownedRecoveryLifecycle = impureCapability({
   writeReceipt: (id, r) => [
     set(instance(OwnedRecoveryOrder, id), "ownedCustody", r.ownedCustody as string),
   ],
+  // This is intentionally unaddressed: opening the designated principal's ordinary generated
+  // client is the provider. Declaring the capability still matters because every durable Order must
+  // have one typed provider contract; the kernel may then retain the sealed obligation locally until
+  // that principal opens the workspace, rather than inventing an untyped host work description.
+  capability: "nomos.owned-recovery",
 });
+const hiddenRecoveryLifecycle = {
+  aggregate: hidden(OwnedRecoveryOrder),
+  obligation: hidden(ownedRecoveryLifecycle.obligation),
+  complete: hidden(ownedRecoveryLifecycle.complete),
+  fail: hidden(ownedRecoveryLifecycle.fail),
+  block: hidden(ownedRecoveryLifecycle.block),
+  deadLetter: hidden(ownedRecoveryLifecycle.deadLetter),
+};
+const ownedRecoveryCapability = {
+  ...ownedRecoveryLifecycle,
+  // Capability expansion deliberately re-seats the lifecycle quartet after application-language
+  // closure. Carry the private declarations there too; pointing back at the raw impure-capability
+  // declarations silently reintroduced framework verbs into proof selection and generated names.
+  aggregate: hiddenRecoveryLifecycle.aggregate,
+  obligation: hiddenRecoveryLifecycle.obligation,
+  complete: hiddenRecoveryLifecycle.complete,
+  fail: hiddenRecoveryLifecycle.fail,
+  block: hiddenRecoveryLifecycle.block,
+  deadLetter: hiddenRecoveryLifecycle.deadLetter,
+  __isCapabilityDecl: true as const,
+};
 
 export const ownedRecoveryOrdersByRecoveryPrincipal = query("nomosOwnedRecoveryOrdersByRecoveryPrincipal")
   .key("recoveryPrincipal")
@@ -157,7 +188,7 @@ const protectOwnedIdentity = Object.assign(
     .alsoEnsures(RelationTuple)
     .alsoEnsures(KeyScope)
     .alsoEnsures(WrappedKey),
-  { businessBirthInternal: true as const },
+  { businessBirthInternal: true as const, ownedAuthoringInternal: true as const },
 );
 
 const acceptOwnedRecovery = Object.assign(
@@ -181,18 +212,9 @@ const acceptOwnedRecovery = Object.assign(
         ownedCustody: p.ownedCustody,
       });
     }),
-  { businessBirthInternal: true as const },
+  { businessBirthInternal: true as const, ownedAuthoringInternal: true as const },
 );
 
-const hiddenRecoveryLifecycle = {
-  aggregate: hidden(OwnedRecoveryOrder),
-  obligation: hidden(ownedRecoveryLifecycle.obligation),
-  complete: hidden(ownedRecoveryLifecycle.complete),
-  fail: hidden(ownedRecoveryLifecycle.fail),
-  block: hidden(ownedRecoveryLifecycle.block),
-  deadLetter: hidden(ownedRecoveryLifecycle.deadLetter),
-};
-
 export type OwnedRecordAction = "share" | "unshare" | "transfer";
 
 /** One collision-resistant framework id per aggregate/action. Tenant code never sees these ids. */
@@ -256,6 +278,7 @@ const approval = directive(OWNED_DEVICE_APPROVAL_DIRECTIVE)
 /** Branded internal so ordinary directive codegen never exposes its cryptographic payload. */
 export const approveOwnedDevice = Object.assign(approval, {
   businessBirthInternal: true as const,
+  ownedAuthoringInternal: true as const,
 });
 
 /** Establish this principal's shared owned-data root before another principal shares to them. */
@@ -281,7 +304,7 @@ const initializeOwnedIdentity = Object.assign(
         ownedCustody: p.ownedCustody,
       });
     }),
-  { businessBirthInternal: true as const },
+  { businessBirthInternal: true as const, ownedAuthoringInternal: true as const },
 );
 
 function recordScope(aggregate: AggregateHandle, recordId: string): string {
@@ -295,7 +318,10 @@ function recordObject(aggregate: AggregateHandle, recordId: string): string {
 function ownedRecordActionDirectives(aggregate: AggregateHandle) {
   const share = Object.assign(
     directive(ownedRecordActionDirectiveId("share", aggregate.id))
-      .ensures(WrappedKey)
+      // The owned business record is the semantic target. Relation tuples and wraps are framework
+      // effects of sharing it; making a wrap the primary target causes authenticated law to describe
+      // this as a key action and the kernel correctly refuses `share(record, person)`.
+      .mutates(aggregate)
       .payload(z.object({
         recordId: z.string().min(1),
         peer: principal,
@@ -313,13 +339,14 @@ function ownedRecordActionDirectives(aggregate: AggregateHandle) {
         }),
         ...p.wraps.flatMap((entry) => writeWrap(recordScope(aggregate, p.recordId), entry.epoch, entry)),
       ])
-      .alsoEnsures(RelationTuple),
-    { businessBirthInternal: true as const },
+      .alsoEnsures(RelationTuple)
+      .alsoEnsuresMany(WrappedKey),
+    { businessBirthInternal: true as const, ownedAuthoringInternal: true as const },
   );
 
   const unshare = Object.assign(
     directive(ownedRecordActionDirectiveId("unshare", aggregate.id))
-      .ensures(KeyScope)
+      .mutates(aggregate)
       .payload(z.object({
         recordId: z.string().min(1),
         peer: principal,
@@ -340,14 +367,15 @@ function ownedRecordActionDirectives(aggregate: AggregateHandle) {
         ...writeKeyEpoch(recordScope(aggregate, p.recordId), p.epoch, p.changedAt, p.wraps),
       ])
       .alsoEnsures(RelationTuple)
+      .alsoEnsures(KeyScope)
       .alsoEnsuresMany(WrappedKey),
-    { businessBirthInternal: true as const },
+    { businessBirthInternal: true as const, ownedAuthoringInternal: true as const },
   );
 
   const ownerField = aggregate.audience?.kind === "owned" ? aggregate.audience.ownerField : "";
   const transfer = Object.assign(
     directive(ownedRecordActionDirectiveId("transfer", aggregate.id))
-      .ensures(KeyScope)
+      .mutates(aggregate)
       .payload(z.object({
         recordId: z.string().min(1),
         newOwner: principal,
@@ -383,9 +411,9 @@ function ownedRecordActionDirectives(aggregate: AggregateHandle) {
         return ops;
       })
       .alsoEnsuresMany(RelationTuple)
-      .alsoMutates(aggregate)
+      .alsoEnsures(KeyScope)
       .alsoEnsuresMany(WrappedKey),
-    { businessBirthInternal: true as const },
+    { businessBirthInternal: true as const, ownedAuthoringInternal: true as const },
   );
 
   return { share, unshare, transfer };
@@ -393,8 +421,11 @@ function ownedRecordActionDirectives(aggregate: AggregateHandle) {
 
 const APPROVAL_EXPORT = "__nomos_owned_device_approval_7c1f5e";
 const IDENTITY_EXPORT = "__nomos_owned_identity_relations_7c1f5e";
+const CUSTODY_RELATIONS_EXPORT = "__nomos_owned_custody_relations_7c1f5e";
 const WARRANT_EXPORT = "__nomos_owned_genesis_warrant_7c1f5e";
 const SEED_EXPORT = "__nomos_owned_seed_genesis_7c1f5e";
+const BIRTH_ATTESTATION_EXPORT = "__nomos_owned_birth_attestation_7c1f5e";
+const BIRTH_ATTESTATION_SEED_EXPORT = "__nomos_owned_seed_birth_attestation_7c1f5e";
 const ENROLL_EXPORT = "__nomos_owned_enroll_signer_7c1f5e";
 const INITIALIZE_EXPORT = "__nomos_owned_initialize_identity_7c1f5e";
 const KEY_SCOPE_EXPORT = "__nomos_owned_key_scope_7c1f5e";
@@ -411,11 +442,15 @@ const RECOVERY_FAIL_EXPORT = "__nomos_owned_recovery_fail_7c1f5e";
 const RECOVERY_BLOCK_EXPORT = "__nomos_owned_recovery_block_7c1f5e";
 const RECOVERY_DEAD_LETTER_EXPORT = "__nomos_owned_recovery_dead_letter_7c1f5e";
 const RECOVERY_QUERY_EXPORT = "__nomos_owned_recovery_query_7c1f5e";
+const RECOVERY_CAPABILITY_EXPORT = "__nomos_owned_recovery_capability_7c1f5e";
 
 const ownedGenesisWarrant = hidden(GenesisWarrant);
 const ownedSeedGenesis = hidden(seedGenesis);
+const ownedBirthAttestation = hidden(BirthAttestation);
+const ownedSeedBirthAttestation = hidden(seedBirthAttestation);
 const ownedEnrollSigner = hidden(enrollSigner);
 const ownedIdentityRelations = hidden(identityRelations);
+const ownedCustodyRelationLaw = hidden(ownedCustodyRelations);
 
 /**
  * The published CLI bundles its compiler while a tenant module imports declarations from the separately
@@ -476,6 +511,7 @@ export function withOwnedCustodyExports<M extends Record<string, unknown>>(mod:
     [RECOVERY_BLOCK_EXPORT, hiddenRecoveryLifecycle.block],
     [RECOVERY_DEAD_LETTER_EXPORT, hiddenRecoveryLifecycle.deadLetter],
     [RECOVERY_QUERY_EXPORT, hidden(ownedRecoveryOrdersByRecoveryPrincipal)],
+    [RECOVERY_CAPABILITY_EXPORT, hidden(ownedRecoveryCapability)],
   ] as const;
 
   // These names are deliberately obscure, not magical. A tenant can still reach one accidentally or
@@ -489,6 +525,10 @@ export function withOwnedCustodyExports<M extends Record<string, unknown>>(mod:
       && !sameFrameworkDeclaration(mod[IDENTITY_EXPORT], ownedIdentityRelations)) {
     reservedCollision(IDENTITY_EXPORT);
   }
+  if (Object.prototype.hasOwnProperty.call(mod, CUSTODY_RELATIONS_EXPORT)
+      && !sameFrameworkDeclaration(mod[CUSTODY_RELATIONS_EXPORT], ownedCustodyRelationLaw)) {
+    reservedCollision(CUSTODY_RELATIONS_EXPORT);
+  }
   for (const [key, generated] of recoveryInjections) {
     if (Object.prototype.hasOwnProperty.call(mod, key) && !sameFrameworkDeclaration(mod[key], generated)) {
       reservedCollision(key);
@@ -497,6 +537,8 @@ export function withOwnedCustodyExports<M extends Record<string, unknown>>(mod:
   for (const [key, generated] of [
     [WARRANT_EXPORT, ownedGenesisWarrant],
     [SEED_EXPORT, ownedSeedGenesis],
+    [BIRTH_ATTESTATION_EXPORT, ownedBirthAttestation],
+    [BIRTH_ATTESTATION_SEED_EXPORT, ownedSeedBirthAttestation],
     [ENROLL_EXPORT, ownedEnrollSigner],
   ] as const) {
     if (Object.prototype.hasOwnProperty.call(mod, key) && !sameFrameworkDeclaration(mod[key], generated)) {
@@ -526,6 +568,8 @@ export function withOwnedCustodyExports<M extends Record<string, unknown>>(mod:
     for (const [framework, generated] of [
       [GenesisWarrant, ownedGenesisWarrant],
       [seedGenesis, ownedSeedGenesis],
+      [BirthAttestation, ownedBirthAttestation],
+      [seedBirthAttestation, ownedSeedBirthAttestation],
       [enrollSigner, ownedEnrollSigner],
     ] as const) {
       if (
@@ -546,6 +590,14 @@ export function withOwnedCustodyExports<M extends Record<string, unknown>>(mod:
     ) {
       reservedCollision(`global relation type '${identityRelations.type}'`);
     }
+    if (
+      !sameFrameworkDeclaration(value, ownedCustodyRelationLaw)
+      && isRelationTypeDecl(value)
+      && value.global === true
+      && value.type === ownedCustodyRelations.type
+    ) {
+      reservedCollision(`global relation type '${ownedCustodyRelations.type}'`);
+    }
     if (value !== null && typeof value === "object" && typeof (value as { id?: unknown }).id === "string") {
       const id = (value as { id: string }).id;
       const generated = actions.flatMap((entry) => [entry.share, entry.unshare, entry.transfer]);
@@ -560,6 +612,7 @@ export function withOwnedCustodyExports<M extends Record<string, unknown>>(mod:
     [APPROVAL_EXPORT]: approveOwnedDevice,
     [INITIALIZE_EXPORT]: initializeOwnedIdentity,
     [IDENTITY_EXPORT]: ownedIdentityRelations,
+    [CUSTODY_RELATIONS_EXPORT]: ownedCustodyRelationLaw,
     [KEY_SCOPE_EXPORT]: hidden(KeyScope),
     [WRAPPED_KEY_EXPORT]: hidden(WrappedKey),
     [KEY_SCOPE_QUERY_EXPORT]: hidden(keyScopeByScope),
@@ -574,11 +627,14 @@ export function withOwnedCustodyExports<M extends Record<string, unknown>>(mod:
     [RECOVERY_BLOCK_EXPORT]: hiddenRecoveryLifecycle.block,
     [RECOVERY_DEAD_LETTER_EXPORT]: hiddenRecoveryLifecycle.deadLetter,
     [RECOVERY_QUERY_EXPORT]: hidden(ownedRecoveryOrdersByRecoveryPrincipal),
+    [RECOVERY_CAPABILITY_EXPORT]: hidden(ownedRecoveryCapability),
     // A local law test starts from an empty root, while production business state is normally born into a
     // warranted child. Keep the same lawful bootstrap machinery available in both cases, but framework-only:
     // the harness can seat its test identity and warrant the root without adding a tenant-facing lane.
     [WARRANT_EXPORT]: ownedGenesisWarrant,
     [SEED_EXPORT]: ownedSeedGenesis,
+    [BIRTH_ATTESTATION_EXPORT]: ownedBirthAttestation,
+    [BIRTH_ATTESTATION_SEED_EXPORT]: ownedSeedBirthAttestation,
     [ENROLL_EXPORT]: ownedEnrollSigner,
   };
   for (const { aggregate, share, unshare, transfer } of actions) {

package/src/law_graph.ts

@@ -1221,6 +1221,7 @@ export function discoverLawGraph(
     const frameworkCapabilities = new Set<"owned-authoring">();
     if (
       businessBirth?.owned === true ||
+      (intent as { ownedAuthoringInternal?: unknown }).ownedAuthoringInternal === true ||
       affectedAggregateIds.some((aggregateId) =>
         aggregateByLabel.get(aggregateId)?.node.ownerField !== undefined)
     ) {
@@ -1537,16 +1538,23 @@ export function discoverLawGraph(
   const synthesizedReadRelations = new Map<string, (typeof authoredRelationDecls)[number]>();
   for (const aggregate of module.aggregates) {
     if (aggregate.audience === undefined || aggregate.audience.kind === "public") continue;
-    const relation = aggregate.audience.kind === "owned"
-      ? OWNED_READ_RELATION
-      : aggregate.audience.cap;
-    const label = `workspace#${relation}`;
+    const owned = aggregate.audience.kind === "owned";
+    const relation = owned ? OWNED_READ_RELATION : aggregate.audience.cap;
+    // A normal capability is a workspace role. `.owned()` is deliberately different: Nomos seats the
+    // creator on each record's own relation so sharing one record grants no sibling. The old synthesis
+    // declared the owned relation on `workspace:self` while the framework correctly wrote
+    // `<domain>.<Aggregate>:<id>#reader`; every lawful owner read was consequently denied.
+    const authoredObjectType = owned ? aggregate.id : "workspace";
+    const objectType = owned
+      ? aggregateByLabel.get(aggregate.id)!.node.wireType
+      : "workspace";
+    const label = `${authoredObjectType}#${relation}`;
     if (authoredRelationLabels.has(label) || synthesizedReadRelations.has(label)) continue;
     synthesizedReadRelations.set(label, {
       label,
-      authoredObjectType: "workspace",
-      objectType: "workspace",
-      global: true,
+      authoredObjectType,
+      objectType,
+      global: !owned,
       caps: DEFAULT_RELATION_CAPS,
       relation,
       definition: {
@@ -1697,16 +1705,17 @@ export function discoverLawGraph(
   }
   for (const aggregate of module.aggregates) {
     if (aggregate.audience === undefined || aggregate.audience.kind === "public") continue;
-    const relationName = aggregate.audience.kind === "owned"
-      ? OWNED_READ_RELATION
-      : aggregate.audience.cap;
+    const owned = aggregate.audience.kind === "owned";
+    const relationName = owned ? OWNED_READ_RELATION : aggregate.audience.cap;
+    const objectType = owned ? aggregate.id : "workspace";
+    const relationLabel = `${objectType}#${relationName}`;
     const candidates = relationNodes.filter((candidate) =>
-      candidate.entity.label === `workspace#${relationName}`);
+      candidate.entity.label === relationLabel);
     if (candidates.length > 1) {
       fail(`aggregate '${aggregate.id}' read relation '${relationName}' is ambiguous across relation types`);
     }
     const readPolicy: LawTargetRef<"relation" | "policy"> = candidates[0] === undefined
-      ? { kind: "dependency-export", entityKind: "relation", label: `workspace#${relationName}` }
+      ? { kind: "dependency-export", entityKind: "relation", label: relationLabel }
       : ref(candidates[0].entity);
     const entry = aggregateByLabel.get(aggregate.id)!;
     const updated = { ...entry.node, readPolicy };