@githolon/dsl 0.105.9 → 0.105.12

package/dart/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 0.64.26
+
+- Restaged with the current kernel candidate: regenerated vendored assets (kernel release identity is baked into them). Published pub.dev archives are immutable, so regenerated bytes ride their own version.
+
 ## 0.64.25
 
 - Rebuild the vendored Dart runner from `@githolon/client` 0.105.8. Web-client source is an input to

package/dart/lib/src/runner/node-entry.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // <define:__NOMOS_KERNEL_RELEASE__>
-var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "08719339b0ecfb39b75543bf40422e84832153cc463b00283c0e84f6e38ce359", version: "kernel-08719339", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 }, testMint: { hash: "ab5c45c029a57b39711a559d803ed7d23e8eb94c11bbba652df7f8b3abd3c6df", version: "kernel-ab5c45c0", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 } };
+var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "7602d5c014cbf79a1069ff0f542b7b5dd3dde6d4920f44e56710bbe23ee3257d", version: "kernel-7602d5c0", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 }, testMint: { hash: "6e5e6d2f655c0a951e8a04a2a4334131cc7237aa3ff8605d575c50598c2ee803", version: "kernel-6e5e6d2f", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 } };
 
 // runner/node-entry.ts
 import { createInterface } from "node:readline";
@@ -11103,7 +11103,7 @@ ${String(commit).toLowerCase()}`;
       }));
       await offerDirective(domain, OWNED_RECOVERY_COMPLETE_DIRECTIVE, {
         requestId,
-        resultRef: JSON.stringify({ ownedCustody: String(prepared.ownedCustody || "") }),
+        ownedCustody: String(prepared.ownedCustody || ""),
         completedAt: Date.now()
       }, { domainHash, actor: connectionPrincipal });
     }
@@ -11126,21 +11126,17 @@ ${String(commit).toLowerCase()}`;
     let orders = await ownedRecoveryOrdersRaw(recoveryPrincipal);
     let order = orders.find((row) => row.ownerPrincipal === connectionPrincipal && row.deviceRequest === deviceRequest);
     if (!order) {
-      const minted = JSON.parse(call("query", {
-        queryBytes: qBytes({ op: "mint", typeTag: "NomosOwnedRecoveryOrder", nowMillis: Date.now() })
-      }));
-      const requestId2 = String(minted.id || "");
-      const now = Date.now();
-      await offerDirective(domain, OWNED_RECOVERY_REQUEST_DIRECTIVE, {
-        requestId: requestId2,
-        requestedBy: connectionPrincipal,
-        requestedAt: now,
-        scheduledAt: now,
-        deadlineAt: now + 30 * 24 * 60 * 60 * 1e3,
+      const accepted = await offerDirective(domain, OWNED_RECOVERY_REQUEST_DIRECTIVE, {
         ownerPrincipal: connectionPrincipal,
         recoveryPrincipal,
         deviceRequest
-      }, { domainHash, actor: connectionPrincipal });
+      }, { domainHash, actor: connectionPrincipal, returnCreated: true });
+      const requestId2 = accepted.created?.find(
+        (ref) => ref.type === "NomosOwnedRecoveryOrder"
+      )?.id ?? "";
+      if (!requestId2) {
+        throw new Error("owned recovery request was accepted without its created obligation reference");
+      }
       orders = await ownedRecoveryOrdersRaw(recoveryPrincipal);
       order = orders.find((row) => row.requestId === requestId2) ?? {
         id: requestId2,
@@ -11153,12 +11149,7 @@ ${String(commit).toLowerCase()}`;
     }
     const requestId = String(order.requestId || order.id || "");
     if (order.status === "completed") {
-      let receipt = {};
-      try {
-        receipt = JSON.parse(String(order.resultRef || "{}"));
-      } catch {
-      }
-      const ownedCustody = String(receipt.ownedCustody || "");
+      const ownedCustody = String(order.ownedCustody || "");
       if (!ownedCustody) {
         throw new OwnedRecoveryPendingError("Recovery is still being prepared; Nomos will continue safely.", {
           workspace,

package/dart/lib/src/runner/offline-install.mjs

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 };
 
 // <define:__NOMOS_KERNEL_RELEASE__>
-var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "08719339b0ecfb39b75543bf40422e84832153cc463b00283c0e84f6e38ce359", version: "kernel-08719339", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 }, testMint: { hash: "ab5c45c029a57b39711a559d803ed7d23e8eb94c11bbba652df7f8b3abd3c6df", version: "kernel-ab5c45c0", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 } };
+var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "7602d5c014cbf79a1069ff0f542b7b5dd3dde6d4920f44e56710bbe23ee3257d", version: "kernel-7602d5c0", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 }, testMint: { hash: "6e5e6d2f655c0a951e8a04a2a4334131cc7237aa3ff8605d575c50598c2ee803", version: "kernel-6e5e6d2f", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 } };
 
 // runner/offline-install.ts
 import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync } from "node:fs";

package/dart/lib/src/webview_bridge.dart

@@ -1153,7 +1153,7 @@ extension NomosRefAcquire<TAggregate> on NomosRef<TAggregate> {
 /// callback, invoked ONLY when the workspace is nowhere on the local plane (never for a local-only or
 /// already-mounted workspace). Mirrors the cloud-shaped subset of [NomosBridge.connect]'s parameters.
 class NomosSessionCredentials {
-  /// The cloud base URL the workspace syncs from (e.g. `https://nomos.captainapp.co.uk`).
+  /// The cloud base URL the workspace syncs from (e.g. `https://nomos.cafe`).
   final String cloud;
 
   /// The verified principal's access token (`x-nomos-auth`), when the workspace requires one.

package/dart/pubspec.yaml

@@ -7,7 +7,7 @@ repository: https://github.com/Captain-App/nomos2
 description: >-
   Nomos 2 Dart client — generated domain values, intent payloads and application
   lifecycle types over the typed Nomos kernel protocol and USDA custody model.
-version: 0.64.25
+version: 0.64.26
 
 environment:
   sdk: ^3.5.0

package/dart/test/node_runner_transport_test.dart

@@ -66,7 +66,7 @@ void main() {
     () async {
       final ws = Platform.environment['NOMOS_HEADLESS_E2E']!;
       final cloud = Platform.environment['NOMOS_CLOUD'] ??
-          'https://nomos.captainapp.co.uk';
+          'https://nomos.cafe';
       await bridge.ready.timeout(const Duration(seconds: 15));
       await bridge.connect(
           cloud: cloud, workspace: ws, clientId: 'headless-test');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.105.9",
+  "version": "0.105.12",
   "type": "module",
   "sideEffects": false,
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",

package/runtime/generated-application-host.js

@@ -10134,7 +10134,7 @@ ${String(commit).toLowerCase()}`;
       }));
       await offerDirective(domain, OWNED_RECOVERY_COMPLETE_DIRECTIVE, {
         requestId,
-        resultRef: JSON.stringify({ ownedCustody: String(prepared.ownedCustody || "") }),
+        ownedCustody: String(prepared.ownedCustody || ""),
         completedAt: Date.now()
       }, { domainHash, actor: connectionPrincipal });
     }
@@ -10157,21 +10157,17 @@ ${String(commit).toLowerCase()}`;
     let orders = await ownedRecoveryOrdersRaw(recoveryPrincipal);
     let order = orders.find((row) => row.ownerPrincipal === connectionPrincipal && row.deviceRequest === deviceRequest);
     if (!order) {
-      const minted = JSON.parse(call("query", {
-        queryBytes: qBytes({ op: "mint", typeTag: "NomosOwnedRecoveryOrder", nowMillis: Date.now() })
-      }));
-      const requestId2 = String(minted.id || "");
-      const now = Date.now();
-      await offerDirective(domain, OWNED_RECOVERY_REQUEST_DIRECTIVE, {
-        requestId: requestId2,
-        requestedBy: connectionPrincipal,
-        requestedAt: now,
-        scheduledAt: now,
-        deadlineAt: now + 30 * 24 * 60 * 60 * 1e3,
+      const accepted = await offerDirective(domain, OWNED_RECOVERY_REQUEST_DIRECTIVE, {
         ownerPrincipal: connectionPrincipal,
         recoveryPrincipal,
         deviceRequest
-      }, { domainHash, actor: connectionPrincipal });
+      }, { domainHash, actor: connectionPrincipal, returnCreated: true });
+      const requestId2 = accepted.created?.find(
+        (ref) => ref.type === "NomosOwnedRecoveryOrder"
+      )?.id ?? "";
+      if (!requestId2) {
+        throw new Error("owned recovery request was accepted without its created obligation reference");
+      }
       orders = await ownedRecoveryOrdersRaw(recoveryPrincipal);
       order = orders.find((row) => row.requestId === requestId2) ?? {
         id: requestId2,
@@ -10184,12 +10180,7 @@ ${String(commit).toLowerCase()}`;
     }
     const requestId = String(order.requestId || order.id || "");
     if (order.status === "completed") {
-      let receipt = {};
-      try {
-        receipt = JSON.parse(String(order.resultRef || "{}"));
-      } catch {
-      }
-      const ownedCustody = String(receipt.ownedCustody || "");
+      const ownedCustody = String(order.ownedCustody || "");
       if (!ownedCustody) {
         throw new OwnedRecoveryPendingError("Recovery is still being prepared; Nomos will continue safely.", {
           workspace,

package/src/capability_exports.ts

@@ -34,6 +34,26 @@ export function isCapabilityDecl(v: unknown): v is Record<string, unknown> {
   );
 }
 
+/**
+ * Compiler-only link carried by every lifecycle directive produced by `capability()`.
+ * A public business intent may wrap or compose that directive; following this typed link
+ * lets every compilation plane retain the declaration without a magic second re-export.
+ * A symbol keeps the link out of canonical law/property walks while object spread preserves
+ * it through the immutable directive and intent builders.
+ */
+export const NOMOS_CAPABILITY_DECLARATIONS = Symbol.for(
+  "nomos.capabilityDeclarations",
+);
+
+/** Capability declarations directly exported or carried by a wrapped/composed directive. */
+export function capabilityDeclarationsOf(v: unknown): Record<string, unknown>[] {
+  if (isCapabilityDecl(v)) return [v];
+  if (typeof v !== "object" || v === null) return [];
+  const attached = (v as Record<PropertyKey, unknown>)[NOMOS_CAPABILITY_DECLARATIONS];
+  if (!Array.isArray(attached)) return [];
+  return attached.filter(isCapabilityDecl);
+}
+
 // `relations` carries the receipt fence's relation SCHEMA. It MUST expand with the bundle:
 // `.requires(...)` is inert in a law that declares no relation schema, so omitting it would
 // leave every capability looking fenced while enforcing nothing.
@@ -47,11 +67,16 @@ const PIECES = ["aggregate", "obligation", "complete", "fail", "block", "deadLet
 export function expandCapabilityExports<M extends Record<string, unknown>>(mod: M): M {
   let out: Record<string, unknown> | null = null;
   for (const [k, v] of Object.entries(mod)) {
-    if (!isCapabilityDecl(v)) continue;
-    out ??= { ...mod };
-    for (const piece of PIECES) {
-      const member = (v as Record<string, unknown>)[piece];
-      if (member !== undefined) out[`${k}$${piece}`] = member;
+    const capabilities = capabilityDeclarationsOf(v);
+    for (let index = 0; index < capabilities.length; index += 1) {
+      const capability = capabilities[index]!;
+      out ??= { ...mod };
+      const stem = capabilities.length === 1 ? k : `${k}$capability${index}`;
+      if (capability !== v) out[`${stem}$declaration`] = capability;
+      for (const piece of PIECES) {
+        const member = capability[piece];
+        if (member !== undefined) out[`${stem}$${piece}`] = member;
+      }
     }
   }
   return (out ?? mod) as M;

package/src/codegen_proof.ts

@@ -3326,13 +3326,13 @@ function generateSealedApplicationProof(
     `const proofPrincipal = proofUid ? "user:" + proofUid : "";`,
     `const signIn = async (request: { readonly deviceChallenge?: string } = {}) => {`,
     `  const session = process.env.NOMOS_AUTH_TOKEN || "";`,
-    `  if (!request.deviceChallenge) return session;`,
     `  if (!proofUid) fail("the generated blank-user proof has no authority subject");`,
-    `  const endpoint = process.env.NOMOS_DEVICE_TOKEN_ENDPOINT || "https://id.nomos.captainapp.co.uk/token";`,
+    `  const endpoint = process.env.NOMOS_DEVICE_TOKEN_ENDPOINT || "https://id.nomos.cafe/token";`,
     `  const localTestIdp = endpoint.endsWith("/dev/mint-token");`,
+    `  const nonce = request.deviceChallenge || "0".repeat(64);`,
     `  const response = await fetch(endpoint, {`,
     `    method: "POST", headers: { "content-type": "application/json", ...(session ? { authorization: "Bearer " + session } : {}) },`,
-    `    body: JSON.stringify(localTestIdp ? { sub: proofUid, nonce: request.deviceChallenge } : { nonce: request.deviceChallenge }),`,
+    `    body: JSON.stringify(localTestIdp ? { sub: proofUid, nonce } : { nonce }),`,
     `  });`,
     `  const body = await response.json() as { token?: string; error?: string };`,
     `  if (!response.ok || !body.token) fail("the generated application could not attest its private device: " + (body.error || response.status));`,

package/src/codegen_provider_dart.ts

@@ -25,9 +25,10 @@
  * daemon / e2e.
  *
  * ── What it emits, per `impureCapability` capability (the STANDARD shape, never invented) ──
- *   1. a typed `XObligation` — the Obligation params (envelope provenance `requestId` /
- *      `requestedBy` / `requestedAt` ⊕ the tenant params from the DSL), with a
- *      `fromJson` decoding the incoming Obligation intent's payload JSON;
+ *   1. a typed `XObligation` — the accepted task projection (kernel envelope provenance
+ *      `requestId` / `requestedBy` / `requestedAt` ⊕ tenant params), with a `fromJson`
+ *      decoding the accepted Obligation intent. This is intentionally richer than the
+ *      peer's public request payload, which contains business params only;
  *   2. a typed `XResult`  — the success payload the handler returns: the capability's DECLARED
  *      receipt fields as TYPED members (they travel to the Receipt as typed USDA values, the
  *      mirror of the Obligation's request params), plus an optional `resultRef` naming a
@@ -76,8 +77,10 @@ export interface ImpureCapabilityDecl {
   readonly tasks?: { readonly id: string };
   /** The task aggregate handle; `.id` is the wire type (e.g. `TranscribeVoiceNoteAggregate`). */
   readonly aggregate: { readonly id: string };
-  /** The Obligation directive: `.creates`, payload = envelope ⊕ tenant params. */
+  /** The public Obligation directive: `.creates`, payload = tenant business params only. */
   readonly obligation: { readonly id: string; readonly payloadSchema: z.ZodTypeAny };
+  /** Accepted task view delivered to providers: kernel envelope ⊕ tenant params. */
+  readonly providerPayloadSchema: z.ZodTypeAny;
   /**
    * The COMPLETE (success) Receipt directive: payload = the complete envelope
    * `{requestId, completedAt}` ⊕ the capability's DECLARED receipt fields (typed USDA values,
@@ -261,8 +264,8 @@ function emitObligationClass(
     `  });`,
     ``,
     `  /// Decode an Obligation from the already-\`jsonDecode\`d payload map (the EXACT shape the`,
-    `  /// peer's \`${obligationDirectiveId}\` generated payload encoder produced). Reverse of the peer`,
-    `  /// encode — types stop here, at the JSON serde.`,
+    `  /// accepted task projection). The public request payload intentionally omits the`,
+    `  /// framework-owned envelope; types stop here, at the provider serde boundary.`,
     `  factory ${cls}.fromJson(Map<String, Object?> j) => ${cls}(`,
     fromJsonAssigns,
     `      );`,
@@ -439,7 +442,7 @@ export function emitProviderTask(
   enumDartTypes: Map<string, string>,
 ): string {
   const base = taskBaseName(task.obligation.id);
-  const specs = introspectPayload(task.obligation.payloadSchema, enumDartTypes);
+  const specs = introspectPayload(task.providerPayloadSchema, enumDartTypes);
   // The declared receipt fields = the complete payload minus the framework envelope. Typed
   // here so the generated result class states them individually instead of a stringly bag.
   const receiptSpecs = task.complete.payloadSchema

package/src/compile_package_main.ts

@@ -1660,8 +1660,8 @@ const NOMOS_TYPES_DEP = "^0.8.7";
 // 0.48.x: session-bound clients (XClient.bind/NomosClientInterface/DomainClientSessionMismatch/
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
-const NOMOS_CLIENT_DEP = "^0.64.25";
-const NOMOS_FLUTTER_DEP = "^0.63.47";
+const NOMOS_CLIENT_DEP = "^0.64.26";
+const NOMOS_FLUTTER_DEP = "^0.63.50";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in dsl/dart/pubspec.yaml
 // and dsl/dart_types/pubspec.yaml — a Dart release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).

package/src/framework/capability.ts

@@ -67,6 +67,8 @@ import {
 import { key, relationRef, relationType, self, user } from "../relation_schema.js";
 import { directive } from "../directive.js";
 import { RelationTuple, removeTuple, writeTuple } from "./relations.js";
+import { idOf } from "../value_object.js";
+import { NOMOS_CAPABILITY_DECLARATIONS } from "../capability_exports.js";
 
 /** The shipped CapabilityBinding name grammar (worker + governance law agree). */
 export const CAPABILITY_NAME_RE = /^[a-z0-9][a-z0-9._-]{0,63}$/;
@@ -111,6 +113,24 @@ export function capabilityPascal(name: string): string {
 /** The zod RAW SHAPE derived from request fields (each Field carries its own zod). */
 type RequestShape<Req extends Record<string, Field>> = { [K in keyof Req]: Req[K]["zod"] };
 
+/**
+ * Turn a stored field declaration into the equivalent public payload schema without
+ * throwing away its nominal identity. A plain `Field.zod` is sufficient for scalar and
+ * structured values; an id-stored reference needs `idOf(Target)` so generated callers and
+ * the aggregate read model name the same type. Optionality belongs to the field declaration
+ * and is preserved here as well.
+ */
+function capabilityPayloadFieldSchema(field: Field): z.ZodTypeAny {
+  const target = field.kind === "ref"
+    && field.nomosRef === undefined
+    && field.versionedForeignRef === undefined
+    ? field.refAggregateId
+    : undefined;
+  if (target === undefined) return field.zod;
+  const schema = idOf(target);
+  return field.isOptional ? schema.optional() : schema;
+}
+
 /**
  * What `capability()` returns: the full shipped quartet (so every existing
  * consumer — codegen, lowering, the reactor helpers — works unchanged) plus the
@@ -184,6 +204,17 @@ export function capability<
   receipt?: Rec;
   endpoint?: string;
   declassify?: string;
+  /** Authorization required to request the capability. Declare it here so the
+   * capability's one obligation object remains identical everywhere it is composed. */
+  requestRequires?: {
+    relation: string;
+    object?: string;
+    objectFrom?: { recordType: string; idField: string };
+  };
+  /** Delay before a provider should attempt accepted work. */
+  scheduleAfterMs?: number;
+  /** Time from acceptance until the obligation is overdue. Defaults to 24h. */
+  deadlineAfterMs?: number;
   /**
    * THE ACKNOWLEDGED WAIVER — open this capability's Receipts to any authorised author.
    *
@@ -235,10 +266,10 @@ export function capability<
   const taskAggregate = impureCapabilityAggregate(aggregateId, params);
 
   const requestShape = Object.fromEntries(
-    Object.entries(spec.request).map(([k, f]) => [k, f.zod]),
+    Object.entries(spec.request).map(([k, f]) => [k, capabilityPayloadFieldSchema(f)]),
   ) as RequestShape<Req>;
   const receiptShape = Object.fromEntries(
-    Object.entries(receipt).map(([k, f]) => [k, f.zod]),
+    Object.entries(receipt).map(([k, f]) => [k, capabilityPayloadFieldSchema(f)]),
   ) as { [K in keyof Rec]: Rec[K]["zod"] };
   const receiptEntries = Object.entries(receipt) as [string, Field][];
 
@@ -271,6 +302,12 @@ export function capability<
         }
       : {}),
     capability: name,
+    ...(spec.scheduleAfterMs !== undefined
+      ? { scheduleAfterMs: spec.scheduleAfterMs }
+      : {}),
+    ...(spec.deadlineAfterMs !== undefined
+      ? { deadlineAfterMs: spec.deadlineAfterMs }
+      : {}),
   });
 
   const camel = pascal[0]!.toLowerCase() + pascal.slice(1);
@@ -328,8 +365,19 @@ export function capability<
           object: capabilityProviderObject(name),
         }) as D);
 
-  return {
+  const obligation = spec.requestRequires === undefined
+    ? quartet.obligation
+    : quartet.obligation.requires(spec.requestRequires.relation, {
+        ...(spec.requestRequires.object !== undefined
+          ? { object: spec.requestRequires.object }
+          : {}),
+        ...(spec.requestRequires.objectFrom !== undefined
+          ? { objectFrom: spec.requestRequires.objectFrom }
+          : {}),
+      });
+  const declaration = {
     ...quartet,
+    obligation,
     complete: fenced(quartet.complete),
     fail: fenced(quartet.fail),
     block: fenced(quartet.block),
@@ -353,4 +401,24 @@ export function capability<
     // discovers this bundle's aggregate + quartet + scan query without re-exports.
     __isCapabilityDecl: true,
   } as CapabilityDecl<Req, Rec>;
+
+  // Carry the declaration through any ordinary `intent().performs(...)` or compound
+  // `.directs(...).atomically()` wrapper. This is compiler metadata, not law and not a
+  // second runtime path: it merely ensures the one declared capability cannot be lost
+  // because the tenant sensibly split it into a small file.
+  for (const lifecycle of [
+    declaration.obligation,
+    declaration.complete,
+    declaration.fail,
+    declaration.block,
+    declaration.deadLetter,
+  ]) {
+    Object.defineProperty(lifecycle, NOMOS_CAPABILITY_DECLARATIONS, {
+      value: Object.freeze([declaration]),
+      enumerable: true,
+      configurable: false,
+      writable: false,
+    });
+  }
+  return declaration;
 }

package/src/framework/impure_capability.ts

@@ -20,7 +20,7 @@
  * an **Obligation → Receipt** pair of ordinary `WireIntent`s with a first-class lifecycle law:
  *
  *   • **Obligation** — a normal intent whose role is the request: a peer dispatches
- *                   `oblige…(params, status:'requested')`,
+ *                   `oblige…(businessParams)`,
  *                   `.creates` a task aggregate keyed by a KERNEL-MINTED obligation id
  *                   (`<ObligationType>_<uuidv7>`, via the marker-driven front-door; idempotent on
  *                   replay by capture).
@@ -48,8 +48,8 @@
  * Framework (here): the task LIFECYCLE shape — the `requestId / status / resultRef? /
  * failureReason? / completedAt? / blockedReason? / nextAction? / deadLetterReason?`
  * envelope, the `requested|completed|failed|blocked|deadLettered` status
- * vocabulary, the deterministic instance-id rule (the task is keyed by its own
- * requestId), and the three plan builders that write that envelope. Tenant: the task's
+ * vocabulary, kernel-minted task identity, captured author/clock, and the plan builders
+ * that write that envelope. Tenant: the task's
  * NAME (`exportJob`, `thingExport`) and its request PARAMS (which group, which
  * filters) — the domain dev supplies those via `impureCapability({...})`.
  *
@@ -67,7 +67,8 @@
  */
 import { z } from "zod";
 import { aggregate, instance, type AggregateHandle } from "../aggregate.js";
-import { t, type Field } from "../fields.js";
+import { create, type AggregateRef } from "../authoring.js";
+import { attributionField, t, type Field } from "../fields.js";
 import { Lww } from "../drivers.js";
 import { set, type PlannedOp } from "../ops.js";
 import { directive, type RequirableDirective } from "../directive.js";
@@ -75,6 +76,7 @@ import { executeDirectiveToIntent } from "../wire_encode.js";
 import type { WireIntent } from "../wire.js";
 import type { Ports } from "../ctx.js";
 import { idOf } from "../value_object.js";
+import type { AttributionPrincipal } from "../principal_evidence.js";
 
 /**
  * The impure-capability lifecycle vocabulary — framework-fixed. A task is `requested` when
@@ -101,6 +103,8 @@ export type ImpureCapabilityStatus = (typeof IMPURE_CAPABILITY_STATUSES)[number]
  *                   create-only gap; modelled Lww).
  *  - requestedBy    Lww — who obligated the task (provenance). Immutable-after-create.
  *  - requestedAt    Int — epoch-ms the obligation was authored. Immutable-after-create.
+ *  - scheduledAt    Int — epoch-ms when a provider may start work. Framework-derived.
+ *  - deadlineAt     Int — epoch-ms when accepted work becomes overdue. Framework-derived.
  *  - status         Lww enum — `requested` → the reactor flips to a terminal status.
  *  - resultRef      Lww string (OPTIONAL) — the content-addressed ARTIFACT the provider
  *                   records on completion: a blob ref / download url, and nothing else. It
@@ -127,7 +131,7 @@ export type ImpureCapabilityStatus = (typeof IMPURE_CAPABILITY_STATUSES)[number]
  */
 export const IMPURE_CAPABILITY_ENVELOPE = {
   requestId: t.string().merge(Lww),
-  requestedBy: t.string().merge(Lww),
+  requestedBy: attributionField(t.string().merge(Lww)),
   requestedAt: t.int().merge(Lww),
   scheduledAt: t.int().merge(Lww),
   deadlineAt: t.int().merge(Lww),
@@ -186,21 +190,24 @@ export function impureCapabilityInstanceId(requestId: string): string {
   return requestId;
 }
 
-/** The Zod schema for the framework envelope fields the Obligation payload always carries. */
-const obligationEnvelopeSchema = z.object({
+/** The receipt-COMPLETE envelope every capability carries, whatever its result shape. */
+const completeEnvelopeSchema = z.object({
   requestId: z.string(),
+  completedAt: z.number().int(),
+});
+
+/**
+ * What a provider receives after the Obligation has passed the gate and become a task.
+ * Deliberately NOT the public request payload: callers supply business params, while the
+ * accepted projection adds kernel-owned identity, provenance and lifecycle timing.
+ */
+const providerEnvelopeSchema = z.object({
   requestedBy: z.string(),
   requestedAt: z.number().int(),
   scheduledAt: z.number().int(),
   deadlineAt: z.number().int(),
 });
 
-/** The receipt-COMPLETE envelope every capability carries, whatever its result shape. */
-const completeEnvelopeSchema = z.object({
-  requestId: z.string(),
-  completedAt: z.number().int(),
-});
-
 /**
  * The receipt-COMPLETE payload for a capability declaring NO typed receipt fields: the
  * envelope plus a required content-addressed ref to the produced ARTIFACT (blob ref / url).
@@ -266,7 +273,13 @@ function envelopeInstance(aggregateId: string, requestId: string) {
  */
 export function obligationOps(
   aggregateId: string,
-  p: z.infer<typeof obligationEnvelopeSchema>,
+  p: {
+    requestId: string;
+    requestedBy: string | AttributionPrincipal;
+    requestedAt: number;
+    scheduledAt: number;
+    deadlineAt: number;
+  },
   paramOps: PlannedOp[] = [],
 ): PlannedOp[] {
   const taskInstance = envelopeInstance(aggregateId, p.requestId);
@@ -366,10 +379,11 @@ export function deadLetterOps(
  *   • `obligation` — `.creates` directive (the authored Obligation),
  *   • `complete`   — `.mutates` directive (the reactor's success Receipt),
  *   • `fail`       — `.mutates` directive (the reactor's failure Receipt),
- * plus the deterministic `instanceId` rule. The `obligation` payload is the framework
- * obligation-envelope MERGED with the tenant's `paramsSchema`; the `complete` payload is
- * SYMMETRICALLY the complete-envelope merged with the tenant's `receiptSchema` (typed USDA
- * values, never an encoded blob); `fail`/`block`/`deadLetter` are fixed.
+ * plus the deterministic `instanceId` rule. The public `obligation` payload contains ONLY
+ * tenant business params. `providerPayloadSchema` describes the accepted task projection
+ * the provider receives: kernel-owned envelope plus those params. The `complete` payload is
+ * the complete-envelope merged with the tenant's `receiptSchema` (typed USDA values, never
+ * an encoded blob); `fail`/`block`/`deadLetter` are fixed.
  */
 // Infer from the EXTENDED schema, exactly as ObligationPayload does — a conditional or an
 // intersection around this turns a `.optional()` receipt field into a REQUIRED key of type
@@ -392,6 +406,8 @@ export interface ImpureCapability<
 > {
   readonly aggregate: AggregateHandle<Id, typeof IMPURE_CAPABILITY_ENVELOPE & F>;
   readonly obligation: RequirableDirective<ObligationPayload<ParamsShape>>;
+  /** Typed accepted-task view delivered to a provider (kernel envelope plus business params). */
+  readonly providerPayloadSchema: z.ZodTypeAny;
   readonly complete: RequirableDirective<CompletePayload<ReceiptShape>>;
   readonly fail: RequirableDirective<z.infer<typeof failSchema>>;
   readonly block: RequirableDirective<z.infer<typeof blockSchema>>;
@@ -412,13 +428,11 @@ export interface ImpureCapability<
 }
 
 /**
- * The inferred Obligation payload type = the framework envelope schema EXTENDED with the
- * tenant's param shape — the EXACT inference `obligationEnvelopeSchema.extend(paramsSchema)`
- * produces (so the declared `ImpureCapability.obligation` directive type and the value the factory
- * builds are the same type, with no brittle hand-written intersection).
+ * The inferred public Obligation payload type: tenant business params only. Task identity,
+ * provenance and lifecycle timing are kernel-owned and appear on the accepted provider view.
  */
 export type ObligationPayload<ParamsShape extends z.ZodRawShape> = z.infer<
-  ReturnType<typeof obligationEnvelopeSchema.extend<ParamsShape>>
+  z.ZodObject<ParamsShape>
 >;
 
 /**
@@ -507,14 +521,19 @@ export function impureCapability<
    * Omit-when-absent — declaring nothing changes nothing on the wire.
    */
   capability?: string;
+  /** Delay before the provider should attempt the task. Captured from the
+   * accepted offer's clock; callers never author lifecycle timestamps. */
+  scheduleAfterMs?: number;
+  /** Time from acceptance until the task is overdue. Defaults to 24 hours. */
+  deadlineAfterMs?: number;
 }): ImpureCapability<Id, ParamsShape, F, ReceiptShape> {
   const taskAggregate = impureCapabilityAggregate(spec.aggregateId, spec.params);
+  const obligationPayload = z.object(spec.paramsSchema);
   const typedRequestId = { requestId: idOf(taskAggregate) };
-  const obligationPayloadBase = obligationEnvelopeSchema.extend(spec.paramsSchema);
-  // `idOf()` deliberately has the same parsed value (`string`) as the schema it
-  // replaces; its extra aggregate identity lives in Zod metadata for lint/codegen.
-  // Preserve the generic payload type while installing that richer runtime schema.
-  const obligationPayload = obligationPayloadBase.extend(typedRequestId) as typeof obligationPayloadBase;
+  const providerPayloadSchema = providerEnvelopeSchema.extend({
+    ...typedRequestId,
+    ...spec.paramsSchema,
+  });
   // THE RECEIPT IS TYPED LAW, SYMMETRICAL WITH THE REQUEST. A capability that declares
   // receipt fields carries them as typed values merged onto the complete envelope, exactly
   // as the obligation merges its params. `resultRef` then keeps only its honest meaning —
@@ -536,18 +555,28 @@ export function impureCapability<
   )
     .creates(taskAggregate)
     .payload(obligationPayload)
-    .plan((p) => {
-      // The validated payload carries BOTH the envelope (required string/int) and the
-      // tenant params. `obligationOps` writes the envelope; the tenant's `writeParams`
-      // writes its own fields. Extract the envelope explicitly (it is required on the
-      // schema, so these are present non-undefined values).
-      const envelope = obligationEnvelopeSchema.parse(p);
+    .plan((p, ctx) => {
+      // The caller supplies BUSINESS PARAMS only. Nomos owns the task identity,
+      // provenance and lifecycle clock so generated clients cannot accidentally
+      // spoof or hand-roll the obligation envelope.
       const params = p as z.infer<z.ZodObject<ParamsShape>>;
-      return obligationOps(
-        spec.aggregateId,
-        envelope,
-        spec.writeParams(impureCapabilityInstanceId(envelope.requestId), params),
-      );
+      const task = create(taskAggregate);
+      const requestId = task.__id;
+      const requestedAt = ctx.clock().physical;
+      const scheduledAt = requestedAt + (spec.scheduleAfterMs ?? 0);
+      const deadlineAt = requestedAt + (spec.deadlineAfterMs ?? 24 * 60 * 60 * 1000);
+      // Narrow to the framework-owned facet while writing its envelope. This keeps every
+      // field name and value checked without pretending the tenant's generic param keys are
+      // known here; the full task still carries both facets on the wire and in generated reads.
+      const envelopeTask = task as unknown as AggregateRef<typeof IMPURE_CAPABILITY_ENVELOPE>;
+      envelopeTask
+        .set("requestId", requestId)
+        .set("requestedBy", ctx.principal().asAttribution())
+        .set("requestedAt", requestedAt)
+        .set("scheduledAt", scheduledAt)
+        .set("deadlineAt", deadlineAt)
+        .set("status", "requested");
+      return spec.writeParams(impureCapabilityInstanceId(requestId), params);
     });
 
   // The two branches above are distinct object schemas; the declared payload TYPE is the
@@ -588,6 +617,7 @@ export function impureCapability<
   return {
     aggregate: taskAggregate,
     obligation,
+    providerPayloadSchema,
     complete,
     fail,
     block,

package/src/framework/owned_custody.ts

@@ -119,6 +119,7 @@ const ownedRecoveryLifecycle = impureCapability({
   // have one typed provider contract; the kernel may then retain the sealed obligation locally until
   // that principal opens the workspace, rather than inventing an untyped host work description.
   capability: "nomos.owned-recovery",
+  deadlineAfterMs: 30 * 24 * 60 * 60 * 1000,
 });
 const hiddenRecoveryLifecycle = {
   aggregate: hidden(OwnedRecoveryOrder),

package/src/intent.ts

@@ -32,6 +32,10 @@ import {
 } from "./business_birth.js";
 import type { BusinessBirthDecl } from "./births.js";
 import type { WorkspaceSharingPolicy } from "./workspace_sharing.js";
+import {
+  capabilityDeclarationsOf,
+  NOMOS_CAPABILITY_DECLARATIONS,
+} from "./capability_exports.js";
 
 const INTENT_BRAND = "__nomos_business_intent_v1" as const;
 const LANGUAGE_BRAND = "__nomos_application_language_v1" as const;
@@ -498,6 +502,9 @@ class IntentBuilder<I> {
     const businessBirth = (birthSteps[0]?.directive as BusinessBirthDirective | undefined)?.businessBirth;
     const bindBusinessBirthPolicy =
       (birthSteps[0]?.directive as BusinessBirthDirective | undefined)?.[BUSINESS_BIRTH_POLICY_BINDING];
+    const carriedCapabilities = [
+      ...new Set(this.steps.flatMap((step) => capabilityDeclarationsOf(step.directive))),
+    ];
     return {
       [INTENT_BRAND]: true,
       id: this.id,
@@ -550,6 +557,11 @@ class IntentBuilder<I> {
               publicPayloadSchema: this.contractDeclaration.accepts,
             },
           }),
+      ...(carriedCapabilities.length === 0
+        ? {}
+        : {
+            [NOMOS_CAPABILITY_DECLARATIONS]: Object.freeze(carriedCapabilities),
+          }),
     };
   }
 }