@githolon/dsl 0.107.0 → 0.107.1

package/src/compile_package_main.ts

@@ -1664,8 +1664,8 @@ const NOMOS_TYPES_DEP = "^0.8.8";
 // 0.48.x: session-bound clients (XClient.bind/NomosClientInterface/DomainClientSessionMismatch/
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
-const NOMOS_CLIENT_DEP = "^0.64.40";
-const NOMOS_FLUTTER_DEP = "^0.63.68";
+const NOMOS_CLIENT_DEP = "^0.64.46";
+const NOMOS_FLUTTER_DEP = "^0.63.75";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in dsl/dart/pubspec.yaml
 // and dsl/dart_types/pubspec.yaml — a Dart release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).

package/src/framework/capability.ts

@@ -300,9 +300,15 @@ export function capability<
     // The loop is dynamic (declared field names), so the per-field `set()` typing
     // is asserted — the PUBLIC payload types stay fully inferred from the zod shape.
     writeParams: (taskId, p) =>
-      Object.keys(spec.request).map((k) =>
-        set(instance(taskAggregate, taskId), k as never, (p as Record<string, unknown>)[k] as never),
-      ),
+      Object.keys(spec.request)
+        // ABSENT OPTIONALS ARE SKIPPED, symmetrically with the receipt half below: an optional
+        // request field the caller omitted must author NO op — `undefined` can never be ledger
+        // state, and writing it deterministically halts the author plan (caught live 2026-08-19:
+        // the first tempo-less oblige after the tempo law refused on `estimatedMs`).
+        .filter((k) => (p as Record<string, unknown>)[k] !== undefined)
+        .map((k) =>
+          set(instance(taskAggregate, taskId), k as never, (p as Record<string, unknown>)[k] as never),
+        ),
     // The receipt half, symmetrical with the request half above: declared fields are merged
     // onto the complete envelope as TYPED values and written straight through. The payload
     // boundary has already validated them against the same zod the author declared, so the

package/src/framework/domain_lifecycle.ts

@@ -137,7 +137,7 @@ export const DomainInstallation = aggregate("DomainInstallation", {
 }).public();
 
 /**
- * The accepted, exact-history evidence for one activation. This is deliberately an
+ * The accepted current-frontier evidence for one activation. This is deliberately an
  * obscure framework concept: tenant models never author or name it. The generated
  * lifecycle client runs pre-flight and folds this receipt in the SAME intent that
  * activates the candidate, so recording evidence cannot make its own head anchor stale.
@@ -151,18 +151,7 @@ export const ReleaseReceipt = aggregate(RELEASE_RECEIPT_AGGREGATE, {
   domain: t.string().merge(Lww),
   atHash: t.gitObjectId().merge(Lww),
   atStateRoot: t.gitObjectId().merge(Lww),
-  historyHash: t.sha256Digest().merge(Lww),
-  reportHash: t.sha256Digest().merge(Lww),
-  reportJson: t.string().merge(Lww),
-  complete: t.bool(),
   evolveOk: t.bool(),
-  rawPromotable: t.bool(),
-  projectionEqual: t.bool(),
-  replayedIntents: t.int().merge(Lww),
-  candidateIntents: t.int().merge(Lww),
-  divergenceCount: t.int().merge(Lww),
-  baselineRoot: t.sha256Digest().merge(Lww),
-  candidateRoot: t.sha256Digest().merge(Lww),
   acceptanceReason: t.string().merge(Lww).optional(),
   acceptedBy: attributionField(t.string().merge(Lww)),
   acceptedAt: t.int().merge(Lww),
@@ -176,12 +165,12 @@ function domainInstallationInstance(domainHash: Sha256Digest) {
   return instance(DomainInstallation, domainInstallationAggregateId(domainHash));
 }
 
-export function releaseReceiptAggregateId(reportHash: Sha256Digest): string {
-  return `${RELEASE_RECEIPT_PREFIX}${reportHash}`;
+export function releaseReceiptAggregateId(candidateHash: Sha256Digest, atStateRoot: string): string {
+  return `${RELEASE_RECEIPT_PREFIX}${candidateHash}:${atStateRoot}`;
 }
 
-function releaseReceiptInstance(reportHash: Sha256Digest) {
-  return instance(ReleaseReceipt, releaseReceiptAggregateId(reportHash));
+function releaseReceiptInstance(candidateHash: Sha256Digest, atStateRoot: string) {
+  return instance(ReleaseReceipt, releaseReceiptAggregateId(candidateHash, atStateRoot));
 }
 
 const dispositions = z.object({
@@ -198,28 +187,9 @@ const preflightReceipt = z.object({
   domain: z.string().min(1),
   atHash: gitOid,
   atStateRoot: gitOid,
-  historyHash: lowerHex64,
-  reportHash: lowerHex64,
-  reportJson: z.string().min(2),
-  complete: z.literal(true),
   evolveOk: z.literal(true),
-  rawPromotable: z.boolean(),
-  projectionEqual: z.boolean(),
-  replayedIntents: z.number().int().nonnegative(),
-  candidateIntents: z.number().int().nonnegative(),
-  divergenceCount: z.number().int().nonnegative(),
-  baselineRoot: lowerHex64,
-  candidateRoot: lowerHex64,
   acceptanceReason: z.string().trim().min(1).optional(),
-}).superRefine((receipt, ctx) => {
-  if (!receipt.rawPromotable && receipt.acceptanceReason === undefined) {
-    ctx.addIssue({
-      code: z.ZodIssueCode.custom,
-      path: ["acceptanceReason"],
-      message: "a divergent but complete report needs an explicit business acceptance reason",
-    });
-  }
-});
+}).strict();
 
 const installPackagePayload = {
   domainHash: lowerHex64,
@@ -317,7 +287,7 @@ export const promoteDomain = directive(DOMAIN_LIFECYCLE_DIRECTIVES.Promote)
   }))
   .plan((p, ctx): PlannedOp[] => {
     const promoted = domainInstallationInstance(p.domainHash);
-    const receipt = releaseReceiptInstance(p.preflight.reportHash);
+    const receipt = releaseReceiptInstance(p.domainHash, p.preflight.atStateRoot);
     const ops: PlannedOp[] = [
       set(promoted, "status.phase", DomainInstallationPhase.Active),
       set(promoted, "status.observedGeneration", 1),
@@ -326,18 +296,7 @@ export const promoteDomain = directive(DOMAIN_LIFECYCLE_DIRECTIVES.Promote)
       set(receipt, "domain", p.preflight.domain),
       set(receipt, "atHash", p.preflight.atHash),
       set(receipt, "atStateRoot", p.preflight.atStateRoot),
-      set(receipt, "historyHash", p.preflight.historyHash),
-      set(receipt, "reportHash", p.preflight.reportHash),
-      set(receipt, "reportJson", p.preflight.reportJson),
-      set(receipt, "complete", true),
       set(receipt, "evolveOk", true),
-      set(receipt, "rawPromotable", p.preflight.rawPromotable),
-      set(receipt, "projectionEqual", p.preflight.projectionEqual),
-      set(receipt, "replayedIntents", p.preflight.replayedIntents),
-      set(receipt, "candidateIntents", p.preflight.candidateIntents),
-      set(receipt, "divergenceCount", p.preflight.divergenceCount),
-      set(receipt, "baselineRoot", p.preflight.baselineRoot),
-      set(receipt, "candidateRoot", p.preflight.candidateRoot),
       ...(p.preflight.acceptanceReason !== undefined
         ? [set(receipt, "acceptanceReason", p.preflight.acceptanceReason)]
         : []),
@@ -380,7 +339,7 @@ export const rollbackDomain = directive(DOMAIN_LIFECYCLE_DIRECTIVES.Rollback)
   .plan((p, ctx): PlannedOp[] => {
     const candidate = domainInstallationInstance(p.candidateHash);
     const prior = domainInstallationInstance(p.priorHash);
-    const receipt = releaseReceiptInstance(p.preflight.reportHash);
+    const receipt = releaseReceiptInstance(p.priorHash, p.preflight.atStateRoot);
     return [
       set(candidate, "status.phase", DomainInstallationPhase.Disabled),
       set(candidate, "status.supersededBy", p.priorHash),
@@ -391,18 +350,7 @@ export const rollbackDomain = directive(DOMAIN_LIFECYCLE_DIRECTIVES.Rollback)
       set(receipt, "domain", p.preflight.domain),
       set(receipt, "atHash", p.preflight.atHash),
       set(receipt, "atStateRoot", p.preflight.atStateRoot),
-      set(receipt, "historyHash", p.preflight.historyHash),
-      set(receipt, "reportHash", p.preflight.reportHash),
-      set(receipt, "reportJson", p.preflight.reportJson),
-      set(receipt, "complete", true),
       set(receipt, "evolveOk", true),
-      set(receipt, "rawPromotable", p.preflight.rawPromotable),
-      set(receipt, "projectionEqual", p.preflight.projectionEqual),
-      set(receipt, "replayedIntents", p.preflight.replayedIntents),
-      set(receipt, "candidateIntents", p.preflight.candidateIntents),
-      set(receipt, "divergenceCount", p.preflight.divergenceCount),
-      set(receipt, "baselineRoot", p.preflight.baselineRoot),
-      set(receipt, "candidateRoot", p.preflight.candidateRoot),
       ...(p.preflight.acceptanceReason !== undefined
         ? [set(receipt, "acceptanceReason", p.preflight.acceptanceReason)]
         : []),

package/src/framework/governance_relations.ts

@@ -0,0 +1,10 @@
+// NOMOS — canonical framework governance relation identities.
+//
+// These names are global, kernel-coupled vocabulary. Coin them once so DSL
+// sugar cannot accidentally redeclare them as tenant-local relations and cause
+// the compiler to namespace gates away from the framework's founding tuples.
+import { relationRef } from "../relation_schema.js";
+
+/** The global workspace authority seated at `workspace:self#admin`. */
+export const WORKSPACE_ADMIN_RELATION = relationRef("admin");
+

package/src/framework/workspaces.ts

@@ -77,6 +77,7 @@ import { read } from "../read.js";
 import { readRef, readSet, workspaceInvariant, refAs, type WorkspaceInvariantVerdict } from "./workspace_invariant.js";
 import { writeTuple, removeTuple, RelationTuple, relationTupleInstanceId } from "./relations.js";
 import { relationType, self, user, key } from "../relation_schema.js";
+import { WORKSPACE_ADMIN_RELATION } from "./governance_relations.js";
 import { GENESIS_WARRANT_ID } from "./genesis.js";
 import { idOf } from "../value_object.js";
 import { enrollSigner, signerObject, SIGNER_RELATION } from "./signing_identity.js";
@@ -191,7 +192,7 @@ export const workspaceRelations = relationType("workspace")
   // migration. (A TENANT that wants a workspace-scoped role uses a namespaced `relationType("workspace")`
   // + a `selfWorkspace()` seed; only THIS framework governance type is global.)
   .asGlobal()
-  .relation("admin", { rewrite: self(), allow: [user(), key()] })
+  .relation(WORKSPACE_ADMIN_RELATION, { rewrite: self(), allow: [user(), key()] })
   .relation("creator", { rewrite: self(), allow: [user(), key()] })
   .relation("platformCreator", { rewrite: self(), allow: [user(), key()] });
 

package/src/role.ts

@@ -14,8 +14,9 @@
  *      `relationType("workspace")` block (the fail-open footgun is CLOSED — a `.requires(role.edit)`
  *      always finds a declared relation), and the `<role>View` relation is a READ-VISIBILITY cap
  *      (used as an aggregate `requires(role.view)` — usd.ts synthesizes the global workspace read
- *      relation, exactly as any private aggregate does). The grant-authority relation (`grantableBy`,
- *      default `admin`) is likewise authored into the schema so the gate on the grant directive has teeth.
+ *      relation, exactly as any private aggregate does). A custom grant-authority relation is likewise
+ *      authored locally. The default `admin` instead refers to the framework's existing GLOBAL
+ *      `workspace:self#admin`; redeclaring it locally would namespace the gate away from its founding tuple.
  *
  *   2. GRANT / SEED DIRECTIVES per role — `grant<Role>` / `revoke<Role>` fold the relation TUPLE via
  *      the existing `writeTuple`/`removeTuple` primitives (a grant seats `<role>Edit` + `<role>View`
@@ -41,6 +42,7 @@ import type { AggregateHandle } from "./aggregate.js";
 import type { Directive, RequirableDirective } from "./directive.js";
 import { directive } from "./directive.js";
 import { RelationTuple, writeTuple, removeTuple } from "./framework/relations.js";
+import { WORKSPACE_ADMIN_RELATION } from "./framework/governance_relations.js";
 import { relationType, self, user, key, type RelationTypeDecl } from "./relation_schema.js";
 
 /** A role name: kebab-case (`editor`, `site-admin`) — lowered to relation/directive labels. */
@@ -234,7 +236,7 @@ export function role(name: string): RoleBuilder {
     name,
     editRelation: `${base}Edit`,
     viewRelation: `${base}View`,
-    grantableBy: "admin",
+    grantableBy: WORKSPACE_ADMIN_RELATION,
     editAggregates: [],
     viewAggregates: [],
     canEdit: false,
@@ -256,8 +258,10 @@ const ROLE_RELATIONS_KEY = "__nomosRoleRelations";
  * EXPANDER (the `capability()`/birth-meter seam): given a module's exports bag, LIFT every `RoleEmission`
  * into discoverable entries — the grant/revoke/seed directives become top-level exports (so `directivesOf`
  * finds them), and ONE synthesized `relationType("workspace")` (the `<role>Edit` write relations + the
- * distinct `grantableBy` grant-authority relations, deduped) becomes a discoverable relation type (so
- * `.requires(role.edit)` / `.requires(grantableBy)` have TEETH — the fail-open footgun is closed). The
+ * distinct LOCAL `grantableBy` grant-authority relations, deduped) becomes a discoverable relation type
+ * (so `.requires(role.edit)` / `.requires(customGrantAuthority)` have TEETH — the fail-open footgun is
+ * closed). The default framework `admin` authority is already declared by the global governance schema
+ * and MUST NOT be redeclared here as tenant-local. The
  * `<role>View` read relations are NOT authored here: they are read-visibility caps, synthesized by usd.ts
  * from the aggregates that declare `requires(role.view)`. IDEMPOTENT + additive: a bag with no role is
  * returned unchanged (byte-identical), and re-running on an already-expanded bag is a no-op.
@@ -281,12 +285,14 @@ export function expandRoleExports(mod: Record<string, unknown>): Record<string,
   };
   for (const e of emissions) {
     if (e.meta.editRelation) declare(e.meta.editRelation);
-    declare(e.meta.grantableBy);
+    if (e.meta.grantableBy !== WORKSPACE_ADMIN_RELATION) declare(e.meta.grantableBy);
     for (const dir of e.directives) {
       const anyDir = dir as { id: string };
       out[`__role_${anyDir.id}`] = dir;
     }
   }
-  out[ROLE_RELATIONS_KEY] = builder as unknown as RelationTypeDecl;
+  // Keep the marker even for a view-only role using global admin so expansion stays idempotent without
+  // publishing an empty relation schema declaration.
+  out[ROLE_RELATIONS_KEY] = declared.size > 0 ? builder as unknown as RelationTypeDecl : true;
   return out;
 }