@githolon/dsl 0.107.4 → 0.108.0

package/src/birth_meter_ensure.ts

@@ -50,6 +50,7 @@ import { GENESIS_WARRANT_ID, GenesisWarrant, seedGenesis } from "./framework/gen
 import {
   BIRTH_ATTESTATION_ID,
   BirthAttestation,
+  BirthAttestationLink,
   birthAttestation,
   seedBirthAttestation,
 } from "./framework/home.js";
@@ -253,6 +254,7 @@ export function withBirthMeterExports<M extends Record<string, unknown>>(mod: M)
   internalize("__nomos_GenesisWarrant", GenesisWarrant);
   internalize("__nomos_seedGenesis", seedGenesis);
   internalize("__nomos_BirthAttestation", BirthAttestation);
+  internalize("__nomos_BirthAttestationLink", BirthAttestationLink);
   internalize("__nomos_seedBirthAttestation", seedBirthAttestation);
   internalize("__nomos_birthAttestation", birthAttestation);
   internalize("__nomos_AuthProvider", AuthProvider);

package/src/business_birth.ts

@@ -36,6 +36,7 @@ import { GENESIS_WARRANT_ID, GenesisWarrant, seedGenesis } from "./framework/gen
 import {
   BIRTH_ATTESTATION_ID,
   BirthAttestation,
+  BirthAttestationLink,
   birthAttestation,
   seedBirthAttestation,
 } from "./framework/home.js";
@@ -359,6 +360,7 @@ function lowerOne<P extends Record<string, unknown>, F extends Record<string, Fi
     __nomos_GenesisWarrant: internalSurface(GenesisWarrant),
     __nomos_seedGenesis: internalDirective(seedGenesis),
     __nomos_BirthAttestation: internalSurface(BirthAttestation),
+    __nomos_BirthAttestationLink: internalSurface(BirthAttestationLink),
     __nomos_seedBirthAttestation: internalDirective(seedBirthAttestation),
     __nomos_birthAttestation: internalSurface(birthAttestation),
     __nomos_RelationTuple: internalSurface(RelationTuple),

package/src/compile_package_main.ts

@@ -865,7 +865,10 @@ const DART_SUPPORT_RUNTIME_SRC = [
 const DART_SUPPORT_SRC = [...DART_SUPPORT_CORE_SRC, ...DART_SUPPORT_RUNTIME_SRC] as const;
 /** The local shim replacing `package:nomos_types/nomos_types.dart` inside vendored runtime files. */
 const VENDORED_TYPES_SHIM = "nomos_types.dart";
+const VENDORED_KERNEL_PROTOCOL_SHIM = "nomos_kernel_protocol.dart";
 const VENDORED_META_DEP = "^1.12.0";
+const VENDORED_PROTOBUF_DEP = "^5.0.0";
+const VENDORED_FIXNUM_DEP = "^1.1.1";
 const VENDORED_DART_SDK_FLOOR = "3.3.0";
 
 /**
@@ -909,21 +912,12 @@ function ensureVendoredPackageRequirements(dartOut: string): void {
       `${sdkLine[1]}\">=${VENDORED_DART_SDK_FLOOR} <4.0.0\"${sdkLine[3] ?? ""}`,
     );
   }
-  if (/^  meta:\s*/m.test(next)) {
-    if (next !== source) writeFileSync(pubspec, next, "utf8");
-    return;
-  }
-  if (!/^dependencies:\s*$/m.test(next)) {
-    fail("generated Dart vendored support needs a dependencies: block in " + pubspec);
-  }
-  writeFileSync(
-    pubspec,
-    next.replace(
-      /^dependencies:\s*$/m,
-      "dependencies:\n  meta: " + VENDORED_META_DEP,
-    ),
-    "utf8",
-  );
+  if (next !== source) writeFileSync(pubspec, next, "utf8");
+  reconcilePubspec(dir, "", {
+    meta: VENDORED_META_DEP,
+    protobuf: VENDORED_PROTOBUF_DEP,
+    fixnum: VENDORED_FIXNUM_DEP,
+  });
 }
 
 /** The generated-owned subdirectory, relative to `dartOut` (the pub package's `lib/`). WIPED and
@@ -1357,9 +1351,33 @@ function emitDart(
         .replace(
           /import 'package:nomos_types\/src\/(?:nomos_ref|foreign_ref|versioned_nomos_ref)\.dart'/g,
           `import '${VENDORED_TYPES_SHIM}'`,
+        )
+        .replace(
+          /import 'package:nomos_types\/nomos_kernel_protocol\.dart'/g,
+          `import '${VENDORED_KERNEL_PROTOCOL_SHIM}'`,
         );
       writeFileSync(path.join(genDir, "src", f), src, "utf8");
     }
+    // Protobuf is the sole kernel/host message schema. Flat vendored packages receive a generated
+    // projection of that schema, never a handwritten certificate mirror. The compiler copies only the
+    // generated kernel files this runtime uses; `generate:kernel-proto-dart` remains their source.
+    const generatedKernelProto = path.join(DSL_DIR, "dart_types", "lib", "src", "proto", "nomos", "kernel", "v1");
+    const vendoredKernelProto = path.join(genDir, "src", "proto", "nomos", "kernel", "v1");
+    mkdirSync(vendoredKernelProto, { recursive: true });
+    for (const f of ["kernel.pb.dart", "kernel.pbenum.dart"]) {
+      copyFileSync(path.join(generatedKernelProto, f), path.join(vendoredKernelProto, f));
+    }
+    writeFileSync(
+      path.join(genDir, "src", VENDORED_KERNEL_PROTOCOL_SHIM),
+      [
+        "// GENERATED from proto/nomos/kernel/v1/kernel.proto by nomos-compile. DO NOT EDIT.",
+        "library;",
+        "",
+        "export 'proto/nomos/kernel/v1/kernel.pb.dart';",
+        "",
+      ].join("\n"),
+      "utf8",
+    );
     // The local shim the rewritten runtime imports resolve through (the vendored twin of the
     // nomos_types barrel — core files only).
     writeFileSync(
@@ -1660,12 +1678,12 @@ const dartTypesImportFor = (generatedSource: string): string => {
  *  just the floor generated code needs — a lagging pin forces tenants into dependency_overrides. */
 // 0.3.0: SurfacedValue<T>/SurfacedObservation/PendingConflictRow — generated Surfaced-field typing +
 //        the pendingConflicts read rows.
-const NOMOS_TYPES_DEP = "^0.8.8";
+const NOMOS_TYPES_DEP = "^0.9.0";
 // 0.48.x: session-bound clients (XClient.bind/NomosClientInterface/DomainClientSessionMismatch/
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
-const NOMOS_CLIENT_DEP = "^0.64.46";
-const NOMOS_FLUTTER_DEP = "^0.63.76";
+const NOMOS_CLIENT_DEP = "^0.65.0";
+const NOMOS_FLUTTER_DEP = "^0.64.0";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in dsl/dart/pubspec.yaml
 // and dsl/dart_types/pubspec.yaml — a Dart release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).

package/src/framework/application_home.ts

@@ -23,6 +23,7 @@ import {
 import { GenesisWarrant, seedGenesis } from "./genesis.js";
 import {
   BirthAttestation,
+  BirthAttestationLink,
   ReceivingGroup,
   ReceivingGroupPolicy,
   SharedWithMe,
@@ -110,6 +111,7 @@ export const __nomos_sharedByObject = query(sharedByObject);
 export const __nomos_GenesisWarrant = aggregate(GenesisWarrant);
 export const __nomos_seedGenesis = directive(seedGenesis);
 export const __nomos_BirthAttestation = aggregate(BirthAttestation);
+export const __nomos_BirthAttestationLink = aggregate(BirthAttestationLink);
 export const __nomos_seedBirthAttestation = directive(seedBirthAttestation);
 export const __nomos_birthAttestation = query(birthAttestation);
 export const __nomos_parentAttestedBirth = internal(parentAttestedBirth);

package/src/framework/auth_provider_law.ts

@@ -69,8 +69,29 @@ export const AuthProvider = aggregate("AuthProvider", {
   setBy: t.string().merge(Lww),
   /** Epoch-ms it was set (caller-stamped). */
   setAt: t.int().merge(Lww),
+  /** The platform-signed provider epoch inserted above new keyless delegations. These are the nominal
+   *  BirthCertificate fields, stored separately as typed USDA properties; the provider issuer, keys and
+   *  audience come from this same AuthProvider row and are therefore covered by the signature without a
+   *  second serialized certificate document. Historical children retain the epoch they were born with. */
+  attestationChild: t.string().merge(Lww).optional(),
+  attestationFounder: t.string().merge(Lww).optional(),
+  attestationVerified: t.bool().merge(Lww).optional(),
+  attestationParentKey: t.string().merge(Lww).optional(),
+  attestationParentId: t.string().merge(Lww).optional(),
+  attestationEpoch: t.int().merge(Lww).optional(),
+  attestationSignature: t.string().merge(Lww).optional(),
 }).public();
 
+const authProviderAttestation = z.object({
+  child: z.string().min(1),
+  founder: z.string().min(1),
+  verified: z.boolean(),
+  parentKey: z.string().min(1),
+  parentId: z.string().min(1),
+  epoch: z.number().int().nonnegative(),
+  signature: z.string().min(1),
+});
+
 /**
  * setAuthProvider — declare (or amend) the platform's identity provider. An
  * Ensure on the singleton; every change is an attributed, replayable intent.
@@ -95,6 +116,10 @@ const authProviderPayload = z.object({
       label: z.string().min(1),
       setBy: z.string().min(1),
       setAt: epochMs,
+      /** A typed, already-signed BirthCertificate body for this provider version. The signer is the
+       *  platform key attested by its existing lineage; the kernel verifies it while walking every new
+       *  descendant chain. Optional keeps pre-epoch histories replayable. */
+      attestation: authProviderAttestation.optional(),
     });
 
 type AuthProviderPayload = z.infer<typeof authProviderPayload>;
@@ -113,6 +138,15 @@ function writeAuthProvider(p: AuthProviderPayload) {
     set(ap, "label", p.label),
     set(ap, "setBy", p.setBy),
     set(ap, "setAt", p.setAt),
+    ...(p.attestation ? [
+      set(ap, "attestationChild", p.attestation.child),
+      set(ap, "attestationFounder", p.attestation.founder),
+      set(ap, "attestationVerified", p.attestation.verified),
+      set(ap, "attestationParentKey", p.attestation.parentKey),
+      set(ap, "attestationParentId", p.attestation.parentId),
+      set(ap, "attestationEpoch", p.attestation.epoch),
+      set(ap, "attestationSignature", p.attestation.signature),
+    ] : []),
   ];
 }
 

package/src/framework/birth_certificate_law.ts

@@ -0,0 +1,24 @@
+// NOMOS — the one typed law payload for a birth-certificate link.
+//
+// A BirthCertificate is nominal in Rust and Protobuf and becomes ordinary typed USDA fields in law state.
+// It is never lowered to a JSON string. The JWKS member is the external standardized JWKS document itself;
+// the certificate envelope and chain structure remain typed Nomos data.
+import { z } from "zod";
+
+export const birthCertificatePayload = z.object({
+  child: z.string().min(1),
+  founder: z.string().min(1),
+  verified: z.boolean(),
+  parentKey: z.string().min(1),
+  parentId: z.string(),
+  epoch: z.number().int().nonnegative(),
+  signature: z.string().min(1),
+  verifiedVia: z.string().min(1).optional(),
+  idpToken: z.string().min(1).optional(),
+  capturedClock: z.number().int().nonnegative().optional(),
+  authProviderIssuer: z.string().min(1).optional(),
+  authProviderJwks: z.string().min(1).optional(),
+  authProviderAudience: z.string().min(1).optional(),
+});
+
+export type BirthCertificatePayload = z.infer<typeof birthCertificatePayload>;

package/src/framework/home.ts

@@ -31,7 +31,7 @@ import { sha256Digest, t } from "../fields.js";
 import { Lww } from "../drivers.js";
 import { directive } from "../directive.js";
 import { ensure } from "../authoring.js";
-import { set, type PlannedOp } from "../ops.js";
+import { set, withMarker, type PlannedOp } from "../ops.js";
 import { query } from "../query.js";
 import { birth } from "../births.js";
 import { readFrameworkDeclared } from "../read.js";
@@ -47,6 +47,7 @@ import {
   DomainInstallExecutor,
   domainInstallGenesisOffer,
 } from "./domain_lifecycle.js";
+import { birthCertificatePayload } from "./birth_certificate_law.js";
 
 // `nomos.sha256` — the TRUSTLESS, pure hash computed IN the githolon (Rust sha2 bound in the sealed engine;
 // see deterministic-rquickjs). Available as a global to plans + invariant predicates (like `nomos.mint`); it
@@ -581,6 +582,7 @@ export const sharedByObject = query("sharedByObject").key("object").returns(Shar
  * verify doors); this aggregate is the human-readable mirror.
  */
 export const BIRTH_ATTESTATION_ID = "birth-attestation:self";
+export const BIRTH_ATTESTATION_LINK_PREFIX = "birth-attestation-link:";
 export const BirthAttestation = aggregate("BirthAttestation", {
   /** This home's self-id (`home-<sha256(founder)>`) — the cert's `child`. */
   child: t.string().merge(Lww),
@@ -594,12 +596,29 @@ export const BirthAttestation = aggregate("BirthAttestation", {
   parentKey: t.string().merge(Lww),
   /** The parent's SignerEpoch at the attestation (informational; the cert is judged at birth-time validity). */
   epoch: t.int().merge(Lww),
-  /** THE TRAVELLING SIGNED CERT CHAIN (JSON: `executor::birth_cert::BirthCertChain`) — the home's own
-   *  P-signed cert FIRST, then each ancestor's birth-cert up to root. The kernel verify doors parse THIS,
-   *  verify the signature chain to the pinned `K_root` OFFLINE (no cross-ws read), and assert it binds this
-   *  home (`child`==self-id, `founder`==HomeOwner.principal, `verified`). It travels because it folds into
-   *  the home's own genesis (seeded by the parent's offer-effect), so a peer holding only the home has it. */
-  certChain: t.string().merge(Lww),
+  /** Legacy replay slot for histories authored before `BirthAttestationLink`. New histories write the
+   *  travelling chain only as ordered, typed link records below. */
+  certChain: t.string().merge(Lww).optional(),
+}).public();
+
+/** One exact link in the travelling certificate chain. The zero-padded index is custody order; every
+ * certificate member is a separate typed USDA property. `certChain` above remains only as a replay fallback
+ * for histories authored before this aggregate existed. */
+export const BirthAttestationLink = aggregate("BirthAttestationLink", {
+  index: t.int().merge(Lww),
+  child: t.string().merge(Lww),
+  founder: t.string().merge(Lww),
+  verified: t.bool().merge(Lww),
+  parentKey: t.string().merge(Lww),
+  parentId: t.string().merge(Lww),
+  epoch: t.int().merge(Lww),
+  signature: t.string().merge(Lww),
+  verifiedVia: t.string().merge(Lww).optional(),
+  idpToken: t.string().merge(Lww).optional(),
+  capturedClock: t.int().merge(Lww).optional(),
+  authProviderIssuer: t.string().merge(Lww).optional(),
+  authProviderJwks: t.string().merge(Lww).optional(),
+  authProviderAudience: t.string().merge(Lww).optional(),
 }).public();
 
 /** Audit read: this home's birth attestation (who attested it + the verified verdict). */
@@ -611,7 +630,7 @@ export const birthAttestation = query("birthAttestation").key("child").returns(B
  * the [`BirthAttestation`] singleton so the home's own state carries its travelling cert. A CONTROL-PLANE
  * write seeded once at birth (the open session lane structurally refuses it by directive id). The values
  * are the parent's GATE VERDICT (`founder`/`verified` lowered from the captured port — CAS-as-law, never
- * the offer payload) + the signed chain bytes; the home's verify doors re-derive trust from the chain.
+ * the offer payload) + the typed signed links; the home's verify doors re-derive trust from the chain.
  */
 export const seedBirthAttestation = directive("seedBirthAttestation")
   .ensures(BirthAttestation)
@@ -625,21 +644,41 @@ export const seedBirthAttestation = directive("seedBirthAttestation")
       parentId: z.string(),
       parentKey: z.string().min(1), // base64 K_P
       epoch: z.number().int().nonnegative(),
-      certChain: z.string().min(1), // JSON BirthCertChain
+      links: z.array(birthCertificatePayload).min(1),
     }),
   )
   .plan((p) => {
     const h = instance(BirthAttestation, BIRTH_ATTESTATION_ID);
-    return [
+    const header = [
       set(h, "child", p.child),
       set(h, "founder", p.founder),
       set(h, "verified", p.verified),
       set(h, "parentId", p.parentId),
       set(h, "parentKey", p.parentKey),
       set(h, "epoch", p.epoch),
-      set(h, "certChain", p.certChain),
     ];
-  });
+    const links = p.links.flatMap((certificate, index) => {
+      const link = instance(BirthAttestationLink, `${BIRTH_ATTESTATION_LINK_PREFIX}${String(index).padStart(8, "0")}`);
+      return [
+        withMarker(set(link, "index", index), "ensures"),
+        withMarker(set(link, "child", certificate.child), "ensures"),
+        withMarker(set(link, "founder", certificate.founder), "ensures"),
+        withMarker(set(link, "verified", certificate.verified), "ensures"),
+        withMarker(set(link, "parentKey", certificate.parentKey), "ensures"),
+        withMarker(set(link, "parentId", certificate.parentId), "ensures"),
+        withMarker(set(link, "epoch", certificate.epoch), "ensures"),
+        withMarker(set(link, "signature", certificate.signature), "ensures"),
+        ...(certificate.verifiedVia ? [withMarker(set(link, "verifiedVia", certificate.verifiedVia), "ensures")] : []),
+        ...(certificate.idpToken ? [withMarker(set(link, "idpToken", certificate.idpToken), "ensures")] : []),
+        ...(certificate.capturedClock === undefined ? [] : [withMarker(set(link, "capturedClock", certificate.capturedClock), "ensures")]),
+        ...(certificate.authProviderIssuer ? [withMarker(set(link, "authProviderIssuer", certificate.authProviderIssuer), "ensures")] : []),
+        ...(certificate.authProviderJwks ? [withMarker(set(link, "authProviderJwks", certificate.authProviderJwks), "ensures")] : []),
+        ...(certificate.authProviderAudience ? [withMarker(set(link, "authProviderAudience", certificate.authProviderAudience), "ensures")] : []),
+      ];
+    });
+    return [...header, ...links];
+  })
+  .alsoEnsures(BirthAttestationLink);
 
 /**
  * THE ERA DECLARATION (the `nomosParentAttestedBirth` USD key). Exporting this sentinel from the home law
@@ -652,8 +691,8 @@ export const seedBirthAttestation = directive("seedBirthAttestation")
 export const parentAttestedBirth: ParentAttestedBirthMarker = {
   ...requireParentAttestedBirth,
   // DECLARE the owner + cert locators so the KERNEL reads them (it names neither): the home owner lives at
-  // the `HomeOwner` singleton's `principal`, the travelling cert at the `BirthAttestation` singleton's
-  // `certChain`. Mirrors how `.attestationAuthorized()` declares its owner-source — the kernel hardcodes none.
+  // the `HomeOwner` singleton's `principal`. `certObject`/`certField` retain the legacy chain locator for
+  // old histories; current histories are discovered through the typed `BirthAttestationLink` aggregate.
   ownerObject: RECEIVING_GROUP_ID,
   ownerField: "principal",
   certObject: BIRTH_ATTESTATION_ID,

package/src/framework/owned_custody.ts

@@ -19,7 +19,7 @@ import {
   writeWrap,
 } from "./encryption_scope.js";
 import { GenesisWarrant, seedGenesis } from "./genesis.js";
-import { BirthAttestation, seedBirthAttestation } from "./home.js";
+import { BirthAttestation, BirthAttestationLink, seedBirthAttestation } from "./home.js";
 import { RelationTuple, __qualifyAggregateType, removeTuple, writeTuple } from "./relations.js";
 import { SIGNER_RELATION, enrollSigner, signerObject, identityRelations } from "./signing_identity.js";
 import { impureCapability, impureCapabilityAggregate } from "./impure_capability.js";
@@ -430,6 +430,7 @@ const CUSTODY_RELATIONS_EXPORT = "__nomos_owned_custody_relations_7c1f5e";
 const WARRANT_EXPORT = "__nomos_owned_genesis_warrant_7c1f5e";
 const SEED_EXPORT = "__nomos_owned_seed_genesis_7c1f5e";
 const BIRTH_ATTESTATION_EXPORT = "__nomos_owned_birth_attestation_7c1f5e";
+const BIRTH_ATTESTATION_LINK_EXPORT = "__nomos_owned_birth_attestation_link_7c1f5e";
 const BIRTH_ATTESTATION_SEED_EXPORT = "__nomos_owned_seed_birth_attestation_7c1f5e";
 const ENROLL_EXPORT = "__nomos_owned_enroll_signer_7c1f5e";
 const INITIALIZE_EXPORT = "__nomos_owned_initialize_identity_7c1f5e";
@@ -452,6 +453,7 @@ const RECOVERY_CAPABILITY_EXPORT = "__nomos_owned_recovery_capability_7c1f5e";
 const ownedGenesisWarrant = hidden(GenesisWarrant);
 const ownedSeedGenesis = hidden(seedGenesis);
 const ownedBirthAttestation = hidden(BirthAttestation);
+const ownedBirthAttestationLink = hidden(BirthAttestationLink);
 const ownedSeedBirthAttestation = hidden(seedBirthAttestation);
 const ownedEnrollSigner = hidden(enrollSigner);
 const ownedIdentityRelations = hidden(identityRelations);
@@ -543,6 +545,7 @@ export function withOwnedCustodyExports<M extends Record<string, unknown>>(mod:
     [WARRANT_EXPORT, ownedGenesisWarrant],
     [SEED_EXPORT, ownedSeedGenesis],
     [BIRTH_ATTESTATION_EXPORT, ownedBirthAttestation],
+    [BIRTH_ATTESTATION_LINK_EXPORT, ownedBirthAttestationLink],
     [BIRTH_ATTESTATION_SEED_EXPORT, ownedSeedBirthAttestation],
     [ENROLL_EXPORT, ownedEnrollSigner],
   ] as const) {
@@ -574,6 +577,7 @@ export function withOwnedCustodyExports<M extends Record<string, unknown>>(mod:
       [GenesisWarrant, ownedGenesisWarrant],
       [seedGenesis, ownedSeedGenesis],
       [BirthAttestation, ownedBirthAttestation],
+      [BirthAttestationLink, ownedBirthAttestationLink],
       [seedBirthAttestation, ownedSeedBirthAttestation],
       [enrollSigner, ownedEnrollSigner],
     ] as const) {
@@ -639,6 +643,7 @@ export function withOwnedCustodyExports<M extends Record<string, unknown>>(mod:
     [WARRANT_EXPORT]: ownedGenesisWarrant,
     [SEED_EXPORT]: ownedSeedGenesis,
     [BIRTH_ATTESTATION_EXPORT]: ownedBirthAttestation,
+    [BIRTH_ATTESTATION_LINK_EXPORT]: ownedBirthAttestationLink,
     [BIRTH_ATTESTATION_SEED_EXPORT]: ownedSeedBirthAttestation,
     [ENROLL_EXPORT]: ownedEnrollSigner,
   };

package/src/framework/signing_identity.ts

@@ -42,11 +42,12 @@
  *    only revokes keys of its OWN identity).
  */
 import { z } from "zod";
-import { aggregate, instance } from "../aggregate.js";
+import { birthCertificatePayload, type BirthCertificatePayload } from "./birth_certificate_law.js";
+import { aggregate, instance, type BoundAggregate } from "../aggregate.js";
 import { t } from "../fields.js";
 import { Lww } from "../drivers.js";
 import { directive } from "../directive.js";
-import { set, withMarker, type PlannedOp } from "../ops.js";
+import { set, withMarker, type FieldOp, type PlannedOp } from "../ops.js";
 import { query } from "../query.js";
 import { relationType, self, key } from "../relation_schema.js";
 import { readRef, readSet, workspaceInvariant, ref } from "./workspace_invariant.js";
@@ -305,8 +306,8 @@ export const enrollSignerSelfRequiresVerified = workspaceInvariant("EnrollSigner
  * DELEGATION CERT binding U's device key `P_U` to the tenant's lineage: a `BirthCert {founder: U,
  * parent_key: P_U, …}` signed by `S_P`. This singleton (keyed by U) records it in the PLATFORM's folded
  * state, so the kernel's birth offer-effect reads U's delegation by-user (trusted, not from the payload) when
- * it assembles U's home cert chain. The cert is OPAQUE on-chain (a JSON `BirthCert`); the kernel parses +
- * verifies it as one chain link (signed by S_P, whose pubkey is attested by the platform's own chain).
+ * it assembles U's home cert chain. Every certificate member is stored as typed USDA fields; the kernel
+ * reconstructs and verifies the nominal link signed by S_P, whose key is attested by the platform chain.
  *
  * SELF-BOUND / control-plane: enrolled by the tenant onboarding lane (composed into the tenant's governance
  * law, off the open session lane), so a tenant cannot forge a delegation for a user another tenant verified.
@@ -322,9 +323,21 @@ export const SignerDelegation = aggregate("SignerDelegation", {
   user: t.string().merge(Lww),
   /** The user's device PUBLIC KEY (base64) the delegation binds — `P_U`, the home_cert's signer. */
   deviceKey: t.string().merge(Lww),
-  /** THE DELEGATION CERT (JSON `executor::birth_cert::BirthCert`), signed by the tenant's `S_P`. Opaque
-   *  on-chain; the kernel parses + verifies it as the `links[1]` delegation in U's travelling chain. */
-  certJson: t.string().merge(Lww),
+  /** Legacy replay slot for histories authored before the typed certificate fields below. */
+  certJson: t.string().merge(Lww).optional(),
+  certificateChild: t.string().merge(Lww).optional(),
+  certificateFounder: t.string().merge(Lww).optional(),
+  certificateVerified: t.bool().merge(Lww).optional(),
+  certificateParentKey: t.string().merge(Lww).optional(),
+  certificateParentId: t.string().merge(Lww).optional(),
+  certificateEpoch: t.int().merge(Lww).optional(),
+  certificateSignature: t.string().merge(Lww).optional(),
+  certificateVerifiedVia: t.string().merge(Lww).optional(),
+  certificateIdpToken: t.string().merge(Lww).optional(),
+  certificateCapturedClock: t.int().merge(Lww).optional(),
+  certificateAuthProviderIssuer: t.string().merge(Lww).optional(),
+  certificateAuthProviderJwks: t.string().merge(Lww).optional(),
+  certificateAuthProviderAudience: t.string().merge(Lww).optional(),
   /** ISO-8601, caller-stamped (determinism — no clock in the plan). */
   enrolledAt: t.string().merge(Lww),
 }).public();
@@ -335,6 +348,29 @@ export function signerDelegationInstanceId(user: string): string {
   return SIGNER_DELEGATION_PREFIX + user;
 }
 
+function writeDelegationCertificate(
+  delegation: BoundAggregate<typeof SignerDelegation.id, typeof SignerDelegation.fields>,
+  certificate: BirthCertificatePayload,
+  marker?: "ensures",
+): PlannedOp[] {
+  const marked = (operation: FieldOp) => marker ? withMarker(operation, marker) : operation;
+  return [
+    marked(set(delegation, "certificateChild", certificate.child)),
+    marked(set(delegation, "certificateFounder", certificate.founder)),
+    marked(set(delegation, "certificateVerified", certificate.verified)),
+    marked(set(delegation, "certificateParentKey", certificate.parentKey)),
+    marked(set(delegation, "certificateParentId", certificate.parentId)),
+    marked(set(delegation, "certificateEpoch", certificate.epoch)),
+    marked(set(delegation, "certificateSignature", certificate.signature)),
+    ...(certificate.verifiedVia ? [marked(set(delegation, "certificateVerifiedVia", certificate.verifiedVia))] : []),
+    ...(certificate.idpToken ? [marked(set(delegation, "certificateIdpToken", certificate.idpToken))] : []),
+    ...(certificate.capturedClock === undefined ? [] : [marked(set(delegation, "certificateCapturedClock", certificate.capturedClock))]),
+    ...(certificate.authProviderIssuer ? [marked(set(delegation, "certificateAuthProviderIssuer", certificate.authProviderIssuer))] : []),
+    ...(certificate.authProviderJwks ? [marked(set(delegation, "certificateAuthProviderJwks", certificate.authProviderJwks))] : []),
+    ...(certificate.authProviderAudience ? [marked(set(delegation, "certificateAuthProviderAudience", certificate.authProviderAudience))] : []),
+  ];
+}
+
 /**
  * `enrollFirstDevice` (architecture/keyless_verified_onboard.md) — THE KEYLESS VERIFIED FIRST-DEVICE
  * self-onboard. A brand-new principal (an IdP-verified user with NO enrolled signer key) bootstraps its
@@ -369,8 +405,11 @@ export const enrollFirstDevice = directive("enrollFirstDevice")
       /** THE CAPTURED PREMISE: the IdP's signed identity assertion (JWT), re-verified on every lane against
        *  the on-chain AuthProvider keys. */
       idpToken: z.string().min(1),
-      /** THE KEYLESS DELEGATION CERT (JSON `executor::birth_cert::BirthCert`) — the self-serve sibling of
-       *  `enrollDelegation.certJson`. Built CLIENT-SIDE via the `cert_sign` op: DEVICE-self-signed by this
+      /** Legacy replay input for callers predating `delegationCertificate`. New callers must provide the
+       *  typed certificate below. */
+      delegationCert: z.string().min(1).optional(),
+      /** THE KEYLESS DELEGATION CERT — the self-serve sibling of `enrollDelegation.certificate`. Built
+       *  CLIENT-SIDE via the typed kernel sign operation: DEVICE-self-signed by this
        *  same device key `P_U` (parent_key == P_U), founder == `user:<uid>`, carrying `verifiedVia` +
        *  `idpToken` + `capturedClock`. There is NO tenant `S_P` in the loop — the kernel's home-birth chain
        *  walk (`verify_to_root`, keyless branch) RE-VERIFIES the token against the platform-attested
@@ -380,7 +419,7 @@ export const enrollFirstDevice = directive("enrollFirstDevice")
        *  OPTIONAL — an enroll-only flow (seat the signer, no imminent home birth) omits it and seeds no
        *  delegation (backward-compatible with every pre-B `enrollFirstDevice` caller). The keyless home-birth
        *  ceremony ALWAYS supplies it (that is what seeds the delegation the chain needs). */
-      delegationCert: z.string().min(1).optional(),
+      delegationCertificate: birthCertificatePayload.optional(),
     }),
   )
   .plan((p, ctx) => {
@@ -404,14 +443,24 @@ export const enrollFirstDevice = directive("enrollFirstDevice")
     // The delegation is keyed by the AUTHENTICATED principal — EXACTLY the `founder` the kernel's birth
     // offer-effect reads it back by (`read_signer_delegation(state, &founder)`, founder == captured principal
     // == this `rawPrincipal`, already in `user:<uid>` form). Do NOT re-prefix.
-    // Absent delegationCert ⇒ enroll-only (no delegation seeded), byte-identical to a pre-B enroll.
-    if (!p.delegationCert) return tupleOps;
+    // Absent certificate ⇒ enroll-only (no delegation seeded), byte-identical to a pre-B enroll.
+    if (!p.delegationCert && !p.delegationCertificate) return tupleOps;
     const d = instance(SignerDelegation, signerDelegationInstanceId(rawPrincipal));
     const delegationOps: PlannedOp[] = [
       withMarker(set(d, "user", rawPrincipal), "ensures"),
       withMarker(set(d, "deviceKey", "key:" + p.keyHash), "ensures"),
-      withMarker(set(d, "certJson", p.delegationCert), "ensures"),
-      withMarker(set(d, "enrolledAt", p.grantedAt), "ensures"),
+      ...(p.delegationCertificate
+        ? [
+            withMarker(set(d, "enrolledAt", p.grantedAt), "ensures"),
+            ...writeDelegationCertificate(d, p.delegationCertificate, "ensures"),
+          ]
+        : [
+            // Exact legacy event order is replay identity, even though Lww folding would commute these
+            // two writes. Historical enrollFirstDevice intents wrote certJson before enrolledAt; retain
+            // that byte-level outcome when re-authoring an old payload under a candidate law.
+            withMarker(set(d, "certJson", p.delegationCert!), "ensures"),
+            withMarker(set(d, "enrolledAt", p.grantedAt), "ensures"),
+          ]),
     ];
     return [...tupleOps, ...delegationOps];
   })
@@ -466,7 +515,7 @@ export const revokeSigner = directive("revokeSigner")
  * offer-effect can read U's delegation when it assembles U's home chain. `.ensures` (a deterministic-keyed
  * singleton — upsert-by-user). A CONTROL-PLANE write composed into the tenant's onboarding governance law
  * (off the open session lane) — only the tenant (whose `S_P` the platform chain attests) may enroll a
- * delegation. The `certJson` is verified by the kernel at home birth (signed by S_P, founder == U); a forged
+ * delegation. The typed certificate is verified by the kernel at home birth (signed by S_P, founder == U); a forged
  * delegation simply fails the chain walk / founder-binding at the child's gate.
  */
 export const enrollDelegation = directive("enrollDelegation")
@@ -475,7 +524,7 @@ export const enrollDelegation = directive("enrollDelegation")
     z.object({
       user: z.string().min(1), // the user:<uid> the delegation enrolls
       deviceKey: z.string().min(1), // base64 P_U — the user's device public key
-      certJson: z.string().min(1), // JSON BirthCert, signed by the tenant's S_P
+      certificate: birthCertificatePayload,
       enrolledAt: z.string().min(1), // ISO-8601, caller-stamped
     }),
   )
@@ -484,8 +533,8 @@ export const enrollDelegation = directive("enrollDelegation")
     return [
       set(d, "user", p.user),
       set(d, "deviceKey", p.deviceKey),
-      set(d, "certJson", p.certJson),
       set(d, "enrolledAt", p.enrolledAt),
+      ...writeDelegationCertificate(d, p.certificate),
     ];
   });
 

package/src/framework/workspaces.ts

@@ -106,7 +106,14 @@ export { enrollFirstDevice, revokeSigner } from "./signing_identity.js";
 // `[platform_cert]` chain would fail `verify_to_root` (>=2 links), so its own verify doors must stay inert
 // while it still carries the cert for its children. Fully additive (new aggregate + directive, no era key ⇒
 // pre-existing chains replay byte-identical). See architecture/verified_auth_from_genesis.md.
-export { BIRTH_ATTESTATION_ID, BirthAttestation, birthAttestation, seedBirthAttestation } from "./home.js";
+export {
+  BIRTH_ATTESTATION_ID,
+  BIRTH_ATTESTATION_LINK_PREFIX,
+  BirthAttestation,
+  BirthAttestationLink,
+  birthAttestation,
+  seedBirthAttestation,
+} from "./home.js";
 // THE ENROLL-ONCE DELEGATION LANE — a platform records each tenant's device-key delegation (signed by its
 // onboarding signer S_P) so the kernel reads it at `signer-delegation:<user>` when assembling a home's chain.
 export { SignerDelegation, enrollDelegation, signerDelegationByUser } from "./signing_identity.js";

package/src/index.ts

@@ -566,7 +566,9 @@ export {
   birthReceivingGroup,
   // THE PEER-SOVEREIGN ROOT-OF-TRUST (the BirthAttestation cert chain).
   BirthAttestation,
+  BirthAttestationLink,
   BIRTH_ATTESTATION_ID,
+  BIRTH_ATTESTATION_LINK_PREFIX,
   seedBirthAttestation,
   birthAttestation,
   parentAttestedBirth,

package/src/shape_compat.ts

@@ -213,16 +213,19 @@ export function domainInterface(mod: DomainModule, stableIds?: StableIds): Domai
   for (const agg of (mod.aggregates ?? []) as Array<{
     id: string;
     fields: Record<string, Field>;
-    internalFields?: readonly string[];
   }>) {
     if (isInternal(agg)) continue;
     const label = agg.id;
     const sa = stableIds?.aggregates?.[label];
     const aggSid = sa?.sid ?? label;
     const fieldEntries: Array<[string, { kind: string; label: string }]> = [];
-    const internal = new Set(agg.internalFields ?? []);
     for (const [fname, f] of Object.entries(agg.fields ?? {})) {
-      if (!f || f.kind === "hasMany" || internal.has(fname)) continue;
+      // This is the workspace's complete structural offer and the input to law-evolution
+      // checking, so framework-managed stored fields belong here too. Only the generated
+      // client's view hides them, in publicClientInterface below. Filtering them at both
+      // seams makes an unchanged private field look deleted when the current offer is
+      // compared with the committed identity ledger.
+      if (!f || f.kind === "hasMany") continue;
       const fsid = sa?.fields?.[fname]?.sid ?? fname;
       const kind = sa?.fields?.[fname]?.kind ?? aggFieldReadKind(f);
       fieldEntries.push([fsid, { kind, label: fname }]);