@githolon/dsl 0.108.0 → 0.108.1

package/src/directive.ts

@@ -195,9 +195,11 @@ export interface BusinessRecordInput {
 
 /**
  * Application-only composition for a business action whose law performs a
- * dynamic attested read. The generated stateful client first obtains the
- * source's signed answer, privately seats its identity through an internal
- * directive, then submits the business action carrying that attestation.
+ * dynamic custody-proved read. The generated stateful client privately seats
+ * the source's immutable genesis through an internal directive, then submits
+ * the business action; the shared kernel reopens and proves the sibling source
+ * position while evaluating that offer. This automatic v2 lane never invents
+ * or enrolls a signed-v1 attestor key.
  */
 export interface BusinessSourceTrust {
   /** Hidden law directive that records the accepted source identity. */
@@ -210,7 +212,7 @@ export interface BusinessSourceTrust {
   readonly queryArgs: Readonly<Record<string, string>>;
   /** Hidden trust payload field -> business payload field. */
   readonly copy: Readonly<Record<string, string>>;
-  /** Hidden trust payload fields populated from the signed envelope. */
+  /** Hidden trust payload fields populated from custody identity; v2 leaves the signing-key set empty. */
   readonly genesisField: string;
   readonly keyHashesField: string;
 }
@@ -320,6 +322,14 @@ export interface Directive<P = unknown> {
      *  `object` is the fallback). `undefined` ⇒ the static object — era-ruled, byte-identical replay. */
     readonly objectFrom?: { readonly recordType: string; readonly idField: string };
   };
+  /**
+   * Admit this directive when it is the exact target call carried by a verified,
+   * law-authored outbound effect from this workspace's attested parent. The marker
+   * supplies no authority of its own: it is only valid beside a static
+   * `.requires(relation, { object: "workspace:self" })`, whose ordinary Zanzibar
+   * check remains the authorization decision.
+   */
+  readonly acceptsWorkspaceEffectGate?: true;
   /**
    * CROSS-CUSTODY ATTESTATION-AUTHORIZED (home_holons §3/§5). When `true`, this directive's authorization
    * is a carried §3 SIGNED QUOTE (the asserter's pubkey + a signature over the edge), NOT an author block —
@@ -599,6 +609,8 @@ export interface RequirableDirective<P> extends Directive<P> {
     relation: string,
     opts?: { object?: string; objectFrom?: { recordType: string; idField: string } },
   ): RequirableDirective<P>;
+  /** Declare this exact call shape as an admissible signed parent-workspace effect. */
+  acceptsWorkspaceEffect(): RequirableDirective<P>;
   /**
    * Declare this directive ATTESTATION-AUTHORIZED (home_holons §3/§5): its authorization is a carried §3
    * signed quote rather than an author block — lowered into the `nomosAttestationGate` era key so the one
@@ -1281,6 +1293,9 @@ function makeRequirable<P>(base: Directive<P>): RequirableDirective<P> {
         },
       });
     },
+    acceptsWorkspaceEffect(): RequirableDirective<P> {
+      return makeRequirable({ ...base, acceptsWorkspaceEffectGate: true });
+    },
     attestationAuthorized(owner: { ownerObject: string; ownerField: string }): RequirableDirective<P> {
       // CROSS-CUSTODY ATTESTATION-AUTHORIZED (home_holons §3/§5): this directive's authorization is a
       // carried §3 signed quote, not an author block — lowered into the `nomosAttestationGate` era key, so

package/src/engine_entry.ts

@@ -179,6 +179,12 @@ export interface EngineEntryConfig {
    * the kernel knowing the package name. The kernel MAY override it (the workspace-level title).
    */
   readonly packageTitle?: string;
+  /** Compiler-generated nominal encoders keyed by the exact target Directive singleton. Source law
+   * can name a target by type, while the runtime emits only canonical USDA. */
+  readonly workspaceEffectTargets?: readonly {
+    readonly target: Directive<unknown>;
+    readonly encode: (payload: unknown, workspace: string) => Uint8Array;
+  }[];
 }
 
 interface RegistryEntry {
@@ -620,6 +626,22 @@ export interface RegisteredEngine {
  * happens inside the dispatch call and writes no globals).
  */
 export function registerEngine(config: EngineEntryConfig): RegisteredEngine {
+  const workspaceEffectEncoders = new Map<Directive<unknown>, (payload: unknown, workspace: string) => Uint8Array>();
+  for (const binding of config.workspaceEffectTargets ?? []) {
+    if (workspaceEffectEncoders.has(binding.target)) {
+      throw new Error(`engine bundle: duplicate workspace-effect encoder for '${binding.target.id}'`);
+    }
+    workspaceEffectEncoders.set(binding.target, binding.encode);
+  }
+  const encodeWorkspaceEffect = (target: Directive<unknown>, payload: unknown, workspace: string): Uint8Array => {
+    const encode = workspaceEffectEncoders.get(target);
+    if (encode === undefined) {
+      throw new Error(
+        `engine bundle: workspace-effect target '${target.id}' has no compiler-generated nominal USDA encoder`,
+      );
+    }
+    return encode(payload, workspace);
+  };
   const domainNames = Object.keys(config.domains);
   const sourceDomainFor = (requested: string): string =>
     config.domains[requested] !== undefined ? requested : (config.routedDomainFallback ?? requested);
@@ -994,7 +1016,7 @@ export function registerEngine(config: EngineEntryConfig): RegisteredEngine {
   function plan(job: {
     intent?: { domain?: string; directiveId?: string; payload?: unknown };
     capturedPorts?: { principal?: string };
-  }): WireEvent[] | { events: WireEvent[]; strikes?: string[]; endorse?: { sink: string; facet: string; reason: string | null }[]; births?: { workspace: string; genesisChain: unknown }[] } {
+  }): WireEvent[] | { events: WireEvent[]; strikes?: string[]; endorse?: { sink: string; facet: string; reason: string | null }[]; births?: import("./births.js").BirthRecipe[] } {
     const intent = job.intent ?? {};
     const domain = intent.domain;
     const directiveId = intent.directiveId;
@@ -1024,7 +1046,13 @@ export function registerEngine(config: EngineEntryConfig): RegisteredEngine {
     });
     let wire: ReturnType<typeof executeDirectiveToIntent>;
     try {
-      wire = executeDirectiveToIntent(entry.directive, entry.agg, intent.payload as never, ctx);
+      wire = executeDirectiveToIntent(
+        entry.directive,
+        entry.agg,
+        intent.payload as never,
+        ctx,
+        encodeWorkspaceEffect,
+      );
     } finally {
       __setDispatchContext(undefined);
     }
@@ -1050,17 +1078,30 @@ export function registerEngine(config: EngineEntryConfig): RegisteredEngine {
           events: WireEvent[],
           strikes: string[],
           endorse: { sink: string; facet: string; reason: string | null }[],
-          births: { workspace: string; genesisChain: unknown }[],
+          births: import("./births.js").BirthRecipe[],
+          workspaceEffects: {
+            destination: { workspace: string } | { verifiedParent: true } | { verifiedSource: true };
+            targetCallUsda: Uint8Array;
+          }[],
         ) => void;
       };
     }).nomos?.__submitPlan;
     if (typeof submitNativePlan === "function") {
-      submitNativePlan(wire.events, wire.strikes, endorse ?? [], births ?? []);
+      submitNativePlan(
+        wire.events,
+        wire.strikes,
+        endorse ?? [],
+        births ?? [],
+        wire.workspaceEffects ?? [],
+      );
       // The Rust sink now owns the result. Return the smallest lawful sentinel; the kernel ignores
       // it when a native submission is present and reconstructs compatibility bytes from its typed
       // events. This avoids retaining and re-traversing the large event graph at the ABI boundary.
       return [];
     }
+    if (wire.workspaceEffects?.length) {
+      throw new Error("workspace effects require the typed native plan sink; an old kernel cannot carry nominal target calls");
+    }
     if (!wire.strikes.length && !(endorse && endorse.length) && !(births && births.length)) return wire.events;
     return {
       events: wire.events,

package/src/framework/application_home.ts

@@ -50,6 +50,7 @@ import {
   advanceSignerEpoch,
   enrollDelegation,
   enrollFirstDevice,
+  enrollAdmissionCheckpointSigner,
   enrollSigner,
   enrollSignerSelf,
   enrollSignerSelfRequiresVerified,
@@ -119,6 +120,7 @@ export const __nomos_RelationTuple = aggregate(RelationTuple);
 export const __nomos_relationTuplesByObject = query(relationTuplesByObject);
 export const __nomos_identityRelations = internal(identityRelations);
 export const __nomos_enrollSigner = directive(enrollSigner);
+export const __nomos_enrollAdmissionCheckpointSigner = directive(enrollAdmissionCheckpointSigner);
 export const __nomos_enrollFirstDevice = directive(enrollFirstDevice);
 export const __nomos_enrollSignerSelf = directive(enrollSignerSelf);
 export const __nomos_enrollSignerSelfRequiresVerified = internal(enrollSignerSelfRequiresVerified);

package/src/framework/auth_provider_law.ts

@@ -10,8 +10,9 @@ import { aggregate, instance } from "../aggregate.js";
 import { directive } from "../directive.js";
 import { t } from "../fields.js";
 import { Lww } from "../drivers.js";
-import { set, withMarker } from "../ops.js";
+import { addToSet, set, withMarker, type PlannedOp } from "../ops.js";
 import { query } from "../query.js";
+import { readFrameworkDeclaredRows } from "../read.js";
 import { GENESIS_WARRANT_ID } from "./genesis.js";
 import { readRef, readSet, refAs, workspaceInvariant } from "./workspace_invariant.js";
 
@@ -23,6 +24,11 @@ const epochMs = z.number().int().nonnegative();
  *  first-class machinery; `setAuthProvider`/`rotateKeys` compile to it. */
 export const AUTH_PROVIDER_ID = "auth-provider:platform";
 
+/** Stable prefix for the typed public keys owned by an AuthProvider epoch. */
+export const AUTH_PROVIDER_KEY_ID_PREFIX = "auth-provider-key:";
+/** Stable prefix for ordered x5c certificate entries belonging to one typed public key. */
+export const AUTH_PROVIDER_CERTIFICATE_ID_PREFIX = "auth-provider-certificate:";
+
 export const AuthProvider = aggregate("AuthProvider", {
   /** The singleton key — always `"platform"`. */
   scope: t.string().merge(Lww),
@@ -31,14 +37,8 @@ export const AuthProvider = aggregate("AuthProvider", {
   /** The provider's public JWKS endpoint (asymmetric verification keys). The KERNEL never fetches — it's a
    *  reference for the rotation capability that re-fetches + re-sets {@link keys}. */
   jwksUrl: t.string().merge(Lww),
-  /** THE VERIFYING KEYS — the JWKS JSON (`{keys:[{kid,kty,alg,crv,x,y,n,e,...}]}`) as an OPAQUE STRING the
-   *  KERNEL parses + verifies a presented token against (sovereign-auth arc — see
-   *  architecture/sovereign_adapter.md). `t.string` (NOT `t.json`): the kernel `Value` has no JSON variant,
-   *  so the raw JWKS text must ride verbatim as a scalar — the kernel does `serde_json` on it, no projection
-   *  parse, no double-encoding. LAW-STATE: set by {@link setAuthProvider} (gated), refreshed by the
-   *  JWKS-fetch rotation capability (the host FETCHES — impure — but the law OWNS the keys + the kernel does
-   *  the verification). Absent ⇒ no in-kernel verify for this workspace (shell-issuer fallback, transitional). */
-  keys: t.string().merge(Lww).optional(),
+  /** The active typed verifying-key epoch. Keys are ordinary USDA aggregates, never a serialized document. */
+  keyEpoch: t.int().merge(Lww).optional(),
   /** OPTIONAL expected `aud` claim. When the platform sets it, a token's `aud` MUST carry this value
    *  (defense-in-depth beyond the issuer match — e.g. a Firebase project id, an Auth0 API audience).
    *  Absent ⇒ issuer match alone. This is LAW-STATE the PLATFORM owns; the host merely enforces it as a
@@ -82,6 +82,41 @@ export const AuthProvider = aggregate("AuthProvider", {
   attestationSignature: t.string().merge(Lww).optional(),
 }).public();
 
+/** One typed RFC 7517 public key. Each JWK member is a real USDA property; no map or JSON envelope crosses
+ * the law boundary. `providerEpoch` is the indexed join key `${scope}:${epoch}`. */
+export const AuthProviderKey = aggregate("AuthProviderKey", {
+  providerEpoch: t.string().merge(Lww),
+  epoch: t.int().merge(Lww),
+  ordinal: t.int().merge(Lww),
+  kty: t.string().merge(Lww),
+  kid: t.string().merge(Lww).optional(),
+  alg: t.string().merge(Lww).optional(),
+  use: t.string().merge(Lww).optional(),
+  crv: t.string().merge(Lww).optional(),
+  x: t.string().merge(Lww).optional(),
+  y: t.string().merge(Lww).optional(),
+  n: t.string().merge(Lww).optional(),
+  e: t.string().merge(Lww).optional(),
+  keyOps: t.set(t.string()),
+}).public();
+
+/** One ordered x5c entry. Certificate order is semantically significant, so each certificate is an
+ * indexed aggregate instead of a set. The DER bytes remain the standard base64 representation. */
+export const AuthProviderCertificate = aggregate("AuthProviderCertificate", {
+  providerEpoch: t.string().merge(Lww),
+  keyOrdinal: t.int().merge(Lww),
+  certificateOrdinal: t.int().merge(Lww),
+  derBase64: t.string().merge(Lww),
+}).public();
+
+export const authProviderKeys = query("authProviderKeys")
+  .key("providerEpoch")
+  .returns(AuthProviderKey);
+
+export const authProviderCertificates = query("authProviderCertificates")
+  .key("providerEpoch")
+  .returns(AuthProviderCertificate);
+
 const authProviderAttestation = z.object({
   child: z.string().min(1),
   founder: z.string().min(1),
@@ -92,19 +127,49 @@ const authProviderAttestation = z.object({
   signature: z.string().min(1),
 });
 
+/** Typed RFC 7517 key input. The adapter at the external JWKS edge parses that standard document once;
+ * every Nomos-facing caller receives this nominal shape and the law stores each member as USDA. */
+export const authProviderPublicKey = z.object({
+  kty: z.enum(["EC", "RSA", "OKP"]),
+  kid: z.string().min(1).optional(),
+  alg: z.string().min(1).optional(),
+  use: z.string().min(1).optional(),
+  crv: z.string().min(1).optional(),
+  x: z.string().min(1).optional(),
+  y: z.string().min(1).optional(),
+  n: z.string().min(1).optional(),
+  e: z.string().min(1).optional(),
+  keyOps: z.array(z.string().min(1)).optional(),
+  x5c: z.array(z.string().min(1)).optional(),
+}).strict().superRefine((key, ctx) => {
+  if (key.kty === "RSA" && (!key.n || !key.e)) {
+    ctx.addIssue({ code: "custom", message: "an RSA public key requires n and e" });
+  }
+  if (key.kty === "EC" && (!key.crv || !key.x || !key.y)) {
+    ctx.addIssue({ code: "custom", message: "an EC public key requires crv, x and y" });
+  }
+  if (key.kty === "OKP" && (!key.crv || !key.x)) {
+    ctx.addIssue({ code: "custom", message: "an OKP public key requires crv and x" });
+  }
+});
+
+export const authProviderKeySet = z.object({
+  epoch: z.number().int().nonnegative(),
+  keys: z.array(authProviderPublicKey).min(1),
+}).strict();
+
 /**
  * setAuthProvider — declare (or amend) the platform's identity provider. An
  * Ensure on the singleton; every change is an attributed, replayable intent.
  */
-const authProviderPayload = z.object({
+export const authProviderConfiguration = z.object({
       // NOT z.url(): zod's url() needs the URL global, which the sealed
       // deterministic engine does not provide — a regex keeps the plan pure.
       issuer: z.string().regex(/^https?:\/\/\S+$/, "expected an http(s) URL"),
       jwksUrl: z.string().regex(/^https?:\/\/\S+$/, "expected an http(s) URL"),
       audience: z.string().min(1).optional(),
-      /** The JWKS JSON (the public verifying keys) the KERNEL checks tokens against. Optional so the
-       *  rotation capability can re-set just the keys; absent keeps the prior keys (Lww). */
-      keys: z.string().min(1).optional(),
+      /** Typed public verifying keys. Omit to retain the current epoch. Serialized JWKS never enters law. */
+      keySet: authProviderKeySet.optional(),
       /** OPTIONAL — the claim carrying the principal (default "sub"; e.g. "oid" for Azure AD). */
       principalClaim: z.string().min(1).optional(),
       /** OPTIONAL — the pinned CA root (base64 DER) enabling trustless {@link rotateKeys}. */
@@ -120,17 +185,189 @@ const authProviderPayload = z.object({
        *  platform key attested by its existing lineage; the kernel verifies it while walking every new
        *  descendant chain. Optional keeps pre-epoch histories replayable. */
       attestation: authProviderAttestation.optional(),
+    }).strict();
+
+export type AuthProviderConfiguration = z.infer<typeof authProviderConfiguration>;
+export type AuthProviderVerifyingConfiguration = Omit<
+  AuthProviderConfiguration,
+  "label" | "setBy" | "setAt" | "attestation"
+>;
+
+/** Read the current provider through its three declared O(1) indexes and reconstruct the one nominal
+ * configuration value used by child genesis and provider-epoch effects. */
+function readCurrentAuthProviderRows() {
+  try {
+    return readFrameworkDeclaredRows(authProvider, AuthProvider, { scope: "platform" });
+  } catch (error) {
+    if (error instanceof z.ZodError && error.issues.some((issue) =>
+      issue.code === "unrecognized_keys" && issue.keys.includes("keys")
+    )) {
+      throw new Error(
+        "the AuthProvider still uses the historical serialized key field; migrate it to a typed keySet first",
+      );
+    }
+    throw error;
+  }
+}
+
+type CurrentAuthProviderRow = ReturnType<typeof readCurrentAuthProviderRows>[number];
+
+/** Reconstruct the verifier-bearing portion once from the three declared indexes. The provider row is
+ * retained so the full audit/attestation value can be added without another read or a parallel schema. */
+function readCurrentAuthProviderValue(): {
+  readonly provider: CurrentAuthProviderRow;
+  readonly verifying: AuthProviderVerifyingConfiguration;
+} | undefined {
+  const providers = readCurrentAuthProviderRows();
+  const provider = providers.find((row) => row.issuer !== undefined);
+  if (provider?.issuer === undefined || provider.issuer.length === 0) return undefined;
+  const keyEpoch = provider.keyEpoch;
+  const providerEpoch = keyEpoch === undefined ? undefined : `platform:${keyEpoch}`;
+  const certificates = providerEpoch === undefined
+    ? []
+    : readFrameworkDeclaredRows(
+        authProviderCertificates,
+        AuthProviderCertificate,
+        { providerEpoch },
+      );
+  const keys = providerEpoch === undefined
+    ? []
+    : readFrameworkDeclaredRows(authProviderKeys, AuthProviderKey, { providerEpoch })
+        .sort((a, b) => (a.ordinal ?? Number.MAX_SAFE_INTEGER) - (b.ordinal ?? Number.MAX_SAFE_INTEGER))
+        .map((key) => authProviderPublicKey.parse({
+          kty: key.kty,
+          kid: key.kid,
+          alg: key.alg,
+          use: key.use,
+          crv: key.crv,
+          x: key.x,
+          y: key.y,
+          n: key.n,
+          e: key.e,
+          keyOps: key.keyOps,
+          x5c: certificates
+            .filter((certificate) => certificate.keyOrdinal === key.ordinal)
+            .sort((a, b) =>
+              (a.certificateOrdinal ?? Number.MAX_SAFE_INTEGER) -
+              (b.certificateOrdinal ?? Number.MAX_SAFE_INTEGER)
+            )
+            .map((certificate) => certificate.derBase64),
+        }));
+  return {
+    provider,
+    verifying: {
+      issuer: provider.issuer,
+      jwksUrl: provider.jwksUrl !== undefined && provider.jwksUrl.length > 0
+        ? provider.jwksUrl
+        : provider.issuer,
+      ...(provider.audience !== undefined && provider.audience.length > 0
+        ? { audience: provider.audience }
+        : {}),
+      ...(keyEpoch !== undefined && keys.length > 0 ? { keySet: { epoch: keyEpoch, keys } } : {}),
+      ...(provider.principalClaim !== undefined && provider.principalClaim.length > 0
+        ? { principalClaim: provider.principalClaim }
+        : {}),
+      ...(provider.rootCert !== undefined && provider.rootCert.length > 0
+        ? { rootCert: provider.rootCert }
+        : {}),
+      ...(provider.deviceBindingClaim !== undefined && provider.deviceBindingClaim.length > 0
+        ? { deviceBindingClaim: provider.deviceBindingClaim }
+        : {}),
+      ...(provider.requireDeviceBinding === "true" || provider.requireDeviceBinding === "false"
+        ? { requireDeviceBinding: provider.requireDeviceBinding }
+        : {}),
+    },
+  };
+}
+
+/** Read the complete current provider through its three declared O(1) indexes. This is the one nominal
+ * value source-law workspace effects may copy; callers never supply provider members independently. */
+export function readAuthProviderConfiguration(): AuthProviderConfiguration | undefined {
+  const current = readCurrentAuthProviderValue();
+  if (current === undefined) return undefined;
+  const { provider, verifying } = current;
+  const attestationMembers = [
+    provider.attestationChild,
+    provider.attestationFounder,
+    provider.attestationVerified,
+    provider.attestationParentKey,
+    provider.attestationParentId,
+    provider.attestationEpoch,
+    provider.attestationSignature,
+  ];
+  const hasAttestation = attestationMembers.some((member) => member !== undefined);
+  if (hasAttestation && attestationMembers.some((member) => member === undefined)) {
+    throw new Error("the AuthProvider carries an incomplete typed attestation");
+  }
+  return authProviderConfiguration.parse({
+    ...verifying,
+    label: provider.label,
+    setBy: provider.setBy,
+    setAt: provider.setAt,
+    ...(hasAttestation ? {
+      attestation: {
+        child: provider.attestationChild,
+        founder: provider.attestationFounder,
+        verified: provider.attestationVerified,
+        parentKey: provider.attestationParentKey,
+        parentId: provider.attestationParentId,
+        epoch: provider.attestationEpoch,
+        signature: provider.attestationSignature,
+      },
+    } : {}),
+  });
+}
+
+/** The verifier consumes the same nominal configuration while deliberately ignoring audit and
+ * lineage-attestation members that do not participate in JWT verification. */
+export function readAuthProviderVerifyingConfiguration(): AuthProviderVerifyingConfiguration | undefined {
+  return readCurrentAuthProviderValue()?.verifying;
+}
+
+export function writeAuthProviderKeySet(keySet: z.infer<typeof authProviderKeySet>): PlannedOp[] {
+  const ap = instance(AuthProvider, AUTH_PROVIDER_ID);
+  const ops: PlannedOp[] = [set(ap, "keyEpoch", keySet.epoch)];
+  const providerEpoch = `platform:${keySet.epoch}`;
+  keySet.keys.forEach((key, keyOrdinal) => {
+      const keyRow = instance(AuthProviderKey, `${AUTH_PROVIDER_KEY_ID_PREFIX}${keySet.epoch}:${keyOrdinal}`);
+      ops.push(
+        withMarker(set(keyRow, "providerEpoch", providerEpoch), "ensures"),
+        set(keyRow, "epoch", keySet.epoch),
+        set(keyRow, "ordinal", keyOrdinal),
+        set(keyRow, "kty", key.kty),
+        ...(key.kid ? [set(keyRow, "kid", key.kid)] : []),
+        ...(key.alg ? [set(keyRow, "alg", key.alg)] : []),
+        ...(key.use ? [set(keyRow, "use", key.use)] : []),
+        ...(key.crv ? [set(keyRow, "crv", key.crv)] : []),
+        ...(key.x ? [set(keyRow, "x", key.x)] : []),
+        ...(key.y ? [set(keyRow, "y", key.y)] : []),
+        ...(key.n ? [set(keyRow, "n", key.n)] : []),
+        ...(key.e ? [set(keyRow, "e", key.e)] : []),
+        ...(key.keyOps && key.keyOps.length > 0 ? [addToSet(keyRow, "keyOps", key.keyOps)] : []),
+      );
+      key.x5c?.forEach((derBase64, certificateOrdinal) => {
+        const certificate = instance(
+          AuthProviderCertificate,
+          `${AUTH_PROVIDER_CERTIFICATE_ID_PREFIX}${keySet.epoch}:${keyOrdinal}:${certificateOrdinal}`,
+        );
+        ops.push(
+          withMarker(set(certificate, "providerEpoch", providerEpoch), "ensures"),
+          set(certificate, "keyOrdinal", keyOrdinal),
+          set(certificate, "certificateOrdinal", certificateOrdinal),
+          set(certificate, "derBase64", derBase64),
+        );
+      });
     });
+  return ops;
+}
 
-type AuthProviderPayload = z.infer<typeof authProviderPayload>;
-function writeAuthProvider(p: AuthProviderPayload) {
+export function writeAuthProviderConfiguration(p: AuthProviderConfiguration): PlannedOp[] {
   const ap = instance(AuthProvider, AUTH_PROVIDER_ID);
   return [
     withMarker(set(ap, "scope", "platform"), "ensures"),
     set(ap, "issuer", p.issuer),
     set(ap, "jwksUrl", p.jwksUrl),
     ...(p.audience ? [set(ap, "audience", p.audience)] : []),
-    ...(p.keys ? [set(ap, "keys", p.keys)] : []),
     ...(p.principalClaim ? [set(ap, "principalClaim", p.principalClaim)] : []),
     ...(p.rootCert ? [set(ap, "rootCert", p.rootCert)] : []),
     ...(p.deviceBindingClaim ? [set(ap, "deviceBindingClaim", p.deviceBindingClaim)] : []),
@@ -147,13 +384,16 @@ function writeAuthProvider(p: AuthProviderPayload) {
       set(ap, "attestationEpoch", p.attestation.epoch),
       set(ap, "attestationSignature", p.attestation.signature),
     ] : []),
+    ...(p.keySet ? writeAuthProviderKeySet(p.keySet) : []),
   ];
 }
 
 export const setAuthProvider = directive("setAuthProvider")
   .ensures(AuthProvider)
-  .payload(authProviderPayload)
-  .plan(writeAuthProvider)
+  .payload(authProviderConfiguration)
+  .plan(writeAuthProviderConfiguration)
+  .alsoEnsuresMany(AuthProviderKey)
+  .alsoEnsuresMany(AuthProviderCertificate)
   .requires("admin");
 
 /**
@@ -164,8 +404,10 @@ export const setAuthProvider = directive("setAuthProvider")
  */
 export const seedAuthProvider = directive("seedAuthProvider")
   .ensures(AuthProvider)
-  .payload(authProviderPayload)
-  .plan(writeAuthProvider);
+  .payload(authProviderConfiguration)
+  .plan(writeAuthProviderConfiguration)
+  .alsoEnsuresMany(AuthProviderKey)
+  .alsoEnsuresMany(AuthProviderCertificate);
 
 export const authProviderSeedBeforeWarrant = workspaceInvariant("AuthProviderSeedBeforeWarrant")
   .on("seedAuthProvider")

package/src/framework/home.ts

@@ -34,8 +34,13 @@ import { ensure } from "../authoring.js";
 import { set, withMarker, type PlannedOp } from "../ops.js";
 import { query } from "../query.js";
 import { birth } from "../births.js";
-import { readFrameworkDeclared } from "../read.js";
-import { authProvider as authProviderQuery, seedAuthProvider } from "./auth_provider_law.js";
+import {
+  authProvider as authProviderQuery,
+  authProviderCertificates as authProviderCertificatesQuery,
+  authProviderKeys as authProviderKeysQuery,
+  readAuthProviderVerifyingConfiguration,
+  seedAuthProvider,
+} from "./auth_provider_law.js";
 import { readRef, readSet, workspaceInvariant, refAs } from "./workspace_invariant.js";
 import { identityRelations } from "./signing_identity.js";
 import { RelationTuple, writeTuple } from "./relations.js";
@@ -355,18 +360,9 @@ export function birthReceivingGroupForDomain(
     // THE PARENT'S DECLARED VERIFIER. This captured read supplies the inherited provider seed.
     // Birth-certificate verification and founding-signer enrollment belong to the kernel-owned
     // attestation step, so neither fact is duplicated in this tenant plan or payload.
-    const apRows = p.inheritAuthProvider !== false
-      ? readFrameworkDeclared<Array<Record<string, unknown>>>("authProvider", { scope: "platform" })
-      : undefined;
-    const apRaw = Array.isArray(apRows) && apRows.length > 0 ? apRows[0] : undefined;
-    // Projected rows are `{type,id,data:{…fields}}`; folded shapes may be flat — accept both.
-    const ap = (apRaw && typeof apRaw === "object" && typeof (apRaw as { data?: unknown }).data === "object"
-      ? (apRaw as { data: Record<string, unknown> }).data
-      : apRaw) as Record<string, unknown> | undefined;
-    const apStr = (k: string): string | undefined => {
-      const v = ap?.[k];
-      return typeof v === "string" && v.length > 0 ? v : undefined;
-    };
+    const inheritedProvider = p.inheritAuthProvider === false
+      ? undefined
+      : readAuthProviderVerifyingConfiguration();
     const genesisChain: Array<{ domain: string; directiveId: string; actor: string; payload: Record<string, unknown>; domainHash?: string }> = [
       // THE ORDER-DECLARED LAW INSTALL: two typed closure identities. The kernel resolves each
       // closure from the parent's custody when it folds the birth; law bytes never ride the intent.
@@ -425,23 +421,14 @@ export function birthReceivingGroupForDomain(
     // (the up-front captured read above) AS DATA into the child genesis. The child owns the copy as its
     // own law-state; nothing is inherited-by-reference. Opt out: `inheritAuthProvider: false`.
     if (p.inheritAuthProvider !== false) {
-      const str = apStr;
-      const issuer = str("issuer");
-      if (issuer !== undefined) {
+      if (inheritedProvider !== undefined) {
         genesisChain.push({
           domain: groupLawDomain,
           directiveId: "seedAuthProvider",
           actor: founder,
           payload: {
-            issuer,
-            jwksUrl: str("jwksUrl") ?? issuer, // required by the framework schema; a keys-only provider mirrors its issuer
-            ...(str("keys") !== undefined ? { keys: str("keys") } : {}),
-            ...(str("audience") !== undefined ? { audience: str("audience") } : {}),
-            ...(str("principalClaim") !== undefined ? { principalClaim: str("principalClaim") } : {}),
-            ...(str("rootCert") !== undefined ? { rootCert: str("rootCert") } : {}),
-            ...(str("deviceBindingClaim") !== undefined ? { deviceBindingClaim: str("deviceBindingClaim") } : {}),
-            ...(str("requireDeviceBinding") !== undefined ? { requireDeviceBinding: str("requireDeviceBinding") } : {}),
-            label: str("label") ?? "inherited-from-parent",
+            ...inheritedProvider,
+            label: "inherited-from-parent",
             setBy: p.owner,
             setAt: 1, // genesis position — deterministic, like enrollSigner's grantedAt
           },
@@ -455,6 +442,8 @@ export function birthReceivingGroupForDomain(
     return [];
   })
   .reads(authProviderQuery) // the parent-side AuthProvider capture the inheritance copies (the #58 lane)
+  .reads(authProviderKeysQuery)
+  .reads(authProviderCertificatesQuery)
   .births(); // BIRTH IS A DECLARED KERNEL PRIMITIVE — emits the `nomosBirthGate` era key; the kernel folds the recipe
   return {
     ...birthDirective,
@@ -645,6 +634,13 @@ export const seedBirthAttestation = directive("seedBirthAttestation")
       parentKey: z.string().min(1), // base64 K_P
       epoch: z.number().int().nonnegative(),
       links: z.array(birthCertificatePayload).min(1),
+      /** Law-declared target roles for the verified immediate parent workspace. The kernel injects this
+       * value from the admitted birth recipe and supplies `parentId`; no host chooses either fact. */
+      parentWorkspaceRoles: z.array(z.string().regex(/^[A-Za-z][A-Za-z0-9_-]*$/)).optional(),
+    }).superRefine((payload, ctx) => {
+      if ((payload.parentWorkspaceRoles?.length ?? 0) > 0 && payload.parentId.length === 0) {
+        ctx.addIssue({ code: "custom", message: "parent workspace roles require a verified non-root parentId" });
+      }
     }),
   )
   .plan((p) => {
@@ -676,9 +672,17 @@ export const seedBirthAttestation = directive("seedBirthAttestation")
         ...(certificate.authProviderAudience ? [withMarker(set(link, "authProviderAudience", certificate.authProviderAudience), "ensures")] : []),
       ];
     });
-    return [...header, ...links];
+    const parentAuthority = (p.parentWorkspaceRoles ?? []).flatMap((relation) => writeTuple({
+      object: "workspace:self",
+      relation,
+      subject: `workspace:${p.parentId}`,
+      grantedBy: `workspace:${p.parentId}`,
+      grantedAt: String(p.epoch),
+    }));
+    return [...header, ...links, ...parentAuthority];
   })
-  .alsoEnsures(BirthAttestationLink);
+  .alsoEnsures(BirthAttestationLink)
+  .alsoEnsures(RelationTuple);
 
 /**
  * THE ERA DECLARATION (the `nomosParentAttestedBirth` USD key). Exporting this sentinel from the home law