@githolon/dsl 0.108.0 → 0.108.1

package/src/framework/owned_custody.ts

@@ -23,6 +23,7 @@ import { BirthAttestation, BirthAttestationLink, seedBirthAttestation } from "./
 import { RelationTuple, __qualifyAggregateType, removeTuple, writeTuple } from "./relations.js";
 import { SIGNER_RELATION, enrollSigner, signerObject, identityRelations } from "./signing_identity.js";
 import { impureCapability, impureCapabilityAggregate } from "./impure_capability.js";
+import { OwnedCustodyValue, OwnedDeviceRequestValue } from "./owned_custody_value.js";
 
 /** Obscure stable law id: deliberately unavailable as a generated tenant directive method. */
 export const OWNED_DEVICE_APPROVAL_DIRECTIVE = "nomos_internal_approve_owned_device_7c1f5e";
@@ -68,7 +69,7 @@ export const OwnedRecoveryPolicy = aggregate("NomosOwnedRecoveryPolicy", {
 const recoveryOrderParams = {
   ownerPrincipal: t.string().merge(Lww),
   recoveryPrincipal: t.string().merge(Lww),
-  deviceRequest: t.string().merge(Lww),
+  deviceRequest: OwnedDeviceRequestValue.merge(Lww),
 };
 
 /**
@@ -81,14 +82,14 @@ const recoveryOrderParams = {
  * the last thing that should degrade quietly.
  */
 const recoveryReceipt = {
-  ownedCustody: z.string().min(1),
+  ownedCustody: OwnedCustodyValue.zod,
 };
 
 /** Order fields ⊕ the receipt field, so the aggregate can hold what the Receipt writes. */
 const recoveryOrderFields = {
   ...recoveryOrderParams,
   // Absent until the recovery principal's Receipt lands (the read-decode discipline).
-  ownedCustody: t.string().merge(Lww).optional(),
+  ownedCustody: OwnedCustodyValue.merge(Lww).optional(),
 };
 
 /** Private framework Order -> Receipt journal. Generated business clients never expose this aggregate. */
@@ -105,7 +106,7 @@ const ownedRecoveryLifecycle = impureCapability({
   paramsSchema: {
     ownerPrincipal: principal,
     recoveryPrincipal: principal,
-    deviceRequest: z.string().min(1),
+    deviceRequest: OwnedDeviceRequestValue.zod,
   },
   writeParams: (id, p) => [
     set(instance(OwnedRecoveryOrder, id), "ownerPrincipal", p.ownerPrincipal),
@@ -114,7 +115,7 @@ const ownedRecoveryLifecycle = impureCapability({
   ],
   receiptSchema: recoveryReceipt,
   writeReceipt: (id, r) => [
-    set(instance(OwnedRecoveryOrder, id), "ownedCustody", r.ownedCustody as string),
+    set(instance(OwnedRecoveryOrder, id), "ownedCustody", OwnedCustodyValue.zod.parse(r.ownedCustody)),
   ],
   // This is intentionally unaddressed: opening the designated principal's ordinary generated
   // client is the provider. Declaring the capability still matters because every durable Order must
@@ -132,6 +133,13 @@ const hiddenRecoveryLifecycle = {
   deadLetter: hidden(ownedRecoveryLifecycle.deadLetter),
   reschedule: hidden(ownedRecoveryLifecycle.reschedule),
 };
+
+/** Compiler-contract handles for the two generated recovery calls used by the
+ * host. They remain framework-private directives; exporting the authored
+ * objects here lets code generation derive the cross-language signatures
+ * instead of maintaining another payload mirror. */
+export const requestOwnedRecovery = hiddenRecoveryLifecycle.obligation;
+export const completeOwnedRecovery = hiddenRecoveryLifecycle.complete;
 const ownedRecoveryCapability = {
   ...ownedRecoveryLifecycle,
   // Capability expansion deliberately re-seats the lifecycle quartet after application-language
@@ -152,7 +160,7 @@ export const ownedRecoveryOrdersByRecoveryPrincipal = query("nomosOwnedRecoveryO
   .returns(OwnedRecoveryOrder);
 
 /** Opt in once. Retrying the same policy is idempotent; replacing the principal is refused by the kernel. */
-const protectOwnedIdentity = Object.assign(
+export const protectOwnedIdentity = Object.assign(
   directive(OWNED_RECOVERY_PROTECT_DIRECTIVE)
     .ensures(OwnedRecoveryPolicy)
     .payload(z.object({
@@ -196,13 +204,13 @@ const protectOwnedIdentity = Object.assign(
   { businessBirthInternal: true as const, ownedAuthoringInternal: true as const },
 );
 
-const acceptOwnedRecovery = Object.assign(
+export const acceptOwnedRecovery = Object.assign(
   directive(OWNED_RECOVERY_ACCEPT_DIRECTIVE)
     .ensures(RelationTuple)
     .payload(z.object({
       requestId: z.string().min(1),
       newKeySubject: keySubject,
-      ownedCustody: z.string().min(1),
+      ownedCustody: OwnedCustodyValue.zod,
       recoveredAt: z.string().min(1),
     }))
     .plan((p, ctx) => {
@@ -249,7 +257,7 @@ const approval = directive(OWNED_DEVICE_APPROVAL_DIRECTIVE)
   .ensures(RelationTuple)
   .payload(z.object({
     newKeySubject: keySubject,
-    ownedCustody: z.string().min(1),
+    ownedCustody: OwnedCustodyValue.zod,
     verifiedVia: z.string().min(1),
     validFromEpoch: z.number().int().nonnegative(),
     approvedAt: z.string().min(1),
@@ -287,12 +295,12 @@ export const approveOwnedDevice = Object.assign(approval, {
 });
 
 /** Establish this principal's shared owned-data root before another principal shares to them. */
-const initializeOwnedIdentity = Object.assign(
+export const initializeOwnedIdentity = Object.assign(
   directive(OWNED_INITIALIZE_DIRECTIVE)
     .ensures(RelationTuple)
     .payload(z.object({
       newKeySubject: keySubject,
-      ownedCustody: z.string().min(1),
+      ownedCustody: OwnedCustodyValue.zod,
       initializedAt: z.string().min(1),
     }))
     .plan((p, ctx) => {

package/src/framework/owned_custody_value.ts

@@ -0,0 +1,51 @@
+// NOMOS — framework-owned typed custody values shared by relation facts, recovery Orders,
+// generated clients and the kernel. USDA is the canonical semantic representation; these
+// descriptors are the authored source from which TS/Dart encoders and decoders are generated.
+
+import { z } from "zod";
+import { valueObject, type ValueObjectValue } from "../value_object.js";
+
+const base64 = z.string().regex(/^[A-Za-z0-9+/]+={0,2}$/);
+const sha256 = z.string().regex(/^[0-9a-f]{64}$/);
+
+export const OwnedDeviceRequestValue = valueObject("OwnedDeviceRequest", {
+  v: z.number().int().min(1).max(255),
+  workspace: z.string().min(1),
+  principal: z.string().min(1),
+  scope: z.string().min(1),
+  signingPublic: base64,
+  wrappingPublic: base64,
+  signature: base64,
+});
+
+export type OwnedDeviceRequest = ValueObjectValue<typeof OwnedDeviceRequestValue>;
+
+export const OwnedCustodyValue = valueObject("OwnedCustody", {
+  v: z.number().int().min(1).max(255),
+  request: OwnedDeviceRequestValue,
+  hpkeEpk: base64,
+  ct: base64,
+  keyCommitment: sha256,
+  principalWrappingPublic: base64,
+});
+
+export type OwnedCustody = ValueObjectValue<typeof OwnedCustodyValue>;
+
+/** Deterministic compile/proof value. It is structurally valid but intentionally has no
+ * cryptographic authority; the live executor will reject it if it ever reaches admission. */
+export const OWNED_CUSTODY_PROBE: OwnedCustody = {
+  v: 1,
+  request: {
+    v: 1,
+    workspace: "nomos-probe",
+    principal: "user:nomos-probe",
+    scope: "nomos-probe",
+    signingPublic: "AA==",
+    wrappingPublic: "AA==",
+    signature: "AA==",
+  },
+  hpkeEpk: "AA==",
+  ct: "AA==",
+  keyCommitment: "0".repeat(64),
+  principalWrappingPublic: "AA==",
+};

package/src/framework/relations.ts

@@ -41,7 +41,7 @@
  */
 import { z } from "zod";
 import { aggregate, instance } from "../aggregate.js";
-import { t, type JsonValue } from "../fields.js";
+import { t } from "../fields.js";
 import { Lww, MapOf } from "../drivers.js";
 import { directive } from "../directive.js";
 import { set, setEntry, withMarker, type PlannedOp } from "../ops.js";
@@ -49,6 +49,8 @@ import { query } from "../query.js";
 import { endorsementOf, type AttributionPrincipal, type EndorsedAuthority } from "../principal_evidence.js";
 import { isRelationObjectToken, qualifyRelationType, type RelationObjectToken } from "../relation_schema.js";
 import { qualifyReadProjectionType } from "../read_projection_namespace.js";
+import { valueObject } from "../value_object.js";
+import { OwnedCustodyValue, type OwnedCustody } from "./owned_custody_value.js";
 
 // ─────────────────────────────── the dispatch context (relation-namespacing) ───────────────────────────────
 //
@@ -192,46 +194,70 @@ export function relationTupleInstanceId(object: string, relation: string): strin
  *  - relation  Lww (the edge label)
  *  - subjects  MapOf(Lww) — subject → typed `RelationshipSubject` runtime leaf
  */
+/** The exact law-level value stored for one subject in a relation tuple.
+ *
+ * This used to be `t.json()` and forced every generated reader to recover an
+ * unstructured object after the kernel had already proved a typed
+ * `RelationshipSubject`. Keeping the descriptor here makes the DSL graph the
+ * one authority for TS, Dart, USDA and the kernel's map leaf. */
+export const RelationshipSubjectValue = valueObject("RelationshipSubject", {
+  status: z.enum(["active", "revoked"]),
+  grantedBy: z.string(),
+  grantedAt: z.string(),
+  revokedBy: z.string().optional(),
+  revokedAt: z.string().optional(),
+  validFromEpoch: z.number().int().nonnegative().optional(),
+  verifiedVia: z.string().optional(),
+  ownedCustody: OwnedCustodyValue.optional(),
+});
+
 export const RelationTuple = aggregate("RelationTuple", {
   object: t.string().merge(Lww),
   relation: t.string().merge(Lww),
-  subjects: t.map(t.json()).merge(MapOf(Lww)),
+  subjects: t.map(RelationshipSubjectValue.field()).merge(MapOf(Lww)),
 }).public();
 export type RelationTupleHandle = typeof RelationTuple;
 
 /** The per-subject leaf the `subjects` map stores as a typed kernel value. */
 export interface RelationSubjectLeaf {
-  status: RelationStatus;
-  grantedBy: string;
-  grantedAt: string;
-  revokedBy?: string;
-  revokedAt?: string;
+  readonly status: RelationStatus;
+  readonly grantedBy: string;
+  readonly grantedAt: string;
+  readonly revokedBy?: string;
+  readonly revokedAt?: string;
   /**
    * VA-core (signer-provenance) — the SignerEpoch this leaf was authored under. OMITTED when absent so
    * every pre-VA chain (and every non-signer relation) stays byte-identical: `compact()` strips an
    * `undefined`. A revoke (`unrelateSubject`) backdates by bumping the SignerEpoch; a key whose
    * `validFromEpoch` predates the current epoch is stale (the full backdate gate is phase 4).
    */
-  validFromEpoch?: number;
+  readonly validFromEpoch?: number;
   /**
    * VA-core (signer-provenance) — the IdP/issuer that VOUCHED for the enrolling principal at enroll time
    * (e.g. the `AuthProvider.issuer`). The kernel's `verify_captured_principal` DERIVES `principal_verified`
    * from THIS leaf field (provenance, not the wire): an enrollment vouched by a real IdP reads verified on
    * every lane. OMITTED when absent (legacy / unverified enrollment) so existing chains stay byte-identical.
    */
-  verifiedVia?: string;
+  readonly verifiedVia?: string;
   /**
    * Secure-by-default owned-data device handoff. Framework-reserved and omitted from every ordinary
-   * relation leaf; the opaque JSON is independently verified by the kernel before it may land.
+   * relation leaf; the typed encrypted handoff is independently verified by the kernel before it may land.
    */
-  ownedCustody?: string;
+  readonly ownedCustody?: OwnedCustody;
 }
 
 /** Strip undefined keys so the typed leaf has one stable optional-field shape. */
-function compact(obj: Record<string, unknown>): RelationSubjectLeaf & Record<string, JsonValue> {
-  const out: Record<string, unknown> = {};
-  for (const [k, v] of Object.entries(obj)) if (v !== undefined) out[k] = v;
-  return out as RelationSubjectLeaf & Record<string, JsonValue>;
+function compact(leaf: RelationSubjectLeaf): RelationSubjectLeaf {
+  return {
+    status: leaf.status,
+    grantedBy: leaf.grantedBy,
+    grantedAt: leaf.grantedAt,
+    ...(leaf.revokedBy === undefined ? {} : { revokedBy: leaf.revokedBy }),
+    ...(leaf.revokedAt === undefined ? {} : { revokedAt: leaf.revokedAt }),
+    ...(leaf.validFromEpoch === undefined ? {} : { validFromEpoch: leaf.validFromEpoch }),
+    ...(leaf.verifiedVia === undefined ? {} : { verifiedVia: leaf.verifiedVia }),
+    ...(leaf.ownedCustody === undefined ? {} : { ownedCustody: leaf.ownedCustody }),
+  };
 }
 
 interface WriteTupleInput {
@@ -261,7 +287,7 @@ interface WriteTupleInput {
   /** VA-core: the IdP/issuer that vouched for the enrolling principal (signer relations only; omitted otherwise). */
   verifiedVia?: string;
   /** Framework-internal encrypted owned-data handoff (owned device relation only). */
-  ownedCustody?: string;
+  ownedCustody?: OwnedCustody;
 }
 
 /** Lower a tuple write to plan ops. The first op MATERIALIZES the (object, relation)
@@ -297,13 +323,13 @@ function lowerTuple(
     status: p.status,
     grantedBy: grantedByRaw,
     grantedAt: p.grantedAt,
-    revokedBy: revokedByRaw,
-    revokedAt: p.revokedAt,
+    ...(revokedByRaw === undefined ? {} : { revokedBy: revokedByRaw }),
+    ...(p.revokedAt === undefined ? {} : { revokedAt: p.revokedAt }),
     // VA-core signer-provenance leaf fields — `compact` strips an `undefined`, so a non-signer relation
     // (these never set) stays byte-identical to a pre-VA leaf (the era rule on the wire shape).
-    validFromEpoch: p.validFromEpoch,
-    verifiedVia: p.verifiedVia,
-    ownedCustody: p.ownedCustody,
+    ...(p.validFromEpoch === undefined ? {} : { validFromEpoch: p.validFromEpoch }),
+    ...(p.verifiedVia === undefined ? {} : { verifiedVia: p.verifiedVia }),
+    ...(p.ownedCustody === undefined ? {} : { ownedCustody: p.ownedCustody }),
   });
   const subjectEntry = {
     ...setEntry(rt, "subjects", subjectRaw, leaf),

package/src/framework/signing_identity.ts

@@ -58,6 +58,7 @@ import {
   RelationTuple,
   relationTupleInstanceId,
 } from "./relations.js";
+import { MODEL_LIFECYCLE_AUTHORITY } from "./domain_lifecycle.js";
 
 /**
  * The framework `identity` relation schema — the `signer` relation, LEAF-ONLY
@@ -84,6 +85,9 @@ export function signerObject(principal: string): string {
 /** The `signer` relation name — the relation a device key holds on its `identity:<principal>` object. */
 export const SIGNER_RELATION = "signer";
 
+/** Reserved workload principal for external admission receipts. It is never the business actor. */
+export const ADMISSION_CHECKPOINT_PRINCIPAL = "workspace:admission-peer";
+
 const sha256Hex = z.string().regex(/^[0-9a-f]{64}$/, "expected lowercase sha256 hex (the device pubkey hash)");
 
 // ─────────────────────────────── PHASE 0 — SignerEpoch ───────────────────────────────
@@ -240,6 +244,36 @@ export const enrollSigner = directive("enrollSigner")
     });
   });
 
+/**
+ * Enrol the runtime workload key which signs causal admission checkpoints. This is ordinary law:
+ * lifecycle authority chooses the public key, the relation is visible/revocable, and possession of
+ * the secret alone grants nothing. The key certifies that this workspace admitted an exact causal
+ * transition; the target directive's independent Zanzibar requirement remains business authority.
+ */
+export const enrollAdmissionCheckpointSigner = directive(
+  "_nmsEffectEnrollAdmissionCheckpointSigner",
+)
+  .ensures(RelationTuple)
+  .payload(
+    z.object({
+      keyHash: sha256Hex,
+      validFromEpoch: z.number().int().nonnegative(),
+      grantedAt: z.string().min(1),
+    }).strict(),
+  )
+  .plan((p, ctx) =>
+    writeTuple({
+      object: signerObject(ADMISSION_CHECKPOINT_PRINCIPAL),
+      relation: SIGNER_RELATION,
+      subject: `key:${p.keyHash}`,
+      grantedBy: ctx.principal().asAttribution(),
+      grantedAt: p.grantedAt,
+      validFromEpoch: p.validFromEpoch,
+      verifiedVia: "workspace-law",
+    }),
+  )
+  .requires(MODEL_LIFECYCLE_AUTHORITY, { object: "workspace:self" });
+
 /**
  * THE SELF-BIND ENROLL (VA-1 / B2). A device enrolls a key for ITS OWN verified identity — the bound
  * principal is `ctx.principal()` (the captured authoring principal), NOT a payload field, so a device can

package/src/framework/workspaces.ts

@@ -1397,16 +1397,37 @@ export const setPlatformPool = directive("setPlatformPool")
 // here verbatim — the public surface and the law bytes are unchanged.
 export {
   AUTH_PROVIDER_ID,
+  AUTH_PROVIDER_KEY_ID_PREFIX,
+  AUTH_PROVIDER_CERTIFICATE_ID_PREFIX,
   AuthProvider,
+  AuthProviderKey,
+  AuthProviderCertificate,
+  authProviderPublicKey,
+  authProviderKeySet,
+  authProviderConfiguration,
+  type AuthProviderConfiguration,
+  writeAuthProviderConfiguration,
+  writeAuthProviderKeySet,
   seedAuthProvider,
   authProviderSeedBeforeWarrant,
   setAuthProvider,
   authProvider,
+  authProviderKeys,
+  authProviderCertificates,
+} from "./auth_provider_law.js";
+import {
+  AUTH_PROVIDER_ID,
+  AuthProvider,
+  AuthProviderCertificate,
+  AuthProviderKey,
+  authProvider,
+  authProviderKeySet,
+  setAuthProvider,
+  writeAuthProviderKeySet,
 } from "./auth_provider_law.js";
-import { AUTH_PROVIDER_ID, AuthProvider, setAuthProvider, authProvider } from "./auth_provider_law.js";
 
 /**
- * rotateKeys — TRUSTLESS key rotation. Replace {@link AuthProvider.keys} with a new JWKS whose every key
+ * rotateKeys — TRUSTLESS key rotation. Replace the typed key epoch with public keys whose every key
  * carries an `x5c` cert chain. DELIBERATELY UNGATED at the relation level — the KERNEL is the authority: it
  * admits this ONLY if each key's x5c chain validates (RFC 5280) to the law-pinned {@link AuthProvider.rootCert}
  * and each key matches its CA-vouched leaf cert (the bind). So a bailiff (host on a cron, or anyone) may
@@ -1417,17 +1438,18 @@ export const rotateKeys = directive("rotateKeys")
   .ensures(AuthProvider)
   .payload(
     z.object({
-      /** The new JWKS JSON; EACH key MUST carry an `x5c` the kernel validates to {@link AuthProvider.rootCert}. */
-      keys: z.string().min(1),
+      /** The new typed keys; EACH key MUST carry an `x5c` the kernel validates to the pinned root. */
+      keySet: authProviderKeySet,
       rotatedAt: epochMs,
-    }),
+    }).strict(),
   )
   .plan((p) => {
     const ap = instance(AuthProvider, AUTH_PROVIDER_ID);
-    // The kernel's x5c admission gate authorizes this (validate_rotate_keys); the plan just stores the
-    // CA-vouched JWKS. The `ensures` marker upserts onto the existing AuthProvider singleton.
-    return [withMarker(set(ap, "keys", p.keys), "ensures"), set(ap, "setAt", p.rotatedAt)];
-  });
+    // The kernel's x5c admission gate authorizes this; the plan stores the CA-vouched typed key epoch.
+    return [withMarker(set(ap, "keyEpoch", p.keySet.epoch), "ensures"), ...writeAuthProviderKeySet(p.keySet), set(ap, "setAt", p.rotatedAt)];
+  })
+  .alsoEnsuresMany(AuthProviderKey)
+  .alsoEnsuresMany(AuthProviderCertificate);
 
 /**
  * HostnameClaim — a CUSTOM HOSTNAME bound to a platform: `api.acme.com` serving

package/src/framework_call_definitions.ts

@@ -0,0 +1,53 @@
+// Stable framework operation names, bound to their authored directive schemas.
+//
+// This is deliberately metadata, not a second schema language. Every payload
+// type and encoder is derived from the Directive object carried here. Both the
+// TypeScript and Dart compilers consume this same list, so adding or changing a
+// framework field cannot leave a handwritten host mirror behind.
+
+import type { Directive } from "./directive.js";
+import { APPLICATION_HOME_DOMAIN } from "./framework/application_home_domain.js";
+import { setAuthProvider } from "./framework/auth_provider_law.js";
+import { seedBirthPolicy } from "./framework/birth_meter.js";
+import { installDomain, promoteDomain, rollbackDomain, stageDomain } from "./framework/domain_lifecycle.js";
+import { seedGenesis } from "./framework/genesis.js";
+import {
+  birthReceivingGroupForDomain,
+  seedBirthAttestation,
+  seedReceivingGroup,
+  seedReceivingGroupPolicy,
+} from "./framework/home.js";
+import { enrollDelegation, enrollFirstDevice, enrollSigner } from "./framework/signing_identity.js";
+
+export interface FixedFrameworkCallDefinition {
+  readonly group: "identity" | "lifecycle" | "birth";
+  readonly kind: string;
+  readonly directive: Directive<any>;
+  /** Needed by the pre-bind Dart birth ceremony before an application exists. */
+  readonly dartBirth?: true;
+  /** A composed application-home law must contain this operation. */
+  readonly requiredApplicationHome?: true;
+}
+
+const receivingGroupBirth = birthReceivingGroupForDomain(
+  APPLICATION_HOME_DOMAIN,
+  0,
+  [APPLICATION_HOME_DOMAIN],
+);
+
+export const fixedFrameworkCallDefinitions: readonly FixedFrameworkCallDefinition[] = [
+  { group: "identity", kind: "enrollFirstDevice", directive: enrollFirstDevice, dartBirth: true, requiredApplicationHome: true },
+  { group: "identity", kind: "enrollSigner", directive: enrollSigner, dartBirth: true, requiredApplicationHome: true },
+  { group: "identity", kind: "setAuthProvider", directive: setAuthProvider, requiredApplicationHome: true },
+  { group: "identity", kind: "birthReceivingGroup", directive: receivingGroupBirth, dartBirth: true, requiredApplicationHome: true },
+  { group: "lifecycle", kind: "installDomain", directive: installDomain },
+  { group: "lifecycle", kind: "stageDomain", directive: stageDomain },
+  { group: "lifecycle", kind: "promoteDomain", directive: promoteDomain },
+  { group: "lifecycle", kind: "rollbackDomain", directive: rollbackDomain },
+  { group: "birth", kind: "seedBirthPolicy", directive: seedBirthPolicy, dartBirth: true },
+  { group: "birth", kind: "enrollDelegation", directive: enrollDelegation, dartBirth: true },
+  { group: "birth", kind: "seedBirthAttestation", directive: seedBirthAttestation, dartBirth: true },
+  { group: "birth", kind: "seedGenesis", directive: seedGenesis, dartBirth: true },
+  { group: "birth", kind: "seedReceivingGroupPolicy", directive: seedReceivingGroupPolicy, dartBirth: true },
+  { group: "birth", kind: "seedReceivingGroup", directive: seedReceivingGroup, dartBirth: true },
+];

package/src/framework_read_definitions.ts

@@ -0,0 +1,45 @@
+// Stable framework reads bound to their authored aggregate/query declarations.
+//
+// This is metadata, not another schema language. The compiler consumes the
+// AggregateHandle/QueryDecl objects directly, so the public host contract,
+// canonical query USDA and result decoder all change together with the DSL.
+
+import type { AggregateHandle } from "./aggregate.js";
+import type { QueryDecl } from "./query.js";
+import { EncKey, encKeyByPrincipal } from "./framework/encryption_identity.js";
+import {
+  KeyScope,
+  WrappedKey,
+  keyScopeByScope,
+  wrappedKeysByRecipient,
+} from "./framework/encryption_scope.js";
+import {
+  OwnedRecoveryOrder,
+  OwnedRecoveryPolicy,
+  ownedRecoveryOrdersByRecoveryPrincipal,
+} from "./framework/owned_custody.js";
+import { RelationTuple, relationTuplesByObject } from "./framework/relations.js";
+import { SignerEpoch } from "./framework/signing_identity.js";
+
+export interface FixedFrameworkReadDefinition {
+  readonly kind:
+    | "encKey"
+    | "keyScope"
+    | "ownedRecoveryOrder"
+    | "ownedRecoveryPolicy"
+    | "relationTuple"
+    | "signerEpoch"
+    | "wrappedKey";
+  readonly aggregate: AggregateHandle;
+  readonly query?: QueryDecl;
+}
+
+export const fixedFrameworkReadDefinitions: readonly FixedFrameworkReadDefinition[] = [
+  { kind: "encKey", aggregate: EncKey, query: encKeyByPrincipal },
+  { kind: "keyScope", aggregate: KeyScope, query: keyScopeByScope },
+  { kind: "ownedRecoveryOrder", aggregate: OwnedRecoveryOrder, query: ownedRecoveryOrdersByRecoveryPrincipal },
+  { kind: "ownedRecoveryPolicy", aggregate: OwnedRecoveryPolicy },
+  { kind: "relationTuple", aggregate: RelationTuple, query: relationTuplesByObject },
+  { kind: "signerEpoch", aggregate: SignerEpoch },
+  { kind: "wrappedKey", aggregate: WrappedKey, query: wrappedKeysByRecipient },
+];

package/src/identity_frontier.ts

@@ -0,0 +1,58 @@
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import path from "node:path";
+
+export type IdentityFrontierSource = Readonly<{
+  source: string;
+  custody: "git-head" | "working-file";
+}>;
+
+/**
+ * Read the identity frontier which is already part of custody.
+ *
+ * The working identity layer is candidate output: it may contain identities minted
+ * by an earlier successful local compile which have never been committed or shipped.
+ * Git HEAD is therefore the historical evolution frontier whenever the package is in
+ * Git custody. Outside Git, the checked-in/working file remains the portable fallback.
+ */
+export function readHistoricalIdentityFrontier(
+  lockPath: string,
+): IdentityFrontierSource | undefined {
+  const directory = path.dirname(lockPath);
+  let repositoryRoot: string;
+  try {
+    repositoryRoot = realpathSync(execFileSync("git", ["rev-parse", "--show-toplevel"], {
+      cwd: directory,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+    }).trim());
+  } catch {
+    return existsSync(lockPath)
+      ? { source: readFileSync(lockPath, "utf8"), custody: "working-file" }
+      : undefined;
+  }
+
+  const canonicalLockPath = path.join(realpathSync(directory), path.basename(lockPath));
+  const relative = path.relative(repositoryRoot, canonicalLockPath);
+  if (relative === "" || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+    return existsSync(lockPath)
+      ? { source: readFileSync(lockPath, "utf8"), custody: "working-file" }
+      : undefined;
+  }
+
+  try {
+    return {
+      source: execFileSync("git", ["show", `HEAD:${relative.split(path.sep).join("/")}`], {
+        cwd: repositoryRoot,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+      }),
+      custody: "git-head",
+    };
+  } catch {
+    // A repository with no committed identity has no historical frontier. Treating
+    // an untracked or candidate-only file as history would make local experimentation
+    // irreversible before it ever entered custody.
+    return undefined;
+  }
+}

package/src/index.ts

@@ -254,7 +254,7 @@ export { repair, repairsOf, isRepairDecl, type RepairDecl, type RepairMatcher, t
 // NOT YET DEPLOYABLE (#57): the sealed wasm engine does not provide `nomos.read` yet, so
 // `nomos-compile` REFUSES law that references read() (a named compile error, never a runtime halt).
 // The captured-reads wave (task #58) wires the capability in and lifts the refusal.
-export { read } from "./read.js";
+export { read, readFrameworkDeclaredRows } from "./read.js";
 // RELEASE COHERENCE — standard OSGi Contract Namespace requirements derived from law shape.
 export {
   requiredKernelContracts,
@@ -319,12 +319,14 @@ export {
 // `nomosBirthGate` era key, never domain state) — spawns + self-validates the child after the offer admits.
 export {
   birth,
+  workspaceRole,
   workspaceNameForKey,
   WORKSPACE_NAME_SEP,
   birthKeyed,
   birthSingleton,
   birthInstance,
   type BirthRecipe,
+  type WorkspaceRole,
   type GenesisChainOrBuilder,
   type BusinessBirthDecl,
   type BusinessBirthSpec,
@@ -505,6 +507,8 @@ export {
   identityRelations,
   signerObject,
   SIGNER_RELATION,
+  ADMISSION_CHECKPOINT_PRINCIPAL,
+  enrollAdmissionCheckpointSigner,
   enrollSigner,
   // VA-core — SignerEpoch + self-bind enroll/revoke + the strict-increment & verified-enroll gates.
   SignerEpoch,
@@ -535,11 +539,26 @@ export {
 // the provider explicitly, without re-declaring the kernel's security schema in tenant code.
 export {
   AUTH_PROVIDER_ID,
+  AUTH_PROVIDER_KEY_ID_PREFIX,
+  AUTH_PROVIDER_CERTIFICATE_ID_PREFIX,
   AuthProvider,
+  AuthProviderKey,
+  AuthProviderCertificate,
+  authProviderPublicKey,
+  authProviderKeySet,
+  authProviderConfiguration,
+  type AuthProviderConfiguration,
+  type AuthProviderVerifyingConfiguration,
+  readAuthProviderConfiguration,
+  readAuthProviderVerifyingConfiguration,
+  writeAuthProviderConfiguration,
+  writeAuthProviderKeySet,
   seedAuthProvider,
   authProviderSeedBeforeWarrant,
   setAuthProvider,
   authProvider,
+  authProviderKeys,
+  authProviderCertificates,
 } from "./framework/auth_provider_law.js";
 // THE RECEIVING-GROUP HOLON — the framework-private shared signer roster + access manifest.
 export {