@githolon/dsl 0.108.0 → 0.108.2

package/src/intent.ts

@@ -19,6 +19,7 @@ import type { Ports } from "./ctx.js";
 import type { PlannedOp } from "./ops.js";
 import type { Field } from "./fields.js";
 import type { AggregateHandle } from "./aggregate.js";
+import type { QueryDecl } from "./query.js";
 import type {
   InvariantReadBinding,
   InvariantReadId,
@@ -45,6 +46,18 @@ export interface IntentStep<I = unknown, P = unknown> {
   readonly payload: (facts: I) => P;
 }
 
+/** One cross-workspace consequence authored by source law. The destination mapper supplies only
+ * the target workspace address; the nominal target directive and payload type remain sealed by the
+ * compiled source graph and its generated USDA encoder. */
+export interface WorkspaceEffectStep<I = unknown, P = unknown> {
+  readonly target: Directive<P>;
+  readonly destination:
+    | { readonly kind: "workspace"; readonly address: (facts: I) => string }
+    | { readonly kind: "verifiedParent" }
+    | { readonly kind: "verifiedSource" };
+  readonly payload: (facts: I) => P;
+}
+
 const PAYLOAD_TRACE_PATH = Symbol("nomos.intent.payload-trace-path");
 
 type PayloadTrace = {
@@ -175,6 +188,10 @@ export interface BusinessIntent<I = unknown> extends Directive<I> {
   readonly [INTENT_BRAND]: true;
   readonly [BUSINESS_BIRTH_POLICY_BINDING]?: (domains: readonly string[]) => void;
   readonly steps: readonly IntentStep<I, any>[];
+  readonly workspaceEffects: readonly WorkspaceEffectStep<I, any>[];
+  /** Law-selected proof for this exact public offer. Omitted means the ordinary session proof
+   * posture. Tenant callers never choose this at invocation time. */
+  readonly offerAuthenticationProof?: "enrolledDevice";
   /** The complete public business boundary. Runtime lowering still uses Directive.payloadSchema privately. */
   readonly contract: IntentContract<I>;
 }
@@ -311,6 +328,11 @@ class IntentBuilder<I> {
     private readonly id: string,
     private readonly contractDeclaration: IntentContractDeclaration<I>,
     private readonly steps: readonly IntentStep<I, any>[] = [],
+    private readonly workspaceEffects: readonly WorkspaceEffectStep<I, any>[] = [],
+    private readonly intentReads: readonly (string | QueryDecl)[] = [],
+    private readonly acceptsWorkspaceEffects = false,
+    private readonly intentRelationGate?: NonNullable<Directive["requiresRelationGate"]>,
+    private readonly offerAuthenticationProof?: "enrolledDevice",
   ) {}
 
   /** Add one private directive consequence to this business intent. */
@@ -324,7 +346,148 @@ class IntentBuilder<I> {
     return new IntentBuilder(this.id, this.contractDeclaration, [
       ...this.steps,
       { directive, payload },
-    ]);
+    ], this.workspaceEffects, this.intentReads, this.acceptsWorkspaceEffects, this.intentRelationGate, this.offerAuthenticationProof);
+  }
+
+  /** Author one exact nominal call into another workspace. The caller chooses only the target
+   * workspace address. Passing the target Directive object preserves the application type and lets
+   * the compiler bind its stable USDA identity; no operation string or host-selected mapping exists. */
+  directsWorkspace<P>(
+    target: Directive<P>,
+    effect: { readonly workspace: (facts: I) => string; readonly payload: (facts: I) => P },
+  ): IntentBuilder<I> {
+    if (isBusinessIntent(target) && target.acceptsWorkspaceEffectGate !== true) {
+      throw new Error(
+        `intent('${this.id}') workspace effect may target a public intent only when target law explicitly accepts workspace effects`,
+      );
+    }
+    return new IntentBuilder(this.id, this.contractDeclaration, this.steps, [
+      ...this.workspaceEffects,
+      {
+        target,
+        destination: { kind: "workspace", address: effect.workspace },
+        payload: effect.payload,
+      },
+    ], this.intentReads, this.acceptsWorkspaceEffects, this.intentRelationGate, this.offerAuthenticationProof);
+  }
+
+  /** Send an exact nominal request to this workspace's verified immediate parent. The route is
+   * resolved by the kernel from birth custody after the source intent admits; no workspace string
+   * enters the public payload or the JavaScript execution boundary. */
+  directsParentWorkspace<P>(
+    target: Directive<P>,
+    effect: { readonly payload: (facts: I) => P },
+  ): IntentBuilder<I> {
+    if (isBusinessIntent(target) && target.acceptsWorkspaceEffectGate !== true) {
+      throw new Error(
+        `intent('${this.id}') parent request may target a public intent only when target law explicitly accepts workspace effects`,
+      );
+    }
+    return new IntentBuilder(this.id, this.contractDeclaration, this.steps, [
+      ...this.workspaceEffects,
+      {
+        target,
+        destination: { kind: "verifiedParent" },
+        payload: effect.payload,
+      },
+    ], this.intentReads, this.acceptsWorkspaceEffects, this.intentRelationGate, this.offerAuthenticationProof);
+  }
+
+  /** Reply to the exact workspace whose carried effect invoked this intent. The destination is
+   * kernel-captured only after the source custody proof succeeds; it is neither public payload nor
+   * an authority subject. This keeps request/reply routing out of application data while target law
+   * still authorizes the verified workspace actor through its ordinary relation gate. */
+  repliesWorkspace<P>(
+    target: Directive<P>,
+    effect: { readonly payload: (facts: I) => P },
+  ): IntentBuilder<I> {
+    if (isBusinessIntent(target)) {
+      throw new Error(
+        `intent('${this.id}') workspace reply must target a private accepted directive, not another public intent`,
+      );
+    }
+    return new IntentBuilder(this.id, this.contractDeclaration, this.steps, [
+      ...this.workspaceEffects,
+      {
+        target,
+        destination: { kind: "verifiedSource" },
+        payload: effect.payload,
+      },
+    ], this.intentReads, this.acceptsWorkspaceEffects, this.intentRelationGate, this.offerAuthenticationProof);
+  }
+
+  /** Admit this public request only through the cross-workspace effect door. Authority remains the
+   * intent's ordinary static `.requires(..., {object:"workspace:self"})` relation gate. */
+  acceptsWorkspaceEffect(): IntentBuilder<I> {
+    return new IntentBuilder(
+      this.id,
+      this.contractDeclaration,
+      this.steps,
+      this.workspaceEffects,
+      this.intentReads,
+      true,
+      this.intentRelationGate,
+      this.offerAuthenticationProof,
+    );
+  }
+
+  /** Require this law-declared offer to prove the author through the workspace's enrolled device
+   * relation. Generated clients therefore withhold any session provider token for this intent;
+   * callers cannot downgrade or override the proof at invocation time. */
+  authenticatesWithEnrolledDevice(): IntentBuilder<I> {
+    return new IntentBuilder(
+      this.id,
+      this.contractDeclaration,
+      this.steps,
+      this.workspaceEffects,
+      this.intentReads,
+      this.acceptsWorkspaceEffects,
+      this.intentRelationGate,
+      "enrolledDevice",
+    );
+  }
+
+  /** Put the authorization requirement on the business action itself. This is the honest shape for
+   * a pure request/reply action that has no local storage consequence on which to hang a gate. */
+  requires(
+    relation: string,
+    options: { readonly object: "workspace:self" } = { object: "workspace:self" },
+  ): IntentBuilder<I> {
+    if (!relation.trim()) throw new Error(`intent('${this.id}') requires a non-empty relation`);
+    const gate = { relation, object: options.object };
+    if (this.intentRelationGate !== undefined && stable(this.intentRelationGate) !== stable(gate)) {
+      throw new Error(`intent('${this.id}') already has a different authorization gate`);
+    }
+    return new IntentBuilder(
+      this.id,
+      this.contractDeclaration,
+      this.steps,
+      this.workspaceEffects,
+      this.intentReads,
+      this.acceptsWorkspaceEffects,
+      gate,
+      this.offerAuthenticationProof,
+    );
+  }
+
+  /** Declare the bounded source reads used to author this business action's consequences.
+   * This belongs on the intent because a pure cross-workspace effect has no honest local
+   * directive on which to hang its captured-read contract. */
+  reads(...reads: readonly (string | QueryDecl)[]): IntentBuilder<I> {
+    const byKey = new Map<string, string | QueryDecl>();
+    for (const read of [...this.intentReads, ...reads]) {
+      byKey.set(typeof read === "string" ? `ref:${read}` : `query:${read.id}`, read);
+    }
+    return new IntentBuilder(
+      this.id,
+      this.contractDeclaration,
+      this.steps,
+      this.workspaceEffects,
+      [...byKey.values()],
+      this.acceptsWorkspaceEffects,
+      this.intentRelationGate,
+      this.offerAuthenticationProof,
+    );
   }
 
   /** Add one declared child birth as a consequence; Nomos owns the private genesis recipe. */
@@ -336,12 +499,12 @@ class IntentBuilder<I> {
     return new IntentBuilder(this.id, this.contractDeclaration, [
       ...this.steps,
       { directive, payload },
-    ]);
+    ], this.workspaceEffects, this.intentReads, this.acceptsWorkspaceEffects, this.intentRelationGate, this.offerAuthenticationProof);
   }
 
   /** Finish the intent and lower its directive graph to one atomic offer. */
   atomically(): BusinessIntent<I> {
-    if (this.steps.length === 0) {
+    if (this.steps.length === 0 && this.workspaceEffects.length === 0) {
       throw new Error(`intent('${this.id}') needs at least one directed consequence`);
     }
     const duplicate = this.steps.find(
@@ -364,7 +527,8 @@ class IntentBuilder<I> {
     }
 
     const primary = this.steps.find((step) => step.directive.birthsChild !== true)?.directive
-      ?? this.steps[0]!.directive;
+      ?? this.steps[0]?.directive
+      ?? this.workspaceEffects[0]!.target;
     const allOutputs: SecondaryOutput[] = [];
     for (const step of this.steps) {
       const candidate = step.directive;
@@ -392,19 +556,21 @@ class IntentBuilder<I> {
         ? { optional: true }
         : {}),
     });
-    const primaryOutput = composedOutput(
-      outputGroups.get(`${primary.marker}\0${primary.aggregateId}`) ?? [{
-        aggregateId: primary.aggregateId,
-        marker: primary.marker,
-      }],
-    );
+    const primaryOutput = this.steps.length === 0
+      ? undefined
+      : composedOutput(
+          outputGroups.get(`${primary.marker}\0${primary.aggregateId}`) ?? [{
+            aggregateId: primary.aggregateId,
+            marker: primary.marker,
+          }],
+        );
     const secondaryOutputs = [...outputGroups.values()]
       .map(composedOutput)
       .filter(
         (output) => !(output.aggregateId === primary.aggregateId && output.marker === primary.marker),
       );
     const inferredReturns = [
-      primary.aggregateId,
+      ...(primaryOutput === undefined ? [] : [primary.aggregateId]),
       ...secondaryOutputs.map((output) => output.aggregateId),
       ...birthSteps.flatMap((step) => {
         const aggregateId = (step.directive as BusinessBirthDirective).businessBirth?.aggregateId;
@@ -451,8 +617,14 @@ class IntentBuilder<I> {
         };
       }),
     );
+    const intentQueryReads = this.intentReads.filter(
+      (read): read is QueryDecl => typeof read !== "string",
+    );
+    const intentRefReads = this.intentReads.filter(
+      (read): read is string => typeof read === "string",
+    );
     const queryReads = dedupeBy(
-      this.steps.flatMap((step) => step.directive.declaredQueryReads ?? []),
+      [...intentQueryReads, ...this.steps.flatMap((step) => step.directive.declaredQueryReads ?? [])],
       (query) => query.id,
     );
     const foreignReads = dedupeBy(
@@ -472,7 +644,24 @@ class IntentBuilder<I> {
         }
       }
     }
-    const relationGate = oneStaticRelationGate(this.steps);
+    const inheritedRelationGate = oneStaticRelationGate(this.steps);
+    if (
+      this.intentRelationGate !== undefined &&
+      inheritedRelationGate !== undefined &&
+      stable(this.intentRelationGate) !== stable(inheritedRelationGate)
+    ) {
+      throw new Error(`intent('${this.id}') has conflicting intent and consequence authorization gates`);
+    }
+    const relationGate = this.intentRelationGate ?? inheritedRelationGate;
+    if (
+      this.acceptsWorkspaceEffects &&
+      (relationGate === undefined || relationGate.object !== "workspace:self" || relationGate.objectFrom !== undefined)
+    ) {
+      throw new Error(
+        `intent('${this.id}') .acceptsWorkspaceEffect() requires one static ` +
+          `.requires(relation, { object: "workspace:self" }) consequence gate`,
+      );
+    }
     const sourceTrusts = this.steps.flatMap((step) =>
       step.directive.businessSourceTrust === undefined
         ? []
@@ -520,16 +709,26 @@ class IntentBuilder<I> {
       // engine cannot rebuild its aggregate registry entry and silently drops
       // compound intents that also birth a child.
       ...(primary.aggregate === undefined ? {} : { aggregate: primary.aggregate }),
-      ...(primaryOutput.many === true
+      ...(primaryOutput?.many === true
         ? { outputCardinality: "many" as const }
-        : primaryOutput.optional === true
+        : primaryOutput?.optional === true
         ? { outputCardinality: "optional" as const }
         : {}),
       ...(secondaryOutputs.length > 0 ? { secondaryOutputs } : {}),
       payloadSchema: (birthSteps[0]?.directive.payloadSchema ?? this.contractDeclaration.accepts) as unknown as z.ZodType<I>,
       plan,
       steps,
-      declaredReads: [...new Set(this.steps.flatMap((step) => step.directive.declaredReads))].sort(),
+      workspaceEffects: this.workspaceEffects,
+      ...(this.offerAuthenticationProof === undefined
+        ? {}
+        : { offerAuthenticationProof: this.offerAuthenticationProof }),
+      ...(this.acceptsWorkspaceEffects ? { acceptsWorkspaceEffectGate: true as const } : {}),
+      declaredReads: [
+        ...new Set([
+          ...intentRefReads,
+          ...this.steps.flatMap((step) => step.directive.declaredReads),
+        ]),
+      ].sort(),
       ...(queryReads.length > 0 ? { declaredQueryReads: queryReads } : {}),
       ...(foreignReads.length > 0 ? { declaredForeignReads: foreignReads } : {}),
       declaredEmits: emits,
@@ -597,6 +796,7 @@ class IntentContractStep {
         refuses: Object.freeze([]),
       },
       steps: [step],
+      workspaceEffects: [],
       plan: (facts, ctx) => effect
         .plan(effect.payloadSchema.parse(facts), ctx)
         .map((op) => composePrimaryConsequenceOp(effect, op)),

package/src/law_check.ts

@@ -50,6 +50,7 @@ import { finishExtremum } from "./extremum.js";
 import { finishExists } from "./exists.js";
 import { clearDirectiveId } from "./clear_directive.js";
 import type { ForeignReadEdge } from "./attested_core.js";
+import { isBusinessIntent } from "./intent.js";
 
 /** One author-time finding — the gate refusal pre-fired at compile, or a courtesy note. */
 export interface Finding {
@@ -116,7 +117,7 @@ function probeDirective(dir: Directive<unknown>, where: string): ProbeResult | u
   const probePayload: Record<string, unknown> = { ...synth.value };
   for (const f of synth.autoStamped) probePayload[f] = "2026-01-01T00:00:00Z";
   if ((dir as { businessBirth?: unknown }).businessBirth !== undefined) {
-    probePayload[BUSINESS_BIRTH_SEED_PAYLOAD_FIELD] = "{}";
+    probePayload[BUSINESS_BIRTH_SEED_PAYLOAD_FIELD] = { ...probePayload };
   }
 
   const shapeKeys = new Set(Object.keys(safeShape(dir.payloadSchema as z.ZodTypeAny)));
@@ -141,6 +142,23 @@ function probeDirective(dir: Directive<unknown>, where: string): ProbeResult | u
       returned = dir.plan(tracked as never, deterministicPorts({ physical: 1, replica: 1, principal: "principal:probe" }));
       const drained: PlannedOp[] = [...__drainAuthoring(), ...(Array.isArray(returned) ? returned : [])];
       ops = drained.filter((o): o is FieldOp => (o as { kind?: string }).kind !== "strike");
+      if (isBusinessIntent(dir)) {
+        for (const effect of dir.workspaceEffects) {
+          // These two mappers are source law just as surely as the local plan. Run them against
+          // the same tracking payload so route/payload fields are not falsely diagnosed as dead.
+          // A captured read may deliberately refuse this isolated empty-state probe; that does not
+          // turn a successful local plan into a plan-return warning, but reads reached before the
+          // refusal are still drained and checked below.
+          try {
+            if (effect.destination.kind === "workspace") {
+              effect.destination.address(tracked as never);
+            }
+            effect.payload(tracked as never);
+          } catch {
+            // Inconclusive mapper branch on the synthesized fixture; runtime/generator proof remains.
+          }
+        }
+      }
       reads = __drainReads();
     } catch (e) {
       threw = true;

package/src/law_graph.ts

@@ -34,6 +34,7 @@ import {
   type LawLiteral,
   type LawValueMember,
   type LawValueConstraint,
+  type LawValueSemantic,
   type LawValueType,
 } from "./law_value_type.js";
 import { harvestPrincipalFlows } from "./wire_encode.js";
@@ -50,6 +51,7 @@ import {
 import { isNamespacedAggregate, qualifyReadProjectionType } from "./read_projection_namespace.js";
 import { assertFlowGateModule } from "./flow_gate.js";
 import type { InvariantReadBinding } from "./framework/workspace_invariant.js";
+import { OwnedCustodyValue } from "./framework/owned_custody_value.js";
 
 declare const LAW_SID: unique symbol;
 export type LawSid<K extends LawEntityKind> = string & { readonly [LAW_SID]: K };
@@ -195,7 +197,7 @@ const OWNED_AUTHORING_PAYLOAD_MEMBERS = [
   {
     name: OWNED_CUSTODY_PAYLOAD_FIELD,
     required: false,
-    value: { kind: "string", constraints: [] },
+    value: lowerLawValueType(OwnedCustodyValue.zod),
   },
   {
     name: OWNED_PREMINTED_RECORDS_PAYLOAD_FIELD,
@@ -378,7 +380,7 @@ export interface LawRelationPredicateNode {
   readonly expression: LawRelationPredicateExpression;
 }
 
-export type LawAnonymousValueTypeExpression =
+type LawAnonymousValueTypeShape =
   | {
       readonly kind: "string" | "number" | "integer";
       readonly constraints: readonly LawValueConstraint[];
@@ -398,6 +400,10 @@ export type LawAnonymousValueTypeExpression =
     }
   | { readonly kind: "recursive"; readonly value: LawStructuralRef<"value-type"> };
 
+export type LawAnonymousValueTypeExpression = LawAnonymousValueTypeShape & {
+  readonly semantic?: LawValueSemantic;
+};
+
 export interface LawAnonymousValueTypeNode {
   readonly kind: "structural";
   readonly structuralKind: "value-type";
@@ -587,6 +593,13 @@ export interface LawIntentNode {
   readonly foreignReads: readonly LawStructuralRef<"foreign-read">[];
   /** Attested cross-workspace contribution contracts which may propose this intent. */
   readonly workspaceRelations: readonly LawStructuralRef<"workspace-relation">[];
+  /** Exact signed parent-workspace effects may propose this call; authority is still `.requires`. */
+  readonly acceptsWorkspaceEffect: boolean;
+  /** Client proof selected by law for this exact public offer. Absence retains the ordinary
+   * session-credential posture. */
+  readonly offerAuthenticationProof?: "enrolledDevice";
+  /** Exact nominal target directives this source intent may author into another workspace. */
+  readonly directsWorkspaceEffects: readonly LawTargetRef<"intent">[];
   /** Zanzibar relation required to author this intent. */
   readonly authorization?: LawIntentAuthorization;
   readonly requiresHostCapabilities: readonly string[];
@@ -1172,6 +1185,16 @@ export function discoverLawGraph(
   ): LawTargetRef<"aggregate"> => {
     const local = aggregateByLabel.get(aggregateId);
     if (local !== undefined) return ref(local.node.entity);
+    if (
+      isBusinessIntent(intent) &&
+      intent.steps.length === 0 &&
+      intent.workspaceEffects.some((effect) => effect.target.aggregateId === aggregateId)
+    ) {
+      // A workspace-effect-only intent has no local aggregate consequence. Its nominal target
+      // aggregate belongs to the destination package; retain that as a dependency export instead
+      // of fabricating a local audit row merely to satisfy the older directive-shaped IR.
+      return { kind: "dependency-export", entityKind: "aggregate", label: aggregateId };
+    }
     const birth = (intent as { businessBirth?: { aggregateId?: unknown; domain?: unknown } }).businessBirth;
     if (birth?.aggregateId === aggregateId && typeof birth.domain === "string") {
       return { kind: "dependency-export", entityKind: "aggregate", label: aggregateId, domain: birth.domain };
@@ -1318,11 +1341,11 @@ export function discoverLawGraph(
     }
     payloadFieldsByIntent.set(intent.id, payloadFields);
     const outputs: Array<Pick<LawIntentEffectNode, "marker" | "aggregate" | "cardinality">> = [
-      {
+      ...(isBusinessIntent(intent) && intent.steps.length === 0 ? [] : [{
         marker: intent.marker,
         aggregate: intentAggregateTarget(intent, intent.aggregateId),
-        cardinality: intent.outputCardinality ?? "one",
-      },
+        cardinality: intent.outputCardinality ?? "one" as const,
+      }]),
       ...(intent.secondaryOutputs ?? []).map((output) => ({
         marker: output.marker,
         aggregate: aggregateRef(aggregateByLabel, output.aggregateId, `intent '${intent.id}'`),
@@ -1460,6 +1483,20 @@ export function discoverLawGraph(
       reads: [],
       foreignReads: [],
       workspaceRelations,
+      acceptsWorkspaceEffect: intent.acceptsWorkspaceEffectGate === true,
+      ...(isBusinessIntent(intent) && intent.offerAuthenticationProof !== undefined
+        ? { offerAuthenticationProof: intent.offerAuthenticationProof }
+        : {}),
+      directsWorkspaceEffects: (isBusinessIntent(intent) ? intent.workspaceEffects : []).map((effect) => {
+        const local = intentEntities.get(effect.target.id);
+        return local === undefined
+          ? {
+              kind: "dependency-export" as const,
+              entityKind: "intent" as const,
+              label: effect.target.id,
+            }
+          : ref(local);
+      }),
       requiresHostCapabilities: [...new Set(intent.declaredHostCapabilities ?? [])].sort(compareText),
       ...(resolvedField === undefined ? {} : { resolves: ref(resolvedField.entity) }),
       births: intent.birthsChild === true,
@@ -1667,6 +1704,14 @@ export function discoverLawGraph(
   for (const [index, intentNode] of intentNodes.entries()) {
     const declaration = intents.find((intent) => intent.id === intentNode.entity.label)!;
     const gate = declaration.requiresRelationGate;
+    if (declaration.acceptsWorkspaceEffectGate === true) {
+      if (gate === undefined || gate.object !== "workspace:self" || gate.objectFrom !== undefined) {
+        fail(
+          `intent '${declaration.id}' .acceptsWorkspaceEffect() requires a static ` +
+            `.requires(relation, { object: "workspace:self" }) authorization gate`,
+        );
+      }
+    }
     if (gate === undefined) continue;
     const objectType = gate.objectFrom?.recordType ?? gate.object.split(":", 1)[0]!;
     const exactLabel = gate.relation.includes("#") ? gate.relation : `${objectType}#${gate.relation}`;
@@ -2783,6 +2828,7 @@ export function lowerAnonymousValueGraph<K extends LawEntityKind>(
       case "recursive-ref":
         throw new Error("unreachable recursive-ref lowering");
     }
+    if (value.semantic !== undefined) expression = { ...expression, semantic: value.semantic };
     nodes.set(entity.id, {
       kind: "structural",
       structuralKind: "value-type",
@@ -2831,25 +2877,28 @@ export function lowerAnonymousContractFields(
 }
 
 function canonicalValueType(value: LawValueType): LawValueType {
+  const semantic = value.semantic === undefined ? {} : { semantic: value.semantic };
   switch (value.kind) {
     case "record":
       return {
+        ...semantic,
         kind: "record",
         fields: value.fields.map((field) => ({ ...field, value: canonicalValueType(field.value) }))
           .sort((a, b) => compareText(a.name, b.name)),
       };
     case "sum":
       return {
+        ...semantic,
         kind: "sum",
         options: value.options.map(canonicalValueType)
           .sort((a, b) => compareText(JSON.stringify(a), JSON.stringify(b))),
       };
     case "list":
-      return { kind: "list", element: canonicalValueType(value.element) };
+      return { ...semantic, kind: "list", element: canonicalValueType(value.element) };
     case "map":
-      return { kind: "map", value: canonicalValueType(value.value) };
+      return { ...semantic, kind: "map", value: canonicalValueType(value.value) };
     case "nullable":
-      return { kind: "nullable", value: canonicalValueType(value.value) };
+      return { ...semantic, kind: "nullable", value: canonicalValueType(value.value) };
     case "default":
       return { ...value, value: canonicalValueType(value.value) };
     case "recursive":

package/src/law_graph_usda.ts

@@ -159,12 +159,20 @@ function entityLabelOpinions(
   ];
 }
 
-/** First W4.4 vertical slice: render domain, aggregate, stored-field and reusable-contract opinions. */
-export function emitSparseLawGraphUsda(
+/** Exact path index produced while rendering one sparse law layer. Generated domain clients consume
+ * these paths in-memory during the same compile so their call USDA cannot drift from the law text.
+ * The index is compiler data, not a sidecar artifact. */
+export interface CompiledSparseLawGraphUsda {
+  readonly text: string;
+  readonly paths: ReadonlyMap<string, string>;
+}
+
+/** Render one sparse law layer and retain its exact identity-path projection for client codegen. */
+export function compileSparseLawGraphUsda(
   graph: LawGraph,
   logicalPath: string,
   closure: readonly LawGraph[] = [graph],
-): string {
+): CompiledSparseLawGraphUsda {
   const domain = graph.domain;
   const aggregates = graph.nodes.filter((node): node is LawAggregateNode => node.kind === "aggregate");
   const contracts = graph.nodes.filter((node): node is LawContractNode => node.kind === "contract");
@@ -675,7 +683,16 @@ export function emitSparseLawGraphUsda(
       (flow) => `w_${flow.entity.sid}`);
   }
   lines.push("        }", "    }", "}", "");
-  return lines.join("\n");
+  return { text: lines.join("\n"), paths: new Map(pathById) };
+}
+
+/** First W4.4 vertical slice: render domain, aggregate, stored-field and reusable-contract opinions. */
+export function emitSparseLawGraphUsda(
+  graph: LawGraph,
+  logicalPath: string,
+  closure: readonly LawGraph[] = [graph],
+): string {
+  return compileSparseLawGraphUsda(graph, logicalPath, closure).text;
 }
 
 function emitRetirement(retirement: LawRetirement, indent: number): string[] {
@@ -966,6 +983,12 @@ function emitIntent(
     `${pad}custom uniform bool nomos:active = true`,
     `${pad}custom uniform bool nomos:public = ${intent.public}`,
     `${pad}custom uniform string nomos:publicRoute = ${quote(intent.publicRoute ?? intent.entity.label)}`,
+    ...(intent.acceptsWorkspaceEffect
+      ? [`${pad}custom uniform bool nomos:acceptsWorkspaceEffect = true`]
+      : []),
+    ...(intent.offerAuthenticationProof === "enrolledDevice"
+      ? [`${pad}custom uniform token nomos:offerAuthenticationProof = "EnrolledDevice"`]
+      : []),
     `${pad}custom rel nomos:target = ${targets([intent.target], paths, resolveDependency)}`,
     `${pad}custom rel nomos:accepts = <${requiredPath(intent.accepts.id, paths)}>`,
     ...(intent.publicAccepts === undefined
@@ -975,6 +998,11 @@ function emitIntent(
   if (intent.reads.length > 0) {
     body.push(`${pad}custom rel nomos:reads = ${targets(intent.reads, paths, resolveDependency)}`);
   }
+  if ((intent.directsWorkspaceEffects ?? []).length > 0) {
+    body.push(
+      `${pad}custom rel nomos:directsWorkspaceEffect = ${targets(intent.directsWorkspaceEffects, paths, resolveDependency)}`,
+    );
+  }
   if (intent.authorization !== undefined) {
     body.push(
       `${pad}custom rel nomos:requires = ${targets([intent.authorization.relation], paths, resolveDependency)}`,
@@ -1471,7 +1499,9 @@ function emitAnonymousType(
 ): string[] {
   const pad = " ".repeat(indent);
   const expression = type.expression;
-  const body: string[] = [];
+  const body: string[] = expression.semantic === undefined
+    ? []
+    : emitAnonymousValueSemantic(expression.semantic, indent);
   switch (expression.kind) {
     case "string":
     case "number":
@@ -1605,6 +1635,44 @@ function emitAnonymousType(
   return body;
 }
 
+function emitAnonymousValueSemantic(
+  semantic: NonNullable<LawAnonymousValueTypeNode["expression"]["semantic"]>,
+  indent: number,
+): string[] {
+  const pad = " ".repeat(indent);
+  const body = [`${pad}custom uniform token nomos:semantic = ${quote(semantic.kind)}`];
+  switch (semantic.kind) {
+    case "sha256-digest":
+    case "git-object-id":
+      break;
+    case "branded-id":
+    case "unit":
+    case "value-object":
+      body.push(`${pad}custom uniform string nomos:semanticName = ${quote(semantic.name)}`);
+      break;
+    case "recipient":
+      body.push(`${pad}custom uniform token nomos:subject = ${quote(semantic.subject)}`);
+      break;
+    case "id-reference":
+    case "address-reference":
+      body.push(
+        `${pad}custom uniform token nomos:targetKind = ${quote(semantic.targetKind)}`,
+        `${pad}custom uniform string nomos:target = ${quote(semantic.target)}`,
+      );
+      break;
+    case "versioned-reference":
+      body.push(
+        `${pad}custom uniform token nomos:targetKind = ${quote(semantic.targetKind)}`,
+        `${pad}custom uniform string nomos:target = ${quote(semantic.target)}`,
+        `${pad}custom uniform token nomos:seriesKind = ${quote(semantic.seriesKind)}`,
+        `${pad}custom uniform string nomos:series = ${quote(semantic.series)}`,
+        `${pad}custom uniform string nomos:currentField = ${quote(semantic.currentField)}`,
+      );
+      break;
+  }
+  return body;
+}
+
 function emitAnonymousField(
   field: LawAnonymousValueFieldNode,
   types: ReadonlyMap<string, LawAnonymousValueTypeNode>,