@githolon/dsl 0.108.3 → 0.108.6

package/src/law_graph.ts

@@ -595,6 +595,8 @@ export interface LawIntentNode {
   readonly workspaceRelations: readonly LawStructuralRef<"workspace-relation">[];
   /** Exact signed parent-workspace effects may propose this call; authority is still `.requires`. */
   readonly acceptsWorkspaceEffect: boolean;
+  /** Recovery-only admission: the verified source workspace must be the target's exact birth parent. */
+  readonly acceptsVerifiedBirthParentRecovery: boolean;
   /** Client proof selected by law for this exact public offer. Absence retains the ordinary
    * session-credential posture. */
   readonly offerAuthenticationProof?: "enrolledDevice";
@@ -1484,6 +1486,8 @@ export function discoverLawGraph(
       foreignReads: [],
       workspaceRelations,
       acceptsWorkspaceEffect: intent.acceptsWorkspaceEffectGate === true,
+      acceptsVerifiedBirthParentRecovery:
+        intent.acceptsVerifiedBirthParentRecoveryGate === true,
       ...(isBusinessIntent(intent) && intent.offerAuthenticationProof !== undefined
         ? { offerAuthenticationProof: intent.offerAuthenticationProof }
         : {}),
@@ -1672,6 +1676,8 @@ export function discoverLawGraph(
       relation.label,
       namespacedRelationTypes,
       domainKey,
+      relation.global,
+      relation.authoredObjectType,
     ),
   ] as const));
   const relationPredicateNodes = new Map<LawStructuralSid<"relation-predicate">, LawRelationPredicateNode>();
@@ -1704,7 +1710,10 @@ export function discoverLawGraph(
   for (const [index, intentNode] of intentNodes.entries()) {
     const declaration = intents.find((intent) => intent.id === intentNode.entity.label)!;
     const gate = declaration.requiresRelationGate;
-    if (declaration.acceptsWorkspaceEffectGate === true) {
+    if (
+      declaration.acceptsWorkspaceEffectGate === true &&
+      declaration.acceptsVerifiedBirthParentRecoveryGate !== true
+    ) {
       if (gate === undefined || gate.object !== "workspace:self" || gate.objectFrom !== undefined) {
         fail(
           `intent '${declaration.id}' .acceptsWorkspaceEffect() requires a static ` +
@@ -1752,7 +1761,12 @@ export function discoverLawGraph(
       ...intentNode,
       authorization: {
         relation: candidates[0] === undefined
-          ? { kind: "dependency-export", entityKind: "relation", label: exactLabel }
+          ? {
+              kind: "dependency-export",
+              entityKind: "relation",
+              label: exactLabel,
+              domain: module.name,
+            }
           : ref(candidates[0].entity),
         object: authorizationObject,
         ...(objectFrom === undefined ? {} : { objectFrom }),
@@ -1771,7 +1785,12 @@ export function discoverLawGraph(
       fail(`aggregate '${aggregate.id}' read relation '${relationName}' is ambiguous across relation types`);
     }
     const readPolicy: LawTargetRef<"relation" | "policy"> = candidates[0] === undefined
-      ? { kind: "dependency-export", entityKind: "relation", label: relationLabel }
+      ? {
+          kind: "dependency-export",
+          entityKind: "relation",
+          label: relationLabel,
+          domain: module.name,
+        }
       : ref(candidates[0].entity);
     const entry = aggregateByLabel.get(aggregate.id)!;
     const updated = { ...entry.node, readPolicy };
@@ -3030,10 +3049,19 @@ function linkRelationAllowed(
   owner: string,
   namespacedTypes: ReadonlySet<string>,
   domainKey: string,
+  ownerIsGlobal: boolean,
+  ownerObjectType: string,
 ): LawAllowedSubject[] {
   return sortStructuralValues(allowed.map((subject): LawAllowedSubject => {
     if (subject.kind === "wildcard") return { kind: "wildcard" };
-    const subjectType = namespacedTypes.has(subject.type)
+    // A global relation over `workspace` may coexist with application-local
+    // `workspace` relations in the same domain. Its self-typed subjects are the
+    // same global object class, not the coincidentally named local class.
+    // Otherwise `workspace:self#child@workspace:<child>` compiles as allowing
+    // only `<domain>__workspace:*`, making the correctly proven workspace actor
+    // impossible to authorize.
+    const subjectType = namespacedTypes.has(subject.type) &&
+        !(ownerIsGlobal && subject.type === ownerObjectType)
       ? qualifyRelationType(domainKey, subject.type)
       : subject.type;
     if (subject.kind === "direct") return { kind: "direct", type: subjectType };

package/src/law_graph_usda.ts

@@ -986,6 +986,9 @@ function emitIntent(
     ...(intent.acceptsWorkspaceEffect
       ? [`${pad}custom uniform bool nomos:acceptsWorkspaceEffect = true`]
       : []),
+    ...(intent.acceptsVerifiedBirthParentRecovery
+      ? [`${pad}custom uniform token nomos:workspaceEffectAdmission = "VerifiedBirthParentRecovery"`]
+      : []),
     ...(intent.offerAuthenticationProof === "enrolledDevice"
       ? [`${pad}custom uniform token nomos:offerAuthenticationProof = "EnrolledDevice"`]
       : []),

package/src/package_config.ts

@@ -8,6 +8,7 @@ import {
   isApplicationHomeGenesis,
   type ApplicationHomeGenesis,
 } from "./application_home_genesis.js";
+import type { WorkspaceRole } from "./births.js";
 
 /**
  * One cohesive, vertically sliced business capability inside a domain.
@@ -73,6 +74,9 @@ export interface NomosPackageConfig {
    * Required for a published application: Nomos never invents a child-workspace allowance. */
   readonly application?: {
     readonly maxChildWorkspacesPerUser: number;
+    /** Target-owned roles granted at genesis to the cryptographically verified platform workspace.
+     * These are law constants, not caller or host input. */
+    readonly parentWorkspaceRoles?: readonly WorkspaceRole[];
     /** Tenant law which must hold from the application's first usable home state. Every entry is
      * an ordinary offer executed through the child's gate; omission declares no tenant ceremony. */
     readonly homeGenesis?: ApplicationHomeGenesis;
@@ -221,7 +225,18 @@ export function validateNomosPackageConfig(value: unknown): {
     ) {
       throw new Error(
         "application.homeGenesis must be declared with applicationHomeGenesis(...); " +
-          "Nomos will not reinterpret an untyped genesis recipe",
+        "Nomos will not reinterpret an untyped genesis recipe",
+      );
+    }
+    if (
+      config.application.parentWorkspaceRoles !== undefined &&
+      (!Array.isArray(config.application.parentWorkspaceRoles) ||
+        config.application.parentWorkspaceRoles.some(
+          (role) => typeof role !== "string" || !/^[A-Za-z][A-Za-z0-9_-]*$/.test(role),
+        ))
+    ) {
+      throw new Error(
+        "application.parentWorkspaceRoles must contain workspaceRole(...) declarations",
       );
     }
   }

package/src/read.ts

@@ -112,9 +112,9 @@ type ProjectionShape<F extends Record<string, Field>> = {
 
 /**
  * Decode one framework query's standard projected rows from the SAME aggregate field declarations
- * that authored its law. The only type assertion is at the TypeScript `Object.fromEntries` seam:
- * every runtime member is still obtained from `Field.zod`, so there is no second field-name/type list
- * and no unvalidated object crosses into a framework plan.
+ * that authored its law. Every runtime member is obtained from `Field.zod`, so there is no second
+ * field-name/type list and no unvalidated object crosses into a framework plan. Historical bool
+ * strings are lifted before that one generated schema validates the current projection.
  *
  * Historical captured reads may contain either the current `{ type, id, data }` projection envelope
  * or the earlier flat data row. Both pass through the identical derived schema before being returned.
@@ -133,18 +133,40 @@ export function readFrameworkDeclaredRows<
     );
   }
   const fields: Readonly<Record<string, Field>> = aggregate.fields;
-  const shape = Object.fromEntries(
-    Object.entries(fields).map(([name, field]) => [name, field.zod.optional()]),
-  ) as ProjectionShape<StoredFields<F>>;
-  const data = z.object(shape).strict() as z.ZodType<ReadModelRow<F>>;
-  // Recognize the envelope before validating its data. If the payload is malformed, validation must
-  // report the actual aggregate field (for example a historical `keys` member), not fall through and
-  // misdiagnose the envelope's `type`/`id` metadata as flat-row fields.
+  const shape: Record<string, z.ZodTypeAny> = {};
+  for (const name in fields) {
+    const field = fields[name]!;
+    const schema = field.zod;
+    if (typeof schema?.optional !== "function") {
+      throw new Error(
+        `framework read('${query.id}') field '${aggregate.id}.${name}' has no executable schema`,
+      );
+    }
+    shape[name] = schema.optional();
+  }
+  // A workspace is folded under the law carried by each historical intent, while a read is
+  // interpreted by the law that is current now. Retired fields therefore remain honest custody
+  // evidence but are not members of the current nominal projection. Strip those historical
+  // members at this typed boundary; validating them against today's schema would retroactively
+  // apply new law to old state and make ordinary evolution impossible.
+  const data = z.object(shape as ProjectionShape<StoredFields<F>>).strip() as z.ZodType<ReadModelRow<F>>;
+  // Recognize the envelope before validating its data. Known current members remain fully typed;
+  // historical members are deliberately outside the current projection above.
   const envelope = z.object({ data: z.unknown() }).passthrough();
   const row = z.union([envelope, z.unknown()])
     .transform((value) => {
       const wrapped = envelope.safeParse(value);
-      return wrapped.success ? wrapped.data.data : value;
+      const projected = wrapped.success ? wrapped.data.data : value;
+      if (projected === null || typeof projected !== "object" || Array.isArray(projected)) {
+        return projected;
+      }
+      const lifted = { ...(projected as Record<string, unknown>) };
+      for (const name in fields) {
+        if (fields[name]?.kind !== "bool") continue;
+        if (lifted[name] === "true") lifted[name] = true;
+        else if (lifted[name] === "false") lifted[name] = false;
+      }
+      return lifted;
     })
     .pipe(data);
   return z.array(row).parse(readFrameworkDeclared(query.id, args));

package/src/wire.ts

@@ -36,6 +36,7 @@ export interface WireHlc {
  * unit-variant bare string `"Git" | "External"`. */
 export type WireValue =
   | { Str: string }
+  | { Bool: boolean }
   | { NomosRef: { workspace: string; type: string; id: string } }
   | {
       VersionedNomosRef: {

package/src/wire_encode.ts

@@ -229,7 +229,7 @@ function encodeKernelValue(field: Field | undefined, value: unknown, op?: FieldO
   // a map's entry value is a leaf scalar.
   if (typeof value === "number" && Number.isInteger(value)) return { Int: value };
   if (typeof value === "string") return { Str: value };
-  if (typeof value === "boolean") return { Str: String(value) };
+  if (typeof value === "boolean") return { Bool: value };
   // Enum values are strings; refs are id strings — both handled above.
   // NAMED diagnostic (never `field '?'`): identify the aggregate + field + the shape we got, and — when the
   // field metadata was UNAVAILABLE (a sibling write whose target schema didn't reach the encoder) — say so,
@@ -249,8 +249,8 @@ function encodeKernelValue(field: Field | undefined, value: unknown, op?: FieldO
   const kindLabel = field.kind === "map" ? `map (${field.mapValueKind ?? "?"}-valued)` : field.kind;
   throw new Error(
     `${aggName}.${fieldName} is a '${kindLabel}' field${expected ? ` (value object ${expected})` : ""}, ` +
-      `but got ${describeShape(value)} (${JSON.stringify(value)}) — kernel scalars are Str | Int only. ` +
-      `A structured value needs a json/value-object field; a set/map needs its additive write.`,
+      `but got ${describeShape(value)} (${JSON.stringify(value)}) — kernel scalars are Str | Bool | Int. ` +
+      `A structured value needs a declared value-object field; a set/map needs its additive write.`,
   );
 }