@githolon/dsl 0.108.6 → 0.110.0

package/src/framework_call_definitions.ts

@@ -7,23 +7,38 @@
 
 import type { Directive } from "./directive.js";
 import { APPLICATION_HOME_DOMAIN } from "./framework/application_home_domain.js";
-import { seedAuthProvider, setAuthProvider } from "./framework/auth_provider_law.js";
+import {
+  adoptIdentityProviderWitness,
+  seedAuthProvider,
+  setAuthProvider,
+} from "./framework/auth_provider_law.js";
 import { seedBirthPolicy } from "./framework/birth_meter.js";
 import { installDomain, promoteDomain, rollbackDomain, stageDomain } from "./framework/domain_lifecycle.js";
 import { seedGenesis } from "./framework/genesis.js";
+import { seedFoundingPrincipal } from "./framework/founding_genesis.js";
 import {
   birthReceivingGroupForDomain,
   seedBirthAttestation,
   seedReceivingGroup,
   seedReceivingGroupPolicy,
-} from "./framework/home.js";
+} from "./framework/receiving_group.js";
 import {
   enrollAdmissionCheckpointSigner,
   enrollDelegation,
   enrollFirstDevice,
   enrollSigner,
+  revokeSigner,
 } from "./framework/signing_identity.js";
-import { grantAdmin } from "./framework/workspaces.js";
+import { enrollDevice, revokeDevice } from "./framework/principal_enrollment.js";
+import {
+  birthChild,
+  grantAdmin,
+  grantEnroller,
+  grantLawOperator,
+  revokeEnroller,
+  revokeLawOperator,
+  setCloudPolicy,
+} from "./framework/workspaces.js";
 
 export interface FixedFrameworkCallDefinition {
   readonly group: "identity" | "governance" | "lifecycle" | "birth";
@@ -48,8 +63,20 @@ export const fixedFrameworkCallDefinitions: readonly FixedFrameworkCallDefinitio
   { group: "identity", kind: "enrollSigner", directive: enrollSigner, dartBirth: true, requiredApplicationHome: true },
   { group: "identity", kind: "enrollAdmissionCheckpointSigner", directive: enrollAdmissionCheckpointSigner, routeId: "enrollAdmissionCheckpointSigner", requiredApplicationHome: true },
   { group: "identity", kind: "setAuthProvider", directive: setAuthProvider, requiredApplicationHome: true },
+  { group: "identity", kind: "adoptIdentityProviderWitness", directive: adoptIdentityProviderWitness, requiredApplicationHome: true },
   { group: "identity", kind: "birthReceivingGroup", directive: receivingGroupBirth, dartBirth: true, requiredApplicationHome: true },
+  // D22: first keys by an enroller, and a principal revoking its own key.
+  { group: "identity", kind: "enrollDevice", directive: enrollDevice },
+  { group: "identity", kind: "revokeDevice", directive: revokeDevice },
+  { group: "identity", kind: "revokeSigner", directive: revokeSigner },
   { group: "governance", kind: "grantAdmin", directive: grantAdmin },
+  // D15/D22: who installs law and who enrols a scope's first keys.
+  { group: "governance", kind: "grantLawOperator", directive: grantLawOperator },
+  { group: "governance", kind: "revokeLawOperator", directive: revokeLawOperator },
+  { group: "governance", kind: "grantEnroller", directive: grantEnroller },
+  { group: "governance", kind: "revokeEnroller", directive: revokeEnroller },
+  { group: "governance", kind: "birthChild", directive: birthChild },
+  { group: "governance", kind: "setCloudPolicy", directive: setCloudPolicy },
   { group: "lifecycle", kind: "installDomain", directive: installDomain },
   { group: "lifecycle", kind: "stageDomain", directive: stageDomain },
   { group: "lifecycle", kind: "promoteDomain", directive: promoteDomain },
@@ -59,6 +86,8 @@ export const fixedFrameworkCallDefinitions: readonly FixedFrameworkCallDefinitio
   { group: "birth", kind: "enrollDelegation", directive: enrollDelegation, dartBirth: true },
   { group: "birth", kind: "seedBirthAttestation", directive: seedBirthAttestation, dartBirth: true },
   { group: "birth", kind: "seedGenesis", directive: seedGenesis, dartBirth: true },
+  // D22 token-free genesis: a root's founding step (a child's is authored by its parent's birth recipe).
+  { group: "birth", kind: "seedFoundingPrincipal", directive: seedFoundingPrincipal },
   { group: "birth", kind: "seedReceivingGroupPolicy", directive: seedReceivingGroupPolicy, dartBirth: true },
   { group: "birth", kind: "seedReceivingGroup", directive: seedReceivingGroup, dartBirth: true },
 ];

package/src/generated_client_bundle_boundary.ts

@@ -0,0 +1,97 @@
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import type { Metafile } from "esbuild";
+
+/** The only executable dependency generated applications may link at runtime. */
+export const APPLICATION_CONTRACT_MODULE = "@githolon/runtime/application";
+
+/** Protobuf does not export package.json; locate it from its resolved entry. */
+export function protobufPackageRoot(entry: string): string {
+  let directory = dirname(realpathSync(entry));
+  while (true) {
+    const manifest = join(directory, "package.json");
+    if (existsSync(manifest) && JSON.parse(readFileSync(manifest, "utf8")).name === "@bufbuild/protobuf") return directory;
+    const parent = dirname(directory);
+    if (parent === directory) throw new Error(`Cannot locate Protobuf package owning ${entry}`);
+    directory = parent;
+  }
+}
+
+/**
+ * Check the actual bundler dependency graph, including transitive imports.
+ * A source-name blacklist cannot detect a renamed or copied runtime helper.
+ * The compiler owns the entry and operation codecs; Protobuf owns wire codecs;
+ * the platform links the shared application contract as an external module.
+ * No directory of tenant or compiler helpers is implicitly trusted.
+ */
+export function assertGeneratedClientBundleBoundary(
+  metafile: Metafile,
+  options: {
+    readonly workingDirectory: string;
+    readonly generatedEntry: string;
+    readonly operationCodec: string;
+    readonly protobufPackageRoot: string;
+  },
+): void {
+  const absolute = (path: string): string =>
+    isAbsolute(path) ? path : resolve(options.workingDirectory, path);
+  const codec = realpathSync(absolute(options.operationCodec));
+  const protobufRoot = realpathSync(absolute(options.protobufPackageRoot));
+  const insideProtobuf = (path: string): boolean => {
+    const child = relative(protobufRoot, path);
+    return child !== ".." && !child.startsWith(`..${sep}`) && !isAbsolute(child);
+  };
+  /**
+   * An import esbuild reports as external either survives into the output — where the
+   * output check below refuses it — or was never linked at all. TypeScript elides an
+   * import whose bindings the module never uses, and esbuild reports an elided import
+   * as external because it never resolved it. Law that declares no directives uses
+   * neither wire codec, so its generated application elides both; refusing that is
+   * refusing a capability nothing links. The two codecs are already permitted as
+   * bundled inputs above, so permit their unlinked names here for the same reason.
+   */
+  const permittedExternal = (input: string, specifier: string): boolean => {
+    if (specifier === APPLICATION_CONTRACT_MODULE) return true;
+    if (/^@bufbuild\/protobuf(?:\/.+)?$/.test(specifier)) return true;
+    if (specifier.startsWith("./") || specifier.startsWith("../")) {
+      const candidate = resolve(dirname(absolute(input)), specifier.replace(/\.js$/, ".ts"));
+      if (existsSync(candidate) && realpathSync(candidate) === codec) return true;
+    }
+    return false;
+  };
+  const violations: string[] = [];
+  let entryFound = false;
+  for (const [input, metadata] of Object.entries(metafile.inputs)) {
+    if (absolute(input) === absolute(options.generatedEntry)) {
+      entryFound = true;
+    } else {
+      // Resolve symlinks as well: putting a runtime link next to generated
+      // Protobuf must not turn it into a permitted compiler artifact.
+      const path = realpathSync(absolute(input));
+      if (path !== codec && !insideProtobuf(path)) {
+        violations.push(`bundled implementation: ${input}`);
+      }
+    }
+    for (const imported of metadata.imports) {
+      if (imported.external && !permittedExternal(input, imported.path)) {
+        violations.push(`external capability: ${input} -> ${imported.path}`);
+      }
+    }
+  }
+  if (!entryFound) violations.push(`missing generated entry: ${options.generatedEntry}`);
+  // Check output imports too: plugins may introduce externals after resolving
+  // the input graph. Only the same narrow public contract may survive linking.
+  for (const output of Object.values(metafile.outputs)) {
+    for (const imported of output.imports) {
+      if (imported.external && imported.path !== APPLICATION_CONTRACT_MODULE) {
+        violations.push(`output capability: ${imported.path}`);
+      }
+    }
+  }
+  if (violations.length > 0) {
+    throw new Error(
+      `Generated application crossed the shared-runtime boundary:\n${violations.join("\n")}\n` +
+      "Move lifecycle implementation to Peer Office; generated artifacts may contain only their vocabulary and wire codecs.",
+    );
+  }
+}

package/src/generated_client_names.ts

@@ -52,6 +52,7 @@ const GENERATED_APPLICATION_MEMBERS = new Set([
   "watchStatus",
   "currentUser",
   "refresh",
+  "receivedAccess",
 ]);
 
 /** Refuse tenant callables that would overwrite a generated application concept. */

package/src/identity_usda.ts

@@ -348,6 +348,17 @@ function emitEntity(
       ? []
       : [`${inner}string[] nomos:was = ${stringList(entity.priorLabels)}`]),
     ...(entity.generation === 0 ? [] : [`${inner}int nomos:generation = ${entity.generation}`]),
+    ...(entity.operationFieldWire === undefined
+      ? []
+      : [
+          `${inner}string nomos:protobufCanonicalWireKey = ${quote(entity.operationFieldWire.protobuf.canonical)}`,
+          ...(entity.operationFieldWire.protobuf.aliases === undefined ||
+          entity.operationFieldWire.protobuf.aliases.length === 0
+            ? []
+            : [
+                `${inner}string[] nomos:protobufWireAliases = ${stringList(entity.operationFieldWire.protobuf.aliases)}`,
+              ]),
+        ]),
     // STATUS IS THE POINT OF THIS LAYER — a retired entity is retained forever so its sid can
     // never be handed to a later declaration wearing the same label. "active" is the fallback.
     ...(entity.status === "active" ? [] : [`${inner}token nomos:status = ${quote(entity.status)}`]),
@@ -367,6 +378,8 @@ const NOMOS_ENTITY_SCHEMA = [
   "    string[] nomos:was = []",
   "    int nomos:generation = 0",
   '    token nomos:status = "active"',
+  '    string nomos:protobufCanonicalWireKey = ""',
+  "    string[] nomos:protobufWireAliases = []",
   "}",
 ].join("\n");
 
@@ -393,6 +406,8 @@ function readEntityForest(
     const { kind, sid } = lawEntityKeyParts(prim.name);
     const declaredParent = prim.attrs.parent as string | undefined;
     const was = prim.attrs.was;
+    const protobufCanonicalWireKey = prim.attrs.protobufCanonicalWireKey as string | undefined;
+    const protobufWireAliases = prim.attrs.protobufWireAliases;
     out[prim.name] = {
       kind,
       sid,
@@ -405,6 +420,18 @@ function readEntityForest(
       ...(Array.isArray(was) && was.length > 0 ? { priorLabels: was as string[] } : {}),
       generation: Number(prim.attrs.generation ?? 0),
       status: (prim.attrs.status ?? "active") as LawIdentityStatus,
+      ...(protobufCanonicalWireKey === undefined || protobufCanonicalWireKey === ""
+        ? {}
+        : {
+            operationFieldWire: {
+              protobuf: {
+                canonical: protobufCanonicalWireKey,
+                ...(Array.isArray(protobufWireAliases) && protobufWireAliases.length > 0
+                  ? { aliases: protobufWireAliases as string[] }
+                  : {}),
+              },
+            },
+          }),
     };
     readEntityForest(prim.children, prim.name, out);
   }

package/src/index.ts

@@ -9,6 +9,19 @@
 // ONE import for a domain file: `z` (payload schemas) rides along with the DSL, so
 // authors never juggle a separate zod dependency (or risk a second zod instance).
 export { z } from "zod";
+export {
+  custodyPlacement,
+  custodyPlacementRule,
+  custodyRemote,
+  isCustodyPlacementDeclaration,
+  peerClass,
+  type CustodyPlacementDeclaration,
+  type CustodyPlacementRule,
+  type CustodyRemote,
+  type CustodyRetention,
+  type KernelResidency,
+  type PeerClass,
+} from "./custody_placement.js";
 export {
   defineDomain,
   defineFeature,
@@ -89,6 +102,7 @@ export {
 // the generated Dart class, and the `nomosValueObjects` IR descriptor. A VO lowers to a
 // single Lww-class json-object leaf (wholesale-replace merge — no per-subfield merge).
 // `geo.*` are the RFC 7946 geometry VOs (pair `geo.point()` with `spatial(...)`).
+export { indexedVariant, type IndexedVariant } from "./indexed_variant.js";
 export {
   valueObject,
   variant,
@@ -138,6 +152,7 @@ export {
 } from "./principal_evidence.js";
 export {
   FirstWriterWins,
+  FirstWriterCandidates,
   Lww,
   LwwCausal,
   LwwBy,
@@ -170,6 +185,27 @@ export {
   type FormerField,
   type Retirement,
 } from "./evolution.js";
+export {
+  authenticationProvider,
+  authenticatesWith,
+  principalsOf,
+  principalScopeOf,
+  sovereignPrincipal,
+  consolePrincipals,
+  CONSOLE_PRINCIPAL_SCOPE,
+  custodianPrincipals,
+  CUSTODIAN_PRINCIPAL_SCOPE,
+  userPrincipals,
+  USER_PRINCIPAL_SCOPE,
+  RESERVED_PROVIDER_SCOPES,
+  MemberAuthenticationKind,
+  type AuthenticationProviderKind,
+  type AuthenticationProviderRef,
+  type EnrolledProviderRef,
+  type SovereignProviderRef,
+  type MemberAuthentication,
+  type AuthenticatedMember,
+} from "./member_authentication.js";
 export {
   intent,
   language,
@@ -177,6 +213,7 @@ export {
   isApplicationLanguage,
   authenticatesWithEnrolledDevice,
   repairsChildAuthenticationFor,
+  assertRepairsChildAuthentication,
   childAuthenticationRecoveryAggregateId,
   applicationLanguageOf,
   executableDirectivesForLanguage,
@@ -192,8 +229,21 @@ export {
   workspaceSharing,
   type WorkspaceSharingOptions,
   type WorkspaceSharingPolicy,
-  type WorkspaceSharingReceipt,
+  workspaceSharingRedemptionFacts,
 } from "./workspace_sharing.js";
+export {
+  publishesWorkspaceAccess,
+  recordReceivedWorkspaceAccess,
+  receivedWorkspaceAccess,
+  WorkspaceAccessPublication,
+  WorkspaceAccessReceipt,
+  workspaceAccessPublication,
+  workspaceAccessReceipt,
+  receivedAccessObject,
+  RECEIVED_ACCESS_RELATION,
+  type WorkspaceAccessChange,
+} from "./framework/workspace_access.js";
+export { receivedWorkspaceAccessIsForOwner } from "./framework/receiving_group.js";
 export {
   recipient,
   recipientMetaOf,
@@ -257,7 +307,11 @@ export { repair, repairsOf, isRepairDecl, type RepairDecl, type RepairMatcher, t
 // NOT YET DEPLOYABLE (#57): the sealed wasm engine does not provide `nomos.read` yet, so
 // `nomos-compile` REFUSES law that references read() (a named compile error, never a runtime halt).
 // The captured-reads wave (task #58) wires the capability in and lifts the refusal.
-export { read, readFrameworkDeclaredRows } from "./read.js";
+export {
+  read,
+  readFrameworkDeclaredRows,
+  readFrameworkAttestedRows,
+} from "./read.js";
 // RELEASE COHERENCE — standard OSGi Contract Namespace requirements derived from law shape.
 export {
   requiredKernelContracts,
@@ -275,8 +329,10 @@ export {
 export {
   trustSource,
   trustParent,
+  trustAuthorizedSource,
   PARENT_TRUST_SENTINEL,
   foreignQuery,
+  attestedReadSubject,
   trustPolicy,
   fromPayload,
   NomosSourceFrontier,
@@ -290,6 +346,7 @@ export {
   type FromPayloadRef,
   type ForeignReadEdge,
   type ForeignQueryRef,
+  type AttestedReadSubjectRef,
 } from "./attested.js";
 // ATTESTATION RECEIPTS + EQUIVOCATION ACCOUNTABILITY (slice B stage 3 — §5): the source-side
 // sealed receipt batch + the reader-side proven-dishonor fact, both ordinary law the kernel's
@@ -512,7 +569,14 @@ export {
   signerObject,
   SIGNER_RELATION,
   ADMISSION_CHECKPOINT_PRINCIPAL,
+  admissionCheckpointSigner,
+  readAdmissionCheckpointSigners,
+  writeAdmissionCheckpointSigners,
+  type AdmissionCheckpointSigner,
   enrollAdmissionCheckpointSigner,
+  revokeAdmissionCheckpointSigner,
+  lastAdmissionCheckpointSignerRemains,
+  enrollAdmissionCheckpointSignerDirect,
   enrollSigner,
   // VA-core — SignerEpoch + self-bind enroll/revoke + the strict-increment & verified-enroll gates.
   SignerEpoch,
@@ -533,6 +597,10 @@ export {
   signerDelegationRecoveryEvidence,
   SIGNER_DELEGATION_PREFIX,
   signerDelegationInstanceId,
+  signerDelegationCertificateId,
+  signerDelegationEvidenceIsRetained,
+  enrollDelegationRetainsEvidence,
+  enrollFirstDeviceRetainsEvidence,
   enrollDelegation,
   signerDelegationByUser,
   readSignerDelegationRecoveryEvidence,
@@ -542,13 +610,36 @@ export {
   type SignerEpochHandle,
   type SignerAuthority,
 } from "./framework/signing_identity.js";
-// THE WORKSPACE VERIFIER is framework-owned law-state. Ordinary birth/onboarding flows compose and
-// inherit it automatically; these exports exist for governance and acceptance laws that need to author
-// the provider explicitly, without re-declaring the kernel's security schema in tenant code.
+// D22 — the kernel is the authentication: the enroller relation, the enrolled scope's first-key
+// lane and the sovereign scope's self-certification (framework/principal_enrollment.ts).
+export {
+  principalScopeRelations,
+  principalScopeObject,
+  PRINCIPAL_SCOPE_OBJECT_TYPE,
+  enrollDevice,
+  revokeDevice,
+  sovereignSelfCertification,
+} from "./framework/principal_enrollment.js";
+export { PRINCIPAL_SCOPE_ENROLLER_RELATION, WORKSPACE_OPERATOR_RELATION } from "./framework/governance_relations.js";
+// D22 — roles a parent delegates into the children its principals found, and the tenant-declared
+// post-birth lane an enroller uses to carry later changes into existing children.
+export {
+  delegatedRoles,
+  grantDelegatedRole,
+  revokeDelegatedRole,
+  ADOPT_DELEGATED_ROLES_DIRECTIVE,
+  SEED_DELEGATED_ROLES_DIRECTIVE,
+  type DelegatedRolesLaw,
+} from "./framework/delegated_roles.js";
+export { workspaceOperatorRelations } from "./framework/workspaces.js";
+// THE WORKSPACE VERIFIER is framework-owned law-state. Birth copies the current verifier once;
+// later epochs arrive through ordinary authority-gated adoption offers.
 export {
   AUTH_PROVIDER_ID,
   AUTH_PROVIDER_KEY_ID_PREFIX,
   AUTH_PROVIDER_CERTIFICATE_ID_PREFIX,
+  AUTH_PROVIDER_AUTHORITY,
+  AUTH_PROVIDER_EPOCH_CONSUMER,
   AuthProvider,
   AuthProviderKey,
   AuthProviderCertificate,
@@ -564,11 +655,89 @@ export {
   seedAuthProvider,
   authProviderSeedBeforeWarrant,
   setAuthProvider,
+  adoptIdentityProviderWitness,
+  identityProviderSourceTrust,
+  authProviderSourceRelations,
+  authProviderEpochConsumerRelations,
   authProvider,
   authProviderKeys,
   authProviderCertificates,
 } from "./framework/auth_provider_law.js";
-// THE RECEIVING-GROUP HOLON — the framework-private shared signer roster + access manifest.
+// CHILD AUTHENTICATION — the framework's verifier-epoch serve/accept pair and the workspace-parameterised
+// child repair, auto-composed into every business-birth domain (`framework/child_authentication.ts`). The
+// ids and evidence shapes are exported for tests, tooling and the Peer Office desk; nothing here is a
+// tenant-authored verb.
+export {
+  ACCEPT_PARENT_AUTH_PROVIDER_EPOCH_ID,
+  ACCEPT_CHILD_AUTHENTICATION_RECOVERY_ID,
+  ACCEPT_CHILD_AUTHENTICATION_RECOVERY_EFFECT_ID,
+  SERVE_AUTH_PROVIDER_EPOCH_ID,
+  PULL_PARENT_AUTH_PROVIDER_EPOCH_ID,
+  REPAIR_CHILD_AUTHENTICATION_ID,
+  childAuthenticationRecoveryEvidence,
+  childAuthenticationRepairInput,
+  acceptParentAuthProviderEpoch,
+  acceptChildAuthenticationRecovery,
+  serveAuthProviderEpoch,
+  pullParentAuthProviderEpoch,
+  repairChildAuthentication,
+  repairChildAuthenticationBindsPrincipal,
+  type ChildAuthenticationRecoveryEvidence,
+  type ChildAuthenticationRepairInput,
+} from "./framework/child_authentication.js";
+// THE PARENT-DIRECTED MODEL TRANSITION (`architecture/parent_directed_model_transition.md`) — a tenant
+// platform holds full model authority over its subtree, so its direction and the child's attested-parent
+// acceptor are framework law. The ids and shapes are exported for the SAME reason as child authentication:
+// the operator CLI addresses the direction by its real id and classifies a child by looking the acceptor
+// up in that child's own framework route surface. One fact, one representation — nothing here is a
+// tenant-authored verb, and a copied string literal in the CLI would be the drift this prevents.
+export {
+  ACCEPT_PARENT_MODEL_TRANSITION_ID,
+  DIRECT_CHILD_MODEL_TRANSITION_ID,
+  RECORD_PARENT_MODEL_TRANSITION_ID,
+  SEAT_PARENT_MODEL_AUTHORITY_ID,
+  PARENT_MODEL_TRANSITION_AGGREGATE,
+  ParentModelTransition,
+  acceptParentModelTransition,
+  directChildModelTransition,
+  directChildModelTransitionInput,
+  modelTransitionDirection,
+  parentModelTransitionAggregateId,
+  parentModelTransitionEvidence,
+  type DirectChildModelTransitionInput,
+  type ModelTransitionDirection,
+  type ParentModelTransitionEvidence,
+} from "./framework/model_transition.js";
+// THE MODEL-AUTHORITY SELF-SEAT (same design, §9) — this workspace's own model-lifecycle holder names
+// who else may install law here. The ids and the record's constant identity are exported for the same
+// reason as child authentication's: the Dart codegen binds the directive by its real id and the
+// Reception reads the seat record by the constant id below. One fact, one representation; a string
+// literal downstream would be the drift this prevents.
+export {
+  SEAT_MODEL_AUTHORITY_ID,
+  SEAT_DECLARED_MODEL_AUTHORITY_ID,
+  RECORD_MODEL_AUTHORITY_SEAT_ID,
+  PARENT_MODEL_AUTHORITY_SEAT_AGGREGATE,
+  PARENT_MODEL_AUTHORITY_SEAT_ID,
+  ParentModelAuthoritySeat,
+  seatModelAuthority,
+} from "./framework/model_authority_repair.js";
+// THE RECEIVING GROUP'S DEVICE-RECOVERY DOOR. Exported for the same reason as the seat ids above:
+// the operator CLI resolves this directive in a workspace's own installed law by its REAL id, and a
+// string literal in a second package is exactly the drift one representation prevents.
+export { RECOVER_RECEIVING_GROUP_DEVICE_ID } from "./framework/receiving_group_recovery.js";
+export {
+  SEAT_INHERITED_MODEL_AUTHORITY_ID,
+  inheritedModelAuthorityEvidence,
+  seatInheritedModelAuthority,
+  type InheritedModelAuthorityEvidence,
+  type InheritedModelAuthorityHolder,
+} from "./framework/model_authority_seed.js";
+/** The compiler-owned domain every framework birth installs into every born workspace — the one
+ * domain that carries the direction, the acceptor and the genesis seat. */
+export { APPLICATION_HOME_DOMAIN } from "./framework/application_home_domain.js";
+// THE RECEIVING-GROUP HOLON — the framework-private shared signer roster + access manifest
+// (`framework/receiving_group.ts`; `birthHome` is the deprecated alias of `birthReceivingGroup`).
 export {
   SharedWithMe,
   recordShare,
@@ -595,6 +764,7 @@ export {
   receivingGroupRevocationFollowsPolicy,
   receivingGroupNameOf,
   birthReceivingGroup,
+  birthHome,
   // THE PEER-SOVEREIGN ROOT-OF-TRUST (the BirthAttestation cert chain).
   BirthAttestation,
   BirthAttestationLink,
@@ -603,7 +773,7 @@ export {
   seedBirthAttestation,
   birthAttestation,
   parentAttestedBirth,
-} from "./framework/home.js";
+} from "./framework/receiving_group.js";
 // METERED BIRTH (slice A — architecture/metered_birth_and_attested_reads.md): the structural birth
 // record + the parent-local birth quota + the allowance governance surface. The record/quota STRUCTURE
 // is auto-ensured on every `.births()` law (zero tenant code); these exports are the GOVERNANCE half a
@@ -693,6 +863,7 @@ export {
   capabilityPascal,
   CAPABILITY_NAME_RE,
   type CapabilityDecl,
+  type CapabilityExecutionPolicy,
 } from "./framework/capability.js";
 export {
   DOMAIN_INSTALLATION_PHASES,
@@ -731,6 +902,8 @@ export {
 } from "./framework/repair.js";
 export {
   workspaceInvariant,
+  accept,
+  reject,
   readRef,
   readSet,
   idItem,
@@ -853,16 +1026,14 @@ export {
 // authoring tools, but never pull generator implementations into the runtime namespace evaluated by
 // every kernel sandbox.
 export type { DomainModule } from "./codegen_dart.js";
-// SHAPE COMPATIBILITY (#72) — the structural contract a client negotiates with a workspace
-// by, instead of the law hash. Pure + deterministic; the editor/CI mirror imports these.
+// Compiler-side compatibility graph extraction. The generated USDA requirement is judged
+// authoritatively by the kernel Compatibility Desk; JavaScript does not mirror that judge.
 export {
   domainInterface,
-  compatible,
   type DomainInterface,
-  type CompatVerdict,
   type DirectivePayloadShape,
   type AggregateReadShape,
-} from "./shape_compat.js";
+} from "./compatibility_graph.js";
 // The OPTIONAL Graphviz `.dot` ER-diagram emitter (off-by-default presentation projection,
 // turned on by the `--emit-dot` compiler flag). Pure `DomainModule -> string`, deterministic;
 // NOT part of the domain identity. Barrel-safe (no node:* imports), so the engine bundle can

package/src/indexed_variant.ts

@@ -0,0 +1,83 @@
+import type { EnumType } from "./enum_type.js";
+import type { ValueObject } from "./value_object.js";
+
+/** An explicit relationship between a runtime discriminator and a nominal value sum.
+ * This declaration has no I/O or lifecycle. It supplies the same compatibility
+ * predicate to authored law and the generated client binding constructors.
+ */
+export interface IndexedVariant {
+  readonly __isIndexedVariant: true;
+  readonly name: string;
+  readonly discriminator: EnumType<readonly [string, ...string[]]>;
+  readonly value: ValueObject<{ type: string }>;
+  readonly cases: Readonly<Record<string, string>>;
+  accepts(kind: string, value: unknown): boolean;
+}
+
+export function indexedVariant<
+  const E extends readonly [string, ...string[]],
+  V extends { type: string },
+>(
+  name: string,
+  spec: {
+    discriminator: EnumType<E>;
+    value: ValueObject<V>;
+    cases: { readonly [K in E[number]]: V["type"] };
+  },
+): IndexedVariant {
+  if (!/^[A-Z][A-Za-z0-9]*$/u.test(name)) {
+    throw new Error(`indexedVariant: '${name}' must be an UpperCamelCase identifier`);
+  }
+  const arms = spec.value.descriptor.union;
+  if (arms === undefined) throw new Error(`indexedVariant '${name}' requires a variant value`);
+  const cases: Record<string, string> = {};
+  for (const kind of spec.discriminator.values) {
+    if (!/^[a-z][A-Za-z0-9]*$/u.test(kind) ||
+      ["binding", "editable", "edit", "rejection", "unsupported", "shapeMismatch", "definitionChanged", "invalidInput"].includes(kind)) {
+      throw new Error(`indexedVariant '${name}': '${kind}' must be a non-reserved lowerCamelCase identifier`);
+    }
+    const arm = (spec.cases as Record<string, string>)[kind];
+    if (arm === undefined || !Object.hasOwn(arms, arm)) {
+      throw new Error(`indexedVariant '${name}': '${kind}' must explicitly name an arm of ${spec.value.name}`);
+    }
+    cases[kind] = arm;
+  }
+  for (const kind of Object.keys(spec.cases)) {
+    if (!Object.hasOwn(cases, kind)) {
+      throw new Error(`indexedVariant '${name}': unknown discriminator '${kind}'`);
+    }
+  }
+  Object.freeze(cases);
+  return Object.freeze({
+    __isIndexedVariant: true as const,
+    name,
+    discriminator: spec.discriminator,
+    value: spec.value,
+    cases,
+    accepts(kind: string, value: unknown): boolean {
+      const arm = cases[kind];
+      if (!Object.hasOwn(cases, kind)) return false;
+      if (value === null) return true;
+      return typeof value === "object" && value !== null &&
+        (value as { type?: unknown }).type === arm && spec.value.zod.safeParse(value).success;
+    },
+  });
+}
+
+/** Discover across original modules, before spread-merge can hide a conflicting declaration. */
+export function indexedVariantsOf(modules: readonly Record<string, unknown>[]): IndexedVariant[] {
+  const byName = new Map<string, IndexedVariant>();
+  for (const module of modules) {
+    for (const value of Object.values(module)) {
+      if (value === null || typeof value !== "object" ||
+        (value as { __isIndexedVariant?: unknown }).__isIndexedVariant !== true) continue;
+      const declaration = value as IndexedVariant;
+      const prior = byName.get(declaration.name);
+      if (prior !== undefined && prior !== declaration) {
+        throw new Error(`indexedVariant '${declaration.name}' has multiple declarations`);
+      }
+      byName.set(declaration.name, declaration);
+    }
+  }
+  return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
+}