@githolon/dsl 0.108.6 → 0.110.0

package/src/member_authentication.ts

@@ -0,0 +1,302 @@
+/** Authentication declared by one exact law member (identity target model, D7 and D22).
+ *
+ * `authenticatesWith(member, provider)` is per directive (and per read): it names the one provider
+ * whose principals may author that member. The kernel is the authentication (D22): an intent is
+ * admitted as principal P iff it is signed by a key K with `identity:P#signer@key:<sha256(K)>` active in
+ * parent state, and P's scope is the scope the member's provider declares. A principal is spelled
+ * `<scope>:<subject>` — exactly its Zanzibar subject, so `.requires` checks it verbatim. A provider is
+ * one of two kinds, and the kind is law; law declares nothing else about it (no issuer, no key, no
+ * token):
+ *
+ * - **enrolled** — a tenant with a login provider. The first key of a principal is written by a
+ *   principal holding `principalScope:<scope>#enroller` (`enrollDevice`,
+ *   `framework/principal_enrollment.ts`), after it verified the provider's token off the ledger.
+ * - **sovereign** — no login provider. The principal is `<scope>:<sha256(root public key)>`; the root
+ *   key certifies its own first signer tuple (`sovereignSelfCertification`). Losing the root is losing
+ *   the identity.
+ *
+ * Every further device of either kind is enrolled by proof of possession (`enrollSigner`).
+ *
+ * A legacy form — `{ scope, identitySha256 }` — pins a workspace-local provider row by digest. It is the
+ * provider-token machinery the target model deletes (`auth_provider_law.ts`, build-order step 4); it
+ * stays only until that deletion, and new law must not use it.
+ */
+
+const authenticationProviderBrand: unique symbol = Symbol(
+  "nomos.authentication-provider",
+);
+
+export type AuthenticationProviderKind = "enrolled" | "sovereign";
+
+interface ProviderBase {
+  readonly [authenticationProviderBrand]: true;
+  /** The provider scope: the principal namespace, and the Zanzibar subject type of its principals. */
+  readonly scope: string;
+}
+
+export interface EnrolledProviderRef extends ProviderBase {
+  readonly kind: "enrolled";
+}
+
+export interface SovereignProviderRef extends ProviderBase {
+  readonly kind: "sovereign";
+}
+
+/** @deprecated The provider-row-by-digest form; deleted with `auth_provider_law.ts` (step 4). */
+export interface LegacySelectedProviderRef extends ProviderBase {
+  readonly kind: "legacySelected";
+  /** Immutable provider identity, independent of issuer URL and verification-key rotation. */
+  readonly identitySha256: string;
+}
+
+export type AuthenticationProviderRef =
+  | EnrolledProviderRef
+  | SovereignProviderRef
+  | LegacySelectedProviderRef;
+
+export enum MemberAuthenticationKind {
+  SelectedProvider = "selectedProvider",
+  EnrolledDevice = "enrolledDevice",
+}
+
+export type MemberAuthentication =
+  | Readonly<{
+      kind: MemberAuthenticationKind.SelectedProvider;
+      provider: AuthenticationProviderRef;
+    }>
+  | Readonly<{
+      kind: MemberAuthenticationKind.EnrolledDevice;
+    }>;
+
+export interface AuthenticatedMember {
+  readonly authentication?: MemberAuthentication;
+}
+
+const scopePattern = /^[A-Za-z][A-Za-z0-9._-]{0,127}$/;
+const digestPattern = /^[0-9a-f]{64}$/;
+/** A principal's subject within its scope: a bounded token that can never re-open the `type:id` split. */
+const principalSubjectPattern = /^[A-Za-z0-9][A-Za-z0-9_.:/-]{0,255}$/;
+
+/**
+ * Subject types the kernel or framework already owns. A provider's principals are Zanzibar subjects
+ * of type `<scope>`, so a scope named after one of these would let a provider's principals pose as
+ * framework subjects (`user:…`, `key:…`) in every relation that allows them. `principalScope` is the
+ * object type of the enroller relation (D22), reserved for the same reason.
+ */
+export const RESERVED_PROVIDER_SCOPES: readonly string[] = Object.freeze([
+  "key",
+  "identity",
+  "workspace",
+  "principalScope",
+]);
+
+/**
+ * The scope of the principals console.nomos.cafe enrolls: operators who install law, and hosted
+ * enrollers acting for tenants who do not run their own backend (D18, D22). Framework vocabulary: the
+ * framework's own governance relations (`workspace:self#operator`, `principalScope:<s>#enroller`) allow
+ * these principals, so a law that names this scope must declare it `enrolled` — a sovereign `console`
+ * scope would let anyone mint a principal the framework treats as a console principal.
+ */
+export const CONSOLE_PRINCIPAL_SCOPE = "console";
+
+/**
+ * The scope of custodian principals: the sovereign identities that found a universe's root (identity
+ * target model D22, token-free genesis). A custodian principal is `custodian:<sha256hex(root key)>` and
+ * certifies itself — nobody verified a login at root, and root must not depend on the console of its own
+ * descendant nomos.cafe, so a sovereign key is the one honest identity a root's founding admin can have.
+ * Framework vocabulary like {@link CONSOLE_PRINCIPAL_SCOPE}, and its mirror: a law naming this scope must
+ * declare it `sovereign`. Being a custodian principal grants nothing by itself; anyone can self-certify
+ * one, and authority is only ever an admin/operator/enroller tuple naming it.
+ */
+export const CUSTODIAN_PRINCIPAL_SCOPE = "custodian";
+
+/**
+ * The scope of an application's signed-in users: `user:<login provider subject>` (for CO2, the Firebase
+ * uid). Framework-owned like {@link CONSOLE_PRINCIPAL_SCOPE}: the principal spelling is the framework's
+ * existing `user:` Zanzibar subject, so every relation that already allows `user()` holds these
+ * principals unchanged. It is enrolled — an enroller holding `principalScope:user#enroller` (the console's
+ * hosted enroller) writes each user's first key after verifying the login token off the ledger — and only
+ * framework law declares it ({@link userPrincipals}); a tenant naming the scope itself is refused, so no
+ * tenant can declare `user` sovereign or re-spell who a user is.
+ */
+export const USER_PRINCIPAL_SCOPE = "user";
+
+function requireScope(scope: string): string {
+  if (typeof scope !== "string" || !scopePattern.test(scope)) {
+    throw new Error("authentication provider scope must be a bounded identifier");
+  }
+  return scope;
+}
+
+function requireKindScope(scope: string): string {
+  requireScope(scope);
+  if (RESERVED_PROVIDER_SCOPES.includes(scope)) {
+    throw new Error(
+      `authentication provider scope '${scope}' is reserved: its principals would pose as framework '${scope}:' subjects`,
+    );
+  }
+  return scope;
+}
+
+/** Declare an enrolled provider: an enroller of this scope writes each principal's first key. */
+export function authenticationProvider(input: {
+  readonly kind: "enrolled";
+  readonly scope: string;
+}): EnrolledProviderRef;
+/** Declare a sovereign provider: principals are their own root keys. */
+export function authenticationProvider(input: {
+  readonly kind: "sovereign";
+  readonly scope: string;
+}): SovereignProviderRef;
+/** @deprecated Pins a workspace provider row by digest; deleted in build-order step 4. */
+export function authenticationProvider(input: {
+  readonly scope: string;
+  readonly identitySha256: string;
+}): LegacySelectedProviderRef;
+export function authenticationProvider(input: {
+  readonly kind?: AuthenticationProviderKind;
+  readonly scope: string;
+  readonly identitySha256?: string;
+}): AuthenticationProviderRef {
+  if (input.kind === undefined) {
+    requireScope(input.scope);
+    if (typeof input.identitySha256 !== "string" || !digestPattern.test(input.identitySha256)) {
+      throw new Error(
+        "authentication provider identitySha256 must be 64 lowercase hexadecimal characters",
+      );
+    }
+    return Object.freeze({
+      [authenticationProviderBrand]: true as const,
+      kind: "legacySelected" as const,
+      scope: input.scope,
+      identitySha256: input.identitySha256,
+    });
+  }
+  if (input.kind !== "enrolled" && input.kind !== "sovereign") {
+    throw new Error(
+      `unknown authentication provider kind '${String(input.kind)}': a provider is "enrolled" or "sovereign" (D22)`,
+    );
+  }
+  for (const option of Object.keys(input)) {
+    if (option !== "kind" && option !== "scope") {
+      throw new Error(
+        `a ${input.kind} provider declares only its kind and scope; '${option}' is not law (D22: no token, issuer or key reaches a ledger)`,
+      );
+    }
+  }
+  const scope = requireKindScope(input.scope);
+  if (scope === USER_PRINCIPAL_SCOPE) {
+    throw new Error(
+      `scope '${USER_PRINCIPAL_SCOPE}' is the framework's enrolled user principals; use userPrincipals, never declare it`,
+    );
+  }
+  if (scope === CONSOLE_PRINCIPAL_SCOPE && input.kind !== "enrolled") {
+    throw new Error(
+      `scope '${CONSOLE_PRINCIPAL_SCOPE}' is the console's enrolled principals; it cannot be ${input.kind}`,
+    );
+  }
+  if (scope === CUSTODIAN_PRINCIPAL_SCOPE && input.kind !== "sovereign") {
+    throw new Error(
+      `scope '${CUSTODIAN_PRINCIPAL_SCOPE}' is the framework's sovereign custodian principals; it cannot be ${input.kind}`,
+    );
+  }
+  return Object.freeze({
+    [authenticationProviderBrand]: true as const,
+    kind: input.kind,
+    scope,
+  }) as EnrolledProviderRef | SovereignProviderRef;
+}
+
+/** The console's principals (`console:<subject>`), enrolled by console.nomos.cafe. */
+export const consolePrincipals: EnrolledProviderRef = authenticationProvider({
+  kind: "enrolled",
+  scope: CONSOLE_PRINCIPAL_SCOPE,
+});
+
+/** The framework's enrolled user principals (`user:<subject>`): see {@link USER_PRINCIPAL_SCOPE}. The one
+ *  declaration of the scope; built here because the public constructor refuses it to tenant law. */
+export const userPrincipals: EnrolledProviderRef = Object.freeze({
+  [authenticationProviderBrand]: true as const,
+  kind: "enrolled" as const,
+  scope: USER_PRINCIPAL_SCOPE,
+});
+
+/** Custodian principals (`custodian:<sha256hex(root key)>`), sovereign: see {@link CUSTODIAN_PRINCIPAL_SCOPE}. */
+export const custodianPrincipals: SovereignProviderRef = authenticationProvider({
+  kind: "sovereign",
+  scope: CUSTODIAN_PRINCIPAL_SCOPE,
+});
+
+/** Is `principal` a well-formed `<scope>:<subject>` principal of a non-reserved scope? Returns its scope. */
+export function principalScopeOf(principal: string): string | undefined {
+  if (typeof principal !== "string") return undefined;
+  const colon = principal.indexOf(":");
+  if (colon <= 0) return undefined;
+  const scope = principal.slice(0, colon);
+  const subject = principal.slice(colon + 1);
+  if (!scopePattern.test(scope) || RESERVED_PROVIDER_SCOPES.includes(scope)) return undefined;
+  if (!principalSubjectPattern.test(subject)) return undefined;
+  return scope;
+}
+
+/** The principal a sovereign scope assigns to a root key: `<scope>:<sha256hex(root public key)>`. */
+export function sovereignPrincipal(provider: SovereignProviderRef, rootKeyHash: string): string {
+  if (provider?.[authenticationProviderBrand] !== true || provider.kind !== "sovereign") {
+    throw new Error("sovereignPrincipal takes a sovereign provider declared with authenticationProvider");
+  }
+  if (!digestPattern.test(rootKeyHash)) {
+    throw new Error("a sovereign principal's subject is the lowercase sha256 hex of its root public key");
+  }
+  return `${provider.scope}:${rootKeyHash}`;
+}
+
+/** Brand check shared by the framework's provider-taking helpers. */
+export function isAuthenticationProvider(value: unknown): value is AuthenticationProviderRef {
+  return (value as { [authenticationProviderBrand]?: unknown } | undefined)?.[authenticationProviderBrand] === true;
+}
+
+/**
+ * The principals a provider authenticates, as the subject class a relation may store: every
+ * `<scope>:<subject>` principal. Sugar for `object(provider.scope)`, so `allow: [principalsOf(members)]`
+ * lets the relation hold exactly that provider's principals and no one else's.
+ */
+export function principalsOf(provider: EnrolledProviderRef | SovereignProviderRef): {
+  readonly kind: "direct";
+  readonly type: string;
+} {
+  if (provider?.[authenticationProviderBrand] !== true) {
+    throw new Error("principalsOf takes a provider declared with authenticationProvider");
+  }
+  if (provider.kind !== "enrolled" && provider.kind !== "sovereign") {
+    throw new Error("principalsOf takes an enrolled or sovereign provider, not a legacy provider row");
+  }
+  return Object.freeze({ kind: "direct" as const, type: provider.scope });
+}
+
+/** Bind a finished read or directive to one exact provider dependency. */
+export function authenticatesWith<
+  T extends object & AuthenticatedMember,
+>(member: T, provider: AuthenticationProviderRef): T & {
+  readonly authentication: Readonly<{
+    kind: MemberAuthenticationKind.SelectedProvider;
+    provider: AuthenticationProviderRef;
+  }>;
+} {
+  if (member.authentication !== undefined) {
+    throw new Error("law member already has an authentication selection");
+  }
+  if (provider?.[authenticationProviderBrand] !== true) {
+    throw new Error("authenticatesWith takes a provider declared with authenticationProvider");
+  }
+  return Object.freeze({
+    ...member,
+    authentication: Object.freeze({
+      kind: MemberAuthenticationKind.SelectedProvider,
+      provider,
+    }),
+  });
+}
+
+export function enrolledDeviceAuthentication(): MemberAuthentication {
+  return Object.freeze({ kind: MemberAuthenticationKind.EnrolledDevice });
+}

package/src/null_meta.ts

@@ -10,7 +10,7 @@
  * `nullSemantic` (`"forbid"` default · `"explicit-empty"` · `"nullable"`), the required
  * `nullReason` documentation for the null-admitting semantics, and `isClearable` for the
  * explicit-clear lane. This module is the ONE reader of those props for the 5 codegen surfaces
- * (TS/Dart clients, the Dart bridge client, proof synthesis, openapi) — so a shape change lands
+ * (TS/Dart clients, the Dart session client, proof synthesis, openapi) — so a shape change lands
  * in one place, and the read is a structural cast (the props are additive/optional on `Field`,
  * so a field carrying none is byte-identical to a pre-feature field).
  */

package/src/openusd_compiled_layer.ts

@@ -0,0 +1,132 @@
+import { execFile } from "node:child_process";
+import { readFileSync, rmSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { promisify } from "node:util";
+
+const execFileAsync = promisify(execFile);
+
+export interface OpenUsdFlattenRequest {
+  readonly usdcat: string;
+  readonly sourcePath: string;
+  readonly populationMask?: readonly string[];
+  readonly description: string;
+}
+
+export interface OpenUsdEncodeRequest {
+  readonly usdcat: string;
+  readonly usda: string;
+  readonly temporaryDirectory: string;
+  readonly temporaryStem: string;
+  readonly description: string;
+}
+
+function stderrOf(error: unknown): string {
+  if (typeof error !== "object" || error === null || !("stderr" in error))
+    return "";
+  return String((error as { readonly stderr?: unknown }).stderr ?? "").trim();
+}
+
+/** Ask stock OpenUSD to compose one source stage into canonical, inspectable USDA. */
+export async function flattenOpenUsdToUsda(
+  request: OpenUsdFlattenRequest
+): Promise<string> {
+  const args = ["--flatten", "--skipSourceFileComment"];
+  const populationMask =
+    request.populationMask === undefined
+      ? undefined
+      : [...new Set(request.populationMask)]
+          .sort((left, right) =>
+            left.length === right.length
+              ? left.localeCompare(right)
+              : left.length - right.length
+          )
+          .filter(
+            (candidate, index, paths) =>
+              !paths
+                .slice(0, index)
+                .some(
+                  (ancestor) =>
+                    candidate === ancestor || candidate.startsWith(`${ancestor}/`)
+                )
+          )
+          .sort();
+  if (
+    populationMask !== undefined &&
+    populationMask.length > 0
+  ) {
+    args.push("--mask", populationMask.join(","));
+  }
+  args.push(request.sourcePath);
+  try {
+    const { stdout: usda } = await execFileAsync(request.usdcat, args, {
+      encoding: "utf8",
+      maxBuffer: 256 * 1024 * 1024,
+    });
+    if (!usda.startsWith("#usda 1.0")) {
+      throw new Error(
+        `stock OpenUSD returned a non-USDA ${request.description}`
+      );
+    }
+    // `--skipSourceFileComment` drops usdcat's leading comment, but the flattened layer's `doc`
+    // still records the ABSOLUTE root-layer path ("Generated from Composed Stage of root layer
+    // /Users/…/build/bootstrap/…"). That is the checkout location, not law: identical sources
+    // hashed differently on every machine (four checkouts, four stage-zero law hashes on
+    // 2026-09-07) and the kernel release could never reproduce the reviewed candidate. Keep the
+    // sentence and the layer's file name; drop the directory.
+    return usda.replace(
+      /(Generated from Composed Stage of root layer )(?:[^"\n]*\/)?([^"\n/]+)/g,
+      "$1$2"
+    );
+  } catch (error) {
+    const stderr = stderrOf(error);
+    const maskDetail =
+      populationMask === undefined
+        ? ""
+        : ` (population mask: ${populationMask.length} irredundant paths, ${populationMask.join(",").length} characters)`;
+    throw new Error(
+      `stock OpenUSD refused the canonical typed USDA closure while compiling ${request.description}${maskDetail}` +
+        (stderr.length === 0 ? "" : `: ${stderr}`),
+      { cause: error }
+    );
+  }
+}
+
+/** Encode already-composed USDA as OpenUSD's reversible binary crate representation. */
+export async function encodeOpenUsdUsdc(
+  request: OpenUsdEncodeRequest
+): Promise<Uint8Array> {
+  const sourcePath = path.join(
+    request.temporaryDirectory,
+    `.${request.temporaryStem}.tmp.usda`
+  );
+  const destinationPath = path.join(
+    request.temporaryDirectory,
+    `.${request.temporaryStem}.tmp.usdc`
+  );
+  try {
+    writeFileSync(sourcePath, request.usda);
+    await execFileAsync(request.usdcat, ["-o", destinationPath, sourcePath], {
+      maxBuffer: 64 * 1024 * 1024,
+    });
+    const usdc = readFileSync(destinationPath);
+    if (
+      usdc.length < 8 ||
+      new TextDecoder().decode(usdc.subarray(0, 8)) !== "PXR-USDC"
+    ) {
+      throw new Error(
+        `stock OpenUSD returned a non-USDC ${request.description}`
+      );
+    }
+    return usdc;
+  } catch (error) {
+    const stderr = stderrOf(error);
+    throw new Error(
+      `stock OpenUSD could not encode ${request.description} as USDC` +
+        (stderr.length === 0 ? "" : `: ${stderr}`),
+      { cause: error }
+    );
+  } finally {
+    rmSync(sourcePath, { force: true });
+    rmSync(destinationPath, { force: true });
+  }
+}

package/src/operation_contract_check.ts

@@ -0,0 +1,31 @@
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+
+/** Validate the emitted law, not a second in-memory interpretation of the DSL.
+ * Cached results accelerate compilation only; they never enter custody or stand
+ * in for the kernel's admission decision. A changed checker invalidates hits.
+ */
+export function checkOperationContracts(lawPath: string, descriptorPath: string, compilerRoot: string, cacheRoot: string): void {
+  const checker = path.join(compilerRoot, 'operation_contract_check.mjs');
+  const artifact = path.join(compilerRoot, 'assets', 'operation-contract.wasm');
+  if (!existsSync(artifact)) throw new Error('Nomos compiler is missing its bundled operation contract checker; rebuild/reinstall the compiler package');
+  const key = createHash('sha256').update('nomos.operation-contract-check.v1\0')
+    .update(readFileSync(artifact)).update(readFileSync(checker)).update(readFileSync(lawPath))
+    .update(readFileSync(descriptorPath)).digest('hex');
+  const cache = path.join(cacheRoot, 'node_modules', '.cache', 'nomos', 'operation-contracts');
+  const receipt = path.join(cache, `${key}.ok`);
+  if (existsSync(receipt)) return;
+  try {
+    execFileSync(process.execPath, [checker, path.resolve(lawPath), path.resolve(descriptorPath)], {
+      encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: 8 * 1024 * 1024,
+    });
+  } catch (error) {
+    const detail = error instanceof Error && 'stderr' in error && error.stderr
+      ? String(error.stderr) : String(error);
+    throw new Error(`Operation contract validation failed:\n${detail}`);
+  }
+  mkdirSync(cache, { recursive: true });
+  writeFileSync(receipt, 'validated by the bundled kernel contract checker\n');
+}

package/src/ordered_read.ts

@@ -217,7 +217,8 @@ export function first(id: string): TypelessFirst {
  * `n` MUST be ≥ 1. `n = 1` is equivalent to `first` but a distinct declaration id.
  */
 export function take(id: string, n: number): TypelessTake {
-  if (n < 1) throw new Error(`take(${id}, ${n}): n must be ≥ 1`);
+  if (!Number.isInteger(n) || n < 1 || n > 0xffff_ffff)
+    throw new Error(`take(${id}, ${n}): n must be an integer from 1 through 4294967295`);
   return {
     id,
     limit: n,

package/src/package_config.ts

@@ -8,7 +8,10 @@ import {
   isApplicationHomeGenesis,
   type ApplicationHomeGenesis,
 } from "./application_home_genesis.js";
-import type { WorkspaceRole } from "./births.js";
+import {
+  RECEIVING_GROUP_RECOVERY_POLICIES,
+  type ReceivingGroupRecoveryPolicy,
+} from "./framework/receiving_group.js";
 
 /**
  * One cohesive, vertically sliced business capability inside a domain.
@@ -74,12 +77,17 @@ export interface NomosPackageConfig {
    * Required for a published application: Nomos never invents a child-workspace allowance. */
   readonly application?: {
     readonly maxChildWorkspacesPerUser: number;
-    /** Target-owned roles granted at genesis to the cryptographically verified platform workspace.
-     * These are law constants, not caller or host input. */
-    readonly parentWorkspaceRoles?: readonly WorkspaceRole[];
     /** Tenant law which must hold from the application's first usable home state. Every entry is
      * an ordinary offer executed through the child's gate; omission declares no tenant ceremony. */
     readonly homeGenesis?: ApplicationHomeGenesis;
+    /** THE RECEIVING-GROUP DECLARATION. A verified person's receiving group is the framework's identity
+     * anchor; the application declares how that anchor behaves as DATA, never by authoring lifecycle law.
+     * `recovery` is the posture the anchor is BORN with (`"guardian-quorum"` is the framework default;
+     * `"platform-identity-provider"` lets the attested parent platform re-seat a replacement device).
+     * Era rule: an application that declares nothing is byte-identical to one compiled before this key. */
+    readonly receivingGroup?: {
+      readonly recovery?: ReceivingGroupRecoveryPolicy;
+    };
   };
   /** Separately installed law required at runtime; USDA composition arcs do not belong here. */
   readonly dependencies?: readonly RuntimePackageDependency[];
@@ -228,15 +236,28 @@ export function validateNomosPackageConfig(value: unknown): {
         "Nomos will not reinterpret an untyped genesis recipe",
       );
     }
-    if (
-      config.application.parentWorkspaceRoles !== undefined &&
-      (!Array.isArray(config.application.parentWorkspaceRoles) ||
-        config.application.parentWorkspaceRoles.some(
-          (role) => typeof role !== "string" || !/^[A-Za-z][A-Za-z0-9_-]*$/.test(role),
-        ))
-    ) {
+    const receivingGroup = config.application.receivingGroup;
+    if (receivingGroup !== undefined) {
+      if (receivingGroup === null || typeof receivingGroup !== "object" || Array.isArray(receivingGroup)) {
+        throw new Error("application.receivingGroup must be an object declaration");
+      }
+      if (
+        receivingGroup.recovery !== undefined &&
+        !(RECEIVING_GROUP_RECOVERY_POLICIES as readonly string[]).includes(receivingGroup.recovery as string)
+      ) {
+        throw new Error(
+          `application.receivingGroup.recovery must be one of ${RECEIVING_GROUP_RECOVERY_POLICIES.join(", ")}; ` +
+            "Nomos will not reinterpret an unknown recovery posture",
+        );
+      }
+    }
+    // RETIRED 2026-09-11 (receiving_group_lifecycle.md, cut 1 item 4): the role a receiving group grants
+    // its birthing platform is the framework's own `authProviderAuthority`, seated by construction. A tenant
+    // restating (or extending) it is refused loudly rather than silently ignored.
+    if ("parentWorkspaceRoles" in config.application) {
       throw new Error(
-        "application.parentWorkspaceRoles must contain workspaceRole(...) declarations",
+        "application.parentWorkspaceRoles is retired: the framework seats authProviderAuthority for the " +
+          "verified platform on every receiving group it births; delete the key",
       );
     }
   }

package/src/package_dependencies.ts

@@ -81,6 +81,7 @@ export function packageContractUsda(input: {
     '    def NomosPackage "Package"',
     "    {",
     `        custom uniform string nomos:name = ${usdaString(input.packageName)}`,
+    '        custom uniform token nomos:operationContract = "nomos.protobuf.v1"',
     `        custom uniform string[] nomos:domains = ${usdaStringArray([...input.exportedDomains].sort())}`,
     ...(targets.length > 0
       ? [

package/src/plan_source_slice.ts

@@ -53,7 +53,33 @@ export class PlanSourceSliceProgram {
         };
       }
     }
-    this.#program = ts.createProgram({ rootNames: rootNames.map(normalized), options });
+    // The slicer only ever retains declarations inside the slice roots, so the program needs
+    // exactly those files: no lib.d.ts, no @types, and no descent into dependency packages.
+    // Resolving `@githolon/dsl`/`zod` from a tenant module otherwise parses the whole dependency
+    // type graph (hundreds of files, ~0.4s) for symbols that are discarded on sight.
+    options = { ...options, noLib: true, types: [] };
+    const host = ts.createCompilerHost(options, true);
+    const normalizedRoots = this.#sliceRoots;
+    const insideSliceRoots = (file: string): boolean => {
+      const absolute = normalized(file);
+      return normalizedRoots.some((root) => absolute.startsWith(root)) &&
+        !absolute.includes(`${path.sep}node_modules${path.sep}`);
+    };
+    host.resolveModuleNameLiterals = (literals, containingFile, redirected, compilerOptions) => {
+      const containerInside = insideSliceRoots(containingFile);
+      return literals.map((literal) => {
+        if (!containerInside) return { resolvedModule: undefined };
+        const resolution = ts.resolveModuleName(
+          literal.text, containingFile, compilerOptions, host, undefined, redirected,
+        );
+        const resolved = resolution.resolvedModule;
+        if (resolved === undefined || !insideSliceRoots(resolved.resolvedFileName)) {
+          return { resolvedModule: undefined };
+        }
+        return resolution;
+      });
+    };
+    this.#program = ts.createProgram({ rootNames: rootNames.map(normalized), options, host });
     this.#checker = this.#program.getTypeChecker();
   }
 
@@ -155,6 +181,9 @@ export class PlanSourceSliceProgram {
     };
     const markSymbol = (symbol: ts.Symbol | undefined): void => {
       if (symbol === undefined || retainedSymbols.has(symbol)) return;
+      // An unresolved external import aliases the checker's one shared `unknown` symbol; retaining
+      // it would make every other unresolved binding look retained.
+      if (symbol.declarations === undefined || symbol.declarations.length === 0) return;
       retainedSymbols.add(symbol);
       if ((symbol.flags & ts.SymbolFlags.Alias) !== 0) {
         try {

package/src/protobuf_field_number.ts

@@ -0,0 +1,36 @@
+/**
+ * THE ONE DERIVATION of a Protobuf field identity from a stable law identity.
+ *
+ * The kernel builds every operation descriptor from installed law with this exact function
+ * (`kernel/src/operation_contract/descriptor.rs` `protobuf_field_number`), and the compiler emits
+ * every generated facade with it too. It is a pure function of the stable identity: nothing is
+ * looked up, there is no registry, and declaration order is deliberately not an input — adding a
+ * field cannot renumber an existing one.
+ *
+ * It lives in its own leaf module, importing nothing, because BOTH sides need it: the compiler
+ * (`codegen_call_proto.ts` re-exports it) and the Peer Office's law-derived encoder
+ * (`peer-office/src/runtime/law_directive_call.ts`), which must derive a call's wire layout from
+ * a workspace's own installed law. `@githolon/dsl` already depends on `@githolon/runtime`, so
+ * the office cannot be the home without a package cycle; and the office reaches this file the way
+ * it already reaches `adapter/proto` — by repository path, inlined by its own bundler. Keeping the
+ * module dependency-free is what makes that safe.
+ */
+
+const fnv64 = (value: string): bigint => {
+  let hash = 0xcbf29ce484222325n;
+  for (const point of new TextEncoder().encode(value)) {
+    hash ^= BigInt(point);
+    hash = BigInt.asUintN(64, hash * 0x100000001b3n);
+  }
+  return hash;
+};
+
+export function protobufFieldNumber(stableIdentity: string): number {
+  const identity = /^[0-9a-f]{16}$/i.test(stableIdentity)
+    ? BigInt(`0x${stableIdentity}`)
+    : fnv64(stableIdentity);
+  const ordinarySlots = 536_869_911n; // 2^29-1, less the 1,000 reserved numbers.
+  let field = Number(identity % ordinarySlots) + 1;
+  if (field >= 19_000) field += 1_000;
+  return field;
+}

package/src/provenance_wire.ts

@@ -0,0 +1,6 @@
+// Transport-only identities derived from existing attributed law. No new durable state.
+// Mirrored by kernel/src/call_authoring/provenance.rs and checked by the descriptor gate.
+export const provenanceRowIdentity = (aggregate: string): string => `${aggregate}:result:provenance`;
+export const provenanceFieldIdentity = (field: string): string => `${field}:result:provenance`;
+export const provenanceAuthorIdentity = "nomos:provenance:author";
+export const provenanceContestedIdentity = "nomos:provenance:wasContested";

package/src/query.ts

@@ -29,6 +29,7 @@
  */
 import type { AggregateHandle } from "./aggregate.js";
 import type { Field } from "./fields.js";
+import type { AuthenticatedMember } from "./member_authentication.js";
 import { pathString, type PathRef } from "./path.js";
 
 /** A key argument accepted by `.key(...)`: a plain (dotted) string OR a typed {@link PathRef}
@@ -67,7 +68,7 @@ type QueryKeyCompatibility<
  * sorted), and the aggregate TYPE id it `returns`. Minimal by design: params /
  * where / scope are later steps.
  */
-export interface QueryDecl {
+export interface QueryDecl extends AuthenticatedMember {
   readonly id: string;
   /** Index key fields, in DECLARED order (= index column order). */
   readonly key: string[];