@githolon/dsl 0.108.7 → 0.110.0

package/src/custody_placement.ts

@@ -0,0 +1,156 @@
+declare const PEER_CLASS: unique symbol;
+
+/** A stable class of peer used by custody-placement declarations. */
+export type PeerClass<Name extends string = string> = Name & {
+  readonly [PEER_CLASS]: true;
+};
+
+/**
+ * Whether this peer should keep custodied workspace state open in kernel memory.
+ * This is independent of durable/offline Git retention.
+ */
+export type KernelResidency = "warm" | "on-demand";
+
+/**
+ * Whether this peer should retain durable Git custody independently of memory residency.
+ * `retain`, not `warm`, is the policy that makes existing custody survive restart/offline use.
+ */
+export type CustodyRetention = "retain" | "cache" | "none";
+
+/** A named reception route selected by placement policy, never part of `NomosRef<T>`. */
+export interface CustodyRemote<Name extends string = string> {
+  readonly __isCustodyRemote: true;
+  readonly name: Name;
+  readonly url: string;
+  readonly peer: string;
+  readonly priority: number;
+}
+
+export interface CustodyPlacementRule {
+  readonly peerClass: PeerClass;
+  readonly kernelResidency: KernelResidency;
+  readonly custodyRetention: CustodyRetention;
+  readonly remotes: readonly string[];
+}
+
+/**
+ * A domain-shipped placement option. This is not live workspace policy.
+ *
+ * A workspace adopts one declaration on its independent placement frontier;
+ * evolving main law never adopts or changes it implicitly. Generated clients
+ * address stable workspace identities; the peer runtime resolves this policy.
+ * Do not copy its remotes or retention choices into domain records or Nomos refs.
+ */
+export interface CustodyPlacementDeclaration<Id extends string = string> {
+  readonly __isCustodyPlacement: true;
+  readonly id: Id;
+  readonly remotes: readonly CustodyRemote[];
+  readonly rules: readonly CustodyPlacementRule[];
+}
+
+const identifier = (kind: string, value: string): void => {
+  if (!/^[A-Za-z][A-Za-z0-9._-]*$/.test(value)) {
+    throw new Error(`${kind} '${value}' is not a stable Nomos identifier`);
+  }
+};
+
+export function peerClass<const Name extends string>(name: Name): PeerClass<Name> {
+  identifier("peer class", name);
+  return name as PeerClass<Name>;
+}
+
+export function custodyRemote<const Name extends string>(
+  name: Name,
+  url: string,
+  options: { readonly peer: string; readonly priority?: number },
+): CustodyRemote<Name> {
+  identifier("custody remote", name);
+  if (!options.peer.trim()) throw new Error(`custody remote '${name}' requires a peer identity`);
+  let parsed: URL;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error(`custody remote '${name}' has invalid URL '${url}'`);
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+    throw new Error(`custody remote '${name}' requires an HTTP(S) URL`);
+  }
+  const priority = options.priority ?? 0;
+  if (!Number.isSafeInteger(priority) || priority < 0) {
+    throw new Error(`custody remote '${name}' priority must be a non-negative integer`);
+  }
+  return Object.freeze({
+    __isCustodyRemote: true,
+    name,
+    url: parsed.toString(),
+    peer: options.peer,
+    priority,
+  });
+}
+
+export function custodyPlacementRule(
+  peer: PeerClass,
+  policy: {
+    readonly kernelResidency: KernelResidency;
+    readonly custodyRetention: CustodyRetention;
+    readonly remotes?: readonly CustodyRemote[];
+  },
+): CustodyPlacementRule {
+  return Object.freeze({
+    peerClass: peer,
+    kernelResidency: policy.kernelResidency,
+    custodyRetention: policy.custodyRetention,
+    remotes: Object.freeze((policy.remotes ?? []).map((remote) => remote.name)),
+  });
+}
+
+export function custodyPlacement<const Id extends string>(
+  id: Id,
+  policy: {
+    readonly remotes?: readonly CustodyRemote[];
+    readonly rules: readonly CustodyPlacementRule[];
+  },
+): CustodyPlacementDeclaration<Id> {
+  identifier("custody placement", id);
+  const rules = policy.rules;
+  if (rules.length === 0) {
+    throw new Error(`custody placement '${id}' declares no peer rules`);
+  }
+  const remotes = [...(policy.remotes ?? [])];
+  const remoteNames = new Set<string>();
+  for (const remote of remotes) {
+    if (!remoteNames.add(remote.name)) {
+      throw new Error(`custody placement '${id}' repeats remote '${remote.name}'`);
+    }
+  }
+  const seen = new Set<string>();
+  for (const rule of rules) {
+    if (seen.has(rule.peerClass)) {
+      throw new Error(
+        `custody placement '${id}' repeats peer class '${rule.peerClass}'`,
+      );
+    }
+    seen.add(rule.peerClass);
+    for (const remote of rule.remotes) {
+      if (!remoteNames.has(remote)) {
+        throw new Error(
+          `custody placement '${id}' rule for '${rule.peerClass}' references unknown remote '${remote}'`,
+        );
+      }
+    }
+  }
+  return Object.freeze({
+    __isCustodyPlacement: true,
+    id,
+    remotes: Object.freeze(remotes),
+    rules: Object.freeze([...rules]),
+  });
+}
+
+export function isCustodyPlacementDeclaration(
+  value: unknown,
+): value is CustodyPlacementDeclaration {
+  return value !== null
+    && typeof value === "object"
+    && (value as { __isCustodyPlacement?: unknown }).__isCustodyPlacement === true;
+}

package/src/custody_placement_usda.ts

@@ -0,0 +1,91 @@
+import {
+  type CustodyPlacementDeclaration,
+} from "./custody_placement.js";
+import { usdaString } from "./usda_text.js";
+
+export interface DomainCustodyPlacement {
+  readonly domain: string;
+  readonly declaration: CustodyPlacementDeclaration;
+}
+
+const primName = (value: string): string =>
+  value.replace(/[^A-Za-z0-9_]/g, (character) =>
+    `_x${character.codePointAt(0)!.toString(16).padStart(2, "0")}_`
+  );
+
+/** Emit independently adoptable placement declarations, never main law. */
+export function custodyPlacementDeclarationsUsda(
+  declarations: readonly DomainCustodyPlacement[],
+): string {
+  const ordered = [...declarations].sort((left, right) => {
+    const domain = left.domain.localeCompare(right.domain);
+    return domain !== 0
+      ? domain
+      : left.declaration.id.localeCompare(right.declaration.id);
+  });
+  const identities = new Set<string>();
+  for (const { domain, declaration } of ordered) {
+    const identity = `${domain}/${declaration.id}`;
+    if (!identities.add(identity)) {
+      throw new Error(`custody placement declaration '${identity}' is repeated`);
+    }
+  }
+
+  return [
+    "#usda 1.0",
+    "(",
+    '    defaultPrim = "NomosPlacementDeclarations"',
+    "    customLayerData = {",
+    '        string "nomos:format" = "nomos.custody-placement-declarations.v1"',
+    "    }",
+    ")",
+    "",
+    'def Scope "NomosPlacementDeclarations"',
+    "{",
+    ...ordered.flatMap(({ domain, declaration }) => [
+      `    def Scope ${usdaString(`d_${primName(domain)}__${primName(declaration.id)}`)}`,
+      "    {",
+      `        custom string nomos:domain = ${usdaString(domain)}`,
+      `        custom string nomos:declaration = ${usdaString(declaration.id)}`,
+      "",
+      '        def Scope "Remotes"',
+      "        {",
+      ...[...declaration.remotes]
+        .sort((left, right) => left.name.localeCompare(right.name))
+        .flatMap((remote) => [
+          `            def NomosCustodyRemote ${usdaString(`r_${primName(remote.name)}`)}`,
+          "            {",
+          `                custom string nomos:name = ${usdaString(remote.name)}`,
+          `                custom string nomos:url = ${usdaString(remote.url)}`,
+          `                custom string nomos:peer = ${usdaString(remote.peer)}`,
+          `                custom int nomos:priority = ${remote.priority}`,
+          "            }",
+        ]),
+      "        }",
+      "",
+      '        def Scope "Rules"',
+      "        {",
+      ...[...declaration.rules]
+        .sort((left, right) => left.peerClass.localeCompare(right.peerClass))
+        .flatMap((rule, index) => [
+          `            def Scope "r_${String(index).padStart(4, "0")}"`,
+          "            {",
+          `                custom token nomos:peerClass = ${usdaString(rule.peerClass)}`,
+          `                custom token nomos:kernelResidency = ${usdaString(rule.kernelResidency)}`,
+          `                custom token nomos:custodyRetention = ${usdaString(rule.custodyRetention)}`,
+          ...(rule.remotes.length === 0
+            ? []
+            : [
+              `                rel nomos:remotes = [${rule.remotes
+                .map((remote) => `</NomosPlacementDeclarations/d_${primName(domain)}__${primName(declaration.id)}/Remotes/r_${primName(remote)}>`)
+                .join(", ")}]`,
+            ]),
+          "            }",
+        ]),
+      "        }",
+      "    }",
+    ]),
+    "}",
+    "",
+  ].join("\n");
+}

package/src/decl_shapes.ts

@@ -20,6 +20,9 @@ import type { QueryDecl } from "./query.js";
 import type { SpatialDecl } from "./spatial.js";
 import type { AnySum } from "./sum.js";
 import type { AnyCount } from "./count.js";
+import type { AnyExtremum } from "./extremum.js";
+import type { AnyExists } from "./exists.js";
+import type { OrderedReadDecl } from "./ordered_read.js";
 import type { WorkspaceInvariantDecl } from "./framework/workspace_invariant.js";
 
 /** A merged domain-module exports bag (scanned by shape). */
@@ -79,7 +82,7 @@ export function isCountDecl(v: unknown): v is AnyCount {
     !("field" in o) && // extremum (wire-descriptor shape)
     !("valueField" in o) && // extremum (the ExtremumDecl/Extremum-builder mark — never a count)
     !("sumField" in o) && // sum (the SumDecl/Sum-builder mark — never a count)
-    !("orderBy" in o) && // ordered read
+    !("orderBy" in o) && !("orderKey" in o) && // unfinished/finished ordered read
     !("_existsMarker" in o) && // exists
     typeof o.refField !== "string" && // combined
     o.__isAggregateHandle !== true && // aggregate
@@ -89,7 +92,7 @@ export function isCountDecl(v: unknown): v is AnyCount {
 }
 
 /** An extremum decl/builder — `{id, of, valueField}` with `{kind:"min"|"max"}` (the #47 read). */
-export function isExtremumDecl(v: unknown): boolean {
+export function isExtremumDecl(v: unknown): v is AnyExtremum {
   if (!v || typeof v !== "object") return false;
   const o = v as Record<string, unknown>;
   return (
@@ -100,6 +103,22 @@ export function isExtremumDecl(v: unknown): boolean {
   );
 }
 
+/** Both total and grouped membership declarations carry the same explicit brand. */
+export function isExistsDecl(v: unknown): v is AnyExists {
+  if (!v || typeof v !== "object") return false;
+  const o = v as Record<string, unknown>;
+  return typeof o.id === "string" && typeof o.of === "string" && o._existsMarker === true;
+}
+
+/** Finished first/take declaration; an unfinished orderBy builder is not executable law. */
+export function isOrderedReadDecl(v: unknown): v is OrderedReadDecl {
+  if (!v || typeof v !== "object") return false;
+  const o = v as Record<string, unknown>;
+  return typeof o.id === "string" && typeof o.of === "string"
+    && typeof o.orderKey === "string" && typeof o.orderDesc === "boolean"
+    && typeof o.limit === "number";
+}
+
 /**
  * Scan merged exports for decls matching `match`: individual exports AND exported arrays, deduped
  * by a function-blind JSON key (the SAME dedup `compile_package_main.ts` `discover` uses).

package/src/describe_model.ts

@@ -81,6 +81,7 @@ const mergePolicy = (driver: unknown): string => {
   const d = driver as { kind?: unknown; inner?: unknown; principal?: unknown };
   switch (d.kind) {
     case "FirstWriterWins": return "the first concurrent change wins; a later informed edit may replace it";
+    case "FirstWriterCandidates": return "the first of the changes nobody had seen wins; a later informed edit settles it";
     case "Lww": return "the latest recorded change wins";
     case "LwwCausal": return "a change based on another wins; truly concurrent changes use a stable tie-break";
     case "LwwBy": return `${String(d.principal ?? "the declared authority")} is the sole writer`;

package/src/directive.ts

@@ -23,6 +23,8 @@ import type { PlannedOp } from "./ops.js";
 import type { Ports } from "./ctx.js";
 import type { RelationDecl } from "./relation.js";
 import type { QueryDecl } from "./query.js";
+import type { AuthenticatedMember } from "./member_authentication.js";
+import { enrolledDeviceAuthentication } from "./member_authentication.js";
 import {
   normalizeActivity,
   type ActivityInput,
@@ -39,6 +41,7 @@ import {
   type FromPayloadRef,
   type TrustPolicyDecl,
   type ForeignReadEdge,
+  type AttestedReadSubjectRef,
 } from "./attested_core.js";
 import {
   buildPointGuard,
@@ -253,7 +256,9 @@ export interface BusinessSourceTrust {
   readonly satisfiedByQueryArgs?: Readonly<Record<string, string>>;
 }
 
-export interface Directive<P = unknown> {
+export interface Directive<P = unknown> extends AuthenticatedMember {
+  /** Durable consequences emitted through the same offer outbox as public intentions. */
+  readonly workspaceEffects?: readonly import("./intent.js").WorkspaceEffectStep<P, any>[];
   readonly id: string;
   readonly marker: ReferentialMarker;
   readonly aggregateId: string;
@@ -274,6 +279,12 @@ export interface Directive<P = unknown> {
    * two generated client shapes without changing the directive's replay law.
    */
   readonly outputCardinality?: "many" | "optional";
+  /**
+   * Law-selected authentication proof for this exact directive. Omitted means
+   * the ordinary session posture (provider token plus enrolled device for a
+   * warranted human workspace). This is authentication only: the directive's
+   * independent `.requires(...)` authorization policy still has to pass.
+   */
   /**
    * MULTI-OUTPUT DIRECTIVES: additional aggregates this directive declares it writes, beyond the primary
    * marker target. Present iff the directive chained `.alsoEnsures/.alsoCreates/.alsoMutates/.alsoArchives`
@@ -360,6 +371,9 @@ export interface Directive<P = unknown> {
       readonly recordType: string;
       readonly idField: string;
     };
+    /** Use the workspace identity proven by this declared foreign read as the
+     * Zanzibar subject. Absent means the ordinary session principal. */
+    readonly subjectFromAttestedRead?: string;
   };
   /**
    * Admit this directive when it is the exact target call carried by a verified,
@@ -372,6 +386,16 @@ export interface Directive<P = unknown> {
   /** Recovery-only workspace-effect door. The carried source must prove it is this workspace's
    * exact K_root-rooted birth parent; no Zanzibar relation or host assertion substitutes for it. */
   readonly acceptsVerifiedBirthParentRecoveryGate?: true;
+  /** Accept a claim made by a cryptographically verified source workspace. This proves the
+   * speaker, not a role in the recipient. Receiving law must scope the claim to that speaker. */
+  readonly acceptsVerifiedWorkspaceClaimGate?: true;
+  /**
+   * SOVEREIGN SELF-CERTIFICATION (identity target model D22). The founding signer tuple this directive
+   * writes (`identity:<scope>:<h>#signer@key:<h>`) is admitted with no prior signer of the principal iff
+   * the signing key's sha256 is `h`, the captured principal's subject. Lowered to
+   * `nomos:selfCertifyingPrincipal = "true"`; framework-only (`sovereignSelfCertification`).
+   */
+  readonly selfCertifyingPrincipalGate?: true;
   /**
    * CROSS-CUSTODY ATTESTATION-AUTHORIZED (home_holons §3/§5). When `true`, this directive's authorization
    * is a carried §3 SIGNED QUOTE (the asserter's pubkey + a signature over the edge), NOT an author block —
@@ -663,10 +687,20 @@ export interface RequirableDirective<P> extends Directive<P> {
     opts?: {
       object?: string;
       objectFrom?: { recordType: string; idField: string };
+      subjectFrom?: AttestedReadSubjectRef;
     }
   ): RequirableDirective<P>;
   /** Declare this exact call shape as an admissible signed parent-workspace effect. */
   acceptsWorkspaceEffect(): RequirableDirective<P>;
+  acceptsVerifiedWorkspaceClaim(): RequirableDirective<P>;
+  /**
+   * Authenticate this exact directive with an already-enrolled active device,
+   * without requiring a provider token. Use for operations which repair the
+   * provider verifier itself; authorization remains separately law-declared.
+   */
+  authenticatesWithEnrolledDevice(): RequirableDirective<P>;
+  /** Framework-only: mark this directive as a sovereign principal's self-certification (D22). */
+  selfCertifyingPrincipal(): RequirableDirective<P>;
   /**
    * Declare this directive ATTESTATION-AUTHORIZED (home_holons §3/§5): its authorization is a carried §3
    * signed quote rather than an author block — lowered into the `nomosAttestationGate` era key so the one
@@ -834,7 +868,10 @@ export interface RequirableDirective<P> extends Directive<P> {
 
 /** Stage 1: id + a referential marker (which fixes the target aggregate). */
 class DirectiveMarkerStep<Id extends string> {
-  constructor(private readonly id: Id) {}
+  private readonly id: Id;
+  constructor(id: Id) {
+    this.id = id;
+  }
   /**
    * `creates(Agg)` — Nomos MINTS the id (byte-identical to before this arg existed). For CREATE-ONCE at an
    * APP-SUPPLIED stable id, chain `.payload(...).withId(p => p.id)` on the plan step (typed against the
@@ -1404,6 +1441,7 @@ function makeRequirable<P>(base: Directive<P>): RequirableDirective<P> {
       opts?: {
         object?: string;
         objectFrom?: { recordType: string; idField: string };
+        subjectFrom?: AttestedReadSubjectRef;
       }
     ): RequirableDirective<P> {
       // THE ONE write-authz declaration (full-native Zanzibar, no mixed systems): the captured author
@@ -1420,12 +1458,31 @@ function makeRequirable<P>(base: Directive<P>): RequirableDirective<P> {
           ...(opts?.objectFrom !== undefined
             ? { objectFrom: opts.objectFrom }
             : {}),
+          ...(opts?.subjectFrom !== undefined
+            ? { subjectFromAttestedRead: opts.subjectFrom.queryId }
+            : {}),
         },
       });
     },
     acceptsWorkspaceEffect(): RequirableDirective<P> {
       return makeRequirable({ ...base, acceptsWorkspaceEffectGate: true });
     },
+    acceptsVerifiedWorkspaceClaim(): RequirableDirective<P> {
+      return makeRequirable({
+        ...base,
+        acceptsWorkspaceEffectGate: true,
+        acceptsVerifiedWorkspaceClaimGate: true,
+      });
+    },
+    authenticatesWithEnrolledDevice(): RequirableDirective<P> {
+      return makeRequirable({
+        ...base,
+        authentication: enrolledDeviceAuthentication(),
+      });
+    },
+    selfCertifyingPrincipal(): RequirableDirective<P> {
+      return makeRequirable({ ...base, selfCertifyingPrincipalGate: true });
+    },
     attestationAuthorized(owner: {
       ownerObject: string;
       ownerField: string;

package/src/drivers.ts

@@ -14,6 +14,7 @@
  * PALETTE_ONLY mechanism + throw remain for any FUTURE driver added to this
  * palette ahead of its kernel merge arm — never silently emit an unsupported wire driver.
  */
+import { canonicalJson } from "./canonical_json.js";
 import type { WireDriver } from "./wire.js";
 
 /**
@@ -24,6 +25,7 @@ import type { WireDriver } from "./wire.js";
 export type KernelDriverKind =
   | "Lww"
   | "FirstWriterWins"
+  | "FirstWriterCandidates"
   // ── EXPLICIT TIME-AUTHORITY Lww drivers (the "whose clock?" axis) ──
   // Nomos has no servers, so "do we trust the clock?" is the WRONG question — the real
   // one is WHOSE clock orders THIS field, and a dev assigns it per field. `Lww` trusts
@@ -61,6 +63,14 @@ export const Lww: Driver = { kind: "Lww" };
 /** Nomos's ordinary scalar conflict policy: an informed later edit replaces the
  * value; concurrent edits converge on the earliest writer. */
 export const FirstWriterWins: Driver = { kind: "FirstWriterWins" };
+/** The same policy as `FirstWriterWins`, decided from the SET of changes rather than the
+ * order they happened to arrive in: changes nobody had seen compete, the earliest of them is
+ * the value, and a change made with knowledge of the others settles it. Because arrival order
+ * cannot matter, work recorded offline joins a workspace without replaying its history.
+ * Opt in per field with `.merge(FirstWriterCandidates)`, or for every first-writer field of an
+ * aggregate with `{ firstWriter: "candidates" }`. It is a law change: roll it out as one.
+ * (architecture/path_independent_first_writer.md) */
+export const FirstWriterCandidates: Driver = { kind: "FirstWriterCandidates" };
 export const AddWins: Driver = { kind: "AddWins" };
 export const Conflict: Driver = { kind: "Conflict" };
 export const MapOf = (inner: Driver): Driver => ({ kind: "MapOf", inner });
@@ -163,11 +173,52 @@ export const Surfaced = (inner: Driver): Driver => {
 // throws for it rather than emit a wire driver the kernel can't merge.
 const PALETTE_ONLY: ReadonlySet<DriverKind> = new Set<DriverKind>([]);
 
+/**
+ * Is this wire driver a SINGLE-VALUE driver (D20)? Mirrors the kernel's
+ * `is_single_value_driver`: one visible value chosen from the field's stored observation
+ * antichain, so the driver is a pure reduction at projection time. Counters, sets, lists,
+ * maps, positions and `Conflict` are not.
+ */
+export function isSingleValueWireDriver(driver: unknown): boolean {
+  if (typeof driver === "string") {
+    return (
+      driver === "Lww" ||
+      driver === "LwwCausal" ||
+      driver === "FirstWriterWins" ||
+      driver === "FirstWriterCandidates"
+    );
+  }
+  if (driver === null || typeof driver !== "object") return false;
+  const d = driver as Record<string, unknown>;
+  if (typeof d.LwwBy === "string") return true;
+  if ("Surfaced" in d) return isSingleValueWireDriver(d.Surfaced);
+  if ("Attributed" in d) return isSingleValueWireDriver(d.Attributed);
+  return false;
+}
+
+/**
+ * The stored VALUE SPACE of a wire driver — the `driver` slot of the field schema identity.
+ * Mirrors the kernel's `field_schema_value_space` byte-for-byte: every single-value driver
+ * shares one value space and is written as its representative `"Lww"` (so fields already
+ * declared `Lww` keep the identity they always had); any other driver is its own value space.
+ * Switching among single-value drivers in a later law is therefore not a retype.
+ */
+export function driverValueSpace(driver: unknown): unknown {
+  return isSingleValueWireDriver(driver) ? "Lww" : driver;
+}
+
+/** Do two wire drivers store the same value space (a driver switch is a plain law change)? */
+export function driversShareValueSpace(a: unknown, b: unknown): boolean {
+  return canonicalJson(driverValueSpace(a)) === canonicalJson(driverValueSpace(b));
+}
+
 /** Encode one Driver to its kernel wire shape, or throw if not yet in the kernel. */
 export function encodeDriver(d: Driver): WireDriver {
   switch (d.kind) {
     case "FirstWriterWins":
       return "FirstWriterWins";
+    case "FirstWriterCandidates":
+      return "FirstWriterCandidates";
     case "Lww":
       return "Lww";
     // ── EXPLICIT TIME-AUTHORITY Lww drivers (kernel `merge_field` arms) ──

package/src/engine_entry.ts

@@ -55,14 +55,24 @@ import { executeDirectiveToIntent } from "./wire_encode.js";
 import { expandCapabilityExports, isCapabilityDecl } from "./capability_exports.js";
 import { RelationTuple, __setDispatchContext } from "./framework/relations.js";
 import { BIRTH_METER_AGGREGATES } from "./birth_meter.js";
-import { AuthProvider as FrameworkAuthProvider, setAuthProvider as frameworkSetAuthProvider } from "./framework/auth_provider_law.js";
+import {
+  AuthProvider as FrameworkAuthProvider,
+  AuthProviderCertificate as FrameworkAuthProviderCertificate,
+  AuthProviderKey as FrameworkAuthProviderKey,
+  adoptIdentityProviderWitness as frameworkAdoptIdentityProviderWitness,
+  setAuthProvider as frameworkSetAuthProvider,
+} from "./framework/auth_provider_law.js";
 import { namespacedAggregateIds, qualifyReadProjectionType, READ_PROJECTION_DELIMITER } from "./read_projection_namespace.js";
 import { discoverRelationTypeDeclarations } from "./relation_schema.js";
 import { synthesizePreconditionInvariants } from "./precondition.js";
 import { synthesizeBirthQuotaInvariants } from "./birth_meter.js";
 import { withBirthMeterExports } from "./birth_meter_ensure.js";
 import { expandRoleExports } from "./role.js";
-import { withAttestedReadExports } from "./attested.js";
+import {
+  NomosSourceFrontier,
+  nomosSourceFrontierEnsure,
+  withAttestedReadExports,
+} from "./attested.js";
 import type { OpenApiDoc } from "./codegen_openapi.js";
 import type { Directive } from "./directive.js";
 import type { AggregateHandle, AggregateInvariantFn, AggregateInvariantVerdict } from "./aggregate.js";
@@ -83,6 +93,7 @@ import {
   applicationLanguageOf,
   assertApplicationLanguageCoversAuthoredDirectives,
   executableDirectivesForLanguage,
+  publicOfferRoute,
   remapWorkspaceInvariantsForLanguage,
 } from "./intent.js";
 
@@ -400,16 +411,42 @@ function buildDomainSlice(mod: DomainModuleExports, domain: string): DomainSlice
     if (declaresBirthHere || declaresPrivateHere) {
       if (!aggs.has(FrameworkAuthProvider.id)) aggs.set(FrameworkAuthProvider.id, FrameworkAuthProvider);
       if (!dirs.has(frameworkSetAuthProvider.id)) dirs.set(frameworkSetAuthProvider.id, frameworkSetAuthProvider as unknown as Directive<unknown>);
+      if (declaresPrivateHere) {
+        for (const aggregate of [
+          FrameworkAuthProviderKey,
+          FrameworkAuthProviderCertificate,
+          NomosSourceFrontier,
+        ]) {
+          if (!aggs.has(aggregate.id)) aggs.set(aggregate.id, aggregate);
+        }
+        if (!dirs.has(frameworkAdoptIdentityProviderWitness.id)) {
+          dirs.set(
+            frameworkAdoptIdentityProviderWitness.id,
+            frameworkAdoptIdentityProviderWitness as unknown as Directive<unknown>,
+          );
+        }
+        if (!dirs.has(nomosSourceFrontierEnsure.id)) {
+          dirs.set(nomosSourceFrontierEnsure.id, nomosSourceFrontierEnsure as unknown as Directive<unknown>);
+        }
+      }
     }
   }
-  for (const [dirId, directive] of dirs) {
+  for (const directive of dirs.values()) {
     const agg = aggs.get(directive.aggregateId);
     if (agg === undefined) {
       // A directive targeting an aggregate not exported by its module is an
       // authoring bug; surface it lazily (only if that directive is invoked).
       continue;
     }
-    registry.set(dirId, { directive, agg });
+    const publicRoute = publicOfferRoute(directive);
+    const prior = registry.get(publicRoute);
+    if (prior !== undefined && prior.directive !== directive) {
+      throw new Error(
+        `engine bundle: public offer route '${publicRoute}' resolves to both ` +
+          `'${prior.directive.id}' and '${directive.id}' in domain '${domain}'`,
+      );
+    }
+    registry.set(publicRoute, { directive, agg });
   }
 
   // ── aggregate type → derived / combined decls (fn bodies ship HERE, never the ledger) ──
@@ -780,7 +817,7 @@ export function registerEngine(config: EngineEntryConfig): RegisteredEngine {
   }
 
   function planAggInvariant(job: {
-    intent?: { aggregateInvariant?: { of?: string } };
+    intent?: { aggregateInvariant?: { of?: string; previous?: Record<string, unknown> | null } };
     priorState?: Record<string, unknown>;
   }): string {
     // WIRE SHAPE (the host oracle's contract, EXACT): `{ aggregateInvariant: { of: "<type>" } }`.
@@ -802,7 +839,7 @@ export function registerEngine(config: EngineEntryConfig): RegisteredEngine {
       return JSON.stringify({ accept: true } satisfies AggregateInvariantVerdict);
     }
     const snapshot = (job.priorState ?? {}) as Record<string, unknown>;
-    const verdict: AggregateInvariantVerdict = body(snapshot);
+    const verdict: AggregateInvariantVerdict = body(snapshot, job.intent?.aggregateInvariant?.previous);
     return JSON.stringify(verdict);
   }
 
@@ -1072,8 +1109,9 @@ export function registerEngine(config: EngineEntryConfig): RegisteredEngine {
     // and meter `Event`s directly instead of walking a second returned object graph. This is an
     // execution ABI, not authority: the same values still pass the ordinary kernel gates, and old
     // kernels/packages retain the returned-value lane below for era replay.
-    const submitNativePlan = (globalThis as unknown as {
+    const nativePlanKernel = (globalThis as unknown as {
       nomos?: {
+        __workspaceEffectDependencies?: number;
         __submitPlan?: (
           events: WireEvent[],
           strikes: string[],
@@ -1082,10 +1120,16 @@ export function registerEngine(config: EngineEntryConfig): RegisteredEngine {
           workspaceEffects: {
             destination: { workspace: string } | { verifiedParent: true } | { verifiedSource: true };
             targetCallUsda: Uint8Array;
+            dependsOn?: readonly number[];
           }[],
         ) => void;
       };
-    }).nomos?.__submitPlan;
+    }).nomos;
+    if (wire.workspaceEffects?.some(effect => effect.dependsOn?.length) &&
+        nativePlanKernel?.__workspaceEffectDependencies !== 1) {
+      throw new Error("workspace effect dependencies require kernel support for authenticated predecessor judgments");
+    }
+    const submitNativePlan = nativePlanKernel?.__submitPlan;
     if (typeof submitNativePlan === "function") {
       submitNativePlan(
         wire.events,