@githolon/dsl 0.108.7 → 0.110.0

package/src/evolve_preview.ts

@@ -21,7 +21,10 @@
  *   REMOVAL  (refuse) — a sid disappeared; declare a typed retirement in the evolution layer.
  *   CONTRACT (refuse) — same sid, changed value language without a deterministic projection;
  *                       needs `.evolvesFrom(...)`, never a disposition.
- *   DRIVER   (refuse) — same sid, changed merge driver; needs a typed evolution or a new field.
+ *   DRIVER   (refuse) — same sid, merge driver moved to a different stored value space (e.g.
+ *            Lww → Counter); needs a typed evolution or a new field. Switching among single-value
+ *            drivers (Lww/LwwCausal/LwwBy/FirstWriterWins/FirstWriterCandidates/Surfaced/Attributed)
+ *            is a plain law change (D20: the driver is a projection-time reduction).
  *   PAYLOAD  (warn)   — a directive's payload shape changed; clients compiled against the old
  *                       law get typed 422s until regenerated (directives are not sid-tracked).
  *
@@ -31,13 +34,14 @@
  * reading the carried sids, never produces.
  */
 import type { Finding } from "./law_check.js";
-import type { DirectivePayloadShape, DomainInterface } from "./shape_compat.js";
-import { domainInterface } from "./shape_compat.js";
+import type { DirectivePayloadShape, DomainInterface } from "./compatibility_graph.js";
+import { domainInterface } from "./compatibility_graph.js";
 import type { StableIds } from "./stable_ids_types.js";
 import type { CompilerIdentityModel } from "./identity_model.js";
 export type { CompilerIdentityModel } from "./identity_model.js";
 import type { DomainModule } from "./codegen_dart.js";
 import type { WireSchema } from "./wire.js";
+import { driversShareValueSpace } from "./drivers.js";
 
 // ── the normalized law shape both sides of the diff speak ──────────────────────────
 
@@ -346,8 +350,11 @@ function diffDomain(
         });
       }
       const kindChanged = oldF.kind !== "" && newF.kind !== "" && oldF.kind !== newF.kind;
+      // A driver switch that keeps the stored value space (among single-value drivers, D20)
+      // is a plain law change: the projection re-reduces the same stored antichain.
       const driverChanged =
-        oldF.driver !== undefined && newF.driver !== undefined && oldF.driver !== newF.driver;
+        oldF.driver !== undefined && newF.driver !== undefined && oldF.driver !== newF.driver &&
+        !driversShareValueSpace(JSON.parse(oldF.driver), JSON.parse(newF.driver));
       const contractChanged =
         oldF.contract !== undefined && newF.contract !== undefined && oldF.contract !== newF.contract;
       const evolutionCovered = evolutionReaches(newF, oldF.schema, newF.schema);

package/src/exists.ts

@@ -57,6 +57,7 @@ export interface ExistsDecl extends CountDecl {
 export interface ExistsBuilder<F extends Record<string, Field> = Record<string, Field>> {
   readonly id: string;
   readonly of: string;
+  readonly _existsMarker: true;
   /** Attach a PREDICATE: only aggregates satisfying it count toward existence. */
   where(fn: (p: ReturnType<typeof predBuilder<F>>) => Predicate<F>): ExistsBuilder<F>;
   /** Partition by a GROUP-BY field: exists per distinct group-key value. */
@@ -136,6 +137,7 @@ function makeExistsBuilder<F extends Record<string, Field>>(
   const b = {
     id,
     of: ofType,
+    _existsMarker: true as const,
     ...(where !== undefined ? { _where: where } : {}),
     where(fn: (p: ReturnType<typeof predBuilder<F>>) => Predicate<F>): ExistsBuilder<F> {
       const pred = fn(predBuilder<F>());

package/src/fields.ts

@@ -143,7 +143,11 @@ export interface EvidenceRefValue {
   storageClass: "git" | "external";
 }
 
-/** One portable address inside Nomos custody. This is identity and routing, never authority. */
+/**
+ * One workspace-qualified record identity inside Nomos custody.
+ * `workspace` is an identity, not a URL: routing and retention come from that
+ * workspace's independently verified placement ref. This value grants no authority.
+ */
 export interface NomosRefValue {
   readonly workspace: string;
   readonly type: string;
@@ -250,6 +254,55 @@ export const versionedNomosRefValueSchema: z.ZodType<VersionedNomosRefValue> = z
   series: nomosRefValueSchema,
 }).strict();
 
+// These are the same global brands consumed by `law_value_type.ts`.  Field
+// builders must put nominal reference meaning on the Zod value itself because
+// that value is what is lowered into the shared law graph and, from there, the
+// Protobuf contract used by every language.  Keeping the target solely on the
+// outer Field made the graph see an anonymous record and forced generators to
+// rediscover type meaning independently.
+const NOMOS_REFOF_SCHEMA_BRAND = Symbol.for("nomos.refOf");
+const NOMOS_VERSIONED_REFOF_SCHEMA_BRAND = Symbol.for("nomos.versionedRefOf");
+
+function nomosRefSchema(
+  aggregateType: string,
+  targetKind: "aggregate" | "contract",
+): z.ZodType<NomosRefValue> {
+  const schema = z.object({
+    workspace: z.string().min(1),
+    type: z.string().min(1),
+    id: z.string().min(1),
+  }).strict();
+  Object.defineProperty(schema, NOMOS_REFOF_SCHEMA_BRAND, {
+    value: { aggregateType, targetKind },
+    enumerable: false,
+  });
+  return schema;
+}
+
+function versionedNomosRefSchema(
+  targetAggregateType: string,
+  targetKind: "aggregate" | "contract",
+  seriesAggregateType: string,
+  seriesKind: "aggregate" | "contract",
+  currentField: string,
+): z.ZodType<VersionedNomosRefValue> {
+  const schema = z.object({
+    pinned: nomosRefValueSchema,
+    series: nomosRefValueSchema,
+  }).strict();
+  Object.defineProperty(schema, NOMOS_VERSIONED_REFOF_SCHEMA_BRAND, {
+    value: {
+      targetAggregateType,
+      targetKind,
+      seriesAggregateType,
+      seriesKind,
+      currentField,
+    },
+    enumerable: false,
+  });
+  return schema;
+}
+
 /** The Zod schema for an authored `EvidenceRefValue` — the single source of truth. */
 export const evidenceRefSchema: z.ZodType<EvidenceRefValue> = z.object({
   hash: z.string(),
@@ -288,28 +341,30 @@ export type ValueObjectFieldDescriptor =
       /** Present only for an `idOf(recordContract(...))` target. Aggregate is the default. */
       readonly idOfContract?: true;
       readonly optional?: true;
+      readonly nullable?: true;
     }
   /** `int: true` when the zod carried `.int()` (Dart `int`, TS `number`); `unit` when the field
    * was declared through `unit(...)` — the generated Dart extension-type wrapper's name. */
-  | { readonly type: "number"; readonly int?: true; readonly unit?: string; readonly optional?: true }
-  | { readonly type: "boolean"; readonly optional?: true }
+  | { readonly type: "number"; readonly int?: true; readonly unit?: string; readonly optional?: true; readonly nullable?: true }
+  | { readonly type: "boolean"; readonly optional?: true; readonly nullable?: true }
   | {
       readonly type: "enum";
       readonly values: readonly string[];
       /** Stable authored scalar name from enumType(...), when this is shared vocabulary. */
       readonly name?: string;
       readonly optional?: true;
+      readonly nullable?: true;
     }
   /** A `z.literal(<string>)` — a CONSTANT discriminator-style member (generated as a getter). */
-  | { readonly type: "literal"; readonly value: string; readonly optional?: true }
-  | { readonly type: "array"; readonly items: ValueObjectFieldDescriptor; readonly optional?: true }
+  | { readonly type: "literal"; readonly value: string; readonly optional?: true; readonly nullable?: true }
+  | { readonly type: "array"; readonly items: ValueObjectFieldDescriptor; readonly optional?: true; readonly nullable?: true }
   /** A MAP/RECORD (`z.record(z.string(), X)`) — string-keyed entries of `values`. TS
    * `Record<string, V>`, Dart `Map<String, V>`; the wire is a plain json object. */
-  | { readonly type: "map"; readonly values: ValueObjectFieldDescriptor; readonly optional?: true }
+  | { readonly type: "map"; readonly values: ValueObjectFieldDescriptor; readonly optional?: true; readonly nullable?: true }
   /** A nested value object, referenced BY NAME (its own descriptor rides alongside). */
-  | { readonly type: "object"; readonly ref: string; readonly optional?: true }
+  | { readonly type: "object"; readonly ref: string; readonly optional?: true; readonly nullable?: true }
   /** A nested GEO value object (RFC 7946 geometry), referenced by name. */
-  | { readonly type: "geometry"; readonly ref: string; readonly geometry: GeometryKind; readonly optional?: true };
+  | { readonly type: "geometry"; readonly ref: string; readonly geometry: GeometryKind; readonly optional?: true; readonly nullable?: true };
 
 /**
  * One arm of a `union(...)` value object: either an ANONYMOUS shape (fields ride inline,
@@ -947,7 +1002,7 @@ function assertNullEligible(field: Field<unknown, FieldKind>, wrapper: "clearabl
     );
   }
   const dk = (field.driver as { kind?: string }).kind;
-  if (dk !== "FirstWriterWins" && dk !== "Lww" && dk !== "LwwCausal" && dk !== "LwwBy") {
+  if (dk !== "FirstWriterWins" && dk !== "FirstWriterCandidates" && dk !== "Lww" && dk !== "LwwCausal" && dk !== "LwwBy") {
     throw new Error(
       `t.${wrapper}(...) needs a wholesale scalar field (FirstWriterWins / Lww / LwwCausal / LwwBy) — ` +
         `a null/clear replaces the value WHOLESALE, which a '${dk}' merge cannot express.`,
@@ -1282,7 +1337,10 @@ export const t = {
     target: AggregateHandle<string, Record<string, Field>> | ContractHandle,
   ): Field<NomosRefValue, "ref"> {
     const isContract = (target as { __isContract?: unknown }).__isContract === true;
-    return makeField<NomosRefValue, "ref">("ref", nomosRefValueSchema, FirstWriterWins, {
+    return makeField<NomosRefValue, "ref">("ref", nomosRefSchema(
+      target.id,
+      isContract ? "contract" : "aggregate",
+    ), FirstWriterWins, {
       refAggregateId: target.id,
       nomosRef: {
         targetAggregateId: target.id,
@@ -1314,7 +1372,13 @@ export const t = {
     const seriesIsContract = (opts.series as { __isContract?: unknown }).__isContract === true;
     return makeField<VersionedNomosRefValue, "ref">(
       "ref",
-      versionedNomosRefValueSchema,
+      versionedNomosRefSchema(
+        opts.target.id,
+        targetIsContract ? "contract" : "aggregate",
+        opts.series.id,
+        seriesIsContract ? "contract" : "aggregate",
+        opts.current,
+      ),
       FirstWriterWins,
       {
         versionedForeignRef: {

package/src/flow_gate.ts

@@ -33,6 +33,7 @@ type Projection = {
   readonly key?: readonly string[];
   readonly by?: string;
   readonly valueField?: string;
+  readonly orderKey?: string;
   readonly where?: CanonicalPred;
 };
 
@@ -120,7 +121,7 @@ export function assertFlowGate(m: FlowLaw, mod?: FlowModule): void {
     const typeOf = (p: Projection): string | undefined =>
       p.of ?? (typeof p.returns === "string" ? p.returns : undefined);
     const fieldsOf = (p: Projection): (string | undefined)[] =>
-      [...(p.key ?? []), p.by, p.valueField, ...predFields(p.where)];
+      [...(p.key ?? []), p.by, p.valueField, p.orderKey, ...predFields(p.where)];
     const reads: { list: readonly Projection[]; sink: string }[] = [
       { list: (m.queries ?? []) as unknown as Projection[], sink: "a query key" },
       { list: (m.counts ?? []) as unknown as Projection[], sink: "a count group / where" },

package/src/framework/application_home.ts

@@ -10,13 +10,20 @@
 
 import type { AggregateHandle } from "../aggregate.js";
 import type { ApplicationHomeGenesis } from "../application_home_genesis.js";
-import type { WorkspaceRole } from "../births.js";
 import type { Directive } from "../directive.js";
+import { intent } from "../intent.js";
 import type { QueryDecl } from "../query.js";
 import { APPLICATION_HOME_DOMAIN } from "./application_home_domain.js";
 import {
   AuthProvider,
+  AuthProviderCertificate,
+  AuthProviderKey,
+  AUTH_PROVIDER_AUTHORITY,
+  adoptIdentityProviderWitness,
   authProvider,
+  authProviderCertificates,
+  authProviderKeys,
+  identityProviderSourceTrust,
   authProviderSeedBeforeWarrant,
   seedAuthProvider,
   setAuthProvider,
@@ -38,12 +45,44 @@ import {
   receivingGroupRelations,
   receivingGroupRevocationFollowsPolicy,
   recordShare,
+  recordReceivedWorkspaceAccess,
+  receivedWorkspaceAccess,
+  receivedWorkspaceAccessIsForOwner,
+  receivingGroupFoundedBirthBindsOwner,
   seedBirthAttestation,
   seedReceivingGroup,
   seedReceivingGroupPolicy,
   sharedByObject,
   sharedByWorkspace,
-} from "./home.js";
+  PLATFORM_IDENTITY_PROVIDER_RECOVERY,
+  type ReceivingGroupRecoveryPolicy,
+} from "./receiving_group.js";
+import { receivingGroupRecoveryLaw } from "./receiving_group_recovery.js";
+import {
+  BirthOrigin,
+  FoundingPrincipal,
+  birthOriginVirginOnly,
+  foundingPrincipalVirginOnly,
+  seedBirthOrigin,
+  seedFoundingPrincipal,
+} from "./founding_genesis.js";
+import {
+  enrollDevice,
+  principalScopeRelations,
+  relationTuplesByRelation,
+  revokeDevice,
+} from "./principal_enrollment.js";
+import { workspaceOperatorRelations } from "./workspaces.js";
+import {
+  delegatedRoleRelations,
+  grantDelegatedRole,
+  revokeDelegatedRole,
+} from "./delegated_roles.js";
+import { consoleGovernanceLaw } from "./console_governance.js";
+import { childAuthenticationExports } from "./child_authentication.js";
+import { modelTransitionExports } from "./model_transition.js";
+import { modelAuthorityRepairExports } from "./model_authority_repair.js";
+import { modelAuthoritySeedBeforeWarrant, seatInheritedModelAuthority } from "./model_authority_seed.js";
 import { RelationTuple, relationTuplesByObject } from "./relations.js";
 import {
   SignerDelegation,
@@ -55,7 +94,11 @@ import {
   enrollSigner,
   enrollSignerSelf,
   enrollSignerSelfRequiresVerified,
+  enrollDelegationRetainsEvidence,
+  enrollFirstDeviceRetainsEvidence,
   identityRelations,
+  lastAdmissionCheckpointSignerRemains,
+  revokeAdmissionCheckpointSigner,
   revokeSigner,
   revokeSignerEpochStrictlyIncreases,
   signerDelegationByUser,
@@ -70,8 +113,10 @@ const internal = <T extends object>(value: T): Internal<T> => ({
   ...value,
   businessBirthInternal: true,
 });
-const aggregate = (value: AggregateHandle): Internal<AggregateHandle> => internal(value);
-const directive = <P>(value: Directive<P>): Internal<Directive<P>> => internal(value);
+const aggregate = (value: AggregateHandle): Internal<AggregateHandle> =>
+  internal(value);
+const directive = <P>(value: Directive<P>): Internal<Directive<P>> =>
+  internal(value);
 const query = (value: QueryDecl): Internal<QueryDecl> => internal(value);
 
 // Parent primitive + the law its born home uses. The compiler supplies the application's explicit
@@ -80,8 +125,11 @@ export function applicationHomePolicyLaw(
   maxChildWorkspacesPerUser: number,
   birthPolicyDomains: readonly string[],
   homeGenesis?: ApplicationHomeGenesis,
-  parentWorkspaceRoles: readonly WorkspaceRole[] = [],
+  recoveryPosture?: ReceivingGroupRecoveryPolicy,
 ) {
+  // THE PARENT'S ROLE ON A RECEIVING GROUP IS A FRAMEWORK CONSTANT. The platform that births the anchor is
+  // its provider authority (verifier epochs + device repair flow down through that seat); no tenant names it.
+  const providerRootRoles = [AUTH_PROVIDER_AUTHORITY];
   return {
     __nomos_birthReceivingGroup: directive(
       birthReceivingGroupForDomain(
@@ -89,20 +137,96 @@ export function applicationHomePolicyLaw(
         maxChildWorkspacesPerUser,
         birthPolicyDomains,
         homeGenesis,
-        parentWorkspaceRoles,
-      ),
+        providerRootRoles,
+        recoveryPosture,
+      )
     ),
+    // THE RECOVERY DOOR IS DECLARED, NOT DISCOVERED. Only the attested-parent posture has a platform
+    // door; an application that declares nothing (or the guardian default) composes no recovery law at
+    // all, so its application-home identity is byte-identical to a compile before this existed.
+    ...(recoveryPosture === PLATFORM_IDENTITY_PROVIDER_RECOVERY
+      ? receivingGroupRecoveryLaw(recoveryPosture)
+      : {}),
+    // CHILD AUTHENTICATION IS FRAMEWORK LAW FOR EVERY PACKAGE THAT BIRTHS CHILDREN (receiving_group_
+    // lifecycle.md, cut 1 item 3): the verifier-epoch serve/accept pair and the workspace-parameterised
+    // child repair, composed here — the one compiler-owned domain, installed into every born workspace —
+    // so no tenant copies them per child kind. A package whose only birth-capable domain is this one
+    // births no children and composes none of it (the era rule).
+    ...(birthPolicyDomains.some((domain) => domain !== APPLICATION_HOME_DOMAIN)
+      ? childAuthenticationExports()
+      : {}),
+    // THE PARENT-DIRECTED MODEL TRANSITION (architecture/parent_directed_model_transition.md) rides the
+    // same seam: the platform's direction and the child's attested-parent acceptor, one exported pair,
+    // composed only when the package births children.
+    ...(birthPolicyDomains.some((domain) => domain !== APPLICATION_HOME_DOMAIN)
+      ? modelTransitionExports()
+      : {}),
+    // THE SELF-HEAL (same design, the third door): a child born before the birth seat existed, and
+    // never directed, asks its OWN verified parent for the model authority it should have been born
+    // holding. Composed under the same era rule, so a package that births nothing is byte-identical.
+    ...(birthPolicyDomains.some((domain) => domain !== APPLICATION_HOME_DOMAIN)
+      ? modelAuthorityRepairExports()
+      : {}),
   };
 }
+// MODEL AUTHORITY DESCENDS: every receiving group is born holding its platform's installDomain holders
+// (the genesis step the birth above embeds), so the anchor law declares the seed + its genesis-only posture.
+export const __nomos_seatInheritedModelAuthority = directive(seatInheritedModelAuthority);
+export const __nomos_modelAuthoritySeedBeforeWarrant = internal(modelAuthoritySeedBeforeWarrant);
 export const __nomos_ReceivingGroup = aggregate(ReceivingGroup);
 export const __nomos_seedReceivingGroup = directive(seedReceivingGroup);
 export const __nomos_ReceivingGroupPolicy = aggregate(ReceivingGroupPolicy);
-export const __nomos_seedReceivingGroupPolicy = directive(seedReceivingGroupPolicy);
-export const __nomos_receivingGroupNameBindsPrincipal = internal(receivingGroupNameBindsPrincipal);
-export const __nomos_receivingGroupRejectsKeylessAdditionalDevice = internal(receivingGroupRejectsKeylessAdditionalDevice);
-export const __nomos_receivingGroupAdditionalDeviceFollowsPolicy = internal(receivingGroupAdditionalDeviceFollowsPolicy);
-export const __nomos_receivingGroupRevocationFollowsPolicy = internal(receivingGroupRevocationFollowsPolicy);
-export const __nomos_receivingGroupRelations = internal(receivingGroupRelations);
+export const __nomos_seedReceivingGroupPolicy = directive(
+  seedReceivingGroupPolicy
+);
+export const __nomos_receivingGroupNameBindsPrincipal = internal(
+  receivingGroupNameBindsPrincipal
+);
+export const __nomos_receivingGroupRejectsKeylessAdditionalDevice = internal(
+  receivingGroupRejectsKeylessAdditionalDevice
+);
+export const __nomos_receivingGroupAdditionalDeviceFollowsPolicy = internal(
+  receivingGroupAdditionalDeviceFollowsPolicy
+);
+export const __nomos_receivingGroupRevocationFollowsPolicy = internal(
+  receivingGroupRevocationFollowsPolicy
+);
+export const __nomos_receivingGroupRelations = internal(
+  receivingGroupRelations
+);
+
+// TOKEN-FREE FOUNDING (identity target model D22): the founding step a founded group's recipe carries,
+// the birth origin and warrant the kernel's founded birth effect appends, and what they seat — the
+// operator and enroller relations — plus the enrolled scope's first-key lane, so an enroller the group
+// inherited from its parent enrols (and revokes) the owner's further devices here.
+export const __nomos_FoundingPrincipal = aggregate(FoundingPrincipal);
+// Parent side: the proof that a founded group's author is its owner, and the enroller read its recipe captures.
+export const __nomos_receivingGroupFoundedBirthBindsOwner = internal(receivingGroupFoundedBirthBindsOwner);
+export const __nomos_relationTuplesByRelation = query(relationTuplesByRelation);
+export const __nomos_seedFoundingPrincipal = directive(seedFoundingPrincipal);
+export const __nomos_foundingPrincipalVirginOnly = internal(foundingPrincipalVirginOnly);
+export const __nomos_BirthOrigin = aggregate(BirthOrigin);
+export const __nomos_seedBirthOrigin = directive(seedBirthOrigin);
+export const __nomos_birthOriginVirginOnly = internal(birthOriginVirginOnly);
+export const __nomos_workspaceOperatorRelations = internal(workspaceOperatorRelations);
+export const __nomos_principalScopeRelations = internal(principalScopeRelations);
+// The console's lawful reach into the group (framework/console_governance.ts): the founding seat of the
+// inherited operators' and enrollers' keys and law authority, operator handover, console key rotation.
+export const __nomos_seedInheritedGovernance = directive(consoleGovernanceLaw.seedInheritedGovernance);
+export const __nomos_inheritedGovernanceBeforeWarrant = internal(consoleGovernanceLaw.inheritedGovernanceBeforeWarrant);
+export const __nomos_grantConsoleOperator = directive(consoleGovernanceLaw.grantConsoleOperator);
+export const __nomos_revokeConsoleOperator = directive(consoleGovernanceLaw.revokeConsoleOperator);
+export const __nomos_lastOperatorRemains = internal(consoleGovernanceLaw.lastOperatorRemains);
+export const __nomos_enrollConsoleSigner = directive(consoleGovernanceLaw.enrollConsoleSigner);
+export const __nomos_revokeConsoleSigner = directive(consoleGovernanceLaw.revokeConsoleSigner);
+export const __nomos_lastConsoleSignerRemains = internal(consoleGovernanceLaw.lastConsoleSignerRemains);
+// Roles a parent delegates into founded groups: the parent's policy and grant lane. The child's seat
+// and adoption lane are the tenant's `delegatedRoles(...)` declaration, in the domain that owns the role.
+export const __nomos_delegatedRoleRelations = internal(delegatedRoleRelations);
+export const __nomos_grantDelegatedRole = directive(grantDelegatedRole);
+export const __nomos_revokeDelegatedRole = directive(revokeDelegatedRole);
+export const __nomos_enrollDevice = directive(enrollDevice);
+export const __nomos_revokeDevice = directive(revokeDevice);
 
 // Subject-side discovery/share custody.
 export const __nomos_SharedWithMe = aggregate(SharedWithMe);
@@ -110,6 +234,9 @@ export const __nomos_recordShare = directive(recordShare);
 export const __nomos_pruneShare = directive(pruneShare);
 export const __nomos_sharedByWorkspace = query(sharedByWorkspace);
 export const __nomos_sharedByObject = query(sharedByObject);
+export const __nomos_recordReceivedWorkspaceAccess = recordReceivedWorkspaceAccess;
+export const __nomos_receivedWorkspaceAccess = query(receivedWorkspaceAccess);
+export const __nomos_receivedWorkspaceAccessIsForOwner = internal(receivedWorkspaceAccessIsForOwner);
 
 // Warrant, provenance, signer seating, recovery and verifier state.
 export const __nomos_GenesisWarrant = aggregate(GenesisWarrant);
@@ -123,21 +250,46 @@ export const __nomos_RelationTuple = aggregate(RelationTuple);
 export const __nomos_relationTuplesByObject = query(relationTuplesByObject);
 export const __nomos_identityRelations = internal(identityRelations);
 export const __nomos_enrollSigner = directive(enrollSigner);
-export const __nomos_enrollAdmissionCheckpointSigner = directive(enrollAdmissionCheckpointSigner);
+export const __nomos_enrollAdmissionCheckpointSignerIntent = internal(
+  intent("enrollAdmissionCheckpointSigner").performs(
+    enrollAdmissionCheckpointSigner
+  )
+);
+// Called directly (as revokeSigner is), so its last-key invariant binds the directive the offer names.
+export const __nomos_revokeAdmissionCheckpointSigner = directive(revokeAdmissionCheckpointSigner);
+export const __nomos_lastAdmissionCheckpointSignerRemains = internal(
+  lastAdmissionCheckpointSignerRemains
+);
 export const __nomos_enrollFirstDevice = directive(enrollFirstDevice);
 export const __nomos_enrollSignerSelf = directive(enrollSignerSelf);
-export const __nomos_enrollSignerSelfRequiresVerified = internal(enrollSignerSelfRequiresVerified);
+export const __nomos_enrollSignerSelfRequiresVerified = internal(
+  enrollSignerSelfRequiresVerified
+);
 export const __nomos_revokeSigner = directive(revokeSigner);
-export const __nomos_revokeSignerEpochStrictlyIncreases = internal(revokeSignerEpochStrictlyIncreases);
+export const __nomos_revokeSignerEpochStrictlyIncreases = internal(
+  revokeSignerEpochStrictlyIncreases
+);
 export const __nomos_SignerEpoch = aggregate(SignerEpoch);
 export const __nomos_signerEpochCurrent = query(signerEpochCurrent);
 export const __nomos_advanceSignerEpoch = directive(advanceSignerEpoch);
-export const __nomos_signerEpochStrictlyIncreases = internal(signerEpochStrictlyIncreases);
+export const __nomos_signerEpochStrictlyIncreases = internal(
+  signerEpochStrictlyIncreases
+);
+export const __nomos_enrollDelegationRetainsEvidence = internal(enrollDelegationRetainsEvidence);
+export const __nomos_enrollFirstDeviceRetainsEvidence = internal(enrollFirstDeviceRetainsEvidence);
 export const __nomos_SignerDelegation = aggregate(SignerDelegation);
 export const __nomos_enrollDelegation = directive(enrollDelegation);
 export const __nomos_signerDelegationByUser = query(signerDelegationByUser);
 export const __nomos_AuthProvider = aggregate(AuthProvider);
+export const __nomos_AuthProviderKey = aggregate(AuthProviderKey);
+export const __nomos_AuthProviderCertificate = aggregate(AuthProviderCertificate);
 export const __nomos_seedAuthProvider = directive(seedAuthProvider);
-export const __nomos_authProviderSeedBeforeWarrant = internal(authProviderSeedBeforeWarrant);
+export const __nomos_authProviderSeedBeforeWarrant = internal(
+  authProviderSeedBeforeWarrant
+);
 export const __nomos_setAuthProvider = directive(setAuthProvider);
+export const __nomos_adoptIdentityProviderWitness = directive(adoptIdentityProviderWitness);
+export const __nomos_identityProviderSourceTrust = internal(identityProviderSourceTrust);
 export const __nomos_authProvider = query(authProvider);
+export const __nomos_authProviderKeys = query(authProviderKeys);
+export const __nomos_authProviderCertificates = query(authProviderCertificates);

package/src/framework/attested_receipts.ts

@@ -32,6 +32,7 @@ import { Lww } from "../drivers.js";
 import { directive } from "../directive.js";
 import { set } from "../ops.js";
 import { query } from "../query.js";
+import { valueObject } from "../value_object.js";
 
 /** The framework-reserved receipt instance-id prefix (kernel mirror:
  *  `nomos_executor::ATTESTATION_RECEIPT_PREFIX`). */
@@ -58,6 +59,10 @@ export function sourceDishonorId(sourceGenesis: string, keyHash: string): string
  * extra signed bytes and NO reader identity (least-disclosure). `receiptPath` (the kernel
  * query op) serves Merkle inclusion `{batchRoot, index, path}` from the folded `leaves`.
  */
+export const AttestationReceiptLeaves = valueObject("AttestationReceiptLeaves", {
+  values: z.array(z.string().min(1)).min(1),
+});
+
 export const NomosAttestationReceipt = aggregate("NomosAttestationReceipt", {
   /** `"<epoch>-<nSealedReceiptsInFold>-<keyHash8>"` — chain-derived mint (collision-free across remounts); promised on every envelope's `receipt_hint`. */
   batchId: t.string().merge(Lww),
@@ -65,8 +70,8 @@ export const NomosAttestationReceipt = aggregate("NomosAttestationReceipt", {
   batchRoot: t.string().merge(Lww),
   /** The leaf count (kernel-verified == leaves.length at the gate). */
   leafCount: t.int().merge(Lww),
-  /** The leaf hashes, in serve order (JSON array) — what `receiptPath` serves from. */
-  leaves: t.json().merge(Lww),
+  /** The leaf hashes, in serve order, stored as a typed structural value object. */
+  leaves: AttestationReceiptLeaves.field().merge(Lww),
   /** The `attested_at_ms` range the batch covers. */
   firstAt: t.int().merge(Lww),
   lastAt: t.int().merge(Lww),
@@ -113,7 +118,7 @@ export const recordAttestationBatch = directive("recordAttestationBatch")
       set(r, "batchId", p.batchId),
       set(r, "batchRoot", p.batchRoot),
       set(r, "leafCount", p.leafCount),
-      set(r, "leaves", JSON.stringify(p.leaves)),
+      set(r, "leaves", { values: p.leaves }),
       set(r, "firstAt", p.firstAt),
       set(r, "lastAt", p.lastAt),
       set(r, "headAtSeal", p.headAtSeal),