@githolon/dsl 0.108.7 → 0.110.0

package/src/framework/home.ts

@@ -4,738 +4,9 @@
 // If a file isn't this / hosting this / authoring for this / proving this — it's gone.
 
 /**
- * framework/home.ts — THE HOME HOLON (the identity role; `architecture/home_holons_and_cross_custody.md`
- * §4). One holon, three roles — "workspace," "platform," "home" are the SAME githolon wearing the role
- * its installed LAW gives it. A HOME holon runs THIS law: an identity's subject-side root.
- *
- * It holds only PUBLIC material + signed facts (private keys never leave the client, so the cloud hosting
- * it stays operator-blind):
- *  - KEY DIRECTORY — the identity's public device keys: the `signer` relation
- *    (`identity:<principal>#signer@key:<hash>`, `framework/signing_identity.ts`). Re-exported here so a
- *    home holon's law carries it: "wrap the scope key to U's device" becomes "read U's home key roster."
- *  - SHARED-WITH-ME index (§5) — one record per verified cross-custody attestation delivered here, so
- *    "show me everything shared with me" is a LOCAL query, no fan-out.
- *  - INBOX — grants/invites/notifications/dead-letters addressed to the identity.
- *
- * THE FORWARD-CHECK DOCTRINE (§5): the index is a DISCOVERY HINT, not the authority. When the identity
- * actually opens the asserting workspace, THAT workspace's gate does the live `Check` — so a stale share
- * (the asserter revoked it) is fail-safe: the identity sees a workspace it can no longer open, the forward
- * check denies, the hint is pruned. (The cross-custody ATTESTATION that proves a delivered share is signed
- * + verifiable is §3; the host DELIVERY lane that fills the index is §5. This file is the law that holds
- * the result, and the owner-authored lane to maintain it.)
+ * @deprecated `framework/home.ts` is the OLD NAME of `framework/receiving_group.ts` (the receiving
+ * group is the framework concept; "home" is a tenant's word for the business law it composes into
+ * that anchor — `architecture/receiving_group_lifecycle.md`). This shim re-exports the same
+ * declarations, byte-identical, for ONE release; import `./receiving_group.js` instead.
  */
-import { z } from "zod";
-import type { ApplicationHomeGenesis } from "../application_home_genesis.js";
-import { aggregate, instance, OWNED_READ_RELATION } from "../aggregate.js";
-import { sha256Digest, t } from "../fields.js";
-import { Lww } from "../drivers.js";
-import { directive } from "../directive.js";
-import { ensure } from "../authoring.js";
-import { set, withMarker, type PlannedOp } from "../ops.js";
-import { query } from "../query.js";
-import { birth, type WorkspaceRole } from "../births.js";
-import {
-  authProvider as authProviderQuery,
-  authProviderCertificates as authProviderCertificatesQuery,
-  authProviderKeys as authProviderKeysQuery,
-  readAuthProviderVerifyingConfiguration,
-  seedAuthProvider,
-} from "./auth_provider_law.js";
-import { readRef, readSet, workspaceInvariant, refAs } from "./workspace_invariant.js";
-import {
-  identityRelations,
-} from "./signing_identity.js";
-import {
-  RelationTuple,
-  writeTuple,
-} from "./relations.js";
-import { relationType, self, user, selfObject } from "../relation_schema.js";
-import { requireParentAttestedBirth, type ParentAttestedBirthMarker } from "../births.js";
-import { GenesisWarrant, seedGenesis } from "./genesis.js";
-import { idOf } from "../value_object.js";
-import {
-  DomainInstallExecutor,
-  domainInstallGenesisOffer,
-} from "./domain_lifecycle.js";
-import { birthCertificatePayload } from "./birth_certificate_law.js";
-
-// `nomos.sha256` — the TRUSTLESS, pure hash computed IN the githolon (Rust sha2 bound in the sealed engine;
-// see deterministic-rquickjs). Available as a global to plans + invariant predicates (like `nomos.mint`); it
-// lets the home law re-derive `home-<hash(owner)>` itself, so the SQUAT invariant runs in-law on every peer.
-declare const nomos: { sha256(input: string): string };
-
-/** The KEY DIRECTORY is the `signer` relation — re-exported so a home holon's law composes it (the
- *  identity's public device keys, enrolled via `enrollSigner`, checked by the gate). */
-export { identityRelations };
-
-/** THE GENESIS WARRANT primitives — re-exported so a HOME law carries them in the `home` domain key. The
- *  birthHome genesis chain runs `home/seedGenesis` to record the home's unique self-id (== homeName), so
- *  `workspace_self_id` resolves on the home and BOTH the signed-author regime + the parent-attested-birth
- *  cert door FIRE on every home (BREAK 1). Without this the home is unwarranted and both doors are inert. */
-export { GenesisWarrant, seedGenesis };
-
-/**
- * THE RECEIVING GROUP — one sovereign framework identity whose enrolled devices clone this same holon.
- * It is not a tenant Person, an IdP account or a host-owned account. The native global
- * `identity:<principal>#signer@key:<hash>` relation is its device roster; this singleton binds the group's
- * stable principal to the workspace that carries that roster and its access manifest.
- *
- * The wire identifiers are deliberately obscure framework names. Tenant business packages may model their
- * own `ReceivingGroup`, `home` or `group` concepts without silently colliding with this implementation.
- */
-export const RECEIVING_GROUP_ID = "nomos-internal-receiving-group-7c1f5e:self";
-/** A receiving group's self-committed workspace-name prefix. */
-export const RECEIVING_GROUP_NAME_PREFIX = "nomos-rg-";
-export const RECEIVING_GROUP_NAME_HASH_LEN = 40;
-export const RECEIVING_GROUP_POLICY_ID = "nomos-internal-receiving-group-policy-7c1f5e:self";
-export const ReceivingGroup = aggregate("NomosInternalReceivingGroup7c1f5e", {
-  /** The stable Zanzibar principal represented by this group. Credentials may locate it but do not own it. */
-  principal: t.string().merge(Lww),
-  /** The group's self-committed workspace name, deterministically bound to its stable principal. */
-  workspaceName: t.string().merge(Lww),
-  /** ISO-8601, caller-stamped (determinism — no clock in the plan). */
-  bornAt: t.string().merge(Lww),
-// The group's genesis seats its controller in OWNED_READ_RELATION below. Declaring that same capability
-// here makes the law's coarse pack gate recognise the seat, so a newly enrolled device can clone its own
-// receiving group before any tenant records or tenant-authored grants exist. This remains ordinary,
-// replayable Zanzibar state: revocation removes the seat; there is no kernel-level founder bypass.
-}, { cap: 1 }).readableBy(OWNED_READ_RELATION);
-
-/**
- * The framework-owned device lifecycle policy for one receiving group. This is deliberately data, not a
- * client-side branch: every peer replays the same rule. The first supported posture is intentionally small
- * and secure: a live, verified device may add or revoke another device; keyless IdP enrolment is only the
- * pre-group bootstrap lane.
- *
- * ALL-DEVICE-LOSS RECOVERY — CO2 already recovers through its platform AuthProvider, but the implementation
- * reaches that result by repeating birth after this home's direct enrollment policy refuses. The corrected
- * design (`architecture/guardian_device_recovery.md`, reconciled 2026-08-10) makes recovery authority an
- * explicit tenant-selected policy: platform identity provider or guardian quorum. The missing work is to
- * evaluate that choice at the existing child's frontier and delete the client-side birth-repeat bypass.
- */
-export const ReceivingGroupPolicy = aggregate("NomosInternalReceivingGroupPolicy7c1f5e", {
-  additionalDevice: t.string().merge(Lww),
-  revocation: t.string().merge(Lww),
-  recovery: t.string().merge(Lww),
-  guardianQuorum: t.int().merge(Lww),
-  setAt: t.string().merge(Lww),
-}, { cap: 1 }).public();
-
-export const DEFAULT_RECEIVING_GROUP_POLICY = {
-  additionalDevice: "current-device",
-  revocation: "current-device",
-  recovery: "guardian-quorum",
-  guardianQuorum: 1,
-} as const;
-
-/** The recovery authorities a receiving group may explicitly select. The default remains guardian
- * quorum; an application must deliberately choose its attested parent identity provider. */
-export const RECEIVING_GROUP_RECOVERY_POLICIES = [
-  "guardian-quorum",
-  "platform-identity-provider",
-] as const;
-export const receivingGroupRecoveryPolicy = z.enum(RECEIVING_GROUP_RECOVERY_POLICIES);
-export type ReceivingGroupRecoveryPolicy = z.infer<typeof receivingGroupRecoveryPolicy>;
-export const PLATFORM_IDENTITY_PROVIDER_RECOVERY: ReceivingGroupRecoveryPolicy =
-  "platform-identity-provider";
-
-function writeReceivingGroupPolicy(p: {
-  setAt: string;
-  recovery?: ReceivingGroupRecoveryPolicy | undefined;
-}): PlannedOp[] {
-  const policy = instance(ReceivingGroupPolicy, RECEIVING_GROUP_POLICY_ID);
-  return [
-    set(policy, "additionalDevice", DEFAULT_RECEIVING_GROUP_POLICY.additionalDevice),
-    set(policy, "revocation", DEFAULT_RECEIVING_GROUP_POLICY.revocation),
-    set(policy, "recovery", p.recovery ?? DEFAULT_RECEIVING_GROUP_POLICY.recovery),
-    set(policy, "guardianQuorum", DEFAULT_RECEIVING_GROUP_POLICY.guardianQuorum),
-    set(policy, "setAt", p.setAt),
-  ];
-}
-
-/** Genesis-only default policy. Policy changes become a separate, guardian-aware ceremony. */
-export const seedReceivingGroupPolicy = directive("nomosInternalSeedReceivingGroupPolicy7c1f5e")
-  .ensures(ReceivingGroupPolicy)
-  .payload(z.object({
-    setAt: z.string().min(1),
-    recovery: receivingGroupRecoveryPolicy.optional(),
-  }))
-  .plan((p) => writeReceivingGroupPolicy(p));
-
-/**
- * The group's controller relation binds its stable principal inside the same genesis. Business representation
- * remains separate Zanzibar edges; this relation only establishes who controls this receiving-group holon.
- */
-export const receivingGroupRelations = relationType("nomos.internal.receiving-group.7c1f5e").relation("controller", {
-  rewrite: self(),
-  allow: [user()],
-});
-
-/** Stamp the receiving group and atomically seat its controller relation. */
-export function writeReceivingGroup(p: { principal: string; workspaceName: string; bornAt: string }): PlannedOp[] {
-  const h = instance(ReceivingGroup, RECEIVING_GROUP_ID);
-  return [
-    set(h, "principal", p.principal),
-    set(h, "workspaceName", p.workspaceName),
-    set(h, "bornAt", p.bornAt),
-    ...writeTuple({
-      object: selfObject(receivingGroupRelations),
-      relation: "controller",
-      subject: p.principal,
-      grantedBy: p.principal,
-      grantedAt: p.bornAt,
-    }),
-    // A device clones the encrypted workspace before record-level ownership can be evaluated locally.
-    // Seat the group's controller for that ciphertext transport in the same genesis; individual owned
-    // records still require their own per-record reader edge before they decrypt or appear in reads.
-    ...writeTuple({
-      object: "workspace:self",
-      relation: OWNED_READ_RELATION,
-      subject: p.principal,
-      grantedBy: p.principal,
-      grantedAt: p.bornAt,
-    }),
-  ];
-}
-
-/**
- * Genesis-only receiving-group stamp. The name is caller-supplied but the invariant below re-derives it.
- */
-export const seedReceivingGroup = directive("nomosInternalSeedReceivingGroup7c1f5e")
-  .ensures(ReceivingGroup)
-  .payload(z.object({ principal: z.string().min(1), workspaceName: z.string().min(1), bornAt: z.string().min(1) }))
-  .plan((p) => writeReceivingGroup(p))
-  .alsoEnsures(RelationTuple);
-
-/**
- * THE SQUAT INVARIANT (home_holons §5) — a home holon's self-committed `homeName` MUST be the hash of its
- * owner: `homeName == home-<sha256(principal)>`. Declared by the home law, it EXECUTES at the one gate — and
- * crucially at `verify_chain` (the bailiff's upload-birth): a squatter's chain (claiming `home-<hash(bob)>`
- * but owned by `mallory`) FAILS the home law's OWN gate during adoption — refused IN THE GITHOLON, BY THE LAW,
- * never by a host check. The host only routes the chain to the name it commits to (custody). `nomos.sha256`
- * re-derives the hash in-law on every peer, so the verdict is identical everywhere.
- */
-export const receivingGroupNameBindsPrincipal = workspaceInvariant("ReceivingGroupNameBindsPrincipal")
-  .on("nomosInternalSeedReceivingGroup7c1f5e")
-  .reads(readSet(readRef("group", ReceivingGroup).at(RECEIVING_GROUP_ID)))
-  .declassify("the receiving-group address is a public hash of its stable principal; refusing a mismatch reveals no private field")
-  .assert(({ group }) => {
-    const g = (group ?? {}) as { principal?: string; workspaceName?: string };
-    const expected = RECEIVING_GROUP_NAME_PREFIX
-      + nomos.sha256(String(g.principal ?? "")).slice(0, RECEIVING_GROUP_NAME_HASH_LEN);
-    return g.workspaceName === expected
-      ? { accept: true }
-      : { reject: "a receiving group's workspace name must hash its stable principal" };
-  });
-
-const receivingGroupPolicyRefs = readSet(
-  readRef("group", ReceivingGroup).at(RECEIVING_GROUP_ID),
-  readRef("policy", ReceivingGroupPolicy).at(RECEIVING_GROUP_POLICY_ID),
-);
-
-/** An IdP token may bootstrap the parent before the group exists; it may never bypass an existing group's
- * device policy. An existing group chooses whether recovery is delegated to its platform AuthProvider or to
- * guardians; the current default below says guardian, while CO2's current product behaviour is platform IdP.
- *
- * KNOWN GAP (`architecture/guardian_device_recovery.md`): this invariant is declared `.on("enrollFirstDevice")`
- * and only fires when that directive targets THIS home directly. It is NOT re-applied when the birth
- * offer-effect (`run_birth_effect`, repeating `nomosInternalBirthReceivingGroup` against an ALREADY-founded
- * home) folds a signer seat via the SAME underlying mechanism. That is how CO2 recovery works today, but its
- * home frontier still says `guardian-quorum`. The fix is not to ban platform recovery: add the explicit
- * platform-identity-provider policy, make CO2 choose it, and have the child gate verify the chosen evidence. */
-export const receivingGroupRejectsKeylessAdditionalDevice = workspaceInvariant("ReceivingGroupRejectsKeylessAdditionalDevice")
-  .on("enrollFirstDevice")
-  .reads(receivingGroupPolicyRefs)
-  .declassify("device enrollment deliberately reveals that this receiving group has already completed first-device bootstrap")
-  .assert(({ group }) => typeof group?.principal !== "string" || group.principal.length === 0
-    ? { accept: true }
-    : { reject: "receiving-group-additional-device-requires-current-device-or-guardian" });
-
-/** The shipped additional-device policy: an already enrolled, verified device signs the self-bound enrol. */
-export const receivingGroupAdditionalDeviceFollowsPolicy = workspaceInvariant("ReceivingGroupAdditionalDeviceFollowsPolicy")
-  .on("enrollSignerSelf")
-  .reads(receivingGroupPolicyRefs)
-  .declassify("device lifecycle policy intentionally branches on principal_verified")
-  .assert(({ group, policy }, ctx) => {
-    if (typeof group?.principal !== "string" || group.principal.length === 0) return { accept: true };
-    const p = policy as { additionalDevice?: string } | undefined;
-    return p?.additionalDevice === "current-device" && ctx?.principalVerified === true
-      ? { accept: true }
-      : { reject: "receiving-group-additional-device-policy-refused" };
-  });
-
-/** The shipped revocation policy: a live verified group device authors the remove-wins signer change. */
-export const receivingGroupRevocationFollowsPolicy = workspaceInvariant("ReceivingGroupRevocationFollowsPolicy")
-  .on("revokeSigner")
-  .reads(receivingGroupPolicyRefs)
-  .declassify("device lifecycle policy intentionally branches on principal_verified")
-  .assert(({ group, policy }, ctx) => {
-    if (typeof group?.principal !== "string" || group.principal.length === 0) return { accept: true };
-    const p = policy as { revocation?: string } | undefined;
-    return p?.revocation === "current-device" && ctx?.principalVerified === true
-      ? { accept: true }
-      : { reject: "receiving-group-revocation-policy-refused" };
-  });
-
-/** Re-derive a receiving group's workspace name in-law. */
-export function receivingGroupNameOf(principal: string): string {
-  return RECEIVING_GROUP_NAME_PREFIX
-    + nomos.sha256(String(principal)).slice(0, RECEIVING_GROUP_NAME_HASH_LEN);
-}
-
-/**
- * `birthHome` — THE FRAMEWORK BIRTH PRIMITIVE for a home holon. This is the MECHANICS (OURS) so a tenant
- * never hand-builds a home genesis: the parent (the cloud/platform whose governance includes this directive)
- * ORDERS the birth of an identity's home holon, and the kernel's offer-effect spawns it + self-validates it
- * through the child's OWN gate from intent 0 (the `.births()` declared consequence; `architecture/
- * home_holons_and_cross_custody.md` + `sovereign_adapter.md` "birth is a kernel offer-effect").
- *
- * SELF-BOUND — squatting is structurally impossible (no separate grant needed; the policy gate is the
- * tenant's `setAuthProvider` auth scoping, which decides whether the offering principal is verified at all):
- *   1. The home OWNER rides the payload (`owner`, a `user:<uid>` subject). `ctx.principal()` is opaque
- *      PrincipalEvidence — it CANNOT be read as a raw string in-plan to compute the slot name — so the owner
- *      is payload-carried, but the binding below makes it sound.
- *   2. The workspace name + the seeded `homeName` are BOTH derived from THE SAME payload `owner` via
- *      {@link homeNameOf} — they cannot diverge in this plan.
- *   3. The child's genesis includes `seedHomeOwner(owner, homeNameOf(owner), bornAt)`, and the home law's
- *      {@link homeNameBindsOwner} invariant RE-DERIVES `home-<sha256(owner)>` at the child's gate (author AND
- *      verify_chain). So a chain that claims `home-<hash(alice)>` but seeds owner `bob` FAILS the child's own
- *      law — refused in the githolon, by the law, never by a host. A verified principal is required upstream
- *      (no anonymous home birth); the offer principal IS the auth boundary (the tenant's setAuthProvider).
- *
- * The genesis chain it authors (reusing the order-declares-the-law install shape — bytes resolved by hash
- * from the parent's typed USDA closure custody):
- *   [ bootstrap/installDomain(frameworkHash), nomos/home installDomain(lawHash), seedHomeOwner(owner, …) ]
- * `frameworkHash` (the bootstrap controller hash) + `lawHash` (the HOME law package domainHash) are
- * tenant-PINNED at their governance compile (mirroring `birthChild`) — the end-user app supplies neither;
- * the tenant's HomeBirth.viaCoordinator buildBody / their governance fills them. `seedHomeOwner` is INCLUDED
- * so HomeOwner is seeded and `homeNameBindsOwner` passes (a birth without it would be an invalid, un-owned
- * home).
- */
-// Standalone framework law explicitly declares `home`; compiler-composed business applications explicitly
-// declare the obscure APPLICATION_HOME_DOMAIN. The kernel refuses law with no attestation-seed registrar.
-export const RECEIVING_GROUP_LAW_DOMAIN = "home";
-/**
- * Build the private home-birth primitive for the domain key that carries the home law.
- *
- * Most framework-authored laws still use the historic public `home` key through
- * {@link birthHome}. Business packages use an obscure compiler-owned key instead, so a
- * tenant remains free to model a business concept called "home". The key is closed over
- * here and written into every child-genesis step; it is never a tenant payload field.
- */
-export function birthReceivingGroupForDomain(
-  groupLawDomain: string,
-  maxChildWorkspacesPerUser: number,
-  birthPolicyDomains: readonly string[],
-  homeGenesis?: ApplicationHomeGenesis,
-  parentWorkspaceRoles: readonly WorkspaceRole[] = [],
-) {
-  if (groupLawDomain.length === 0) {
-    throw new Error("birthReceivingGroupForDomain requires a non-empty receiving-group law domain");
-  }
-  if (!Number.isInteger(maxChildWorkspacesPerUser) || maxChildWorkspacesPerUser < 0) {
-    throw new Error(
-      "birthReceivingGroupForDomain requires an explicit non-negative maxChildWorkspacesPerUser; " +
-        "Nomos has no compiled birth-policy fallback",
-    );
-  }
-  const policyDomains = [...new Set(birthPolicyDomains)];
-  if (
-    policyDomains.length === 0 ||
-    policyDomains.some((domain) => domain.trim().length === 0) ||
-    !policyDomains.includes(groupLawDomain)
-  ) {
-    throw new Error(
-      "birthReceivingGroupForDomain requires every co-resident birth-capable law domain, " +
-        "including its own domain; Nomos will not birth partially configured law",
-    );
-  }
-  const birthDirective = directive("nomosInternalBirthReceivingGroup7c1f5e")
-  .creates(ReceivingGroup)
-  .payload(
-    z.object({
-      /** The identity this home belongs to (a `user:<uid>` subject). The workspace name + seeded homeName are
-       *  both `home-<sha256(owner)>` — self-bound, so you can only birth YOUR OWN home slot. */
-      owner: z.string().min(1),
-      /** The bootstrap framework controller content hash — tenant-pinned at governance compile (the child
-       *  installs it IN-CHAIN as intent 0; the kernel resolves the bytes by hash from the parent's custody). */
-      frameworkHash: sha256Digest(),
-      /** The HOME law package domainHash — tenant-pinned at governance compile (the child's second install). */
-      lawHash: sha256Digest(),
-      /** ISO-8601 birth time, caller-stamped (the timestamp doctrine — the plan reads no clock). */
-      bornAt: z.string().min(1),
-      /** AUTHPROVIDER INHERITANCE — DEFAULT ON, opt out with `false`. Verification is PER-WORKSPACE (the
-       *  kernel never walks up to the parent), so a PRIVATE child born without its own AuthProvider cannot
-       *  verify any token — its own owner is locked out of verified reads (the co2 phase-6 wall). By
-       *  default the birth READS the parent's `authProvider` row (the #58 captured-read lane — live at
-       *  author, CAS-re-derived at the gate) and, when one is declared, COPIES it AS DATA into the child's
-       *  genesis (a `setAuthProvider` step) — the child still OWNS its verifier as its own law-state; the
-       *  parent's later rotations do NOT propagate (re-set on the child to rotate). Requirements the
-       *  refusals name: the parent law must compose the `authProvider` query and the child law the
-       *  `setAuthProvider` directive (both ride the framework export set). Pass `false` for a child that
-       *  must NOT trust the parent's IdP (it then seeds its own or stays bare-principal). */
-      inheritAuthProvider: z.boolean().optional(),
-    }),
-  )
-  .plan((p) => {
-    const founder = p.owner; // the actor for the child's own genesis steps (its self-bound owner subject)
-    const groupName = receivingGroupNameOf(p.owner);
-    // THE PARENT'S DECLARED VERIFIER. This captured read supplies the inherited provider seed.
-    // Birth-certificate verification and founding-signer enrollment belong to the kernel-owned
-    // attestation step, so neither fact is duplicated in this tenant plan or payload.
-    const inheritedProvider = p.inheritAuthProvider === false
-      ? undefined
-      : readAuthProviderVerifyingConfiguration();
-    const genesisChain: Array<{ domain: string; directiveId: string; actor: string; payload: Record<string, unknown>; domainHash?: string }> = [
-      // THE ORDER-DECLARED LAW INSTALL: two typed closure identities. The kernel resolves each
-      // closure from the parent's custody when it folds the birth; law bytes never ride the intent.
-      domainInstallGenesisOffer(
-        DomainInstallExecutor.StageZero,
-        p.frameworkHash,
-        founder,
-      ),
-      domainInstallGenesisOffer(
-        DomainInstallExecutor.LifecycleController,
-        p.lawHash,
-        founder,
-      ),
-      {
-        domain: groupLawDomain,
-        directiveId: "nomosInternalSeedReceivingGroupPolicy7c1f5e",
-        actor: founder,
-        payload: { setAt: p.bornAt },
-      },
-      // SEED THE OWNER — the home is born OWNED; the homeNameBindsOwner invariant in the child's law proves
-      // homeName == home-<sha256(owner)> at the child's own gate, so the slot can ONLY be its rightful owner's.
-      {
-        domain: groupLawDomain,
-        directiveId: "nomosInternalSeedReceivingGroup7c1f5e",
-        actor: founder,
-        payload: { principal: p.owner, workspaceName: groupName, bornAt: p.bornAt },
-      },
-      // The receiving group is born with its child-workspace allowance as explicit law-state. The
-      // value is closed over by the package's application policy, so neither the host nor the end
-      // user can substitute it in the offer payload.
-      ...policyDomains.map((domain) => ({
-        domain,
-        directiveId: "seedBirthPolicy",
-        actor: founder,
-        payload: {
-          maxBirthsPerPrincipal: maxChildWorkspacesPerUser,
-          setBy: p.owner,
-          setAt: p.bornAt,
-        },
-      })),
-      // Tenant founding law is an ordered list of ordinary offers. Values derive solely from the
-      // canonical home facts; every payload is parsed by the target directive before it reaches
-      // the child's author gate. There is no host append point and no framework-selected fallback.
-      ...(homeGenesis?.steps ?? []).map((step) => ({
-        domain: step.domain,
-        directiveId: step.directive.id,
-        actor: founder,
-        payload: step.directive.payloadSchema.parse(step.payload({
-          owner: p.owner,
-          workspaceName: groupName,
-          bornAt: p.bornAt,
-        })),
-      })),
-    ];
-    // AUTHPROVIDER INHERITANCE (default ON — see the payload doc): copy the parent's declared provider
-    // (the up-front captured read above) AS DATA into the child genesis. The child owns the copy as its
-    // own law-state; nothing is inherited-by-reference. Opt out: `inheritAuthProvider: false`.
-    if (p.inheritAuthProvider !== false) {
-      if (inheritedProvider !== undefined) {
-        genesisChain.push({
-          domain: groupLawDomain,
-          directiveId: "seedAuthProvider",
-          actor: founder,
-          payload: {
-            ...inheritedProvider,
-            label: "inherited-from-parent",
-            setBy: p.owner,
-            setAt: 1, // genesis position — deterministic, like enrollSigner's grantedAt
-          },
-        });
-      }
-    }
-    // THE DECLARED BIRTH EFFECT (the unix model): the recipe rides the committed intent as a declared output
-    // (captured_ports.births). The kernel — reading the `.births()` declaration off the law manifest — takes
-    // the recipe and spawns + self-validates the child through the child's OWN gate (each step self-verifies).
-    birth({
-      workspace: groupName,
-      genesisChain,
-      ...(parentWorkspaceRoles.length > 0 ? { parentWorkspaceRoles } : {}),
-    });
-    // Parent/child lineage is an ordinary global Zanzibar relation in parent custody. The exact child
-    // address comes from the same plan which births it, so neither the host nor the caller can redirect
-    // this seat. Application law can then authorize upward workspace effects with the ordinary relation.
-    return writeTuple({
-      object: "workspace:self",
-      relation: "child",
-      subject: `workspace:${groupName}`,
-      grantedBy: p.owner,
-      grantedAt: p.bornAt,
-    });
-  })
-  .reads(authProviderQuery) // the parent-side AuthProvider capture the inheritance copies (the #58 lane)
-  .reads(authProviderKeysQuery)
-  .reads(authProviderCertificatesQuery)
-  .alsoEnsures(RelationTuple)
-  .births(); // BIRTH IS A DECLARED KERNEL PRIMITIVE — emits the `nomosBirthGate` era key; the kernel folds the recipe
-  return {
-    ...birthDirective,
-    ...(homeGenesis === undefined || homeGenesis.steps.length === 0
-      ? {}
-      : {
-          birthGenesisRequirements: homeGenesis.steps.map((step) => ({
-            domain: step.domain,
-            directiveId: step.directive.id,
-          })),
-        }),
-  };
-}
-
-/** Build the standalone framework receiving-group law with an explicit allowance. */
-export const birthReceivingGroup = (maxChildWorkspacesPerUser: number) =>
-  birthReceivingGroupForDomain(
-    RECEIVING_GROUP_LAW_DOMAIN,
-    maxChildWorkspacesPerUser,
-    [RECEIVING_GROUP_LAW_DOMAIN],
-  );
-
-/**
- * THE SHARED-WITH-ME INDEX (§5) — one record per cross-custody attestation delivered to this home holon:
- * a signed edge `<asserterWorkspace> : <object> # <relation> @ this-identity`, indexed LOCALLY so the
- * access list is a local query (no fan-out across every resource holon). A DISCOVERY HINT — the live authz
- * stays the forward `Check` on the asserting holon when the identity opens it.
- */
-export const SharedWithMe = aggregate("SharedWithMe", {
-  /** The holon that signed + delivered this edge — WHERE the live forward `Check` runs when opened. */
-  asserterWorkspace: t.string().merge(Lww),
-  /** The shared OBJECT — the whole workspace (`workspace:self`) or a specific record (`Entry:<id>`). */
-  object: t.string().merge(Lww),
-  /** The relation granted (`reader` / `editor` / a read cap). */
-  relation: t.string().merge(Lww),
-  /** The asserter's OWNER principal — whose key signed the attestation (verified at §3 admission). */
-  asserterPrincipal: t.string().merge(Lww),
-  /** ISO-8601, caller-stamped (determinism — no clock in the plan). */
-  attestedAt: t.string().merge(Lww),
-  /** PRUNED (forward-check fail-safe): set when the live `Check` on the asserter denies — the hint is
-   *  dropped from the list but the audit row stays. `""` = live. */
-  prunedAt: t.string().merge(Lww),
-}).public();
-
-/** One idempotent access-manifest row per source edge in this home. Delivery is at-least-once: a retry,
- * reconnect or source outbox replay must update the same bookmark rather than manufacture another thing the
- * recipient appears to have access to. The home itself scopes the recipient, so the edge coordinate is the
- * source workspace + protected object + granted relation. */
-export function sharedWithMeId(asserterWorkspace: string, object: string, relation: string): string {
-  const coordinate = JSON.stringify([asserterWorkspace, object, relation]);
-  return `SharedWithMe_${nomos.sha256(coordinate)}`;
-}
-
-/**
- * `recordShare` — index a cross-custody share into the home holon's access list. AUTHORED on the home
- * holon (the identity's own subject-side root). The payload carries the §3 CROSS-CUSTODY ATTESTATION — a
- * SIGNED QUOTE: the asserter's device `publicKey` + a `signature` over the edge
- * `<asserterWorkspace>:<object>#<relation>@<this-home-owner>`. The home holon's OWN gate verifies it
- * (`executor::record_share_attestation_violation`, bound to the warrant owner), so the BAILIFF can deliver
- * it HOST-FREE (the host carries bytes, vouches nothing — the gate vouches). The owner lane authors the
- * SAME shape (the owner holds the quote the asserter gave it). The signature is a verification input, not
- * stored — only the edge facts fold into the index. The live authority stays the forward `Check` on the
- * asserter when the identity opens it (§5 fail-safe); a stale/forged quote can't enter the list at all.
- */
-export const recordShare = directive("recordShare")
-  .ensures(SharedWithMe)
-  .payload(
-    z.object({
-      asserterWorkspace: z.string().min(1),
-      object: z.string().min(1),
-      relation: z.string().min(1),
-      asserterPrincipal: z.string().min(1),
-      attestedAt: z.string().min(1),
-      /** The asserter's device PUBLIC KEY (base64) — what the §3 gate verifies the quote against. */
-      publicKey: z.string().min(1),
-      /** The asserter's SIGNATURE (base64) over the edge bytes, subject = this home's owner. */
-      signature: z.string().min(1),
-    }),
-  )
-  .plan((p) => {
-    // ENSURE, never CREATE: signed delivery is retryable and therefore at-least-once. Re-delivery (including
-    // a later re-grant after prune) refreshes this exact access edge and makes it live again.
-    ensure(SharedWithMe, sharedWithMeId(p.asserterWorkspace, p.object, p.relation))
-      .set("asserterWorkspace", p.asserterWorkspace)
-      .set("object", p.object)
-      .set("relation", p.relation)
-      .set("asserterPrincipal", p.asserterPrincipal)
-      .set("attestedAt", p.attestedAt)
-      .set("prunedAt", "");
-    return [];
-  })
-  // CROSS-CUSTODY ATTESTATION-AUTHORIZED (§3/§5): the payload's signed quote IS the authorization (lowered
-  // into the `nomosAttestationGate` era key) — the one gate verifies it against the home's owner (the
-  // LAW-DECLARED owner-source below, NOT a kernel-hardcoded id) + pins the principal to the attestation key,
-  // so the bailiff delivers it host-free to an OFFLINE subject (no device key, no author block).
-  .attestationAuthorized({ ownerObject: RECEIVING_GROUP_ID, ownerField: "principal" });
-
-/**
- * `pruneShare` — fail-safe drop of a hint whose forward `Check` denied (the asserter revoked it). The row
- * stays for audit; `prunedAt` removes it from the live list. (The forward check itself is the resource
- * holon's job — this records the verdict locally.)
- */
-export const pruneShare = directive("pruneShare")
-  .mutates(SharedWithMe)
-  .payload(z.object({ shareId: idOf(SharedWithMe), prunedAt: z.string().min(1) }))
-  .plan((p) => [set(instance(SharedWithMe, p.shareId), "prunedAt", p.prunedAt)]);
-
-/** "Show me everything <asserter> shared with me" — an indexed probe over the local access list. */
-export const sharedByWorkspace = query("sharedByWorkspace").key("asserterWorkspace").returns(SharedWithMe);
-
-/** "Show me every share for this protected object" — the indexed access-list probe used by generated
- * application discovery. A home commonly has a very large installed law, so discovery must never fall back
- * to the generic `aggregatesByType(SharedWithMe)` scan merely to find whole-workspace shares. */
-export const sharedByObject = query("sharedByObject").key("object").returns(SharedWithMe);
-
-// ─────────────────── THE PEER-SOVEREIGN ROOT-OF-TRUST (the BirthAttestation cert chain) ───────────────────
-
-/**
- * THE BIRTH ATTESTATION (the cert, on-chain for AUDIT). When a parent P births this home via the offer-
- * effect, the kernel seeds a SIGNED [executor::birth_cert::BirthCert] {child, founder, verified, parentKey,
- * parentId, epoch} into the home's genesis (it travels with the home's `GenesisWarrant.bornUnder` so a peer
- * verifies it OFFLINE), AND folds this singleton record so the home's projection surfaces "who attested my
- * birth, and was my founder verified". `verified` + `founder` are the parent's GATE verdict (captured-port,
- * CAS-as-law), never the offer payload. A peer's TRUST decision uses the travelling signed chain (the kernel
- * verify doors); this aggregate is the human-readable mirror.
- */
-export const BIRTH_ATTESTATION_ID = "birth-attestation:self";
-export const BIRTH_ATTESTATION_LINK_PREFIX = "birth-attestation-link:";
-export const BirthAttestation = aggregate("BirthAttestation", {
-  /** This home's self-id (`home-<sha256(founder)>`) — the cert's `child`. */
-  child: t.string().merge(Lww),
-  /** The founding principal the parent attested (== {@link HomeOwner} `principal`). */
-  founder: t.string().merge(Lww),
-  /** THE PARENT'S GATE VERDICT: was `founder` VERIFIED at the parent's offer gate (an IdP vouched)? */
-  verified: t.string().merge(Lww), // "true"/"false" (string for the Lww scalar projection)
-  /** The parent's workspace self-id (lineage). */
-  parentId: t.string().merge(Lww),
-  /** The parent's enrolled signer PUBLIC KEY (base64) — `K_P`, the cert's signer. */
-  parentKey: t.string().merge(Lww),
-  /** The parent's SignerEpoch at the attestation (informational; the cert is judged at birth-time validity). */
-  epoch: t.int().merge(Lww),
-  /** Legacy replay slot for histories authored before `BirthAttestationLink`. New histories write the
-   *  travelling chain only as ordered, typed link records below. */
-  certChain: t.string().merge(Lww).optional(),
-}).public();
-
-/** One exact link in the travelling certificate chain. The zero-padded index is custody order; every
- * certificate member is a separate typed USDA property. `certChain` above remains only as a replay fallback
- * for histories authored before this aggregate existed. */
-export const BirthAttestationLink = aggregate("BirthAttestationLink", {
-  index: t.int().merge(Lww),
-  child: t.string().merge(Lww),
-  founder: t.string().merge(Lww),
-  verified: t.bool().merge(Lww),
-  parentKey: t.string().merge(Lww),
-  parentId: t.string().merge(Lww),
-  epoch: t.int().merge(Lww),
-  signature: t.string().merge(Lww),
-  verifiedVia: t.string().merge(Lww).optional(),
-  idpToken: t.string().merge(Lww).optional(),
-  capturedClock: t.int().merge(Lww).optional(),
-  authProviderIssuer: t.string().merge(Lww).optional(),
-  authProviderJwks: t.string().merge(Lww).optional(),
-  authProviderAudience: t.string().merge(Lww).optional(),
-}).public();
-
-/** Audit read: this home's birth attestation (who attested it + the verified verdict). */
-export const birthAttestation = query("birthAttestation").key("child").returns(BirthAttestation);
-
-/**
- * `seedBirthAttestation` — THE GENESIS-DOOR step the parent's offer-effect INJECTS into the home's genesis
- * chain (the kernel appends it in `run_birth_effect` carrying the assembled + signed cert chain). It folds
- * the [`BirthAttestation`] singleton so the home's own state carries its travelling cert. A CONTROL-PLANE
- * write seeded once at birth (the open session lane structurally refuses it by directive id). The values
- * are the parent's GATE VERDICT (`founder`/`verified` lowered from the captured port — CAS-as-law, never
- * the offer payload) + the typed signed links; the home's verify doors re-derive trust from the chain.
- */
-export const seedBirthAttestation = directive("seedBirthAttestation")
-  .ensures(BirthAttestation)
-  .payload(
-    z.object({
-      child: z.string().min(1),
-      founder: z.string().min(1),
-      verified: z.string().min(1), // "true"/"false"
-      /** The parent's workspace self-id (lineage). EMPTY for a root-DIRECT birth (root carries no self-id
-       *  binding in the unwarranted lane) — the cert's terminal link is then signed by K_root directly. */
-      parentId: z.string(),
-      parentKey: z.string().min(1), // base64 K_P
-      epoch: z.number().int().nonnegative(),
-      links: z.array(birthCertificatePayload).min(1),
-      /** Law-declared target roles for the verified immediate parent workspace. The kernel injects this
-       * value from the admitted birth recipe and supplies `parentId`; no host chooses either fact. */
-      parentWorkspaceRoles: z.array(z.string().regex(/^[A-Za-z][A-Za-z0-9_-]*$/)).optional(),
-    }).superRefine((payload, ctx) => {
-      if ((payload.parentWorkspaceRoles?.length ?? 0) > 0 && payload.parentId.length === 0) {
-        ctx.addIssue({ code: "custom", message: "parent workspace roles require a verified non-root parentId" });
-      }
-    }),
-  )
-  .plan((p) => {
-    const h = instance(BirthAttestation, BIRTH_ATTESTATION_ID);
-    const header = [
-      set(h, "child", p.child),
-      set(h, "founder", p.founder),
-      set(h, "verified", p.verified),
-      set(h, "parentId", p.parentId),
-      set(h, "parentKey", p.parentKey),
-      set(h, "epoch", p.epoch),
-    ];
-    const links = p.links.flatMap((certificate, index) => {
-      const link = instance(BirthAttestationLink, `${BIRTH_ATTESTATION_LINK_PREFIX}${String(index).padStart(8, "0")}`);
-      return [
-        withMarker(set(link, "index", index), "ensures"),
-        withMarker(set(link, "child", certificate.child), "ensures"),
-        withMarker(set(link, "founder", certificate.founder), "ensures"),
-        withMarker(set(link, "verified", certificate.verified), "ensures"),
-        withMarker(set(link, "parentKey", certificate.parentKey), "ensures"),
-        withMarker(set(link, "parentId", certificate.parentId), "ensures"),
-        withMarker(set(link, "epoch", certificate.epoch), "ensures"),
-        withMarker(set(link, "signature", certificate.signature), "ensures"),
-        ...(certificate.verifiedVia ? [withMarker(set(link, "verifiedVia", certificate.verifiedVia), "ensures")] : []),
-        ...(certificate.idpToken ? [withMarker(set(link, "idpToken", certificate.idpToken), "ensures")] : []),
-        ...(certificate.capturedClock === undefined ? [] : [withMarker(set(link, "capturedClock", certificate.capturedClock), "ensures")]),
-        ...(certificate.authProviderIssuer ? [withMarker(set(link, "authProviderIssuer", certificate.authProviderIssuer), "ensures")] : []),
-        ...(certificate.authProviderJwks ? [withMarker(set(link, "authProviderJwks", certificate.authProviderJwks), "ensures")] : []),
-        ...(certificate.authProviderAudience ? [withMarker(set(link, "authProviderAudience", certificate.authProviderAudience), "ensures")] : []),
-      ];
-    });
-    const parentAuthority = (p.parentWorkspaceRoles ?? []).flatMap((relation) => writeTuple({
-      object: "workspace:self",
-      relation,
-      subject: `workspace:${p.parentId}`,
-      grantedBy: `workspace:${p.parentId}`,
-      grantedAt: String(p.epoch),
-    }));
-    return [...header, ...links, ...parentAuthority];
-  })
-  .alsoEnsures(BirthAttestationLink)
-  .alsoEnsures(RelationTuple);
-
-/**
- * THE ERA DECLARATION (the `nomosParentAttestedBirth` USD key). Exporting this sentinel from the home law
- * tells the kernel's verify doors to VERIFY THE TRAVELLING CERT CHAIN to the pinned `K_root` on every lane
- * (author / receive / verify_chain) — so a warranted home that self-asserts a verified founder WITHOUT a
- * parent-signed chain rooting at root is refused (`ParentDidNotAttest` / `CertChainBroken` /
- * `NotRootedAtRoot`). Era-ruled: a home law that does NOT export this carries no key and replays byte-
- * identical (the squat-only `homeNameBindsOwner` check still runs; the cert check is simply inert).
- */
-export const parentAttestedBirth: ParentAttestedBirthMarker = {
-  ...requireParentAttestedBirth,
-  // DECLARE the owner + cert locators so the KERNEL reads them (it names neither): the home owner lives at
-  // the `HomeOwner` singleton's `principal`. `certObject`/`certField` retain the legacy chain locator for
-  // old histories; current histories are discovered through the typed `BirthAttestationLink` aggregate.
-  ownerObject: RECEIVING_GROUP_ID,
-  ownerField: "principal",
-  certObject: BIRTH_ATTESTATION_ID,
-  certField: "certChain",
-};
+export * from "./receiving_group.js";