@githolon/dsl 0.108.7 → 0.110.0

package/src/framework/receiving_group.ts

@@ -0,0 +1,857 @@
+// NOMOS — Nomos Sovereign: participants act · verify · remember LOCALLY; hosted
+// remotes are replaceable custody/transport, not truth.  ⇒ ONE Nomos GitHolon
+// wasm32-wasip1 artifact {kernel · projection · embedded QuickJS engine}.
+// If a file isn't this / hosting this / authoring for this / proving this — it's gone.
+
+/**
+ * framework/receiving_group.ts — THE RECEIVING GROUP (the identity role; `architecture/
+ * receiving_group_lifecycle.md`, `home_holons_and_cross_custody.md` §4). One holon, three roles —
+ * "workspace," "platform," "receiving group" are the SAME githolon wearing the role its installed LAW
+ * gives it. A receiving group runs THIS law: an identity's subject-side root — the one small workspace
+ * an enrolled device can always clone first. "Home" is a TENANT's word for the business law it composes
+ * into this anchor; the framework never uses it (this file was `home.ts` until 2026-09-11; that path
+ * remains a deprecated re-export shim for one release).
+ *
+ * It holds only PUBLIC material + signed facts (private keys never leave the client, so the cloud hosting
+ * it stays operator-blind):
+ *  - KEY DIRECTORY — the identity's public device keys: the `signer` relation
+ *    (`identity:<principal>#signer@key:<hash>`, `framework/signing_identity.ts`). Re-exported here so a
+ *    home holon's law carries it: "wrap the scope key to U's device" becomes "read U's home key roster."
+ *  - SHARED-WITH-ME index (§5) — one record per verified cross-custody attestation delivered here, so
+ *    "show me everything shared with me" is a LOCAL query, no fan-out.
+ *  - INBOX — grants/invites/notifications/dead-letters addressed to the identity.
+ *
+ * THE FORWARD-CHECK DOCTRINE (§5): the index is a DISCOVERY HINT, not the authority. When the identity
+ * actually opens the asserting workspace, THAT workspace's gate does the live `Check` — so a stale share
+ * (the asserter revoked it) is fail-safe: the identity sees a workspace it can no longer open, the forward
+ * check denies, the hint is pruned. (The cross-custody ATTESTATION that proves a delivered share is signed
+ * + verifiable is §3; the host DELIVERY lane that fills the index is §5. This file is the law that holds
+ * the result, and the owner-authored lane to maintain it.)
+ */
+import { z } from "zod";
+import type { ApplicationHomeGenesis } from "../application_home_genesis.js";
+import { aggregate, instance, OWNED_READ_RELATION } from "../aggregate.js";
+import { sha256Digest, t } from "../fields.js";
+import { Lww } from "../drivers.js";
+import { directive } from "../directive.js";
+import { ensure } from "../authoring.js";
+import { set, withMarker, type PlannedOp } from "../ops.js";
+import { query } from "../query.js";
+import { AUTH_PROVIDER_EPOCH_CONSUMER, birth, type WorkspaceRole } from "../births.js";
+import {
+  authProvider as authProviderQuery,
+  authProviderCertificates as authProviderCertificatesQuery,
+  authProviderKeys as authProviderKeysQuery,
+  readAuthProviderVerifyingConfiguration,
+  seedAuthProvider,
+} from "./auth_provider_law.js";
+import { readRef, readSet, workspaceInvariant, refAs } from "./workspace_invariant.js";
+import {
+  identityRelations,
+} from "./signing_identity.js";
+import {
+  RelationTuple,
+  relationTuplesByObject,
+  writeTuple,
+} from "./relations.js";
+import { inheritedModelAuthorityGenesisStep } from "./model_authority_seed.js";
+import { relationType, self, user, selfObject } from "../relation_schema.js";
+import { requireParentAttestedBirth, type ParentAttestedBirthMarker } from "../births.js";
+import { GenesisWarrant, seedGenesis } from "./genesis.js";
+import { idOf } from "../value_object.js";
+import {
+  DomainInstallExecutor,
+  domainInstallGenesisOffer,
+} from "./domain_lifecycle.js";
+import { birthCertificatePayload } from "./birth_certificate_law.js";
+import { recordReceivedWorkspaceAccess } from "./workspace_access.js";
+import { readInheritedOperators, seedFoundingPrincipal } from "./founding_genesis.js";
+import { readInheritedEnrollers, relationTuplesByRelation } from "./principal_enrollment.js";
+import { inheritedGovernanceStep } from "./console_governance.js";
+import { delegatedRolesSteps, RECEIVING_GROUP_CHILD_KIND } from "./delegated_roles.js";
+export { recordReceivedWorkspaceAccess, receivedWorkspaceAccess } from "./workspace_access.js";
+
+// `nomos.sha256` — the TRUSTLESS, pure hash computed IN the githolon (Rust sha2 bound in the sealed engine;
+// see deterministic-rquickjs). Available as a global to plans + invariant predicates (like `nomos.mint`); it
+// lets the home law re-derive `home-<hash(owner)>` itself, so the SQUAT invariant runs in-law on every peer.
+declare const nomos: { sha256(input: string): string };
+
+/** The KEY DIRECTORY is the `signer` relation — re-exported so a home holon's law composes it (the
+ *  identity's public device keys, enrolled via `enrollSigner`, checked by the gate). */
+export { identityRelations };
+
+/** THE GENESIS WARRANT primitives — re-exported so a HOME law carries them in the `home` domain key. The
+ *  birthReceivingGroup genesis chain runs `home/seedGenesis` to record the home's unique self-id (== homeName), so
+ *  `workspace_self_id` resolves on the home and BOTH the signed-author regime + the parent-attested-birth
+ *  cert door FIRE on every home (BREAK 1). Without this the home is unwarranted and both doors are inert. */
+export { GenesisWarrant, seedGenesis };
+
+/**
+ * THE RECEIVING GROUP — one sovereign framework identity whose enrolled devices clone this same holon.
+ * It is not a tenant Person, an IdP account or a host-owned account. The native global
+ * `identity:<principal>#signer@key:<hash>` relation is its device roster; this singleton binds the group's
+ * stable principal to the workspace that carries that roster and its access manifest.
+ *
+ * The wire identifiers are deliberately obscure framework names. Tenant business packages may model their
+ * own `ReceivingGroup`, `home` or `group` concepts without silently colliding with this implementation.
+ */
+export const RECEIVING_GROUP_ID = "nomos-internal-receiving-group-7c1f5e:self";
+/** A receiving group's self-committed workspace-name prefix. */
+export const RECEIVING_GROUP_NAME_PREFIX = "nomos-rg-";
+export const RECEIVING_GROUP_NAME_HASH_LEN = 40;
+export const RECEIVING_GROUP_POLICY_ID = "nomos-internal-receiving-group-policy-7c1f5e:self";
+export const ReceivingGroup = aggregate("NomosInternalReceivingGroup7c1f5e", {
+  /** The stable Zanzibar principal represented by this group. Credentials may locate it but do not own it. */
+  principal: t.string().merge(Lww),
+  /** The group's self-committed workspace name, deterministically bound to its stable principal. */
+  workspaceName: t.string().merge(Lww),
+  /** ISO-8601, caller-stamped (determinism — no clock in the plan). */
+  bornAt: t.string().merge(Lww),
+// The group's genesis seats its controller in OWNED_READ_RELATION below. Declaring that same capability
+// here makes the law's coarse pack gate recognise the seat, so a newly enrolled device can clone its own
+// receiving group before any tenant records or tenant-authored grants exist. This remains ordinary,
+// replayable Zanzibar state: revocation removes the seat; there is no kernel-level founder bypass.
+}, { cap: 1 }).readableBy(OWNED_READ_RELATION);
+
+/**
+ * The framework-owned device lifecycle policy for one receiving group. This is deliberately data, not a
+ * client-side branch: every peer replays the same rule. The first supported posture is intentionally small
+ * and secure: a live, verified device may add or revoke another device; keyless IdP enrolment is only the
+ * pre-group bootstrap lane.
+ *
+ * ALL-DEVICE-LOSS RECOVERY — CO2 already recovers through its platform AuthProvider, but the implementation
+ * reaches that result by repeating birth after this home's direct enrollment policy refuses. The corrected
+ * design (`architecture/guardian_device_recovery.md`, reconciled 2026-08-10) makes recovery authority an
+ * explicit tenant-selected policy: platform identity provider or guardian quorum. The missing work is to
+ * evaluate that choice at the existing child's frontier and delete the client-side birth-repeat bypass.
+ */
+export const ReceivingGroupPolicy = aggregate("NomosInternalReceivingGroupPolicy7c1f5e", {
+  additionalDevice: t.string().merge(Lww),
+  revocation: t.string().merge(Lww),
+  recovery: t.string().merge(Lww),
+  guardianQuorum: t.int().merge(Lww),
+  setAt: t.string().merge(Lww),
+}, { cap: 1 }).public();
+
+export const DEFAULT_RECEIVING_GROUP_POLICY = {
+  additionalDevice: "current-device",
+  revocation: "current-device",
+  recovery: "guardian-quorum",
+  guardianQuorum: 1,
+} as const;
+
+/** The recovery authorities a receiving group may explicitly select. The default remains guardian
+ * quorum; an application must deliberately choose its attested parent identity provider. */
+export const RECEIVING_GROUP_RECOVERY_POLICIES = [
+  "guardian-quorum",
+  "platform-identity-provider",
+] as const;
+export const receivingGroupRecoveryPolicy = z.enum(RECEIVING_GROUP_RECOVERY_POLICIES);
+export type ReceivingGroupRecoveryPolicy = z.infer<typeof receivingGroupRecoveryPolicy>;
+export const PLATFORM_IDENTITY_PROVIDER_RECOVERY: ReceivingGroupRecoveryPolicy =
+  "platform-identity-provider";
+
+/** The one policy write: genesis seeds it, and the framework's recovery acceptor re-seats it for a
+ * receiving group born under the untouched framework default (`receiving_group_recovery.ts`). */
+export function writeReceivingGroupPolicy(p: {
+  setAt: string;
+  recovery?: ReceivingGroupRecoveryPolicy | undefined;
+}): PlannedOp[] {
+  const policy = instance(ReceivingGroupPolicy, RECEIVING_GROUP_POLICY_ID);
+  return [
+    set(policy, "additionalDevice", DEFAULT_RECEIVING_GROUP_POLICY.additionalDevice),
+    set(policy, "revocation", DEFAULT_RECEIVING_GROUP_POLICY.revocation),
+    set(policy, "recovery", p.recovery ?? DEFAULT_RECEIVING_GROUP_POLICY.recovery),
+    set(policy, "guardianQuorum", DEFAULT_RECEIVING_GROUP_POLICY.guardianQuorum),
+    set(policy, "setAt", p.setAt),
+  ];
+}
+
+/** Genesis-only default policy. Policy changes become a separate, guardian-aware ceremony. */
+export const seedReceivingGroupPolicy = directive("nomosInternalSeedReceivingGroupPolicy7c1f5e")
+  .ensures(ReceivingGroupPolicy)
+  .payload(z.object({
+    setAt: z.string().min(1),
+    recovery: receivingGroupRecoveryPolicy.optional(),
+  }))
+  .plan((p) => writeReceivingGroupPolicy(p));
+
+/**
+ * The group's controller relation binds its stable principal inside the same genesis. Business representation
+ * remains separate Zanzibar edges; this relation only establishes who controls this receiving-group holon.
+ */
+export const receivingGroupRelations = relationType("nomos.internal.receiving-group.7c1f5e").relation("controller", {
+  rewrite: self(),
+  allow: [user()],
+});
+
+/** Stamp the receiving group and atomically seat its controller relation. */
+export function writeReceivingGroup(p: { principal: string; workspaceName: string; bornAt: string }): PlannedOp[] {
+  const h = instance(ReceivingGroup, RECEIVING_GROUP_ID);
+  return [
+    set(h, "principal", p.principal),
+    set(h, "workspaceName", p.workspaceName),
+    set(h, "bornAt", p.bornAt),
+    ...writeTuple({
+      object: selfObject(receivingGroupRelations),
+      relation: "controller",
+      subject: p.principal,
+      grantedBy: p.principal,
+      grantedAt: p.bornAt,
+    }),
+    // A device clones the encrypted workspace before record-level ownership can be evaluated locally.
+    // Seat the group's controller for that ciphertext transport in the same genesis; individual owned
+    // records still require their own per-record reader edge before they decrypt or appear in reads.
+    ...writeTuple({
+      object: "workspace:self",
+      relation: OWNED_READ_RELATION,
+      subject: p.principal,
+      grantedBy: p.principal,
+      grantedAt: p.bornAt,
+    }),
+  ];
+}
+
+/**
+ * Genesis-only receiving-group stamp. The name is caller-supplied but the invariant below re-derives it.
+ */
+export const seedReceivingGroup = directive("nomosInternalSeedReceivingGroup7c1f5e")
+  .ensures(ReceivingGroup)
+  .payload(z.object({ principal: z.string().min(1), workspaceName: z.string().min(1), bornAt: z.string().min(1) }))
+  .plan((p) => writeReceivingGroup(p))
+  .alsoEnsures(RelationTuple);
+
+/**
+ * THE SQUAT INVARIANT (home_holons §5) — a home holon's self-committed `homeName` MUST be the hash of its
+ * owner: `homeName == home-<sha256(principal)>`. Declared by the home law, it EXECUTES at the one gate — and
+ * crucially at `verify_chain` (the bailiff's upload-birth): a squatter's chain (claiming `home-<hash(bob)>`
+ * but owned by `mallory`) FAILS the home law's OWN gate during adoption — refused IN THE GITHOLON, BY THE LAW,
+ * never by a host check. The host only routes the chain to the name it commits to (custody). `nomos.sha256`
+ * re-derives the hash in-law on every peer, so the verdict is identical everywhere.
+ */
+export const receivingGroupNameBindsPrincipal = workspaceInvariant("ReceivingGroupNameBindsPrincipal")
+  .on("nomosInternalSeedReceivingGroup7c1f5e")
+  .reads(readSet(readRef("group", ReceivingGroup).at(RECEIVING_GROUP_ID)))
+  .declassify("the receiving-group address is a public hash of its stable principal; refusing a mismatch reveals no private field")
+  .assert(({ group }) => {
+    const g = (group ?? {}) as { principal?: string; workspaceName?: string };
+    const expected = RECEIVING_GROUP_NAME_PREFIX
+      + nomos.sha256(String(g.principal ?? "")).slice(0, RECEIVING_GROUP_NAME_HASH_LEN);
+    return g.workspaceName === expected
+      ? { accept: true }
+      : { reject: "a receiving group's workspace name must hash its stable principal" };
+  });
+
+const receivingGroupPolicyRefs = readSet(
+  readRef("group", ReceivingGroup).at(RECEIVING_GROUP_ID),
+  readRef("policy", ReceivingGroupPolicy).at(RECEIVING_GROUP_POLICY_ID),
+);
+
+/** An IdP token may bootstrap the parent before the group exists; it may never bypass an existing group's
+ * device policy. An existing group chooses whether recovery is delegated to its platform AuthProvider or to
+ * guardians; the current default below says guardian, while CO2's current product behaviour is platform IdP.
+ *
+ * KNOWN GAP (`architecture/guardian_device_recovery.md`): this invariant is declared `.on("enrollFirstDevice")`
+ * and only fires when that directive targets THIS home directly. It is NOT re-applied when the birth
+ * offer-effect (`run_birth_effect`, repeating `nomosInternalBirthReceivingGroup` against an ALREADY-founded
+ * home) folds a signer seat via the SAME underlying mechanism. That is how CO2 recovery works today, but its
+ * home frontier still says `guardian-quorum`. The fix is not to ban platform recovery: add the explicit
+ * platform-identity-provider policy, make CO2 choose it, and have the child gate verify the chosen evidence. */
+export const receivingGroupRejectsKeylessAdditionalDevice = workspaceInvariant("ReceivingGroupRejectsKeylessAdditionalDevice")
+  .on("enrollFirstDevice")
+  .reads(receivingGroupPolicyRefs)
+  .declassify("device enrollment deliberately reveals that this receiving group has already completed first-device bootstrap")
+  .assert(({ group }) => typeof group?.principal !== "string" || group.principal.length === 0
+    ? { accept: true }
+    : { reject: "receiving-group-additional-device-requires-current-device-or-guardian" });
+
+/** The shipped additional-device policy: an already enrolled, verified device signs the self-bound enrol. */
+export const receivingGroupAdditionalDeviceFollowsPolicy = workspaceInvariant("ReceivingGroupAdditionalDeviceFollowsPolicy")
+  .on("enrollSignerSelf")
+  .reads(receivingGroupPolicyRefs)
+  .declassify("device lifecycle policy intentionally branches on principal_verified")
+  .assert(({ group, policy }, ctx) => {
+    if (typeof group?.principal !== "string" || group.principal.length === 0) return { accept: true };
+    const p = policy as { additionalDevice?: string } | undefined;
+    return p?.additionalDevice === "current-device" && ctx?.principalVerified === true
+      ? { accept: true }
+      : { reject: "receiving-group-additional-device-policy-refused" };
+  });
+
+/** The shipped revocation policy: a live verified group device authors the remove-wins signer change. */
+export const receivingGroupRevocationFollowsPolicy = workspaceInvariant("ReceivingGroupRevocationFollowsPolicy")
+  .on("revokeSigner")
+  .reads(receivingGroupPolicyRefs)
+  .declassify("device lifecycle policy intentionally branches on principal_verified")
+  .assert(({ group, policy }, ctx) => {
+    if (typeof group?.principal !== "string" || group.principal.length === 0) return { accept: true };
+    const p = policy as { revocation?: string } | undefined;
+    return p?.revocation === "current-device" && ctx?.principalVerified === true
+      ? { accept: true }
+      : { reject: "receiving-group-revocation-policy-refused" };
+  });
+
+/** Re-derive a receiving group's workspace name in-law. */
+export function receivingGroupNameOf(principal: string): string {
+  return RECEIVING_GROUP_NAME_PREFIX
+    + nomos.sha256(String(principal)).slice(0, RECEIVING_GROUP_NAME_HASH_LEN);
+}
+
+/** The speaker is established by the ordinary carried-offer gate. This law binds
+ * its otherwise source-scoped access claim to the actual recipient of this Home. */
+export const receivedWorkspaceAccessIsForOwner = workspaceInvariant("ReceivedWorkspaceAccessIsForOwner")
+  .on(recordReceivedWorkspaceAccess.id)
+  .reads(readSet(readRef("group", ReceivingGroup).at(RECEIVING_GROUP_ID)))
+  .declassify("acceptance discloses only that this access claim was addressed to the receiving principal")
+  .assert(({ group }, ctx) => group?.principal === ctx?.intent.recipient
+    ? { accept: true }
+    : { reject: "workspace-access-wrong-recipient" });
+
+/**
+ * `birthReceivingGroup` (née `birthHome`) — THE FRAMEWORK BIRTH PRIMITIVE for a receiving group. This is
+ * the MECHANICS (OURS) so a tenant never hand-builds a home genesis: the parent (the platform whose law includes this directive)
+ * ORDERS the birth of an identity's home holon, and the kernel's offer-effect spawns it + self-validates it
+ * through the child's OWN gate from intent 0 (the `.births()` declared consequence; `architecture/
+ * home_holons_and_cross_custody.md` + `sovereign_adapter.md` "birth is a kernel offer-effect").
+ *
+ * SELF-BOUND — squatting is structurally impossible (no separate grant needed; the policy gate is the
+ * tenant's `setAuthProvider` auth scoping, which decides whether the offering principal is verified at all):
+ *   1. The home OWNER rides the payload (`owner`, a `user:<uid>` subject). `ctx.principal()` is opaque
+ *      PrincipalEvidence — it CANNOT be read as a raw string in-plan to compute the slot name — so the owner
+ *      is payload-carried, but the binding below makes it sound.
+ *   2. The workspace name + the seeded `homeName` are BOTH derived from THE SAME payload `owner` via
+ *      {@link homeNameOf} — they cannot diverge in this plan.
+ *   3. The child's genesis includes `seedHomeOwner(owner, homeNameOf(owner), bornAt)`, and the home law's
+ *      {@link homeNameBindsOwner} invariant RE-DERIVES `home-<sha256(owner)>` at the child's gate (author AND
+ *      verify_chain). So a chain that claims `home-<hash(alice)>` but seeds owner `bob` FAILS the child's own
+ *      law — refused in the githolon, by the law, never by a host. A verified principal is required upstream
+ *      (no anonymous home birth); the offer principal IS the auth boundary (the tenant's setAuthProvider).
+ *
+ * The genesis chain it authors (reusing the order-declares-the-law install shape — bytes resolved by hash
+ * from the parent's typed USDA closure custody):
+ *   [ bootstrap/installDomain(frameworkHash), nomos/home installDomain(lawHash), seedHomeOwner(owner, …) ]
+ * `frameworkHash` (the bootstrap controller hash) + `lawHash` (the HOME law package domainHash) are
+ * tenant-PINNED at their governance compile (mirroring `birthChild`) — the end-user app supplies neither;
+ * the tenant's HomeBirth.viaCoordinator buildBody / their governance fills them. `seedHomeOwner` is INCLUDED
+ * so HomeOwner is seeded and `homeNameBindsOwner` passes (a birth without it would be an invalid, un-owned
+ * home).
+ */
+// Standalone framework law explicitly declares `home`; compiler-composed business applications explicitly
+// declare the obscure APPLICATION_HOME_DOMAIN. The kernel refuses law with no attestation-seed registrar.
+export const RECEIVING_GROUP_LAW_DOMAIN = "home";
+/**
+ * Build the private home-birth primitive for the domain key that carries the home law.
+ *
+ * Most framework-authored laws still use the historic public `home` key through
+ * {@link birthReceivingGroup}. Business packages use an obscure compiler-owned key instead, so a
+ * tenant remains free to model a business concept called "home". The key is closed over
+ * here and written into every child-genesis step; it is never a tenant payload field.
+ */
+export function birthReceivingGroupForDomain(
+  groupLawDomain: string,
+  maxChildWorkspacesPerUser: number,
+  birthPolicyDomains: readonly string[],
+  homeGenesis?: ApplicationHomeGenesis,
+  parentWorkspaceRoles: readonly WorkspaceRole[] = [],
+  recoveryPosture?: ReceivingGroupRecoveryPolicy,
+) {
+  if (groupLawDomain.length === 0) {
+    throw new Error("birthReceivingGroupForDomain requires a non-empty receiving-group law domain");
+  }
+  if (recoveryPosture !== undefined && !RECEIVING_GROUP_RECOVERY_POLICIES.includes(recoveryPosture)) {
+    throw new Error(
+      `birthReceivingGroupForDomain: unknown receiving-group recovery posture '${String(recoveryPosture)}'`,
+    );
+  }
+  if (!Number.isInteger(maxChildWorkspacesPerUser) || maxChildWorkspacesPerUser < 0) {
+    throw new Error(
+      "birthReceivingGroupForDomain requires an explicit non-negative maxChildWorkspacesPerUser; " +
+        "Nomos has no compiled birth-policy fallback",
+    );
+  }
+  const policyDomains = [...new Set(birthPolicyDomains)];
+  if (
+    policyDomains.length === 0 ||
+    policyDomains.some((domain) => domain.trim().length === 0) ||
+    !policyDomains.includes(groupLawDomain)
+  ) {
+    throw new Error(
+      "birthReceivingGroupForDomain requires every co-resident birth-capable law domain, " +
+        "including its own domain; Nomos will not birth partially configured law",
+    );
+  }
+  const birthDirective = directive("nomosInternalBirthReceivingGroup7c1f5e")
+  .creates(ReceivingGroup)
+  .payload(
+    z.object({
+      /** The identity this home belongs to (a `user:<uid>` subject). The workspace name + seeded homeName are
+       *  both `home-<sha256(owner)>` — self-bound, so you can only birth YOUR OWN home slot. */
+      owner: z.string().min(1),
+      /** The bootstrap framework controller content hash — tenant-pinned at governance compile (the child
+       *  installs it IN-CHAIN as intent 0; the kernel resolves the bytes by hash from the parent's custody). */
+      frameworkHash: sha256Digest(),
+      /** The HOME law package domainHash — tenant-pinned at governance compile (the child's second install). */
+      lawHash: sha256Digest(),
+      /** ISO-8601 birth time, caller-stamped (the timestamp doctrine — the plan reads no clock). */
+      bornAt: z.string().min(1),
+      /** AUTHPROVIDER INHERITANCE — DEFAULT ON. Birth copies the current verifying material once;
+       *  later rotations arrive through the ordinary lazy provider-adoption offer. */
+      inheritAuthProvider: z.boolean().optional(),
+      /** TOKEN-FREE FOUNDING (identity target model D22): sha256hex of the owner's device public key.
+       *  Present ⇒ the owner FOUNDS their own group — `seedFoundingPrincipal` seats this key as the
+       *  owner's signer and the owner as admin, with the parent's operators and enrollers — and the
+       *  recipe carries no provider verifier, certificate or parent role, so the kernel's birth effect
+       *  takes the founded lane. The birth must then be authored by the owner (see
+       *  {@link receivingGroupFoundedBirthBindsOwner}). Absent ⇒ the historical recipe. */
+      foundingKeyHash: sha256Digest().optional(),
+    }),
+  )
+  .plan((p) => {
+    const founder = p.owner; // the actor for the child's own genesis steps (its self-bound owner subject)
+    const groupName = receivingGroupNameOf(p.owner);
+    const founded = p.foundingKeyHash !== undefined;
+    const inheritedProvider = founded || p.inheritAuthProvider === false
+      ? undefined
+      : readAuthProviderVerifyingConfiguration();
+    const bornAtMs = Date.parse(p.bornAt);
+    if (founded && !Number.isFinite(bornAtMs)) {
+      throw new Error("a founded receiving-group birth needs bornAt as an ISO-8601 instant");
+    }
+    // The owner founds the group: its device key, the owner as admin, and the parent's operators and
+    // enrollers (D15/D22), in the one requires-free founding step on the warrant-free prefix. It closes
+    // the recipe, in the group's own law domain: the kernel appends the birth origin and the warrant to
+    // the LAST step's domain, so the recipe must end in the law that declares them (a tenant
+    // home-genesis step last would route them to a tenant domain that has neither).
+    const inheritedEnrollers = founded ? readInheritedEnrollers() : [];
+    const inheritedOperators = founded ? readInheritedOperators() : [];
+    const foundingSteps = founded
+      ? [{
+          domain: groupLawDomain,
+          directiveId: seedFoundingPrincipal.id,
+          actor: founder,
+          payload: seedFoundingPrincipal.payloadSchema.parse({
+            principal: p.owner,
+            keyHash: p.foundingKeyHash,
+            operators: [...inheritedOperators],
+            enrollers: inheritedEnrollers.map((enroller) => ({ scope: enroller.scope, subject: enroller.subject })),
+            grantedAt: bornAtMs,
+          }) as Record<string, unknown>,
+        },
+        // Each inherited enroller's keys, so it can act here (enrol the owner's next device): keys live
+        // on every workspace, which is what keeps each one independently replayable.
+        // The inherited operators' and enrollers' keys, and installDomain for the operators, so the
+        // jurisdiction can enrol the owner's next device and roll out law here without a re-found.
+        ...inheritedGovernanceStep(groupLawDomain, founder, inheritedOperators, inheritedEnrollers, bornAtMs,
+          { principal: p.owner, keyHash: p.foundingKeyHash as string })]
+      : [];
+    // The roles the parent delegates into every group its owner's scope founds (formerly a per-intent
+    // delegation certificate), as state tuples for the owner — each seated in the domain whose law
+    // declares it. They precede the founding steps, which must close the recipe (see above).
+    const delegatedRoleSteps = founded
+      ? delegatedRolesSteps(founder, p.owner, RECEIVING_GROUP_CHILD_KIND, bornAtMs)
+      : [];
+    const genesisChain: Array<{ domain: string; directiveId: string; actor: string; payload: Record<string, unknown>; domainHash?: string }> = [
+      // THE ORDER-DECLARED LAW INSTALL: two typed closure identities. The kernel resolves each
+      // closure from the parent's custody when it folds the birth; law bytes never ride the intent.
+      domainInstallGenesisOffer(
+        DomainInstallExecutor.StageZero,
+        p.frameworkHash,
+        founder,
+      ),
+      domainInstallGenesisOffer(
+        DomainInstallExecutor.LifecycleController,
+        p.lawHash,
+        founder,
+      ),
+      // THE POSTURE IS BORN, NOT MIGRATED. The application's receiving-group declaration names the
+      // recovery authority its anchors are born with; an application that declares none seeds the
+      // framework default exactly as before (the field is omitted, so the recipe is byte-identical).
+      {
+        domain: groupLawDomain,
+        directiveId: "nomosInternalSeedReceivingGroupPolicy7c1f5e",
+        actor: founder,
+        payload: recoveryPosture === undefined
+          ? { setAt: p.bornAt }
+          : { setAt: p.bornAt, recovery: recoveryPosture },
+      },
+      // SEED THE OWNER — the home is born OWNED; the homeNameBindsOwner invariant in the child's law proves
+      // homeName == home-<sha256(owner)> at the child's own gate, so the slot can ONLY be its rightful owner's.
+      {
+        domain: groupLawDomain,
+        directiveId: "nomosInternalSeedReceivingGroup7c1f5e",
+        actor: founder,
+        payload: { principal: p.owner, workspaceName: groupName, bornAt: p.bornAt },
+      },
+      // The receiving group is born with its child-workspace allowance as explicit law-state. The
+      // value is closed over by the package's application policy, so neither the host nor the end
+      // user can substitute it in the offer payload.
+      ...policyDomains.map((domain) => ({
+        domain,
+        directiveId: "seedBirthPolicy",
+        actor: founder,
+        payload: {
+          maxBirthsPerPrincipal: maxChildWorkspacesPerUser,
+          setBy: p.owner,
+          setAt: p.bornAt,
+        },
+      })),
+      // Tenant founding law is an ordered list of ordinary offers. Values derive solely from the
+      // canonical home facts; every payload is parsed by the target directive before it reaches
+      // the child's author gate. There is no host append point and no framework-selected fallback.
+      ...(homeGenesis?.steps ?? []).map((step) => ({
+        domain: step.domain,
+        directiveId: step.directive.id,
+        actor: founder,
+        payload: step.directive.payloadSchema.parse(step.payload({
+          owner: p.owner,
+          workspaceName: groupName,
+          bornAt: p.bornAt,
+        })),
+      })),
+      ...delegatedRoleSteps,
+      ...foundingSteps,
+    ];
+    if (!founded && p.inheritAuthProvider !== false) {
+      if (inheritedProvider !== undefined) {
+        genesisChain.push({
+          domain: groupLawDomain,
+          directiveId: "seedAuthProvider",
+          actor: founder,
+          payload: {
+            ...inheritedProvider,
+            label: "inherited-from-parent",
+            setBy: p.owner,
+            setAt: 1,
+          },
+        });
+      }
+    }
+    // MODEL AUTHORITY DESCENDS (architecture/parent_directed_model_transition.md §4, lane A): the anchor is
+    // born holding its platform's current installDomain holders + their devices, read from THIS
+    // workspace's committed relation state, so the platform's own signer may lawfully stage and promote
+    // law in every receiving group it births. A parent holding no seat (a chain born before the seat
+    // existed) embeds nothing; the parent-directed transition seats it later.
+    // A founded group inherits law authority as `operator` tuples in its founding step instead.
+    const inheritedAuthority = founded
+      ? undefined
+      : inheritedModelAuthorityGenesisStep(groupLawDomain, founder, p.bornAt);
+    if (inheritedAuthority !== undefined) genesisChain.push(inheritedAuthority);
+    // THE DECLARED BIRTH EFFECT (the unix model): the recipe rides the committed intent as a declared output
+    // (captured_ports.births). The kernel — reading the `.births()` declaration off the law manifest — takes
+    // the recipe and spawns + self-validates the child through the child's OWN gate (each step self-verifies).
+    // A founded birth declares no parent role: parent roles ride the certificate lane's attestation.
+    birth({
+      workspace: groupName,
+      genesisChain,
+      ...(!founded && parentWorkspaceRoles.length > 0 ? { parentWorkspaceRoles } : {}),
+    });
+    // Parent/child lineage is an ordinary global Zanzibar relation in parent custody. The exact child
+    // address comes from the same plan which births it, so neither the host nor the caller can redirect
+    // this seat. Application law can then authorize upward workspace effects with the ordinary relation.
+    // THE INVERSE EPOCH EDGE rides the same plan: the born receiving group may ask THIS workspace for its
+    // current verifier epoch (`nomosInternalServeAuthProviderEpoch7c1f5e` gates on it), so a group whose
+    // verifier went stale refreshes it through the one framework lane instead of a tenant copy.
+    return [
+      ...writeTuple({
+        object: "workspace:self",
+        relation: "child",
+        subject: `workspace:${groupName}`,
+        grantedBy: p.owner,
+        grantedAt: p.bornAt,
+      }),
+      // A founded group has no provider verifier, so it never asks for an epoch.
+      ...(founded ? [] : writeTuple({
+        object: "workspace:self",
+        relation: AUTH_PROVIDER_EPOCH_CONSUMER,
+        subject: `workspace:${groupName}`,
+        grantedBy: p.owner,
+        grantedAt: p.bornAt,
+      })),
+    ];
+  })
+  .reads(authProviderQuery)
+  .reads(authProviderKeysQuery)
+  .reads(authProviderCertificatesQuery)
+  .reads(relationTuplesByObject)
+  // The parent's enroller tuples a founded group inherits (D22) — readInheritedEnrollers's one read.
+  .reads(relationTuplesByRelation)
+  .alsoEnsures(RelationTuple)
+  .births(); // BIRTH IS A DECLARED KERNEL PRIMITIVE — emits the `nomosBirthGate` era key; the kernel folds the recipe
+  return {
+    ...birthDirective,
+    ...(homeGenesis === undefined || homeGenesis.steps.length === 0
+      ? {}
+      : {
+          birthGenesisRequirements: homeGenesis.steps.map((step) => ({
+            domain: step.domain,
+            directiveId: step.directive.id,
+          })),
+        }),
+  };
+}
+
+/**
+ * A FOUNDED receiving-group birth (D22, `foundingKeyHash` present) carries no certificate or token to
+ * prove who the owner is, so the parent's own admission proves it: the birth is admitted only when its
+ * author — the principal the kernel authenticated from a signed key — IS the owner it founds. Nobody can
+ * found someone else's group, and the owner is authenticated exactly as for any other write (for an
+ * application, a `user:<uid>` key its enroller enrolled). The historical recipe is unchanged.
+ */
+export const receivingGroupFoundedBirthBindsOwner = workspaceInvariant("ReceivingGroupFoundedBirthBindsOwner")
+  .on("nomosInternalBirthReceivingGroup7c1f5e")
+  .reads(readSet())
+  .declassify("the founded-birth refusal reveals only whether the author is the owner it names")
+  .assert((_snapshots, ctx) => {
+    const intent = (ctx?.intent ?? {}) as { owner?: string; foundingKeyHash?: string };
+    if (intent.foundingKeyHash === undefined) return { accept: true };
+    return typeof intent.owner === "string" && intent.owner.length > 0 && ctx?.principal === intent.owner
+      ? { accept: true }
+      : { reject: "founded-receiving-group-birth-must-be-authored-by-its-owner" };
+  });
+
+/** Build the standalone framework receiving-group law with an explicit allowance. */
+export const birthReceivingGroup = (maxChildWorkspacesPerUser: number) =>
+  birthReceivingGroupForDomain(
+    RECEIVING_GROUP_LAW_DOMAIN,
+    maxChildWorkspacesPerUser,
+    [RECEIVING_GROUP_LAW_DOMAIN],
+  );
+/** @deprecated the old name of {@link birthReceivingGroup}; kept as an alias for one release. */
+export const birthHome = birthReceivingGroup;
+
+/**
+ * THE SHARED-WITH-ME INDEX (§5) — one record per cross-custody attestation delivered to this home holon:
+ * a signed edge `<asserterWorkspace> : <object> # <relation> @ this-identity`, indexed LOCALLY so the
+ * access list is a local query (no fan-out across every resource holon). A DISCOVERY HINT — the live authz
+ * stays the forward `Check` on the asserting holon when the identity opens it.
+ */
+export const SharedWithMe = aggregate("SharedWithMe", {
+  /** The holon that signed + delivered this edge — WHERE the live forward `Check` runs when opened. */
+  asserterWorkspace: t.string().merge(Lww),
+  /** The shared OBJECT — the whole workspace (`workspace:self`) or a specific record (`Entry:<id>`). */
+  object: t.string().merge(Lww),
+  /** The relation granted (`reader` / `editor` / a read cap). */
+  relation: t.string().merge(Lww),
+  /** The asserter's OWNER principal — whose key signed the attestation (verified at §3 admission). */
+  asserterPrincipal: t.string().merge(Lww),
+  /** ISO-8601, caller-stamped (determinism — no clock in the plan). */
+  attestedAt: t.string().merge(Lww),
+  /** PRUNED (forward-check fail-safe): set when the live `Check` on the asserter denies — the hint is
+   *  dropped from the list but the audit row stays. `""` = live. */
+  prunedAt: t.string().merge(Lww),
+}).public();
+
+/** One idempotent access-manifest row per source edge in this home. Delivery is at-least-once: a retry,
+ * reconnect or source outbox replay must update the same bookmark rather than manufacture another thing the
+ * recipient appears to have access to. The home itself scopes the recipient, so the edge coordinate is the
+ * source workspace + protected object + granted relation. */
+export function sharedWithMeId(asserterWorkspace: string, object: string, relation: string): string {
+  const coordinate = JSON.stringify([asserterWorkspace, object, relation]);
+  return `SharedWithMe_${nomos.sha256(coordinate)}`;
+}
+
+/**
+ * `recordShare` — index a cross-custody share into the home holon's access list. AUTHORED on the home
+ * holon (the identity's own subject-side root). The payload carries the §3 CROSS-CUSTODY ATTESTATION — a
+ * SIGNED QUOTE: the asserter's device `publicKey` + a `signature` over the edge
+ * `<asserterWorkspace>:<object>#<relation>@<this-home-owner>`. The home holon's OWN gate verifies it
+ * (`executor::record_share_attestation_violation`, bound to the warrant owner), so the BAILIFF can deliver
+ * it HOST-FREE (the host carries bytes, vouches nothing — the gate vouches). The owner lane authors the
+ * SAME shape (the owner holds the quote the asserter gave it). The signature is a verification input, not
+ * stored — only the edge facts fold into the index. The live authority stays the forward `Check` on the
+ * asserter when the identity opens it (§5 fail-safe); a stale/forged quote can't enter the list at all.
+ */
+export const recordShare = directive("recordShare")
+  .ensures(SharedWithMe)
+  .payload(
+    z.object({
+      asserterWorkspace: z.string().min(1),
+      object: z.string().min(1),
+      relation: z.string().min(1),
+      asserterPrincipal: z.string().min(1),
+      attestedAt: z.string().min(1),
+      /** The asserter's device PUBLIC KEY (base64) — what the §3 gate verifies the quote against. */
+      publicKey: z.string().min(1),
+      /** The asserter's SIGNATURE (base64) over the edge bytes, subject = this home's owner. */
+      signature: z.string().min(1),
+    }),
+  )
+  .plan((p) => {
+    // ENSURE, never CREATE: signed delivery is retryable and therefore at-least-once. Re-delivery (including
+    // a later re-grant after prune) refreshes this exact access edge and makes it live again.
+    ensure(SharedWithMe, sharedWithMeId(p.asserterWorkspace, p.object, p.relation))
+      .set("asserterWorkspace", p.asserterWorkspace)
+      .set("object", p.object)
+      .set("relation", p.relation)
+      .set("asserterPrincipal", p.asserterPrincipal)
+      .set("attestedAt", p.attestedAt)
+      .set("prunedAt", "");
+    return [];
+  })
+  // CROSS-CUSTODY ATTESTATION-AUTHORIZED (§3/§5): the payload's signed quote IS the authorization (lowered
+  // into the `nomosAttestationGate` era key) — the one gate verifies it against the home's owner (the
+  // LAW-DECLARED owner-source below, NOT a kernel-hardcoded id) + pins the principal to the attestation key,
+  // so the bailiff delivers it host-free to an OFFLINE subject (no device key, no author block).
+  .attestationAuthorized({ ownerObject: RECEIVING_GROUP_ID, ownerField: "principal" });
+
+/**
+ * `pruneShare` — fail-safe drop of a hint whose forward `Check` denied (the asserter revoked it). The row
+ * stays for audit; `prunedAt` removes it from the live list. (The forward check itself is the resource
+ * holon's job — this records the verdict locally.)
+ */
+export const pruneShare = directive("pruneShare")
+  .mutates(SharedWithMe)
+  .payload(z.object({ shareId: idOf(SharedWithMe), prunedAt: z.string().min(1) }))
+  .plan((p) => [set(instance(SharedWithMe, p.shareId), "prunedAt", p.prunedAt)]);
+
+/** "Show me everything <asserter> shared with me" — an indexed probe over the local access list. */
+export const sharedByWorkspace = query("sharedByWorkspace").key("asserterWorkspace").returns(SharedWithMe);
+
+/** "Show me every share for this protected object" — the indexed access-list probe used by generated
+ * application discovery. A home commonly has a very large installed law, so discovery must never fall back
+ * to the generic `aggregatesByType(SharedWithMe)` scan merely to find whole-workspace shares. */
+export const sharedByObject = query("sharedByObject").key("object").returns(SharedWithMe);
+
+// ─────────────────── THE PEER-SOVEREIGN ROOT-OF-TRUST (the BirthAttestation cert chain) ───────────────────
+
+/**
+ * THE BIRTH ATTESTATION (the cert, on-chain for AUDIT). When a parent P births this home via the offer-
+ * effect, the kernel seeds a SIGNED [executor::birth_cert::BirthCert] {child, founder, verified, parentKey,
+ * parentId, epoch} into the home's genesis (it travels with the home's `GenesisWarrant.bornUnder` so a peer
+ * verifies it OFFLINE), AND folds this singleton record so the home's projection surfaces "who attested my
+ * birth, and was my founder verified". `verified` + `founder` are the parent's GATE verdict (captured-port,
+ * CAS-as-law), never the offer payload. A peer's TRUST decision uses the travelling signed chain (the kernel
+ * verify doors); this aggregate is the human-readable mirror.
+ */
+export const BIRTH_ATTESTATION_ID = "birth-attestation:self";
+export const BIRTH_ATTESTATION_LINK_PREFIX = "birth-attestation-link:";
+export const BirthAttestation = aggregate("BirthAttestation", {
+  /** This home's self-id (`home-<sha256(founder)>`) — the cert's `child`. */
+  child: t.string().merge(Lww),
+  /** The founding principal the parent attested (== {@link HomeOwner} `principal`). */
+  founder: t.string().merge(Lww),
+  /** THE PARENT'S GATE VERDICT: was `founder` VERIFIED at the parent's offer gate (an IdP vouched)? */
+  verified: t.string().merge(Lww), // "true"/"false" (string for the Lww scalar projection)
+  /** The parent's workspace self-id (lineage). */
+  parentId: t.string().merge(Lww),
+  /** The parent's enrolled signer PUBLIC KEY (base64) — `K_P`, the cert's signer. */
+  parentKey: t.string().merge(Lww),
+  /** The parent's SignerEpoch at the attestation (informational; the cert is judged at birth-time validity). */
+  epoch: t.int().merge(Lww),
+  /** Legacy replay slot for histories authored before `BirthAttestationLink`. New histories write the
+   *  travelling chain only as ordered, typed link records below. */
+  certChain: t.string().merge(Lww).optional(),
+}).public();
+
+/** One exact link in the travelling certificate chain. The zero-padded index is custody order; every
+ * certificate member is a separate typed USDA property. `certChain` above remains only as a replay fallback
+ * for histories authored before this aggregate existed. */
+export const BirthAttestationLink = aggregate("BirthAttestationLink", {
+  index: t.int().merge(Lww),
+  child: t.string().merge(Lww),
+  founder: t.string().merge(Lww),
+  verified: t.bool().merge(Lww),
+  parentKey: t.string().merge(Lww),
+  parentId: t.string().merge(Lww),
+  epoch: t.int().merge(Lww),
+  signature: t.string().merge(Lww),
+  verifiedVia: t.string().merge(Lww).optional(),
+  idpToken: t.string().merge(Lww).optional(),
+  capturedClock: t.int().merge(Lww).optional(),
+  authProviderIssuer: t.string().merge(Lww).optional(),
+  authProviderJwks: t.string().merge(Lww).optional(),
+  authProviderAudience: t.string().merge(Lww).optional(),
+}).public();
+
+/** Audit read: this home's birth attestation (who attested it + the verified verdict). */
+export const birthAttestation = query("birthAttestation").key("child").returns(BirthAttestation);
+
+/**
+ * `seedBirthAttestation` — THE GENESIS-DOOR step the parent's offer-effect INJECTS into the home's genesis
+ * chain (the kernel appends it in `run_birth_effect` carrying the assembled + signed cert chain). It folds
+ * the [`BirthAttestation`] singleton so the home's own state carries its travelling cert. A CONTROL-PLANE
+ * write seeded once at birth (the open session lane structurally refuses it by directive id). The values
+ * are the parent's GATE VERDICT (`founder`/`verified` lowered from the captured port — CAS-as-law, never
+ * the offer payload) + the typed signed links; the home's verify doors re-derive trust from the chain.
+ */
+export const seedBirthAttestation = directive("seedBirthAttestation")
+  .ensures(BirthAttestation)
+  .payload(
+    z.object({
+      child: z.string().min(1),
+      founder: z.string().min(1),
+      verified: z.string().min(1), // "true"/"false"
+      /** The parent's workspace self-id (lineage). EMPTY for a root-DIRECT birth (root carries no self-id
+       *  binding in the unwarranted lane) — the cert's terminal link is then signed by K_root directly. */
+      parentId: z.string(),
+      parentKey: z.string().min(1), // base64 K_P
+      epoch: z.number().int().nonnegative(),
+      links: z.array(birthCertificatePayload).min(1),
+      /** Law-declared target roles for the verified immediate parent workspace. The kernel injects this
+       * value from the admitted birth recipe and supplies `parentId`; no host chooses either fact. */
+      parentWorkspaceRoles: z.array(z.string().regex(/^[A-Za-z][A-Za-z0-9_-]*$/)).optional(),
+    }).superRefine((payload, ctx) => {
+      if ((payload.parentWorkspaceRoles?.length ?? 0) > 0 && payload.parentId.length === 0) {
+        ctx.addIssue({ code: "custom", message: "parent workspace roles require a verified non-root parentId" });
+      }
+    }),
+  )
+  .plan((p) => {
+    const h = instance(BirthAttestation, BIRTH_ATTESTATION_ID);
+    const header = [
+      set(h, "child", p.child),
+      set(h, "founder", p.founder),
+      set(h, "verified", p.verified),
+      set(h, "parentId", p.parentId),
+      set(h, "parentKey", p.parentKey),
+      set(h, "epoch", p.epoch),
+    ];
+    const links = p.links.flatMap((certificate, index) => {
+      const link = instance(BirthAttestationLink, `${BIRTH_ATTESTATION_LINK_PREFIX}${String(index).padStart(8, "0")}`);
+      return [
+        withMarker(set(link, "index", index), "ensures"),
+        withMarker(set(link, "child", certificate.child), "ensures"),
+        withMarker(set(link, "founder", certificate.founder), "ensures"),
+        withMarker(set(link, "verified", certificate.verified), "ensures"),
+        withMarker(set(link, "parentKey", certificate.parentKey), "ensures"),
+        withMarker(set(link, "parentId", certificate.parentId), "ensures"),
+        withMarker(set(link, "epoch", certificate.epoch), "ensures"),
+        withMarker(set(link, "signature", certificate.signature), "ensures"),
+        ...(certificate.verifiedVia ? [withMarker(set(link, "verifiedVia", certificate.verifiedVia), "ensures")] : []),
+        ...(certificate.idpToken ? [withMarker(set(link, "idpToken", certificate.idpToken), "ensures")] : []),
+        ...(certificate.capturedClock === undefined ? [] : [withMarker(set(link, "capturedClock", certificate.capturedClock), "ensures")]),
+        ...(certificate.authProviderIssuer ? [withMarker(set(link, "authProviderIssuer", certificate.authProviderIssuer), "ensures")] : []),
+        ...(certificate.authProviderJwks ? [withMarker(set(link, "authProviderJwks", certificate.authProviderJwks), "ensures")] : []),
+        ...(certificate.authProviderAudience ? [withMarker(set(link, "authProviderAudience", certificate.authProviderAudience), "ensures")] : []),
+      ];
+    });
+    const parentAuthority = (p.parentWorkspaceRoles ?? []).flatMap((relation) => writeTuple({
+      object: "workspace:self",
+      relation,
+      subject: `workspace:${p.parentId}`,
+      grantedBy: `workspace:${p.parentId}`,
+      grantedAt: String(p.epoch),
+    }));
+    return [...header, ...links, ...parentAuthority];
+  })
+  .alsoEnsures(BirthAttestationLink)
+  .alsoEnsures(RelationTuple);
+
+/**
+ * THE ERA DECLARATION (the `nomosParentAttestedBirth` USD key). Exporting this sentinel from the home law
+ * tells the kernel's verify doors to VERIFY THE TRAVELLING CERT CHAIN to the pinned `K_root` on every lane
+ * (author / receive / verify_chain) — so a warranted home that self-asserts a verified founder WITHOUT a
+ * parent-signed chain rooting at root is refused (`ParentDidNotAttest` / `CertChainBroken` /
+ * `NotRootedAtRoot`). Era-ruled: a home law that does NOT export this carries no key and replays byte-
+ * identical (the squat-only `homeNameBindsOwner` check still runs; the cert check is simply inert).
+ */
+export const parentAttestedBirth: ParentAttestedBirthMarker = {
+  ...requireParentAttestedBirth,
+  // DECLARE the owner + cert locators so the KERNEL reads them (it names neither): the home owner lives at
+  // the `HomeOwner` singleton's `principal`. `certObject`/`certField` retain the legacy chain locator for
+  // old histories; current histories are discovered through the typed `BirthAttestationLink` aggregate.
+  ownerObject: RECEIVING_GROUP_ID,
+  ownerField: "principal",
+  certObject: BIRTH_ATTESTATION_ID,
+  certField: "certChain",
+};