@githolon/dsl 0.108.7 → 0.110.0

package/src/framework/workspaces.ts

@@ -75,16 +75,34 @@ import { set, withMarker } from "../ops.js";
 import { query } from "../query.js";
 import { read } from "../read.js";
 import { readRef, readSet, workspaceInvariant, refAs, type WorkspaceInvariantVerdict } from "./workspace_invariant.js";
-import { writeTuple, removeTuple, RelationTuple, relationTupleInstanceId } from "./relations.js";
+import { writeTuple, removeTuple, RelationTuple, relationTupleInstanceId, relationTuplesByObject } from "./relations.js";
+import { readFrameworkDeclaredRows } from "../read.js";
 import { relationType, self, user, key, object } from "../relation_schema.js";
-import { WORKSPACE_ADMIN_RELATION } from "./governance_relations.js";
+import { WORKSPACE_ADMIN_RELATION, WORKSPACE_OPERATOR_RELATION } from "./governance_relations.js";
 import { GENESIS_WARRANT_ID } from "./genesis.js";
-import { idOf } from "../value_object.js";
+import { idOf, valueObject } from "../value_object.js";
 import { enrollSigner, signerObject, SIGNER_RELATION } from "./signing_identity.js";
+import { principalScopeOf } from "../member_authentication.js";
+import {
+  GOVERNANCE_SUBJECTS,
+  governanceSubject,
+  governanceSubjectFields,
+  governanceSubjectPayload,
+  hasOneGovernanceSubject,
+  isGovernanceSubject,
+  principalScopeObject,
+  providerScopeField,
+  readInheritedEnrollers,
+  relationTuplesByRelation,
+  type InheritedEnroller,
+} from "./principal_enrollment.js";
+import { PRINCIPAL_SCOPE_ENROLLER_RELATION } from "./governance_relations.js";
 import { seedBirthPolicy } from "./birth_meter.js";
 import {
   DomainInstallExecutor,
   domainInstallGenesisOffer,
+  type LawClosureReference,
+  MODEL_LIFECYCLE_AUTHORITY,
 } from "./domain_lifecycle.js";
 // THE GENESIS BOOTSTRAP (platform-birth genesis bootstrap, Approach A): governance carries the
 // warrant-flip primitives so the birth door can lawfully bootstrap a virgin platform's founding admin —
@@ -93,6 +111,13 @@ import {
 // them up as part of the `workspaces` domain. (architecture/platform_birth_genesis_bootstrap.md)
 export { GenesisWarrant, seedGenesis } from "./genesis.js";
 export { identityRelations, enrollSigner } from "./signing_identity.js";
+// A platform (root, nomos-cafe, a tenant platform) receives workspace effects only where its custodian's
+// admission-checkpoint key is an active signer: its operator seats and retires that key here.
+export {
+  enrollAdmissionCheckpointSignerDirect,
+  revokeAdmissionCheckpointSigner,
+  lastAdmissionCheckpointSignerRemains,
+} from "./signing_identity.js";
 // ERA 0 — the keyless verified first-device door rides the GOVERNANCE law too: a freshly BORN platform
 // has a virgin roster and a cert-ATTESTED AuthProvider (the S_root-signed birth witness), so its founder's
 // FIRST action is `enrollFirstDevice` (token-verified against the attested provider) followed by a SIGNED
@@ -113,10 +138,42 @@ export {
   BirthAttestationLink,
   birthAttestation,
   seedBirthAttestation,
-} from "./home.js";
+} from "./receiving_group.js";
 // THE ENROLL-ONCE DELEGATION LANE — a platform records each tenant's device-key delegation (signed by its
 // onboarding signer S_P) so the kernel reads it at `signer-delegation:<user>` when assembling a home's chain.
 export { SignerDelegation, enrollDelegation, signerDelegationByUser } from "./signing_identity.js";
+// D22 — THE KERNEL IS THE AUTHENTICATION: the enroller relation and the enrolled-scope first-key lane
+// ride governance, so every workspace born under it can enrol its scopes' principals.
+export {
+  principalScopeRelations,
+  enrollDevice,
+  revokeDevice,
+  relationTuplesByRelation,
+} from "./principal_enrollment.js";
+// D22 — TOKEN-FREE GENESIS: the one founding step of a workspace born without a provider token or a
+// birth certificate, and the invariant fencing it to the virgin, warrant-free prefix.
+export {
+  BirthOrigin,
+  FoundingPrincipal,
+  birthOriginVirginOnly,
+  foundingPrincipalVirginOnly,
+  seedBirthOrigin,
+  seedFoundingPrincipal,
+} from "./founding_genesis.js";
+import { seedFoundingPrincipal } from "./founding_genesis.js";
+// The console's lawful reach (framework/console_governance.ts): the founding seat of inherited operators'
+// and enrollers' keys and law authority, operator handover, and console key rotation.
+export {
+  seedInheritedGovernance,
+  inheritedGovernanceBeforeWarrant,
+  grantConsoleOperator,
+  revokeConsoleOperator,
+  lastOperatorRemains,
+  enrollConsoleSigner,
+  revokeConsoleSigner,
+  lastConsoleSignerRemains,
+} from "./console_governance.js";
+import { inheritedGovernanceStepFrom, readInheritedSigners, type InheritedSigner } from "./console_governance.js";
 
 /** Canonical governance-law namespace. Genesis routes refer to this declaration, never a repeated
  * string literal, so renaming the module cannot silently strand part of the founding ceremony. */
@@ -201,10 +258,23 @@ export const workspaceRelations = relationType("workspace")
   // migration. (A TENANT that wants a workspace-scoped role uses a namespaced `relationType("workspace")`
   // + a `selfWorkspace()` seed; only THIS framework governance type is global.)
   .asGlobal()
-  .relation(WORKSPACE_ADMIN_RELATION, { rewrite: self(), allow: [user(), key()] })
+  // admin also admits the framework's console and custodian principals: token-free genesis (D22) seats a
+  // `console:`/`custodian:` founding admin by `seedFoundingPrincipal`. Still leaf-only.
+  .relation(WORKSPACE_ADMIN_RELATION, { rewrite: self(), allow: [...GOVERNANCE_SUBJECTS] })
   .relation("creator", { rewrite: self(), allow: [user(), key()] })
   .relation("platformCreator", { rewrite: self(), allow: [user(), key()] });
 
+/**
+ * `workspace:self#operator` (D15/D19), its own fragment of the global `workspace` type so tenant law that
+ * gates on it (`.requires("operator")`) composes exactly this relation and not the admin surface — the
+ * same shape as `modelLifecycleRelations`. It also admits the console's enrolled principals
+ * (`console:<subject>`, D18/D22): the operators who install law sign in through console.nomos.cafe. See
+ * GOVERNANCE_SUBJECTS.
+ */
+export const workspaceOperatorRelations = relationType("workspace")
+  .asGlobal()
+  .relation(WORKSPACE_OPERATOR_RELATION, { rewrite: self(), allow: [...GOVERNANCE_SUBJECTS] });
+
 /** Global holarchy edge kept separate so application packages can compose child authority without
  * re-exporting the governance admin/creator surface into a tenant domain. */
 export const workspaceChildRelations = relationType("workspace")
@@ -271,6 +341,16 @@ const epochMs = z.number().int().nonnegative();
  * presented owner bearer against THIS field — the law record, not a worker-side
  * secret store. `""` until provisioned.
  */
+export const WorkspaceBirthAuthority = valueObject("WorkspaceBirthAuthority", {
+  parent: z.string(),
+  principal: z.string(),
+  authorizedAt: z.number().int().nonnegative(),
+  lawHash: z.string(),
+  authorizationHash: z.string(),
+  parentHead: z.string(),
+  rebornFrom: z.string().optional(),
+});
+
 export const CloudWorkspace = aggregate("CloudWorkspace", {
   /** Human-meaningful unique workspace name (the `:ws` URL segment). */
   name: t.string().merge(Lww),
@@ -321,29 +401,17 @@ export const CloudWorkspace = aggregate("CloudWorkspace", {
    * request at the cloud level).
    */
   pool: t.int().merge(Lww).optional(),
-  /**
-   * THE LAW-AUTHORED GENESIS CHAIN (P1, architecture/provisioning_as_obligations.md "law and law alone").
-   * For a genesis birth, `birthChild` authors the child's genesis RECIPE here as data — a JSON array of
-   * `{domain, directiveId, payload, actor}` steps (`seedGenesis → grantAdmin → birthCloud`). The birth
-   * capability provider REPLAYS this opaque list on the child (it names nothing — the directive ids come
-   * from the law, not host source); that is the difference between the host *reconstructing* the genesis
-   * (today) and the host *delivering* a law-authored one. Absent for plain births + pre-P1 records (the
-   * provider falls back to its inline recipe — flag-gated until live byte-equivalence is proven). Naming
-   * the genesis directives HERE is law naming law (legitimate); the prohibition binds only the host.
-   */
-  genesisChain: t.json().merge(Lww).optional(),
   /**
    * THE LINEAGE-AUTHORIZATION BINDING (proof-friendly — architecture/sovereign_adapter.md "birth is a kernel
-   * offer-effect"). The child's genesis SELF-ATTESTS who authorized it: a JSON commitment
+   * offer-effect"). The child's genesis SELF-ATTESTS who authorized it: a structural commitment
    * `{parent, principal, authorizedAt}` — the law-available lineage anchor — that the child's OWN chain
    * carries, so a verifier of the child alone sees its claimed parentage, cross-checkable against the
    * parent's chain (which holds the child's CloudWorkspace + the gated `birthChild` that minted it). It is
    * the clean public-input shape a future recursive-proof circuit (Nova / zkWASM) would expose; the
    * kernel-structural commitments (the parent chain head + the `birthChild` intent hash + the law hash) join
    * it when the KERNEL produces the genesis (B's later slice — until then those ride as `""`). `t.string`
-   * (JSON), never `t.json`: it rides verbatim as a scalar (the kernel `Value` has no JSON variant — the same
-   * reasoning as the auth keys). Absent on root (the base of the world tree, born under nothing). */
-  bornUnder: t.string().merge(Lww).optional(),
+   * encoded as named USDA prims. Absent on root (the base of the world tree, born under nothing). */
+  bornUnder: WorkspaceBirthAuthority.field().merge(Lww).optional(),
   /**
    * SUPERSESSION (recovery verb 3 — {@link rebirthWorkspace}, architecture/rebirth_and_custody_lifecycle.md).
    * "Supersession, never forgiveness": a chain scarred by a historical LAW violation cannot be retro-blessed;
@@ -563,6 +631,19 @@ function planBirthRecord(
 // so the chain is a pure function of the payload (deterministic on every replaying peer). Naming the genesis
 // directives here is law naming law; the prohibition binds only the host. The law package bytes are NOT in
 // here — the install-by-hash stays a custody concern of the provider (the bytes-in-pack refinement is later).
+export interface GovernanceGenesisOffer {
+  readonly domain: string;
+  readonly directiveId: string;
+  readonly actor: string;
+  readonly payload: Readonly<Record<string, unknown>>;
+  readonly domainHash?: LawClosureReference;
+}
+
+// OPERATOR INHERITANCE (D15) — `readInheritedOperators` lives with the founding step it feeds
+// (`founding_genesis.ts`), so the receiving-group birth can share it without an import cycle.
+export { readInheritedOperators } from "./founding_genesis.js";
+import { readInheritedOperators } from "./founding_genesis.js";
+
 export function buildGenesisChain(p: {
   name: string;
   principal: string;
@@ -586,7 +667,17 @@ export function buildGenesisChain(p: {
    *  child's birthCloud record (`rebornFrom`) + the bornUnder commitment — the reborn holon testifies to its
    *  ancestry while `parent` stays the SUPERSEDED record's parent (a rebirth may never reparent). */
   rebornFrom?: string;
-}): string {
+  /** AUTHPROVIDER INHERITANCE (the same law `birthReceivingGroup` already runs): the parent's CURRENT
+   *  verifying material, read off the parent's folded state by the calling plan. A child is born WARRANTED,
+   *  and the warrant permanently closes `seedAuthProvider` — so if the recipe does not seat a verifier here
+   *  the child can never obtain one (`setAuthProvider` mutates a singleton that would never exist), and no
+   *  `user:` principal could ever be captured on it: not even its own first-device enrolment. Absent ⇒ the
+   *  child is born device-key administered, exactly as before. */
+  inheritedAuthProvider?: AuthProviderVerifyingConfiguration;
+  // Operator (D15) and enroller (D22) inheritance live on the token-free recipe only
+  // ({@link buildFoundingGenesisChain}): as admin-gated `grantLawOperator`/`grantEnroller` steps on this
+  // warrant-free prefix no admin exists to satisfy `.requires("admin")`, so the kernel refused them.
+}): readonly GovernanceGenesisOffer[] {
   const founder: `user:${string}` = `user:${p.principal}`;
   // THE ORDER-DECLARED LAW INSTALL (G3): the child installs the EXACT typed USDA closures the order names.
   // Bytes are NOT in the recipe; the kernel resolves each identity from its own custody when it folds the
@@ -611,7 +702,7 @@ export function buildGenesisChain(p: {
   // law-available anchor now; the kernel-structural commitments (parent chain head + birthChild intent hash
   // + law hash) join as `""` placeholders until the kernel produces the genesis (B's later slice). The
   // ordering of keys is fixed so the commitment is a stable, content-addressed shape (proof public inputs).
-  const bornUnder = JSON.stringify({
+  const bornUnder = {
     parent: p.parent,
     principal: p.principal,
     authorizedAt: p.requestedAt,
@@ -619,7 +710,7 @@ export function buildGenesisChain(p: {
     authorizationHash: "",
     parentHead: "",
     ...(p.rebornFrom ? { rebornFrom: p.rebornFrom } : {}),
-  });
+  };
   if (!Number.isInteger(p.descendantPool) || p.descendantPool < 0) {
     throw new Error(
       "buildGenesisChain requires an explicit non-negative descendantPool; " +
@@ -645,7 +736,7 @@ export function buildGenesisChain(p: {
       setAt: p.bornAt,
     }),
   ];
-  return JSON.stringify([
+  return [
     ...installSteps,
     ...poolSteps,
     // ERA 0 — THE GENESIS-ORDER CONTRACT (the birthHome ordering, unified): every recipe seed below runs
@@ -680,7 +771,113 @@ export function buildGenesisChain(p: {
       bornUnder,
       ...(p.rebornFrom ? { rebornFrom: p.rebornFrom } : {}),
     }),
-  ]);
+    // THE VERIFIER THE CHILD IS BORN WITH. Still on the warrant-free prefix (the kernel appends the
+    // attestation and the warrant AFTER this recipe), so this is the one lawful moment the singleton can
+    // come into existence. `setAt: 1` keeps the recipe a pure function of the payload + the parent's
+    // committed fold — no clock, byte-identical on every replaying peer.
+    ...(p.inheritedAuthProvider === undefined ? [] : [
+      governanceGenesisStep(seedAuthProvider, {
+        ...p.inheritedAuthProvider,
+        label: "inherited-from-parent",
+        setBy: p.principal,
+        setAt: 1,
+      } as never),
+    ]),
+  ];
+}
+
+/**
+ * THE TOKEN-FREE GENESIS RECIPE (identity target model D22, build order step 2). The recipe a
+ * `birthChild` naming a `<scope>:<subject>` founding principal and its founding key hash authors:
+ *
+ *   [installDomain(framework), installDomain(law)] → seedBirthPolicy → seedFoundingPrincipal → birthCloud
+ *
+ * `seedFoundingPrincipal` seats the founder's signer tuple, the founder as admin, and the operator and
+ * enroller tuples the parent held at birth — all in one requires-free, virgin-only step, because no
+ * admin exists yet on the warrant-free prefix. No step carries a provider token, verifier, JWKS or
+ * certificate, and nothing here asks the kernel to assemble one: the kernel's birth effect appends only
+ * the warrant (`seedGenesis`, principal = the founder, self-id = the name), which it binds to the
+ * founding record. A parent running law without this builder keeps authoring {@link buildGenesisChain},
+ * so live chains keep their path until regenerated (build order step 4 deletes it).
+ */
+export function buildFoundingGenesisChain(p: {
+  name: string;
+  /** The founding admin principal, `<scope>:<subject>` of a framework governance scope. */
+  foundingPrincipal: string;
+  /** sha256hex of the founding signer's Ed25519 public key. */
+  foundingKeyHash: string;
+  /** The parent's proven requester who authorized the birth (`bornUnder.principal`). */
+  authorizedBy: string;
+  /** The parent CloudWorkspace record id, recorded on the child's lineage (`bornUnder.parent`). */
+  parent: string;
+  tier: (typeof WORKSPACE_TIERS)[number];
+  bornAt: string;
+  requestedAt: number;
+  descendantPool: number;
+  frameworkHash?: Sha256Digest;
+  lawHash?: Sha256Digest;
+  /** The parent's active `operator` subjects at birth ({@link readInheritedOperators}). */
+  inheritedOperators?: readonly string[];
+  /** The parent's active enroller tuples at birth (`readInheritedEnrollers`). */
+  inheritedEnrollers?: readonly InheritedEnroller[];
+  /** The parent's active keys for those operators and enrollers (`readInheritedSigners`). */
+  inheritedSigners?: readonly InheritedSigner[];
+}): readonly GovernanceGenesisOffer[] {
+  if (!Number.isInteger(p.descendantPool) || p.descendantPool < 0) {
+    throw new Error(
+      "buildFoundingGenesisChain requires an explicit non-negative descendantPool; " +
+        "Nomos has no compiled birth-policy fallback",
+    );
+  }
+  const founder = p.foundingPrincipal;
+  const step = <P extends Record<string, unknown>>(declaration: Directive<P>, payload: P) => ({
+    domain: WORKSPACES_DOMAIN,
+    directiveId: declaration.id,
+    actor: founder,
+    payload,
+  });
+  const installSteps =
+    p.frameworkHash && p.lawHash
+      ? [
+          domainInstallGenesisOffer(DomainInstallExecutor.StageZero, p.frameworkHash, founder),
+          domainInstallGenesisOffer(DomainInstallExecutor.LifecycleController, p.lawHash, founder),
+        ]
+      : [];
+  return [
+    ...installSteps,
+    step(seedBirthPolicy, { maxBirthsPerPrincipal: p.descendantPool, setBy: founder, setAt: p.bornAt }),
+    step(seedFoundingPrincipal, {
+      principal: founder,
+      keyHash: p.foundingKeyHash,
+      operators: [...(p.inheritedOperators ?? [])],
+      enrollers: (p.inheritedEnrollers ?? []).map((enroller) => ({ scope: enroller.scope, subject: enroller.subject })),
+      grantedAt: p.requestedAt,
+    }),
+    // The inherited operators' and enrollers' keys, and installDomain for the operators, so the
+    // jurisdiction can act in this child and roll out its law without a re-found.
+    ...inheritedGovernanceStepFrom(
+      WORKSPACES_DOMAIN,
+      founder,
+      p.inheritedOperators ?? [],
+      p.inheritedSigners ?? [],
+      p.requestedAt,
+      { principal: founder, keyHash: p.foundingKeyHash },
+    ),
+    step(birthCloud, {
+      principal: founder,
+      name: p.name,
+      tier: p.tier,
+      bornAt: p.requestedAt,
+      bornUnder: {
+        parent: p.parent,
+        principal: p.authorizedBy,
+        authorizedAt: p.requestedAt,
+        lawHash: "",
+        authorizationHash: "",
+        parentHead: "",
+      },
+    }),
+  ];
 }
 
 // ── THE QUOTA-GATE QUERIES (declared HERE — used by the WorkspaceQuota captured-read invariant) ────────
@@ -836,10 +1033,10 @@ export const birthCloud = directive("birthCloud")
       role: z.enum(WORKSPACE_ROLES).optional(),
       tier: z.enum(WORKSPACE_TIERS).default("edge"),
       bornAt: epochMs,
-      /** THE LINEAGE-AUTHORIZATION BINDING (proof-friendly): the JSON commitment to who authorized this
+      /** THE LINEAGE-AUTHORIZATION BINDING (proof-friendly): the structural commitment to who authorized this
        *  birth, recorded onto the child's self-record so its OWN chain self-attests its parentage. Absent on
        *  root (born under nothing). Authored by {@link buildGenesisChain} for a child birth. */
-      bornUnder: z.string().optional(),
+      bornUnder: WorkspaceBirthAuthority.zod.optional(),
       /** LINEAGE CONTINUITY: present ONLY on a REBIRTH genesis — the superseded incarnation's genesis oid.
        *  The reborn holon's own chain testifies to its ancestry; `parent` (in bornUnder) stays UNCHANGED. */
       rebornFrom: z.string().optional(),
@@ -1312,6 +1509,13 @@ export const birthChild = directive("birthChild")
         /** GENESIS (optional): present ⇒ this child is born running the governance law (a platform). The
          *  sha256 of the founding-admin key the requester presented — the provider grants admin to the hash. */
         foundingAdminHash: sha256Hex.optional(),
+        /** TOKEN-FREE GENESIS (D22): the child's founding admin, a `<scope>:<subject>` principal of a
+         *  framework governance scope (console: or custodian:), and the sha256 of its founding signer's
+         *  public key. Both present ⇒ the child's recipe is {@link buildFoundingGenesisChain}: no provider
+         *  verifier, no certificate, no token. `principal` stays the proven requester the birth is charged
+         *  to. Exclusive with `foundingAdminHash`, which selects the historical recipe. */
+        foundingPrincipal: z.string().min(1).optional(),
+        foundingKeyHash: sha256Hex.optional(),
         /** PLATFORM POOL: explicit law-state for how many live children the born platform may parent.
          * Required with genesis. There is no framework default. Zero deliberately disables births. */
         pool: z.number().int().nonnegative().optional(),
@@ -1335,32 +1539,85 @@ export const birthChild = directive("birthChild")
       .refine((d) => !d.foundingAdminHash || (d.principal.length > 0 && !!d.bornAt && d.pool !== undefined), {
         message: "a genesis birth (foundingAdminHash present) requires a non-empty principal, bornAt (ISO), and explicit pool",
         path: ["pool"],
+      })
+      .refine((d) => !(d.foundingAdminHash && d.foundingKeyHash), {
+        message: "a genesis birth names foundingAdminHash (historical) or foundingKeyHash (token-free), not both",
+        path: ["foundingKeyHash"],
+      })
+      .refine((d) => !d.foundingKeyHash === !d.foundingPrincipal, {
+        message: "a token-free genesis birth names both foundingPrincipal and foundingKeyHash",
+        path: ["foundingPrincipal"],
+      })
+      .refine((d) => !d.foundingPrincipal || (isGovernanceSubject(d.foundingPrincipal) && principalScopeOf(d.foundingPrincipal) !== undefined && !!d.bornAt && d.pool !== undefined), {
+        message: "a token-free genesis birth requires foundingPrincipal as a console: or custodian: <scope>:<subject> principal, bornAt (ISO), and explicit pool",
+        path: ["foundingPrincipal"],
       }),
   )
   .plan((p) => {
     // THE WORKSPACE-QUOTA CAPTURED READS (#58 / S2) — same unconditional capture as createWorkspace, so the
     // WorkspaceQuota invariant counts this principal's live workspaces against its allowance on every lane.
     countQuotaReads(p.principal);
+    // A genesis child inherits its parent's CURRENT verifying material, exactly as a receiving-group birth
+    // does. The read is declared below and captured on the intent, so every replaying peer folds the same
+    // child genesis.
+    const inheritedAuthProvider = p.foundingAdminHash
+      ? readAuthProviderVerifyingConfiguration()
+      : undefined;
+    // TOKEN-FREE GENESIS (D22): the founder is a `<scope>:<subject>` principal named with its founding
+    // key hash. The child inherits no provider verifier (there is none to inherit); it inherits the
+    // parent's operator (D15) and enroller (D22) tuples, captured on this intent so every replaying
+    // peer folds the same child genesis, never re-read live from the parent again.
+    if (p.foundingKeyHash && p.foundingPrincipal) {
+      const inheritedOperators = readInheritedOperators();
+      const inheritedEnrollers = readInheritedEnrollers();
+      const inheritedSigners = readInheritedSigners([...inheritedOperators, ...inheritedEnrollers.map((e) => e.subject)]);
+      planBirthRecord(p, { foundingAdminHash: p.foundingKeyHash, pool: p.pool as number });
+      birth({
+        workspace: p.name,
+        genesisChain: buildFoundingGenesisChain({
+          name: p.name,
+          foundingPrincipal: p.foundingPrincipal,
+          foundingKeyHash: p.foundingKeyHash,
+          authorizedBy: p.principal,
+          parent: p.parent,
+          tier: p.tier,
+          bornAt: p.bornAt as string,
+          requestedAt: p.requestedAt,
+          descendantPool: p.pool as number,
+          ...(p.frameworkHash ? { frameworkHash: p.frameworkHash } : {}),
+          ...(p.lawHash ? { lawHash: p.lawHash } : {}),
+          inheritedOperators,
+          inheritedEnrollers,
+          inheritedSigners,
+        }),
+      });
+      return [];
+    }
     const rec = planBirthRecord(p, p.foundingAdminHash ? { foundingAdminHash: p.foundingAdminHash, pool: p.pool as number } : undefined);
     // LAW AUTHORS THE GENESIS RECIPE (P1): a genesis birth carries its child's [installDomain×2 →]
     // seedGenesis→grantAdmin→birthCloud chain. (refine guarantees principal + bornAt here.)
     if (p.foundingAdminHash) {
       // ERA 0 — every governance/platform birth is WARRANTED (no compat hatch to thread; buildGenesisChain
       // always records the real self-id).
-      const genesisChain = buildGenesisChain({ name: p.name, principal: p.principal, parent: p.parent, tier: p.tier, foundingAdminHash: p.foundingAdminHash, bornAt: p.bornAt as string, requestedAt: p.requestedAt, descendantPool: p.pool as number, ...(p.frameworkHash ? { frameworkHash: p.frameworkHash } : {}), ...(p.lawHash ? { lawHash: p.lawHash } : {}) });
-      // THE GENESIS RECIPE IS ALSO A LINEAGE/AUDIT FACT on the parent's chain (the parent records what it
-      // ORDERED — law naming law, legitimate). The kernel does NOT read this field to detect the birth.
-      rec.set("genesisChain", genesisChain);
+      const genesisChain = buildGenesisChain({ name: p.name, principal: p.principal, parent: p.parent, tier: p.tier, foundingAdminHash: p.foundingAdminHash, bornAt: p.bornAt as string, requestedAt: p.requestedAt, descendantPool: p.pool as number, ...(p.frameworkHash ? { frameworkHash: p.frameworkHash } : {}), ...(p.lawHash ? { lawHash: p.lawHash } : {}), ...(inheritedAuthProvider ? { inheritedAuthProvider } : {}) });
       // THE DECLARED BIRTH EFFECT (G3 — the unix model): the recipe rides the committed intent as a declared
       // output (`captured_ports.births`). The kernel — reading the `.births` DECLARATION off the law manifest
       // (the `nomosBirthGate` era key, NEVER this CloudWorkspace aggregate) — takes the recipe off the intent
       // after admit and spawns + self-validates the child through the child's OWN gate. So birth is an
       // EXPLICIT, declared consequence of the offer, not a side-effect inferred by scanning domain state.
-      birth({ workspace: p.name, genesisChain: JSON.parse(genesisChain) });
+      birth({ workspace: p.name, genesisChain });
     }
     return [];
   })
   .reads(workspacesByPrincipal, quotaByPrincipal, cloudPolicy) // arm the WorkspaceQuota captured-read gate (S2)
+  // The parent's verifier, in the exact provider/keys/certificates order the read helper executes.
+  .reads(authProvider)
+  .reads(authProviderKeysQuery)
+  .reads(authProviderCertificatesQuery)
+  // The parent's current operator subjects (D15) — readInheritedOperators's one declared dependency.
+  .reads(relationTuplesByObject)
+  // The parent's current enroller tuples (D22) — readInheritedEnrollers's one declared dependency.
+  .reads(relationTuplesByRelation)
   .births(); // BIRTH IS A DECLARED KERNEL PRIMITIVE (G3): the kernel folds the carried recipe; posture is invariant law
 
 /** workspacesByStatus — the birth provider drains `requested` CloudWorkspaces that CARRY A foundingAdminHash
@@ -1407,6 +1664,8 @@ export {
   AUTH_PROVIDER_ID,
   AUTH_PROVIDER_KEY_ID_PREFIX,
   AUTH_PROVIDER_CERTIFICATE_ID_PREFIX,
+  AUTH_PROVIDER_AUTHORITY,
+  AUTH_PROVIDER_EPOCH_CONSUMER,
   AuthProvider,
   AuthProviderKey,
   AuthProviderCertificate,
@@ -1419,6 +1678,10 @@ export {
   seedAuthProvider,
   authProviderSeedBeforeWarrant,
   setAuthProvider,
+  adoptIdentityProviderWitness,
+  identityProviderSourceTrust,
+  authProviderSourceRelations,
+  authProviderEpochConsumerRelations,
   authProvider,
   authProviderKeys,
   authProviderCertificates,
@@ -1429,9 +1692,15 @@ import {
   AuthProviderCertificate,
   AuthProviderKey,
   authProvider,
+  authProviderCertificates as authProviderCertificatesQuery,
+  authProviderKeys as authProviderKeysQuery,
   authProviderKeySet,
+  adoptIdentityProviderWitness,
+  readAuthProviderVerifyingConfiguration,
+  seedAuthProvider,
   setAuthProvider,
   writeAuthProviderKeySet,
+  type AuthProviderVerifyingConfiguration,
 } from "./auth_provider_law.js";
 
 /**
@@ -1726,17 +1995,102 @@ export const grantAdmin = directive("grantAdmin")
         // identity, so it survives device-key ROTATION (the signer indirection's whole point) and matches
         // the subject a SIGNED author resolves to. `keyHash` (a `key:<hash>` subject) is the legacy
         // key-centric grant (the bearer-secret lane). Exactly one — mirrors grantCreation.
-        keyHash: sha256Hex.optional(),
-        principal: z.string().min(1).optional(),
+        // `consolePrincipal` (a `console:<subject>`) — an operator the console enrols (D22): how a real
+        // operator takes over a workspace founded by a stand-in, after birth, with no re-found.
+        ...governanceSubjectFields,
         label: z.string().min(1),
         grantedBy: z.string().min(1),
         grantedAt: epochMs,
       })
-      .refine((d) => !!d.keyHash !== !!d.principal, { message: "grantAdmin needs exactly one of keyHash (a key: subject) or principal (a user: subject)", path: ["keyHash"] }),
+      .refine(hasOneGovernanceSubject, { message: "grantAdmin needs exactly one of keyHash (a key: subject), principal (a user: subject) or consolePrincipal (a console: subject)", path: ["keyHash"] }),
   )
-  .plan((p) => writeTuple({ object: SELF_ADMIN_OBJECT, relation: "admin", subject: p.principal ? "user:" + p.principal : "key:" + p.keyHash, grantedBy: p.grantedBy, grantedAt: String(p.grantedAt) }))
+  .plan((p) => writeTuple({ object: SELF_ADMIN_OBJECT, relation: "admin", subject: governanceSubject(p), grantedBy: p.grantedBy, grantedAt: String(p.grantedAt) }))
   .requires("admin"); // only an admin grants admin (pre-apply roster ⇒ no self-grant)
 
+/**
+ * grantLawOperator — seat `workspace:self#operator@<subject>` (identity target model D15): who may
+ * install, stage or promote law here. Distinct from {@link grantOperator}/{@link revokeOperator}
+ * above, which toggle this workspace's OWN {@link GovernancePosture} (managed vs sovereign) — a
+ * coarse platform-relationship flag, not a principal-level grant. An admin seats this, exactly as an
+ * admin grants admin; a child born under this workspace gets a copy of whoever currently holds it at
+ * the moment of birth (`buildGenesisChain`'s `inheritedOperators`, `readInheritedOperators` below) —
+ * a fact recorded once, never a live read of the parent afterward.
+ */
+export const grantLawOperator = directive("grantLawOperator")
+  .ensures(RelationTuple)
+  .payload(
+    z
+      .object({
+        ...governanceSubjectFields,
+        label: z.string().min(1),
+        grantedBy: z.string().min(1),
+        grantedAt: epochMs,
+      })
+      .refine(hasOneGovernanceSubject, { message: "grantLawOperator needs exactly one of keyHash (a key: subject), principal (a user: subject) or consolePrincipal (a console: subject)", path: ["keyHash"] }),
+  )
+  // An operator is who installs law (D15), so the seat carries workspace:self#installDomain with it.
+  .plan((p) => [
+    ...writeTuple({ object: SELF_ADMIN_OBJECT, relation: "operator", subject: governanceSubject(p), grantedBy: p.grantedBy, grantedAt: String(p.grantedAt) }),
+    ...writeTuple({ object: SELF_ADMIN_OBJECT, relation: MODEL_LIFECYCLE_AUTHORITY, subject: governanceSubject(p), grantedBy: p.grantedBy, grantedAt: String(p.grantedAt) }),
+  ])
+  .requires("admin");
+
+/** revokeLawOperator — the operator-relation mirror of revokeAdmin; see its own doc for the leaf mechanics. */
+export const revokeLawOperator = directive("revokeLawOperator")
+  .ensures(RelationTuple)
+  .payload(
+    z
+      .object({
+        ...governanceSubjectFields,
+        revokedBy: z.string().min(1),
+        revokedAt: epochMs,
+      })
+      .refine(hasOneGovernanceSubject, { message: "revokeLawOperator needs exactly one of keyHash, principal or consolePrincipal", path: ["keyHash"] }),
+  )
+  .plan((p) => [
+    ...removeTuple({ object: SELF_ADMIN_OBJECT, relation: "operator", subject: governanceSubject(p), grantedBy: p.revokedBy, grantedAt: String(p.revokedAt), revokedBy: p.revokedBy, revokedAt: String(p.revokedAt) }),
+    ...removeTuple({ object: SELF_ADMIN_OBJECT, relation: MODEL_LIFECYCLE_AUTHORITY, subject: governanceSubject(p), grantedBy: p.revokedBy, grantedAt: String(p.revokedAt), revokedBy: p.revokedBy, revokedAt: String(p.revokedAt) }),
+  ])
+  .requires("admin");
+
+/**
+ * grantEnroller — seat `principalScope:<scope>#enroller@<subject>` (identity target model D22): who may
+ * write the first signer key of a `<scope>:` principal (`enrollDevice`) and revoke that scope's keys
+ * (`revokeDevice`). Mirrors {@link grantLawOperator} exactly: admin-gated, one subject, and copied into
+ * a child at birth (`buildGenesisChain`'s `inheritedEnrollers`).
+ */
+export const grantEnroller = directive("grantEnroller")
+  .ensures(RelationTuple)
+  .payload(
+    z
+      .object({
+        scope: providerScopeField,
+        ...governanceSubjectFields,
+        label: z.string().min(1),
+        grantedBy: z.string().min(1),
+        grantedAt: epochMs,
+      })
+      .refine(hasOneGovernanceSubject, { message: "grantEnroller needs exactly one of keyHash, principal or consolePrincipal", path: ["keyHash"] }),
+  )
+  .plan((p) => writeTuple({ object: principalScopeObject(p.scope), relation: PRINCIPAL_SCOPE_ENROLLER_RELATION, subject: governanceSubject(p), grantedBy: p.grantedBy, grantedAt: String(p.grantedAt) }))
+  .requires("admin");
+
+/** revokeEnroller — the enroller-relation mirror of {@link revokeLawOperator}. */
+export const revokeEnroller = directive("revokeEnroller")
+  .ensures(RelationTuple)
+  .payload(
+    z
+      .object({
+        scope: providerScopeField,
+        ...governanceSubjectFields,
+        revokedBy: z.string().min(1),
+        revokedAt: epochMs,
+      })
+      .refine(hasOneGovernanceSubject, { message: "revokeEnroller needs exactly one of keyHash, principal or consolePrincipal", path: ["keyHash"] }),
+  )
+  .plan((p) => removeTuple({ object: principalScopeObject(p.scope), relation: PRINCIPAL_SCOPE_ENROLLER_RELATION, subject: governanceSubject(p), grantedBy: p.revokedBy, grantedAt: String(p.revokedAt), revokedBy: p.revokedBy, revokedAt: String(p.revokedAt) }))
+  .requires("admin");
+
 /**
  * revokeAdmin — flip an AdminGrant to `revoked`. The key stops verifying at fold
  * time; the grant record (who granted it, when, who killed it) stays on the
@@ -1750,16 +2104,29 @@ export const revokeAdmin = directive("revokeAdmin")
   .payload(
     z
       .object({
-        keyHash: sha256Hex.optional(),
-        principal: z.string().min(1).optional(),
+        ...governanceSubjectFields,
         revokedBy: z.string().min(1),
         revokedAt: epochMs,
       })
-      .refine((d) => !!d.keyHash !== !!d.principal, { message: "revokeAdmin needs exactly one of keyHash or principal", path: ["keyHash"] }),
+      .refine(hasOneGovernanceSubject, { message: "revokeAdmin needs exactly one of keyHash, principal or consolePrincipal", path: ["keyHash"] }),
   )
-  .plan((p) => removeTuple({ object: SELF_ADMIN_OBJECT, relation: "admin", subject: p.principal ? "user:" + p.principal : "key:" + p.keyHash, grantedBy: p.revokedBy, grantedAt: String(p.revokedAt), revokedBy: p.revokedBy, revokedAt: String(p.revokedAt) }))
+  .plan((p) => removeTuple({ object: SELF_ADMIN_OBJECT, relation: "admin", subject: governanceSubject(p), grantedBy: p.revokedBy, grantedAt: String(p.revokedAt), revokedBy: p.revokedBy, revokedAt: String(p.revokedAt) }))
   .requires("admin");
 
+/** A workspace always keeps an admin: revoking the last one (a handover done in the wrong order) is refused. */
+export const lastAdminRemains = workspaceInvariant("LastAdminRemains")
+  .on("revokeAdmin")
+  .reads(() => [refAs("tuple", "RelationTuple", "pre:" + relationTupleInstanceId(SELF_ADMIN_OBJECT, "admin"))])
+  .assert(({ tuple }, ctx) => {
+    const intent = (ctx?.intent ?? {}) as { keyHash?: string; principal?: string; consolePrincipal?: string };
+    let leaving = "";
+    try { leaving = governanceSubject(intent); } catch { return { reject: "revoke-admin-names-no-subject" }; }
+    const subjects = (tuple as { subjects?: Record<string, { status?: string }> } | undefined)?.subjects ?? {};
+    return Object.entries(subjects).some(([subject, leaf]) => leaf?.status === "active" && subject !== leaving)
+      ? { accept: true }
+      : { reject: "last-admin-cannot-be-revoked" };
+  });
+
 /**
  * grantCreation — mint a workspace-creation credential record (`status:"active"`).
  * The lawful replacement for the `NOMOS_CLOUD_INVITE_KEY` env var: who may invite