@githolon/dsl 0.108.7 → 0.110.0

package/src/law_graph.ts

@@ -4,6 +4,7 @@
 import type { DomainModule } from "./codegen_dart.js";
 import type { z } from "zod";
 import { finishCount } from "./count.js";
+import { SIGNER_DELEGATION_PREFIX } from "./framework/signing_identity.js";
 import { finishExists } from "./exists.js";
 import { finishExtremum } from "./extremum.js";
 import { finishSum } from "./sum.js";
@@ -15,9 +16,12 @@ import {
   mintStructuralLawSid,
   type LawEntityKind,
   type LawIdentityCarry,
+  type LawIdentityEntity,
   type LawIdentityRegistry,
+  type LawOperationFieldWire,
 } from "./law_identity.js";
-import type { ReferentialMarker } from "./directive.js";
+import type { Directive, ReferentialMarker } from "./directive.js";
+import type { MemberAuthentication } from "./member_authentication.js";
 import type { CanonicalPred } from "./predicate.js";
 import type { PointGuardPredicate } from "./point_guard.js";
 import {
@@ -27,7 +31,7 @@ import {
   type Rewrite,
 } from "./relation_schema.js";
 import type { StableFieldEvolution, StableIds } from "./stable_ids_types.js";
-import { isBusinessIntent } from "./intent.js";
+import { isBusinessIntent, publicOfferRoute } from "./intent.js";
 import {
   lowerLawValueType,
   type LawConstant,
@@ -38,7 +42,13 @@ import {
   type LawValueType,
 } from "./law_value_type.js";
 import { harvestPrincipalFlows } from "./wire_encode.js";
-import { admitsNull, type Field, type FieldKind, type ValueObjectFieldDescriptor } from "./fields.js";
+import {
+  admitsNull,
+  type Field,
+  type FieldKind,
+  type ValueObjectDescriptor,
+  type ValueObjectFieldDescriptor,
+} from "./fields.js";
 import type { GeometryKind } from "./value_object.js";
 import type { Driver } from "./drivers.js";
 import {
@@ -302,6 +312,10 @@ export interface LawStructuralEntity<K extends LawStructuralKind> {
   readonly sid: string;
   readonly label: string;
   readonly identityClass: "structural";
+  /** Retained transport allocation. Meaning remains the scoped field name + its disclosed lineage. */
+  readonly wireKey?: string;
+  /** Previously shipped transport allocations accepted during a managed overlap. */
+  readonly wireAliases?: readonly string[];
 }
 
 export interface LawStructuralRef<K extends LawStructuralKind> {
@@ -469,7 +483,12 @@ export interface LawTrustSourceSetNode extends LawPolicyBase<"source-set"> {
   readonly keysField: LawRef<"field">;
 }
 
-export type LawPolicyNode = LawPinnedTrustSourceNode | LawTrustSourceSetNode;
+export interface LawAuthorizedCustodySourceNode extends LawPolicyBase<"authorized-custody-source"> {}
+
+export type LawPolicyNode =
+  | LawPinnedTrustSourceNode
+  | LawTrustSourceSetNode
+  | LawAuthorizedCustodySourceNode;
 
 export interface LawForeignReadNode {
   readonly kind: "structural";
@@ -508,6 +527,7 @@ export interface LawWorkspaceInvariantNode {
   readonly entity: LawEntity<"invariant">;
   readonly domain: LawRef<"domain">;
   readonly invariantKind: "workspace";
+  readonly refusalType?: LawRef<"type">;
   readonly on: LawRef<"intent">;
   readonly reads?: readonly {
     readonly binding: string;
@@ -516,7 +536,7 @@ export interface LawWorkspaceInvariantNode {
     readonly eachPayloadPath?: readonly string[];
     readonly id: InvariantReadBinding["id"];
   }[];
-  readonly evaluator?: "birth-quota-v1" | "founder-signer-write-once-v1" | "point-guard-v1";
+  readonly evaluator?: "birth-quota-v1" | "founder-signer-write-once-v1" | "founder-signer-write-once-v2" | "point-guard-v1";
   readonly pointGuard?: {
     readonly aggregate: LawRef<"aggregate">;
     readonly binding: string;
@@ -549,6 +569,8 @@ export interface LawCapabilityNode {
   readonly deadLetter: LawRef<"intent">;
   readonly capability: string;
   readonly endpoint?: string;
+  readonly executionPlacement?: "custodian";
+  readonly executionCardinality?: "singleton";
   readonly tasks?: LawRef<"read">;
 }
 
@@ -572,6 +594,7 @@ export interface LawIntentAuthorization {
   readonly relation: LawTargetRef<"relation">;
   readonly object: string;
   readonly objectFrom?: LawIntentAuthorizationObjectFrom;
+  readonly subjectFromAttestedRead?: string;
 }
 
 export interface LawIntentNode {
@@ -597,9 +620,13 @@ export interface LawIntentNode {
   readonly acceptsWorkspaceEffect: boolean;
   /** Recovery-only admission: the verified source workspace must be the target's exact birth parent. */
   readonly acceptsVerifiedBirthParentRecovery: boolean;
-  /** Client proof selected by law for this exact public offer. Absence retains the ordinary
-   * session-credential posture. */
-  readonly offerAuthenticationProof?: "enrolledDevice";
+  readonly acceptsVerifiedWorkspaceClaim?: boolean;
+  /** Authentication selected by law for this exact member. Absence retains the historical
+   * default-provider interpretation for existing law. */
+  readonly authentication?: MemberAuthentication;
+  /** D22 sovereign self-certification: the founding signer tuple this intent writes is admitted iff
+   * the signing key's sha256 is the captured principal's subject. */
+  readonly selfCertifyingPrincipal?: boolean;
   /** Exact nominal target directives this source intent may author into another workspace. */
   readonly directsWorkspaceEffects: readonly LawTargetRef<"intent">[];
   /** Zanzibar relation required to author this intent. */
@@ -609,6 +636,8 @@ export interface LawIntentNode {
   readonly births: boolean;
   readonly birthRecord?: LawRef<"aggregate">;
   readonly birthPrefix?: string;
+  readonly birthDelegations?: LawRef<"field">;
+  readonly birthDelegationPrefix?: string;
   /** The law-declared genesis verb that establishes this workspace's birth policy. This is a
    * relationship to executable law, never a compiler/runtime allowance value: the kernel uses it
    * only to require an explicit matching step in child genesis before custody can be created. */
@@ -644,12 +673,7 @@ export interface LawIntentNode {
   readonly effects: readonly LawStructuralRef<"effect">[];
   readonly steps: readonly LawRef<"intent">[];
   readonly refuses: readonly string[];
-}
-
-/** The public directive vocabulary carried into typed USDA and generated-client compatibility. */
-export function publicIntentRoute(intent: DomainModule["directives"][number]): string {
-  const businessBirth = (intent as { businessBirth?: unknown }).businessBirth;
-  return businessBirth === undefined || isBusinessIntent(intent) ? intent.id : "birth";
+  readonly domainRefusals?: readonly LawRef<"type">[];
 }
 
 /**
@@ -680,6 +704,7 @@ interface LawReadBase<K extends string> {
   readonly of: LawRef<"aggregate">;
   readonly contract: LawRef<"contract">;
   readonly public: boolean;
+  readonly authentication?: MemberAuthentication;
   readonly predicate?: LawStructuralRef<"predicate">;
 }
 
@@ -711,6 +736,9 @@ export interface LawOrderedReadNode extends LawReadBase<"ordered"> {
   readonly filtered: boolean;
 }
 
+/** Declared aggregate-row reads share typed transport, not selection semantics. */
+export type LawRowReadNode = LawQueryReadNode | LawOrderedReadNode;
+
 export interface LawSpatialReadNode extends LawReadBase<"spatial"> {
   readonly geometry: LawFieldPathRef;
 }
@@ -776,6 +804,8 @@ export interface LawRetirement {
 }
 
 export interface DiscoverLawGraphOptions {
+  /** The package's exact declaration/export identity, not a label search. */
+  readonly workspaceEffectDomain?: (target: Directive<unknown>) => string;
   readonly intentCarries?: readonly LawIdentityCarry[];
   readonly readCarries?: readonly LawIdentityCarry[];
   readonly source?: (
@@ -786,6 +816,7 @@ export interface DiscoverLawGraphOptions {
       | "intent"
       | "read"
       | "contract"
+      | "operation-field"
       | "type"
       | "object-type"
       | "relation"
@@ -992,6 +1023,7 @@ export function discoverLawGraph(
   }
 
   const types = [...(module.valueObjects ?? [])].sort((a, b) => compareText(a.name, b.name));
+  const typeDescriptorByName = new Map(types.map((type) => [type.name, type] as const));
   reconciled = identities.reconcile({
     kind: "type",
     parent: domainKey,
@@ -1008,7 +1040,7 @@ export function discoverLawGraph(
     ),
   ] as const));
   const linkValueObjectField = (node: LawFieldNode, field: Field, owner: string): LawFieldNode => {
-    const valueObject = field.valueObject;
+    const valueObject = field.valueObject ?? field.mapValueVo;
     if (valueObject === undefined) return node;
     const target = typeEntitiesByLabel.get(valueObject.name);
     if (target === undefined) fail(`field '${owner}.${node.entity.label}' targets unknown type '${valueObject.name}'`);
@@ -1017,6 +1049,27 @@ export function discoverLawGraph(
         anonymousValueNodes.delete(id);
       }
     }
+    if (field.mapValueVo !== undefined) {
+      // A map of named values is not an anonymous JSON/map shape. Lower its
+      // canonical descriptor into the graph so every downstream projection
+      // (Protobuf, Dart, TypeScript and USDA) sees the same nested nominal
+      // enums, units, references and objects.
+      const lowered = lowerAnonymousValueGraph(
+        {
+          kind: "map",
+          value: descriptorTypeValue(
+            field.mapValueVo.descriptor,
+            typeDescriptorByName,
+            new Set(),
+          ),
+        },
+        node.entity,
+      );
+      for (const structural of lowered.nodes) {
+        anonymousValueNodes.set(structural.entity.id, structural);
+      }
+      return { ...node, value: lowered.root };
+    }
     return { ...node, value: ref(target) };
   };
   for (const aggregate of module.aggregates) {
@@ -1064,7 +1117,10 @@ export function discoverLawGraph(
         if (target === undefined) fail(`type '${type.name}' field '${fieldName}' targets unknown type '${field.ref}'`);
         value = ref(target);
       } else {
-        const lowered = lowerAnonymousValueGraph(descriptorValue(field), fieldEntity);
+        const lowered = lowerAnonymousValueGraph(
+          descriptorValue(field, typeDescriptorByName, new Set(), type.name, fieldName),
+          fieldEntity,
+        );
         for (const structural of lowered.nodes) anonymousValueNodes.set(structural.entity.id, structural);
         value = lowered.root;
       }
@@ -1076,7 +1132,7 @@ export function discoverLawGraph(
         evolutions: [],
         mergeDrivers: [],
         required: field.optional !== true,
-        nullable: false,
+        nullable: field.nullable === true,
         encrypted: false,
         blindIndexed: false,
       };
@@ -1090,12 +1146,13 @@ export function discoverLawGraph(
         if (referenced === undefined) fail(`type '${type.name}' variant '${variantName}' targets unknown type '${variant.ref}'`);
         target = ref(referenced);
       } else {
+        const armOwner = `${type.name}${variantName[0]!.toUpperCase()}${variantName.slice(1)}`;
         const value: LawValueType = {
           kind: "record",
           fields: Object.entries(variant.fields).sort(([a], [b]) => compareText(a, b)).map(([name, field]) => ({
             name,
             required: field.optional !== true,
-            value: descriptorValue(field),
+            value: descriptorValue(field, typeDescriptorByName, new Set(), armOwner, name),
           })),
         };
         const lowered = lowerAnonymousValueGraph(value, typeEntity);
@@ -1195,7 +1252,16 @@ export function discoverLawGraph(
       // A workspace-effect-only intent has no local aggregate consequence. Its nominal target
       // aggregate belongs to the destination package; retain that as a dependency export instead
       // of fabricating a local audit row merely to satisfy the older directive-shaped IR.
-      return { kind: "dependency-export", entityKind: "aggregate", label: aggregateId };
+      const effect = intent.workspaceEffects.find(
+        (candidate) => candidate.target.aggregateId === aggregateId,
+      )!;
+      const owner = options.workspaceEffectDomain?.(effect.target);
+      return {
+        kind: "dependency-export",
+        entityKind: "aggregate",
+        label: aggregateId,
+        ...(owner === undefined ? {} : { domain: owner }),
+      };
     }
     const birth = (intent as { businessBirth?: { aggregateId?: unknown; domain?: unknown } }).businessBirth;
     if (birth?.aggregateId === aggregateId && typeof birth.domain === "string") {
@@ -1205,6 +1271,55 @@ export function discoverLawGraph(
   };
   const intentNodes: LawIntentNode[] = intents.map((intent) => {
     const intentEntity = intentEntities.get(intent.id)!;
+    const liveOperationFieldNames = new Set<string>();
+    const lowerPayloadContract = (
+      value: LawValueType,
+      contract: LawEntity<"contract">,
+      scope: "accepts" | "publicAccepts",
+    ): ReturnType<typeof lowerAnonymousContractFields> => {
+      // A field's scoped name is its semantic declaration. The identity ledger keeps
+      // its prior names/tombstone; this additional binding retains only the Protobuf
+      // allocation already spoken by clients. Schema fingerprints remain structural.
+      const provisional = lowerAnonymousContractFields(value, contract);
+      const provisionalById = new Map(provisional.nodes.map((node) => [node.entity.id, node]));
+      const fields = provisional.fields.map((fieldRef): LawAnonymousValueFieldNode => {
+        const field = provisionalById.get(fieldRef.id);
+        if (field?.kind !== "structural" || field.structuralKind !== "value-field") {
+          fail(`directive '${intent.id}' has an invalid top-level ${scope} field`);
+        }
+        return field;
+      });
+      const labels = fields.map((field) => field.name);
+      for (const label of labels) liveOperationFieldNames.add(label);
+      const preferredOperationFieldWire = Object.fromEntries(
+        fields.map((field) => [
+          field.name,
+          { protobuf: { canonical: field.entity.sid } },
+        ]),
+      );
+      const fieldLedger = identities.reconcile({
+        kind: "operation-field",
+        parent: intentEntity.id,
+        labels,
+        preferredOperationFieldWire,
+        // `accepts` and the optional public projection are lowered separately but
+        // share one operation namespace. Retire only after their union is known.
+        retireAbsent: false,
+      });
+      registry = fieldLedger.registry;
+      return lowerAnonymousContractFields(value, contract, (name) => {
+        const key = fieldLedger.resolved[name];
+        const field = key === undefined ? undefined : registry.entities[key];
+        if (
+          field?.kind !== "operation-field" ||
+          field.status !== "active" ||
+          field.operationFieldWire === undefined
+        ) {
+          fail(`directive '${intent.id}' has no active wire allocation for ${scope} field '${name}'`);
+        }
+        return field.operationFieldWire.protobuf;
+      });
+    };
     const businessBirth = (intent as {
       businessBirth?: { publicPayloadSchema?: z.ZodTypeAny; owned?: boolean };
     }).businessBirth;
@@ -1263,9 +1378,10 @@ export function discoverLawGraph(
     ) {
       frameworkCapabilities.add("owned-authoring");
     }
-    const payloadShape = lowerAnonymousContractFields(
+    const payloadShape = lowerPayloadContract(
       internalPayloadContract(tenantPayloadContract, frameworkCapabilities),
       payloadContractEntity,
+      "accepts",
     );
     for (const node of payloadShape.nodes) anonymousValueNodes.set(node.entity.id, node);
     payloadContractNodes.push({
@@ -1284,9 +1400,10 @@ export function discoverLawGraph(
         `${intent.id}#publicAccepts`,
         options.source?.("intent", intent.id, module.name),
       );
-      const publicPayloadShape = lowerAnonymousContractFields(
+      const publicPayloadShape = lowerPayloadContract(
         lowerLawValueType(businessBirth.publicPayloadSchema),
         publicPayloadContractEntity,
+        "publicAccepts",
       );
       for (const node of publicPayloadShape.nodes) anonymousValueNodes.set(node.entity.id, node);
       payloadContractNodes.push({
@@ -1296,6 +1413,12 @@ export function discoverLawGraph(
         fields: publicPayloadShape.fields,
       });
     }
+    const finalizedOperationFields = identities.reconcile({
+      kind: "operation-field",
+      parent: intentEntity.id,
+      labels: [...liveOperationFieldNames],
+    });
+    registry = finalizedOperationFields.registry;
     const payloadFields = new Map<string, LawStructuralRef<"value-field">>();
     const indexPayloadValue = (
       valueRef: LawValueTypeRef,
@@ -1477,7 +1600,7 @@ export function discoverLawGraph(
       // compiler-lowered business-birth directive publishes the generic framework `birth` route.
       // Keep this identical to domainInterface/codegen so the typed USDA is sufficient to
       // reconstruct the generated-client compatibility surface.
-      publicRoute: publicIntentRoute(intent),
+      publicRoute: publicOfferRoute(intent),
       accepts: ref(payloadContractEntity),
       ...(publicPayloadContractEntity === undefined ? {} : {
         publicAccepts: ref(publicPayloadContractEntity),
@@ -1488,16 +1611,25 @@ export function discoverLawGraph(
       acceptsWorkspaceEffect: intent.acceptsWorkspaceEffectGate === true,
       acceptsVerifiedBirthParentRecovery:
         intent.acceptsVerifiedBirthParentRecoveryGate === true,
-      ...(isBusinessIntent(intent) && intent.offerAuthenticationProof !== undefined
-        ? { offerAuthenticationProof: intent.offerAuthenticationProof }
+      ...(intent.acceptsVerifiedWorkspaceClaimGate === true
+        ? { acceptsVerifiedWorkspaceClaim: true }
         : {}),
-      directsWorkspaceEffects: (isBusinessIntent(intent) ? intent.workspaceEffects : []).map((effect) => {
-        const local = intentEntities.get(effect.target.id);
+      ...(intent.authentication !== undefined
+        ? { authentication: intent.authentication }
+        : {}),
+      ...(intent.selfCertifyingPrincipalGate === true
+        ? { selfCertifyingPrincipal: true }
+        : {}),
+      directsWorkspaceEffects: (intent.workspaceEffects ?? []).map((effect) => {
+        const owner = options.workspaceEffectDomain?.(effect.target);
+        const local = owner === undefined || owner === (module.domain ?? module.name)
+          ? intentEntities.get(effect.target.id) : undefined;
         return local === undefined
           ? {
               kind: "dependency-export" as const,
               entityKind: "intent" as const,
               label: effect.target.id,
+              ...(owner === undefined ? {} : { domain: owner }),
             }
           : ref(local);
       }),
@@ -1508,6 +1640,10 @@ export function discoverLawGraph(
         birthRecord: ref(aggregateByLabel.get("NomosBirthRecord")!.node.entity),
         birthPrefix: "nomos-birth-record:",
       }),
+      ...(intent.birthsChild !== true || aggregateByLabel.get("SignerDelegation")?.fields.get("certificates") === undefined ? {} : {
+        birthDelegations: ref(aggregateByLabel.get("SignerDelegation")!.fields.get("certificates")!.entity),
+        birthDelegationPrefix: SIGNER_DELEGATION_PREFIX,
+      }),
       ...(intent.birthsChild !== true || intentEntities.get("seedBirthPolicy") === undefined ? {} : {
         birthPolicySeed: ref(intentEntities.get("seedBirthPolicy")!),
       }),
@@ -1709,10 +1845,15 @@ export function discoverLawGraph(
   });
   for (const [index, intentNode] of intentNodes.entries()) {
     const declaration = intents.find((intent) => intent.id === intentNode.entity.label)!;
+    if (declaration.acceptsVerifiedWorkspaceClaimGate === true &&
+        declaration.acceptsVerifiedBirthParentRecoveryGate === true) {
+      throw new Error(`directive '${declaration.id}' declares competing workspace admission policies`);
+    }
     const gate = declaration.requiresRelationGate;
     if (
       declaration.acceptsWorkspaceEffectGate === true &&
-      declaration.acceptsVerifiedBirthParentRecoveryGate !== true
+      declaration.acceptsVerifiedBirthParentRecoveryGate !== true &&
+      declaration.acceptsVerifiedWorkspaceClaimGate !== true
     ) {
       if (gate === undefined || gate.object !== "workspace:self" || gate.objectFrom !== undefined) {
         fail(
@@ -1722,6 +1863,17 @@ export function discoverLawGraph(
       }
     }
     if (gate === undefined) continue;
+    if (
+      gate.subjectFromAttestedRead !== undefined &&
+      !(declaration.declaredForeignReads ?? []).some(
+        (edge) => edge.queryId === gate.subjectFromAttestedRead,
+      )
+    ) {
+      fail(
+        `intent '${declaration.id}' authorization subject read ` +
+          `'${gate.subjectFromAttestedRead}' is not declared with .readsFrom(...)`,
+      );
+    }
     const objectType = gate.objectFrom?.recordType ?? gate.object.split(":", 1)[0]!;
     const exactLabel = gate.relation.includes("#") ? gate.relation : `${objectType}#${gate.relation}`;
     const candidates = relationNodes.filter((relation) =>
@@ -1770,6 +1922,9 @@ export function discoverLawGraph(
           : ref(candidates[0].entity),
         object: authorizationObject,
         ...(objectFrom === undefined ? {} : { objectFrom }),
+        ...(gate.subjectFromAttestedRead === undefined
+          ? {}
+          : { subjectFromAttestedRead: gate.subjectFromAttestedRead }),
       },
     };
   }
@@ -1800,10 +1955,10 @@ export function discoverLawGraph(
   }
 
   const pinnedSources = [...(module.trustSources ?? [])].sort((a, b) => compareText(a.workspace, b.workspace));
-  const sourceSets = [...(module.trustPolicies ?? [])].sort((a, b) => compareText(a.policyId, b.policyId));
+  const trustPolicies = [...(module.trustPolicies ?? [])].sort((a, b) => compareText(a.policyId, b.policyId));
   const policyLabels = [
     ...pinnedSources.map((source) => `source:${source.workspace}`),
-    ...sourceSets.map((policy) => policy.policyId),
+    ...trustPolicies.map((policy) => policy.policyId),
   ];
   reconciled = identities.reconcile({
     kind: "policy",
@@ -1829,7 +1984,24 @@ export function discoverLawGraph(
         onDishonor: source.onDishonor ?? "refuse",
       };
     }),
-    ...sourceSets.map((policy): LawTrustSourceSetNode => {
+    ...trustPolicies.map((policy): LawTrustSourceSetNode | LawAuthorizedCustodySourceNode => {
+      if (policy.authorizationOnly === true) {
+        return {
+          kind: "policy",
+          entity: entity(registry, reconciled.resolved[policy.policyId]!, "policy", options.source?.("policy", policy.policyId, module.name)),
+          domain: domainRef,
+          policyKind: "authorized-custody-source",
+          monotone: false,
+          onDishonor: "refuse",
+        };
+      }
+      if (
+        policy.allowListType === undefined ||
+        policy.genesisField === undefined ||
+        policy.keysField === undefined
+      ) {
+        fail(`policy '${policy.policyId}' has no source-set fields`);
+      }
       const allowList = aggregateByLabel.get(policy.allowListType);
       if (allowList === undefined) fail(`policy '${policy.policyId}' targets unknown aggregate '${policy.allowListType}'`);
       const genesisField = allowList.fields.get(policy.genesisField);
@@ -1856,8 +2028,9 @@ export function discoverLawGraph(
     policyNodes.filter((node): node is LawPinnedTrustSourceNode => node.policyKind === "pinned-source")
       .map((node) => [node.workspace, node] as const),
   );
-  const sourceSetByLabel = new Map(
-    policyNodes.filter((node): node is LawTrustSourceSetNode => node.policyKind === "source-set")
+  const dynamicPolicyByLabel = new Map(
+    policyNodes.filter((node): node is LawTrustSourceSetNode | LawAuthorizedCustodySourceNode =>
+      node.policyKind === "source-set" || node.policyKind === "authorized-custody-source")
       .map((node) => [node.entity.label, node] as const),
   );
   const foreignReadNodes: LawForeignReadNode[] = [];
@@ -1867,13 +2040,34 @@ export function discoverLawGraph(
     for (const edge of declaration.declaredForeignReads ?? []) {
       const source = "from" in edge
         ? pinnedPolicyByWorkspace.get(edge.from)
-        : sourceSetByLabel.get(edge.policy);
+        : dynamicPolicyByLabel.get(edge.policy);
       if (source === undefined) {
         fail(
           `intent '${declaration.id}' foreign read '${edge.queryId}' targets undeclared ` +
             `${"from" in edge ? `source '${edge.from}'` : `policy '${edge.policy}'`}`,
         );
       }
+      if (
+        source.policyKind === "authorized-custody-source" &&
+        declaration.requiresRelationGate?.subjectFromAttestedRead !== edge.queryId
+      ) {
+        const subjectQuery = declaration.requiresRelationGate?.subjectFromAttestedRead;
+        const subjectEdge = declaration.declaredForeignReads?.find((candidate) =>
+          candidate.queryId === subjectQuery
+          && "policy" in candidate
+          && "policy" in edge
+          && candidate.policy === edge.policy
+          && "fromPayload" in candidate
+          && "fromPayload" in edge
+          && candidate.fromPayload === edge.fromPayload
+        );
+        if (subjectEdge === undefined) {
+          fail(
+            `intent '${declaration.id}' authorized custody read '${edge.queryId}' must derive its ` +
+              `Zanzibar subject from an attested read bound to the same source`,
+          );
+        }
+      }
       const fromField = "fromPayload" in edge
         ? payloadFieldsByIntent.get(declaration.id)?.get(edge.fromPayload)
         : undefined;
@@ -1912,6 +2106,10 @@ export function discoverLawGraph(
   });
   registry = reconciled.registry;
   const invariantNodes: LawInvariantNode[] = invariants.map((invariant) => {
+    const refusalType = invariant.refusal === undefined ? undefined : typeEntitiesByLabel.get(invariant.refusal.name);
+    if (invariant.refusal !== undefined && refusalType === undefined) {
+      fail(`invariant '${invariant.id}' refusal targets unknown nominal type '${invariant.refusal.name}'`);
+    }
     const point = invariant.__nomosPointGuard;
     const pointAggregate = point === undefined ? undefined : aggregateByLabel.get(point.aggregateId)?.node;
     if (point !== undefined && pointAggregate === undefined) {
@@ -1940,6 +2138,7 @@ export function discoverLawGraph(
       ),
       domain: domainRef,
       invariantKind: "workspace",
+      ...(refusalType === undefined ? {} : { refusalType: ref(refusalType) }),
       on: intentRef(intentByLabel, invariant.on, `invariant '${invariant.id}'`),
       ...(nativeReads === undefined ? {} : { reads: nativeReads }),
       ...(invariant.__nomosEvaluator === undefined
@@ -1978,6 +2177,22 @@ export function discoverLawGraph(
     });
   }
 
+  // Derive the output family closure from rules and composed steps. A tenant
+  // cannot omit a reachable refusal by supplying a handwritten command list.
+  const refusalTypesFor = (id: string, active = new Set<string>()): LawRef<"type">[] => {
+    if (active.has(id)) fail(`cyclic refusal contract composition at '${id}'`);
+    const next = new Set(active).add(id);
+    const direct = invariantNodes.flatMap((rule) => rule.invariantKind === "workspace"
+      && rule.on.id === id && rule.refusalType !== undefined ? [rule.refusalType] : []);
+    const steps = intentNodes.find(node => node.entity.id === id)?.steps ?? [];
+    return [...new Map([...direct, ...steps.flatMap(step => refusalTypesFor(step.id, next))]
+      .map(type => [type.id, type])).values()].sort((a, b) => compareText(a.id, b.id));
+  };
+  for (const [index, node] of intentNodes.entries()) {
+    const domainRefusals = refusalTypesFor(node.entity.id);
+    if (domainRefusals.length > 0) intentNodes[index] = { ...node, domainRefusals };
+  }
+
   const capabilities = [...(module.impureCapabilities ?? [])].sort((a, b) =>
     compareText(a.aggregate.id, b.aggregate.id),
   );
@@ -1992,7 +2207,12 @@ export function discoverLawGraph(
       readonly name?: unknown;
       readonly capability?: unknown;
       readonly endpoint?: unknown;
+      readonly execution?: unknown;
     };
+    const execution = metadata.execution as {
+      readonly placement?: unknown;
+      readonly cardinality?: unknown;
+    } | undefined;
     return {
       kind: "capability",
       entity: entity(
@@ -2014,6 +2234,12 @@ export function discoverLawGraph(
           ? metadata.capability
           : capability.aggregate.id,
       ...(typeof metadata.endpoint === "string" ? { endpoint: metadata.endpoint } : {}),
+      ...(execution?.placement === "custodian"
+        ? { executionPlacement: execution.placement }
+        : {}),
+      ...(execution?.cardinality === "singleton"
+        ? { executionCardinality: execution.cardinality }
+        : {}),
     };
   });
 
@@ -2207,6 +2433,9 @@ export function discoverLawGraph(
       of: readAggregate,
       contract: ref(readContractEntity),
       public: read.public,
+      ...(read.authentication === undefined
+        ? {}
+        : { authentication: read.authentication }),
       ...(predicate === undefined ? {} : { predicate }),
     };
     switch (read.readKind) {
@@ -2238,6 +2467,8 @@ export function discoverLawGraph(
           filtered: read.filtered,
         };
       case "ordered":
+        if (!Number.isInteger(read.limit) || read.limit < 1 || read.limit > 0xffff_ffff)
+          throw new Error(`ordered read '${read.id}' needs an integer limit from 1 through 4294967295`);
         return {
           ...base,
           readKind: "ordered",
@@ -2353,13 +2584,23 @@ export function discoverLawGraph(
     parent: string,
     label: string,
     status?: "active" | "retired",
-  ) => {
+    allowAbsent = false,
+  ): [string, LawIdentityEntity] | undefined => {
     const matches = Object.entries(registry.entities).filter(([, candidate]) =>
       candidate.kind === kind &&
       candidate.parent === parent &&
       (status === undefined || candidate.status === status) &&
       (candidate.label === label || candidate.priorLabels?.includes(label) === true)
     );
+    if (allowAbsent && matches.length === 0) return undefined;
+    // Resolve the latest unambiguous declaration when a label has been reused.
+    // Field tombstones below additionally retain its older retired generations
+    // so one candidate can migrate frontiers from before that reuse.
+    if (matches.length > 1) {
+      const latest = Math.max(...matches.map(([, candidate]) => candidate.generation));
+      const latestMatches = matches.filter(([, candidate]) => candidate.generation === latest);
+      if (latestMatches.length === 1) return latestMatches[0]!;
+    }
     if (matches.length !== 1) {
       fail(
         `${kind} retirement '${label}' resolves to ${matches.length} prior identities under '${parent}'; ` +
@@ -2368,42 +2609,61 @@ export function discoverLawGraph(
     }
     return matches[0]!;
   };
-  const retirements = (module.retirements ?? []).map((declaration): LawRetirement => {
-    const retirementParent = (module.aggregates ?? []).some(
+  const retirements = (module.retirements ?? []).flatMap((declaration): LawRetirement[] => {
+    const frameworkRetirement = (module.aggregates ?? []).some(
       (aggregate) => aggregate.id === declaration.aggregate && aggregate.framework === true,
-    )
-      ? LAW_FRAMEWORK_PARENT
-      : domainKey;
-    const [aggregateKey, aggregate] = identityEntity(
+    );
+    const retirementParent = frameworkRetirement ? LAW_FRAMEWORK_PARENT : domainKey;
+    const aggregateIdentity = identityEntity(
       "aggregate",
       retirementParent,
       declaration.aggregate,
       declaration.kind === "aggregate" ? "retired" : undefined,
+      frameworkRetirement,
     );
+    // Framework evolution is composed into both established and greenfield
+    // domains. A tombstone exists only when this identity layer actually has
+    // the historical declaration; greenfield law never invents a past. Tenant
+    // retirements remain strict so a typo cannot silently erase intent.
+    if (aggregateIdentity === undefined) return [];
+    const [aggregateKey, aggregate] = aggregateIdentity;
     if (declaration.kind === "aggregate") {
-      return {
+      return [{
         kind: "aggregate",
         sid: aggregate.sid,
         label: aggregate.label,
-      };
+      }];
     }
-    const [, field] = identityEntity(
+    const fieldIdentity = identityEntity(
       "field",
       aggregateKey,
       declaration.field ?? "",
       "retired",
+      frameworkRetirement,
     );
-    return {
+    if (fieldIdentity === undefined) return [];
+    // A candidate may replace any older frontier, not just the last compiler
+    // generation. Keep every known tombstone for this explicitly retired
+    // field; otherwise an older installed SID has no retirement authority.
+    const retiredFields = Object.values(registry.entities).filter((field) =>
+      field.kind === "field" && field.parent === aggregateKey && field.status === "retired" &&
+      (field.label === declaration.field || field.priorLabels?.includes(declaration.field ?? "") === true)
+    );
+    return retiredFields.map((field) => ({
       kind: "field",
       sid: field.sid,
       label: field.label,
       parentSid: aggregate.sid,
-    };
+    }));
   }).sort((left, right) => compareText(`${left.kind}:${left.sid}`, `${right.kind}:${right.sid}`));
   return { registry, graph: { v: 1, domain: domainNode, retirements, nodes } };
 }
 
-type ReadInputBase = { id: string; public: boolean };
+type ReadInputBase = {
+  id: string;
+  public: boolean;
+  authentication?: MemberAuthentication;
+};
 type ReadInput =
   | (ReadInputBase & { readKind: "query"; of: string; key: readonly string[] })
   | (ReadInputBase & { readKind: "count" | "exists"; of: string; by?: string; where?: CanonicalPred; filtered: boolean })
@@ -2442,34 +2702,41 @@ function readInputs(module: DomainModule): ReadInput[] {
   const isPublic = (value: unknown): boolean =>
     !(value && typeof value === "object" &&
       (value as { businessBirthInternal?: unknown }).businessBirthInternal === true);
+  const authenticationOf = (value: unknown): MemberAuthentication | undefined =>
+    (value as { authentication?: MemberAuthentication }).authentication;
+  const member = (value: unknown) => {
+    const authentication = authenticationOf(value);
+    return authentication === undefined ? {} : { authentication };
+  };
   const reads: ReadInput[] = [
-    ...(module.queries ?? []).map((read) => ({ id: read.id, public: isPublic(read), readKind: "query" as const, of: read.returns, key: read.key })),
+    ...(module.queries ?? []).map((read) => ({ id: read.id, public: isPublic(read), ...member(read), readKind: "query" as const, of: read.returns, key: read.key })),
     ...(module.counts ?? []).map((value) => {
       const read = finishCount(value);
-      return { id: read.id, public: isPublic(value), readKind: "count" as const, of: read.of, ...(read.by === undefined ? {} : { by: read.by }), ...(read.where === undefined ? {} : { where: read.where }), filtered: read.where !== undefined };
+      return { id: read.id, public: isPublic(value), ...member(value), readKind: "count" as const, of: read.of, ...(read.by === undefined ? {} : { by: read.by }), ...(read.where === undefined ? {} : { where: read.where }), filtered: read.where !== undefined };
     }),
     ...(module.exists_ ?? []).map((value) => {
       const read = finishExists(value);
-      return { id: read.id, public: isPublic(value), readKind: "exists" as const, of: read.of, ...(read.by === undefined ? {} : { by: read.by }), ...(read.where === undefined ? {} : { where: read.where }), filtered: read.where !== undefined };
+      return { id: read.id, public: isPublic(value), ...member(value), readKind: "exists" as const, of: read.of, ...(read.by === undefined ? {} : { by: read.by }), ...(read.where === undefined ? {} : { where: read.where }), filtered: read.where !== undefined };
     }),
     ...(module.sums ?? []).map((value) => {
       const read = finishSum(value);
-      return { id: read.id, public: isPublic(value), readKind: "sum" as const, of: read.of, value: read.sumField, ...(read.by === undefined ? {} : { by: read.by }), ...(read.where === undefined ? {} : { where: read.where }), filtered: read.where !== undefined };
+      return { id: read.id, public: isPublic(value), ...member(value), readKind: "sum" as const, of: read.of, value: read.sumField, ...(read.by === undefined ? {} : { by: read.by }), ...(read.where === undefined ? {} : { where: read.where }), filtered: read.where !== undefined };
     }),
     ...(module.mins ?? []).map((value) => {
       const read = finishExtremum(value);
-      return { id: read.id, public: isPublic(value), readKind: "min" as const, of: read.of, value: read.valueField, ...(read.by === undefined ? {} : { by: read.by }), ...(read.where === undefined ? {} : { where: read.where }), filtered: read.where !== undefined };
+      return { id: read.id, public: isPublic(value), ...member(value), readKind: "min" as const, of: read.of, value: read.valueField, ...(read.by === undefined ? {} : { by: read.by }), ...(read.where === undefined ? {} : { where: read.where }), filtered: read.where !== undefined };
     }),
     ...(module.maxes ?? []).map((value) => {
       const read = finishExtremum(value);
-      return { id: read.id, public: isPublic(value), readKind: "max" as const, of: read.of, value: read.valueField, ...(read.by === undefined ? {} : { by: read.by }), ...(read.where === undefined ? {} : { where: read.where }), filtered: read.where !== undefined };
+      return { id: read.id, public: isPublic(value), ...member(value), readKind: "max" as const, of: read.of, value: read.valueField, ...(read.by === undefined ? {} : { by: read.by }), ...(read.where === undefined ? {} : { where: read.where }), filtered: read.where !== undefined };
     }),
-    ...(module.orderedReads ?? []).map((read) => ({ id: read.id, public: isPublic(read), readKind: "ordered" as const, of: read.of, orderBy: read.orderKey, descending: read.orderDesc, limit: read.limit, ...(read.where === undefined ? {} : { where: read.where }), filtered: read.where !== undefined })),
-    ...(module.spatials ?? []).map((read) => ({ id: read.id, public: isPublic(read), readKind: "spatial" as const, of: read.of, geometry: read.on })),
+    ...(module.orderedReads ?? []).map((read) => ({ id: read.id, public: isPublic(read), ...member(read), readKind: "ordered" as const, of: read.of, orderBy: read.orderKey, descending: read.orderDesc, limit: read.limit, ...(read.where === undefined ? {} : { where: read.where }), filtered: read.where !== undefined })),
+    ...(module.spatials ?? []).map((read) => ({ id: read.id, public: isPublic(read), ...member(read), readKind: "spatial" as const, of: read.of, geometry: read.on })),
     ...(module.deriveds ?? []).map((read) => "kind" in read && read.kind === "temporalEnum"
       ? {
           id: read.id,
           public: isPublic(read),
+          ...member(read),
           readKind: "temporalEnum" as const,
           of: read.of,
           sourceField: read.sourceField,
@@ -2478,8 +2745,8 @@ function readInputs(module: DomainModule): ReadInput[] {
           transitions: read.transitions,
           returns: read.returns,
         }
-      : { id: read.id, public: isPublic(read), readKind: "derived" as const, of: read.of, returns: read.returns }),
-    ...(module.combineds ?? []).map((read) => ({ id: read.id, public: isPublic(read), readKind: "combined" as const, of: read.of, via: read.refField, reads: read.reads, returns: read.returns })),
+      : { id: read.id, public: isPublic(read), ...member(read), readKind: "derived" as const, of: read.of, returns: read.returns }),
+    ...(module.combineds ?? []).map((read) => ({ id: read.id, public: isPublic(read), ...member(read), readKind: "combined" as const, of: read.of, via: read.refField, reads: read.reads, returns: read.returns })),
   ];
   return reads.sort((a, b) => compareText(a.id, b.id));
 }
@@ -2556,7 +2823,20 @@ function readResult(read: ReadInput, aggregate: LawRef<"aggregate">): RawLawRead
 
 function storedFieldValue(field: Field): LawValueType {
   if (field.kind === "json") return { kind: "unknown" };
-  if (field.kind === "ref" || field.kind === "position") {
+  if (field.kind === "ref") {
+    // A same-workspace or sibling-workspace reference is stored as its stable
+    // id string. Atomic and versioned Nomos references are different lawful
+    // values: their workspace/type/id address (or pinned/series pair) is one
+    // indivisible value and must remain structured in the law graph. Lowering
+    // every ref to string made the generated transport disagree with the
+    // generated public type and deferred that contradiction until tenant
+    // application compilation.
+    if (field.nomosRef !== undefined || field.versionedForeignRef !== undefined) {
+      return lowerLawValueType(field.zod);
+    }
+    return { kind: "string", constraints: [] };
+  }
+  if (field.kind === "position") {
     return { kind: "string", constraints: [] };
   }
   if (field.kind === "counter") return { kind: "integer", constraints: [] };
@@ -2638,30 +2918,167 @@ function linkStoredField(
   };
 }
 
-function descriptorValue(field: ValueObjectFieldDescriptor): LawValueType {
-  switch (field.type) {
-    case "string":
-      return { kind: "string", constraints: [] };
+function descriptorTypeValue(
+  descriptor: ValueObjectDescriptor,
+  byName: ReadonlyMap<string, ValueObjectDescriptor>,
+  active: ReadonlySet<string>,
+): LawValueType {
+  if (active.has(descriptor.name)) {
+    fail(`value object '${descriptor.name}' recursively contains itself without a declared recursive type`);
+  }
+  const next = new Set(active).add(descriptor.name);
+  const semantic: LawValueSemantic = {
+    kind: "value-object", name: descriptor.name,
+    ...(descriptor.geometry === undefined ? {} : { geometry: descriptor.geometry }),
+  };
+  if (descriptor.geometry !== undefined) {
+    const scalar: LawValueType = { kind: "number", constraints: [] };
+    const position: LawValueType = { kind: "list", element: scalar };
+    const coordinates: LawValueType = descriptor.geometry === "Point"
+      ? position
+      : descriptor.geometry === "Polygon"
+        ? { kind: "list", element: { kind: "list", element: position } }
+        : { kind: "list", element: position };
+    return {
+      kind: "record",
+      semantic,
+      fields: [
+        {
+          name: "type",
+          required: true,
+          value: { kind: "literal", value: descriptor.geometry },
+        },
+        { name: "coordinates", required: true, value: coordinates },
+      ],
+    };
+  }
+  if (descriptor.union !== undefined) {
+    return {
+      kind: "sum",
+      semantic,
+      options: Object.entries(descriptor.union)
+        .sort(([a], [b]) => compareText(a, b))
+        .map(([discriminator, arm]) => {
+          const fields: LawValueMember[] = [{
+            name: "type",
+            required: true,
+            value: { kind: "literal", value: discriminator },
+          }];
+          if ("ref" in arm) {
+            const target = byName.get(arm.ref);
+            if (target === undefined) {
+              fail(`value object '${descriptor.name}' references unknown type '${arm.ref}'`);
+            }
+            // Named union arms are deliberately nested under `value`; this is
+            // the authored value-object wire shape, not a flattened record.
+            fields.push({
+              name: "value",
+              required: true,
+              value: descriptorTypeValue(target, byName, next),
+            });
+          } else {
+            fields.push(...Object.entries(arm.fields)
+              .sort(([a], [b]) => compareText(a, b))
+              .map(([name, field]) => ({
+                name,
+                required: field.optional !== true,
+                value: descriptorValue(
+                  field,
+                  byName,
+                  next,
+                  `${descriptor.name}${discriminator[0]!.toUpperCase()}${discriminator.slice(1)}`,
+                  name,
+                ),
+              })));
+          }
+          return {
+            kind: "record" as const,
+            fields,
+          };
+        }),
+    };
+  }
+  return {
+    kind: "record",
+    semantic,
+    fields: Object.entries(descriptor.fields ?? {})
+      .sort(([a], [b]) => compareText(a, b))
+      .map(([name, field]) => ({
+        name,
+        required: field.optional !== true,
+        value: descriptorValue(field, byName, next, descriptor.name, name),
+      })),
+  };
+}
+
+function descriptorValue(
+  field: ValueObjectFieldDescriptor,
+  byName: ReadonlyMap<string, ValueObjectDescriptor>,
+  active: ReadonlySet<string> = new Set(),
+  ownerName?: string,
+  fieldName?: string,
+): LawValueType {
+  const value: LawValueType = (() => {
+    switch (field.type) {
+    case "string": {
+      const semantic: LawValueSemantic | undefined = field.digest === "sha256"
+        ? { kind: "sha256-digest" }
+        : field.idOf !== undefined
+            ? {
+                kind: "id-reference",
+                target: field.idOf,
+                targetKind: field.idOfContract === true ? "contract" : "aggregate",
+              }
+          : field.brand !== undefined
+            ? { kind: "branded-id", name: field.brand }
+            : undefined;
+      return {
+        kind: "string",
+        constraints: [],
+        ...(semantic === undefined ? {} : { semantic }),
+      };
+    }
     case "number":
-      return { kind: field.int === true ? "integer" : "number", constraints: [] };
+      return {
+        kind: field.int === true ? "integer" : "number",
+        constraints: [],
+        ...(field.unit === undefined
+          ? {}
+          : { semantic: { kind: "unit", name: field.unit } as const }),
+      };
     case "boolean":
       return { kind: "boolean" };
     case "enum":
       return {
         kind: "enum",
         values: [...field.values].sort(compareText),
-        ...(field.name === undefined ? {} : { name: field.name }),
+        ...(field.name !== undefined
+          ? { name: field.name }
+          : ownerName !== undefined && fieldName !== undefined
+            ? { name: `${ownerName}${fieldName[0]!.toUpperCase()}${fieldName.slice(1)}` }
+            : {}),
       };
     case "literal":
       return { kind: "literal", value: field.value };
     case "array":
-      return { kind: "list", element: descriptorValue(field.items) };
+      return {
+        kind: "list",
+        element: descriptorValue(field.items, byName, active, ownerName, fieldName),
+      };
     case "map":
-      return { kind: "map", value: descriptorValue(field.values) };
+      return {
+        kind: "map",
+        value: descriptorValue(field.values, byName, active, ownerName, fieldName),
+      };
     case "object":
-    case "geometry":
-      return { kind: "unknown" };
-  }
+    case "geometry": {
+      const target = byName.get(field.ref);
+      if (target === undefined) fail(`value object field references unknown type '${field.ref}'`);
+      return descriptorTypeValue(target, byName, active);
+    }
+    }
+  })();
+  return field.nullable === true ? { kind: "nullable", value } : value;
 }
 
 function mergeDrivers(driver: Driver): LawMergeDriver[] {
@@ -2823,12 +3240,22 @@ export function lowerAnonymousValueGraph<K extends LawEntityKind>(
       }
       case "sum": {
         const variants = value.options.map((option) => {
+          const discriminator = option.kind === "record"
+            ? option.fields.find((field) =>
+                field.name === "type" &&
+                field.required &&
+                field.value.kind === "literal" &&
+                typeof field.value.value === "string")?.value
+            : undefined;
+          const label = discriminator?.kind === "literal" && typeof discriminator.value === "string"
+            ? discriminator.value
+            : undefined;
           const child = lower(option);
           const variantEntity = structuralEntity(
             owner,
             "value-variant",
-            { parent: entity.id, value: child.id },
-            `${owner.label}#${child.id}`,
+            { parent: entity.id, ...(label === undefined ? {} : { label }), value: child.id },
+            `${owner.label}#${label ?? child.id}`,
           );
           if (!nodes.has(variantEntity.id)) {
             nodes.set(variantEntity.id, {
@@ -2836,6 +3263,7 @@ export function lowerAnonymousValueGraph<K extends LawEntityKind>(
               structuralKind: "value-variant",
               entity: variantEntity,
               owner: structuralRef(entity),
+              ...(label === undefined ? {} : { label }),
               value: child,
             });
           }
@@ -2866,6 +3294,10 @@ export function lowerAnonymousValueGraph<K extends LawEntityKind>(
 export function lowerAnonymousContractFields(
   source: LawValueType,
   owner: LawEntity<"contract">,
+  wireForField: (
+    name: string,
+    structuralSid: string,
+  ) => LawOperationFieldWire["protobuf"] = (_name, structuralSid) => ({ canonical: structuralSid }),
 ): { readonly fields: readonly LawStructuralRef<"value-field">[]; readonly nodes: readonly LawAnonymousValueNode[] } {
   const value = canonicalValueType(source);
   if (value.kind !== "record") {
@@ -2881,10 +3313,15 @@ export function lowerAnonymousContractFields(
       { name: member.name, required: member.required, value: lowered.root.id },
       `${owner.label}#${member.name}`,
     );
+    const wire = wireForField(member.name, entity.sid);
     nodes.set(entity.id, {
       kind: "structural",
       structuralKind: "value-field",
-      entity,
+      entity: {
+        ...entity,
+        wireKey: wire.canonical,
+        ...(wire.aliases === undefined ? {} : { wireAliases: wire.aliases }),
+      },
       owner: ref(owner),
       name: member.name,
       required: member.required,