@githolon/dsl 0.108.7 → 0.110.1

package/src/build_package.ts

@@ -35,12 +35,15 @@ import type { QueryDecl } from "./query.js";
 import type { SpatialDecl } from "./spatial.js";
 import type { AnySum } from "./sum.js";
 import type { AnyExtremum } from "./extremum.js";
+import type { AnyExists } from "./exists.js";
+import type { OrderedReadDecl } from "./ordered_read.js";
 import type { AnyDerivedDecl, DerivedDecl, TemporalEnumDecl } from "./derived.js";
 import type { CombinedDecl } from "./combined.js";
 import type { ImpureCapabilityDecl } from "./codegen_provider_dart.js";
 import type { WorkspaceTypeDecl } from "./workspace_type.js";
 import type { WorkspaceInvariantDecl } from "./framework/workspace_invariant.js";
 import { withWorkspaceSharingInvitationExports } from "./workspace_sharing.js";
+import { indexedVariantsOf } from "./indexed_variant.js";
 import {
   applicationLanguageOf,
   assertApplicationLanguageCoversAuthoredDirectives,
@@ -69,11 +72,32 @@ import {
   mergeRelationTypeDeclarations,
   type RelationTypeDecl,
 } from "./relation_schema.js";
-import { collectValueObjectDescriptors } from "./value_object.js";
+import {
+  collectPayloadValueObjectDescriptors,
+  collectValueObjectDescriptors,
+} from "./value_object.js";
 import { expandCapabilityExports, isCapabilityDecl } from "./capability_exports.js";
 import { RelationTuple, relationTuplesByObject } from "./framework/relations.js";
-import { signerDelegationByUser } from "./framework/signing_identity.js";
-import { AuthProvider, setAuthProvider, authProvider } from "./framework/workspaces.js";
+import {
+  SignerDelegation,
+  signerDelegationByUser,
+  signerDelegationCertJsonRetired,
+} from "./framework/signing_identity.js";
+import {
+  AUTH_PROVIDER_AUTHORITY,
+  AuthProvider,
+  AuthProviderCertificate,
+  AuthProviderKey,
+  adoptIdentityProviderWitness,
+  authProvider,
+  authProviderCertificates,
+  authProviderKeys,
+  authProviderSourceRelations,
+  identityProviderSourceTrust,
+  seedAuthProvider,
+  setAuthProvider,
+} from "./framework/workspaces.js";
+import { nomosSourceFrontierEnsure } from "./attested.js";
 import { parentAttestedBirthMarker } from "./births.js";
 import { discoverUnsanctionedEnsures, sanctioningEnsureDirective } from "./secondary_ensure.js";
 import { probeEnsuredTypes, probePlanOps } from "./codegen_proof.js";
@@ -178,6 +202,8 @@ export interface DomainModuleSpec {
   /** Maintained MIN/MAX reads (#47 — the extremum RPC's manifest half). Config-named like sums. */
   readonly mins?: readonly AnyExtremum[];
   readonly maxes?: readonly AnyExtremum[];
+  readonly exists_?: readonly AnyExists[];
+  readonly orderedReads?: readonly OrderedReadDecl[];
   readonly spatials?: readonly SpatialDecl[];
   /** First-class workspace types (sharding §10 slice 1) — the law-declared taxonomy. */
   readonly workspaceTypes?: readonly WorkspaceTypeDecl[];
@@ -205,6 +231,7 @@ export interface DomainModuleSpec {
  */
 export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   const domain = spec.domain ?? spec.name;
+  const indexedVariants = indexedVariantsOf(spec.modules);
   const conflictPolicies = conflictPoliciesOf(spec.modules, domain);
   const fieldEvolutions = fieldEvolutionsOf(spec.modules);
   const retirements = retirementsOf(spec.modules, domain);
@@ -264,9 +291,19 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   const discoveredDirectives = directivesOf(merged);
   // A directive builder already possessed the typed aggregate handle. Retain that compiler link so
   // re-exporting a lawful directive is self-contained: its local target schema joins the domain without
-  // a second magic re-export. A cross-workspace birth remains a dependency edge, not a copied child schema.
+  // a second magic re-export. A pure workspace-effect intent keeps the handle for runtime dispatch but
+  // has no local aggregate consequence, so its destination schema remains a dependency instead of being
+  // copied into the source domain's generated types. A cross-workspace birth follows the same boundary.
   for (const directive of discoveredDirectives) {
-    if (directive.birthsChild !== true && directive.aggregate !== undefined) {
+    const pureWorkspaceEffect =
+      (directive as { steps?: readonly unknown[] }).steps?.length === 0 &&
+      ((directive as { workspaceEffects?: readonly unknown[] }).workspaceEffects
+        ?.length ?? 0) > 0;
+    if (
+      directive.birthsChild !== true &&
+      !pureWorkspaceEffect &&
+      directive.aggregate !== undefined
+    ) {
       const prior = byId.get(directive.aggregate.id);
       byId.set(
         directive.aggregate.id,
@@ -468,6 +505,17 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
         ? { ...setAuthProvider, businessBirthInternal: true } as Directive<any>
         : setAuthProvider);
     }
+    if (!directives.some((d) => d.id === adoptIdentityProviderWitness.id)) {
+      directives.push(declaresOwnedRead
+        ? { ...adoptIdentityProviderWitness, businessBirthInternal: true } as Directive<any>
+        : adoptIdentityProviderWitness);
+    }
+    for (const aggregate of [AuthProviderKey, AuthProviderCertificate, NomosSourceFrontier]) {
+      if (!byId.has(aggregate.id)) byId.set(aggregate.id, aggregate);
+    }
+    if (!directives.some((d) => d.id === nomosSourceFrontierEnsure.id)) {
+      directives.push(nomosSourceFrontierEnsure);
+    }
   }
   const usesRelations =
     declaresPrivateRead ||
@@ -491,11 +539,10 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
     for (const a of BIRTH_METER_AGGREGATES) {
       if (!byId.has(a.id)) byId.set(a.id, a);
     }
-    // AUTHPROVIDER INHERITANCE (birthHome's default-on parent read — the same courtesy): a birth-capable
-    // law serves the `authProvider` captured read (parent side) AND can fold the inherited
-    // `setAuthProvider` genesis step (child side; the one-package fixture shape is both at once). Without
-    // this carry, default-on inheritance would refuse on every law that never hand-exported the trio.
+    // Birth captures and seeds the current verifier once; later provider epochs use the ordinary
+    // authority-gated adoption directive above.
     if (!byId.has(AuthProvider.id)) byId.set(AuthProvider.id, AuthProvider);
+    if (!directives.some((d) => d.id === seedAuthProvider.id)) directives.push(seedAuthProvider);
     if (!directives.some((d) => d.id === setAuthProvider.id)) directives.push(setAuthProvider);
   }
   // SECONDARY-CREATE AUTO-DECLARE (secondary_ensure.ts — the id-mint-gate DX): a plan may `ensure(B, "det:id")`
@@ -528,6 +575,22 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
     directives.push(dir);
     autoDeclaredEnsures.push(ty);
   }
+  // Framework-owned schema evolution travels with the framework aggregate.
+  // Applications compose SignerDelegation into several domains; requiring each
+  // tenant evolution folder to repeat the same tombstone would make framework
+  // correctness application-maintained. Inject it only where the exact
+  // framework aggregate is present, and only when the tenant has not already
+  // declared the same retirement.
+  if (
+    byId.has(SignerDelegation.id) &&
+    !retirements.some((candidate) =>
+      candidate.kind === signerDelegationCertJsonRetired.kind &&
+      candidate.aggregate === signerDelegationCertJsonRetired.aggregate &&
+      candidate.field === signerDelegationCertJsonRetired.field
+    )
+  ) {
+    retirements.push(signerDelegationCertJsonRetired);
+  }
   const aggregates = applyFieldEvolutionsToAggregates(
     applyConflictPoliciesToAggregates(
       [...byId.values()],
@@ -610,6 +673,8 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
     }
   }
   const counts = [...(spec.counts ?? [])];
+  const exists_ = [...(spec.exists_ ?? [])];
+  const orderedReads = [...(spec.orderedReads ?? [])];
   const spatials = [...(spec.spatials ?? [])];
   const temporalEnums: TemporalEnumDecl[] = aggregates.flatMap((aggregate) =>
     Object.entries(aggregate.fields).flatMap(([sourceField, field]) =>
@@ -712,7 +777,7 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
         queries.push({ ...q, businessBirthInternal: true } as QueryDecl);
       }
     }
-    // The inheritance read (`.reads("authProvider")` on birthHome) routes like any declared query.
+    // The inheritance read (`.reads("authProvider")` on birth) routes like any declared query.
     if (!haveQuery.has(authProvider.id)) queries.push(authProvider);
     // The client's private birth ceremony checks the actor's delegation before creating it. Carry the
     // structural read in certified routing law for every `.births()` domain, but keep it off tenant codegen.
@@ -724,9 +789,33 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
       queries.push(internalDelegationQuery);
     }
   }
-  const relationTypes = mergeRelationTypeDeclarations([
+  const authoredRelationTypes = [
     ...exportedRelationTypes,
     ...(spec.relationTypes ?? []),
+  ];
+  const authoredProviderAuthority = authoredRelationTypes.find(
+    (declaration) =>
+      declaration.global === true &&
+      declaration.type === authProviderSourceRelations.type &&
+      declaration.relations.has(AUTH_PROVIDER_AUTHORITY),
+  );
+  const frameworkProviderAuthority = authProviderSourceRelations.relations.get(
+    AUTH_PROVIDER_AUTHORITY,
+  );
+  const carriesExactProviderAuthority =
+    authoredProviderAuthority !== undefined &&
+    frameworkProviderAuthority !== undefined &&
+    JSON.stringify(authoredProviderAuthority.relations.get(AUTH_PROVIDER_AUTHORITY)) ===
+      JSON.stringify(frameworkProviderAuthority);
+  const relationTypes = mergeRelationTypeDeclarations([
+    ...authoredRelationTypes,
+    // This relation belongs to the exact provider-adoption member. Supply the
+    // framework declaration only when tenant law has not already declared the
+    // same authority; a divergent declaration is deliberately composed below
+    // so the duplicate-relation guard refuses it loudly.
+    ...(declaresPrivateRead && !carriesExactProviderAuthority
+      ? [authProviderSourceRelations]
+      : []),
   ]);
   // RELATION-USING LAW AUTO-COMPOSES ITS AUDIT READ (co2 recovery DX — same idiom as the meter
   // queries above): a domain that declares relation law (a relation schema, a `.requires(...)` gated
@@ -746,8 +835,17 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
       ? { ...authProvider, businessBirthInternal: true } as QueryDecl
       : authProvider);
   }
+  if (declaresPrivateRead) {
+    for (const providerQuery of [authProviderKeys, authProviderCertificates]) {
+      if (!queries.some((candidate) => candidate.id === providerQuery.id)) {
+        queries.push(declaresOwnedRead
+          ? { ...providerQuery, businessBirthInternal: true } as QueryDecl
+          : providerQuery);
+      }
+    }
+  }
   if (usesRelations && !queries.some((q) => q.id === relationTuplesByObject.id)) {
-    queries.push(declaresOwnedRead
+    queries.push(declaresOwnedRead || (byId.get(RelationTuple.id) as { businessBirthInternal?: boolean } | undefined)?.businessBirthInternal === true
       ? { ...relationTuplesByObject, businessBirthInternal: true } as QueryDecl
       : relationTuplesByObject);
   }
@@ -761,7 +859,30 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   // contracts. A contract may be the only local owner of a named value object (especially a
   // cross-domain publication DTO); collecting aggregates alone left a dangling type reference in
   // the canonical law graph. Transitive nested VOs remain included by the descriptor collector.
-  const valueObjects = collectValueObjectDescriptors([...aggregates, ...contracts]);
+  const valueObjectByName = new Map(
+    collectValueObjectDescriptors([...aggregates, ...contracts])
+      .map((descriptor) => [descriptor.name, descriptor] as const),
+  );
+  for (const descriptor of collectPayloadValueObjectDescriptors(directives)) {
+    // Payload contracts are law contracts too. A value object used only by an
+    // offer must therefore inhabit the same nominal law type graph as one used
+    // by stored state; generated clients must not own a parallel type registry.
+    if (!valueObjectByName.has(descriptor.name)) {
+      valueObjectByName.set(descriptor.name, descriptor);
+    }
+  }
+  for (const invariant of workspaceInvariants) {
+    if (!invariant.refusal) continue;
+    for (const descriptor of [invariant.refusal.descriptor, ...invariant.refusal.dependencies]) {
+      const prior = valueObjectByName.get(descriptor.name);
+      if (prior && JSON.stringify(prior) !== JSON.stringify(descriptor)) {
+        throw new Error(`invariant '${invariant.id}' conflicts with nominal type '${descriptor.name}'`);
+      }
+      valueObjectByName.set(descriptor.name, descriptor);
+    }
+  }
+  const valueObjects = [...valueObjectByName.values()]
+    .sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
   // SPATIAL × VO PAIRING (fail at build, not at fold): a spatial index over a VO-typed field
   // must index a GEO value object (an RFC 7946 geometry — the R*Tree's bbox source). A
   // structural VO (e.g. a PostalAddress) has no geometry to index. Non-VO fields (a
@@ -848,6 +969,9 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   for (const v of Object.values(merged)) {
     if (isTrustPolicyDecl(v)) policyById.set(v.policyId, v);
   }
+  if (declaresPrivateRead) {
+    policyById.set(identityProviderSourceTrust.policyId, identityProviderSourceTrust);
+  }
   const trustPolicies = [...policyById.values()].sort((a, b) =>
     a.policyId < b.policyId ? -1 : a.policyId > b.policyId ? 1 : 0,
   );
@@ -921,6 +1045,8 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
     ...(retirements.length > 0 ? { retirements } : {}),
     ...(queries.length > 0 ? { queries } : {}),
     ...(counts.length > 0 ? { counts } : {}),
+    ...(exists_.length > 0 ? { exists_ } : {}),
+    ...(orderedReads.length > 0 ? { orderedReads } : {}),
     ...(spatials.length > 0 ? { spatials } : {}),
     ...(deriveds.length > 0 ? { deriveds } : {}),
     ...(combineds.length > 0 ? { combineds } : {}),
@@ -942,6 +1068,7 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
     // Omit-when-empty — the `nomosValueObjects` era rule: a VO-free domain's USD/package
     // bytes are byte-identical to before value objects existed.
     ...(valueObjects.length > 0 ? { valueObjects } : {}),
+    ...(indexedVariants.length > 0 ? { indexedVariants } : {}),
     // Omit-when-empty — the `nomosContracts` era rule: a contract-free domain's USD/package bytes
     // are byte-identical to before domain contracts existed (pure additive typing metadata).
     ...(contracts.length > 0 ? { contracts } : {}),

package/src/business_birth.ts

@@ -20,6 +20,7 @@ import {
 } from "./births.js";
 import type { Field } from "./fields.js";
 import {
+  AUTH_PROVIDER_EPOCH_CONSUMER,
   AuthProvider,
   authProvider,
   authProviderCertificates,
@@ -48,21 +49,93 @@ import {
   BirthAttestationLink,
   birthAttestation,
   seedBirthAttestation,
-} from "./framework/home.js";
+} from "./framework/receiving_group.js";
 import { RelationTuple, relationTuplesByObject, writeTuple } from "./framework/relations.js";
 import {
+  inheritedModelAuthorityGenesisStep,
+  modelAuthoritySeedBeforeWarrant,
+  seatInheritedModelAuthority,
+} from "./framework/model_authority_seed.js";
+import {
+  SIGNER_RELATION,
   SignerDelegation,
   enrollDelegation,
   enrollFirstDevice,
   enrollSigner,
   identityRelations,
   signerDelegationByUser,
+  signerObject,
 } from "./framework/signing_identity.js";
 import {
   DomainInstallExecutor,
   currentLawReference,
   domainInstallGenesisOffer,
 } from "./framework/domain_lifecycle.js";
+import {
+  BirthOrigin,
+  FoundingPrincipal,
+  birthOriginVirginOnly,
+  foundingPrincipalVirginOnly,
+  seedBirthOrigin,
+  seedFoundingPrincipal,
+} from "./framework/founding_genesis.js";
+import {
+  enrollDevice,
+  principalScopeRelations,
+  readInheritedEnrollers,
+  relationTuplesByRelation,
+  revokeDevice,
+} from "./framework/principal_enrollment.js";
+import { readInheritedOperators, workspaceOperatorRelations } from "./framework/workspaces.js";
+import {
+  delegatedRoleRelations,
+  delegatedRolesSteps,
+  grantDelegatedRole,
+  revokeDelegatedRole,
+} from "./framework/delegated_roles.js";
+import { consoleGovernanceLaw, inheritedGovernanceStep, INHERITED_SIGNER_GRANTOR } from "./framework/console_governance.js";
+import { readFrameworkDeclaredRows } from "./read.js";
+import { endorsementOf } from "./principal_evidence.js";
+
+/** The `grantedBy` of every tuple `seedFoundingPrincipal` seats (`writeFoundingPrincipal` in
+ * framework/founding_genesis.ts); nothing else grants as it. */
+const FOUNDING_GRANTOR = "genesis";
+
+/**
+ * THE MODE IS SELECTED BY LAW, FROM THE PARENT'S STATE (identity target model D22). A parent founded
+ * by token-free genesis by P holds `workspace:self#admin@P` granted by {@link FOUNDING_GRANTOR}
+ * (`seedFoundingPrincipal`; nothing else grants admin as it), and P's founding key as a signer seated
+ * on its warrant-free prefix. When the birth's principal IS that founder (a founded Home birthing its
+ * owner's estate), the child is founded the same way: the author is its founding principal, with that
+ * key, and the parent's operators and enrollers. Every other parent (every workspace born on the
+ * certificate lane) keeps the historical recipe byte-for-byte, so live chains keep their path until
+ * regenerated. Both reads are the declared `relationTuplesByObject` every birth already captures.
+ *
+ * The founding key is P's one `genesis`-granted signer. A workspace founded on the e712cae05 law, whose
+ * inherited-governance step re-seated that same leaf as {@link INHERITED_SIGNER_GRANTOR} when P was also
+ * an inherited operator or enroller, has no `genesis` key left; there the key is P's one
+ * inheritance-granted signer instead. Current law never rewrites the founding leaf
+ * (`inheritedGovernanceStepFrom` skips it), so its founders keep exactly one `genesis` key. Anything
+ * else — no founding admin grant, or not exactly one such key — is not a founded parent of P.
+ */
+function foundedBirthKeyHash(principal: string): string | undefined {
+  const adminRow = readFrameworkDeclaredRows(relationTuplesByObject, RelationTuple, { object: "workspace:self" })
+    .find((candidate) => candidate.relation === "admin");
+  const admin = (adminRow?.subjects as Record<string, { status?: string; grantedBy?: string }> | undefined)?.[principal];
+  if (admin?.status !== "active" || admin.grantedBy !== FOUNDING_GRANTOR) return undefined;
+  const rows = readFrameworkDeclaredRows(relationTuplesByObject, RelationTuple, { object: signerObject(principal) });
+  const row = rows.find((candidate) => candidate.relation === SIGNER_RELATION);
+  const subjects = row?.subjects as Record<string, { status?: string; grantedBy?: string }> | undefined;
+  const keysGrantedBy = (grantor: string) => Object.entries(subjects ?? {})
+    .filter(([subject, leaf]) =>
+      leaf?.status === "active" && leaf.grantedBy === grantor && /^key:[0-9a-f]{64}$/.test(subject))
+    .map(([subject]) => subject.slice("key:".length))
+    .sort();
+  const genesis = keysGrantedBy(FOUNDING_GRANTOR);
+  if (genesis.length > 0) return genesis.length === 1 ? genesis[0] : undefined;
+  const inherited = keysGrantedBy(INHERITED_SIGNER_GRANTOR);
+  return inherited.length === 1 ? inherited[0] : undefined;
+}
 
 /** @internal Compiler-only domain enumeration. It carries no allowance or authority. */
 export const BUSINESS_BIRTH_POLICY_DOMAINS_EXPORT = "__nomos_birth_policy_domains_c9f14a";
@@ -252,9 +325,28 @@ function lowerOne<P extends Record<string, unknown>, F extends Record<string, Fi
   const birthBase = directive(birthId)
     .creates(decl.aggregate)
     .payload(parentSchema)
-    .plan((p) => {
+    .plan((p, ctx) => {
       const founder = p.principal as string;
       const child = workspaceNameForKey(namespace, String(decl.key(p as P)));
+      const foundingKeyHash = foundedBirthKeyHash(founder);
+      const founded = foundingKeyHash !== undefined;
+      if (founded) {
+        // No certificate or token proves who the founder is, so the parent's own admission does: the
+        // birth's author — the principal the kernel authenticated from a signed key — must be the
+        // principal it founds. Nobody founds a workspace in someone else's name.
+        const author = endorsementOf(ctx.principal().asAttribution())?.principal ?? "";
+        if (author !== founder) {
+          throw new Error(
+            `birth(${decl.aggregate.id}): founded-business-birth-must-be-authored-by-its-founder ` +
+              `(principal '${founder}', author '${author}')`,
+          );
+        }
+        if (!Number.isFinite(Date.parse(String(p.bornAt)))) {
+          throw new Error(`birth(${decl.aggregate.id}): a founded birth needs bornAt as an ISO-8601 instant`);
+        }
+      }
+      const inheritedEnrollers = founded ? readInheritedEnrollers() : [];
+      const inheritedOperators = founded ? readInheritedOperators() : [];
       const childPayload = { ...(p as Record<string, unknown>) };
       if (encryptedBirth) {
         const sealedSeed = childPayload[BUSINESS_BIRTH_SEED_PAYLOAD_FIELD];
@@ -287,6 +379,33 @@ function lowerOne<P extends Record<string, unknown>, F extends Record<string, Fi
             setAt: p.bornAt,
           },
         })),
+        // The founder founds the child (D22): their key, themselves as admin, and the parent's operators
+        // and enrollers, in the one requires-free founding step on the warrant-free prefix.
+        ...(founded
+          ? [{
+              domain,
+              directiveId: seedFoundingPrincipal.id,
+              actor: founder,
+              payload: seedFoundingPrincipal.payloadSchema.parse({
+                principal: founder,
+                keyHash: foundingKeyHash,
+                operators: [...inheritedOperators],
+                enrollers: inheritedEnrollers.map((enroller) => ({
+                  scope: enroller.scope,
+                  subject: enroller.subject,
+                })),
+                grantedAt: Date.parse(String(p.bornAt)),
+              }) as Record<string, unknown>,
+            },
+            // The inherited operators' and enrollers' keys, and installDomain for the operators, so the
+            // jurisdiction can act here — enrol the founder's next device, roll out law — without the
+            // child ever being re-founded (framework/console_governance.ts).
+            ...inheritedGovernanceStep(domain, founder, inheritedOperators, inheritedEnrollers, Date.parse(String(p.bornAt)),
+              { principal: founder, keyHash: foundingKeyHash as string }),
+            // The roles the parent delegates into every child of this namespace its founder's scope
+            // founds (formerly a per-intent delegation certificate), as state tuples for the founder.
+            ...delegatedRolesSteps(founder, founder, namespace, Date.parse(String(p.bornAt)))]
+          : []),
         {
           domain,
           directiveId: seedId,
@@ -295,6 +414,13 @@ function lowerOne<P extends Record<string, unknown>, F extends Record<string, Fi
         },
       ];
 
+      if (founded) {
+        // No provider verifier, inherited model authority (operators ride the founding step instead),
+        // parent workspace role or epoch edge: those belong to the certificate lane's attestation.
+        birth({ workspace: child, genesisChain: chain });
+        return [];
+      }
+
       const inheritedProvider = readAuthProviderVerifyingConfiguration();
       if (inheritedProvider !== undefined) {
         chain.push({
@@ -309,6 +435,11 @@ function lowerOne<P extends Record<string, unknown>, F extends Record<string, Fi
           },
         });
       }
+      // MODEL AUTHORITY DESCENDS (architecture/parent_directed_model_transition.md §4, lane A): the child is
+      // born holding this workspace's current installDomain holders + their devices (by induction, the
+      // platform's operators), so the platform's own signer may lawfully stage and promote law in it.
+      const inheritedAuthority = inheritedModelAuthorityGenesisStep(domain, founder, p.bornAt as string);
+      if (inheritedAuthority !== undefined) chain.push(inheritedAuthority);
       birth({
         workspace: child,
         genesisChain: chain,
@@ -316,11 +447,25 @@ function lowerOne<P extends Record<string, unknown>, F extends Record<string, Fi
           ? { parentWorkspaceRoles: decl.parentWorkspaceRoles }
           : {}),
       });
-      return [];
+      // THE INVERSE EPOCH EDGE: the born child may ask THIS workspace for its current verifier epoch
+      // (`nomosInternalServeAuthProviderEpoch7c1f5e` gates on it). Seated in the same plan that births
+      // the child, so neither the host nor the caller can redirect it; the child's own genesis seats the
+      // downward `authProviderAuthority` for this workspace (`parentWorkspaceRoles`).
+      return writeTuple({
+        object: "workspace:self",
+        relation: AUTH_PROVIDER_EPOCH_CONSUMER,
+        subject: `workspace:${child}`,
+        grantedBy: founder,
+        grantedAt: p.bornAt as string,
+      });
     })
     .reads(authProvider)
     .reads(authProviderKeys)
     .reads(authProviderCertificates)
+    .reads(relationTuplesByObject)
+    // Token-free founding: the enroller tuples a founded child inherits.
+    .reads(relationTuplesByRelation)
+    .alsoEnsures(RelationTuple)
     .births();
 
   const metadata: BusinessBirthMetadata = {
@@ -335,9 +480,12 @@ function lowerOne<P extends Record<string, unknown>, F extends Record<string, Fi
     genesisDirectiveIds: [
       "enrollSigner",
       "seedAuthProvider",
+      seatInheritedModelAuthority.id,
       "seedBirthAttestation",
       "seedGenesis",
       "nomosBirthRecordEnsure",
+      seedFoundingPrincipal.id,
+      seedBirthOrigin.id,
     ],
     founderRoles: decl.founderRoles,
     founderScope: decl.founderScope,
@@ -357,7 +505,7 @@ function lowerOne<P extends Record<string, unknown>, F extends Record<string, Fi
 
     // THE SOVEREIGN-WORKSPACE CORE. These are ordinary law declarations, composed automatically so the
     // tenant's one business declaration is also a complete child law: it can fold the kernel-injected
-    // travelling attestation + warrant, seat its founding device, inherit its verifier, and verify itself
+    // travelling attestation + warrant, seat its founding device, bind its provider root, and verify itself
     // offline after custody is moved or reopened. The generated tenant client hides every one of them.
     __nomos_GenesisWarrant: internalSurface(GenesisWarrant),
     __nomos_seedGenesis: internalDirective(seedGenesis),
@@ -376,6 +524,8 @@ function lowerOne<P extends Record<string, unknown>, F extends Record<string, Fi
     __nomos_AuthProvider: internalSurface(AuthProvider),
     __nomos_seedAuthProvider: internalDirective(seedAuthProvider),
     __nomos_authProviderSeedBeforeWarrant: internalSurface(authProviderSeedBeforeWarrant),
+    __nomos_seatInheritedModelAuthority: internalDirective(seatInheritedModelAuthority),
+    __nomos_modelAuthoritySeedBeforeWarrant: internalSurface(modelAuthoritySeedBeforeWarrant),
     __nomos_setAuthProvider: internalDirective(setAuthProvider),
     __nomos_authProvider: internalSurface(authProvider),
     __nomos_authProviderKeys: internalSurface(authProviderKeys),
@@ -393,6 +543,33 @@ function lowerOne<P extends Record<string, unknown>, F extends Record<string, Fi
     __nomos_birthPolicy: internalSurface(birthPolicy),
     __nomos_birthGrantByPrincipal: internalSurface(birthGrantByPrincipal),
     __nomos_parentAttestedBirth: internalSurface(businessParentAttestedBirth),
+    // TOKEN-FREE FOUNDING (D22). Child side: the founding step a founded recipe carries, the birth origin
+    // the kernel's founded birth effect appends before the warrant, the relations the founding step seats
+    // (operator, enroller), and the enrolled scope's device lane, so an enroller the child inherited
+    // enrols (and revokes) the founder's further devices there. Parent side: the enroller read the recipe
+    // captures.
+    __nomos_FoundingPrincipal: internalSurface(FoundingPrincipal),
+    __nomos_seedFoundingPrincipal: internalDirective(seedFoundingPrincipal),
+    __nomos_foundingPrincipalVirginOnly: internalSurface(foundingPrincipalVirginOnly),
+    __nomos_BirthOrigin: internalSurface(BirthOrigin),
+    __nomos_seedBirthOrigin: internalDirective(seedBirthOrigin),
+    __nomos_birthOriginVirginOnly: internalSurface(birthOriginVirginOnly),
+    __nomos_workspaceOperatorRelations: internalSurface(workspaceOperatorRelations),
+    __nomos_principalScopeRelations: internalSurface(principalScopeRelations),
+    __nomos_relationTuplesByRelation: internalSurface(relationTuplesByRelation),
+    __nomos_seedInheritedGovernance: internalDirective(consoleGovernanceLaw.seedInheritedGovernance),
+    __nomos_inheritedGovernanceBeforeWarrant: internalSurface(consoleGovernanceLaw.inheritedGovernanceBeforeWarrant),
+    __nomos_grantConsoleOperator: internalDirective(consoleGovernanceLaw.grantConsoleOperator),
+    __nomos_revokeConsoleOperator: internalDirective(consoleGovernanceLaw.revokeConsoleOperator),
+    __nomos_lastOperatorRemains: internalSurface(consoleGovernanceLaw.lastOperatorRemains),
+    __nomos_enrollConsoleSigner: internalDirective(consoleGovernanceLaw.enrollConsoleSigner),
+    __nomos_revokeConsoleSigner: internalDirective(consoleGovernanceLaw.revokeConsoleSigner),
+    __nomos_lastConsoleSignerRemains: internalSurface(consoleGovernanceLaw.lastConsoleSignerRemains),
+    __nomos_delegatedRoleRelations: internalSurface(delegatedRoleRelations),
+    __nomos_grantDelegatedRole: internalDirective(grantDelegatedRole),
+    __nomos_revokeDelegatedRole: internalDirective(revokeDelegatedRole),
+    __nomos_enrollDevice: internalDirective(enrollDevice),
+    __nomos_revokeDevice: internalDirective(revokeDevice),
   };
 }