@githolon/dsl 0.108.7 → 0.110.1

package/src/framework/domain_lifecycle.ts

@@ -19,7 +19,7 @@
  */
 import { z } from "zod";
 import { aggregate, instance } from "../aggregate.js";
-import { Lww, MapOf } from "../drivers.js";
+import { Lww } from "../drivers.js";
 import {
   attributionField,
   gitObjectId,
@@ -31,6 +31,7 @@ import { directive } from "../directive.js";
 import { formerAggregate, retirement } from "../evolution.js";
 import { set, withMarker, addToSet, type PlannedOp } from "../ops.js";
 import { key, relationRef, relationType, self, user } from "../relation_schema.js";
+import { consolePrincipals, custodianPrincipals, principalsOf } from "../member_authentication.js";
 
 /** The two authenticated capabilities which may execute a lifecycle install.
  * Callers choose a role; the serialized USDA route is an implementation detail. */
@@ -98,7 +99,12 @@ export function domainInstallGenesisOffer(
  * delegation remains an ordinary, replayable Zanzibar edge. */
 export const modelLifecycleRelations = relationType("workspace")
   .asGlobal()
-  .relation(MODEL_LIFECYCLE_AUTHORITY, { rewrite: self(), allow: [user(), key()] });
+  // Token-free genesis (D22): a child founded by a console principal, or a root founded by a custodian,
+  // receives this leaf in its own name from `seedGenesis`, so those two framework scopes are admitted too.
+  .relation(MODEL_LIFECYCLE_AUTHORITY, {
+    rewrite: self(),
+    allow: [user(), key(), principalsOf(consolePrincipals), principalsOf(custodianPrincipals)],
+  });
 
 /** The lifecycle state machine is a framework type, not a bag of coincidentally matching strings. */
 export enum DomainInstallationPhase {
@@ -134,13 +140,12 @@ export const DomainInstallation = aggregate("DomainInstallation", {
   "status.phase": t.enum(DOMAIN_INSTALLATION_PHASES).merge(Lww),
   "status.observedGeneration": t.int().merge(Lww),
   "status.supersededBy": t.sha256Digest().merge(Lww).optional(),
-  "status.conditions": t.map(t.json()).merge(MapOf(Lww)),
 }).public();
 
 /**
  * The accepted current-frontier evidence for one activation. This is deliberately an
  * obscure framework concept: tenant models never author or name it. The generated
- * lifecycle client runs pre-flight and folds this receipt in the SAME intent that
+ * lifecycle client derives the current-frontier transition and folds this receipt in the SAME intent that
  * activates the candidate, so recording evidence cannot make its own head anchor stale.
  */
 export const RELEASE_RECEIPT_AGGREGATE = "nomos_internal_ReleaseReceipt_6f0d3a";
@@ -211,7 +216,9 @@ const dispositions = z.object({
 
 const lowerHex64 = sha256Digest();
 const gitOid = gitObjectId();
-const preflightReceipt = z.object({
+// `preflight` is the already-shipped law field name; its value is now strictly a
+// current-frontier receipt and never carries counterfactual history results.
+const frontierReceipt = z.object({
   candidateHash: lowerHex64,
   domain: z.string().min(1),
   atHash: gitOid,
@@ -263,7 +270,10 @@ export const installDomain = directive(DOMAIN_LIFECYCLE_DIRECTIVES.Install)
     }
     return ops;
   })
-  .requires(MODEL_LIFECYCLE_AUTHORITY);
+  .requires(MODEL_LIFECYCLE_AUTHORITY)
+  // Model custody is exercised by an enrolled user/device or executor key which independently
+  // holds installDomain. It must never inherit the customer-facing provider used by business law.
+  .authenticatesWithEnrolledDevice();
 
 /** Store candidate law in the ledger without changing the served law frontier. The
  *  kernel content-verifies the package and lifecycle pair, while the Pending phase is
@@ -291,7 +301,8 @@ export const stageDomain = directive(DOMAIN_LIFECYCLE_DIRECTIVES.Stage)
     if ((p.finalizers ?? []).length > 0) ops.push(addToSet(install, "spec.finalizers", p.finalizers ?? []));
     return ops;
   })
-  .requires(MODEL_LIFECYCLE_AUTHORITY);
+  .requires(MODEL_LIFECYCLE_AUTHORITY)
+  .authenticatesWithEnrolledDevice();
 
 /** Make a staged or retained Active package current. The package bytes are already
  *  committed; the kernel re-loads them from prefix state and runs the evolve gate on
@@ -306,12 +317,12 @@ export const promoteDomain = directive(DOMAIN_LIFECYCLE_DIRECTIVES.Promote)
     replaces: sha256Digest().optional(),
     retireReplaced: z.boolean().default(false),
     dispositions,
-    preflight: preflightReceipt,
+    preflight: frontierReceipt,
   }).refine((p) => p.replaces === undefined || p.replaces !== p.domainHash, {
     message: "a promoted domain package cannot replace itself",
     path: ["replaces"],
   }).refine((p) => p.preflight.candidateHash === p.domainHash, {
-    message: "the pre-flight receipt must name the package being promoted",
+    message: "the current-frontier receipt must name the package being promoted",
     path: ["preflight", "candidateHash"],
   }))
   .plan((p, ctx): PlannedOp[] => {
@@ -343,7 +354,8 @@ export const promoteDomain = directive(DOMAIN_LIFECYCLE_DIRECTIVES.Promote)
     return ops;
   })
   .alsoEnsures(ReleaseReceipt)
-  .requires(MODEL_LIFECYCLE_AUTHORITY);
+  .requires(MODEL_LIFECYCLE_AUTHORITY)
+  .authenticatesWithEnrolledDevice();
 
 /** Rollback is a new governed transition, never a history-pointer rewind. The prior
  *  package is promoted from committed custody and the failed candidate becomes Disabled;
@@ -354,12 +366,12 @@ export const rollbackDomain = directive(DOMAIN_LIFECYCLE_DIRECTIVES.Rollback)
     candidateHash: sha256Digest(),
     priorHash: sha256Digest(),
     dispositions,
-    preflight: preflightReceipt,
+    preflight: frontierReceipt,
   }).refine((p) => p.candidateHash !== p.priorHash, {
     message: "rollback candidate and prior package must differ",
     path: ["priorHash"],
   }).refine((p) => p.preflight.candidateHash === p.priorHash, {
-    message: "the rollback pre-flight receipt must name the prior package being restored",
+    message: "the rollback current-frontier receipt must name the prior package being restored",
     path: ["preflight", "candidateHash"],
   }).refine((p) => (p.preflight.acceptanceReason ?? "").trim().length > 0, {
     message: "restoring previous law needs an attributed business reason",
@@ -388,4 +400,5 @@ export const rollbackDomain = directive(DOMAIN_LIFECYCLE_DIRECTIVES.Rollback)
     ];
   })
   .alsoEnsures(ReleaseReceipt)
-  .requires(MODEL_LIFECYCLE_AUTHORITY);
+  .requires(MODEL_LIFECYCLE_AUTHORITY)
+  .authenticatesWithEnrolledDevice();

package/src/framework/founding_genesis.ts

@@ -0,0 +1,193 @@
+// NOMOS — Nomos Sovereign: participants act · verify · remember LOCALLY; hosted
+// remotes are replaceable custody/transport, not truth.  ⇒ ONE Nomos GitHolon
+// wasm32-wasip1 artifact {kernel · projection · embedded QuickJS engine}.
+// If a file isn't this / hosting this / authoring for this / proving this — it's gone.
+
+/**
+ * framework/founding_genesis.ts — TOKEN-FREE GENESIS (identity target model D22, build order step 2).
+ *
+ * A workspace's founding facts land in ONE control-plane step on its warrant-free genesis prefix:
+ * `seedFoundingPrincipal` seats
+ *
+ *   - `identity:P#signer@key:K`          the founding admin principal's founding signer key;
+ *   - `workspace:self#admin@P`           the founding admin;
+ *   - `workspace:self#operator@S`        each operator the parent held at birth (D15);
+ *   - `principalScope:<s>#enroller@S`    each enroller the parent held at birth (D22),
+ *
+ * and records them on the singleton {@link FoundingPrincipal} the kernel reads when it judges the
+ * warrant. Nothing here is a token, an issuer key, a JWKS or a certificate: P is a `<scope>:<subject>`
+ * principal and K is the sha256 of a public key.
+ *
+ * Why one requires-free step: on the warrant-free prefix no admin exists yet, so an admin-gated grant
+ * (`grantAdmin`, `grantLawOperator`, `grantEnroller`) is refused by the kernel's relation gate. The
+ * step is instead fenced by {@link foundingPrincipalVirginOnly}: it is admitted only before the warrant
+ * and only once, so it can never be replayed to seat a second founder. What makes the prefix
+ * trustworthy is the warrant that closes it — the root's is signed by the pinned K_root; a child's is
+ * appended by the kernel's birth effect of the parent's admitted, signed `birthChild`, and the kernel
+ * binds the warrant's principal to this record (`executor/src/founding_genesis.rs`).
+ *
+ * The founding principal must be one the framework's governance relations admit (`user:`, `console:` or
+ * `custodian:`, `isGovernanceSubject`): the framework cannot name a tenant's scopes. A `user:` founder is
+ * an application's signed-in user founding their own workspace (a Home), enrolled by the user scope's
+ * enroller (`principalScope:user#enroller`) exactly like any enrolled principal.
+ */
+import { z } from "zod";
+import { aggregate, instance } from "../aggregate.js";
+import { t } from "../fields.js";
+import { Lww } from "../drivers.js";
+import { directive } from "../directive.js";
+import { set, type PlannedOp } from "../ops.js";
+import { principalScopeOf } from "../member_authentication.js";
+import { RelationTuple, relationTuplesByObject, writeTuple } from "./relations.js";
+import { readFrameworkDeclaredRows } from "../read.js";
+import { readRef, readSet, workspaceInvariant } from "./workspace_invariant.js";
+import { GENESIS_WARRANT_ID } from "./genesis.js";
+import { signerObject, SIGNER_RELATION } from "./signing_identity.js";
+import { WORKSPACE_ADMIN_RELATION, WORKSPACE_OPERATOR_RELATION, PRINCIPAL_SCOPE_ENROLLER_RELATION } from "./governance_relations.js";
+import { isGovernanceSubject, principalScopeObject, providerScopeField } from "./principal_enrollment.js";
+
+/**
+ * OPERATOR INHERITANCE (identity target model D15): the parent's CURRENT `operator` subjects, read
+ * off the parent's folded state by the calling plan (a declared captured read, `relationTuplesByObject`
+ * on `workspace:self`). The founding step seats each one in the child — a fact copied once at birth,
+ * never a live dependency on the parent afterward (D15's whole point). Sorted so the recipe is a pure
+ * function of the tuple set.
+ */
+export function readInheritedOperators(): readonly string[] {
+  const rows = readFrameworkDeclaredRows(relationTuplesByObject, RelationTuple, { object: "workspace:self" });
+  const row = rows.find((candidate) => candidate.relation === WORKSPACE_OPERATOR_RELATION);
+  const subjects = row?.subjects as Record<string, { status?: string }> | undefined;
+  if (!subjects) return [];
+  return Object.keys(subjects)
+    .filter((subject) => subjects[subject]?.status === "active")
+    .sort();
+}
+
+/** The singleton id of the founding record — MUST equal `executor::founding_genesis::FOUNDING_PRINCIPAL_ID`. */
+export const FOUNDING_PRINCIPAL_ID = "founding-principal:self";
+
+/** The directive id — MUST equal `executor::founding_genesis::SEED_FOUNDING_PRINCIPAL_DIRECTIVE`. */
+export const SEED_FOUNDING_PRINCIPAL_DIRECTIVE = "seedFoundingPrincipal" as const;
+
+/** The one record the kernel reads to bind the warrant to the founder (an O(1) point read). */
+export const FoundingPrincipal = aggregate("FoundingPrincipal", {
+  principal: t.string().merge(Lww), // `<scope>:<subject>`, the founding admin
+  keyHash: t.string().merge(Lww), // sha256hex of the founding signer's public key
+}).public();
+
+const sha256Hex = z.string().regex(/^[0-9a-f]{64}$/, "expected lowercase sha256 hex (a public key hash)");
+/** Every field that is law on the founding step. Strict: no token-, issuer- or certificate-shaped field.
+ *  Subject-class checks are object-level refinements (the compiler's security discovery must be able to
+ *  sample each field on its own). */
+export const foundingPrincipalPayload = z
+  .object({
+    /** The founding admin: a user:, console: or custodian: `<scope>:<subject>` principal. */
+    principal: z.string().min(1),
+    keyHash: sha256Hex,
+    /** The parent's active operator subjects at birth, sorted (D15). */
+    operators: z.array(z.string().min(1)).default([]),
+    /** The parent's active enroller tuples at birth, sorted by (scope, subject) (D22). */
+    enrollers: z.array(z.object({ scope: providerScopeField, subject: z.string().min(1) }).strict()).default([]),
+    grantedAt: z.number().int().nonnegative(),
+  })
+  .strict()
+  .refine((p) => principalScopeOf(p.principal) !== undefined && isGovernanceSubject(p.principal), {
+    message: "the founding principal is a console: or custodian: <scope>:<subject> principal",
+    path: ["principal"],
+  })
+  .refine((p) => p.operators.every(isGovernanceSubject) && p.enrollers.every((e) => isGovernanceSubject(e.subject)), {
+    message: "every inherited operator and enroller is a framework governance subject",
+    path: ["operators"],
+  });
+
+export type FoundingPrincipalPayload = z.input<typeof foundingPrincipalPayload>;
+
+/** The founding facts as planned ops — a pure function of the payload. */
+export function writeFoundingPrincipal(p: z.output<typeof foundingPrincipalPayload>): PlannedOp[] {
+  // The grant's authority is the genesis itself: at a root the K_root-signed warrant that closes this
+  // prefix, at a child the parent's admitted birth whose effect appends that warrant.
+  const grantedBy = "genesis";
+  const grantedAt = String(p.grantedAt);
+  const record = instance(FoundingPrincipal, FOUNDING_PRINCIPAL_ID);
+  return [
+    set(record, "principal", p.principal),
+    set(record, "keyHash", p.keyHash),
+    ...writeTuple({
+      object: signerObject(p.principal),
+      relation: SIGNER_RELATION,
+      subject: `key:${p.keyHash}`,
+      grantedBy,
+      grantedAt,
+    }),
+    ...writeTuple({ object: "workspace:self", relation: WORKSPACE_ADMIN_RELATION, subject: p.principal, grantedBy, grantedAt }),
+    ...(p.operators ?? []).flatMap((subject) =>
+      writeTuple({ object: "workspace:self", relation: WORKSPACE_OPERATOR_RELATION, subject, grantedBy, grantedAt })),
+    ...(p.enrollers ?? []).flatMap((enroller) =>
+      writeTuple({
+        object: principalScopeObject(enroller.scope),
+        relation: PRINCIPAL_SCOPE_ENROLLER_RELATION,
+        subject: enroller.subject,
+        grantedBy,
+        grantedAt,
+      })),
+  ];
+}
+
+/** `seedFoundingPrincipal` — the one founding step of a token-free genesis. See the module doc. */
+export const seedFoundingPrincipal = directive(SEED_FOUNDING_PRINCIPAL_DIRECTIVE)
+  .ensures(FoundingPrincipal)
+  .payload(foundingPrincipalPayload)
+  .plan((p) => writeFoundingPrincipal(p))
+  .alsoEnsures(RelationTuple);
+
+/** Admitted only on a virgin, warrant-free prefix, and only once: no second founder, ever. */
+export const foundingPrincipalVirginOnly = workspaceInvariant("FoundingPrincipalVirginOnly")
+  .on(SEED_FOUNDING_PRINCIPAL_DIRECTIVE)
+  .reads(readSet(
+    readRef("warrant", "GenesisWarrant").pre().at(GENESIS_WARRANT_ID),
+    readRef("founding", FoundingPrincipal).pre().at(FOUNDING_PRINCIPAL_ID),
+  ))
+  .assert(({ warrant, founding }) => {
+    if ((warrant as { principal?: string } | undefined)?.principal) return { reject: "founding-after-warrant" };
+    if ((founding as { principal?: string } | undefined)?.principal) return { reject: "founding-principal-already-seeded" };
+    return { accept: true };
+  });
+
+/** The birth-origin record's singleton id — MUST equal `executor::founding_genesis::BIRTH_ORIGIN_ID`. */
+export const BIRTH_ORIGIN_ID = "birth-origin:self";
+
+/** The directive id — MUST equal `executor::founding_genesis::SEED_BIRTH_ORIGIN_DIRECTIVE`. */
+export const SEED_BIRTH_ORIGIN_DIRECTIVE = "seedBirthOrigin" as const;
+
+/**
+ * Where a token-free child came from: the parent workspace and the id of the parent's admitted, signed
+ * birth intent whose births witness re-derives this child's genesis prefix. Appended by the KERNEL's
+ * birth effect (never by a plan), just before the warrant, so the child's own chain names the parent
+ * birth it can be checked against offline. A root has none.
+ */
+export const BirthOrigin = aggregate("BirthOrigin", {
+  parent: t.string().merge(Lww),
+  parentIntent: t.string().merge(Lww),
+}).public();
+
+/** `seedBirthOrigin` — the kernel-appended parent reference of a token-free birth. */
+export const seedBirthOrigin = directive(SEED_BIRTH_ORIGIN_DIRECTIVE)
+  .ensures(BirthOrigin)
+  .payload(z.object({ parent: z.string().min(1), parentIntent: z.string().min(1) }).strict())
+  .plan((p) => {
+    const record = instance(BirthOrigin, BIRTH_ORIGIN_ID);
+    return [set(record, "parent", p.parent), set(record, "parentIntent", p.parentIntent)];
+  });
+
+/** Kernel-appended once, before the warrant; never again. */
+export const birthOriginVirginOnly = workspaceInvariant("BirthOriginVirginOnly")
+  .on(SEED_BIRTH_ORIGIN_DIRECTIVE)
+  .reads(readSet(
+    readRef("warrant", "GenesisWarrant").pre().at(GENESIS_WARRANT_ID),
+    readRef("origin", BirthOrigin).pre().at(BIRTH_ORIGIN_ID),
+  ))
+  .assert(({ warrant, origin }) => {
+    if ((warrant as { principal?: string } | undefined)?.principal) return { reject: "birth-origin-after-warrant" };
+    if ((origin as { parent?: string } | undefined)?.parent) return { reject: "birth-origin-already-seeded" };
+    return { accept: true };
+  });

package/src/framework/framework_aggregates.ts

@@ -43,7 +43,7 @@ import * as domainLifecycle from "./domain_lifecycle.js";
 import * as encryptionIdentity from "./encryption_identity.js";
 import * as encryptionScope from "./encryption_scope.js";
 import * as genesis from "./genesis.js";
-import * as home from "./home.js";
+import * as home from "./receiving_group.js";
 import * as ownedCustody from "./owned_custody.js";
 import * as relations from "./relations.js";
 import * as repair from "./repair.js";

package/src/framework/genesis.ts

@@ -35,6 +35,7 @@ import { directive } from "../directive.js";
 import { set, type PlannedOp } from "../ops.js";
 import { RelationTuple, writeTuple } from "./relations.js";
 import { MODEL_LIFECYCLE_AUTHORITY } from "./domain_lifecycle.js";
+import { principalScopeOf } from "../member_authentication.js";
 import {
   ADMISSION_CHECKPOINT_PRINCIPAL,
   SIGNER_RELATION,
@@ -133,7 +134,11 @@ export const seedGenesis = directive("seedGenesis")
     ...writeTuple({
       object: "workspace:self",
       relation: MODEL_LIFECYCLE_AUTHORITY,
-      subject: /^(user|key):/.test(p.principal) ? p.principal : `user:${p.principal}`,
+      // A `<scope>:<subject>` principal (token-free genesis, D22) is its own Zanzibar subject; a bare
+      // legacy uid is still spelled `user:<uid>`.
+      subject: /^(user|key):/.test(p.principal) || principalScopeOf(p.principal) !== undefined
+        ? p.principal
+        : `user:${p.principal}`,
       grantedBy: p.principal,
       grantedAt: p.bornAt,
     }),

package/src/framework/governance_relations.ts

@@ -8,3 +8,22 @@ import { relationRef } from "../relation_schema.js";
 /** The global workspace authority seated at `workspace:self#admin`. */
 export const WORKSPACE_ADMIN_RELATION = relationRef("admin");
 
+/**
+ * The global workspace authority seated at `workspace:self#operator` (identity target model,
+ * `architecture/identity_target_model.md` D15): who may install, stage or promote law here. Narrower
+ * than {@link WORKSPACE_ADMIN_RELATION} — an admin grants and revokes it, exactly as an admin grants
+ * admin — and, unlike admin, it is copied into a child's own genesis chain when the child is born
+ * (`buildGenesisChain`'s `inheritedOperators`), a fact recorded once at birth, never a live dependency
+ * on the parent afterward. A child may change who it trusts as an operator the moment it exists; the
+ * parent has no ongoing authority over it.
+ */
+export const WORKSPACE_OPERATOR_RELATION = relationRef("operator");
+
+/**
+ * The framework authority seated at `principalScope:<scope>#enroller` (identity target model D22): who
+ * may write the FIRST signer key of a principal of an enrolled scope (`enrollDevice`) and revoke that
+ * scope's keys (`revokeDevice`). A relation tuple, revocable and replaceable by one intent — never a key
+ * in law. Like {@link WORKSPACE_OPERATOR_RELATION}, an admin grants it and a child is born with a copy
+ * of its parent's enroller tuples (`buildGenesisChain`'s `inheritedEnrollers`).
+ */
+export const PRINCIPAL_SCOPE_ENROLLER_RELATION = relationRef("enroller");