@githolon/dsl 0.108.7 → 0.110.1

package/src/framework/legacy/child_auth_provider_epoch.ts

@@ -0,0 +1,73 @@
+/**
+ * Upgrade existing children from the former `child` epoch gate to the explicit
+ * epoch-consumer seat. New framework births already write that seat.
+ *
+ * This is an operator-authorised parent-local change, not device recovery and
+ * not a kernel exception. It uses canonical birth/lifecycle custody, never a
+ * tenant catalogue or a caller-supplied certificate. An explicit revocation is
+ * not a missing migration: neither it nor a withdrawn child may be resurrected.
+ * Remove this compatibility operation only after existing children are migrated.
+ */
+import { z } from "zod";
+import { directive, nomosImplementationDetail } from "../../directive.js";
+import { authenticatesWithEnrolledDevice, intent } from "../../intent.js";
+import { readFrameworkDeclaredRows } from "../../read.js";
+import { AUTH_PROVIDER_EPOCH_CONSUMER } from "../auth_provider_law.js";
+import {
+  NomosBirthRecord,
+  NomosChildLifecycle,
+  birthRecordsByPrincipal,
+  childLifecyclesByPrincipal,
+} from "../birth_meter.js";
+import { MODEL_LIFECYCLE_AUTHORITY } from "../domain_lifecycle.js";
+import { RelationTuple, relationTuplesByObject, writeTuple } from "../relations.js";
+
+export const REPAIR_CHILD_AUTH_PROVIDER_EPOCH_CONSUMER_ID =
+  "nomosInternalRepairChildAuthProviderEpochConsumer7c1f5e";
+
+const repairMissingChildEpochConsumer = nomosImplementationDetail(
+  directive("nomosInternalRepairMissingChildEpochConsumer7c1f5e")
+    .ensures(RelationTuple)
+    .payload(z.object({ child: z.string().min(1), principal: z.string().min(1) }).strict())
+    .plan(({ child, principal }, ctx) => {
+      const births = readFrameworkDeclaredRows(birthRecordsByPrincipal, NomosBirthRecord, { principal })
+        .filter((birth) => birth.child === child && birth.principal === principal);
+      if (births.length !== 1 || !/^[0-9a-f]{64}$/.test(births[0]!.childGenesisHash ?? "")) {
+        throw new Error("epoch-consumer repair requires one canonical birth for the exact child and principal");
+      }
+      const lifecycles = readFrameworkDeclaredRows(childLifecyclesByPrincipal, NomosChildLifecycle, { principal })
+        .filter((lifecycle) => lifecycle.child === child);
+      if (lifecycles.some((lifecycle) => lifecycle.status !== "active")) {
+        throw new Error("epoch-consumer repair cannot restore a retired or reclaimed child");
+      }
+      const subject = `workspace:${births[0]!.child}`;
+      const tuples = readFrameworkDeclaredRows(relationTuplesByObject, RelationTuple, { object: "workspace:self" })
+        .filter((tuple) => tuple.object === "workspace:self");
+      const childGrants = tuples.filter((tuple) => tuple.relation === "child")
+        .flatMap((tuple) => tuple.subjects?.[subject] ? [tuple.subjects[subject]!] : []);
+      const epochGrants = tuples.filter((tuple) => tuple.relation === AUTH_PROVIDER_EPOCH_CONSUMER)
+        .flatMap((tuple) => tuple.subjects?.[subject] ? [tuple.subjects[subject]!] : []);
+      if ([...childGrants, ...epochGrants].some((grant) => grant.status !== "active")) {
+        throw new Error("epoch-consumer repair cannot overwrite an explicit child or consumer revocation");
+      }
+      // A repeat is a real no-op: preserve original grant provenance as well as
+      // every other child's seat. Never replace the entire subjects map.
+      if (epochGrants.length > 0) return [];
+      return writeTuple({
+        object: "workspace:self",
+        relation: AUTH_PROVIDER_EPOCH_CONSUMER,
+        subject,
+        grantedBy: ctx.principal().asAttribution(),
+        grantedAt: String(ctx.clock().physical),
+      });
+    })
+    .reads(birthRecordsByPrincipal, childLifecyclesByPrincipal, relationTuplesByObject)
+    // Gate the step itself too: presentation-internal is not an authority boundary.
+    .requires(MODEL_LIFECYCLE_AUTHORITY, { object: "workspace:self" }),
+);
+
+export const repairChildAuthProviderEpochConsumer = nomosImplementationDetail(
+  authenticatesWithEnrolledDevice(
+    intent(REPAIR_CHILD_AUTH_PROVIDER_EPOCH_CONSUMER_ID).performs(repairMissingChildEpochConsumer),
+  ),
+);

package/src/framework/model_authority_repair.ts

@@ -0,0 +1,116 @@
+// NOMOS — Nomos Sovereign: participants act · verify · remember LOCALLY; hosted
+// remotes are replaceable custody/transport, not truth.  ⇒ ONE Nomos GitHolon
+// wasm32-wasip1 artifact {kernel · projection · embedded QuickJS engine}.
+// If a file isn't this / hosting this / authoring for this / proving this — it's gone.
+
+/**
+ * THE MODEL-AUTHORITY SELF-SEAT — a workspace's own model-lifecycle holder names who else may install
+ * law here. ONE directive, one gate, no handshake.
+ *
+ * Design: `architecture/parent_directed_model_transition.md` §9. Lane A seats the platform's holders in
+ * a child's GENESIS (`model_authority_seed.ts`); lane B seats them when the platform DIRECTS a
+ * transition (`model_transition.ts`). Both are forward-looking, and lane B's entry needs an operator who
+ * can author on the platform. The population neither reaches is the one that already exists: a workspace
+ * born before lane A whose platform never directed it, holding exactly one `workspace:self#installDomain`
+ * subject — its founder, the signed-in person. As the product owner put it: a platform whose every act
+ * still needs that person's device key does not hold authority, it holds an ask with a stamp.
+ *
+ * WHY THIS IS ONE DIRECTIVE AND NOT A HANDSHAKE. It was built first as a child-asks / parent-answers /
+ * child-accepts round trip, so the holders could be derived by parent law rather than supplied. That
+ * defends against a threat that does not exist: the founder already holds `installDomain` here and can
+ * therefore install ANY law into this workspace, including law that seats anyone. A directive that lets
+ * that same founder seat a named subject grants no privilege they do not already hold — the "attacker"
+ * would be the sole owner of the thing attacked. Every mechanism added to route around that was cost
+ * with no security return, and it was precisely what excluded the workspaces this exists to reach: the
+ * parent's `workspace:self#child` tuple is only written by births after 2026-09-11, and both live
+ * production receiving groups check `allowed: false` for it.
+ *
+ * THE GATE IS THE WHOLE ARGUMENT: {@link MODEL_LIFECYCLE_AUTHORITY} on `workspace:self`, and nothing
+ * else. Whoever may install law here may say who else may.
+ *
+ * THE EFFECT IS THE BIRTH SEED'S. {@link seatInheritedModelAuthorityOps} is shared by the genesis seed,
+ * the parent-directed acceptor and this directive, so a seeded, a directed and a self-seated workspace
+ * are indistinguishable afterwards. Idempotent by construction: `writeTuple`'s first op is `ensures` and
+ * the subject rides a `setEntry` on the same subject key, so a re-run writes the same tuple; the record
+ * is one constant-id row whose fields are Lww/AddWins. Only `grantedAt`/`seatedAt` move, which is what
+ * re-attesting a fact does.
+ */
+import { aggregate, instance } from "../aggregate.js";
+import { directive, nomosImplementationDetail } from "../directive.js";
+import { AddWins, Lww } from "../drivers.js";
+import { t } from "../fields.js";
+import { intent } from "../intent.js";
+import { addToSet, set, withMarker, type PlannedOp } from "../ops.js";
+import { MODEL_LIFECYCLE_AUTHORITY } from "./domain_lifecycle.js";
+import {
+  inheritedModelAuthorityEvidence,
+  seatInheritedModelAuthorityOps,
+  type InheritedModelAuthorityEvidence,
+} from "./model_authority_seed.js";
+import { RelationTuple } from "./relations.js";
+
+/** Wire ids — framework-internal, obscure on purpose (the 7c1f5e suffix convention). */
+export const SEAT_MODEL_AUTHORITY_ID = "nomosInternalSeatModelAuthority7c1f5e";
+export const SEAT_DECLARED_MODEL_AUTHORITY_ID = "nomosInternalSeatDeclaredModelAuthority7c1f5e";
+export const RECORD_MODEL_AUTHORITY_SEAT_ID = "nomosInternalRecordModelAuthoritySeat7c1f5e";
+export const PARENT_MODEL_AUTHORITY_SEAT_AGGREGATE = "nomos_internal_ParentModelAuthoritySeat_7c1f5e";
+/** A CONSTANT instance id (the RelationTuple discipline — a literal, never minted), so every peer reads
+ * the same address and a client can ask for it by id with nothing compiled in but this string. */
+export const PARENT_MODEL_AUTHORITY_SEAT_ID = "nomos-parent-model-authority-seat";
+
+/** THE IN-HISTORY RECORD that this workspace has seated model-lifecycle authority beyond its founder,
+ * and the peer-readable answer to "has this workspace been seated yet". One row, one constant id. */
+export const ParentModelAuthoritySeat = aggregate(PARENT_MODEL_AUTHORITY_SEAT_AGGREGATE, {
+  /** The model-lifecycle holders seated (`user:`/`key:` subjects). */
+  holders: t.set(t.string()).merge(AddWins),
+  seatedAt: t.string().merge(Lww),
+}).public();
+
+/** Seat the named holders — THE VERY OPS the genesis seed writes, so a seeded, a directed and a
+ * self-seated workspace are indistinguishable afterwards. */
+export const seatDeclaredModelAuthority = nomosImplementationDetail(
+  directive(SEAT_DECLARED_MODEL_AUTHORITY_ID)
+    .ensures(RelationTuple)
+    .payload(inheritedModelAuthorityEvidence)
+    .plan((evidence, ctx) => seatInheritedModelAuthorityOps(evidence, ctx.principal().asAttribution())),
+);
+
+/** Record the seat, so a peer can tell "already seated" from one by-id read. */
+export const recordModelAuthoritySeat = nomosImplementationDetail(
+  directive(RECORD_MODEL_AUTHORITY_SEAT_ID)
+    .ensures(ParentModelAuthoritySeat)
+    .payload(inheritedModelAuthorityEvidence)
+    .plan((evidence: InheritedModelAuthorityEvidence): PlannedOp[] => {
+      const row = instance(ParentModelAuthoritySeat, PARENT_MODEL_AUTHORITY_SEAT_ID);
+      return [
+        withMarker(set(row, "seatedAt", evidence.seatedAt), "ensures"),
+        addToSet(row, "holders", evidence.holders.map((holder) => holder.principal)),
+      ];
+    }),
+);
+
+/**
+ * THE SELF-SEAT. Gated on THIS workspace's own model-lifecycle seat — the founder/admin principal
+ * `seedGenesis` wrote — and on nothing else. Seat and record are ONE atomic transition.
+ */
+export const seatModelAuthority = nomosImplementationDetail(
+  intent(SEAT_MODEL_AUTHORITY_ID)
+    .contract({ accepts: inheritedModelAuthorityEvidence })
+    .directs(seatDeclaredModelAuthority, (evidence) => evidence)
+    .directs(recordModelAuthoritySeat, (evidence) => evidence)
+    .requires(MODEL_LIFECYCLE_AUTHORITY, { object: "workspace:self" })
+    .atomically(),
+);
+
+/**
+ * The export map the application-home policy law composes (keys are the obscure `__nomos_*` slots;
+ * values are THE singletons — the law graph folds an intent's step closure by object identity). The two
+ * consequences ride only the intent's step closure, as `child_authentication.ts` carries its gated
+ * acceptor effect.
+ */
+export function modelAuthorityRepairExports(): Readonly<Record<string, object>> {
+  return {
+    __nomos_ParentModelAuthoritySeat: ParentModelAuthoritySeat,
+    __nomos_seatModelAuthority: seatModelAuthority,
+  };
+}

package/src/framework/model_authority_seed.ts

@@ -0,0 +1,185 @@
+// NOMOS — Nomos Sovereign: participants act · verify · remember LOCALLY; hosted
+// remotes are replaceable custody/transport, not truth.  ⇒ ONE Nomos GitHolon
+// wasm32-wasip1 artifact {kernel · projection · embedded QuickJS engine}.
+// If a file isn't this / hosting this / authoring for this / proving this — it's gone.
+
+/**
+ * INHERITED MODEL AUTHORITY — the platform's own signer holds `installDomain` on every descendant.
+ *
+ * The authority model (`architecture/parent_directed_model_transition.md` §2): the framework holds no
+ * seat in a tenant workspace and the host holds none; the TENANT PLATFORM holds full model authority
+ * over its subtree; a user holds their own device seat. Until this module every child was born with
+ * exactly one `workspace:self#installDomain` holder — its founder (`seedGenesis`) — so the platform's
+ * operator could not lawfully install law into a child it had birthed.
+ *
+ * THE SEED. Every framework birth recipe (the receiving-group birth and the business `birth()`) reads
+ * the parent's committed model-lifecycle holders — the active `user:`/`key:` subjects of
+ * `workspace:self#installDomain` — and, for each `user:` holder, its active signer keys from
+ * `identity:<holder>#signer`, and embeds ONE genesis step that seats the same facts in the child. The
+ * read is the declared `relationTuplesByObject` query (captured, CAS-re-derived on every lane), the
+ * same idiom by which a birth copies the parent's verifier (`seedAuthProvider`). Authority therefore
+ * DESCENDS BY INDUCTION: a home inherits the platform's holders, an estate inherits the home's (the
+ * owner and the platform's operators). Root → platform is deliberately outside this lane.
+ *
+ * THE POSTURE. The seed carries no `.requires` (it runs on the warrant-free genesis prefix, like every
+ * child-genesis primitive) and is refused once the GenesisWarrant exists
+ * ({@link modelAuthoritySeedBeforeWarrant}, the `authProviderSeedBeforeWarrant` shape). After birth
+ * the ONLY way these seats enter a child is the parent-directed transition acceptor
+ * (`model_transition.ts`), admitted on the attested parent's cert chain.
+ *
+ * Signer leaves are carried VERBATIM (`grantedAt`, `verifiedVia`, `validFromEpoch`): provenance is
+ * preserved, never re-vouched. The relation schema already admits `user:`/`key:` subjects on
+ * `installDomain` (`modelLifecycleRelations`) and `key:` subjects on `signer` (`identityRelations`);
+ * nothing here changes a schema.
+ */
+import { z } from "zod";
+import { directive, nomosImplementationDetail } from "../directive.js";
+import type { PlannedOp } from "../ops.js";
+import type { AttributionPrincipal } from "../principal_evidence.js";
+import { readFrameworkDeclaredRows } from "../read.js";
+import { MODEL_LIFECYCLE_AUTHORITY } from "./domain_lifecycle.js";
+import { GENESIS_WARRANT_ID } from "./genesis.js";
+import { RelationTuple, relationTuplesByObject, writeTuple } from "./relations.js";
+import { SIGNER_RELATION, signerObject } from "./signing_identity.js";
+import { readRef, readSet, workspaceInvariant } from "./workspace_invariant.js";
+
+/** Wire id — framework-internal, obscure on purpose (the 7c1f5e suffix convention). */
+export const SEAT_INHERITED_MODEL_AUTHORITY_ID = "nomosInternalSeatInheritedModelAuthority7c1f5e";
+
+const principalSubject = z.string().regex(/^(user|key):[A-Za-z0-9][A-Za-z0-9_.:/-]*$/);
+const deviceKeySubject = z.string().regex(/^key:[0-9a-f]{64}$/);
+
+/** One active signer leaf of a holder, carried verbatim from the parent's committed signer relation. */
+export const inheritedSignerLeaf = z
+  .object({
+    deviceKeySubject,
+    grantedAt: z.string().min(1),
+    verifiedVia: z.string().min(1).optional(),
+    validFromEpoch: z.number().int().nonnegative().optional(),
+  })
+  .strict();
+
+/** One model-lifecycle holder of the parent and the devices that may author as it. A `key:` holder
+ * self-authenticates and carries no signer leaves. */
+export const inheritedModelAuthorityHolder = z
+  .object({
+    principal: principalSubject,
+    signers: z.array(inheritedSignerLeaf),
+  })
+  .strict();
+
+/** The exact typed evidence a parent discloses: its current holders, and when it read them. */
+export const inheritedModelAuthorityEvidence = z
+  .object({
+    holders: z.array(inheritedModelAuthorityHolder).min(1),
+    /** Caller-stamped (ISO-8601 or epoch string) — the timestamp doctrine; the plan reads no clock. */
+    seatedAt: z.string().min(1),
+  })
+  .strict();
+export type InheritedModelAuthorityEvidence = z.infer<typeof inheritedModelAuthorityEvidence>;
+export type InheritedModelAuthorityHolder = z.infer<typeof inheritedModelAuthorityHolder>;
+
+/**
+ * Read THIS workspace's current model-lifecycle holders and their active devices. Returns `undefined`
+ * when the workspace holds no `installDomain` tuple row (a chain born before the seat existed), so a
+ * birth plan can omit the step rather than seed an empty list. Deterministic: both reads are declared
+ * captured reads and the output is sorted by subject.
+ */
+export function readInheritedModelAuthority(): InheritedModelAuthorityHolder[] | undefined {
+  const rows = readFrameworkDeclaredRows(relationTuplesByObject, RelationTuple, { object: "workspace:self" });
+  const authority = rows.find(
+    (row) => row.object === "workspace:self" && row.relation === MODEL_LIFECYCLE_AUTHORITY,
+  );
+  if (authority === undefined) return undefined;
+  const principals = Object.entries(authority.subjects ?? {})
+    .filter(([subject, leaf]) => /^(user|key):/.test(subject) && leaf.status === "active")
+    .map(([subject]) => subject)
+    .sort();
+  if (principals.length === 0) return undefined;
+  return principals.map((principal) => {
+    if (!principal.startsWith("user:")) return { principal, signers: [] };
+    const signerRows = readFrameworkDeclaredRows(relationTuplesByObject, RelationTuple, {
+      object: signerObject(principal),
+    });
+    const signers = signerRows
+      .filter((row) => row.object === signerObject(principal) && row.relation === SIGNER_RELATION)
+      .flatMap((row) =>
+        Object.entries(row.subjects ?? {})
+          .filter(([subject, leaf]) => subject.startsWith("key:") && leaf.status === "active")
+          .map(([subject, leaf]) =>
+            inheritedSignerLeaf.parse({
+              deviceKeySubject: subject,
+              grantedAt: leaf.grantedAt,
+              ...(leaf.verifiedVia === undefined ? {} : { verifiedVia: leaf.verifiedVia }),
+              ...(leaf.validFromEpoch === undefined ? {} : { validFromEpoch: leaf.validFromEpoch }),
+            }),
+          ),
+      )
+      .sort((left, right) => left.deviceKeySubject.localeCompare(right.deviceKeySubject));
+    return { principal, signers };
+  });
+}
+
+/** The ops that seat one disclosed holder set: `workspace:self#installDomain@<holder>` and, per device,
+ * `identity:<holder>#signer@key:…`. Shared by the genesis seed and the parent-directed acceptor. */
+export function seatInheritedModelAuthorityOps(
+  evidence: InheritedModelAuthorityEvidence,
+  grantedBy: string | AttributionPrincipal,
+): PlannedOp[] {
+  return evidence.holders.flatMap((holder) => [
+    ...writeTuple({
+      object: "workspace:self",
+      relation: MODEL_LIFECYCLE_AUTHORITY,
+      subject: holder.principal,
+      grantedBy,
+      grantedAt: evidence.seatedAt,
+    }),
+    ...holder.signers.flatMap((leaf) =>
+      writeTuple({
+        object: signerObject(holder.principal),
+        relation: SIGNER_RELATION,
+        subject: leaf.deviceKeySubject,
+        grantedBy,
+        grantedAt: leaf.grantedAt,
+        ...(leaf.verifiedVia === undefined ? {} : { verifiedVia: leaf.verifiedVia }),
+        ...(leaf.validFromEpoch === undefined ? {} : { validFromEpoch: leaf.validFromEpoch }),
+      }),
+    ),
+  ]);
+}
+
+/** THE GENESIS SEED: the child seats its parent's model-lifecycle holders as its own. */
+export const seatInheritedModelAuthority = nomosImplementationDetail(
+  directive(SEAT_INHERITED_MODEL_AUTHORITY_ID)
+    .ensures(RelationTuple)
+    .payload(inheritedModelAuthorityEvidence)
+    .plan((evidence, ctx) => seatInheritedModelAuthorityOps(evidence, ctx.principal().asAttribution())),
+);
+
+/** A child-genesis primitive: refused once the GenesisWarrant exists. After birth the seats enter only
+ * through the parent-directed transition acceptor, admitted on the attested parent's cert chain. */
+export const modelAuthoritySeedBeforeWarrant = workspaceInvariant("ModelAuthoritySeedBeforeWarrant")
+  .on(SEAT_INHERITED_MODEL_AUTHORITY_ID)
+  .reads(readSet(readRef("warrant", "GenesisWarrant").at(GENESIS_WARRANT_ID)))
+  .assert(({ warrant }) => {
+    const principal = (warrant as { principal?: unknown } | null | undefined)?.principal;
+    return typeof principal !== "string" || principal.length === 0
+      ? { accept: true }
+      : { reject: "inherited model authority is seated at genesis or by the parent-directed transition, never by a bare offer" };
+  });
+
+/** Build the genesis step a birth recipe embeds, or `undefined` when the parent holds no seat to pass on. */
+export function inheritedModelAuthorityGenesisStep(
+  domain: string,
+  actor: string,
+  seatedAt: string,
+): { domain: string; directiveId: string; actor: string; payload: Record<string, unknown> } | undefined {
+  const holders = readInheritedModelAuthority();
+  if (holders === undefined) return undefined;
+  return {
+    domain,
+    directiveId: SEAT_INHERITED_MODEL_AUTHORITY_ID,
+    actor,
+    payload: inheritedModelAuthorityEvidence.parse({ holders, seatedAt }),
+  };
+}

package/src/framework/model_transition.ts

@@ -0,0 +1,211 @@
+// NOMOS — Nomos Sovereign: participants act · verify · remember LOCALLY; hosted
+// remotes are replaceable custody/transport, not truth.  ⇒ ONE Nomos GitHolon
+// wasm32-wasip1 artifact {kernel · projection · embedded QuickJS engine}.
+// If a file isn't this / hosting this / authoring for this / proving this — it's gone.
+
+/**
+ * PARENT-DIRECTED MODEL TRANSITION — the platform adopts once and DIRECTS the transition into each
+ * child; the child accepts it on the strength of its attested parent, with no device signature.
+ *
+ * Design: `architecture/parent_directed_model_transition.md`. Two halves, both framework law composed
+ * into the application-home domain whenever a package births children (the same era rule as child
+ * authentication), so the parent door and the child acceptor are one exported pair in one module:
+ *
+ *   THE CHILD ACCEPTOR ({@link acceptParentModelTransition}) — a recovery-door intent
+ *   (`acceptsVerifiedBirthParentRecoveryEffect`): the kernel admits the carried effect only when the
+ *   verified source workspace IS this workspace's persisted birth parent. It atomically records the
+ *   direction in the child's own chain ({@link ParentModelTransition}: "my parent directed model X for
+ *   domain D") and seats the parent's current model-lifecycle holders + their devices exactly as the
+ *   birth seed does — so a child born before the seat existed heals itself on its first direction.
+ *
+ *   THE PLATFORM DIRECTION ({@link directChildModelTransition}) — gated on the platform's own
+ *   `workspace:self#installDomain` (whoever may install law here may direct it into a child); it
+ *   addresses ONE exact child from its typed input and derives every payload member from the
+ *   platform's committed state, so no caller can make a child seat a subject the platform does not hold.
+ *
+ * WHY THE ACCEPTOR DOES NOT STAGE/PROMOTE ITSELF (yet): the kernel keys the model lifecycle by the
+ * nominal labels `nomos/stageDomain` / `nomos/promoteDomain`, needs the closure bytes at the author
+ * lane and a frontier transition proved at the child's own head — none of which a carried effect
+ * supplies today (design §3, §7 scopes the kernel lane). Until then the direction is the RECORD and the
+ * SEAT; the platform's signer — now lawful on the child — stages and promotes through the ordinary
+ * signed lifecycle offers (`githolon model adopt <platform> --children`).
+ */
+import { z } from "zod";
+import { aggregate, instance } from "../aggregate.js";
+import { directive, nomosImplementationDetail } from "../directive.js";
+import { AddWins, Lww } from "../drivers.js";
+import { sha256Digest, t } from "../fields.js";
+import { intent } from "../intent.js";
+import { addToSet, set, withMarker, type PlannedOp } from "../ops.js";
+import { readFrameworkDeclaredRows } from "../read.js";
+import { MODEL_LIFECYCLE_AUTHORITY } from "./domain_lifecycle.js";
+import { verifiedBirthAttestation } from "./child_authentication.js";
+import {
+  inheritedModelAuthorityEvidence,
+  readInheritedModelAuthority,
+  seatInheritedModelAuthorityOps,
+} from "./model_authority_seed.js";
+import { BirthAttestation } from "./receiving_group.js";
+import { RelationTuple, relationTuplesByObject } from "./relations.js";
+
+/** Wire ids — framework-internal, obscure on purpose (the 7c1f5e suffix convention). */
+export const ACCEPT_PARENT_MODEL_TRANSITION_ID = "nomosInternalAcceptParentModelTransition7c1f5e";
+export const DIRECT_CHILD_MODEL_TRANSITION_ID = "nomosInternalDirectChildModelTransition7c1f5e";
+export const RECORD_PARENT_MODEL_TRANSITION_ID = "nomosInternalRecordParentModelTransition7c1f5e";
+export const SEAT_PARENT_MODEL_AUTHORITY_ID = "nomosInternalSeatParentModelAuthority7c1f5e";
+export const PARENT_MODEL_TRANSITION_AGGREGATE = "nomos_internal_ParentModelTransition_7c1f5e";
+export const PARENT_MODEL_TRANSITION_PREFIX = "nomos-parent-model-transition:";
+
+/** The transition a parent directs: which package, for which domain key, and why. The executing
+ * transition (stage + promote) is kernel-judged in full on the child; this names it. */
+export const modelTransitionDirection = z
+  .object({
+    domain: z.string().min(1),
+    candidateHash: sha256Digest(),
+    supersedes: sha256Digest().optional(),
+    acceptanceReason: z.string().trim().min(1),
+    /** Caller-stamped (ISO-8601) — the timestamp doctrine. */
+    directedAt: z.string().min(1),
+  })
+  .strict();
+export type ModelTransitionDirection = z.infer<typeof modelTransitionDirection>;
+
+/** What the child accepts: the direction plus the parent's current model-lifecycle holders. Every
+ * member is derived by parent law from committed parent state, never supplied by a caller. */
+export const parentModelTransitionEvidence = z
+  .object({
+    direction: modelTransitionDirection,
+    authority: inheritedModelAuthorityEvidence,
+  })
+  .strict();
+export type ParentModelTransitionEvidence = z.infer<typeof parentModelTransitionEvidence>;
+
+/** The platform's typed call: the exact child and the transition to direct. */
+export const directChildModelTransitionInput = z
+  .object({
+    workspace: z.string().min(1),
+    domain: z.string().min(1),
+    candidateHash: sha256Digest(),
+    supersedes: sha256Digest().optional(),
+    acceptanceReason: z.string().trim().min(1),
+    directedAt: z.string().min(1),
+  })
+  .strict();
+export type DirectChildModelTransitionInput = z.infer<typeof directChildModelTransitionInput>;
+
+/** The child's in-history record of a direction: one row per (domain, candidate). */
+export const ParentModelTransition = aggregate(PARENT_MODEL_TRANSITION_AGGREGATE, {
+  domain: t.string().merge(Lww),
+  candidateHash: t.sha256Digest().merge(Lww),
+  supersedes: t.sha256Digest().merge(Lww).optional(),
+  acceptanceReason: t.string().merge(Lww),
+  /** The verified birth parent that directed it (`workspace:<parent>`), derived from this workspace's
+   * own BirthAttestation — never from the payload. */
+  directedBy: t.string().merge(Lww),
+  directedAt: t.string().merge(Lww),
+  /** The model-lifecycle holders seated alongside the record. */
+  seatedHolders: t.set(t.string()).merge(AddWins),
+}).public();
+
+export function parentModelTransitionAggregateId(domain: string, candidateHash: string): string {
+  return `${PARENT_MODEL_TRANSITION_PREFIX}${domain}:${candidateHash}`;
+}
+
+function verifiedBirthParentId(): string {
+  const births = readFrameworkDeclaredRows(verifiedBirthAttestation, BirthAttestation, { verified: "true" });
+  if (births.length !== 1) {
+    throw new Error(`a parent-directed model transition requires exactly one verified BirthAttestation; found ${births.length}`);
+  }
+  const birth = births[0]!;
+  if (birth.verified !== "true" || !birth.parentId?.trim()) {
+    throw new Error("a parent-directed model transition requires a verified non-root parent");
+  }
+  return birth.parentId;
+}
+
+// ── CHILD SIDE ─────────────────────────────────────────────────────────────────────────────────
+
+/** Record the direction under the verified birth parent's name. */
+export const recordParentModelTransition = nomosImplementationDetail(
+  directive(RECORD_PARENT_MODEL_TRANSITION_ID)
+    .ensures(ParentModelTransition)
+    .payload(parentModelTransitionEvidence)
+    .plan(({ direction, authority }): PlannedOp[] => {
+      const row = instance(ParentModelTransition, parentModelTransitionAggregateId(direction.domain, direction.candidateHash));
+      return [
+        withMarker(set(row, "domain", direction.domain), "ensures"),
+        set(row, "candidateHash", direction.candidateHash),
+        ...(direction.supersedes === undefined ? [] : [set(row, "supersedes", direction.supersedes)]),
+        set(row, "acceptanceReason", direction.acceptanceReason),
+        set(row, "directedBy", `workspace:${verifiedBirthParentId()}`),
+        set(row, "directedAt", direction.directedAt),
+        addToSet(row, "seatedHolders", authority.holders.map((holder) => holder.principal)),
+      ];
+    })
+    .reads(verifiedBirthAttestation),
+);
+
+/** Seat the parent's disclosed holders — the same ops the genesis seed writes. */
+export const seatParentModelAuthority = nomosImplementationDetail(
+  directive(SEAT_PARENT_MODEL_AUTHORITY_ID)
+    .ensures(RelationTuple)
+    .payload(parentModelTransitionEvidence)
+    .plan(({ authority }, ctx) => seatInheritedModelAuthorityOps(authority, ctx.principal().asAttribution())),
+);
+
+/** THE ACCEPTOR: admitted through the verified-birth-parent door; record + seat are ONE transition. */
+export const acceptParentModelTransition = nomosImplementationDetail(
+  intent(ACCEPT_PARENT_MODEL_TRANSITION_ID)
+    .contract({ accepts: parentModelTransitionEvidence })
+    .directs(recordParentModelTransition, (evidence) => evidence)
+    .directs(seatParentModelAuthority, (evidence) => evidence)
+    .acceptsVerifiedBirthParentRecoveryEffect()
+    .atomically(),
+);
+
+// ── PLATFORM SIDE ──────────────────────────────────────────────────────────────────────────────
+
+function currentParentModelTransitionEvidence(input: DirectChildModelTransitionInput): ParentModelTransitionEvidence {
+  const holders = readInheritedModelAuthority();
+  if (holders === undefined) {
+    throw new Error("directing a model transition requires this workspace to hold at least one active installDomain seat");
+  }
+  return parentModelTransitionEvidence.parse({
+    direction: modelTransitionDirection.parse({
+      domain: input.domain,
+      candidateHash: input.candidateHash,
+      ...(input.supersedes === undefined ? {} : { supersedes: input.supersedes }),
+      acceptanceReason: input.acceptanceReason,
+      directedAt: input.directedAt,
+    }),
+    authority: { holders, seatedAt: input.directedAt },
+  });
+}
+
+/** THE DIRECTION: one exact child, addressed from the typed input; the evidence comes from committed
+ * platform state. Gated on the platform's own model-lifecycle authority. */
+export const directChildModelTransition = nomosImplementationDetail(
+  intent(DIRECT_CHILD_MODEL_TRANSITION_ID)
+    .contract({ accepts: directChildModelTransitionInput })
+    .reads(relationTuplesByObject)
+    .directsWorkspace(acceptParentModelTransition, {
+      workspace: ({ workspace }) => workspace,
+      payload: currentParentModelTransitionEvidence,
+    })
+    .requires(MODEL_LIFECYCLE_AUTHORITY, { object: "workspace:self" })
+    .atomically(),
+);
+
+/**
+ * The export map the application-home policy law composes (keys are the obscure `__nomos_*` slots;
+ * values are THE singletons — the law graph folds an intent's step closure by object identity).
+ * The two child-side consequences ride only the acceptor's step closure, as `child_authentication.ts`
+ * carries its gated acceptor effect.
+ */
+export function modelTransitionExports(): Readonly<Record<string, object>> {
+  return {
+    __nomos_ParentModelTransition: ParentModelTransition,
+    __nomos_acceptParentModelTransition: acceptParentModelTransition,
+    __nomos_directChildModelTransition: directChildModelTransition,
+  };
+}

package/src/framework/owned_custody.ts

@@ -19,7 +19,7 @@ import {
   writeWrap,
 } from "./encryption_scope.js";
 import { GenesisWarrant, seedGenesis } from "./genesis.js";
-import { BirthAttestation, BirthAttestationLink, seedBirthAttestation } from "./home.js";
+import { BirthAttestation, BirthAttestationLink, seedBirthAttestation } from "./receiving_group.js";
 import { RelationTuple, __qualifyAggregateType, removeTuple, writeTuple } from "./relations.js";
 import { SIGNER_RELATION, enrollSigner, signerObject, identityRelations } from "./signing_identity.js";
 import { impureCapability, impureCapabilityAggregate } from "./impure_capability.js";