@githolon/dsl 0.108.7 → 0.110.1

package/src/framework/signing_identity.ts

@@ -42,24 +42,31 @@
  *    only revokes keys of its OWN identity).
  */
 import { z } from "zod";
-import { birthCertificatePayload, type BirthCertificatePayload } from "./birth_certificate_law.js";
+import { BirthDelegationCertificate, birthCertificatePayload, type BirthCertificatePayload } from "./birth_certificate_law.js";
 import { aggregate, instance, type BoundAggregate } from "../aggregate.js";
 import { t } from "../fields.js";
-import { Lww } from "../drivers.js";
+import { FirstWriterWins, Lww, MapOf } from "../drivers.js";
 import { directive } from "../directive.js";
-import { set, withMarker, type FieldOp, type PlannedOp } from "../ops.js";
+import { set, setEntry, withMarker, type FieldOp, type PlannedOp } from "../ops.js";
 import { query } from "../query.js";
 import { relationType, self, key } from "../relation_schema.js";
 import { readRef, readSet, workspaceInvariant, ref } from "./workspace_invariant.js";
-import { endorsementOf, type EndorsedAuthority } from "../principal_evidence.js";
+import {
+  endorsementOf,
+  type AttributionPrincipal,
+  type EndorsedAuthority,
+} from "../principal_evidence.js";
 import {
   writeTuple,
   removeTuple,
   RelationTuple,
+  relationTuplesByObject,
   relationTupleInstanceId,
 } from "./relations.js";
 import { MODEL_LIFECYCLE_AUTHORITY } from "./domain_lifecycle.js";
 import { readFrameworkDeclaredRows } from "../read.js";
+import { formerAggregate, retirement } from "../evolution.js";
+import { valueObject } from "../value_object.js";
 
 /**
  * The framework `identity` relation schema — the `signer` relation, LEAF-ONLY
@@ -91,6 +98,55 @@ export const ADMISSION_CHECKPOINT_PRINCIPAL = "workspace:admission-peer";
 
 const sha256Hex = z.string().regex(/^[0-9a-f]{64}$/, "expected lowercase sha256 hex (the device pubkey hash)");
 
+/** Public, typed disclosure of one active admission workload key. Parents carry this exact shape
+ * into child law; the corresponding secret remains runtime custody and never enters a domain. */
+export const admissionCheckpointSigner = z.object({
+  keyHash: sha256Hex,
+  validFromEpoch: z.number().int().nonnegative(),
+  grantedAt: z.string().min(1),
+}).strict();
+export type AdmissionCheckpointSigner = z.infer<typeof admissionCheckpointSigner>;
+
+/** Read the current workspace's visible admission workload grants through the framework's declared
+ * relation index. This is the law-side twin of the kernel's replay verifier, from the same tuple. */
+export function readAdmissionCheckpointSigners(): AdmissionCheckpointSigner[] {
+  const rows = readFrameworkDeclaredRows(
+    relationTuplesByObject,
+    RelationTuple,
+    { object: signerObject(ADMISSION_CHECKPOINT_PRINCIPAL) },
+  );
+  const signers: AdmissionCheckpointSigner[] = [];
+  for (const row of rows) {
+    if (row.relation !== SIGNER_RELATION || row.subjects === undefined) continue;
+    for (const [subject, leaf] of Object.entries(row.subjects)) {
+      if (!subject.startsWith("key:") || leaf.status !== "active") continue;
+      signers.push(admissionCheckpointSigner.parse({
+        keyHash: subject.slice("key:".length),
+        validFromEpoch: leaf.validFromEpoch,
+        grantedAt: leaf.grantedAt,
+      }));
+    }
+  }
+  return signers.sort((left, right) => left.keyHash.localeCompare(right.keyHash));
+}
+
+/** Lower a parent's typed signer disclosure into the child's ordinary relation state. The caller's
+ * directive still decides authority; this helper supplies no gate and owns no secret. */
+export function writeAdmissionCheckpointSigners(
+  signers: readonly AdmissionCheckpointSigner[],
+  grantedBy: string | AttributionPrincipal,
+): PlannedOp[] {
+  return signers.flatMap((signer) => writeTuple({
+    object: signerObject(ADMISSION_CHECKPOINT_PRINCIPAL),
+    relation: SIGNER_RELATION,
+    subject: `key:${signer.keyHash}`,
+    grantedBy,
+    grantedAt: signer.grantedAt,
+    validFromEpoch: signer.validFromEpoch,
+    verifiedVia: "workspace-law",
+  }));
+}
+
 // ─────────────────────────────── PHASE 0 — SignerEpoch ───────────────────────────────
 
 /** The deterministic singleton id of the per-workspace signer epoch — one per chain. */
@@ -251,30 +307,78 @@ export const enrollSigner = directive("enrollSigner")
  * the secret alone grants nothing. The key certifies that this workspace admitted an exact causal
  * transition; the target directive's independent Zanzibar requirement remains business authority.
  */
-export const enrollAdmissionCheckpointSigner = directive(
-  "_nmsEffectEnrollAdmissionCheckpointSigner",
-)
+function admissionCheckpointEnrollment(id: string) {
+  return directive(id)
+    .ensures(RelationTuple)
+    .payload(
+      z.object({
+        keyHash: sha256Hex,
+        validFromEpoch: z.number().int().nonnegative(),
+        grantedAt: z.string().min(1),
+      }).strict(),
+    )
+    .plan((p, ctx) =>
+      writeTuple({
+        object: signerObject(ADMISSION_CHECKPOINT_PRINCIPAL),
+        relation: SIGNER_RELATION,
+        subject: `key:${p.keyHash}`,
+        grantedBy: ctx.principal().asAttribution(),
+        grantedAt: p.grantedAt,
+        validFromEpoch: p.validFromEpoch,
+        verifiedVia: "workspace-law",
+      }),
+    )
+    .requires(MODEL_LIFECYCLE_AUTHORITY, { object: "workspace:self" });
+}
+export const enrollAdmissionCheckpointSigner = admissionCheckpointEnrollment("_nmsEffectEnrollAdmissionCheckpointSigner");
+/** The same enrolment, called directly by its public name: the platform governance law (root, platforms),
+ *  which composes no application-home law, publishes it this way. */
+export const enrollAdmissionCheckpointSignerDirect = admissionCheckpointEnrollment("enrollAdmissionCheckpointSigner");
+
+/**
+ * Retire one admission-checkpoint workload key: the custodian that held its secret no longer vouches this
+ * workspace's admissions (a custody move retires the old custodian's key). The same lifecycle authority
+ * that enrols a key revokes it; {@link lastAdmissionCheckpointSignerRemains} refuses leaving the workspace
+ * with no active checkpoint key, which would stop it receiving any workspace effect.
+ */
+export const REVOKE_ADMISSION_CHECKPOINT_SIGNER_DIRECTIVE = "revokeAdmissionCheckpointSigner" as const;
+export const revokeAdmissionCheckpointSigner = directive(REVOKE_ADMISSION_CHECKPOINT_SIGNER_DIRECTIVE)
   .ensures(RelationTuple)
   .payload(
     z.object({
       keyHash: sha256Hex,
-      validFromEpoch: z.number().int().nonnegative(),
-      grantedAt: z.string().min(1),
+      revokedAt: z.string().min(1),
     }).strict(),
   )
   .plan((p, ctx) =>
-    writeTuple({
+    removeTuple({
       object: signerObject(ADMISSION_CHECKPOINT_PRINCIPAL),
       relation: SIGNER_RELATION,
       subject: `key:${p.keyHash}`,
       grantedBy: ctx.principal().asAttribution(),
-      grantedAt: p.grantedAt,
-      validFromEpoch: p.validFromEpoch,
-      verifiedVia: "workspace-law",
+      grantedAt: p.revokedAt,
+      revokedBy: ctx.principal().asAttribution(),
+      revokedAt: p.revokedAt,
     }),
   )
   .requires(MODEL_LIFECYCLE_AUTHORITY, { object: "workspace:self" });
 
+export const lastAdmissionCheckpointSignerRemains = workspaceInvariant("LastAdmissionCheckpointSignerRemains")
+  .on(REVOKE_ADMISSION_CHECKPOINT_SIGNER_DIRECTIVE)
+  .reads(readSet(
+    readRef("tuple", RelationTuple).pre()
+      .at(relationTupleInstanceId(signerObject(ADMISSION_CHECKPOINT_PRINCIPAL), SIGNER_RELATION)),
+  ))
+  .assert(({ tuple }, ctx) => {
+    const leaving = `key:${String(((ctx?.intent ?? {}) as { keyHash?: string }).keyHash ?? "")}`;
+    const subjects = ((tuple as { subjects?: Record<string, { status?: string }> } | undefined)?.subjects) ?? {};
+    const active = Object.entries(subjects).filter(([, leaf]) => leaf?.status === "active").map(([subject]) => subject);
+    if (!active.includes(leaving)) return { reject: "checkpoint-key-not-active" };
+    return active.some((subject) => subject !== leaving)
+      ? { accept: true }
+      : { reject: "last-checkpoint-key-cannot-be-revoked" };
+  });
+
 /**
  * THE SELF-BIND ENROLL (VA-1 / B2). A device enrolls a key for ITS OWN verified identity — the bound
  * principal is `ctx.principal()` (the captured authoring principal), NOT a payload field, so a device can
@@ -335,31 +439,36 @@ export const enrollSignerSelfRequiresVerified = workspaceInvariant("EnrollSigner
 
 // ─────────────────── THE ENROLL-ONCE DELEGATION CERT (the peer-sovereign root-of-trust) ───────────────────
 
-/**
- * THE SIGNER DELEGATION (the enroll-once delegation cert, `executor::birth_cert`). When the TENANT verifies a
- * user U's IdP token at U's live enroll gate, the tenant's onboarding signer `S_P` signs — ONCE — a
- * DELEGATION CERT binding U's device key `P_U` to the tenant's lineage: a `BirthCert {founder: U,
- * parent_key: P_U, …}` signed by `S_P`. This singleton (keyed by U) records it in the PLATFORM's folded
- * state, so the kernel's birth offer-effect reads U's delegation by-user (trusted, not from the payload) when
- * it assembles U's home cert chain. Every certificate member is stored as typed USDA fields; the kernel
- * reconstructs and verifies the nominal link signed by S_P, whose key is attested by the platform chain.
- *
- * SELF-BOUND / control-plane: enrolled by the tenant onboarding lane (composed into the tenant's governance
- * law, off the open session lane), so a tenant cannot forge a delegation for a user another tenant verified.
- * The delegation's `founder` IS the gate's binding — the kernel asserts the home cert's founder equals the
- * delegation's founder (the crux founder-binding), so a delegation enrolled for A cannot mint a home for V.
- *
- * Declared before `enrollFirstDevice` because that directive's typed effect signature and optional plan arm
- * both refer to this aggregate during module initialisation.
- */
+/** Delegation evidence is retained independently of the live signer relation. New law
+ * appends whole signed certificates by device and signature; it never replaces another
+ * device's evidence. Read-only predecessor fields keep existing typed custody readable
+ * during law adoption. The kernel's new lookup is declared by the compiled law. */
+/** The bounded, typed disclosure a parent workspace may carry when its law recovers a child device.
+ * Current cross-workspace law consumes only the nominal certificate fields and the exact signer key
+ * subject admitted by the parent. */
+export const signerDelegationRecoveryEvidence = z.object({
+  user: z.string().min(1),
+  deviceKeySubject: z.string().regex(/^key:[0-9a-f]{64}$/),
+  enrolledAt: z.string().min(1),
+  certificate: BirthDelegationCertificate.zod,
+}).strict();
+export type SignerDelegationRecoveryEvidence = z.infer<
+  typeof signerDelegationRecoveryEvidence
+>;
+
+
+const SignerDelegationEvidence = valueObject(
+  "SignerDelegationEvidence", signerDelegationRecoveryEvidence.shape,
+);
+
 export const SIGNER_DELEGATION_PREFIX = "signer-delegation:";
 export const SignerDelegation = aggregate("SignerDelegation", {
-  /** The user (a `user:<uid>` subject) this delegation enrolls — the key of the singleton. */
+  /** Grow by certificate identity. Each entry is one complete signed nominal value. */
+  certificates: t.map(SignerDelegationEvidence.field()).merge(MapOf(FirstWriterWins)),
+  /** Principal whose certificate collection this is. */
   user: t.string().merge(Lww),
-  /** The user's device PUBLIC KEY (base64) the delegation binds — `P_U`, the home_cert's signer. */
-  deviceKey: t.string().merge(Lww),
-  /** Legacy replay slot for histories authored before the typed certificate fields below. */
-  certJson: t.string().merge(Lww).optional(),
+  /** Read-only predecessor fields. Current enrollment/recovery plans never write these. */
+  deviceKey: t.string().merge(Lww).optional(),
   certificateChild: t.string().merge(Lww).optional(),
   certificateFounder: t.string().merge(Lww).optional(),
   certificateVerified: t.bool().merge(Lww).optional(),
@@ -374,49 +483,44 @@ export const SignerDelegation = aggregate("SignerDelegation", {
   certificateAuthProviderJwks: t.string().merge(Lww).optional(),
   certificateAuthProviderAudience: t.string().merge(Lww).optional(),
   /** ISO-8601, caller-stamped (determinism — no clock in the plan). */
-  enrolledAt: t.string().merge(Lww),
+  enrolledAt: t.string().merge(Lww).optional(),
 }).public();
 export type SignerDelegationHandle = typeof SignerDelegation;
 
-/** The bounded, typed disclosure a parent workspace may carry when its law recovers a child device.
- * It deliberately excludes the historical certJson slot: current cross-workspace law consumes only
- * the nominal certificate fields and the exact signer key subject admitted by the parent. */
-export const signerDelegationRecoveryEvidence = z.object({
-  user: z.string().min(1),
-  deviceKeySubject: z.string().regex(/^key:[0-9a-f]{64}$/),
-  enrolledAt: z.string().min(1),
-  certificate: birthCertificatePayload,
-}).strict();
-export type SignerDelegationRecoveryEvidence = z.infer<
-  typeof signerDelegationRecoveryEvidence
->;
+const formerSignerDelegation = formerAggregate(
+  "SignerDelegation",
+  ["certJson"] as const,
+);
 
-/** The deterministic singleton id of a user's signer delegation (the kernel reads THIS id by-user). */
+/** The old opaque certificate document has been replaced by the typed certificate
+ * members above. Carry the retirement in framework law so every composed domain
+ * proves the same transition without restoring a JSON compatibility slot. */
+export const signerDelegationCertJsonRetired = retirement(
+  formerSignerDelegation.fields.certJson,
+);
+
+/** Law-owned address of a user's certificate collection. */
 export function signerDelegationInstanceId(user: string): string {
   return SIGNER_DELEGATION_PREFIX + user;
 }
 
+/** Both encodings are fixed by the certificate contract. The signed identity makes retries
+ * address the same entry, while renewals and different device keys occupy distinct entries. */
+export function signerDelegationCertificateId(certificate: BirthCertificatePayload): string {
+  return `${certificate.parentKey}:${certificate.signature}`;
+}
+
 function writeDelegationCertificate(
   delegation: BoundAggregate<typeof SignerDelegation.id, typeof SignerDelegation.fields>,
-  certificate: BirthCertificatePayload,
+  evidence: SignerDelegationRecoveryEvidence,
   marker?: "ensures",
 ): PlannedOp[] {
-  const marked = (operation: FieldOp) => marker ? withMarker(operation, marker) : operation;
-  return [
-    marked(set(delegation, "certificateChild", certificate.child)),
-    marked(set(delegation, "certificateFounder", certificate.founder)),
-    marked(set(delegation, "certificateVerified", certificate.verified)),
-    marked(set(delegation, "certificateParentKey", certificate.parentKey)),
-    marked(set(delegation, "certificateParentId", certificate.parentId)),
-    marked(set(delegation, "certificateEpoch", certificate.epoch)),
-    marked(set(delegation, "certificateSignature", certificate.signature)),
-    ...(certificate.verifiedVia ? [marked(set(delegation, "certificateVerifiedVia", certificate.verifiedVia))] : []),
-    ...(certificate.idpToken ? [marked(set(delegation, "certificateIdpToken", certificate.idpToken))] : []),
-    ...(certificate.capturedClock === undefined ? [] : [marked(set(delegation, "certificateCapturedClock", certificate.capturedClock))]),
-    ...(certificate.authProviderIssuer ? [marked(set(delegation, "certificateAuthProviderIssuer", certificate.authProviderIssuer))] : []),
-    ...(certificate.authProviderJwks ? [marked(set(delegation, "certificateAuthProviderJwks", certificate.authProviderJwks))] : []),
-    ...(certificate.authProviderAudience ? [marked(set(delegation, "certificateAuthProviderAudience", certificate.authProviderAudience))] : []),
-  ];
+  if (evidence.user !== evidence.certificate.founder) {
+    throw new Error("signer-delegation-evidence-must-bind-its-founder");
+  }
+  const operation = setEntry(delegation, "certificates",
+    signerDelegationCertificateId(evidence.certificate), evidence);
+  return [marker ? withMarker(operation, marker) : operation];
 }
 
 /** Materialise the exact typed delegation disclosed by a parent during device
@@ -432,9 +536,7 @@ export function writeSignerDelegationRecoveryEvidence(
   );
   return [
     set(delegation, "user", evidence.user),
-    set(delegation, "deviceKey", evidence.deviceKeySubject),
-    set(delegation, "enrolledAt", evidence.enrolledAt),
-    ...writeDelegationCertificate(delegation, evidence.certificate),
+    ...writeDelegationCertificate(delegation, evidence),
   ];
 }
 
@@ -472,9 +574,6 @@ export const enrollFirstDevice = directive("enrollFirstDevice")
       /** THE CAPTURED PREMISE: the IdP's signed identity assertion (JWT), re-verified on every lane against
        *  the on-chain AuthProvider keys. */
       idpToken: z.string().min(1),
-      /** Legacy replay input for callers predating `delegationCertificate`. New callers must provide the
-       *  typed certificate below. */
-      delegationCert: z.string().min(1).optional(),
       /** THE KEYLESS DELEGATION CERT — the self-serve sibling of `enrollDelegation.certificate`. Built
        *  CLIENT-SIDE via the typed kernel sign operation: DEVICE-self-signed by this
        *  same device key `P_U` (parent_key == P_U), founder == `user:<uid>`, carrying `verifiedVia` +
@@ -506,28 +605,19 @@ export const enrollFirstDevice = directive("enrollFirstDevice")
     });
     // (2) fold the KEYLESS delegation cert as the user's `SignerDelegation` singleton (a SECONDARY ensures,
     // per-op marked — the id is deterministic-by-user, an upsert). This is the seed `birthHome` reads to
-    // assemble the warranted chain; without it the home is born headless (co2's block).
+    // assemble the warranted chain; without it the home is born without its founder's device seat (co2's block).
     // The delegation is keyed by the AUTHENTICATED principal — EXACTLY the `founder` the kernel's birth
     // offer-effect reads it back by (`read_signer_delegation(state, &founder)`, founder == captured principal
     // == this `rawPrincipal`, already in `user:<uid>` form). Do NOT re-prefix.
     // Absent certificate ⇒ enroll-only (no delegation seeded), byte-identical to a pre-B enroll.
-    if (!p.delegationCert && !p.delegationCertificate) return tupleOps;
+    if (!p.delegationCertificate) return tupleOps;
     const d = instance(SignerDelegation, signerDelegationInstanceId(rawPrincipal));
     const delegationOps: PlannedOp[] = [
       withMarker(set(d, "user", rawPrincipal), "ensures"),
-      withMarker(set(d, "deviceKey", "key:" + p.keyHash), "ensures"),
-      ...(p.delegationCertificate
-        ? [
-            withMarker(set(d, "enrolledAt", p.grantedAt), "ensures"),
-            ...writeDelegationCertificate(d, p.delegationCertificate, "ensures"),
-          ]
-        : [
-            // Exact legacy event order is replay identity, even though Lww folding would commute these
-            // two writes. Historical enrollFirstDevice intents wrote certJson before enrolledAt; retain
-            // that byte-level outcome when re-authoring an old payload under a candidate law.
-            withMarker(set(d, "certJson", p.delegationCert!), "ensures"),
-            withMarker(set(d, "enrolledAt", p.grantedAt), "ensures"),
-          ]),
+      ...writeDelegationCertificate(d, {
+        user: rawPrincipal, deviceKeySubject: "key:" + p.keyHash,
+        enrolledAt: p.grantedAt, certificate: p.delegationCertificate,
+      }, "ensures"),
     ];
     return [...tupleOps, ...delegationOps];
   })
@@ -590,7 +680,7 @@ export const enrollDelegation = directive("enrollDelegation")
   .payload(
     z.object({
       user: z.string().min(1), // the user:<uid> the delegation enrolls
-      deviceKey: z.string().min(1), // base64 P_U — the user's device public key
+      deviceKey: z.string().regex(/^key:[0-9a-f]{64}$/), // enrolled public-key fingerprint
       certificate: birthCertificatePayload,
       enrolledAt: z.string().min(1), // ISO-8601, caller-stamped
     }),
@@ -599,19 +689,62 @@ export const enrollDelegation = directive("enrollDelegation")
     const d = instance(SignerDelegation, signerDelegationInstanceId(p.user));
     return [
       set(d, "user", p.user),
-      set(d, "deviceKey", p.deviceKey),
-      set(d, "enrolledAt", p.enrolledAt),
-      ...writeDelegationCertificate(d, p.certificate),
+      ...writeDelegationCertificate(d, {
+        user: p.user, deviceKeySubject: p.deviceKey,
+        enrolledAt: p.enrolledAt, certificate: p.certificate,
+      }),
     ];
   });
 
+/** Retention is a law invariant, not a promise made by a scalar merge driver. */
+function sameEvidenceValue(left: unknown, right: unknown): boolean {
+  if (left === right) return true;
+  if (left === null || right === null || typeof left !== "object" || typeof right !== "object") return false;
+  const a = left as Record<string, unknown>, b = right as Record<string, unknown>;
+  const keys = Object.keys(a);
+  return keys.length === Object.keys(b).length && keys.every((key) =>
+    Object.prototype.hasOwnProperty.call(b, key) && sameEvidenceValue(a[key], b[key]));
+}
+
+export function signerDelegationEvidenceIsRetained(
+  name: string, directiveId: string, userPayloadPath: string,
+) {
+  return workspaceInvariant(name).on(directiveId).reads(readSet(
+    readRef("before", SignerDelegation).pre().fromOptionalPayload(userPayloadPath, { prefix: SIGNER_DELEGATION_PREFIX }),
+    readRef("after", SignerDelegation).post().fromOptionalPayload(userPayloadPath, { prefix: SIGNER_DELEGATION_PREFIX }),
+  )).assert(({ before, after }) => {
+    const oldEntries = (before?.certificates ?? {}) as Record<string, unknown>;
+    const newEntries = (after?.certificates ?? {}) as Record<string, unknown>;
+    if (!Object.entries(oldEntries).every(([id, value]) => sameEvidenceValue(value, newEntries[id]))) {
+      return { reject: "signer-delegation-evidence-is-immutable" };
+    }
+    for (const [id, value] of Object.entries(newEntries)) {
+      const parsed = signerDelegationRecoveryEvidence.safeParse(value);
+      if (!parsed.success || parsed.data.user !== after?.user ||
+          parsed.data.certificate.founder !== parsed.data.user ||
+          signerDelegationCertificateId(parsed.data.certificate) !== id) {
+        return { reject: "signer-delegation-evidence-must-bind-its-identity" };
+      }
+    }
+    return { accept: true };
+  });
+}
+
+export const enrollDelegationRetainsEvidence = signerDelegationEvidenceIsRetained(
+  "EnrollDelegationRetainsEvidence", "enrollDelegation", "user",
+);
+export const enrollFirstDeviceRetainsEvidence = signerDelegationEvidenceIsRetained(
+  "EnrollFirstDeviceRetainsEvidence", "enrollFirstDevice", "delegationCertificate.founder",
+);
+
 /** Audit: a user's signer delegation (the enroll-once cert binding their device to the tenant lineage). */
 export const signerDelegationByUser = query("signerDelegationByUser").key("user").returns(SignerDelegation);
 
-/** Read exactly one current typed delegation through its declared O(1) index. Missing or incomplete
- * typed certificate members fail closed; no legacy document is parsed or carried. */
+/** Read the exact device's evidence through the law's declared user index. A caller that
+ * omits the device is accepted only for a single-device collection; never pick another device. */
 export function readSignerDelegationRecoveryEvidence(
   user: string,
+  deviceKeySubject?: string,
 ): SignerDelegationRecoveryEvidence | undefined {
   const rows = readFrameworkDeclaredRows(
     signerDelegationByUser,
@@ -625,7 +758,10 @@ export function readSignerDelegationRecoveryEvidence(
     );
   }
   const row = rows[0]!;
-  return signerDelegationRecoveryEvidence.parse({
+  const candidates = Object.values(row.certificates ?? {}).map((value) =>
+    signerDelegationRecoveryEvidence.parse(value));
+  // Old typed fields are a read-only predecessor. New law never writes them again.
+  if (row.certificateSignature !== undefined) candidates.push(signerDelegationRecoveryEvidence.parse({
     user: row.user,
     deviceKeySubject: row.deviceKey,
     enrolledAt: row.enrolledAt,
@@ -650,7 +786,18 @@ export function readSignerDelegationRecoveryEvidence(
         ? {}
         : { authProviderAudience: row.certificateAuthProviderAudience }),
     },
-  });
+  }));
+  const matching = candidates.filter((candidate) => candidate.user === user &&
+    (deviceKeySubject === undefined || candidate.deviceKeySubject === deviceKeySubject));
+  if (new Set(matching.map((candidate) => candidate.deviceKeySubject)).size > 1) {
+    throw new Error(`signerDelegationByUser('${user}') requires an exact device key`);
+  }
+  // Renewal selection is explicit and deterministic; unrelated devices cannot influence it.
+  matching.sort((a, b) => b.certificate.epoch - a.certificate.epoch ||
+    (b.certificate.capturedClock ?? 0) - (a.certificate.capturedClock ?? 0) ||
+    (a.certificate.signature < b.certificate.signature ? -1 :
+      a.certificate.signature > b.certificate.signature ? 1 : 0));
+  return matching[0];
 }
 
 /** Audit: the signer tuples for an identity (the raw relation aggregate). */

package/src/framework/source_roster.ts

@@ -28,6 +28,8 @@ import { directive, type Directive } from "../directive.js";
 import { set } from "../ops.js";
 import { read } from "../read.js";
 import { foreignQuery } from "../attested_core.js";
+import { valueObject } from "../value_object.js";
+import { RelationshipSubjectValue } from "./relations.js";
 
 /** The framework-reserved roster instance-id prefix (kernel mirror:
  *  `nomos_executor::SOURCE_ROSTER_PREFIX`). */
@@ -43,16 +45,20 @@ export const ATTESTOR_ROSTER_QUERY_ID = "attestorRoster";
 
 /**
  * NomosSourceRoster (§1.5) — the reader's folded mirror of one source's read-attestor
- * roster, keyed by the source's TRUE identity (`source-roster:<genesis>`). `rosterJson` is
+ * roster, keyed by the source's TRUE identity (`source-roster:<genesis>`). `roster` is
  * the `keyHash → leaf` map exactly as the source's signer chain folds it (a key is ACCEPTED
  * iff its leaf's `status == "active"` — the position-aware revocation mirror); the kernel's
  * `accepted_keys` reads THIS under `roster: "tracked"`.
  */
+export const SourceSignerRoster = valueObject("SourceSignerRoster", {
+  keys: z.record(z.string(), RelationshipSubjectValue.zod),
+});
+
 export const NomosSourceRoster = aggregate("NomosSourceRoster", {
   /** The routable source name the edge was declared under (diagnostics). */
   source: t.string().merge(Lww),
-  /** The `keyHash → enrollment leaf` map, JSON — as attested by the source's own chain. */
-  rosterJson: t.json().merge(Lww),
+  /** The typed `keyHash → enrollment leaf` map attested by the source's own chain. */
+  roster: SourceSignerRoster.field().merge(Lww),
   /** The source's `SignerEpoch` at the attested sync. */
   currentEpoch: t.int().merge(Lww),
 }).public();
@@ -63,7 +69,7 @@ interface AttestorRosterRow {
   data: {
     genesis: string;
     currentEpoch: number;
-    keys: Record<string, unknown>;
+    keys: Record<string, z.infer<typeof RelationshipSubjectValue.zod>>;
   };
 }
 
@@ -88,7 +94,7 @@ export function sourceRosterSync(sourceWs: string, directiveId = "syncSourceRost
       const r = instance(NomosSourceRoster, sourceRosterId(d.genesis));
       return [
         set(r, "source", sourceWs),
-        set(r, "rosterJson", JSON.stringify(d.keys ?? {})),
+        set(r, "roster", { keys: d.keys ?? {} }),
         set(r, "currentEpoch", d.currentEpoch ?? 0),
       ];
     })