@githolon/dsl 0.113.4 → 0.115.0

package/src/baseline_import.ts

@@ -0,0 +1,312 @@
+// NOMOS — IMPORT A PINNED BASELINE INTO A COMPILE (architecture/domain_release_lifecycle.md, step 1).
+//
+// The ledger (`nomos.identity.usda`) is the compiler's continuity; the baseline (baseline_usda.ts) is
+// what released custody proves. A publishable compile starts from their agreement:
+//
+//   * an identity the release carries that the ledger lacks is IMPORTED — a clean checkout, or a ledger
+//     that never saw the release, still allocates the released sid and wire key, never a fresh one;
+//   * an identity the ledger carries under the same key keeps its released label lineage and status,
+//     or the compile REFUSES: a branch that allocated its own sid for a label the release allocated
+//     differently, or retired what the release serves, cannot publish over it by accident;
+//   * an operation field's released wire key must be the ledger's canonical key, with every released
+//     alias retained, or the compile REFUSES: generated clients would otherwise encode keys installed
+//     law does not decode (the 1 October 2026 incident).
+//
+// Refusals are typed (`BaselineRefusal.code`) so `githolon check` and `githolon compile` name the
+// same reason, and a release lane can gate on the code rather than the prose.
+import {
+  LAW_FRAMEWORK_PARENT,
+  createLawIdentityReconciler,
+  validateLawIdentityRegistry,
+  type LawIdentityEntity,
+  type LawIdentityRegistry,
+} from "./law_identity.js";
+import { NOMOS_BASELINE_FILENAME, baselineSha256, type ReleasedBaseline } from "./baseline_usda.js";
+
+export type BaselineRefusalCode =
+  /** A publishable compile names no baseline. */
+  | "baseline-required"
+  /** The pinned artifact's bytes are not the pinned content address. */
+  | "baseline-pin-mismatch"
+  /** The artifact is not a readable baseline. */
+  | "baseline-unreadable"
+  /** The baseline carries none of this package's domains: it was exported from another package. */
+  | "baseline-wrong-package"
+  /** The ledger and the release disagree about which sid a declaration owns, or what it is called. */
+  | "baseline-identity-divergence"
+  /** The release retired a declaration the ledger still serves. */
+  | "baseline-retirement-divergence"
+  /** The ledger's canonical wire key or aliases for a released operation field differ. */
+  | "baseline-wire-divergence"
+  /** The candidate re-allocated a released identity or wire key after import. */
+  | "baseline-reallocation";
+
+export class BaselineRefusal extends Error {
+  readonly code: BaselineRefusalCode;
+  /** One line per disagreement, each naming the coordinate, the released value and the local value. */
+  readonly details: readonly string[];
+  constructor(code: BaselineRefusalCode, message: string, details: readonly string[] = []) {
+    super(details.length === 0 ? message : `${message}\n${details.map((detail) => `  - ${detail}`).join("\n")}`);
+    this.code = code;
+    this.details = details;
+  }
+}
+
+export interface BaselinePin {
+  /** Path of the artifact, relative to `nomos.project.ts`. */
+  readonly artifact: string;
+  /** Its content address (baseline_usda.ts `baselineSha256`). */
+  readonly sha256: string;
+}
+
+/** The pin must name the exact bytes: a baseline edited by hand is not the one that was exported. */
+export function verifyBaselinePin(text: string, pin: BaselinePin): void {
+  const actual = baselineSha256(text);
+  if (actual !== pin.sha256) {
+    throw new BaselineRefusal(
+      "baseline-pin-mismatch",
+      `${pin.artifact} is ${actual}, not the pinned ${pin.sha256}: re-export the baseline from the release you intend to extend and pin its sha256`,
+    );
+  }
+}
+
+export interface BaselineImport {
+  readonly registry: LawIdentityRegistry;
+  /** Registry keys the baseline added (absent from the ledger). */
+  readonly imported: readonly string[];
+  /** Registry keys whose released label lineage the ledger was behind on and now carries. */
+  readonly relabelled: readonly string[];
+  /** Operation-field coordinates whose released allocation the ledger now carries. */
+  readonly allocated: readonly string[];
+  /** Entities and allocations the ledger already agreed with. */
+  readonly verified: number;
+}
+
+const compareText = (a: string, b: string): number => (a < b ? -1 : a > b ? 1 : 0);
+const coordinateOf = (entity: Pick<LawIdentityEntity, "kind" | "parent" | "label">): string =>
+  `${entity.kind} '${entity.label}' in ${entity.parent ?? "@root"}`;
+
+function activeAt(
+  entities: Readonly<Record<string, LawIdentityEntity>>,
+  kind: LawIdentityEntity["kind"],
+  parent: string | undefined,
+  labels: readonly string[],
+): [string, LawIdentityEntity] | undefined {
+  return Object.entries(entities).find(([, entity]) =>
+    entity.kind === kind && entity.parent === parent && entity.status === "active" &&
+    (labels.includes(entity.label) || entity.priorLabels?.some((prior) => labels.includes(prior)) === true));
+}
+
+/** Parents first, so every imported child finds its parent already in the registry. */
+function orderByParent(entities: Readonly<Record<string, LawIdentityEntity>>): [string, LawIdentityEntity][] {
+  const ordered: [string, LawIdentityEntity][] = [];
+  const placed = new Set<string>();
+  const place = (key: string, trail: ReadonlySet<string>): void => {
+    if (placed.has(key)) return;
+    const entity = entities[key];
+    if (entity === undefined) return;
+    const parent = entity.parent;
+    if (parent !== undefined && parent !== LAW_FRAMEWORK_PARENT && !trail.has(key)) place(parent, new Set(trail).add(key));
+    placed.add(key);
+    ordered.push([key, entity]);
+  };
+  for (const key of Object.keys(entities).sort(compareText)) place(key, new Set());
+  return ordered;
+}
+
+/**
+ * Verify the ledger against the baseline and return the registry a compile starts from. Throws a
+ * typed {@link BaselineRefusal} on the first class of disagreement found, listing every instance.
+ * `packageDomains` are the domain keys this compile declares (`nomos.project.ts`).
+ */
+export function importBaseline(
+  ledger: LawIdentityRegistry,
+  baseline: ReleasedBaseline,
+  packageDomains: readonly string[],
+): BaselineImport {
+  validateLawIdentityRegistry(ledger);
+  const released = baseline.continuity.identity?.entities ?? {};
+
+  const releasedDomains = Object.values(released).filter((entity) => entity.kind === "domain");
+  const servesPackage = releasedDomains.some((domain) =>
+    packageDomains.includes(domain.label) || domain.priorLabels?.some((prior) => packageDomains.includes(prior)) === true);
+  if (!servesPackage) {
+    throw new BaselineRefusal(
+      "baseline-wrong-package",
+      `${NOMOS_BASELINE_FILENAME} (release ${baseline.release}, law ${baseline.unitSet}) carries domain(s) ` +
+        `${releasedDomains.map((domain) => `'${domain.label}'`).join(", ") || "none"}, not this package's ` +
+        `${packageDomains.map((domain) => `'${domain}'`).join(", ")}: pin the baseline exported from this package's release`,
+    );
+  }
+
+  const entities: Record<string, LawIdentityEntity> = Object.fromEntries(
+    Object.entries(ledger.entities).map(([key, entity]) => [key, { ...entity }]),
+  );
+  const imported: string[] = [];
+  const relabelled: string[] = [];
+  const identityDivergence: string[] = [];
+  const retirementDivergence: string[] = [];
+  let verified = 0;
+
+  for (const [key, releasedEntity] of orderByParent(released)) {
+    const lineage = [releasedEntity.label, ...(releasedEntity.priorLabels ?? [])];
+    const local = entities[key];
+    if (local !== undefined) {
+      if (local.kind !== releasedEntity.kind) {
+        identityDivergence.push(`${key}: released as ${releasedEntity.kind}, ledgered as ${local.kind}`);
+        continue;
+      }
+      if (releasedEntity.status === "retired" && local.status === "active") {
+        retirementDivergence.push(`${key} (${coordinateOf(releasedEntity)}): retired by the release, active in the ledger`);
+        continue;
+      }
+      if (local.label === releasedEntity.label || local.priorLabels?.includes(releasedEntity.label) === true) {
+        verified += 1;
+        continue;
+      }
+      if (releasedEntity.priorLabels?.includes(local.label) === true) {
+        // The ledger predates a released rename: carry the released lineage so the compile resolves
+        // the current label to this sid instead of minting a successor.
+        const priorLabels = [...new Set([...(local.priorLabels ?? []), ...(releasedEntity.priorLabels ?? [])])]
+          .filter((prior) => prior !== releasedEntity.label);
+        entities[key] = { ...local, label: releasedEntity.label, ...(priorLabels.length > 0 ? { priorLabels } : {}) };
+        relabelled.push(key);
+        continue;
+      }
+      identityDivergence.push(
+        `${key}: released as '${releasedEntity.label}'${releasedEntity.priorLabels ? ` (was ${releasedEntity.priorLabels.join(", ")})` : ""}, ` +
+          `ledgered as '${local.label}'${local.priorLabels ? ` (was ${local.priorLabels.join(", ")})` : ""}`,
+      );
+      continue;
+    }
+    // Absent from the ledger. The same coordinate owned by another sid locally is the branch-divergence
+    // case: this checkout allocated its own identity for a label the release allocated differently.
+    const occupied = activeAt(entities, releasedEntity.kind, releasedEntity.parent, lineage);
+    if (occupied !== undefined && releasedEntity.status === "active") {
+      identityDivergence.push(
+        `${coordinateOf(releasedEntity)}: the release carries ${key}, this ledger allocated ${occupied[0]}`,
+      );
+      continue;
+    }
+    const parent = releasedEntity.parent;
+    if (parent !== undefined && parent !== LAW_FRAMEWORK_PARENT && entities[parent] === undefined) {
+      // Its parent diverged above; that refusal names the cause.
+      continue;
+    }
+    if (parent !== undefined && parent !== LAW_FRAMEWORK_PARENT && entities[parent]!.status !== "active" && releasedEntity.status === "active") {
+      // The ledger retired the parent after the release: the candidate is ahead, not divergent. The
+      // evolution gate judges that retirement; nothing to import beneath a tombstone.
+      continue;
+    }
+    entities[key] = { ...releasedEntity };
+    imported.push(key);
+  }
+
+  if (identityDivergence.length > 0) {
+    throw new BaselineRefusal(
+      "baseline-identity-divergence",
+      `the identity ledger disagrees with release ${baseline.release} (law ${baseline.unitSet}) about ${identityDivergence.length} ` +
+        "declaration(s); reconcile the ledger with the branch that released them, or pin the baseline of the release this branch extends",
+      identityDivergence,
+    );
+  }
+  if (retirementDivergence.length > 0) {
+    throw new BaselineRefusal(
+      "baseline-retirement-divergence",
+      `release ${baseline.release} retired ${retirementDivergence.length} declaration(s) this ledger still serves; ` +
+        "a retired identity cannot be revived — declare the retirement in the ledger's branch or pin the baseline this branch extends",
+      retirementDivergence,
+    );
+  }
+
+  // Wire allocations: by ledger coordinate (intent, field label), never by the `u_` key — the ledger's
+  // generation for an operation field is not recoverable from released law.
+  const wireDivergence: string[] = [];
+  const allocated: string[] = [];
+  const reconciler = createLawIdentityReconciler({ v: 1, entities });
+  let registry: LawIdentityRegistry = { v: 1, entities };
+  for (const allocation of [...baseline.wireAllocations].sort((l, r) => compareText(l.intent, r.intent) || compareText(l.field, r.field))) {
+    const intent = registry.entities[allocation.intent];
+    if (intent === undefined || intent.status !== "active") continue; // the intent diverged or was retired: judged above / by evolution
+    const local = activeAt(registry.entities, "operation-field", allocation.intent, [allocation.field]);
+    if (local !== undefined) {
+      const wire = local[1].operationFieldWire?.protobuf;
+      if (wire === undefined) {
+        wireDivergence.push(`${intent.label}.${allocation.field}: released on ${allocation.protobuf.canonical}, ledgered without a wire allocation`);
+        continue;
+      }
+      if (wire.canonical !== allocation.protobuf.canonical) {
+        wireDivergence.push(`${intent.label}.${allocation.field}: released on ${allocation.protobuf.canonical}, ledgered on ${wire.canonical}`);
+        continue;
+      }
+      const missingAliases = (allocation.protobuf.aliases ?? []).filter((alias) => !(wire.aliases ?? []).includes(alias));
+      if (missingAliases.length > 0) {
+        wireDivergence.push(`${intent.label}.${allocation.field}: released alias(es) ${missingAliases.join(", ")} are not retained by the ledger`);
+        continue;
+      }
+      verified += 1;
+      continue;
+    }
+    const retired = Object.values(registry.entities).some((entity) =>
+      entity.kind === "operation-field" && entity.parent === allocation.intent && entity.status === "retired" &&
+      (entity.label === allocation.field || entity.priorLabels?.includes(allocation.field) === true));
+    if (retired) continue; // the candidate dropped the field after the release; the evolution lane judges it
+    const result = reconciler.reconcile({
+      kind: "operation-field",
+      parent: allocation.intent,
+      labels: [allocation.field],
+      preferredOperationFieldWire: { [allocation.field]: { protobuf: allocation.protobuf } },
+      retireAbsent: false,
+    });
+    registry = result.registry;
+    allocated.push(`${intent.label}.${allocation.field}`);
+  }
+  if (wireDivergence.length > 0) {
+    throw new BaselineRefusal(
+      "baseline-wire-divergence",
+      `${wireDivergence.length} operation field(s) would encode wire keys release ${baseline.release} (law ${baseline.unitSet}) does not serve; ` +
+        "generated clients and installed law would disagree — restore the released allocation, or evolve it with a declared alias window",
+      wireDivergence,
+    );
+  }
+  const finished = reconciler.finish();
+  return { registry: finished, imported: imported.sort(compareText), relabelled: relabelled.sort(compareText), allocated, verified };
+}
+
+/**
+ * After reconciliation: every released identity still resolves to its released sid and every released
+ * wire allocation is still the canonical key. Reconciliation never rewrites an existing allocation, so
+ * this is the compile's own proof that nothing it did re-allocated released continuity.
+ */
+export function assertBaselineRetained(final: LawIdentityRegistry, baseline: ReleasedBaseline): void {
+  const details: string[] = [];
+  for (const [key, releasedEntity] of Object.entries(baseline.continuity.identity?.entities ?? {})) {
+    if (releasedEntity.status !== "active") continue;
+    const local = final.entities[key];
+    if (local === undefined) {
+      details.push(`${coordinateOf(releasedEntity)}: released ${key} is absent after reconciliation`);
+      continue;
+    }
+    if (local.status !== "active") continue; // retired by a declared candidate-law retirement; the evolution gate judged it
+    const lineage = [releasedEntity.label, ...(releasedEntity.priorLabels ?? [])];
+    const occupant = activeAt(final.entities, releasedEntity.kind, local.parent, lineage);
+    if (occupant !== undefined && occupant[0] !== key) {
+      details.push(`${coordinateOf(releasedEntity)}: released ${key}, the candidate resolved ${occupant[0]}`);
+    }
+  }
+  for (const allocation of baseline.wireAllocations) {
+    const local = activeAt(final.entities, "operation-field", allocation.intent, [allocation.field]);
+    if (local === undefined) continue;
+    const canonical = local[1].operationFieldWire?.protobuf.canonical;
+    if (canonical !== allocation.protobuf.canonical) {
+      details.push(`${final.entities[allocation.intent]?.label ?? allocation.intent}.${allocation.field}: released on ${allocation.protobuf.canonical}, candidate on ${canonical ?? "nothing"}`);
+    }
+  }
+  if (details.length > 0) {
+    throw new BaselineRefusal(
+      "baseline-reallocation",
+      `the candidate re-allocated ${details.length} released identity/wire allocation(s)`,
+      details,
+    );
+  }
+}

package/src/baseline_usda.ts

@@ -0,0 +1,186 @@
+// NOMOS — THE RELEASED BASELINE ARTIFACT (architecture/domain_release_lifecycle.md, build step 1).
+//
+// A baseline is the continuity a publishable compile must start from: the identities, label lineage,
+// declared retirements and operation wire allocations that released custody actually carries, named
+// by the release / unit set they were exported from. It is content-addressed (its sha256 is the pin
+// `nomos.project.ts` names), deterministic (two exports of the same units are byte-identical) and
+// verifiable (export re-derives every unit hash from the bytes before it reads a single opinion).
+//
+// It is NOT the identity ledger. `nomos.identity.usda` keeps value contracts, merge drivers and every
+// historical tombstone the compiler ever minted; released law carries none of that. The baseline
+// anchors the ledger to custody: a compile that pins one refuses when its ledger would allocate an
+// identity or wire key that disagrees with what was released (baseline_import.ts).
+//
+// Typed USDA, like everything Nomos remembers: the identity scopes are the identity layer's own
+// encoding (identity_usda.ts `renderIdentityScopes`), hosted under `NomosBaseline` beside the
+// provenance and wire-allocation scopes this artifact adds.
+import { createHash } from "node:crypto";
+import type { CompilerIdentityModel } from "./identity_model.js";
+import {
+  NOMOS_IDENTITY_ENTITY_SCHEMA,
+  parseIdentityPrims,
+  readIdentityScopes,
+  renderIdentityScopes,
+  type IdentityPrim,
+} from "./identity_usda.js";
+import type { LawOperationFieldWire } from "./law_identity.js";
+
+export const NOMOS_BASELINE_FORMAT = "nomos.baseline.v1";
+/** The pinned baseline's conventional filename, beside `nomos.project.ts`. */
+export const NOMOS_BASELINE_FILENAME = "nomos.baseline.usda";
+/** The baseline's own "no release" marker, matching release_publication.ts `NO_PREDECESSOR`. */
+export const BASELINE_NO_RELEASE = "none";
+
+export type BaselineSource = "release" | "installed" | "units";
+
+/** One operation field's released transport allocation, by its ledger coordinate. */
+export interface BaselineWireAllocation {
+  /** The owning intent's registry key (`i_<sid>`). */
+  readonly intent: string;
+  /** The field's ledger label: a top-level payload name or a nested path (law_graph.ts `nestedWirePath`). */
+  readonly field: string;
+  readonly protobuf: LawOperationFieldWire["protobuf"];
+}
+
+export interface ReleasedBaseline {
+  readonly format: typeof NOMOS_BASELINE_FORMAT;
+  readonly source: BaselineSource;
+  /** The release identity (release_publication.ts) or {@link BASELINE_NO_RELEASE}. */
+  readonly release: string;
+  readonly series: string;
+  readonly predecessor: string;
+  /** THE LAW IDENTITY the baseline was read from (law_unit_set_identity.ts). */
+  readonly unitSet: string;
+  readonly units: readonly { readonly key: string; readonly unitHash: string }[];
+  /** For `installed`: the workspace whose installed law named these units, and the head observed. */
+  readonly workspace: string;
+  readonly workspaceHead: string;
+  /** Identities, lineage and declared retirements, in the identity layer's own model. */
+  readonly continuity: CompilerIdentityModel;
+  readonly wireAllocations: readonly BaselineWireAllocation[];
+}
+
+function quote(value: string): string {
+  return JSON.stringify(value);
+}
+const stringList = (items: readonly string[]): string => `[${items.map(quote).join(", ")}]`;
+const byteOrder = (left: string, right: string): number => (left < right ? -1 : left > right ? 1 : 0);
+
+/** The baseline's content address: sha256 of its exact bytes. */
+export function baselineSha256(text: string): string {
+  return createHash("sha256").update(text, "utf8").digest("hex");
+}
+
+export function isBaselineUsda(text: string): boolean {
+  return text.startsWith("#usda") && text.includes(`"nomos:format" = ${quote(NOMOS_BASELINE_FORMAT)}`);
+}
+
+/** Render the baseline. Deterministic: units, allocations and every identity map are sorted. */
+export function serializeBaselineUsda(baseline: Omit<ReleasedBaseline, "format">): string {
+  const units = [...baseline.units].sort((l, r) => byteOrder(l.key, r.key));
+  const allocations = [...baseline.wireAllocations].sort(
+    (l, r) => byteOrder(l.intent, r.intent) || byteOrder(l.field, r.field),
+  );
+  return [
+    "#usda 1.0",
+    "(",
+    '    defaultPrim = "NomosBaseline"',
+    "    customLayerData = {",
+    `        string "nomos:format" = ${quote(NOMOS_BASELINE_FORMAT)}`,
+    "    }",
+    ")",
+    "",
+    NOMOS_IDENTITY_ENTITY_SCHEMA,
+    "",
+    'def Scope "NomosBaseline"',
+    "{",
+    `    custom uniform string nomos:source = ${quote(baseline.source)}`,
+    `    custom uniform string nomos:release = ${quote(baseline.release)}`,
+    `    custom uniform string nomos:series = ${quote(baseline.series)}`,
+    `    custom uniform string nomos:predecessor = ${quote(baseline.predecessor)}`,
+    `    custom uniform string nomos:unitSet = ${quote(baseline.unitSet)}`,
+    `    custom uniform string nomos:workspace = ${quote(baseline.workspace)}`,
+    `    custom uniform string nomos:workspaceHead = ${quote(baseline.workspaceHead)}`,
+    '    def Scope "Units"',
+    "    {",
+    ...units.flatMap((unit, index) => [
+      `        def Scope ${quote(`u_${String(index).padStart(4, "0")}`)}`,
+      "        {",
+      `            custom uniform string nomos:key = ${quote(unit.key)}`,
+      `            custom uniform string nomos:unitHash = ${quote(unit.unitHash)}`,
+      "        }",
+    ]),
+    "    }",
+    '    def Scope "WireAllocations"',
+    "    {",
+    ...allocations.flatMap((allocation, index) => [
+      `        def Scope ${quote(`w_${String(index).padStart(6, "0")}`)}`,
+      "        {",
+      `            custom uniform string nomos:intent = ${quote(allocation.intent)}`,
+      `            custom uniform string nomos:field = ${quote(allocation.field)}`,
+      `            custom uniform string nomos:protobufCanonicalWireKey = ${quote(allocation.protobuf.canonical)}`,
+      ...(allocation.protobuf.aliases === undefined || allocation.protobuf.aliases.length === 0
+        ? []
+        : [`            custom uniform string[] nomos:protobufWireAliases = ${stringList(allocation.protobuf.aliases)}`]),
+      "        }",
+    ]),
+    "    }",
+    '    def Scope "Continuity"',
+    "    {",
+    ...renderIdentityScopes(baseline.continuity, 8),
+    "    }",
+    "}",
+    "",
+  ].join("\n");
+}
+
+function attr(prim: IdentityPrim, name: string): string {
+  const value = prim.attrs[name];
+  if (typeof value !== "string") throw new Error(`${NOMOS_BASELINE_FILENAME} prim ${prim.name} lacks nomos:${name}`);
+  return value;
+}
+
+/** Read a baseline back. Refuses anything that is not this exact format. */
+export function parseBaselineUsda(text: string): ReleasedBaseline {
+  if (!isBaselineUsda(text)) {
+    throw new Error(`${NOMOS_BASELINE_FILENAME} is not ${NOMOS_BASELINE_FORMAT} — refusing to guess a baseline encoding`);
+  }
+  const roots = parseIdentityPrims(text, NOMOS_BASELINE_FILENAME);
+  const root = roots.find((prim) => prim.name === "NomosBaseline");
+  if (root === undefined) throw new Error(`${NOMOS_BASELINE_FILENAME} has no NomosBaseline prim`);
+  const child = (name: string): IdentityPrim | undefined => root.children.find((prim) => prim.name === name);
+  const source = attr(root, "source");
+  if (source !== "release" && source !== "installed" && source !== "units") {
+    throw new Error(`${NOMOS_BASELINE_FILENAME} names unknown source '${source}'`);
+  }
+  const units = (child("Units")?.children ?? []).map((prim) => ({
+    key: attr(prim, "key"),
+    unitHash: attr(prim, "unitHash"),
+  }));
+  const wireAllocations = (child("WireAllocations")?.children ?? []).map((prim) => {
+    const aliases = prim.attrs.protobufWireAliases;
+    return {
+      intent: attr(prim, "intent"),
+      field: attr(prim, "field"),
+      protobuf: {
+        canonical: attr(prim, "protobufCanonicalWireKey"),
+        ...(Array.isArray(aliases) && aliases.length > 0 ? { aliases: aliases as string[] } : {}),
+      },
+    };
+  });
+  const continuityPrim = child("Continuity");
+  if (continuityPrim === undefined) throw new Error(`${NOMOS_BASELINE_FILENAME} has no Continuity scope`);
+  return {
+    format: NOMOS_BASELINE_FORMAT,
+    source,
+    release: attr(root, "release"),
+    series: attr(root, "series"),
+    predecessor: attr(root, "predecessor"),
+    unitSet: attr(root, "unitSet"),
+    units,
+    workspace: attr(root, "workspace"),
+    workspaceHead: attr(root, "workspaceHead"),
+    continuity: readIdentityScopes(continuityPrim, NOMOS_BASELINE_FILENAME),
+    wireAllocations,
+  };
+}