@githolon/dsl 0.113.4 → 0.115.0

package/src/births.ts

@@ -4,10 +4,19 @@
 // QuickJS engine}.  If a file isn't this / hosting this / authoring for this / proving this — it's gone.
 
 import { z } from "zod";
-import type { AggregateHandle } from "./aggregate.js";
+import { __declareBirthKeyWriteOnce, type AggregateHandle } from "./aggregate.js";
 import type { AggregateRef } from "./authoring.js";
 import type { Ports } from "./ctx.js";
-import type { Field, FieldValue, NomosRefValue } from "./fields.js";
+import {
+  CANONICAL_UUID_RE,
+  isUuidIdSchema,
+  typedIdShapeRefusal,
+  type Field,
+  type FieldValue,
+  type NomosRefValue,
+  type TypedId,
+} from "./fields.js";
+import { brandedIdMetaOf } from "./value_object.js";
 import {
   object,
   relationType,
@@ -42,6 +51,10 @@ export interface BirthRecipe {
   /** Target-owned roles granted at genesis to the cryptographically verified immediate parent workspace.
    * Values are law constants; the kernel supplies the parent workspace id after verifying the birth. */
   readonly parentWorkspaceRoles?: readonly WorkspaceRole[];
+  /** The typed key the {@link workspace} name hashes (`workspaceNameForKey(namespace, birthKey)`). Carried
+   * on the recipe (`nomos:birthKey`) by a business birth whose law declares its key type, so the kernel can
+   * check the key's shape and re-derive the name. Absent on every other recipe (historical law included). */
+  readonly birthKey?: string;
 }
 
 declare const WORKSPACE_ROLE: unique symbol;
@@ -129,13 +142,20 @@ export interface BusinessBirthDecl<
   readonly __isBusinessBirth: true;
   readonly aggregate: AggregateHandle<string, F>;
   readonly payloadSchema: z.ZodObject<z.ZodRawShape> & z.ZodType<P>;
-  /** A stable business key the caller already knows (an estate reference, account number, etc.). */
+  /** How this birth's workspace name is keyed (see `architecture/choosing_a_birth_key.md`). `"minted"` —
+   * the default — keys the name by a Nomos-minted id drawn inside the birth itself; `"field"` keys it by one
+   * declared, birth-only TYPED ID fact. */
+  readonly keyMode: "minted" | "field";
+  /** The key's typed-id family and brand (the kernel's era-ruled `nomos:birthKeyType` declaration). */
+  readonly keyType: Omit<BirthKeyDeclaration, "namespace">;
+  /** The declared business key of a `"field"`-keyed birth. A `"minted"` birth has no business key:
+   * calling this throws, because its name is drawn by Nomos when the birth runs. */
   readonly key: (payload: P) => string;
-  /** The complete custody address this declaration gives the born root.
-   * Carry it in parent projections instead of reconstructing workspace names in tenant code. */
+  /** The complete custody address a `"field"`-keyed birth gives the born root. A `"minted"` birth's
+   * address is the born workspace its birth returns (carry that `NomosRef`); calling this throws. */
   readonly reference: (payload: P) => NomosRefValue;
-  /** The declared business fact used by {@link key}; retained for generated clients to pre-address custody. */
-  readonly keyField: string;
+  /** The declared business fact used by {@link key} (`"field"` births only; `undefined` when minted). */
+  readonly keyField: string | undefined;
   /** Framework-derived initial authoring. Tenant code marks aggregate fields `.fromBirth()` instead. */
   readonly plan: (root: AggregateRef<F>, payload: P, ctx: Ports) => unknown;
   /** Business roles the founder holds from the first valid state. Nomos seats them inside genesis. */
@@ -160,17 +180,100 @@ export type BirthFactKeys<F extends Record<string, Field>> = {
   [K in keyof F]-?: F[K] extends { readonly isFromBirth: true } ? K : never;
 }[keyof F] & string;
 
-export type BirthStringFactKeys<F extends Record<string, Field>> = {
-  [K in BirthFactKeys<F>]: FieldValue<F[K]> extends string ? K : never;
+/**
+ * The `.fromBirth()` facts that may key a birth: TYPED IDS ONLY — a `t.brandedId(Name)`, `t.uuid()` or
+ * field (value type {@link TypedId}), or a string reference (`t.ref` / `t.foreignRef`, the field form of `idOf`).
+ * A plain `t.string()`, an enum, a number, or anything else is NOT a key, and naming it in `key:` is a
+ * compile error. There is no name heuristic: `estateId: t.string()` is a plain string however it is named.
+ */
+export type BirthKeyFactKeys<F extends Record<string, Field>> = {
+  [K in BirthFactKeys<F>]: F[K] extends { readonly kind: "ref" }
+    ? (FieldValue<F[K]> extends string ? K : never)
+    : FieldValue<F[K]> extends TypedId<string> ? K : never;
 }[BirthFactKeys<F>] & string;
 
 export type BusinessBirthPayload<F extends Record<string, Field>> = {
   readonly [K in BirthFactKeys<F>]: FieldValue<F[K]>;
 };
 
+/** Where every birth-key compile error points. */
+export const CHOOSING_A_BIRTH_KEY_DOC = "architecture/choosing_a_birth_key.md";
+
+/**
+ * The typed-id families a birth key may have. The kernel reads this off the law (the
+ * `nomos:birthKeyType` era key on the birthing intent) and checks every carried birth's key against it.
+ *   - `minted`    — the default: `<Aggregate>_<uuidv7>`, drawn by Nomos inside the birth;
+ *   - `brandedId` — `t.brandedId(Name)`;
+ *   - `uuid`      — `t.uuid()`, canonical lowercase;
+ *   - `ref`       — a string `t.ref(Aggregate)` / `t.foreignRef` (the field form of `idOf`): an `Aggregate` id.
+ */
+export type BirthKeyType = "minted" | "brandedId" | "uuid" | "ref";
+
+/** The law's declaration of a birth's key: its typed-id family, the brand (the `brandedId` name, `Uuid`,
+ * the referenced aggregate, or for `minted` the born aggregate), and the name's namespace. */
+export interface BirthKeyDeclaration {
+  readonly type: BirthKeyType;
+  readonly brand: string;
+  readonly namespace: string;
+}
+
+/** The typed-id family of a `.fromBirth()` field, or `undefined` when it is not a typed id. Reads the
+ * field's TYPE (its schema brand / reference kind) — never its name. */
+export function birthKeyTypeOfField(field: Field): Omit<BirthKeyDeclaration, "namespace"> | undefined {
+  if (field.kind === "ref") {
+    if (field.nomosRef !== undefined || field.versionedForeignRef !== undefined) return undefined;
+    const target = field.refAggregateId;
+    return target === undefined ? undefined : { type: "ref", brand: target };
+  }
+  if (field.kind !== "string") return undefined;
+  const schema = field.zod as z.ZodTypeAny;
+  if (isUuidIdSchema(schema)) return { type: "uuid", brand: "Uuid" };
+  const brand = brandedIdMetaOf(schema);
+  if (brand !== undefined) return { type: "brandedId", brand };
+  return undefined;
+}
+
+const MINTED_KEY_UUIDV7 = /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+
+/**
+ * Why `key` is not a well-formed key for `declaration` (`undefined` when it is). The ONE rule set, mirrored
+ * byte-for-byte by the kernel (`kernel/src/birth_stage.rs` `typed_birth_key_refusal`), which re-checks every
+ * carried birth whose law declares a typed key:
+ *   - every key is a typed id value ({@link typedIdShapeRefusal}: non-empty, ≤ 256 UTF-8 bytes, no control
+ *     character — so the `(namespace, key)` unit separator can never appear inside a key);
+ *   - `minted` is exactly `<brand>_<uuidv7>`; `uuid` is the canonical lowercase uuid.
+ */
+export function birthKeyShapeRefusal(declaration: BirthKeyDeclaration, key: unknown): string | undefined {
+  const shape = typedIdShapeRefusal(key);
+  if (shape !== undefined) return shape;
+  const text = key as string;
+  switch (declaration.type) {
+    case "minted": {
+      const prefix = `${declaration.brand}_`;
+      return text.startsWith(prefix) && MINTED_KEY_UUIDV7.test(text.slice(prefix.length))
+        ? undefined
+        : `a minted key is ${declaration.brand}_<uuidv7>`;
+    }
+    case "uuid":
+      return CANONICAL_UUID_RE.test(text) ? undefined : "a uuid key is a canonical lowercase uuid";
+    case "brandedId":
+    case "ref":
+      return undefined;
+  }
+}
+
 export interface BusinessBirthSpec<F extends Record<string, Field>> {
-  /** One declared birth fact that gives this business life its stable address. */
-  readonly key: BirthStringFactKeys<F>;
+  /**
+   * How the born workspace is named.
+   *   - OMIT IT (the default): Nomos mints the key inside the birth (`<Aggregate>_<uuidv7>`), so two births
+   *     never share a name.
+   *   - `key: "estateId"` — a `.fromBirth()` TYPED ID field: `t.brandedId(Name)`, `t.uuid()` or a string
+   *     `t.ref(Aggregate)` (the field form of `idOf`). A plain `t.string()` is a compile error (see {@link BirthKeyFactKeys}).
+   * A keyed name is `workspaceNameForKey(namespace, key)` — global to the namespace and fixed at birth: Nomos
+   * refuses any later write that changes the key, and the kernel re-checks the key's shape and the name it
+   * derives on every birth. See `architecture/choosing_a_birth_key.md`.
+   */
+  readonly key?: BirthKeyFactKeys<F>;
   readonly namespace?: string;
   /** Business policy: roles held by the founder from the aggregate's first valid state. */
   readonly founder?: {
@@ -221,15 +324,39 @@ export function birth<F extends Record<string, Field>>(
         `birth(${aggregate.id}): no birth facts are declared — mark every required initial business field with .fromBirth()`,
       );
     }
-    const keyField = (aggregate.fields as Record<string, Field>)[spec.key];
-    if (keyField === undefined || keyField.isFromBirth !== true) {
-      throw new Error(`birth(${aggregate.id}): key '${String(spec.key)}' must be a declared .fromBirth() field`);
-    }
-    if (keyField.kind !== "string" && keyField.kind !== "enum" && keyField.kind !== "ref") {
+    const rawKey = (spec as { key?: unknown }).key;
+    if (rawKey !== undefined && typeof rawKey !== "string") {
       throw new Error(
-        `birth(${aggregate.id}): key '${String(spec.key)}' must be a string-like business fact; got ${keyField.kind}`,
+        `birth(${aggregate.id}): a birth key is \`key: "<typed-id fromBirth field>"\`; omit \`key\` for the ` +
+          `default Nomos-minted key. See ${CHOOSING_A_BIRTH_KEY_DOC}.`,
       );
     }
+    const keyFieldName: string | undefined = rawKey;
+    let keyType: Omit<BirthKeyDeclaration, "namespace"> = { type: "minted", brand: aggregate.id };
+    if (keyFieldName !== undefined) {
+      const keyField = (aggregate.fields as Record<string, Field>)[keyFieldName];
+      if (keyField === undefined || keyField.isFromBirth !== true) {
+        throw new Error(
+          `birth(${aggregate.id}): key field '${keyFieldName}' must be a declared .fromBirth() field — a birth key ` +
+            `is a fact the birth itself supplies, fixed for the life of the workspace. See ${CHOOSING_A_BIRTH_KEY_DOC}.`,
+        );
+      }
+      // The compile-time type (BirthKeyFactKeys) already refuses this; the same judgement by TYPE refuses an
+      // untyped (JS / cast) caller. Never by the field's name.
+      const typed = birthKeyTypeOfField(keyField);
+      if (typed === undefined) {
+        throw new Error(
+          `birth(${aggregate.id}): key field '${keyFieldName}' is a '${keyField.kind}' field, not a typed id, so it ` +
+            `cannot name a workspace. A birth key is t.brandedId(Name), t.uuid() or a string t.ref(Aggregate) ` +
+            `— or omit \`key\` for the Nomos-minted default. See ${CHOOSING_A_BIRTH_KEY_DOC}.`,
+        );
+      }
+      keyType = typed;
+      // The name is fixed at birth, so the key is write-once — enforced by the framework at the kernel
+      // (the aggregate's composed invariant), not by tenant code. An encrypted key (an `.owned()` content
+      // field) is ciphertext in the snapshot and cannot be compared, so it is not registered.
+      if (keyField.isEncrypted !== true) __declareBirthKeyWriteOnce(aggregate as AggregateHandle, keyFieldName);
+    }
     const payloadSchema = z.object(Object.fromEntries(facts.map(([name, field]) => [name, field.zod])));
     const founderRoles = [...new Set(spec.founder?.roles ?? [])];
     for (const role of founderRoles) {
@@ -272,13 +399,31 @@ export function birth<F extends Record<string, Field>>(
       __isBusinessBirth: true,
       aggregate,
       payloadSchema,
-      key: (payload: Payload) => String(payload[spec.key]),
-      reference: (payload: Payload): NomosRefValue => ({
-        workspace: workspaceNameForKey(namespace, String(payload[spec.key])),
-        type: aggregate.id,
-        id: rootId,
-      }),
-      keyField: spec.key,
+      keyMode: keyFieldName === undefined ? "minted" as const : "field" as const,
+      keyType,
+      key: (payload: Payload) => {
+        if (keyFieldName === undefined) {
+          throw new Error(
+            `birth(${aggregate.id}) is keyed by a Nomos-minted id drawn when the birth runs; it has no business key. ` +
+              `Carry the born workspace's NomosRef instead. See ${CHOOSING_A_BIRTH_KEY_DOC}.`,
+          );
+        }
+        return String(payload[keyFieldName as keyof Payload]);
+      },
+      reference: (payload: Payload): NomosRefValue => {
+        if (keyFieldName === undefined) {
+          throw new Error(
+            `birth(${aggregate.id}).reference(facts): a Nomos-minted birth's address is not derivable from its facts — ` +
+              `it is the born workspace the birth returns. Carry that NomosRef. See ${CHOOSING_A_BIRTH_KEY_DOC}.`,
+          );
+        }
+        return {
+          workspace: workspaceNameForKey(namespace, String(payload[keyFieldName as keyof Payload])),
+          type: aggregate.id,
+          id: rootId,
+        };
+      },
+      keyField: keyFieldName,
       plan: (root: AggregateRef<F>, payload: Payload, ctx: Ports) => {
         const writable = root as unknown as { set(field: string, value: unknown): unknown };
         for (const [name] of facts) writable.set(name, payload[name as keyof Payload]);
@@ -325,12 +470,50 @@ declare const nomos: { sha256(input: string): string };
  *   ("estate", "estate-abc123") -> estate-83662e729ba18cd04bde52c7a8d854594833d70e
  *   ("home",   "user:ada")      -> home-561af44c94b5b80824f1a9e8cfa1095105f3cb34
  *   ("catalogue", "cat-42")     -> catalogue-f50bf3b9732dc36961b05b8e6503d96df5f3e88e
+ *
+ * NAMES ARE FIXED AT BIRTH. A business child (`birth(Aggregate, { key })`) is named exactly this way too —
+ * the birthing parent is NOT part of the name. CAP-788 briefly folded the parent into the hash; CAP-803
+ * withdrew that before release, because every child born before it is addressed by the name it was born
+ * with and a recomputation under a rule it was not born with addresses a workspace that does not exist.
+ * One parent per node is enforced where custody is, by the kernel's typed `[birth-child-already-parented]`
+ * refusal: a second parent's birth of an existing child name is refused, never re-routed.
+ *
+ * THE KEY IS MINTED BY DEFAULT (CAP-804). `birth(Aggregate, spec)` with no `key` hashes a Nomos-minted id
+ * ({@link mintBirthKey}) drawn inside the birth plan, so names cannot collide by construction; the address
+ * the app keeps is the born workspace's NomosRef. An explicit `key: { field, scope: "global" }` hashes a
+ * birth-only business fact exactly as above — see `architecture/choosing_a_birth_key.md`.
  */
 export const WORKSPACE_NAME_SEP = "\u001f"; // unit separator disambiguates (namespace,key)
 export function workspaceNameForKey(namespace: string, key: string): string {
   return namespace + "-" + nomos.sha256(String(namespace) + WORKSPACE_NAME_SEP + String(key)).slice(0, 40);
 }
 
+/**
+ * @internal THE DEFAULT BIRTH KEY: a typed `<Aggregate>_<uuidv7>` drawn with `nomos.mint` INSIDE the birth
+ * plan. The sealed engine derives it from the intent's captured clock and captured entropy seed, so the
+ * author draws a fresh, unguessable id and every replay of that intent reproduces it byte-for-byte; the
+ * born name is then `workspaceNameForKey(namespace, mintedKey)` like any other birth.
+ */
+/** @internal The hidden payload field through which a generated client that must know a minted birth's
+ * address BEFORE dispatch (an encrypted `.owned()` birth seals to it) supplies a key it reserved from the
+ * kernel's own minter (`mintId`). Absent, the birth plan mints. Never part of the application payload. */
+export const BUSINESS_BIRTH_KEY_PAYLOAD_FIELD = "__nomos_birth_key_4b9e2d";
+
+/** @internal A key Nomos minted for `aggregateId`: the typed `<Aggregate>_<uuidv7>` shape, nothing else. */
+export function isMintedBirthKey(aggregateId: string, key: string): boolean {
+  return birthKeyShapeRefusal({ type: "minted", brand: aggregateId, namespace: "" }, key) === undefined;
+}
+
+export function mintBirthKey(aggregateId: string): string {
+  const host = (globalThis as { nomos?: { mint?: (typeTag: string) => string } }).nomos;
+  if (typeof host?.mint !== "function") {
+    throw new Error(
+      `birth(${aggregateId}): Nomos mints this birth's key inside the sealed engine, but no nomos.mint capability is bound here`,
+    );
+  }
+  return host.mint(aggregateId);
+}
+
 /** A genesis chain, or a builder that receives the resolved child workspace name (so a seed step can embed
  *  it — e.g. `seedEstate` needs to write its own `estateName`). Passing a builder is the common case. */
 // An array of genesis steps, OR a builder that receives the resolved child name. Typed as `unknown[]`

package/src/build_provenance.ts

@@ -43,8 +43,10 @@ export interface ProvenanceSubject {
 export interface BuildProvenanceInput {
   /** Package name from the project config. */
   readonly packageName: string;
-  /** `sha256(package bytes)` — the composed typed USDA closure identity. */
+  /** The PACKAGE identity: this compiler's closure of `<name>.law.usdz`. Not what a unit-lane target serves. */
   readonly domainHash: string;
+  /** THE LAW IDENTITY: the unit set identity of `<name>.units` (law_unit_set_identity.ts, CAP-773). */
+  readonly unitSetIdentity: string;
   /** The transports the domainHash addresses (law archive, package asset, …). */
   readonly artifacts: readonly { readonly name: string; readonly sha256?: string }[];
   /** Per-domain compiled surface, already computed for the summary. */
@@ -61,6 +63,13 @@ export interface BuildProvenanceInput {
   readonly builder: { readonly id: string; readonly version: string };
   /** Source law modules, by feature — the external parameters of the build. */
   readonly sourceModules?: readonly string[];
+  /** The released baseline the candidate extends (CAP-660): pinned by content address, naming its source. */
+  readonly baseline?: {
+    readonly sha256: string;
+    readonly source: "release" | "installed" | "units";
+    readonly release: string;
+    readonly unitSet: string;
+  };
 }
 
 /**
@@ -71,8 +80,11 @@ export interface BuildProvenanceInput {
  */
 export function buildProvenanceStatement(input: BuildProvenanceInput): Record<string, unknown> {
   const subject: ProvenanceSubject[] = [
-    // The law closure identity is THE subject: `sha256(package bytes) = domainHash`.
+    // The package: `<name>.law` is the compiler's closure of the `.law.usdz` bytes (the package identity).
     { name: `${input.packageName}.law`, digest: { sha256: input.domainHash } },
+    // The law: `<name>.units` names the unit set identity, what releases, clients and qualification name.
+    // A target serves a closure its own kernel composes from these units, which neither digest names.
+    { name: `${input.packageName}.units`, digest: { sha256: input.unitSetIdentity } },
     ...input.artifacts
       .filter((a): a is { name: string; sha256: string } => typeof a.sha256 === "string")
       .map((a) => ({ name: a.name, digest: { sha256: a.sha256 } })),
@@ -90,6 +102,9 @@ export function buildProvenanceStatement(input: BuildProvenanceInput): Record<st
           ...(input.sourceModules === undefined
             ? {}
             : { sourceModules: [...input.sourceModules].sort() }),
+          // The baseline is an external parameter: the same source compiled against another
+          // baseline is a different build, and a publisher can gate on which release it extends.
+          ...(input.baseline === undefined ? {} : { baseline: { ...input.baseline } }),
         },
         // What the compile RESOLVED — the surface each domain actually exposes. A
         // consumer diffing two provenances sees the law's shape change without

package/src/business_birth.ts

@@ -13,6 +13,11 @@ import { ensure } from "./authoring.js";
 import { directive, type Directive } from "./directive.js";
 import {
   birth,
+  BUSINESS_BIRTH_KEY_PAYLOAD_FIELD,
+  birthKeyShapeRefusal,
+  isMintedBirthKey,
+  type BirthKeyDeclaration,
+  mintBirthKey,
   requireParentAttestedBirth,
   workspaceNameForKey,
   type BusinessBirthDecl,
@@ -164,7 +169,13 @@ export interface BusinessBirthMetadata {
   readonly publicPayloadSchema: z.ZodObject<z.ZodRawShape>;
   readonly rootId: string;
   readonly namespace: string;
-  readonly keyField: string;
+  /** `"minted"` (default): the name hashes a Nomos-minted id; `"field"`: it hashes {@link keyField}. */
+  readonly keyMode: "minted" | "field";
+  /** The declared business key field of a `"field"`-keyed birth; absent for a minted birth. */
+  readonly keyField?: string;
+  /** The key's typed-id family and brand: generated clients type the key by it (a `brandedId`/`uuid` key is
+   *  its branded type, never a bare string). */
+  readonly keyType: { readonly type: import("./births.js").BirthKeyType; readonly brand: string };
   /** Exact child-genesis offer route prepared before the parent birth dispatch. */
   readonly seedDirectiveId: string;
   /** Compiler-owned child-genesis routes which may be appended after the business seed. */
@@ -198,6 +209,7 @@ const INTERNAL_FIELDS = [
   "principal",
   "bornAt",
   BUSINESS_BIRTH_SEED_PAYLOAD_FIELD,
+  BUSINESS_BIRTH_KEY_PAYLOAD_FIELD,
 ] as const;
 
 /**
@@ -271,8 +283,16 @@ function lowerOne<P extends Record<string, unknown>, F extends Record<string, Fi
   });
   const parentSchema = seedSchema.extend({
     ...(encryptedBirth ? { [BUSINESS_BIRTH_SEED_PAYLOAD_FIELD]: seedCarrierSchema } : {}),
+    // A minted birth's client may reserve its key ahead of dispatch (an encrypted .owned() birth seals to
+    // the child's address). A field-keyed birth's law is unchanged: it declares no such field.
+    ...(decl.keyMode === "minted" ? { [BUSINESS_BIRTH_KEY_PAYLOAD_FIELD]: z.string().min(1).optional() } : {}),
   });
 
+  // THE TYPED BIRTH KEY (era key `nomos:birthKeyType`/`nomos:birthKeyBrand`/`nomos:birthKeyNamespace` on the
+  // birthing intent): the kernel reads it off the law and checks every carried recipe's `nomos:birthKey`
+  // against it — its shape, and that the child's name is `workspaceNameForKey(namespace, key)`.
+  const birthKeyDeclaration: BirthKeyDeclaration = { ...decl.keyType, namespace };
+
   const seedBase = directive(seedId)
     .ensures(decl.aggregate)
     .payload(seedSchema)
@@ -327,7 +347,28 @@ function lowerOne<P extends Record<string, unknown>, F extends Record<string, Fi
     .payload(parentSchema)
     .plan((p, ctx) => {
       const founder = p.principal as string;
-      const child = workspaceNameForKey(namespace, String(decl.key(p as P)));
+      // A name is fixed at birth: a minted birth (the default) hashes an id Nomos draws here, inside the
+      // plan, from the intent's captured entropy (replay reproduces it); a field-keyed birth hashes its
+      // declared birth-only fact. Either way the name is `workspaceNameForKey(namespace, key)`.
+      const reserved = (p as Record<string, unknown>)[BUSINESS_BIRTH_KEY_PAYLOAD_FIELD];
+      if (reserved !== undefined && !isMintedBirthKey(decl.aggregate.id, String(reserved))) {
+        throw new Error(
+          `birth(${decl.aggregate.id}): a reserved birth key must be one Nomos minted for ${decl.aggregate.id}; ` +
+            "an application cannot choose a workspace name",
+        );
+      }
+      const birthKey = decl.keyMode === "minted"
+        ? (reserved !== undefined ? String(reserved) : mintBirthKey(decl.aggregate.id))
+        : decl.key(p as P);
+      // The same shape rule the kernel re-checks on the carried recipe (`nomos:birthKey`): refuse here, as
+      // the author, before a name is derived from a key the kernel would refuse.
+      const keyRefusal = birthKeyShapeRefusal(birthKeyDeclaration, birthKey);
+      if (keyRefusal !== undefined) {
+        throw new Error(
+          `[birth-key-shape] birth(${decl.aggregate.id}): the ${birthKeyDeclaration.type} key is malformed: ${keyRefusal}`,
+        );
+      }
+      const child = workspaceNameForKey(namespace, birthKey);
       const foundingKeyHash = foundedBirthKeyHash(founder);
       const founded = foundingKeyHash !== undefined;
       if (founded) {
@@ -358,6 +399,7 @@ function lowerOne<P extends Record<string, unknown>, F extends Record<string, Fi
         Object.assign(childPayload, sealedSeed as Record<string, unknown>);
       }
       delete childPayload[BUSINESS_BIRTH_SEED_PAYLOAD_FIELD];
+      delete childPayload[BUSINESS_BIRTH_KEY_PAYLOAD_FIELD];
       const chain: Array<Record<string, unknown>> = [
         domainInstallGenesisOffer(
           DomainInstallExecutor.StageZero,
@@ -417,7 +459,7 @@ function lowerOne<P extends Record<string, unknown>, F extends Record<string, Fi
       if (founded) {
         // No provider verifier, inherited model authority (operators ride the founding step instead),
         // parent workspace role or epoch edge: those belong to the certificate lane's attestation.
-        birth({ workspace: child, genesisChain: chain });
+        birth({ workspace: child, genesisChain: chain, birthKey });
         return [];
       }
 
@@ -443,6 +485,7 @@ function lowerOne<P extends Record<string, unknown>, F extends Record<string, Fi
       birth({
         workspace: child,
         genesisChain: chain,
+        birthKey,
         ...(decl.parentWorkspaceRoles.length > 0
           ? { parentWorkspaceRoles: decl.parentWorkspaceRoles }
           : {}),
@@ -475,7 +518,9 @@ function lowerOne<P extends Record<string, unknown>, F extends Record<string, Fi
     publicPayloadSchema: publicSchema,
     rootId,
     namespace,
-    keyField: decl.keyField,
+    keyMode: decl.keyMode,
+    ...(decl.keyField !== undefined ? { keyField: decl.keyField } : {}),
+    keyType: decl.keyType,
     seedDirectiveId: seedId,
     genesisDirectiveIds: [
       "enrollSigner",
@@ -493,6 +538,7 @@ function lowerOne<P extends Record<string, unknown>, F extends Record<string, Fi
   };
   const parent = {
     ...birthBase,
+    birthKey: birthKeyDeclaration,
     businessBirth: metadata,
     [BUSINESS_BIRTH_POLICY_BINDING]: (domains: readonly string[]) => {
       decl.__nomosBirthPolicyDomains = domains;

package/src/check_package_main.ts

@@ -32,6 +32,9 @@ import {
   NOMOS_IDENTITY_FILENAME,
   parseIdentityUsda,
 } from "./identity_usda.js";
+import { identityRegistryFromModel } from "./identity_model.js";
+import { NOMOS_BASELINE_FILENAME, isBaselineUsda, parseBaselineUsda, type ReleasedBaseline } from "./baseline_usda.js";
+import { BaselineRefusal, importBaseline } from "./baseline_import.js";
 import {
   validateNomosPackageConfig,
   type NormalizedNomosPackageConfig,
@@ -150,11 +153,13 @@ export async function loadComposedModulesWithSources(
 }
 
 /**
- * Load the PRIOR identity surface for `--against <path>` (the evolve preview's baseline). The one
- * supported artifact is the committed `nomos.identity.usda` layer, directly or via its package dir.
- * There is no interface/JSON sidecar lane: prior executable-law inspection belongs to the holon.
+ * Load the PRIOR identity surface for `--against <path>` (the evolve preview's baseline). Two
+ * artifacts are supported, directly or via a package dir: the committed `nomos.identity.usda`
+ * layer, and a released `nomos.baseline.usda` (CAP-660) — the continuity exported from custody,
+ * which also pre-fires the compile's baseline verification as findings. There is no
+ * interface/JSON sidecar lane: prior executable-law inspection belongs to the holon.
  */
-function loadPriorEvolveLaw(arg: string): { law: EvolveLaw; source: string; note?: string } {
+function loadPriorEvolveLaw(arg: string): { law: EvolveLaw; source: string; note?: string; baseline?: ReleasedBaseline } {
   if (/^https?:\/\//.test(arg)) {
     fail(
       `--against does not support a live URL (${arg}) — the installed package's #58 stable-ids are ` +
@@ -167,12 +172,29 @@ function loadPriorEvolveLaw(arg: string): { law: EvolveLaw; source: string; note
   let file = abs;
   if (statSync(abs).isDirectory()) {
     const identity = path.join(abs, NOMOS_IDENTITY_FILENAME);
+    const baseline = path.join(abs, NOMOS_BASELINE_FILENAME);
     if (existsSync(identity)) file = identity;
-    else fail(`--against: no ${NOMOS_IDENTITY_FILENAME} under ${abs}`);
+    else if (existsSync(baseline)) file = baseline;
+    else fail(`--against: no ${NOMOS_IDENTITY_FILENAME} or ${NOMOS_BASELINE_FILENAME} under ${abs}`);
+  }
+  const text = readFileSync(file, "utf8");
+  if (isBaselineUsda(text)) {
+    let baseline: ReleasedBaseline;
+    try {
+      baseline = parseBaselineUsda(text);
+    } catch (e) {
+      fail(`--against: could not parse ${file}: ${(e as Error).message}`);
+    }
+    return {
+      law: evolveLawFromLockfile(baseline.continuity),
+      source: file,
+      baseline,
+      note: `released baseline (${baseline.release === "none" ? "unreleased units" : `release ${baseline.release}`}, law ${baseline.unitSet}): identities and wire allocations are verified against the ledger; value contracts are not carried by released law.`,
+    };
   }
   let lock: CompilerIdentityModel;
   try {
-    lock = parseIdentityUsda(readFileSync(file, "utf8"));
+    lock = parseIdentityUsda(text);
   } catch (e) {
     fail(`--against: could not parse ${file}: ${(e as Error).message}`);
   }
@@ -229,6 +251,28 @@ async function main(): Promise<void> {
     const current = currentEvolveLaw(modules, lock);
     const diff = evolveDiff(prior.law, current);
     findings.push(...diff.findings);
+    if (prior.baseline !== undefined) {
+      // The compile's own baseline verification, pre-fired here with the same typed reasons
+      // (baseline_import.ts): a diverged ledger or wire allocation is named before any compile.
+      try {
+        importBaseline(
+          identityRegistryFromModel(lock),
+          prior.baseline,
+          modules.flatMap((mod) => [mod.domain ?? mod.name, mod.name]),
+        );
+      } catch (error) {
+        if (!(error instanceof BaselineRefusal)) throw error;
+        const details = error.details.length === 0 ? [error.message] : error.details;
+        for (const detail of details) {
+          findings.push({
+            domain: modules[0]?.domain ?? modules[0]?.name ?? "package",
+            level: "refuse",
+            what: `[${error.code}] ${detail}`,
+            fix: error.message.split("\n")[0] ?? error.message,
+          });
+        }
+      }
+    }
     if (!asJson) console.log(`githolon check: evolve preview against ${prior.source}`);
   }
 

package/src/codegen_call_proto.ts

@@ -14,9 +14,14 @@ import type {
 import type { GeometryKind } from "./fields.js";
 import { dartMemberName, unionArmClassName } from "./codegen_dart.js";
 import { mintStableId } from "./stable_ids.js";
+import { composedWireIdentity } from "./composed_wire_identity.js";
 import { protobufFieldNumber } from "./protobuf_field_number.js";
 import { provenanceRowIdentity, provenanceFieldIdentity, provenanceAuthorIdentity, provenanceContestedIdentity } from "./provenance_wire.js";
 
+// The composed wire identity lives in its own node-free module so the compatibility graph can reach
+// it from the law bundle; the generated codecs keep importing it from here.
+export { composedWireIdentity };
+
 export interface TsCallProtoFieldAccess {
   readonly value: string;
   readonly present?: string;
@@ -87,24 +92,6 @@ function requireUniqueFieldNumbers(
   }
 }
 
-/**
- * OpenUSD composition may share structurally identical anonymous records between
- * operation contracts. `compileSparseLawGraphUsda` records that sharing by
- * redirecting each duplicate field path to the canonical field prim. The wire
- * identity must follow that composed path too; using the duplicate graph-local
- * SID makes generated clients speak a different Protobuf schema from the law the
- * kernel actually installs.
- */
-export function composedWireIdentity(
-  paths: ReadonlyMap<string, string>,
-  entity: { readonly id: string; readonly sid: string; readonly wireKey?: string },
-): string {
-  if (entity.wireKey !== undefined) return entity.wireKey;
-  const path = paths.get(entity.id);
-  const canonical = path?.match(/\/(?:Fields\/f_|Variants\/v_)([0-9a-f]{16})$/i)?.[1];
-  return canonical ?? entity.sid;
-}
-
 interface NominalSumArm {
   readonly discriminator: string;
   readonly variant: LawAnonymousValueVariantNode;