@githolon/dsl 0.113.4 → 0.115.0

package/src/compile_package_main.ts

@@ -1,3 +1,4 @@
+import { collectPackageSources, findBirthKeyWrites, formatBirthKeyWriteWarnings } from "./birth_key_rule.js";
 import type { Directive } from "./directive.js";
 // NOMOS — Nomos Sovereign: participants act · verify · remember LOCALLY; hosted
 // remotes are replaceable custody/transport, not truth.  ⇒ ONE Nomos GitHolon
@@ -46,6 +47,7 @@ import type { Directive } from "./directive.js";
 import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";
 import { checkOperationContracts, deriveInterfaceOffer } from "./operation_contract_check.js";
+import { lawVersionClaim, type LawVersionClaim } from "./law_version.js";
 import { compilerIntermediateCacheRoot, compilerSourceName, compilerSourceRoot } from "./compiler_cache.js";
 import {
   APPLICATION_CONTRACT_MODULE,
@@ -80,6 +82,7 @@ import ts from "typescript";
 import type { AggregateHandle } from "./aggregate.js";
 import {
   generateDartDomain,
+  dartBrandNamesForModule,
   generateDartContracts,
   generateDartActivityRegistry,
   collectActivityDescriptors,
@@ -97,6 +100,8 @@ import {
 } from "./evolution_files.js";
 import { assertEvolutionModuleExports } from "./evolution.js";
 import { readHistoricalIdentityFrontier } from "./identity_frontier.js";
+import { parseBaselineUsda, type ReleasedBaseline } from "./baseline_usda.js";
+import { BaselineRefusal, assertBaselineRetained, importBaseline, verifyBaselinePin } from "./baseline_import.js";
 import {
   dartBridgeClientOperationDirectiveIds,
   generateDartDomainClient,
@@ -251,10 +256,6 @@ import {
   tsClientFactoryName,
   recursiveLazyTypes,
 } from "./codegen_ts.js";
-import {
-  generateOpenApiFragment,
-  mergeOpenApiFragments,
-} from "./codegen_openapi.js";
 import {
   domainInterfaceFromLawGraph,
   publicClientInterface,
@@ -269,6 +270,8 @@ import {
   packageRoutesLayerUsda,
   splitLawUnits,
 } from "./law_units.js";
+import { lawUnitSetIdentityWith } from "./law_unit_set_identity.js";
+import { domainRequirementsOf, type DomainUnitRequirement } from "./domain_requirements.js";
 import { checkDomainModules, formatFindings, hasRefusal } from "./law_check.js";
 import {
   currentEvolveLaw,
@@ -627,6 +630,7 @@ const compareLogicalPath = (left: string, right: string): number =>
  * inventories the USDZ/Git tree and re-hashes every logically named layer. */
 function emitLawClosure(
   packageName: string,
+  claimedVersion: LawVersionClaim | undefined,
   exportedDomains: readonly string[],
   runtimeDependencies: readonly RuntimePackageDependency[],
   domainAssets: readonly EmittedLawClosureAsset[],
@@ -673,6 +677,7 @@ function emitLawClosure(
     "package.usda",
     packageContractUsda({
       packageName,
+      ...(claimedVersion === undefined ? {} : { claimedVersion }),
       exportedDomains,
       runtimeDependencies,
     })
@@ -1268,6 +1273,7 @@ function closeComposedBusinessBirthPresentation(
     aggregateId?: unknown;
     rootId?: unknown;
     namespace?: unknown;
+    keyMode?: unknown;
     keyField?: unknown;
   };
   type BirthDirective = DomainModule["directives"][number] & {
@@ -1281,14 +1287,15 @@ function closeComposedBusinessBirthPresentation(
       typeof birth.aggregateId !== "string" ||
       typeof birth.rootId !== "string" ||
       typeof birth.namespace !== "string" ||
-      typeof birth.keyField !== "string"
+      (typeof birth.keyField !== "string" && birth.keyMode !== "minted")
     )
       return undefined;
     return [
       birth.aggregateId,
       birth.rootId,
       birth.namespace,
-      birth.keyField,
+      // A minted birth has no key field; its identity here is the minted mode itself.
+      typeof birth.keyField === "string" ? birth.keyField : "\u0001minted",
     ].join("\u0000");
   };
 
@@ -1338,6 +1345,8 @@ interface DartSharedSymbols {
   readonly frameworkDirIds: ReadonlySet<string>;
   readonly frameworkQueryIds: ReadonlySet<string>;
   readonly sharedVoNames: ReadonlySet<string>;
+  /** Branded-id extension types used by ≥2 domains — declared ONCE in the framework file. */
+  readonly sharedBrandNames: ReadonlySet<string>;
   readonly hasFrameworkSymbols: boolean;
   /** The synthetic module whose emit IS `nomos_framework.dart` — undefined when nothing is shared. */
   readonly frameworkMod: DomainModule | undefined;
@@ -1499,11 +1508,23 @@ function collectDartSharedSymbols(
   const sharedVos = [...sharedVoNames]
     .sort()
     .map((name) => voDescriptorByName.get(name)!);
+  // TYPED IDS: a branded id used by two domains (a parent's business-birth payload and the child's key
+  // field, typically) would otherwise declare one extension type per file and make the barrel ambiguous.
+  const brandDomains = new Map<string, number>();
+  for (const mod of modules) {
+    for (const brand of dartBrandNamesForModule(mod)) {
+      brandDomains.set(brand, (brandDomains.get(brand) ?? 0) + 1);
+    }
+  }
+  const sharedBrandNames: ReadonlySet<string> = new Set(
+    [...brandDomains.entries()].filter(([, n]) => n > 1).map(([name]) => name).sort()
+  );
   const hasFrameworkSymbols =
     frameworkAggs.length > 0 ||
     frameworkDirs.length > 0 ||
     frameworkQueries.length > 0 ||
-    sharedVos.length > 0;
+    sharedVos.length > 0 ||
+    sharedBrandNames.size > 0;
   const frameworkMod: DomainModule | undefined = hasFrameworkSymbols
     ? {
         name: FRAMEWORK_FILE,
@@ -1521,6 +1542,7 @@ function collectDartSharedSymbols(
     frameworkDirIds: new Set(frameworkDirById.keys()),
     frameworkQueryIds: new Set(frameworkQueryById.keys()),
     sharedVoNames,
+    sharedBrandNames,
     hasFrameworkSymbols,
     frameworkMod,
   };
@@ -1538,6 +1560,7 @@ function domainDedupOpts(
     readonly skipDirectiveIds: Set<string>;
     readonly skipQueryIds: Set<string>;
     readonly skipValueObjectNames: Set<string>;
+    readonly skipBrandNames: Set<string>;
   };
   readonly foldsFramework: boolean;
 } {
@@ -1565,11 +1588,17 @@ function domainDedupOpts(
       .filter((d) => shared.sharedVoNames.has(d.name))
       .map((d) => d.name)
   );
+  const skipBrandNames = new Set(
+    [...dartBrandNamesForModule(modForDart)].filter((name) =>
+      shared.sharedBrandNames.has(name)
+    )
+  );
   const foldsFramework =
     skipAggregateIds.size > 0 ||
     skipDirectiveIds.size > 0 ||
     skipQueryIds.size > 0 ||
-    skipValueObjectNames.size > 0;
+    skipValueObjectNames.size > 0 ||
+    skipBrandNames.size > 0;
   return {
     modForDart,
     skips: {
@@ -1577,6 +1606,7 @@ function domainDedupOpts(
       skipDirectiveIds,
       skipQueryIds,
       skipValueObjectNames,
+      skipBrandNames,
     },
     foldsFramework,
   };
@@ -2145,10 +2175,18 @@ function emitDartOperationProto(
   return [protoPath, generatedBinding];
 }
 
+/** The compiled law's identities (CAP-773): the unit set is the law; the package is the `.law.usdz` bytes. */
+interface CompiledLawIdentities {
+  readonly unitSet: string;
+  readonly packageSha256: string;
+  /** One requirement per application domain (CAP-666): its unit hash and its generated requirement identity. */
+  readonly domainRequirements: readonly DomainUnitRequirement[];
+}
+
 function emitDart(
   modules: readonly DomainModule[],
   dartOut: string,
-  domainHash: string,
+  law: CompiledLawIdentities,
   lawGraphs: ReadonlyMap<string, LawGraph>,
   lawPaths: ReadonlyMap<string, ReadonlyMap<string, string>>,
   packageInterface: Record<string, DomainInterface> = {},
@@ -2224,7 +2262,7 @@ function emitDart(
         ? []
         : [{ module, graph, paths }];
     }),
-    { lawSha256: domainHash }
+    { lawUnitSet: law.unitSet, lawPackageSha256: law.packageSha256, domainRequirements: law.domainRequirements }
   );
   if (applicationFrameworkCallsSource !== undefined) {
     const applicationFrameworkCallsPath = path.join(
@@ -2246,6 +2284,7 @@ function emitDart(
       FRAMEWORK_FILE,
       generateDartDomain(shared.frameworkMod, {
         additionalValueObjects: shared.frameworkMod.valueObjects ?? [],
+        extraBrandNames: [...shared.sharedBrandNames],
       })
     );
   }
@@ -2364,7 +2403,7 @@ function emitDart(
     writeGenerated(mod.name, src);
 
     const clientSrc = generateDartDomainClient(modForDart, {
-      domainHash,
+      domainHash: law.unitSet,
       callUsda: {
         graph: lawGraphs.get(mod.name)!,
         paths: lawPaths.get(mod.name)!,
@@ -2539,12 +2578,12 @@ const dartTypesImportFor = (generatedSource: string): string => {
  *  just the floor generated code needs — a lagging pin forces tenants into dependency_overrides. */
 // 0.3.0: SurfacedValue<T>/SurfacedObservation/PendingConflictRow — generated Surfaced-field typing +
 //        the pendingConflicts read rows.
-const NOMOS_TYPES_DEP = "^0.12.0";
+const NOMOS_TYPES_DEP = "^0.14.0";
 // 0.48.x: session-bound clients (XClient.bind/NomosClientInterface/DomainClientSessionMismatch/
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
-const NOMOS_CLIENT_DEP = "^0.67.2";
-const NOMOS_FLUTTER_DEP = "^0.66.4";
+const NOMOS_CLIENT_DEP = "^0.69.0";
+const NOMOS_FLUTTER_DEP = "^0.68.0";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in the Dart and Flutter
 // package pubspecs — a release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).
@@ -3282,7 +3321,7 @@ function removeGeneratedClientLawAssets(pkgDir: string): boolean {
 function emitDartPackages(
   modules: readonly DomainModule[],
   dartOut: string,
-  domainHash: string,
+  law: CompiledLawIdentities,
   lawGraphs: ReadonlyMap<string, LawGraph>,
   lawPaths: ReadonlyMap<string, ReadonlyMap<string, string>>,
   packageInterface: Record<string, DomainInterface>,
@@ -3387,6 +3426,7 @@ function emitDartPackages(
       FRAMEWORK_FILE,
       generateDartDomain(shared.frameworkMod, {
         additionalValueObjects: shared.frameworkMod.valueObjects ?? [],
+        extraBrandNames: [...shared.sharedBrandNames],
       })
     );
   }
@@ -3677,7 +3717,7 @@ function emitDartPackages(
         ? []
         : [{ module, graph, paths }];
     }),
-    { lawSha256: domainHash }
+    { lawUnitSet: law.unitSet, lawPackageSha256: law.packageSha256, domainRequirements: law.domainRequirements }
   );
   const workspaceAccessReadImports = new Map<string, string>();
     for (const module of operationProtoModules) {
@@ -3727,7 +3767,7 @@ function emitDartPackages(
     const workspaceAccessReadImportUri = workspaceAccessReadImports.get(mod.name);
     const makeClient = (imports: readonly string[]) =>
       generateDartDomainClient(dd.modForDart, {
-        domainHash,
+        domainHash: law.unitSet,
         callUsda: {
           graph: lawGraphs.get(mod.name)!,
           paths: lawPaths.get(mod.name)!,
@@ -3818,7 +3858,7 @@ function emitDartPackages(
           invitationPolicies: (
             dd.modForDart.applicationWorkspaceSharing ?? []
           ).map((policy) => ({
-            domainHash,
+            domainHash: law.unitSet,
             query: policy.invitationLaw.pendingByRecipient.id,
             redeem: policy.invitationLaw.redeem.id,
             personField: policy.person,
@@ -3858,6 +3898,7 @@ function emitDartPackages(
     `export 'package:${packages.types}/${genRel}/${businessSharedFile}';`,
     `export 'package:nomos_client/src/workspace_open_progress.dart' show ApplicationWorkspaceOpenProgress;`,
     `export 'package:nomos_client/src/write_progress.dart' show NomosWrite, NomosWriteProgress, NomosWritePhase;`,
+    `export 'package:nomos_client/src/rows_watch.dart' show NomosRows, NomosRowProjection, NomosRowsProjectionStream;`,
     `export 'package:nomos_types/nomos_types.dart' show CustodyError, CustodyPhase, CustodySource, NomosRecommendedAction;`,
     ...tenantTypesExportKeys
       .map((file) => {
@@ -4201,6 +4242,7 @@ async function main(): Promise<void> {
     "--preflight",
     "--inspect-sqlite",
     "--inspect-law",
+    "--publishable",
   ]);
   for (const flag of argv.filter((arg) => arg.startsWith("--"))) {
     if (supportedFlags.has(flag)) continue;
@@ -4236,6 +4278,9 @@ async function main(): Promise<void> {
   // `dart analyze` on the generated Dart package after emission and fails the compile on red.
   const analyzeFlag =
     argv.includes("--analyze") || process.env.NOMOS_ANALYZE === "1";
+  // A PUBLISHABLE compile (architecture/domain_release_lifecycle.md, step 1) must start from the
+  // baseline exported from released custody: it refuses without a pinned `nomos.baseline.usda`.
+  const publishableFlag = argv.includes("--publishable");
   const configArg = argv.find((a) => !a.startsWith("--")) ?? "nomos.project.ts";
   const configPath = path.resolve(process.cwd(), configArg);
   if (!existsSync(configPath)) fail(`config not found: ${configPath}`);
@@ -4320,6 +4365,39 @@ async function main(): Promise<void> {
       "nomos.project.ts no longer accepts 'layered': every law closure is layered, with no alternate compile lane"
     );
   }
+  // ── THE RELEASED BASELINE (CAP-660) ──────────────────────────────────────────────────────────
+  // `nomos.project.ts` pins the baseline by content address. Verify the bytes are the pinned ones
+  // and read it now, before any identity is touched; the import and the retention proof follow.
+  const baselineRefused = (error: unknown): never => {
+    if (error instanceof BaselineRefusal) fail(`[${error.code}] ${error.message}`);
+    throw error;
+  };
+  let releasedBaseline: ReleasedBaseline | undefined;
+  let releasedBaselineSha256: string | undefined;
+  if (cfg.baseline === undefined) {
+    if (publishableFlag) {
+      fail(
+        "[baseline-required] a publishable compile must name the released baseline it extends: " +
+          `run \`githolon baseline export --units build/${cfg.name}.units\` (or --release <id>) against the release ` +
+          "you are extending, commit nomos.baseline.usda, and pin it in nomos.project.ts as " +
+          "baseline: { artifact: \"./nomos.baseline.usda\", sha256: \"<printed sha256>\" }"
+      );
+    }
+  } else {
+    const baselinePath = path.resolve(cfgDir, cfg.baseline.artifact);
+    if (!existsSync(baselinePath)) {
+      fail(`[baseline-unreadable] pinned baseline not found: ${baselinePath}`);
+    }
+    const baselineText = readFileSync(baselinePath, "utf8");
+    try {
+      verifyBaselinePin(baselineText, cfg.baseline);
+      releasedBaseline = parseBaselineUsda(baselineText);
+    } catch (error) {
+      if (error instanceof BaselineRefusal) baselineRefused(error);
+      fail(`[baseline-unreadable] ${cfg.baseline.artifact}: ${(error as Error).message}`);
+    }
+    releasedBaselineSha256 = cfg.baseline.sha256;
+  }
   let sourceTopologyDiagnostics: ReturnType<
     typeof assertPackageFeatureTopology
   > = [];
@@ -4391,6 +4469,7 @@ async function main(): Promise<void> {
   if (cfg.rootPart !== undefined) {
     applicationBirthPolicyDomains.push(APPLICATION_HOME_DOMAIN);
   }
+  const authoredDomainModules: Mod[] = [];
   for (const domain of cfg.domains) {
     let authored: Mod = {};
     for (const rel of domain.modules) {
@@ -4416,10 +4495,32 @@ async function main(): Promise<void> {
       }
     }
     const expanded = expandBusinessBirthExports(authored, domain.key);
+    authoredDomainModules.push(authored);
     if (directivesOf(expanded).some((dir) => dir.birthsChild === true)) {
       applicationBirthPolicyDomains.push(domain.key);
     }
   }
+  // A workspace name is fixed at birth, and the framework enforces it at the kernel: every field-keyed
+  // birth's key is write-once (aggregate.ts BIRTH_KEY_WRITE_ONCE_CODE). Statically WARN at each source line
+  // that writes a key outside the birth in a way that rule will refuse, or that keys another instance
+  // (CAP-804; architecture/choosing_a_birth_key.md). Advisory only — the runtime rule is the guarantee.
+  {
+    const birthKeyWarnings = findBirthKeyWrites(
+      authoredDomainModules,
+      collectPackageSources(
+        cfg.domains.flatMap((domain) => domain.modules.map((rel) => path.resolve(cfgDir, rel))),
+        cfgDir
+      ),
+      { root: cfgDir }
+    );
+    if (birthKeyWarnings.length > 0) {
+      console.warn(
+        `nomos-compile: ${birthKeyWarnings.length} birth-key write warning(s)`
+      );
+      for (const line of formatBirthKeyWriteWarnings(birthKeyWarnings))
+        console.warn(line);
+    }
+  }
   stage("domain discovery imports");
   if (
     cfg.application?.homeGenesis !== undefined &&
@@ -5539,15 +5640,6 @@ async function main(): Promise<void> {
     finding.directiveId?.startsWith("nomos_internal_") === true ||
     (finding.directiveId !== undefined &&
       frameworkComposedDirectives.has(`${finding.domain}\0${finding.directiveId}`));
-  // Self-description is a compiler-owned presentation projection, not executable law. Build it
-  // once from the same composed modules and place it only in the separately routed describe plan;
-  // exact offer/read plans must not carry OpenAPI generation and Zod JSON-Schema machinery.
-  const runtimeOpenApiDocument = mergeOpenApiFragments(
-    domainModules.map((module) =>
-      generateOpenApiFragment(module, { includeFrameworkRoutes: true })
-    ),
-    { title: `${cfg.name} (nomos package)` }
-  );
 
   if (preflightFlag) {
     const businessFindings = authorTimeFindings.filter(
@@ -5622,12 +5714,36 @@ async function main(): Promise<void> {
     ? parseIdentityUsda(readFileSync(lockPath, "utf8"))
     : undefined;
   const historicalFrontier = readHistoricalIdentityFrontier(lockPath);
+  // Outside Git custody (a clean export, a CI checkout without history) the released baseline IS
+  // the evolution frontier: it carries every released aggregate and field by sid, so a removal
+  // without a declared retirement still refuses. It carries no value contracts, so it never
+  // produces a false in-place refusal.
   const historicalLock: CompilerIdentityModel | undefined =
     historicalFrontier === undefined
-      ? undefined
+      ? releasedBaseline?.continuity
       : parseIdentityUsda(historicalFrontier.source);
   const inferredRenames: { domain: string; renames: InferredRename[] }[] = [];
   let nextIdentity = identityRegistryFromModel(priorLock);
+  if (releasedBaseline !== undefined) {
+    // Verify the ledger against released custody and import what it lacks, so a clean checkout
+    // allocates the released sids and wire keys rather than fresh ones, and a diverged branch
+    // refuses with the coordinate named (baseline_import.ts).
+    try {
+      const imported = importBaseline(
+        nextIdentity,
+        releasedBaseline,
+        cfg.domains.flatMap((domain) => [domain.key, ...(domain.name === undefined ? [] : [domain.name])])
+      );
+      nextIdentity = imported.registry;
+      console.log(
+        `baseline: ${releasedBaseline.release === "none" ? "unreleased units" : `release ${releasedBaseline.release}`} ` +
+          `(law ${releasedBaseline.unitSet}) — ${imported.verified} verified, ${imported.imported.length} identit${imported.imported.length === 1 ? "y" : "ies"} ` +
+          `and ${imported.allocated.length} wire allocation(s) imported${imported.relabelled.length === 0 ? "" : `, ${imported.relabelled.length} released rename(s) carried`}`
+      );
+    } catch (error) {
+      baselineRefused(error);
+    }
+  }
   const typedLawGraphs = new Map<string, LawGraph>();
   // The lock is project-wide, not package-local. Several package configs commonly live beside one
   // application stage; compiling one must not erase the stable identity of domains owned by its siblings.
@@ -5837,6 +5953,18 @@ async function main(): Promise<void> {
     return;
   }
 
+  // ── BASELINE RETENTION PROOF (CAP-660) ───────────────────────────────────────────
+  // Every released identity still resolves to its released sid and every released wire key is still
+  // the canonical allocation. Reconciliation never rewrites an allocation, so this holds by
+  // construction; proving it here keeps "the candidate extends the release" a checked fact.
+  if (releasedBaseline !== undefined) {
+    try {
+      assertBaselineRetained(nextIdentity, releasedBaseline);
+    } catch (error) {
+      baselineRefused(error);
+    }
+  }
+
   // ── ORDINARY-COMPILE EVOLUTION GATE ──────────────────────────────────────────────
   // Agents reliably run `compile`; they do not reliably discover an optional migration command.
   // Compare the candidate against the committed identity frontier here, after stable-id
@@ -5915,6 +6043,44 @@ async function main(): Promise<void> {
   // giant formatting-only diff in an established lock.
   writeFileSync(lockPath, serializeIdentityUsda(nextLock), "utf8");
 
+  // USDA is rendered directly from the typed graph. The final closure writer below publishes these
+  // exact texts under their logical paths; no parallel layer directory or JSON reconstruction exists.
+  const v3Closure = [...typedLawGraphs.values()];
+  const v3DomainAssets: EmittedLawClosureAsset[] = [];
+  const v3DomainRoots: string[] = [];
+  const v3LawPathByNode = new Map<LawGraph["nodes"][number], string>();
+  const v3CompiledGraphs = new Map<LawGraph, ReturnType<typeof compileSparseLawGraphUsda>>();
+  const typedDomainIdentityByName = new Map<string, string>();
+  const typedLawPathsByName = new Map<string, ReadonlyMap<string, string>>();
+  for (const [domain, graph] of typedLawGraphs) {
+    const safeDomain = domain.replace(/[^A-Za-z0-9._-]/g, "_");
+    const logicalPath = `domains/${safeDomain}.usda`;
+    const compiledLayer = compileSparseLawGraphUsda(
+      graph,
+      logicalPath,
+      v3Closure
+    );
+    v3CompiledGraphs.set(graph, compiledLayer);
+    const layerText = compiledLayer.text;
+    const sha256 = sha256HexUtf8(layerText);
+    v3DomainAssets.push({
+      logicalPath,
+      sha256,
+      utf8: layerText,
+    });
+    const domainRoot = compiledLayer.paths.get(graph.domain.entity.id);
+    if (domainRoot === undefined) {
+      fail(`domain '${domain}' did not emit its canonical OpenUSD root path`);
+    }
+    v3DomainRoots.push(domainRoot);
+    for (const node of graph.nodes) {
+      const lawPath = compiledLayer.paths.get(node.entity.id);
+      if (lawPath !== undefined) v3LawPathByNode.set(node, lawPath);
+    }
+    typedDomainIdentityByName.set(domain, sha256);
+    typedLawPathsByName.set(domain, compiledLayer.paths);
+  }
+
   // ── THE STRUCTURAL INTERFACE (#72) — directives (payload shapes) + aggregates (read
   // shapes, sid-keyed), keyed by DOMAIN. The SAME object is (a) baked into the generated
   // clients as their requirement and (b) staged on the deploy as the workspace's offer, so
@@ -5929,7 +6095,12 @@ async function main(): Promise<void> {
         `compiler surface invariant: domain '${key}' has no typed USDA graph`
       );
     }
-    const offeredInterface = domainInterfaceFromLawGraph(graph);
+    // Nested record members carry the allocation the generated codecs encode them under, which
+    // follows the composed layer's canonical prim (CAP-681).
+    const offeredInterface = domainInterfaceFromLawGraph(
+      graph,
+      typedLawPathsByName.get(mod.name)
+    );
     const di = publicClientInterface([mod], { [key]: offeredInterface })[key]!;
     const graphRoutes = graph.nodes
       .filter((node) => node.kind === "intent" && node.public)
@@ -6022,44 +6193,6 @@ async function main(): Promise<void> {
     }
   }
 
-  // USDA is rendered directly from the typed graph. The final closure writer below publishes these
-  // exact texts under their logical paths; no parallel layer directory or JSON reconstruction exists.
-  const v3Closure = [...typedLawGraphs.values()];
-  const v3DomainAssets: EmittedLawClosureAsset[] = [];
-  const v3DomainRoots: string[] = [];
-  const v3LawPathByNode = new Map<LawGraph["nodes"][number], string>();
-  const v3CompiledGraphs = new Map<LawGraph, ReturnType<typeof compileSparseLawGraphUsda>>();
-  const typedDomainIdentityByName = new Map<string, string>();
-  const typedLawPathsByName = new Map<string, ReadonlyMap<string, string>>();
-  for (const [domain, graph] of typedLawGraphs) {
-    const safeDomain = domain.replace(/[^A-Za-z0-9._-]/g, "_");
-    const logicalPath = `domains/${safeDomain}.usda`;
-    const compiledLayer = compileSparseLawGraphUsda(
-      graph,
-      logicalPath,
-      v3Closure
-    );
-    v3CompiledGraphs.set(graph, compiledLayer);
-    const layerText = compiledLayer.text;
-    const sha256 = sha256HexUtf8(layerText);
-    v3DomainAssets.push({
-      logicalPath,
-      sha256,
-      utf8: layerText,
-    });
-    const domainRoot = compiledLayer.paths.get(graph.domain.entity.id);
-    if (domainRoot === undefined) {
-      fail(`domain '${domain}' did not emit its canonical OpenUSD root path`);
-    }
-    v3DomainRoots.push(domainRoot);
-    for (const node of graph.nodes) {
-      const lawPath = compiledLayer.paths.get(node.entity.id);
-      if (lawPath !== undefined) v3LawPathByNode.set(node, lawPath);
-    }
-    typedDomainIdentityByName.set(domain, sha256);
-    typedLawPathsByName.set(domain, compiledLayer.paths);
-  }
-
   // Index the transient graph once. Both projections follow the same nominal edges, including
   // transitive cross-domain dependencies. Per-command selection also follows reverse guard edges;
   // the retained package command projection remains the compatibility consumer until the runtime
@@ -6607,7 +6740,6 @@ async function main(): Promise<void> {
   const planEntrySource = (
     domainKeys: readonly string[],
     includeReports: boolean,
-    includeDescribe: boolean,
     sourceOverrides: ReadonlyMap<string, string> = new Map(),
     includePreloads = true,
     routingOverride?: Record<string, unknown>,
@@ -6659,12 +6791,6 @@ async function main(): Promise<void> {
       ...(!sharedRuntime && zodSeedNames.length > 0
         ? [`  seeds: [${zodSeedNames.join(", ")}],`]
         : []),
-      ...(includeDescribe
-        ? [`  openapiDocument: ${JSON.stringify(runtimeOpenApiDocument)},`]
-        : []),
-      ...(includeDescribe
-        ? [`  packageTitle: ${JSON.stringify(`${cfg.name} (nomos package)`)},`]
-        : []),
       ...workspaceEffects.config,
       `});`,
       ...(includeMintInstalls
@@ -6841,7 +6967,6 @@ async function main(): Promise<void> {
   const compilePlan = async (
     domainKeys: readonly string[],
     includeReports: boolean,
-    includeDescribe: boolean,
     options: {
       readonly sourceOverrides?: ReadonlyMap<string, string>;
       readonly sliceTargets?: readonly PlanSourceSliceTarget[];
@@ -6880,7 +7005,6 @@ async function main(): Promise<void> {
     const signature = JSON.stringify({
       domains: ordered,
       reports: includeReports,
-      describe: includeDescribe,
       slice:
         effectiveSliceTargets?.map((target) => [
           target.modulePath,
@@ -6895,7 +7019,6 @@ async function main(): Promise<void> {
       planEntrySource(
         ordered,
         includeReports,
-        includeDescribe,
         options.sourceOverrides,
         options.includePreloads ?? options.sliceTargets === undefined,
         options.routingOverride,
@@ -7035,14 +7158,9 @@ async function main(): Promise<void> {
   const routePlan = async (
     selector: string,
     domainKeys: readonly string[],
-    includeReports = false,
-    includeDescribe = false
+    includeReports = false
   ): Promise<void> => {
-    const asset = await compilePlan(
-      domainKeys,
-      includeReports,
-      includeDescribe
-    );
+    const asset = await compilePlan(domainKeys, includeReports);
     planRoutes.push({ selector, planSha256: asset.sha256 });
   };
   const routeAsset = (selector: string, asset: UsdPlanAsset): void => {
@@ -7086,7 +7204,7 @@ async function main(): Promise<void> {
   // content hash, and emitted sorted by selector/hash), so compile them concurrently and bind
   // routes afterwards in declaration order.
   const domainPlans = await Promise.all(
-    orderedDomainKeys.map((key) => compilePlan([key], false, false))
+    orderedDomainKeys.map((key) => compilePlan([key], false))
   );
   orderedDomainKeys.forEach((key, index) => {
     const asset = domainPlans[index]!;
@@ -7158,7 +7276,7 @@ async function main(): Promise<void> {
       const source = `    ${JSON.stringify(
         BUSINESS_BIRTH_FRAMEWORK_PLAN_DOMAIN
       )}: [${selectedSources.join(", ")}],`;
-      frameworkPlan = compilePlan([domain], false, false, {
+      frameworkPlan = compilePlan([domain], false, {
         sourceOverrides: new Map([[domain, source]]),
         includePreloads: false,
         cacheKey: "business-birth-framework",
@@ -7228,7 +7346,7 @@ async function main(): Promise<void> {
           selectedModule,
           ...generated,
         ].join(", ")}],`;
-        const asset = await compilePlan([domain], false, false, {
+        const asset = await compilePlan([domain], false, {
           sourceOverrides: new Map([[domain, source]]),
           sliceTargets: selected,
         });
@@ -7386,7 +7504,7 @@ async function main(): Promise<void> {
       )}: [${moduleExpression}],`;
       workspaceInvariantPlans.push({
         invariantIds: members.map(([id]) => id),
-        plan: compilePlan([domain], false, false, {
+        plan: compilePlan([domain], false, {
           sourceOverrides: new Map([[domain, domainSource]]),
           sliceTargets: [...selectedByKey.values()],
           cacheKey: `workspace-invariants:${directiveId}:${members
@@ -7403,9 +7521,11 @@ async function main(): Promise<void> {
     }
   }
   stage("workspace invariant plans");
-  const reportRoutes: Promise<void>[] = [
-    routePlan("describe", orderedDomainKeys, false, true),
-  ];
+  // No `describe` route: the kernel derives a workspace's description from its installed law
+  // (rpc_describe renders it from the command contract and read projection), so a compiled
+  // self-description plan over every domain was never executed, and it was the one composition
+  // file a single-domain edit moved (CAP-658).
+  const reportRoutes: Promise<void>[] = [];
   for (const reportId of Object.keys(cfg.reports ?? {}))
     reportRoutes.push(routePlan(`report:report:${reportId}`, [], true));
   const routeTable = (
@@ -7447,7 +7567,7 @@ async function main(): Promise<void> {
     }
   }
   await Promise.all(reportRoutes);
-  stage("describe + report plans");
+  stage("report plans");
   // Adaptive offer splitting deliberately compiles candidate parents before retaining their children.
   // Only route-reachable content is custody; exploratory compiler work never becomes law bytes.
   const routedPlanHashes = new Set(planRoutes.map((route) => route.planSha256));
@@ -7747,6 +7867,7 @@ async function main(): Promise<void> {
   };
   let lawClosure = emitLawClosure(
     cfg.name,
+    cfg.version === undefined ? undefined : lawVersionClaim(cfg.version),
     domainModules.map((module) => module.domain ?? module.name),
     runtimeDependencies,
     v3DomainAssets,
@@ -7908,6 +8029,7 @@ async function main(): Promise<void> {
     };
     lawClosure = emitLawClosure(
       cfg.name,
+      cfg.version === undefined ? undefined : lawVersionClaim(cfg.version),
       domainModules.map((module) => module.domain ?? module.name),
       runtimeDependencies,
       v3DomainAssets,
@@ -7934,8 +8056,10 @@ async function main(): Promise<void> {
     if (probeFailure !== undefined) fail(probeFailure);
   }
   stage("boot probe (verdict)");
-  // The composed USDA closure is the law. Generated clients, lifecycle rows and
-  // compatibility metadata all bind this identity, never the retired flattened envelope.
+  // The PACKAGE identity: this compiler's own closure of the package (root.usda, routes and its derived
+  // finished goods included). It names the `.law.usdz` bytes and the package lane; it is NOT what a
+  // unit-lane target serves (that target's kernel composes the units itself, CAP-773). The law
+  // identity is the unit set identity below.
   const domainHash = lawClosure.identity;
   const rootAsset = lawClosure.assets.find(
     (asset) => asset.logicalPath === lawClosure.rootLogicalPath
@@ -7949,11 +8073,18 @@ async function main(): Promise<void> {
       .map((asset) => [`layers/${asset.logicalPath}`, asset.bytes] as const),
   ]);
   writeFileSync(lawUsdzPath, lawUsdz);
-  // The compiled law's identity on its own line, for release gates that need the hash and nothing else.
+  // The package closure's identity on its own line, for gates that check the `.law.usdz` bytes.
   writeFileSync(path.join(outDir, `${cfg.name}.law.sha256`), `${domainHash}\n`, "utf8");
   // D21: the same law, authored as per-domain units the kernel composes. Split from the closure just
   // emitted (its bytes and identity are untouched), previewed for exact coverage, and written as plain
   // trees: in custody each unit is a git tree, so git owns compression and deduplication.
+  // THE LAW IDENTITY (CAP-773): the unit set identity of the units below, the kernel's own definition
+  // (law_unit_set_identity.ts). Releases, generated clients and qualification name the law by it.
+  let unitSetIdentity: string;
+  // THE PER-DOMAIN REQUIREMENTS (CAP-666): each application domain's unit hash beside the identity of its own
+  // compatibility requirement, derived from the units just split and the interfaces just emitted. Written into
+  // no law or package (the era rule); the generated clients, the approved model and the inventory carry them.
+  let domainRequirements: readonly DomainUnitRequirement[];
   {
     const lawUnits = (() => {
       try {
@@ -7975,6 +8106,13 @@ async function main(): Promise<void> {
       }
       writeFileSync(path.join(unitPath, LAW_UNIT_MANIFEST), unit.manifest);
     }
+    unitSetIdentity = lawUnitSetIdentityWith(
+      (bytes) => createHash("sha256").update(bytes).digest("hex"),
+      lawUnits.map((unit) => ({ key: unit.key, unitHash: unit.hash }))
+    );
+    // The law identity on its own line, for publishers and gates that need it and nothing else.
+    writeFileSync(path.join(outDir, `${cfg.name}.units.sha256`), `${unitSetIdentity}\n`, "utf8");
+    domainRequirements = domainRequirementsOf(lawUnits, packageInterface, sha256HexUtf8);
   }
   const layeredRootPath = path.join(
     lawClosureAssetsPath,
@@ -8133,6 +8271,7 @@ async function main(): Promise<void> {
     package: cfg.name,
     // Binds the summary to the published package asset consumed by an application stage.
     sourceIdentity: composedUsdIdentity!,
+    unitSetIdentity,
     domainHash,
     lawClosureIdentity: lawClosure.identity,
     domains: presentationDomainModules.map((m) => ({
@@ -8168,7 +8307,10 @@ async function main(): Promise<void> {
 
   const summaryTxt = [
     `${cfg.name} — compiled Nomos domain package`,
-    `law (domainHash): ${domainHash}   # composed typed USDA closure identity`,
+    `law (unit set): ${unitSetIdentity}   # THE law identity: ${cfg.name}.units/, as releases, clients and qualification name it (${cfg.name}.units.sha256)`,
+    `claimed version: ${cfg.version ?? "none"}   # orders versions of law '${cfg.name}' (nomos.project.ts version); covered by the unit set identity`,
+    `package closure: ${domainHash}   # package — not what targets serve: this compiler's closure of ${cfg.name}.law.usdz (${cfg.name}.law.sha256)`,
+    `served law: githolon domains status <ws>   # each target's kernel composes the units into its own closure (it depends on that kernel's composer)`,
     `law transport: ${path.basename(
       lawUsdzPath
     )}   # lossless one-file USDZ envelope; not canonical custody`,
@@ -8190,6 +8332,11 @@ async function main(): Promise<void> {
         d.counts.join(", ") || "—"
       }   sums: ${d.sums.join(", ") || "—"}`,
     ]),
+    ...(releasedBaseline === undefined
+      ? [`baseline: NONE   # not a publishable build; githolon compile --publishable needs a pinned nomos.baseline.usda`]
+      : [
+          `baseline: ${releasedBaselineSha256}   # extends ${releasedBaseline.release === "none" ? "unreleased units" : `release ${releasedBaseline.release}`}, law ${releasedBaseline.unitSet} (${releasedBaseline.source})`,
+        ]),
     `deploy: githolon deploy <ws> --file ${cfg.name}.law.usdz`,
     packageAssetPath !== undefined
       ? `package asset: ${path.basename(
@@ -8222,6 +8369,7 @@ async function main(): Promise<void> {
   const provenance = buildProvenanceStatement({
     packageName: cfg.name,
     domainHash,
+    unitSetIdentity,
     artifacts: [
       { name: path.basename(lawUsdzPath) },
       {
@@ -8245,6 +8393,16 @@ async function main(): Promise<void> {
       id: "https://github.com/Captain-App/nomos2",
       version: dslVersion,
     },
+    ...(releasedBaseline === undefined || releasedBaselineSha256 === undefined
+      ? {}
+      : {
+          baseline: {
+            sha256: releasedBaselineSha256,
+            source: releasedBaseline.source,
+            release: releasedBaseline.release,
+            unitSet: releasedBaseline.unitSet,
+          },
+        }),
   });
   writeFileSync(
     path.join(outDir, `${cfg.name}.provenance.json`),
@@ -8272,7 +8430,9 @@ async function main(): Promise<void> {
   );
   const clientOptions = {
     packageName: cfg.name,
-    domainHash,
+    // THE LAW the generated clients name: the unit set (CAP-773), never the package closure.
+    domainHash: unitSetIdentity,
+    domainRequirements,
     lawAssetName: `${cfg.name}.law.usdz`,
     interface: packageInterface,
     kernelContracts,
@@ -8380,10 +8540,9 @@ async function main(): Promise<void> {
     writeKeyProofUsda(file: string, format: string, key: string): void;
   };
   const declarationProofFormat = "nomos.typescript-declaration-proof.v1";
-  const normalizedClientSource = clientSource.replaceAll(
-    domainHash,
-    "<nomos-composed-law-identity>"
-  );
+  const normalizedClientSource = clientSource
+    .replaceAll(unitSetIdentity, "<nomos-law-unit-set-identity>")
+    .replaceAll(domainHash, "<nomos-package-identity>");
   const declarationInputIdentity = createHash("sha256")
     .update(`${declarationProofFormat}\0`)
     .update(normalizedClientSource)
@@ -8863,7 +9022,7 @@ async function main(): Promise<void> {
       const r = emitDartPackages(
         presentationDomainModules,
         dartOut,
-        domainHash,
+        { unitSet: unitSetIdentity, packageSha256: domainHash, domainRequirements },
         typedLawGraphs,
         typedLawPathsByName,
         packageInterface,
@@ -8891,7 +9050,7 @@ async function main(): Promise<void> {
       dartFiles = emitDart(
         presentationDomainModules,
         dartOut,
-        domainHash,
+        { unitSet: unitSetIdentity, packageSha256: domainHash, domainRequirements },
         typedLawGraphs,
         typedLawPathsByName,
         packageInterface,
@@ -9274,10 +9433,12 @@ async function main(): Promise<void> {
   // ── summary ──
   const rel = (p: string) => path.relative(process.cwd(), p);
   console.log(`nomos-compile: ${cfg.name}`);
+  console.log(`  law        unit set ${unitSetIdentity} (${rel(path.join(outDir, `${cfg.name}.units`))})`);
+  if (cfg.version !== undefined) console.log(`  version    ${cfg.name}@${cfg.version} (claimed; covered by the unit set identity)`);
   console.log(
-    `  law        ${rel(lawUsdzPath)} (${lawUsdz.byteLength} transport bytes)`
+    `  package    ${domainHash} — package — not what targets serve (${rel(lawUsdzPath)}, ${lawUsdz.byteLength} transport bytes)`
   );
-  console.log(`  domainHash ${domainHash}`);
+  console.log(`  served     githolon domains status <ws> — each target's kernel composes the units into its own closure`);
   console.log(
     custodyPlacementDeclarations.length > 0
       ? `  placement  ${rel(custodyPlacementDeclarationsPath)} (${
@@ -9506,6 +9667,7 @@ async function main(): Promise<void> {
         dslDir: string;
         configPath: string;
         argumentIdentity: string;
+        importedSources?: readonly string[];
       }): unknown;
       generatedOutputFiles(
         outDir: string,
@@ -9525,6 +9687,11 @@ async function main(): Promise<void> {
       dslDir: DSL_DIR,
       configPath,
       argumentIdentity: compileArgumentIdentity,
+      importedSources: [
+        ...((globalThis as Record<symbol, unknown>)[
+          Symbol.for("nomos.compile.importedSources")
+        ] as ReadonlySet<string> | undefined ?? []),
+      ],
     });
     const outputs = proof.generatedOutputFiles(outDir, [
       lockPath,