@githolon/dsl 0.114.0 → 0.115.0

package/src/compile_package_main.ts

@@ -1,3 +1,4 @@
+import { collectPackageSources, findBirthKeyWrites, formatBirthKeyWriteWarnings } from "./birth_key_rule.js";
 import type { Directive } from "./directive.js";
 // NOMOS — Nomos Sovereign: participants act · verify · remember LOCALLY; hosted
 // remotes are replaceable custody/transport, not truth.  ⇒ ONE Nomos GitHolon
@@ -46,6 +47,7 @@ import type { Directive } from "./directive.js";
 import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";
 import { checkOperationContracts, deriveInterfaceOffer } from "./operation_contract_check.js";
+import { lawVersionClaim, type LawVersionClaim } from "./law_version.js";
 import { compilerIntermediateCacheRoot, compilerSourceName, compilerSourceRoot } from "./compiler_cache.js";
 import {
   APPLICATION_CONTRACT_MODULE,
@@ -80,6 +82,7 @@ import ts from "typescript";
 import type { AggregateHandle } from "./aggregate.js";
 import {
   generateDartDomain,
+  dartBrandNamesForModule,
   generateDartContracts,
   generateDartActivityRegistry,
   collectActivityDescriptors,
@@ -97,6 +100,8 @@ import {
 } from "./evolution_files.js";
 import { assertEvolutionModuleExports } from "./evolution.js";
 import { readHistoricalIdentityFrontier } from "./identity_frontier.js";
+import { parseBaselineUsda, type ReleasedBaseline } from "./baseline_usda.js";
+import { BaselineRefusal, assertBaselineRetained, importBaseline, verifyBaselinePin } from "./baseline_import.js";
 import {
   dartBridgeClientOperationDirectiveIds,
   generateDartDomainClient,
@@ -266,6 +271,7 @@ import {
   splitLawUnits,
 } from "./law_units.js";
 import { lawUnitSetIdentityWith } from "./law_unit_set_identity.js";
+import { domainRequirementsOf, type DomainUnitRequirement } from "./domain_requirements.js";
 import { checkDomainModules, formatFindings, hasRefusal } from "./law_check.js";
 import {
   currentEvolveLaw,
@@ -624,6 +630,7 @@ const compareLogicalPath = (left: string, right: string): number =>
  * inventories the USDZ/Git tree and re-hashes every logically named layer. */
 function emitLawClosure(
   packageName: string,
+  claimedVersion: LawVersionClaim | undefined,
   exportedDomains: readonly string[],
   runtimeDependencies: readonly RuntimePackageDependency[],
   domainAssets: readonly EmittedLawClosureAsset[],
@@ -670,6 +677,7 @@ function emitLawClosure(
     "package.usda",
     packageContractUsda({
       packageName,
+      ...(claimedVersion === undefined ? {} : { claimedVersion }),
       exportedDomains,
       runtimeDependencies,
     })
@@ -1265,6 +1273,7 @@ function closeComposedBusinessBirthPresentation(
     aggregateId?: unknown;
     rootId?: unknown;
     namespace?: unknown;
+    keyMode?: unknown;
     keyField?: unknown;
   };
   type BirthDirective = DomainModule["directives"][number] & {
@@ -1278,14 +1287,15 @@ function closeComposedBusinessBirthPresentation(
       typeof birth.aggregateId !== "string" ||
       typeof birth.rootId !== "string" ||
       typeof birth.namespace !== "string" ||
-      typeof birth.keyField !== "string"
+      (typeof birth.keyField !== "string" && birth.keyMode !== "minted")
     )
       return undefined;
     return [
       birth.aggregateId,
       birth.rootId,
       birth.namespace,
-      birth.keyField,
+      // A minted birth has no key field; its identity here is the minted mode itself.
+      typeof birth.keyField === "string" ? birth.keyField : "\u0001minted",
     ].join("\u0000");
   };
 
@@ -1335,6 +1345,8 @@ interface DartSharedSymbols {
   readonly frameworkDirIds: ReadonlySet<string>;
   readonly frameworkQueryIds: ReadonlySet<string>;
   readonly sharedVoNames: ReadonlySet<string>;
+  /** Branded-id extension types used by ≥2 domains — declared ONCE in the framework file. */
+  readonly sharedBrandNames: ReadonlySet<string>;
   readonly hasFrameworkSymbols: boolean;
   /** The synthetic module whose emit IS `nomos_framework.dart` — undefined when nothing is shared. */
   readonly frameworkMod: DomainModule | undefined;
@@ -1496,11 +1508,23 @@ function collectDartSharedSymbols(
   const sharedVos = [...sharedVoNames]
     .sort()
     .map((name) => voDescriptorByName.get(name)!);
+  // TYPED IDS: a branded id used by two domains (a parent's business-birth payload and the child's key
+  // field, typically) would otherwise declare one extension type per file and make the barrel ambiguous.
+  const brandDomains = new Map<string, number>();
+  for (const mod of modules) {
+    for (const brand of dartBrandNamesForModule(mod)) {
+      brandDomains.set(brand, (brandDomains.get(brand) ?? 0) + 1);
+    }
+  }
+  const sharedBrandNames: ReadonlySet<string> = new Set(
+    [...brandDomains.entries()].filter(([, n]) => n > 1).map(([name]) => name).sort()
+  );
   const hasFrameworkSymbols =
     frameworkAggs.length > 0 ||
     frameworkDirs.length > 0 ||
     frameworkQueries.length > 0 ||
-    sharedVos.length > 0;
+    sharedVos.length > 0 ||
+    sharedBrandNames.size > 0;
   const frameworkMod: DomainModule | undefined = hasFrameworkSymbols
     ? {
         name: FRAMEWORK_FILE,
@@ -1518,6 +1542,7 @@ function collectDartSharedSymbols(
     frameworkDirIds: new Set(frameworkDirById.keys()),
     frameworkQueryIds: new Set(frameworkQueryById.keys()),
     sharedVoNames,
+    sharedBrandNames,
     hasFrameworkSymbols,
     frameworkMod,
   };
@@ -1535,6 +1560,7 @@ function domainDedupOpts(
     readonly skipDirectiveIds: Set<string>;
     readonly skipQueryIds: Set<string>;
     readonly skipValueObjectNames: Set<string>;
+    readonly skipBrandNames: Set<string>;
   };
   readonly foldsFramework: boolean;
 } {
@@ -1562,11 +1588,17 @@ function domainDedupOpts(
       .filter((d) => shared.sharedVoNames.has(d.name))
       .map((d) => d.name)
   );
+  const skipBrandNames = new Set(
+    [...dartBrandNamesForModule(modForDart)].filter((name) =>
+      shared.sharedBrandNames.has(name)
+    )
+  );
   const foldsFramework =
     skipAggregateIds.size > 0 ||
     skipDirectiveIds.size > 0 ||
     skipQueryIds.size > 0 ||
-    skipValueObjectNames.size > 0;
+    skipValueObjectNames.size > 0 ||
+    skipBrandNames.size > 0;
   return {
     modForDart,
     skips: {
@@ -1574,6 +1606,7 @@ function domainDedupOpts(
       skipDirectiveIds,
       skipQueryIds,
       skipValueObjectNames,
+      skipBrandNames,
     },
     foldsFramework,
   };
@@ -2146,6 +2179,8 @@ function emitDartOperationProto(
 interface CompiledLawIdentities {
   readonly unitSet: string;
   readonly packageSha256: string;
+  /** One requirement per application domain (CAP-666): its unit hash and its generated requirement identity. */
+  readonly domainRequirements: readonly DomainUnitRequirement[];
 }
 
 function emitDart(
@@ -2227,7 +2262,7 @@ function emitDart(
         ? []
         : [{ module, graph, paths }];
     }),
-    { lawUnitSet: law.unitSet, lawPackageSha256: law.packageSha256 }
+    { lawUnitSet: law.unitSet, lawPackageSha256: law.packageSha256, domainRequirements: law.domainRequirements }
   );
   if (applicationFrameworkCallsSource !== undefined) {
     const applicationFrameworkCallsPath = path.join(
@@ -2249,6 +2284,7 @@ function emitDart(
       FRAMEWORK_FILE,
       generateDartDomain(shared.frameworkMod, {
         additionalValueObjects: shared.frameworkMod.valueObjects ?? [],
+        extraBrandNames: [...shared.sharedBrandNames],
       })
     );
   }
@@ -2542,12 +2578,12 @@ const dartTypesImportFor = (generatedSource: string): string => {
  *  just the floor generated code needs — a lagging pin forces tenants into dependency_overrides. */
 // 0.3.0: SurfacedValue<T>/SurfacedObservation/PendingConflictRow — generated Surfaced-field typing +
 //        the pendingConflicts read rows.
-const NOMOS_TYPES_DEP = "^0.13.0";
+const NOMOS_TYPES_DEP = "^0.14.0";
 // 0.48.x: session-bound clients (XClient.bind/NomosClientInterface/DomainClientSessionMismatch/
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
-const NOMOS_CLIENT_DEP = "^0.68.0";
-const NOMOS_FLUTTER_DEP = "^0.67.0";
+const NOMOS_CLIENT_DEP = "^0.69.0";
+const NOMOS_FLUTTER_DEP = "^0.68.0";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in the Dart and Flutter
 // package pubspecs — a release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).
@@ -3390,6 +3426,7 @@ function emitDartPackages(
       FRAMEWORK_FILE,
       generateDartDomain(shared.frameworkMod, {
         additionalValueObjects: shared.frameworkMod.valueObjects ?? [],
+        extraBrandNames: [...shared.sharedBrandNames],
       })
     );
   }
@@ -3680,7 +3717,7 @@ function emitDartPackages(
         ? []
         : [{ module, graph, paths }];
     }),
-    { lawUnitSet: law.unitSet, lawPackageSha256: law.packageSha256 }
+    { lawUnitSet: law.unitSet, lawPackageSha256: law.packageSha256, domainRequirements: law.domainRequirements }
   );
   const workspaceAccessReadImports = new Map<string, string>();
     for (const module of operationProtoModules) {
@@ -4205,6 +4242,7 @@ async function main(): Promise<void> {
     "--preflight",
     "--inspect-sqlite",
     "--inspect-law",
+    "--publishable",
   ]);
   for (const flag of argv.filter((arg) => arg.startsWith("--"))) {
     if (supportedFlags.has(flag)) continue;
@@ -4240,6 +4278,9 @@ async function main(): Promise<void> {
   // `dart analyze` on the generated Dart package after emission and fails the compile on red.
   const analyzeFlag =
     argv.includes("--analyze") || process.env.NOMOS_ANALYZE === "1";
+  // A PUBLISHABLE compile (architecture/domain_release_lifecycle.md, step 1) must start from the
+  // baseline exported from released custody: it refuses without a pinned `nomos.baseline.usda`.
+  const publishableFlag = argv.includes("--publishable");
   const configArg = argv.find((a) => !a.startsWith("--")) ?? "nomos.project.ts";
   const configPath = path.resolve(process.cwd(), configArg);
   if (!existsSync(configPath)) fail(`config not found: ${configPath}`);
@@ -4324,6 +4365,39 @@ async function main(): Promise<void> {
       "nomos.project.ts no longer accepts 'layered': every law closure is layered, with no alternate compile lane"
     );
   }
+  // ── THE RELEASED BASELINE (CAP-660) ──────────────────────────────────────────────────────────
+  // `nomos.project.ts` pins the baseline by content address. Verify the bytes are the pinned ones
+  // and read it now, before any identity is touched; the import and the retention proof follow.
+  const baselineRefused = (error: unknown): never => {
+    if (error instanceof BaselineRefusal) fail(`[${error.code}] ${error.message}`);
+    throw error;
+  };
+  let releasedBaseline: ReleasedBaseline | undefined;
+  let releasedBaselineSha256: string | undefined;
+  if (cfg.baseline === undefined) {
+    if (publishableFlag) {
+      fail(
+        "[baseline-required] a publishable compile must name the released baseline it extends: " +
+          `run \`githolon baseline export --units build/${cfg.name}.units\` (or --release <id>) against the release ` +
+          "you are extending, commit nomos.baseline.usda, and pin it in nomos.project.ts as " +
+          "baseline: { artifact: \"./nomos.baseline.usda\", sha256: \"<printed sha256>\" }"
+      );
+    }
+  } else {
+    const baselinePath = path.resolve(cfgDir, cfg.baseline.artifact);
+    if (!existsSync(baselinePath)) {
+      fail(`[baseline-unreadable] pinned baseline not found: ${baselinePath}`);
+    }
+    const baselineText = readFileSync(baselinePath, "utf8");
+    try {
+      verifyBaselinePin(baselineText, cfg.baseline);
+      releasedBaseline = parseBaselineUsda(baselineText);
+    } catch (error) {
+      if (error instanceof BaselineRefusal) baselineRefused(error);
+      fail(`[baseline-unreadable] ${cfg.baseline.artifact}: ${(error as Error).message}`);
+    }
+    releasedBaselineSha256 = cfg.baseline.sha256;
+  }
   let sourceTopologyDiagnostics: ReturnType<
     typeof assertPackageFeatureTopology
   > = [];
@@ -4395,6 +4469,7 @@ async function main(): Promise<void> {
   if (cfg.rootPart !== undefined) {
     applicationBirthPolicyDomains.push(APPLICATION_HOME_DOMAIN);
   }
+  const authoredDomainModules: Mod[] = [];
   for (const domain of cfg.domains) {
     let authored: Mod = {};
     for (const rel of domain.modules) {
@@ -4420,10 +4495,32 @@ async function main(): Promise<void> {
       }
     }
     const expanded = expandBusinessBirthExports(authored, domain.key);
+    authoredDomainModules.push(authored);
     if (directivesOf(expanded).some((dir) => dir.birthsChild === true)) {
       applicationBirthPolicyDomains.push(domain.key);
     }
   }
+  // A workspace name is fixed at birth, and the framework enforces it at the kernel: every field-keyed
+  // birth's key is write-once (aggregate.ts BIRTH_KEY_WRITE_ONCE_CODE). Statically WARN at each source line
+  // that writes a key outside the birth in a way that rule will refuse, or that keys another instance
+  // (CAP-804; architecture/choosing_a_birth_key.md). Advisory only — the runtime rule is the guarantee.
+  {
+    const birthKeyWarnings = findBirthKeyWrites(
+      authoredDomainModules,
+      collectPackageSources(
+        cfg.domains.flatMap((domain) => domain.modules.map((rel) => path.resolve(cfgDir, rel))),
+        cfgDir
+      ),
+      { root: cfgDir }
+    );
+    if (birthKeyWarnings.length > 0) {
+      console.warn(
+        `nomos-compile: ${birthKeyWarnings.length} birth-key write warning(s)`
+      );
+      for (const line of formatBirthKeyWriteWarnings(birthKeyWarnings))
+        console.warn(line);
+    }
+  }
   stage("domain discovery imports");
   if (
     cfg.application?.homeGenesis !== undefined &&
@@ -5617,12 +5714,36 @@ async function main(): Promise<void> {
     ? parseIdentityUsda(readFileSync(lockPath, "utf8"))
     : undefined;
   const historicalFrontier = readHistoricalIdentityFrontier(lockPath);
+  // Outside Git custody (a clean export, a CI checkout without history) the released baseline IS
+  // the evolution frontier: it carries every released aggregate and field by sid, so a removal
+  // without a declared retirement still refuses. It carries no value contracts, so it never
+  // produces a false in-place refusal.
   const historicalLock: CompilerIdentityModel | undefined =
     historicalFrontier === undefined
-      ? undefined
+      ? releasedBaseline?.continuity
       : parseIdentityUsda(historicalFrontier.source);
   const inferredRenames: { domain: string; renames: InferredRename[] }[] = [];
   let nextIdentity = identityRegistryFromModel(priorLock);
+  if (releasedBaseline !== undefined) {
+    // Verify the ledger against released custody and import what it lacks, so a clean checkout
+    // allocates the released sids and wire keys rather than fresh ones, and a diverged branch
+    // refuses with the coordinate named (baseline_import.ts).
+    try {
+      const imported = importBaseline(
+        nextIdentity,
+        releasedBaseline,
+        cfg.domains.flatMap((domain) => [domain.key, ...(domain.name === undefined ? [] : [domain.name])])
+      );
+      nextIdentity = imported.registry;
+      console.log(
+        `baseline: ${releasedBaseline.release === "none" ? "unreleased units" : `release ${releasedBaseline.release}`} ` +
+          `(law ${releasedBaseline.unitSet}) — ${imported.verified} verified, ${imported.imported.length} identit${imported.imported.length === 1 ? "y" : "ies"} ` +
+          `and ${imported.allocated.length} wire allocation(s) imported${imported.relabelled.length === 0 ? "" : `, ${imported.relabelled.length} released rename(s) carried`}`
+      );
+    } catch (error) {
+      baselineRefused(error);
+    }
+  }
   const typedLawGraphs = new Map<string, LawGraph>();
   // The lock is project-wide, not package-local. Several package configs commonly live beside one
   // application stage; compiling one must not erase the stable identity of domains owned by its siblings.
@@ -5832,6 +5953,18 @@ async function main(): Promise<void> {
     return;
   }
 
+  // ── BASELINE RETENTION PROOF (CAP-660) ───────────────────────────────────────────
+  // Every released identity still resolves to its released sid and every released wire key is still
+  // the canonical allocation. Reconciliation never rewrites an allocation, so this holds by
+  // construction; proving it here keeps "the candidate extends the release" a checked fact.
+  if (releasedBaseline !== undefined) {
+    try {
+      assertBaselineRetained(nextIdentity, releasedBaseline);
+    } catch (error) {
+      baselineRefused(error);
+    }
+  }
+
   // ── ORDINARY-COMPILE EVOLUTION GATE ──────────────────────────────────────────────
   // Agents reliably run `compile`; they do not reliably discover an optional migration command.
   // Compare the candidate against the committed identity frontier here, after stable-id
@@ -5910,6 +6043,44 @@ async function main(): Promise<void> {
   // giant formatting-only diff in an established lock.
   writeFileSync(lockPath, serializeIdentityUsda(nextLock), "utf8");
 
+  // USDA is rendered directly from the typed graph. The final closure writer below publishes these
+  // exact texts under their logical paths; no parallel layer directory or JSON reconstruction exists.
+  const v3Closure = [...typedLawGraphs.values()];
+  const v3DomainAssets: EmittedLawClosureAsset[] = [];
+  const v3DomainRoots: string[] = [];
+  const v3LawPathByNode = new Map<LawGraph["nodes"][number], string>();
+  const v3CompiledGraphs = new Map<LawGraph, ReturnType<typeof compileSparseLawGraphUsda>>();
+  const typedDomainIdentityByName = new Map<string, string>();
+  const typedLawPathsByName = new Map<string, ReadonlyMap<string, string>>();
+  for (const [domain, graph] of typedLawGraphs) {
+    const safeDomain = domain.replace(/[^A-Za-z0-9._-]/g, "_");
+    const logicalPath = `domains/${safeDomain}.usda`;
+    const compiledLayer = compileSparseLawGraphUsda(
+      graph,
+      logicalPath,
+      v3Closure
+    );
+    v3CompiledGraphs.set(graph, compiledLayer);
+    const layerText = compiledLayer.text;
+    const sha256 = sha256HexUtf8(layerText);
+    v3DomainAssets.push({
+      logicalPath,
+      sha256,
+      utf8: layerText,
+    });
+    const domainRoot = compiledLayer.paths.get(graph.domain.entity.id);
+    if (domainRoot === undefined) {
+      fail(`domain '${domain}' did not emit its canonical OpenUSD root path`);
+    }
+    v3DomainRoots.push(domainRoot);
+    for (const node of graph.nodes) {
+      const lawPath = compiledLayer.paths.get(node.entity.id);
+      if (lawPath !== undefined) v3LawPathByNode.set(node, lawPath);
+    }
+    typedDomainIdentityByName.set(domain, sha256);
+    typedLawPathsByName.set(domain, compiledLayer.paths);
+  }
+
   // ── THE STRUCTURAL INTERFACE (#72) — directives (payload shapes) + aggregates (read
   // shapes, sid-keyed), keyed by DOMAIN. The SAME object is (a) baked into the generated
   // clients as their requirement and (b) staged on the deploy as the workspace's offer, so
@@ -5924,7 +6095,12 @@ async function main(): Promise<void> {
         `compiler surface invariant: domain '${key}' has no typed USDA graph`
       );
     }
-    const offeredInterface = domainInterfaceFromLawGraph(graph);
+    // Nested record members carry the allocation the generated codecs encode them under, which
+    // follows the composed layer's canonical prim (CAP-681).
+    const offeredInterface = domainInterfaceFromLawGraph(
+      graph,
+      typedLawPathsByName.get(mod.name)
+    );
     const di = publicClientInterface([mod], { [key]: offeredInterface })[key]!;
     const graphRoutes = graph.nodes
       .filter((node) => node.kind === "intent" && node.public)
@@ -6017,44 +6193,6 @@ async function main(): Promise<void> {
     }
   }
 
-  // USDA is rendered directly from the typed graph. The final closure writer below publishes these
-  // exact texts under their logical paths; no parallel layer directory or JSON reconstruction exists.
-  const v3Closure = [...typedLawGraphs.values()];
-  const v3DomainAssets: EmittedLawClosureAsset[] = [];
-  const v3DomainRoots: string[] = [];
-  const v3LawPathByNode = new Map<LawGraph["nodes"][number], string>();
-  const v3CompiledGraphs = new Map<LawGraph, ReturnType<typeof compileSparseLawGraphUsda>>();
-  const typedDomainIdentityByName = new Map<string, string>();
-  const typedLawPathsByName = new Map<string, ReadonlyMap<string, string>>();
-  for (const [domain, graph] of typedLawGraphs) {
-    const safeDomain = domain.replace(/[^A-Za-z0-9._-]/g, "_");
-    const logicalPath = `domains/${safeDomain}.usda`;
-    const compiledLayer = compileSparseLawGraphUsda(
-      graph,
-      logicalPath,
-      v3Closure
-    );
-    v3CompiledGraphs.set(graph, compiledLayer);
-    const layerText = compiledLayer.text;
-    const sha256 = sha256HexUtf8(layerText);
-    v3DomainAssets.push({
-      logicalPath,
-      sha256,
-      utf8: layerText,
-    });
-    const domainRoot = compiledLayer.paths.get(graph.domain.entity.id);
-    if (domainRoot === undefined) {
-      fail(`domain '${domain}' did not emit its canonical OpenUSD root path`);
-    }
-    v3DomainRoots.push(domainRoot);
-    for (const node of graph.nodes) {
-      const lawPath = compiledLayer.paths.get(node.entity.id);
-      if (lawPath !== undefined) v3LawPathByNode.set(node, lawPath);
-    }
-    typedDomainIdentityByName.set(domain, sha256);
-    typedLawPathsByName.set(domain, compiledLayer.paths);
-  }
-
   // Index the transient graph once. Both projections follow the same nominal edges, including
   // transitive cross-domain dependencies. Per-command selection also follows reverse guard edges;
   // the retained package command projection remains the compatibility consumer until the runtime
@@ -7729,6 +7867,7 @@ async function main(): Promise<void> {
   };
   let lawClosure = emitLawClosure(
     cfg.name,
+    cfg.version === undefined ? undefined : lawVersionClaim(cfg.version),
     domainModules.map((module) => module.domain ?? module.name),
     runtimeDependencies,
     v3DomainAssets,
@@ -7890,6 +8029,7 @@ async function main(): Promise<void> {
     };
     lawClosure = emitLawClosure(
       cfg.name,
+      cfg.version === undefined ? undefined : lawVersionClaim(cfg.version),
       domainModules.map((module) => module.domain ?? module.name),
       runtimeDependencies,
       v3DomainAssets,
@@ -7941,6 +8081,10 @@ async function main(): Promise<void> {
   // THE LAW IDENTITY (CAP-773): the unit set identity of the units below, the kernel's own definition
   // (law_unit_set_identity.ts). Releases, generated clients and qualification name the law by it.
   let unitSetIdentity: string;
+  // THE PER-DOMAIN REQUIREMENTS (CAP-666): each application domain's unit hash beside the identity of its own
+  // compatibility requirement, derived from the units just split and the interfaces just emitted. Written into
+  // no law or package (the era rule); the generated clients, the approved model and the inventory carry them.
+  let domainRequirements: readonly DomainUnitRequirement[];
   {
     const lawUnits = (() => {
       try {
@@ -7968,6 +8112,7 @@ async function main(): Promise<void> {
     );
     // The law identity on its own line, for publishers and gates that need it and nothing else.
     writeFileSync(path.join(outDir, `${cfg.name}.units.sha256`), `${unitSetIdentity}\n`, "utf8");
+    domainRequirements = domainRequirementsOf(lawUnits, packageInterface, sha256HexUtf8);
   }
   const layeredRootPath = path.join(
     lawClosureAssetsPath,
@@ -8163,6 +8308,7 @@ async function main(): Promise<void> {
   const summaryTxt = [
     `${cfg.name} — compiled Nomos domain package`,
     `law (unit set): ${unitSetIdentity}   # THE law identity: ${cfg.name}.units/, as releases, clients and qualification name it (${cfg.name}.units.sha256)`,
+    `claimed version: ${cfg.version ?? "none"}   # orders versions of law '${cfg.name}' (nomos.project.ts version); covered by the unit set identity`,
     `package closure: ${domainHash}   # package — not what targets serve: this compiler's closure of ${cfg.name}.law.usdz (${cfg.name}.law.sha256)`,
     `served law: githolon domains status <ws>   # each target's kernel composes the units into its own closure (it depends on that kernel's composer)`,
     `law transport: ${path.basename(
@@ -8186,6 +8332,11 @@ async function main(): Promise<void> {
         d.counts.join(", ") || "—"
       }   sums: ${d.sums.join(", ") || "—"}`,
     ]),
+    ...(releasedBaseline === undefined
+      ? [`baseline: NONE   # not a publishable build; githolon compile --publishable needs a pinned nomos.baseline.usda`]
+      : [
+          `baseline: ${releasedBaselineSha256}   # extends ${releasedBaseline.release === "none" ? "unreleased units" : `release ${releasedBaseline.release}`}, law ${releasedBaseline.unitSet} (${releasedBaseline.source})`,
+        ]),
     `deploy: githolon deploy <ws> --file ${cfg.name}.law.usdz`,
     packageAssetPath !== undefined
       ? `package asset: ${path.basename(
@@ -8242,6 +8393,16 @@ async function main(): Promise<void> {
       id: "https://github.com/Captain-App/nomos2",
       version: dslVersion,
     },
+    ...(releasedBaseline === undefined || releasedBaselineSha256 === undefined
+      ? {}
+      : {
+          baseline: {
+            sha256: releasedBaselineSha256,
+            source: releasedBaseline.source,
+            release: releasedBaseline.release,
+            unitSet: releasedBaseline.unitSet,
+          },
+        }),
   });
   writeFileSync(
     path.join(outDir, `${cfg.name}.provenance.json`),
@@ -8271,6 +8432,7 @@ async function main(): Promise<void> {
     packageName: cfg.name,
     // THE LAW the generated clients name: the unit set (CAP-773), never the package closure.
     domainHash: unitSetIdentity,
+    domainRequirements,
     lawAssetName: `${cfg.name}.law.usdz`,
     interface: packageInterface,
     kernelContracts,
@@ -8860,7 +9022,7 @@ async function main(): Promise<void> {
       const r = emitDartPackages(
         presentationDomainModules,
         dartOut,
-        { unitSet: unitSetIdentity, packageSha256: domainHash },
+        { unitSet: unitSetIdentity, packageSha256: domainHash, domainRequirements },
         typedLawGraphs,
         typedLawPathsByName,
         packageInterface,
@@ -8888,7 +9050,7 @@ async function main(): Promise<void> {
       dartFiles = emitDart(
         presentationDomainModules,
         dartOut,
-        { unitSet: unitSetIdentity, packageSha256: domainHash },
+        { unitSet: unitSetIdentity, packageSha256: domainHash, domainRequirements },
         typedLawGraphs,
         typedLawPathsByName,
         packageInterface,
@@ -9272,6 +9434,7 @@ async function main(): Promise<void> {
   const rel = (p: string) => path.relative(process.cwd(), p);
   console.log(`nomos-compile: ${cfg.name}`);
   console.log(`  law        unit set ${unitSetIdentity} (${rel(path.join(outDir, `${cfg.name}.units`))})`);
+  if (cfg.version !== undefined) console.log(`  version    ${cfg.name}@${cfg.version} (claimed; covered by the unit set identity)`);
   console.log(
     `  package    ${domainHash} — package — not what targets serve (${rel(lawUsdzPath)}, ${lawUsdz.byteLength} transport bytes)`
   );

package/src/composed_wire_identity.ts

@@ -0,0 +1,24 @@
+// NOMOS — The wire identity of an operation field under OpenUSD composition.
+//
+// Node-free on purpose: the compatibility graph reaches this from the law bundle (the release law's
+// plans bundle for a neutral platform), where `codegen_call_proto.ts` cannot live (it mints stable
+// ids through `node:crypto`). Both the generated codecs and the compatibility requirement derive a
+// nested member's allocation here, so the two can never disagree (CAP-681).
+
+/**
+ * OpenUSD composition may share structurally identical anonymous records between
+ * operation contracts. `compileSparseLawGraphUsda` records that sharing by
+ * redirecting each duplicate field path to the canonical field prim. The wire
+ * identity must follow that composed path too; using the duplicate graph-local
+ * SID makes generated clients speak a different Protobuf schema from the law the
+ * kernel actually installs.
+ */
+export function composedWireIdentity(
+  paths: ReadonlyMap<string, string>,
+  entity: { readonly id: string; readonly sid: string; readonly wireKey?: string },
+): string {
+  if (entity.wireKey !== undefined) return entity.wireKey;
+  const path = paths.get(entity.id);
+  const canonical = path?.match(/\/(?:Fields\/f_|Variants\/v_)([0-9a-f]{16})$/i)?.[1];
+  return canonical ?? entity.sid;
+}

package/src/directive.ts

@@ -536,6 +536,12 @@ export interface Directive<P = unknown> extends AuthenticatedMember {
    * `attestationAuthorizedGate`/`.attestationAuthorized()` naming convention; the declaration is the noun.)
    */
   readonly birthsChild?: boolean;
+  /** THE TYPED BIRTH KEY of a business birth (`birth(Aggregate, spec)`): the key's typed-id family, brand and
+   * the name's namespace. Lowered to the `nomos:birthKeyType` / `nomos:birthKeyBrand` /
+   * `nomos:birthKeyNamespace` era keys on the birthing intent; the kernel then requires every carried recipe
+   * of this intent to carry `nomos:birthKey`, checks its shape, and re-derives the child's name from it.
+   * Absent on every other directive (and on all historical law), so those chains replay unchanged. */
+  readonly birthKey?: import("./births.js").BirthKeyDeclaration;
   /** Additional ordinary offers which the born workspace's typed law requires in genesis.
    * This is compiler/runtime metadata attached only to a birthing directive. It contains no
    * payload or fallback value: the kernel checks that the re-derived recipe invokes each named