@githolon/dsl 0.119.29 → 0.119.32

package/dart/CHANGELOG.md

@@ -1,3 +1,17 @@
+## 0.70.30
+
+- Restage the bundled runtime with the coordinated compiler release that selects founded business births from the durable founding record, so console device re-enrolment keeps a founded workspace able to birth children (CAP-1011).
+
+- Release the generated runner restaged with the CAP-892 compiler (wire-type evolution gate) package versions.
+
+- The bundled Node runner carries the @githolon/runtime release that refuses an oversized live offer frame before encoding it and never records a refused frame as sent (CAP-1008).
+
+- The bundled Node runner carries the @githolon/runtime release whose post-rebase offer check asks the kernel for one change above the custodian's head instead of every unsent change (CAP-1007).
+
+## 0.70.29
+
+- The bundled Node runner names the @githolon/runtime release it was built from; it now carries the runtime that accompanies native hosts 0.69.5.
+
 ## 0.70.28
 
 - The bundled Node runner names the @githolon/runtime release it was built from; it now carries the runtime that accompanies native hosts 0.69.4.

package/dart/lib/src/runner/node-entry.mjs

@@ -26258,7 +26258,7 @@ function delayUntilDue(follow, nowUnixMillis) {
 
 // ../src/runtime/runtime_identity.ts
 init_define_NOMOS_KERNEL_RELEASE();
-var PEER_RUNTIME_IDENTITY = "0.119.29" ? `@githolon/runtime@${"0.119.29"}` : "@githolon/runtime@unbundled";
+var PEER_RUNTIME_IDENTITY = "0.119.32" ? `@githolon/runtime@${"0.119.32"}` : "@githolon/runtime@unbundled";
 
 // ../src/runtime/replica_follow_desk.ts
 init_define_NOMOS_KERNEL_RELEASE();
@@ -27740,6 +27740,10 @@ function boundedReason(reason) {
   return new TextDecoder().decode(bytes.subarray(0, CLOSE_REASON_BYTES)).replace(/\uFFFD+$/, "");
 }
 var LIVE_CARRIED_COMMITS_BYTES = 4 * 1024 * 1024;
+function offerFrameBytes(batch) {
+  const offers = batch.source.case === "inline" ? batch.source.value.offers : [];
+  return batch.evidencePack.byteLength + offers.reduce((total, offer) => total + offer.changeUsda.byteLength + offer.commitOid.length + offer.session.length + 16, 0) + 1024;
+}
 var LIVE_ANSWER_WINDOW = 15000000000n;
 var LIVE_STREAM_WINDOW = 16;
 var LIVE_BATCH_COMMITS = 64;
@@ -27854,8 +27858,7 @@ var LiveCorrespondenceDesk = class {
       send: (workspace, message) => {
         const link = this.#links.get(workspace);
         if (!link || link.state !== "open" || link.publisher) return false;
-        this.#send(link, message);
-        return true;
+        return this.#send(link, message);
       },
       // This copy's main as its kernel holds it (residency is not asked: a stream ask only ever
       // comes from a procedure that has the copy open).
@@ -28145,10 +28148,17 @@ var LiveCorrespondenceDesk = class {
     this.#effect(link, { case: "openUrl", value: `${endpoint}/v2/workspaces/${encodeURIComponent(link.binding.workspace)}/subscribe?${subscribeQuery(link)}` });
     return true;
   }
+  /** Sends one frame, or refuses one too large for the live socket (large recovery uses Git) and
+   * answers false: the caller must not account a refused frame as sent. An offers frame is refused
+   * on its byte-length estimate, before it is encoded; the encoded size is the backstop. */
   #send(link, message) {
+    if (message.case === "offers" && offerFrameBytes(create(CustodyOfferBatchRequestSchema, message.value)) > MAX_LIVE_FRAME_BYTES) {
+      return false;
+    }
     const bytes = toBinary(LiveOfferFrameSchema, create(LiveOfferFrameSchema, { message }));
-    if (bytes.byteLength > MAX_LIVE_FRAME_BYTES) return;
+    if (bytes.byteLength > MAX_LIVE_FRAME_BYTES) return false;
     this.#effect(link, { case: "send", value: bytes });
+    return true;
   }
   export(binding, base, requestId, options = {}) {
     if (this.kernel.isResident(binding.workspace) === false) {
@@ -28172,11 +28182,7 @@ var LiveCorrespondenceDesk = class {
       }
     }
     const batchRequestId = `${binding.replicaId}:${batchHead}`;
-    if (intents.length) {
-      this.#own.commits(binding.workspace, intents.map((intent) => intent.oid));
-      this.#own.request(binding.workspace, batchRequestId, batchHead);
-    }
-    return create(CustodyOfferBatchRequestSchema, {
+    const batch = create(CustodyOfferBatchRequestSchema, {
       protocolVersion: 2,
       requestId: batchRequestId,
       source: { case: "inline", value: { offers: intents.map((intent) => ({
@@ -28191,6 +28197,15 @@ var LiveCorrespondenceDesk = class {
       // travel the same way.
       evidencePack: options.carryCommits || intents.some((intent) => intent.transportRequirement === IntentTransportRequirement.COMMIT_TREE) ? this.kernel.packDelta(mount, requestId, batchHead, base) : new Uint8Array()
     });
+    if (!options.registerWhenSent) this.#ownBatch(binding.workspace, batch);
+    return batch;
+  }
+  /** Records a batch this replica offered, so the custodian's answer to it is recognised as its own. */
+  #ownBatch(workspace, batch) {
+    const offers = batch.source.case === "inline" ? batch.source.value.offers : [];
+    if (!offers.length) return;
+    this.#own.commits(workspace, offers.map((offer) => offer.commitOid));
+    this.#own.request(workspace, batch.requestId, offers.at(-1).commitOid);
   }
   receive(receipt) {
     const link = [...this.#links.values()].find((item) => item.id === receipt.connectionId);
@@ -28378,6 +28393,10 @@ var LiveCorrespondenceDesk = class {
       link.convergeDue = void 0;
       link.heldRing = void 0;
     }
+    this.#followNow(workspace);
+  }
+  /** Asks for the ordinary (HTTP) round for this workspace now. */
+  #followNow(workspace) {
     if (this.declined) this.declined(workspace);
     else this.remoteAdvanced?.(workspace);
   }
@@ -28539,19 +28558,31 @@ var LiveCorrespondenceDesk = class {
               link.binding,
               continuesAfter ?? answered2,
               ++this.#requestId,
-              { baseInHistory: continuesAfter !== void 0, carryCommits: false }
+              { baseInHistory: continuesAfter !== void 0, carryCommits: false, registerWhenSent: true }
             ) : this.#fittingBatch(link, continuesAfter ?? answered2, continuesAfter !== void 0);
             if (batch.evidencePack.byteLength > LIVE_CARRIED_COMMITS_BYTES && !link.publisher) {
               batch = create(CustodyOfferBatchRequestSchema, { ...batch, evidencePack: new Uint8Array() });
             }
+            let refused = false;
             if (batch.source.case === "inline" && batch.source.value.offers.length) {
-              this.#send(link, { case: "offers", value: link.publisher ? batch : create(CustodyOfferBatchRequestSchema, {
+              refused = !this.#send(link, { case: "offers", value: link.publisher ? batch : create(CustodyOfferBatchRequestSchema, {
                 ...batch,
                 baseHead: fence,
                 fastForwardOnly: true,
                 ...continuesAfter ? { continuesAfter } : {}
               }) });
-              if (!link.publisher && head) {
+              if (!refused) this.#ownBatch(link.binding.workspace, batch);
+              else if (!link.publisher) {
+                this.#followNow(link.binding.workspace);
+              } else {
+                this.#send(link, { case: "offers", value: create(CustodyOfferBatchRequestSchema, {
+                  protocolVersion: 2,
+                  requestId: batch.requestId,
+                  source: { case: "inline", value: { offers: [] } },
+                  ...head ? { observedHead: head } : {}
+                }) });
+              }
+              if (!refused && !link.publisher && head) {
                 const batchHead = batch.source.value.offers.at(-1).commitOid;
                 link.stream ??= { sent: batchHead, unanswered: [] };
                 link.stream.sent = batchHead;
@@ -28603,8 +28634,9 @@ var LiveCorrespondenceDesk = class {
   /**
    * A follower's next batch above `base`: up to the link's commit bound, cut down until its carried
    * commits fit LIVE_CARRIED_COMMITS_BYTES and its frame fits MAX_LIVE_FRAME_BYTES. A single commit
-   * too large to carry still goes out (the custodian admits it on its own commits). Each attempt is
-   * the same bounded export, so every batch still continues its base with no hole below it.
+   * too large to carry still goes out (the custodian admits it on its own commits); a single commit
+   * whose frame cannot fit is refused by #send before it is encoded. Each attempt is the same bounded
+   * export, so every batch still continues its base with no hole below it.
    */
   #fittingBatch(link, base, baseInHistory) {
     let bound = link.batchCommits ?? LIVE_BATCH_COMMITS;
@@ -28613,12 +28645,13 @@ var LiveCorrespondenceDesk = class {
         link.binding,
         base,
         ++this.#requestId,
-        { baseInHistory, carryCommits: true, maxCommits: bound }
+        { baseInHistory, carryCommits: true, maxCommits: bound, registerWhenSent: true }
       );
       const offers = batch.source.case === "inline" ? batch.source.value.offers : [];
-      const frameBytes = batch.evidencePack.byteLength + offers.reduce((total, offer) => total + offer.changeUsda.byteLength + offer.commitOid.length + offer.session.length + 16, 0) + 1024;
+      const frameBytes = offerFrameBytes(batch);
       if (offers.length > 1 && (batch.evidencePack.byteLength > LIVE_CARRIED_COMMITS_BYTES || frameBytes > MAX_LIVE_FRAME_BYTES)) {
-        bound = Math.max(1, Math.floor(offers.length / 2));
+        const first = offers[0];
+        bound = first.changeUsda.byteLength + first.commitOid.length + first.session.length + 16 + 1024 > MAX_LIVE_FRAME_BYTES ? 1 : Math.max(1, Math.floor(offers.length / 2));
         link.batchCommits = bound;
         continue;
       }
@@ -29708,6 +29741,7 @@ var notContainedThisLifetime = /* @__PURE__ */ new Map();
 var MAX_NOT_CONTAINED = 1024;
 var NOT_CONTAINED_REFUSALS = /* @__PURE__ */ new Set(["nomos.stream.off_main", "nomos.stream.history_required"]);
 var MAX_REBASES_PER_ROUND = 2;
+var OFF_CHAIN_BASE = /intents_above: base \S* is not on the first-parent chain/;
 var elapsedMillis = (clock2, started) => {
   const finished = clock2.monotonicNanoseconds();
   return finished >= started ? Number(finished - started) / 1e6 : 0;
@@ -30999,7 +31033,7 @@ var WorkspaceSyncWork = class {
     const head = this.#kernel.head(this.#mount, this.#requestId);
     if (tracked !== candidateHead || !head || head === tracked) return void 0;
     if (candidateHead === this.#rebaseFrom) return void 0;
-    if (this.#kernel.transportIntentsAbove(this.#mount, this.#requestId, 0n, tracked, this.#offerHead).intents.length === 0) return void 0;
+    if (!this.#holdsWorkAbove(tracked)) return void 0;
     this.#rebases += 1;
     this.#offerAfterConverge = false;
     this.#previousHead = tracked;
@@ -31010,6 +31044,23 @@ var WorkspaceSyncWork = class {
     this.#candidateDurable = true;
     return this.#offerOrReconcile();
   }
+  /**
+   * Whether the head this round offers holds at least one commit above `base`. Asks for the ONE
+   * commit immediately above base (the bounded `fromBase` walk the live export uses): a walk of
+   * commit objects to base plus one decoded change, never the whole suffix. Asking for the whole
+   * suffix only to test it for emptiness decoded every unsent change (5,001 commits: 3.6 s and
+   * 70.6 MB). A base off that head's first-parent chain (a dependency's captured prefix the
+   * rebase rewrote, or history that ends before base) is no fast-forward from base: there is
+   * nothing to offer onto it in this round, and the next round plans from the rebased head.
+   */
+  #holdsWorkAbove(base) {
+    try {
+      return this.#kernel.transportIntentsAbove(this.#mount, this.#requestId, 1n, base, this.#offerHead, true).intents.length > 0;
+    } catch (error) {
+      if (error instanceof Error && OFF_CHAIN_BASE.test(error.message)) return false;
+      throw error;
+    }
+  }
   /**
    * The admitted local changes a copy with a missing history commit holds above the provider's last
    * admitted head (its bookmark), oldest first. Without a reachable bookmark the walk ends at the

package/dart/pubspec.yaml

@@ -7,7 +7,7 @@ repository: https://github.com/Captain-App/nomos2
 description: >-
   Nomos 2 Dart client — generated domain values, intent payloads and application
   lifecycle types over the typed Nomos kernel protocol and USDA custody model.
-version: 0.70.28
+version: 0.70.30
 
 environment:
   sdk: ^3.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.119.29",
+  "version": "0.119.32",
   "type": "module",
   "sideEffects": false,
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
@@ -82,7 +82,7 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@githolon/runtime": "0.119.29",
+    "@githolon/runtime": "0.119.32",
     "@bufbuild/protobuf": "2.13.0",
     "@bufbuild/protoc-gen-es": "2.13.0",
     "esbuild": "0.24.2",

package/src/build_package.ts

@@ -79,6 +79,7 @@ import {
 } from "./value_object.js";
 import { expandCapabilityExports, isCapabilityDecl } from "./capability_exports.js";
 import { RelationTuple, relationTuplesByObject } from "./framework/relations.js";
+import { type FoundingPrincipalSourceQuery } from "./framework/founding_genesis.js";
 import {
   SignerDelegation,
   signerDelegationByUser,
@@ -578,6 +579,15 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
     if (!byId.has(AuthProvider.id)) byId.set(AuthProvider.id, AuthProvider);
     if (!directives.some((d) => d.id === seedAuthProvider.id)) directives.push(seedAuthProvider);
     if (!directives.some((d) => d.id === setAuthProvider.id)) directives.push(setAuthProvider);
+    // Read-only founding schemas preserve each source's physical namespace. No writer or ensure effect.
+    for (const reads of [spec.queries ?? [], ...directives.map((directive) => directive.declaredQueryReads ?? [])]) {
+      for (const query of reads) {
+        if (!("foundingPrincipalSource" in query)) continue;
+        const source = (query as FoundingPrincipalSourceQuery).foundingPrincipalSource;
+        if (!byId.has(source.id)) byId.set(source.id,
+          { ...source, businessBirthInternal: true } as AggregateHandle);
+      }
+    }
   }
   // SECONDARY-CREATE AUTO-DECLARE (secondary_ensure.ts — the id-mint-gate DX): a plan may `ensure(B, "det:id")`
   // a SECOND aggregate at a deterministic id of a type its directive does NOT declare `.ensures()` for. The

package/src/business_birth.ts

@@ -79,6 +79,8 @@ import {
 import {
   BirthOrigin,
   FoundingPrincipal,
+  FOUNDING_PRINCIPAL_ID,
+  foundingPrincipalSourceQueries,
   birthOriginVirginOnly,
   foundingPrincipalVirginOnly,
   seedBirthOrigin,
@@ -98,58 +100,49 @@ import {
   grantDelegatedRole,
   revokeDelegatedRole,
 } from "./framework/delegated_roles.js";
-import { consoleGovernanceLaw, inheritedGovernanceStep, INHERITED_SIGNER_GRANTOR } from "./framework/console_governance.js";
-import { readFrameworkDeclaredRows } from "./read.js";
+import { consoleGovernanceLaw, inheritedGovernanceStep } from "./framework/console_governance.js";
+import { readFrameworkDeclared, readFrameworkDeclaredRows } from "./read.js";
 import { endorsementOf } from "./principal_evidence.js";
 
-/** The `grantedBy` of every tuple `seedFoundingPrincipal` seats (`writeFoundingPrincipal` in
- * framework/founding_genesis.ts); nothing else grants as it. */
-const FOUNDING_GRANTOR = "genesis";
-
 /**
- * THE MODE IS SELECTED BY LAW, FROM THE PARENT'S STATE (identity target model D22). A parent founded
- * by token-free genesis by P holds `workspace:self#admin@P` granted by {@link FOUNDING_GRANTOR}
- * (`seedFoundingPrincipal`; nothing else grants admin as it), and P's founding key as a signer seated
- * on its warrant-free prefix. When the birth's principal IS that founder (a founded Home birthing its
- * owner's estate), the child is founded the same way: the author is its founding principal, with that
- * key, and the parent's operators and enrollers. Every other parent (every workspace born on the
- * certificate lane) keeps the historical recipe byte-for-byte, so live chains keep their path until
- * regenerated. Both reads are the declared `relationTuplesByObject` every birth already captures.
- *
- * The founding key is P's one `genesis`-granted signer. A workspace founded on the e712cae05 law, whose
- * inherited-governance step re-seated that same leaf as {@link INHERITED_SIGNER_GRANTOR} when P was also
- * an inherited operator or enroller, has no `genesis` key left; there the key is P's one
- * inheritance-granted signer instead. Current law never rewrites the founding leaf
- * (`inheritedGovernanceStepFrom` skips it), so its founders keep exactly one `genesis` key.
+ * Select token-free ancestry from the durable, kernel-validated founding singleton. Enrollment may
+ * re-grant an existing signer or admin leaf, so `grantedBy` is current grant provenance, not a birth
+ * fact. The original key still must be an active signer and its principal must remain an active
+ * administrator; neither another enrolled device nor an admin grant can replace the founding record.
  *
- * A signer leaf is an Lww entry, so its grantor is only the LAST writer: when an enroller enrols the
- * founding key again (`enrollDevice`) the leaf stops saying `genesis`, and when the founder revokes the
- * founding device the leaf stops being active. Either way neither rule above finds a key, and every
- * birth of a parent P founded used to fall onto the certificate lane, which a founded parent cannot
- * satisfy (CAP-957). P is still the founder — the admin grant above is the founding step's and nothing
- * else writes it — so the child is founded with a key P holds now: the lowest of P's active signer keys,
- * so the recipe stays a pure function of the tuple set. Anything else — no founding admin grant, several
- * `genesis` or several inherited keys, or no active key at all — is not a founded parent of P.
+ * A parent with no founding record for this principal keeps its historical certificate recipe.
+ * A founded parent whose original authority was revoked fails closed: key rotation is not permission
+ * to seat that revoked key in a new child, or to invent a new immutable founder key here.
  */
-function foundedBirthKeyHash(principal: string): string | undefined {
+function foundedBirthKeyHash(principal: string, domains: readonly string[]): string | undefined {
+  const rows = foundingPrincipalSourceQueries(domains).flatMap((query) => {
+    const rows = readFrameworkDeclared<unknown>(query.id, { principal });
+    if (!Array.isArray(rows)) throw new Error("founded-business-birth-invalid-founding-record");
+    return rows;
+  });
+  if (rows.length === 0) return undefined;
+  if (rows.length !== 1) throw new Error("founded-business-birth-ambiguous-founding-record");
+  const parsed = z.object({
+    id: z.literal(FOUNDING_PRINCIPAL_ID),
+    data: z.object({
+      principal: FoundingPrincipal.fields.principal.zod,
+      keyHash: FoundingPrincipal.fields.keyHash.zod,
+    }),
+  }).safeParse(rows[0]);
+  if (!parsed.success || parsed.data.data.principal !== principal
+      || !/^[0-9a-f]{64}$/.test(parsed.data.data.keyHash)) {
+    throw new Error("founded-business-birth-invalid-founding-record");
+  }
+  const keyHash = parsed.data.data.keyHash;
   const adminRow = readFrameworkDeclaredRows(relationTuplesByObject, RelationTuple, { object: "workspace:self" })
     .find((candidate) => candidate.relation === "admin");
-  const admin = (adminRow?.subjects as Record<string, { status?: string; grantedBy?: string }> | undefined)?.[principal];
-  if (admin?.status !== "active" || admin.grantedBy !== FOUNDING_GRANTOR) return undefined;
-  const rows = readFrameworkDeclaredRows(relationTuplesByObject, RelationTuple, { object: signerObject(principal) });
-  const row = rows.find((candidate) => candidate.relation === SIGNER_RELATION);
-  const subjects = row?.subjects as Record<string, { status?: string; grantedBy?: string }> | undefined;
-  const activeKeys = (grantor?: string) => Object.entries(subjects ?? {})
-    .filter(([subject, leaf]) =>
-      leaf?.status === "active" && (grantor === undefined || leaf.grantedBy === grantor) &&
-      /^key:[0-9a-f]{64}$/.test(subject))
-    .map(([subject]) => subject.slice("key:".length))
-    .sort();
-  const genesis = activeKeys(FOUNDING_GRANTOR);
-  if (genesis.length > 0) return genesis.length === 1 ? genesis[0] : undefined;
-  const inherited = activeKeys(INHERITED_SIGNER_GRANTOR);
-  if (inherited.length > 0) return inherited.length === 1 ? inherited[0] : undefined;
-  return activeKeys()[0];
+  const admin = (adminRow?.subjects as Record<string, { status?: string }> | undefined)?.[principal];
+  if (admin?.status !== "active") throw new Error("founded-business-birth-founder-not-current-admin");
+  const signerRow = readFrameworkDeclaredRows(relationTuplesByObject, RelationTuple, { object: signerObject(principal) })
+    .find((candidate) => candidate.relation === SIGNER_RELATION);
+  const signer = (signerRow?.subjects as Record<string, { status?: string }> | undefined)?.[`key:${keyHash}`];
+  if (signer?.status !== "active") throw new Error("founded-business-birth-founding-key-not-current-signer");
+  return keyHash;
 }
 
 /** @internal Compiler-only domain enumeration. It carries no allowance or authority. */
@@ -379,7 +372,7 @@ function lowerOne<P extends Record<string, unknown>, F extends Record<string, Fi
         );
       }
       const child = workspaceNameForKey(namespace, birthKey);
-      const foundingKeyHash = foundedBirthKeyHash(founder);
+      const foundingKeyHash = foundedBirthKeyHash(founder, decl.__nomosBirthPolicyDomains ?? initialBirthPolicyDomains);
       const founded = foundingKeyHash !== undefined;
       if (founded) {
         // No certificate or token proves who the founder is, so the parent's own admission does: the
@@ -516,6 +509,7 @@ function lowerOne<P extends Record<string, unknown>, F extends Record<string, Fi
     .reads(authProviderKeys)
     .reads(authProviderCertificates)
     .reads(relationTuplesByObject)
+    .reads(...foundingPrincipalSourceQueries(initialBirthPolicyDomains))
     // Token-free founding: the enroller tuples a founded child inherits.
     .reads(relationTuplesByRelation)
     .alsoEnsures(RelationTuple)
@@ -552,6 +546,10 @@ function lowerOne<P extends Record<string, unknown>, F extends Record<string, Fi
     businessBirth: metadata,
     [BUSINESS_BIRTH_POLICY_BINDING]: (domains: readonly string[]) => {
       decl.__nomosBirthPolicyDomains = domains;
+      const reads = parent.declaredQueryReads!;
+      reads.splice(0, reads.length,
+        ...reads.filter((query) => !("foundingPrincipalSource" in query)),
+        ...foundingPrincipalSourceQueries(domains));
     },
     ...(applicationIntentOnlyBirths.has(decl) ? { businessBirthInternal: true } : {}),
   } as BusinessBirthDirective;

package/src/compile_package_main.ts

@@ -2593,8 +2593,8 @@ const NOMOS_TYPES_DEP = "^0.16.0";
 // 0.48.x: session-bound clients (XClient.bind/NomosClientInterface/DomainClientSessionMismatch/
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
-const NOMOS_CLIENT_DEP = "^0.70.28";
-const NOMOS_FLUTTER_DEP = "^0.69.19";
+const NOMOS_CLIENT_DEP = "^0.70.30";
+const NOMOS_FLUTTER_DEP = "^0.69.22";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in the Dart and Flutter
 // package pubspecs — a release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).
@@ -5370,7 +5370,8 @@ async function main(): Promise<void> {
       composeDomainModule({
         name: d.name ?? d.key,
         domain: d.key,
-        modules: [...mods, ...evolutionMods],
+        modules: [...mods, ...evolutionMods,
+          { [BUSINESS_BIRTH_POLICY_DOMAINS_EXPORT]: applicationBirthPolicyDomains }],
         ...(extraAggregates.length > 0 ? { extraAggregates } : {}),
         ...(queries.length > 0 ? { queries } : {}),
         ...(counts.length > 0 ? { counts } : {}),

package/src/evolve_preview.ts

@@ -21,6 +21,10 @@
  *   REMOVAL  (refuse) — a sid disappeared; declare a typed retirement in the evolution layer.
  *   CONTRACT (refuse) — same sid, changed value language without a deterministic projection;
  *                       needs `.evolvesFrom(...)`, never a disposition.
+ *   WIRE     (refuse) — same sid, different Protobuf wire form (CAP-892): the field number is a
+ *                       function of the sid, so an old-law replica's rows would not decode. No
+ *                       evolution covers it — `.evolvesFrom(...)` proves VALUES, not the wire; the
+ *                       lawful path is a new field. See `wire_evolution_gate.ts`.
  *   DRIVER   (refuse) — same sid, merge driver moved to a different stored value space (e.g.
  *            Lww → Counter); needs a typed evolution or a new field. Switching among single-value
  *            drivers (Lww/LwwCausal/LwwBy/FirstWriterWins/FirstWriterCandidates/Surfaced/Attributed)
@@ -42,6 +46,9 @@ export type { CompilerIdentityModel } from "./identity_model.js";
 import type { DomainModule } from "./codegen_dart.js";
 import type { WireSchema } from "./wire.js";
 import { driversShareValueSpace } from "./drivers.js";
+import type { StableFieldId } from "./stable_ids_types.js";
+import { describeWireForm, storedFieldWireForm, wireDivergence, type WireForm } from "./wire_evolution_gate.js";
+import { protobufFieldNumber } from "./protobuf_field_number.js";
 
 // ── the normalized law shape both sides of the diff speak ──────────────────────────
 
@@ -60,6 +67,9 @@ export interface EvolveAggregate {
     contract?: string;
     schema?: string;
     evolutions?: readonly { from: string; to: string }[];
+    /** The stored Protobuf wire form, derived from the recorded value contract + driver.
+     *  Absent for a pre-contract lock entry (nothing to judge). */
+    wire?: WireForm;
   }>;
 }
 
@@ -83,6 +93,16 @@ export type EvolveLaw = Record<string, EvolveDomain>;
 
 // ── normalizers: build an EvolveLaw from the artifacts a dev already has ────────────
 
+/** The wire form of a recorded stable field, or nothing when it carries no value contract. */
+function wireOf(field: Pick<StableFieldId, "kind" | "shape">, driver: unknown): { wire: WireForm } | Record<string, never> {
+  const wire = storedFieldWireForm({
+    ...(field.kind === undefined ? {} : { kind: field.kind }),
+    shape: field.shape,
+    driver,
+  });
+  return wire === undefined ? {} : { wire };
+}
+
 /** Build ONE domain's aggregate surface from a #58 `StableIds` block (+ optional driver
  *  schemas keyed by CURRENT aggregate label). The sids/kinds come from the stable-id block;
  *  the drivers (when supplied) sharpen the retype arm. */
@@ -103,6 +123,7 @@ function aggregatesFromStableIds(
         ...(driver !== undefined ? { driver: JSON.stringify(driver) } : {}),
         ...(f.contract !== undefined ? { contract: f.contract } : {}),
         ...(f.schema !== undefined ? { schema: f.schema } : {}),
+        ...wireOf(f, driver),
         ...(f.evolutions !== undefined ? {
           evolutions: f.evolutions.map((rule) => ({ from: rule.from, to: rule.to })),
         } : {}),
@@ -157,11 +178,12 @@ export function evolveLawFromInterface(
         const schema = locked?.schemas?.[agg.label]
           ?? Object.entries(locked?.schemas ?? {}).find(([type]) => type.endsWith(`.${agg.label}`))?.[1];
         for (const f of Object.values(agg.fields)) {
-          const driver = schema?.[f.label];
-          if (driver !== undefined) (f as { driver?: string }).driver = JSON.stringify(driver);
           const stable = stableFields.get(f.sid);
+          const driver = stable?.driver ?? schema?.[f.label];
+          if (driver !== undefined) (f as { driver?: string }).driver = JSON.stringify(driver);
           if (stable?.contract !== undefined) f.contract = stable.contract;
           if (stable?.schema !== undefined) f.schema = stable.schema;
+          if (stable !== undefined) Object.assign(f, wireOf(stable, driver));
           if (stable?.evolutions !== undefined) {
             f.evolutions = stable.evolutions.map((rule) => ({ from: rule.from, to: rule.to }));
           }
@@ -231,6 +253,7 @@ export function currentEvolveLaw(
           if (driver !== undefined) (f as { driver?: string }).driver = JSON.stringify(driver);
           if (stableField?.contract !== undefined) f.contract = stableField.contract;
           if (stableField?.schema !== undefined) f.schema = stableField.schema;
+          if (stableField !== undefined) Object.assign(f, wireOf(stableField, driver));
           if (stableField?.evolutions !== undefined) {
             f.evolutions = stableField.evolutions.map((rule) => ({ from: rule.from, to: rule.to }));
           }
@@ -368,6 +391,23 @@ function diffDomain(
         });
         continue;
       }
+      // WIRE (CAP-892): no evolution covers it — an evolution proves the VALUE projection, but an
+      // old-law replica still encodes the old wire form under this Protobuf number.
+      const wire = oldF.wire !== undefined && newF.wire !== undefined
+        ? wireDivergence(oldF.wire, newF.wire, newF.label)
+        : undefined;
+      if (wire !== undefined) {
+        const at = wire.path === newF.label ? "" : ` (at ${wire.path})`;
+        const before = describeWireForm(wire.before);
+        const after = describeWireForm(wire.after);
+        findings.push({
+          domain,
+          level: "refuse",
+          what: `field '${oldAgg.label}.${oldF.label}' changes the wire type of ${newAgg.label}.${newF.label}${at} under the unchanged stable id ${fSid} (Protobuf field ${protobufFieldNumber(fSid)}): ${before} -> ${after}. A replica still on the predecessor law encodes it as ${before}, and an application built for this law cannot decode it`,
+          fix: `never change a field's wire type under the same id: add a new field (it gets a new stable id) carrying the new type, and deprecate the old one (retire it once no era writes it)`,
+        });
+        continue;
+      }
       if ((kindChanged || driverChanged) && !evolutionCovered) {
         const how = kindChanged && !contractCovered
           ? `read kind ${oldF.kind} → ${newF.kind}`

package/src/framework/founding_genesis.ts

@@ -32,13 +32,15 @@
  * enroller (`principalScope:user#enroller`) exactly like any enrolled principal.
  */
 import { z } from "zod";
-import { aggregate, instance } from "../aggregate.js";
+import { aggregate, instance, type AggregateHandle } from "../aggregate.js";
 import { t } from "../fields.js";
 import { Lww } from "../drivers.js";
 import { directive } from "../directive.js";
 import { set, type PlannedOp } from "../ops.js";
 import { principalScopeOf } from "../member_authentication.js";
 import { RelationTuple, relationTuplesByObject, writeTuple } from "./relations.js";
+import { query, type QueryDecl } from "../query.js";
+import { qualifyReadProjectionType } from "../read_projection_namespace.js";
 import { readFrameworkDeclaredRows } from "../read.js";
 import { readRef, readSet, workspaceInvariant } from "./workspace_invariant.js";
 import { GENESIS_WARRANT_ID } from "./genesis.js";
@@ -75,6 +77,24 @@ export const FoundingPrincipal = aggregate("FoundingPrincipal", {
   keyHash: t.string().merge(Lww), // sha256hex of the founding signer's public key
 }).public();
 
+/** A read-only schema for an existing physical founding type. This never changes its writer's type. */
+export interface FoundingPrincipalSourceQuery extends QueryDecl {
+  readonly foundingPrincipalSource: AggregateHandle;
+}
+
+export function foundingPrincipalSourceQueries(domains: readonly string[]): FoundingPrincipalSourceQuery[] {
+  // Governance is a separately installed framework law, so its canonical source is not in the
+  // application's business-birth inventory. Other sources come from that compiler-derived inventory.
+  return [...new Set(["workspaces", ...domains])].sort().map((domain) => {
+    const source = aggregate(qualifyReadProjectionType(domain, FoundingPrincipal.id), FoundingPrincipal.fields,
+      { global: true }).public();
+    return {
+      ...query(`foundingPrincipalByPrincipal_${domain}`).key("principal").returns(source),
+      foundingPrincipalSource: source,
+    };
+  });
+}
+
 const sha256Hex = z.string().regex(/^[0-9a-f]{64}$/, "expected lowercase sha256 hex (a public key hash)");
 /** Every field that is law on the founding step. Strict: no token-, issuer- or certificate-shaped field.
  *  Subject-class checks are object-level refinements (the compiler's security discovery must be able to

package/src/framework/framework_aggregates.ts

@@ -42,6 +42,7 @@ import * as disclosure from "./disclosure.js";
 import * as domainLifecycle from "./domain_lifecycle.js";
 import * as encryptionIdentity from "./encryption_identity.js";
 import * as encryptionScope from "./encryption_scope.js";
+import * as foundingGenesis from "./founding_genesis.js";
 import * as genesis from "./genesis.js";
 import * as home from "./receiving_group.js";
 import * as ownedCustody from "./owned_custody.js";
@@ -66,6 +67,7 @@ const FRAMEWORK_NAMESPACES: ReadonlyArray<Record<string, unknown>> = [
   domainLifecycle,
   encryptionIdentity,
   encryptionScope,
+  foundingGenesis,
   genesis,
   home,
   ownedCustody,

package/src/intent.ts

@@ -1063,9 +1063,16 @@ class IntentBuilder<I> {
     const businessBirth = (
       birthSteps[0]?.directive as BusinessBirthDirective | undefined
     )?.businessBirth;
-    const bindBusinessBirthPolicy = (
+    const bindBirthPolicy = (
       birthSteps[0]?.directive as BusinessBirthDirective | undefined
     )?.[BUSINESS_BIRTH_POLICY_BINDING];
+    const bindBusinessBirthPolicy = bindBirthPolicy === undefined ? undefined : (domains: readonly string[]) => {
+      bindBirthPolicy(domains);
+      queryReads.splice(0, queryReads.length, ...dedupeBy([
+        ...intentQueryReads,
+        ...this.steps.flatMap((step) => step.directive.declaredQueryReads ?? []),
+      ], (query) => query.id));
+    };
     const carriedCapabilities = [
       ...new Set(
         this.steps.flatMap((step) => capabilityDeclarationsOf(step.directive))

package/src/wire_evolution_gate.ts

@@ -0,0 +1,192 @@
+// NOMOS — THE WIRE-TYPE EVOLUTION GATE (CAP-892).
+//
+// A stored field's Protobuf field number is a pure function of its stable id
+// (`protobuf_field_number.ts`), never of its type. That is what lets a field be renamed or an enum
+// widened without renumbering — and it is also why a field's WIRE FORM must never change under an
+// unchanged stable id. A replica still on the predecessor law encodes rows with the predecessor's
+// descriptor; an application built for the successor decodes them with the successor's bindings.
+// If the same number now means a different wire form, the decoder reads garbage (CO2-1714 turned
+// catalogue listing `shape` from a plain string into a `NullableField` envelope under sid
+// b8263dbf0459cb01 / field 324349277, and an old-law replica's `"circle"` then failed to parse as
+// a message: CO2-APP-209).
+//
+// Protobuf's own evolution rule is the law here: never change a field's wire type under the same
+// number. This module derives each stored field's wire form from the value contract the committed
+// identity lock already records (`StableFieldId.shape` + `driver`), so it judges every existing
+// lock without a format change, and compares predecessor against successor per stable id.
+//
+// Wire-compatible (allowed): new fields (new sids), removed fields, label renames on the same sid,
+// enum values added or removed (enums travel as strings), optional/required changes (every scalar
+// is emitted `optional`), driver changes within the same envelope, record members added/removed.
+// Wire-incompatible (refused): scalar ↔ message, a different scalar (string ↔ sint64 ↔ double ↔
+// bool), gaining or losing the explicit-null `NullableField` envelope (clearable / nullable), the
+// `SurfacedField` envelope (a `Surfaced` driver), or a change of collection shape (single value ↔
+// list ↔ map ↔ record ↔ sum) — at the top level or inside a record member, list item or map value.
+// The operation schema has no `bytes` type (encrypted fields cross the wire as their plaintext
+// type), so string ↔ bytes cannot arise here; encryption toggles stay refused by the value-contract
+// evolution proof in `stable_ids_for_module.ts`.
+//
+// There is no declared-breaking-change escape: the lawful path is a new field (new stable id) and
+// deprecating the old one, which keeps every era's rows decodable by every application.
+//
+// ONE GATE: this module only DERIVES and COMPARES wire forms. The refusal is the WIRE arm of the
+// evolve gate (`evolve_preview.ts` evolveDiff), so `nomos-compile`, `githolon check --against`
+// and the LSP all judge it in the same pass as removals, contract and driver changes.
+
+import type { StableFieldId, StableIds } from "./stable_ids_types.js";
+
+/** The structural wire form of one stored value, as the operation Protobuf schema encodes it. */
+export type WireForm =
+  | { readonly t: "scalar"; readonly scalar: "string" | "sint64" | "double" | "bool" }
+  | { readonly t: "nullable-field"; readonly inner: WireForm }
+  | { readonly t: "surfaced-field"; readonly inner: WireForm }
+  | { readonly t: "nullable"; readonly inner: WireForm }
+  | { readonly t: "record"; readonly members: Readonly<Record<string, WireForm>> }
+  | { readonly t: "map"; readonly value: WireForm }
+  | { readonly t: "list"; readonly item: WireForm }
+  | { readonly t: "message"; readonly what: "sum" | "null" | "unknown" | "literal" };
+
+type Json = Record<string, unknown>;
+
+const isObject = (value: unknown): value is Json =>
+  value !== null && typeof value === "object" && !Array.isArray(value);
+
+const scalarOfLiteral = (value: unknown): WireForm => {
+  if (value === null) return { t: "message", what: "null" };
+  if (typeof value === "string") return { t: "scalar", scalar: "string" };
+  if (typeof value === "boolean") return { t: "scalar", scalar: "bool" };
+  if (typeof value === "number") return { t: "scalar", scalar: Number.isInteger(value) ? "sint64" : "double" };
+  return { t: "message", what: "literal" };
+};
+
+const isNullSchema = (schema: unknown): boolean =>
+  isObject(schema) && (schema.type === "null" || (Object.prototype.hasOwnProperty.call(schema, "const") && schema.const === null));
+
+/** The wire form of a canonical JSON-schema value contract (the same Zod value the law graph lowers). */
+export function jsonSchemaWireForm(schema: unknown): WireForm {
+  if (!isObject(schema)) return { t: "message", what: "unknown" };
+  const union = Array.isArray(schema.anyOf) ? schema.anyOf : Array.isArray(schema.oneOf) ? schema.oneOf : undefined;
+  if (union !== undefined) {
+    const present = union.filter((arm) => !isNullSchema(arm));
+    if (present.length === 1 && present.length < union.length) {
+      return { t: "nullable", inner: jsonSchemaWireForm(present[0]) };
+    }
+    if (present.length === 1) return jsonSchemaWireForm(present[0]);
+    return { t: "message", what: "sum" };
+  }
+  if (Array.isArray(schema.enum)) {
+    // Enums travel as their string member; adding or removing members never changes the wire.
+    const forms = new Set(schema.enum.map((member) => JSON.stringify(scalarOfLiteral(member))));
+    return forms.size === 1 ? scalarOfLiteral(schema.enum[0]) : { t: "message", what: "sum" };
+  }
+  if (Object.prototype.hasOwnProperty.call(schema, "const")) return scalarOfLiteral(schema.const);
+  const types = Array.isArray(schema.type) ? (schema.type as unknown[]) : schema.type === undefined ? [] : [schema.type];
+  const present = types.filter((type) => type !== "null");
+  if (present.length === 1 && present.length < types.length) {
+    return { t: "nullable", inner: jsonSchemaWireForm({ ...schema, type: present[0] }) };
+  }
+  if (present.length > 1) return { t: "message", what: "sum" };
+  switch (present[0]) {
+    case "string": return { t: "scalar", scalar: "string" };
+    case "integer": return { t: "scalar", scalar: "sint64" };
+    case "number": return { t: "scalar", scalar: "double" };
+    case "boolean": return { t: "scalar", scalar: "bool" };
+    case "null": return { t: "message", what: "null" };
+    case "array": return { t: "list", item: jsonSchemaWireForm(schema.items) };
+    case "object": {
+      const properties = isObject(schema.properties) ? schema.properties : {};
+      if (Object.keys(properties).length === 0 && isObject(schema.additionalProperties)) {
+        return { t: "map", value: jsonSchemaWireForm(schema.additionalProperties) };
+      }
+      return {
+        t: "record",
+        members: Object.fromEntries(
+          Object.entries(properties).map(([name, member]) => [name, jsonSchemaWireForm(member)]),
+        ),
+      };
+    }
+    default: return { t: "message", what: "unknown" };
+  }
+}
+
+const NULL_ADMITTING = new Set(["explicit-empty", "nullable"]);
+
+/** The outermost merge driver kind of an encoded (`encodeDriver`) driver. */
+const outermostDriver = (driver: unknown): string | undefined =>
+  typeof driver === "string" ? driver : isObject(driver) ? Object.keys(driver)[0] : undefined;
+
+/**
+ * The wire form of one stored aggregate field from its recorded value contract and driver —
+ * mirroring the row emission in `codegen_call_proto.ts`: the authored value, wrapped in
+ * `SurfacedField` when the outermost driver is `Surfaced`, wrapped in `NullableField` when the
+ * field admits an explicit null (clearable or a null-admitting null semantic).
+ * `undefined` when the record carries no contract (a pre-contract lock entry: nothing to judge).
+ */
+export function storedFieldWireForm(field: Pick<StableFieldId, "kind" | "shape" | "driver">): WireForm | undefined {
+  if (!isObject(field.shape)) return undefined;
+  const shape = field.shape;
+  const kind = (shape.kind ?? field.kind) as string | undefined;
+  let form: WireForm;
+  if (kind === "counter") form = { t: "scalar", scalar: "sint64" };
+  else if (kind === "position") form = { t: "scalar", scalar: "string" };
+  else if (kind === "ref" && shape.nomosRef === undefined && shape.versionedForeignRef === undefined) {
+    // A plain reference is stored and transported as its target id string.
+    form = { t: "scalar", scalar: "string" };
+  } else form = jsonSchemaWireForm(shape.jsonSchema);
+  if (outermostDriver(field.driver) === "Surfaced") form = { t: "surfaced-field", inner: form };
+  const admitsNull = shape.clearable === true ||
+    (typeof shape.nullSemantic === "string" && NULL_ADMITTING.has(shape.nullSemantic));
+  if (admitsNull) form = { t: "nullable-field", inner: form };
+  return form;
+}
+
+/** A readable rendering of a wire form for refusals. */
+export function describeWireForm(form: WireForm): string {
+  switch (form.t) {
+    case "scalar": return form.scalar;
+    case "nullable-field": return `NullableField message { is_null | ${describeWireForm(form.inner)} }`;
+    case "surfaced-field": return `SurfacedField message { resolved ${describeWireForm(form.inner)} | pending }`;
+    case "nullable": return `Nullable message { is_null | ${describeWireForm(form.inner)} }`;
+    case "record": {
+      const names = Object.keys(form.members).sort();
+      return `record message { ${names.join(", ")} }`;
+    }
+    case "map": return `map message <${describeWireForm(form.value)}>`;
+    case "list": return `list message <${describeWireForm(form.item)}>`;
+    case "message": return `${form.what} message`;
+  }
+}
+
+/** The first wire divergence between two forms (`undefined` when wire-compatible). */
+export function wireDivergence(
+  before: WireForm,
+  after: WireForm,
+  path: string,
+): { readonly path: string; readonly before: WireForm; readonly after: WireForm } | undefined {
+  if (before.t !== after.t) return { path, before, after };
+  switch (before.t) {
+    case "scalar":
+      return before.scalar === (after as typeof before).scalar ? undefined : { path, before, after };
+    case "message":
+      return before.what === (after as typeof before).what ? undefined : { path, before, after };
+    case "nullable-field":
+    case "surfaced-field":
+    case "nullable":
+      return wireDivergence(before.inner, (after as typeof before).inner, path);
+    case "list":
+      return wireDivergence(before.item, (after as typeof before).item, `${path}[]`);
+    case "map":
+      return wireDivergence(before.value, (after as typeof before).value, `${path}{}`);
+    case "record": {
+      const next = (after as typeof before).members;
+      // Members present in only one era are added/removed fields: wire-compatible.
+      for (const name of Object.keys(before.members).sort()) {
+        const nextMember = next[name];
+        if (nextMember === undefined) continue;
+        const divergence = wireDivergence(before.members[name]!, nextMember, `${path}.${name}`);
+        if (divergence !== undefined) return divergence;
+      }
+      return undefined;
+    }
+  }
+}