@githolon/dsl 0.13.0 → 0.15.0

package/src/codegen_provider_dart.ts

@@ -9,32 +9,32 @@
  * Provider SDK codegen — the SYMMETRIC TWIN of the typed peer write codegen
  * (`codegen_dart.ts`).
  *
- * Order and Receipt are ordinary intent roles. This codegen gives a capability provider typed
+ * Obligation and Receipt are ordinary intent roles. This codegen gives a capability provider typed
  * decode/encode helpers; it does not create a separate admission job protocol or a privileged
  * mutation path.
  *
  * ── Why this exists (Jack 2026-06-04) ────────────────────────────────────────
  * Code is ~free; INTEGRATION POINTS are expensive + fuckup-guaranteed. A capability
  * PROVIDER (Whisper, a renderer, a multi-target PR transporter) sits at
- * the far end of the framework `impureCapability` Order→Receipt pair. Today a dev would
- * hand-parse the incoming Order intent JSON and hand-build the Receipt — exactly the
+ * the far end of the framework `impureCapability` Obligation→Receipt pair. Today a dev would
+ * hand-parse the incoming Obligation intent JSON and hand-build the Receipt — exactly the
  * brittle integration the peer write codegen eliminated on the WRITE side. This generator
  * eliminates it on the PROVIDE side: a dev writes ONE typed method
- * `handler(Order) -> Result | Failure`, and the generated dispatcher DECODES the Order
+ * `handler(Obligation) -> Result | Failure`, and the generated dispatcher DECODES the Obligation
  * and ENCODES the ordinary Receipt intent — proven in ISOLATION (a Dart unit test), with NO deploy /
  * daemon / e2e.
  *
  * ── What it emits, per `impureCapability` capability (the STANDARD shape, never invented) ──
- *   1. a typed `XOrder`   — the Order params (envelope provenance `requestId` /
+ *   1. a typed `XObligation` — the Obligation params (envelope provenance `requestId` /
  *      `requestedBy` / `requestedAt` ⊕ the tenant params from the DSL), with a
- *      `fromJson` decoding the incoming Order intent's payload JSON;
+ *      `fromJson` decoding the incoming Obligation intent's payload JSON;
  *   2. a typed `XResult`  — the success payload the handler returns (`resultRef`, the
  *      content-addressed Evidence handle — the framework's `completeSchema.resultRef`),
  *      implementing `TaskResult.toResultRef()`;
  *   3. typed failure/blocked/DLQ outcomes;
- *   4. a handler typedef `XHandler = TaskOutcome<XResult> Function(XOrder)`;
+ *   4. a handler typedef `XHandler = TaskOutcome<XResult> Function(XObligation)`;
  *   5. a generated `XProvider` dispatcher (`implements TaskProvider`): given the
- *      registered typed handler, `handleOrder(orderJson, now)` DECODES → calls the
+ *      registered typed handler, `handleObligation(obligationJson, now)` DECODES → calls the
  *      handler → ENCODES the typed outcome into the ordinary RECEIPT intent — REUSING the peer write
  *      codegen's `CompleteXPayload` / `FailXPayload` / `BlockXPayload` /
  *      `DeadLetterXPayload`. The Receipt is an
@@ -61,7 +61,7 @@ import {
 /**
  * The minimal shape of a `impureCapability` declaration the provider codegen needs. A
  * `ImpureCapability` (framework `impure_capability.ts`) carries EXACTLY this — its task `aggregate`
- * handle (whose `.id` is the wire type) and its `.order` / receipt directives
+ * handle (whose `.id` is the wire type) and its `.obligation` / receipt directives
  * directives — so a `impureCapability(...)` return value satisfies `ImpureCapabilityDecl`
  * STRUCTURALLY. The emit script passes the values straight through: no re-derivation, no
  * fragile structural inference over the flattened directive list.
@@ -69,8 +69,8 @@ import {
 export interface ImpureCapabilityDecl {
   /** The task aggregate handle; `.id` is the wire type (e.g. `TranscribeVoiceNoteAggregate`). */
   readonly aggregate: { readonly id: string };
-  /** The ORDER directive: `.creates`, payload = envelope ⊕ tenant params. */
-  readonly order: { readonly id: string; readonly payloadSchema: z.ZodTypeAny };
+  /** The Obligation directive: `.creates`, payload = envelope ⊕ tenant params. */
+  readonly obligation: { readonly id: string; readonly payloadSchema: z.ZodTypeAny };
   /** The COMPLETE (success) Receipt directive: payload = {requestId, resultRef, completedAt}. */
   readonly complete: { readonly id: string };
   /** The FAIL (failure) Receipt directive: payload = {requestId, failureReason, failedAt}. */
@@ -81,17 +81,23 @@ export interface ImpureCapabilityDecl {
   readonly deadLetter: { readonly id: string };
 }
 
-/** The framework ORDER-ENVELOPE field names — provenance, NOT tenant params. The Order
- * type carries them (the provider sees the whole Order intent) but the codegen labels
+/** The framework Obligation envelope field names — provenance/timing, NOT tenant params. The Obligation
+ * type carries them (the provider sees the whole Obligation intent) but the codegen labels
  * them so the doc separates provenance from the tenant's request params. */
-const ORDER_ENVELOPE_FIELDS = new Set(["requestId", "requestedBy", "requestedAt"]);
+const OBLIGATION_ENVELOPE_FIELDS = new Set([
+  "requestId",
+  "requestedBy",
+  "requestedAt",
+  "scheduledAt",
+  "deadlineAt",
+]);
 
-/** A stable PascalCase base for a task's generated class family, derived from its ORDER
- * directive id with a leading `create`/`order` verb stripped (so `createTranscribeVoiceNote`
+/** A stable PascalCase base for a task's generated class family, derived from its Obligation
+ * directive id with a leading `create`/`oblige` verb stripped (so `createTranscribeVoiceNote`
  * → `TranscribeVoiceNote`). Pure + deterministic. */
-export function taskBaseName(orderDirectiveId: string): string {
-  const stripped = orderDirectiveId.replace(/^(create|order)/, "");
-  const base = stripped === "" ? orderDirectiveId : stripped;
+export function taskBaseName(obligationDirectiveId: string): string {
+  const stripped = obligationDirectiveId.replace(/^(create|oblige)/, "");
+  const base = stripped === "" ? obligationDirectiveId : stripped;
   return cap(base);
 }
 
@@ -109,21 +115,21 @@ function deadLetterPayloadClass(deadLetterDirectiveId: string): string {
   return `${cap(deadLetterDirectiveId)}Payload`;
 }
 
-/** Dart field DECL for one Order field (optional → nullable). */
-function orderFieldDecl(s: PayloadFieldSpec): string {
-  const provenance = ORDER_ENVELOPE_FIELDS.has(s.name)
+/** Dart field DECL for one Obligation field (optional → nullable). */
+function obligationFieldDecl(s: PayloadFieldSpec): string {
+  const provenance = OBLIGATION_ENVELOPE_FIELDS.has(s.name)
     ? ` // envelope provenance (framework)`
     : ``;
   return `  final ${s.dartType}${s.optional ? "?" : ""} ${s.name};${provenance}`;
 }
 
-/** Dart ctor PARAM for one Order field. */
-function orderCtorParam(s: PayloadFieldSpec): string {
+/** Dart ctor PARAM for one Obligation field. */
+function obligationCtorParam(s: PayloadFieldSpec): string {
   return `    ${s.optional ? "" : "required "}this.${s.name},`;
 }
 
 /**
- * Expression decoding ONE Order field FROM the already-`jsonDecode`d payload map `j`.
+ * Expression decoding ONE Obligation field FROM the already-`jsonDecode`d payload map `j`.
  * The REVERSE of the peer codegen's `toJsonExpr` — same field-kind matrix:
  *   • scalar  — read directly, cast to the Dart scalar type.
  *   • enum    — `XEnum.fromWire(j['f'] as String)`.
@@ -132,7 +138,7 @@ function orderCtorParam(s: PayloadFieldSpec): string {
  * Optional fields tolerate absence (return null); required fields cast strictly (a
  * missing required field throws on the cast — the strict-decode contract).
  */
-function orderFromJsonExpr(s: PayloadFieldSpec): string {
+function obligationFromJsonExpr(s: PayloadFieldSpec): string {
   const raw = `j['${s.name}']`;
   switch (s.toJson) {
     case "scalar": {
@@ -168,22 +174,22 @@ function orderFromJsonExpr(s: PayloadFieldSpec): string {
   }
 }
 
-/** Emit the typed `XOrder` class — the DECODED incoming Order. */
-function emitOrderClass(
+/** Emit the typed `XObligation` class — the DECODED incoming Obligation. */
+function emitObligationClass(
   base: string,
-  orderDirectiveId: string,
+  obligationDirectiveId: string,
   specs: PayloadFieldSpec[],
 ): string {
-  const cls = `${base}Order`;
-  const fieldDecls = specs.map(orderFieldDecl).join("\n");
-  const ctorParams = specs.map(orderCtorParam).join("\n");
+  const cls = `${base}Obligation`;
+  const fieldDecls = specs.map(obligationFieldDecl).join("\n");
+  const ctorParams = specs.map(obligationCtorParam).join("\n");
   const fromJsonAssigns = specs
-    .map((s) => `      ${s.name}: ${orderFromJsonExpr(s)},`)
+    .map((s) => `      ${s.name}: ${obligationFromJsonExpr(s)},`)
     .join("\n");
   return [
-    `/// The typed ORDER for the \`${orderDirectiveId}\` capability — what the provider`,
+    `/// The typed Obligation for the \`${obligationDirectiveId}\` capability — what the provider`,
     `/// RECEIVES. Carries the framework envelope provenance (requestId / requestedBy /`,
-    `/// requestedAt) ⊕ the tenant request params. Decoded from the incoming Order intent's`,
+    `/// requestedAt / scheduledAt / deadlineAt) ⊕ the tenant request params. Decoded from the incoming Obligation intent's`,
     `/// payload JSON via [${cls}.fromJson]; the handler sees ONLY this typed value.`,
     `class ${cls} {`,
     fieldDecls,
@@ -192,8 +198,8 @@ function emitOrderClass(
     ctorParams,
     `  });`,
     ``,
-    `  /// Decode an Order from the already-\`jsonDecode\`d payload map (the EXACT shape the`,
-    `  /// peer's \`${orderDirectiveId}\` \`toPayloadJson()\` produced). Reverse of the peer`,
+    `  /// Decode an Obligation from the already-\`jsonDecode\`d payload map (the EXACT shape the`,
+    `  /// peer's \`${obligationDirectiveId}\` \`toPayloadJson()\` produced). Reverse of the peer`,
     `  /// encode — types stop here, at the JSON serde.`,
     `  factory ${cls}.fromJson(Map<String, Object?> j) => ${cls}(`,
     fromJsonAssigns,
@@ -224,7 +230,7 @@ function emitResultClasses(base: string, completeDirectiveId: string): string {
     ``,
     `/// The typed FAILURE the \`${base}\` handler returns — the recorded reason the side-effect`,
     `/// failed. Maps to the framework \`fail…\` Receipt (status:failed + failureReason +`,
-    `/// closesOrder); a recorded failure is terminal, NOT a retry storm.`,
+    `/// closesObligation); a recorded failure is terminal, NOT a retry storm.`,
     `class ${failureCls} {`,
     `  final String failureReason;`,
     `  const ${failureCls}({required this.failureReason});`,
@@ -237,7 +243,7 @@ function emitProviderClass(
   task: ImpureCapabilityDecl,
   base: string,
 ): string {
-  const orderCls = `${base}Order`;
+  const obligationCls = `${base}Obligation`;
   const resultCls = `${base}Result`;
   const handlerTypedef = `${base}Handler`;
   const providerCls = `${base}Provider`;
@@ -247,25 +253,25 @@ function emitProviderClass(
   const deadLetterCls = deadLetterPayloadClass(task.deadLetter.id);
   return [
     `/// The typed HANDLER the dev writes for the \`${base}\` capability: given the typed`,
-    `/// [${orderCls}], perform the side-effect and return a typed [TaskOutcome] — a`,
+    `/// [${obligationCls}], perform the side-effect and return a typed [TaskOutcome] — a`,
     `/// [TaskSuccess]<[${resultCls}]>, [TaskFailure], [TaskBlocked], or [TaskDeadLetter]. NO raw JSON, NO directive id, NO`,
     `/// Receipt construction: the dev writes pure typed business logic; the [${providerCls}]`,
     `/// does the decode/encode round-trip.`,
-    `typedef ${handlerTypedef} = TaskOutcome<${resultCls}> Function(${orderCls} order);`,
+    `typedef ${handlerTypedef} = TaskOutcome<${resultCls}> Function(${obligationCls} obligation);`,
     ``,
     `/// The GENERATED dispatcher for the \`${base}\` capability — the symmetric twin of the`,
-    `/// peer's typed dispatch. Register a typed [${handlerTypedef}]; [handleOrder] DECODES an`,
-    `/// incoming Order intent JSON into [${orderCls}], runs the handler, and ENCODES the typed`,
+    `/// peer's typed dispatch. Register a typed [${handlerTypedef}]; [handleObligation] DECODES an`,
+    `/// incoming Obligation intent JSON into [${obligationCls}], runs the handler, and ENCODES the typed`,
     `/// outcome into the ordinary RECEIPT intent: [${completeCls}], [${failCls}],`,
     `/// [${blockCls}], or [${deadLetterCls}]. The returned [NomosIntent] ships through the SAME`,
     `/// \`dispatch\` gate as any authored write (ONE-WRITE-PATH).`,
-    `class ${providerCls} implements TaskProvider<${orderCls}, ${resultCls}> {`,
+    `class ${providerCls} implements TaskProvider<${obligationCls}, ${resultCls}> {`,
     `  /// The dev's typed handler.`,
     `  final ${handlerTypedef} handler;`,
     `  const ${providerCls}(this.handler);`,
     ``,
     `  @override`,
-    `  String get orderDirectiveId => '${task.order.id}';`,
+    `  String get obligationDirectiveId => '${task.obligation.id}';`,
     `  @override`,
     `  String get completeDirectiveId => '${task.complete.id}';`,
     `  @override`,
@@ -276,39 +282,39 @@ function emitProviderClass(
     `  String get deadLetterDirectiveId => '${task.deadLetter.id}';`,
     ``,
     `  @override`,
-    `  NomosIntent handleOrder(String orderPayloadJson, {required HostClock now}) =>`,
-    `      handleOrderMap(decodeOrderPayload(orderPayloadJson), now: now);`,
+    `  NomosIntent handleObligation(String obligationPayloadJson, {required HostClock now}) =>`,
+    `      handleObligationMap(decodeObligationPayload(obligationPayloadJson), now: now);`,
     ``,
     `  @override`,
-    `  NomosIntent handleOrderMap(`,
-    `    Map<String, Object?> orderPayload, {`,
+    `  NomosIntent handleObligationMap(`,
+    `    Map<String, Object?> obligationPayload, {`,
     `    required HostClock now,`,
     `  }) {`,
-    `    final order = ${orderCls}.fromJson(orderPayload);`,
-    `    final outcome = handler(order);`,
+    `    final obligation = ${obligationCls}.fromJson(obligationPayload);`,
+    `    final outcome = handler(obligation);`,
     `    // ENCODE the outcome into the ordinary RECEIPT intent (reusing the peer-codegen Receipt`,
     `    // payload classes — same generated file). The Receipt addresses the SAME instance`,
-    `    // the Order created (keyed by requestId), so closesOrder == requestId by`,
+    `    // the Obligation created (keyed by requestId), so closesObligation == requestId by`,
     `    // construction in the engine's \`.plan()\` — terminal-once is the kernel's gate.`,
     `    return switch (outcome) {`,
     `      TaskSuccess<${resultCls}>(:final result) => ${completeCls}(`,
-    `          requestId: order.requestId,`,
+    `          requestId: obligation.requestId,`,
     `          resultRef: result.toResultRef(),`,
     `          completedAt: now(),`,
     `        ),`,
     `      TaskFailure<${resultCls}>(:final failureReason) => ${failCls}(`,
-    `          requestId: order.requestId,`,
+    `          requestId: obligation.requestId,`,
     `          failureReason: failureReason,`,
     `          failedAt: now(),`,
     `        ),`,
     `      TaskBlocked<${resultCls}>(:final blockedReason, :final nextAction) => ${blockCls}(`,
-    `          requestId: order.requestId,`,
+    `          requestId: obligation.requestId,`,
     `          blockedReason: blockedReason,`,
     `          blockedAt: now(),`,
     `          nextAction: nextAction,`,
     `        ),`,
     `      TaskDeadLetter<${resultCls}>(:final deadLetterReason) => ${deadLetterCls}(`,
-    `          requestId: order.requestId,`,
+    `          requestId: obligation.requestId,`,
     `          deadLetterReason: deadLetterReason,`,
     `          deadLetteredAt: now(),`,
     `        ),`,
@@ -319,20 +325,20 @@ function emitProviderClass(
 }
 
 /**
- * Emit the full provider SDK for ONE `impureCapability`: the typed Order/Result/Failure
+ * Emit the full provider SDK for ONE `impureCapability`: the typed Obligation/Result/Failure
  * classes + the handler typedef + the dispatcher. `enumDartTypes` is the SAME map the
- * domain's `collectEnums` produced (so an enum-typed order param references the
+ * domain's `collectEnums` produced (so an enum-typed obligation param references the
  * already-emitted domain enum — NO duplicate enum decl).
  */
 export function emitProviderTask(
   task: ImpureCapabilityDecl,
   enumDartTypes: Map<string, string>,
 ): string {
-  const base = taskBaseName(task.order.id);
-  const specs = introspectPayload(task.order.payloadSchema, enumDartTypes);
+  const base = taskBaseName(task.obligation.id);
+  const specs = introspectPayload(task.obligation.payloadSchema, enumDartTypes);
   return [
     `// ── provider SDK: ${base} (impureCapability '${task.aggregate.id}') ──`,
-    emitOrderClass(base, task.order.id, specs),
+    emitObligationClass(base, task.obligation.id, specs),
     ``,
     emitResultClasses(base, task.complete.id),
     ``,

package/src/codegen_ts.ts

@@ -10,7 +10,7 @@
  *
  * Dart apps get generated payload classes / read models / typed query accessors;
  * until this file, a web app on `@githolon/client` hand-typed directive ids and
- * payload shapes against the raw `dispatch()` surface. `generateTsClient(modules,
+ * payload shapes against the raw `offer()` surface. `generateTsClient(modules,
  * opts)` closes that: ONE generated `.ts` file per package, emitted by
  * `nomos-compile` AFTER the package is hashed (the deployed law's content hash is
  * baked in as a constant), carrying:
@@ -20,13 +20,13 @@
  *     becomes `?`, `.int()` stays `number`), so a payload the type system accepts is
  *     a payload the engine accepts; required string fields named `…At` are
  *     CALLER-STAMPED TIMESTAMPS — optional in the type, auto-filled with ISO now()
- *     at dispatch (see {@link autoStampFields});
+ *     at offer (see {@link autoStampFields});
  *   * a READ-MODEL interface per aggregate — derived from the DSL `Field` kinds the
  *     projection decodes by (set→`T[]`, map→`Record<string, V>` via `mapValueKind`,
  *     `t.jsonObject()`→`Record<string, unknown>`, plain `t.json()`→`unknown`), with
  *     derived/combined read fields merged in (typed off their declared zod returns).
  *     EVERY field is `?`: a projection row carries only what has folded so far;
- *   * a CLIENT FACTORY per domain — typed `dispatch` wrappers bound to the baked
+ *   * a CLIENT FACTORY per domain — typed `offer` wrappers bound to the baked
  *     domainHash, typed declared-query accessors, and by-id read/watch helpers —
  *     over a STRUCTURAL `NomosHolon` interface, so the file has ZERO imports and
  *     binds to `@githolon/client`'s `connect()` result (browser or node) as-is.
@@ -173,7 +173,7 @@ function tsTypeOfZod(zt: z.ZodTypeAny, indent: string): string {
 /**
  * Top-level REQUIRED string payload fields named `…At` (`signedAt`, `updatedAt`,
  * `stampedAt`, …) are CALLER-STAMPED TIMESTAMPS by convention: the generated client
- * fills an omitted one with `new Date().toISOString()` at dispatch. The stamp rides
+ * fills an omitted one with `new Date().toISOString()` at offer. The stamp rides
  * IN the payload — the plan stays a pure function of `(payload, ports)` and replays
  * byte-identical on every peer — so the domain dev stops thinking about clocks.
  * Passing the field explicitly always wins (scheduling-shaped fields like
@@ -210,11 +210,11 @@ function tsTypeOfPayload(
       f = zodDef(f).innerType!;
     }
     const note = stamped.has(name)
-      ? " // auto-stamped with ISO now() at dispatch when omitted"
+      ? " // auto-stamped with ISO now() at offer when omitted"
       : mintedSet.has(name)
-        ? " // kernel-minted at dispatch when omitted (the front-door mint; returned on the result)"
+        ? " // kernel-minted at offer when omitted (the front-door mint; returned on the result)"
         : placedSet.has(name)
-          ? " // picked LEAST-LOADED over the coordinator's law-state at dispatch when omitted (sharding §3)"
+          ? " // picked LEAST-LOADED over the coordinator's law-state at offer when omitted (sharding §3)"
           : "";
     return `  ${name}${optional ? "?" : ""}: ${tsTypeOfZod(f, "  ")};${note}`;
   });
@@ -287,7 +287,7 @@ function aggregatesOf(mod: Record<string, unknown>): AggregateHandle[] {
 export interface TsClientOptions {
   /** The package name (`nomos.package.mjs` `name`) — used for the hash constant. */
   readonly packageName: string;
-  /** sha256 of the built `.package.usda` — the law this client dispatches under. */
+  /** sha256 of the built `.package.usda` — the law this client offers under. */
   readonly domainHash: string;
 }
 
@@ -319,7 +319,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
     `//   const holon = await connect({ cloud, workspace, clientId });`,
     `//   const app = ${tsClientFactoryName(modules[0]?.domain ?? "domain")}(holon);`,
     ``,
-    `/** sha256 of the deployed \`.package.usda\` — the installed law this client dispatches under. */`,
+    `/** sha256 of the deployed \`.package.usda\` — the installed law this client offers under. */`,
     `export const ${hashConst} = ${JSON.stringify(opts.domainHash)};`,
     ``,
     `/** One projection row: the aggregate's wire type, its id, and the folded fields. */`,
@@ -327,7 +327,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
     ``,
     `/** The holon surface this client binds to (structurally satisfied by @githolon/client). */`,
     `export interface NomosHolon {`,
-    `  dispatch(domain: string, directiveId: string, payload: unknown, opts: { domainHash: string }): Promise<string>;`,
+    `  offer(intentBytes: string | Uint8Array): Promise<string>;`,
     `  query(queryId: string, params?: Record<string, unknown>): Promise<unknown>;`,
     `  queryById(aggregateId: string): Promise<unknown>;`,
     `  watchById(aggregateId: string, cb: (rows: unknown) => void, opts?: { intervalMs?: number }): () => void;`,
@@ -347,6 +347,9 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
     `  discardDeadLetter(id: string): Promise<{ ok: boolean; removed: number }>;`,
     `}`,
     ``,
+    `const encodeIntentOffer = (domain: string, directiveId: string, payload: unknown, domainHash: string): Uint8Array =>`,
+    `  new TextEncoder().encode(JSON.stringify({ v: 2, intent: { domain, directiveId, payload, domainHash } }));`,
+    ``,
   );
 
   const anyAutoStamp = modules.some((mod) =>
@@ -553,7 +556,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
 
     const mintPlan = mintPlans.get(mod);
     // PLACEMENT directives (packed taxonomy births): their `shard` is AUTO-PICKED
-    // least-loaded by the routed holon at dispatch — optional on the typed surface
+    // least-loaded by the routed holon at offer — optional on the typed surface
     // (the §7 transparency contract: a dev never names a shard).
     const placementDirs = new Set<string>();
     if (mod.workspaceTypes !== undefined && mod.workspaceTypes.length > 0) {
@@ -573,7 +576,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       const mint = mintPlan?.get(d.id);
       const placed = placementDirs.has(d.id) ? ["shard"] : [];
       out.push(
-        `/** \`${domain}/${d.id}\` payload (mirrors the engine's zod schema).${stamps.length ? ` Omitted ${stamps.map((s) => `\`${s}\``).join("/")} auto-stamp(s) ISO now() at dispatch.` : ""}${mint ? ` Omitted \`${mint.field}\` is KERNEL-MINTED at dispatch (returned on the result).` : ""}${placed.length ? " Omitted `shard` is picked LEAST-LOADED at dispatch (the routed holon)." : ""} */`,
+        `/** \`${domain}/${d.id}\` payload (mirrors the engine's zod schema).${stamps.length ? ` Omitted ${stamps.map((s) => `\`${s}\``).join("/")} auto-stamp(s) ISO now() at offer.` : ""}${mint ? ` Omitted \`${mint.field}\` is KERNEL-MINTED at offer (returned on the result).` : ""}${placed.length ? " Omitted `shard` is picked LEAST-LOADED at offer (the routed holon)." : ""} */`,
         `export type ${payloadName} = ${tsTypeOfPayload(schema, stamps, mint ? [mint.field] : [], placed)};`,
         ``,
       );
@@ -592,7 +595,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
           `     *  — ids stay internal plumbing — and returns it with the new local head. */`,
           `    ${d.id}: async (payload: ${payloadName}): Promise<{ head: string; ${mint.field}: string }> => {`,
           `      const ${mint.field} = payload.${mint.field} ?? (await (holon as NomosRoutedHolon).mint(${JSON.stringify(mint.mintType)}${mintOpts}));`,
-          `      const head = await holon.dispatch(${JSON.stringify(domain)}, ${JSON.stringify(d.id)}, ${body}, { domainHash });`,
+          `      const head = await holon.offer(encodeIntentOffer(${JSON.stringify(domain)}, ${JSON.stringify(d.id)}, ${body}, domainHash));`,
           `      return { head, ${mint.field} };`,
           `    },`,
         );
@@ -601,8 +604,8 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       methods.push(
         `    /** Author \`${domain}/${d.id}\` locally under the installed law; returns the new local head. */`,
         stamps.length
-          ? `    ${d.id}: (payload: ${payloadName}) => holon.dispatch(${JSON.stringify(domain)}, ${JSON.stringify(d.id)}, stampNow(payload, ${JSON.stringify(stamps)}), { domainHash }),`
-          : `    ${d.id}: (payload: ${payloadName}) => holon.dispatch(${JSON.stringify(domain)}, ${JSON.stringify(d.id)}, payload, { domainHash }),`,
+          ? `    ${d.id}: (payload: ${payloadName}) => holon.offer(encodeIntentOffer(${JSON.stringify(domain)}, ${JSON.stringify(d.id)}, stampNow(payload, ${JSON.stringify(stamps)}), domainHash)),`
+          : `    ${d.id}: (payload: ${payloadName}) => holon.offer(encodeIntentOffer(${JSON.stringify(domain)}, ${JSON.stringify(d.id)}, payload, domainHash)),`,
       );
     }
 

package/src/compile_package_main.ts

@@ -30,13 +30,10 @@
  * It emits into `outDir` (default `<config dir>/build`):
  *   * `<name>.package.usda`            — the deployable package (engine bundle + USD IR);
  *     its sha256 IS the deploy `domainHash` (`policy:{hash}`).
- *   * `domain_manifests.json`          — the READ manifest (field kinds + query routes).
- *   * `domain_identity_manifests.json` + `domain_identity_hashes.json` (+ excluded
- *     sidecar) — the per-domain IDENTITY artifacts (admission gates).
- *   * `<name>.deploy.json`             — `{packageUsda, readManifest, identityManifests,
- *     identityHashes}`: the EXACT body `POST /v1/workspaces/:ws/domains` accepts as
- *     `application/json` on Nomos Cloud (package + per-workspace manifest overlay in
- *     one deploy).
+ *   * `<name>.deploy.json`             — `{packageUsda}`: the EXACT body
+ *     `POST /v1/workspaces/:ws/domains` accepts as `application/json` on Nomos Cloud.
+ *     Admission/projection manifests are embedded in the package USDA and are not host
+ *     sidecars.
  *   * `<name>.proof.mts`               — the GENERATED PROOF (codegen_proof.ts): a
  *     runnable, domain-shaped live e2e synthesized from the law's own directives /
  *     queries / counts. Run it with `githolon proof`. Never fatal: an unsampleable
@@ -406,7 +403,7 @@ const DART_RELATIVE_IMPORT = `import 'nomos_dsl.dart';`;
 const DART_SUPPORT_SRC = [
   "wire.dart",
   "driver.dart",
-  "dispatch.dart",
+  "offer.dart",
   "subscriptions.dart",
   "provider.dart",
   // The async WebView bridge runtime (NomosBridge / BridgeTransport) the generated
@@ -519,7 +516,7 @@ async function main(): Promise<void> {
     capability: string;
     domain: string;
     aggregateId: string;
-    order: string;
+    obligation: string;
     complete: string;
     fail: string;
     block: string;
@@ -750,7 +747,7 @@ async function main(): Promise<void> {
         capability: cap,
         domain: d.key,
         aggregateId: c.aggregate.id,
-        order: c.order.id,
+        obligation: c.obligation.id,
         complete: c.complete.id,
         fail: c.fail.id,
         block: c.block.id,
@@ -1252,7 +1249,8 @@ async function main(): Promise<void> {
         relPaths.push(`layers/${base}.usda`);
       }
     }
-    const flatJson = JSON.stringify(flattenLayeredUsd(allLayers));
+    const flat = flattenLayeredUsd(allLayers);
+    const flatJson = JSON.stringify(flat);
     if (flatJson !== usdJson) {
       fail(
         `layered emission does not flatten to the canonical composed IR — the module fold and ` +
@@ -1264,11 +1262,13 @@ async function main(): Promise<void> {
     }
     for (const w of pendingWrites) writeFileSync(w.path, w.text, "utf8");
     layeredRootPath = path.join(outDir, `${cfg.name}.layered.usda`);
-    writeFileSync(layeredRootPath, layeredRootUsda(relPaths), "utf8");
+    writeFileSync(layeredRootPath, layeredRootUsda(relPaths, flat), "utf8");
     layeredFileCount = relPaths.length;
   }
 
   // ── 3. the READ manifest + IDENTITY artifacts ──
+  // These are generated from the same source functions embedded into USDA by emitUsd().
+  // They remain local diagnostics for now; the deploy/cloud/runtime contract ignores them.
   const readManifest = buildReadManifest(domainModules);
   const readPath = path.join(outDir, "domain_manifests.json");
   writeFileSync(readPath, JSON.stringify(readManifest, null, 2) + "\n", "utf8");
@@ -1276,7 +1276,7 @@ async function main(): Promise<void> {
   const identity = buildIdentity(domainModules);
   const { manifestsPath } = writeIdentity(identity, outDir);
 
-  // ── 4. the one-call deploy body (package + per-workspace manifest overlay) ──
+  // ── 4. the one-call deploy body (package only) ──
   // SELF-DESCRIBING: `summary` states what the (otherwise hex-opaque) package
   // contains — purely derived from the inputs (no timestamps), ignored by the
   // deploy endpoint, and mirrored as build/<name>.summary.txt for a human or
@@ -1297,9 +1297,6 @@ async function main(): Promise<void> {
   const deployBody = {
     summary,
     packageUsda: text,
-    readManifest,
-    identityManifests: identity.manifests,
-    identityHashes: identity.hashes,
     // The capability lowering (unhashed sidecar; omit-when-empty — see the
     // collector's doc above). The worker stages it on the manifest overlay:
     // the deploy-time binding warning + the executor's scan map read it there.

package/src/framework/capability.ts

@@ -8,12 +8,12 @@
 /**
  * framework/capability.ts — `capability()`: THE MARKETPLACE DECLARATION
  * (`architecture/capability_marketplace.md` §4, ruling M2 — the framework-hidden
- * lane). ONE call declares a typed Order→Receipt capability interface; the dev
- * sees a typed order call and a typed task row, and the framework supplies
+ * lane). ONE call declares a typed Obligation→Receipt capability interface; the dev
+ * sees a typed obligation call and a typed task row, and the framework supplies
  * everything else through the SHIPPED `impureCapability()` quartet — so the gate
- * law (`check_order_receipt`), the kernel recognizer, codegen, and the stable-id
+ * law (`check_obligation_receipt`), the kernel recognizer, codegen, and the stable-id
  * lockfile all see a perfectly ordinary impure capability. Hidden means *not
- * hand-rolled*, never *not auditable*: the Order and Receipt facts ride the
+ * hand-rolled*, never *not auditable*: the Obligation and Receipt facts ride the
  * ledger verbatim.
  *
  * ```ts
@@ -22,7 +22,7 @@
  *   receipt: { tokensIn: t.int(), tokensOut: t.int() },
  * });
  * // derived, deterministically from the name:
- * //   aggregate  LlmCompleteTask        order      orderLlmComplete
+ * //   aggregate  LlmCompleteTask        obligation obligeLlmComplete
  * //   complete   completeLlmComplete    fail/block/deadLetter likewise
  * //   capability "llm.complete"         (the CapabilityBinding the executor must hold)
  * ```
@@ -84,7 +84,7 @@ export interface CapabilityDecl<
 > extends ImpureCapability<string, RequestShape<Req>, Req & Rec> {
   /** The capability name — the `CapabilityBinding` slot the executor must hold. */
   readonly name: string;
-  /** The request fields' zod object (what `order<Pascal>`'s params validate as). */
+  /** The request fields' zod object (what `oblige<Pascal>`'s params validate as). */
   readonly requestSchema: z.ZodObject<RequestShape<Req>>;
   /**
    * THE EXECUTOR'S SCAN LANE — a declared, indexed query over the task
@@ -127,7 +127,7 @@ export function capability<
     for (const k of Object.keys(fields)) {
       if (reserved.has(k)) {
         throw new Error(
-          `capability('${name}'): ${side} field '${k}' shadows the reserved Order→Receipt envelope — rename it (the envelope is framework law: ${[...reserved].join(", ")})`,
+          `capability('${name}'): ${side} field '${k}' shadows the reserved Obligation→Receipt envelope — rename it (the envelope is framework law: ${[...reserved].join(", ")})`,
         );
       }
     }
@@ -135,7 +135,7 @@ export function capability<
   for (const k of Object.keys(receipt)) {
     if (k in spec.request) {
       throw new Error(
-        `capability('${name}'): '${k}' is declared on BOTH request and receipt — a field has one writer (the order writes requests, the complete Receipt writes receipts); split or rename it`,
+        `capability('${name}'): '${k}' is declared on BOTH request and receipt — a field has one writer (the obligation writes requests, the complete Receipt writes receipts); split or rename it`,
       );
     }
   }
@@ -144,7 +144,7 @@ export function capability<
   const aggregateId = `${pascal}Task`;
 
   // Receipt fields fold only when the complete Receipt lands — auto-`.optional()`
-  // so a freshly-ordered task decodes on the generated read type (the same
+  // so a freshly-obligated task decodes on the generated read type (the same
   // read-decode discipline the envelope's own optionals follow).
   const receiptFields = Object.fromEntries(
     Object.entries(receipt).map(([k, f]) => [k, f.optional()]),
@@ -162,7 +162,7 @@ export function capability<
 
   const quartet = impureCapability({
     aggregateId,
-    orderDirectiveId: `order${pascal}`,
+    obligationDirectiveId: `oblige${pascal}`,
     completeDirectiveId: `complete${pascal}`,
     failDirectiveId: `fail${pascal}`,
     blockDirectiveId: `block${pascal}`,