@githolon/dsl 0.16.2 → 0.17.0

package/dart/CHANGELOG.md

@@ -1,2 +1,7 @@
+## 0.17.0
+- Lockstep bump with the birth-primitive release (see `@githolon/dsl` 0.17.0): birth is one law primitive
+  (`birthChild`), the platform-creator tier collapsed onto `#creator`, `grantCreation` takes a user or key
+  subject. The Dart wire types track the current /v2 governance surface.
+
 ## 0.16.0
 - First pub.dev release: kernel wire types, `NomosBridge` protocol, typed offer/query/watch surface.

package/dart/pubspec.yaml

@@ -11,7 +11,7 @@ description: >-
   Nomos 2 Dart frontend types — the hand-written kernel wire types plus the
   code-generated per-domain aggregate + directive-payload types. (De)serializes
   the EXACT serde JSON the Rust kernel + projection produce/consume.
-version: 0.16.0
+version: 0.17.0
 
 environment:
   sdk: ^3.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.16.2",
+  "version": "0.17.0",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/codegen_ts.ts

@@ -534,7 +534,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       // the obligation the birth provider materializes. parentWs = "root" for a top-level platform,
       // else the parent holon's own name. timestamps ride IN the payload (the determinism doctrine);
       // a platform's foundingAdminHash = sha256(your chosen platformAdminKey) — the host never mints it.
-      const emit = (name: string, doc: string, params: string[], lane: { kind: "boot" } | { kind: "offer"; parentWs: string; directiveId: "createWorkspace" | "birthPlatform" }) => {
+      const emit = (name: string, doc: string, params: string[], lane: { kind: "boot" } | { kind: "offer"; parentWs: string; directiveId: "createWorkspace" | "birthChild" }) => {
         if (emittedBirths.has(name)) return;
         emittedBirths.add(name);
         const sig = `opts: NomosBirthAuth & { cloud: string; ${params.join("; ")} }`;
@@ -547,14 +547,18 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
           );
           return;
         }
-        const isPlatformOffer = lane.directiveId === "birthPlatform";
+        // A platform birth is birthChild WITH genesis (the tier collapsed onto #creator; birthPlatform is
+        // gone). The genesis stamps ride IN the payload (the determinism doctrine): foundingAdminHash =
+        // sha256(your chosen platformAdminKey), bornAt = the ISO birth time. The host replays the
+        // law-authored chain — it mints no genesis.
+        const isPlatformOffer = lane.directiveId === "birthChild";
         const bodyFields = [
           `name: opts.name`,
           `parent: ${lane.parentWs}`,
           `principal: opts.principal ?? ""`,
           `requestedBy: opts.principal ?? ""`,
           `requestedAt: Date.now()`,
-          ...(isPlatformOffer ? [`foundingAdminHash: await nomosKeyHash(opts.platformAdminKey)`] : []),
+          ...(isPlatformOffer ? [`foundingAdminHash: await nomosKeyHash(opts.platformAdminKey)`, `bornAt: new Date().toISOString()`] : []),
         ];
         out.push(
           `/** ${doc} */`,
@@ -570,13 +574,13 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
         const isPlatform = t.childIds.length > 0;
         if (!childIds.has(t.id)) {
           // A TOP-LEVEL type: a workspace births on the boot lane; a platform-kind
-          // coordinator births via the root holon's birthPlatform offer.
+          // coordinator births via the root holon's birthChild offer (with genesis).
           emit(
             fnName(t.id),
-            `Birth a '${t.id}' workspace${isPlatform ? " (a platform-kind coordinator: hosts its own subtree; PRESENT your chosen platformAdminKey) via root's birthPlatform offer" : " on the boot lane (the one-time secret comes back)"} — derived from the taxonomy. Placement is automatic (measured shape) — no tier to pick.`,
+            `Birth a '${t.id}' workspace${isPlatform ? " (a platform-kind coordinator: hosts its own subtree; PRESENT your chosen platformAdminKey) via root's birthChild offer" : " on the boot lane (the one-time secret comes back)"} — derived from the taxonomy. Placement is automatic (measured shape) — no tier to pick.`,
             isPlatform ? [`name: string`, `platformAdminKey: string`] : [`name: string`],
             isPlatform
-              ? { kind: "offer", parentWs: `"root"`, directiveId: "birthPlatform" }
+              ? { kind: "offer", parentWs: `"root"`, directiveId: "birthChild" }
               : { kind: "boot" },
           );
         }
@@ -587,11 +591,11 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
           const childIsPlatform = child.childIds.length > 0;
           emit(
             fnName(child.id),
-            `Birth a '${child.id}' under a '${t.id}' — the taxonomy's hasMany edge, a governance offer on the parent holon (POST /v2/workspaces/<${parentParam}>/${childIsPlatform ? "birthPlatform" : "createWorkspace"}; lineage + pool enforced by the parent's law).${childIsPlatform ? " PRESENT your chosen platformAdminKey." : ""} Placement is automatic (measured shape).`,
+            `Birth a '${child.id}' under a '${t.id}' — the taxonomy's hasMany edge, a governance offer on the parent holon (POST /v2/workspaces/<${parentParam}>/${childIsPlatform ? "birthChild" : "createWorkspace"}; lineage + pool enforced by the parent's law).${childIsPlatform ? " PRESENT your chosen platformAdminKey." : ""} Placement is automatic (measured shape).`,
             childIsPlatform
               ? [`${parentParam}: string`, `name: string`, `platformAdminKey: string`]
               : [`${parentParam}: string`, `name: string`],
-            { kind: "offer", parentWs: `opts.${parentParam}`, directiveId: childIsPlatform ? "birthPlatform" : "createWorkspace" },
+            { kind: "offer", parentWs: `opts.${parentParam}`, directiveId: childIsPlatform ? "birthChild" : "createWorkspace" },
           );
         }
       }

package/src/framework/workspaces.ts

@@ -96,18 +96,24 @@ export const WORKSPACE_ROLES = ["cloud-root", "platform", "tenant"] as const;
 const WORKSPACE_SELF_ID = "workspaceself-self";
 const SELF_ADMIN_OBJECT = "workspace:self";
 export const WorkspaceSelf = aggregate("WorkspaceSelf", {
+  // VESTIGIAL node-class label (the same smell as `kind`): NOTHING decides on its value — the kernel, host,
+  // and gate read it nowhere; the write-once invariants below key on `name`'s PRESENCE (the "born" marker),
+  // never role. No longer set on new records (birthCloud/ensureWorkspaceSelf stopped writing it). Kept only
+  // for era-safety (old records carry it); slated for removal with `kind` in one #58 disposition pass.
   role: t.enum(WORKSPACE_ROLES).merge(Lww),
   name: t.string().merge(Lww),
 });
 // The one-off SELF-IDENTITY backfill for an already-born workspace (root predates WorkspaceSelf). UNGATED
 // by the admin gate — it must run BEFORE the admin tuple/gate are live — but WRITE-ONCE (the invariant
-// below refuses a re-set once the role exists), so a race or a malicious re-set cannot flip the role and
-// freeze governance. The HOST authors this in the serialized genesis re-entry, winning any race.
+// below refuses a re-set once the self-record exists), so a race or a malicious re-set cannot freeze
+// governance. The HOST authors this in the serialized genesis re-entry, winning any race.
 export const ensureWorkspaceSelf = directive("ensureWorkspaceSelf")
   .ensures(WorkspaceSelf)
-  .payload(z.object({ role: z.enum(WORKSPACE_ROLES), name: z.string().min(1) }))
+  // `role` accepted-but-ignored (vestigial — see WorkspaceSelf): callers may still pass it; the plan no
+  // longer sets it. `name` is the self-record's only meaningful field + the born marker.
+  .payload(z.object({ role: z.enum(WORKSPACE_ROLES).optional(), name: z.string().min(1) }))
   .plan((p) => {
-    ensure(WorkspaceSelf, WORKSPACE_SELF_ID).set("role", p.role).set("name", p.name);
+    ensure(WorkspaceSelf, WORKSPACE_SELF_ID).set("name", p.name);
     return [];
   });
 export const workspaceSelfWriteOnce = workspaceInvariant("WorkspaceSelfWriteOnce")
@@ -118,8 +124,11 @@ export const workspaceSelfWriteOnce = workspaceInvariant("WorkspaceSelfWriteOnce
   // 2026-06-15). Bare matches — exactly the convention the sharding invariants already fire under.
   .on("ensureWorkspaceSelf")
   .reads(() => [refAs("self", "WorkspaceSelf", "pre:" + WORKSPACE_SELF_ID)])
+  // WRITE-ONCE on the self-record's PRESENCE via `name` (not the vestigial `role`). At genesis name + role
+  // were always co-written, so an existing born workspace has `name` ⇒ behaviour preserved; a fresh one has
+  // neither ⇒ first set admitted.
   .assert(({ self }) =>
-    (self as { role?: string })?.role ? { reject: "workspace-self-already-set" } : { accept: true },
+    (self as { name?: string })?.name ? { reject: "workspace-self-already-set" } : { accept: true },
   );
 
 // ── THE GOVERNANCE RELATION SCHEMA (full-native Zanzibar — the ONE authz model) ──────────────────────
@@ -136,8 +145,10 @@ export const workspaceSelfWriteOnce = workspaceInvariant("WorkspaceSelfWriteOnce
 // side) DISCARDED at evaluation. Each relation is a flat `self()` (directly-stored tuples) — NO rewrite
 // algebra (no computed/from/union): control-plane authority is direct membership only.
 //   * admin           — grantAdmin/revokeAdmin + every admin-mutating governance directive.
-//   * creator         — createWorkspace (under invite/closed posture; see the host's _creationLawOk).
-//   * platformCreator — birthPlatform (always invite-only).
+//   * creator         — THE birth authority: createWorkspace + birthChild (leaf OR platform). The tier
+//                       collapsed onto this one relation (2026-06-24); a subject is user: or key:.
+//   * platformCreator — VESTIGIAL: its directives (birthPlatform/grant·revokePlatformCreation) are removed;
+//                       no .requires references it. Kept until the #58 disposition pass (with kind/role).
 // SELF-RELATIVE: custody guarantees a workspace only ever folds its OWN relations table, so
 // `workspace:root#admin` collapses to `workspace:self#admin` — the SAME law governs root and every
 // born platform with no name plumbing. (A pure tenant runs no governance ⇒ no schema ⇒ the gate is
@@ -224,9 +235,12 @@ export const CloudWorkspace = aggregate("CloudWorkspace", {
    */
   byteCap: t.int().merge(Lww).optional(),
   /**
-   * What this node IS: absent/`"workspace"` = a leaf; `"platform"` = a PLATFORM —
-   * a workspace that hosts the SAME governance law and parents its own subtree
-   * (the cloud, one level down; born via {@link birthPlatform}).
+   * DERIVED LABEL (the `kind`-collapse, architecture/provisioning_as_obligations.md): set to `"platform"`
+   * iff the birth order carried a genesis (a `foundingAdminHash`), else absent/`"workspace"`. It is NOT a
+   * node-class and NOTHING decides on it — the birth provider keys off `foundingAdminHash`, the genuine
+   * signal that a child is born running the governance law. Kept only so old readers/queries that filter by
+   * label still resolve; slated for removal (a #58 disposition) once no reader depends on it. "All
+   * workspaces are equal until a domain is installed" — a platform is one with the governance domain.
    */
   kind: t.enum(["workspace", "platform"]).merge(Lww).optional(),
   /**
@@ -237,6 +251,17 @@ export const CloudWorkspace = aggregate("CloudWorkspace", {
    * request at the cloud level).
    */
   pool: t.int().merge(Lww).optional(),
+  /**
+   * THE LAW-AUTHORED GENESIS CHAIN (P1, architecture/provisioning_as_obligations.md "law and law alone").
+   * For a genesis birth, `birthChild` authors the child's genesis RECIPE here as data — a JSON array of
+   * `{domain, directiveId, payload, actor}` steps (`seedGenesis → grantAdmin → birthCloud`). The birth
+   * capability provider REPLAYS this opaque list on the child (it names nothing — the directive ids come
+   * from the law, not host source); that is the difference between the host *reconstructing* the genesis
+   * (today) and the host *delivering* a law-authored one. Absent for plain births + pre-P1 records (the
+   * provider falls back to its inline recipe — flag-gated until live byte-equivalence is proven). Naming
+   * the genesis directives HERE is law naming law (legitimate); the prohibition binds only the host.
+   */
+  genesisChain: t.json().merge(Lww).optional(),
 });
 
 // AdminGrant / CreationGrant aggregates: DELETED (full-native Zanzibar). Admin/creation authority is
@@ -356,11 +381,79 @@ export const CapabilityBinding = aggregate("CapabilityBinding", {
 
 // --- workspace directives ---------------------------------------------------------
 
+// ── THE ONE BIRTH RECORD (the `kind`-collapse — architecture/provisioning_as_obligations.md) ───────────
+// Every birth — a plain child OR a platform — mints the SAME `CloudWorkspace` order; the ONLY difference is
+// the GENESIS DATA the order carries. `genesis` present (a founding-admin hash + pool) ⇒ this child is born
+// running the governance law: the birth capability provider drains it (the order carries a foundingAdminHash)
+// and seeds the genesis. Absent ⇒ a plain lineage record, materialized by boot-on-touch (never drained).
+// `kind` is set PURELY as a derived label off genesis presence — a vestige for old readers; NOTHING decides
+// on it (the host now keys off foundingAdminHash, not the label). There is NO node-class: a platform is just
+// a workspace whose birth order carried a genesis. (`birthChild` is the one unified directive — the tier
+// was collapsed onto `#creator`; `birthPlatform`/`createWorkspace` remain only as deprecated compat aliases.)
+// Returns the record builder so a caller (birthChild) can author the law-authored genesis chain onto it.
+function planBirthRecord(
+  p: {
+    name: string;
+    parent: string;
+    principal: string;
+    tier: (typeof WORKSPACE_TIERS)[number];
+    requestedBy: string;
+    requestedAt: number;
+  },
+  genesis?: { foundingAdminHash: string; pool: number },
+) {
+  const rec = create(CloudWorkspace)
+    .set("name", p.name)
+    .set("parent", p.parent)
+    .set("principal", p.principal)
+    .set("tier", p.tier)
+    .set("status", "requested" as const)
+    .set("ownerGrantHash", "") // no owner credential until provisioned
+    .set("createdBy", p.requestedBy)
+    .set("createdAt", p.requestedAt);
+  if (genesis) {
+    rec
+      .set("kind", "platform" as const) // DERIVED LABEL ONLY — the order's foundingAdminHash is the real signal
+      .set("pool", genesis.pool)
+      .set("foundingAdminHash", genesis.foundingAdminHash); // the provider grants admin to this hash at materialize
+  }
+  return rec;
+}
+
+// ── THE LAW-AUTHORED GENESIS CHAIN (P1 — "law and law alone") ──────────────────────────────────────────
+// The parent's `birthChild` AUTHORS the child's genesis recipe as DATA — byte-faithful to what the host's
+// `/materialize` reconstructs today (seedGenesis → grantAdmin → birthCloud), but now owned by the LAW. The
+// host replays this opaque list on the child (naming nothing). Timestamps ride IN the payload (the doctrine):
+// `bornAt` (ISO) for the warrant, `requestedAt` (epoch-ms) for the ms-stamped grants — both caller-stamped,
+// so the chain is a pure function of the payload (deterministic on every replaying peer). Naming the genesis
+// directives here is law naming law; the prohibition binds only the host. The law package bytes are NOT in
+// here — the install-by-hash stays a custody concern of the provider (the bytes-in-pack refinement is later).
+export function buildGenesisChain(p: {
+  name: string;
+  principal: string;
+  tier: (typeof WORKSPACE_TIERS)[number];
+  foundingAdminHash: string;
+  bornAt: string;
+  requestedAt: number;
+}): string {
+  const founder = "user:" + p.principal;
+  return JSON.stringify([
+    { domain: "workspaces", directiveId: "seedGenesis", actor: founder, payload: { principal: founder, workspaceId: "", bornAt: p.bornAt } },
+    { domain: "workspaces", directiveId: "grantAdmin", actor: founder, payload: { keyHash: p.foundingAdminHash, label: `founding admin (born for ${p.principal})`, grantedBy: p.principal, grantedAt: p.requestedAt } },
+    // No `role` — it was a vestigial node-class label (collapsed with `kind`); birthCloud ignores it now.
+    { domain: "workspaces", directiveId: "birthCloud", actor: "", payload: { principal: p.principal, name: p.name, tier: p.tier, bornAt: p.requestedAt } },
+  ]);
+}
+
 /**
  * createWorkspace — record the lawful REQUEST for a workspace. Nomos MINTS the
  * `CloudWorkspace` id (the payload carries none); the record is born
  * `status:"requested"` with `ownerGrantHash:""` — no bearer exists until the
  * worker provisions and authors {@link provisionWorkspace}.
+ *
+ * @deprecated SUPERSEDED by {@link birthChild} (the `kind`-collapse) — a plain birth is `birthChild`
+ * with no genesis. Kept as a compat alias (same `#creator` gate) during migration; the host still
+ * authors it by name for namespaced-child + upload births. Retire once those callers move to birthChild.
  */
 export const createWorkspace = directive("createWorkspace")
   .creates(CloudWorkspace)
@@ -378,17 +471,8 @@ export const createWorkspace = directive("createWorkspace")
     }),
   )
   .plan((p) => {
-    create(CloudWorkspace)
-      .set("name", p.name)
-      .set("parent", p.parent)
-      .set("principal", p.principal)
-      .set("tier", p.tier)
-      .set("status", "requested" as const)
-      .set("ownerGrantHash", "") // no owner credential until provisioned
-      .set("createdBy", p.requestedBy)
-      .set("createdAt", p.requestedAt);
-    // A plain workspace record (no kind:platform) — boot materializes it directly; the birth capability
-    // provider only drains kind:platform records, so this is a lineage record, not a genesis order.
+    // No genesis ⇒ a plain lineage record (no foundingAdminHash) — never drained; materialized by boot-on-touch.
+    planBirthRecord(p);
     return [];
   })
   .requires("creator"); // posture-gated creation: only a #creator holder may request a workspace
@@ -409,9 +493,9 @@ export const birthCloud = directive("birthCloud")
       /** The genesis auth-provider principal uid upon which the world rests. */
       principal: z.string().min(1),
       name: z.string().min(1).default("root"),
-      /** The workspace's ROLE for the governance domain — the host stamps "cloud-root" at root genesis,
-       *  "platform" when birthing a platform's own chain. Drives the self-relative authz gate. */
-      role: z.enum(WORKSPACE_ROLES).default("cloud-root"),
+      /** VESTIGIAL (see WorkspaceSelf): accepted-but-ignored — the value drives nothing. The authz gate is
+       *  self-relative (`workspace:self#<relation>`), NOT role-keyed. Kept optional for caller compat. */
+      role: z.enum(WORKSPACE_ROLES).optional(),
       tier: z.enum(WORKSPACE_TIERS).default("edge"),
       bornAt: epochMs,
     }),
@@ -428,8 +512,9 @@ export const birthCloud = directive("birthCloud")
       .set("createdAt", p.bornAt)
       .set("provisionedAt", p.bornAt);
     // The self-identity singleton at the CONSTANT id (ungated — birthCloud is not admin-mutating), so the
-    // gate's self-record exists before any admin write. ensure() = deterministic-id sibling birth.
-    ensure(WorkspaceSelf, WORKSPACE_SELF_ID).set("role", p.role).set("name", p.name);
+    // gate's self-record exists before any admin write. ensure() = deterministic-id sibling birth. `name` is
+    // the born marker; `role` is no longer written (vestigial node-class — see WorkspaceSelf).
+    ensure(WorkspaceSelf, WORKSPACE_SELF_ID).set("name", p.name);
     return [];
   });
 
@@ -552,67 +637,75 @@ export const reclaimWorkspace = directive("reclaimWorkspace")
   })
   .requires("admin");
 
-/**
- * birthPlatform — A PLATFORM IS BORN: the cloud, one level down. Records the
- * platform-kind workspace (parented to root, owned by the invited principal,
- * carrying its POOL). The worker then provisions it exactly like the cloud
- * provisioned itself: deploys the SAME governance law into it, seeds ITS founding
- * AdminGrant, and the platform claims itself with its own birth intent on its own
- * chain. Recursion, not new machinery.
- */
-export const birthPlatform = directive("birthPlatform")
+// ─────────────────────────── BIRTH AS A NOMOS PRIMITIVE ──────────────────────────────────────────────
+// (birthPlatform is GONE — the tier collapsed onto #creator; birthChild is the one birth directive.)
+// THE RECORD IS THE OBLIGATION (architecture/githolon_host_contract.md "Birth is a capability" +
+// provisioning_as_obligations.md). Birth is an IMPURE capability: the parent ORDERS (the law-gated
+// birthChild mints a CloudWorkspace at status:requested carrying foundingAdminHash + the LAW-AUTHORED
+// genesisChain — gated by .requires("creator")), the BIRTH CAPABILITY PROVIDER fulfils it (materialize:
+// install the parent's law + REPLAY the genesisChain opaquely — the child's OWN kernel admitting each), and
+// authors provisionWorkspace (the receipt) the parent TRUSTS. No separate obligation aggregate — the minted
+// CloudWorkspace IS the order. The provider owns only the impure boot + replay; the LAW owns the recipe (P1)
+// AND who/what (the gate); the parent trusts the DID-IT-HAPPEN. A child born this way runs THIS SAME law and
+// births its children identically — the recursion is the law.
+
+// ─────────────────────────── birthChild — THE ONE BIRTH DIRECTIVE (the `kind`-collapse) ───────────────
+// "There are only workspaces, all equal until a domain is installed." birthChild is the SINGLE directive
+// that births any child — a plain leaf OR a platform; the difference is the GENESIS DATA the payload carries,
+// never a node-class. THE TIER IS COLLAPSED (Jack, 2026-06-24): `#creator` is THE one birth authority — a
+// creator may spawn a leaf AND a platform (the prior `#platformCreator` second tier is retired; platform
+// birth under root is still invite-only because `creator` on root is admin-granted, just renamed/unified).
+//   • genesis ABSENT  → a plain lineage record (no foundingAdminHash); boot-on-touch, never drained.
+//   • genesis PRESENT → carries {foundingAdminHash, pool}: the birth capability provider drains it
+//                       (the order carries a foundingAdminHash) → materialize + seed genesis. A platform.
+// Self-relative: the gate is `workspace:self#creator`, so the SAME directive on root births a platform and
+// on a platform births a child — no per-level host code (the recursion is the law). Supersedes
+// createWorkspace + birthPlatform (kept as compat aliases during migration). See
+// architecture/provisioning_as_obligations.md "The `kind`-collapse".
+export const birthChild = directive("birthChild")
   .creates(CloudWorkspace)
   .payload(
-    z.object({
-      name: z.string().min(1),
-      /** The auth-provider uid of the platform OWNER (must hold a PlatformGrant). */
-      principal: z.string().min(1),
-      /** Parent CloudWorkspace aggregate id (root's record). */
-      parent: z.string().default(""),
-      /** The pool: how many live children the platform may parent. */
-      pool: z.number().int().positive().default(50),
-      tier: z.enum(WORKSPACE_TIERS).default("heavy"),
-      /** sha256 of the founding-admin key the requester PRESENTED (the provider grants admin to the hash;
-       *  the requester keeps the key — it is the platform's admin credential, used to govern + deploy). */
-      foundingAdminHash: sha256Hex,
-      requestedBy: z.string().min(1),
-      requestedAt: epochMs,
-    }),
+    z
+      .object({
+        name: z.string().min(1),
+        /** The auth-provider principal uid the request claimed; `""` = unclaimed (a plain leaf may be). */
+        principal: z.string().default(""),
+        /** Parent CloudWorkspace aggregate id; `""` (default) = root. */
+        parent: z.string().default(""),
+        /** Hosting tier; defaults to the edge DO (a genesis/platform birth typically passes `heavy`). */
+        tier: z.enum(WORKSPACE_TIERS).default("edge"),
+        requestedBy: z.string().min(1),
+        requestedAt: epochMs,
+        /** GENESIS (optional): present ⇒ this child is born running the governance law (a platform). The
+         *  sha256 of the founding-admin key the requester presented — the provider grants admin to the hash. */
+        foundingAdminHash: sha256Hex.optional(),
+        /** PLATFORM POOL: how many live children the born platform may parent. Only meaningful with genesis. */
+        pool: z.number().int().positive().default(50),
+        /** GENESIS birth time as an ISO string (caller-stamped — the timestamp doctrine). Arms the warrant
+         *  in the law-authored genesis chain; required for (and only used by) a genesis birth. */
+        bornAt: z.string().optional(),
+      })
+      // A genesis birth (a platform) must carry a principal AND a bornAt — it owns a subtree, a lineage
+      // anchor, and a law-authored genesis chain whose warrant is stamped at bornAt.
+      .refine((d) => !d.foundingAdminHash || (d.principal.length > 0 && !!d.bornAt), {
+        message: "a genesis birth (foundingAdminHash present) requires a non-empty principal and bornAt (ISO)",
+        path: ["principal"],
+      }),
   )
   .plan((p) => {
-    create(CloudWorkspace)
-      .set("name", p.name)
-      .set("parent", p.parent)
-      .set("principal", p.principal)
-      .set("kind", "platform" as const)
-      .set("pool", p.pool)
-      .set("tier", p.tier)
-      .set("status", "requested" as const)
-      .set("ownerGrantHash", "")
-      .set("foundingAdminHash", p.foundingAdminHash) // the provider grants admin to this hash at materialize
-      .set("createdBy", p.requestedBy)
-      .set("createdAt", p.requestedAt);
-    // THE RECORD IS THE OBLIGATION: a kind:platform CloudWorkspace at status:requested with no ownerGrantHash
-    // is an order the birth capability provider drains (materialize + install the parent's law + seed genesis
-    // + grant the founding admin + birthCloud), closing it with provisionWorkspace (the receipt). No separate
-    // obligation aggregate — the minted CloudWorkspace IS it (sidesteps the id-mint gate; reuses the lifecycle).
+    const rec = planBirthRecord(p, p.foundingAdminHash ? { foundingAdminHash: p.foundingAdminHash, pool: p.pool } : undefined);
+    // LAW AUTHORS THE GENESIS RECIPE (P1): a genesis birth carries its child's seedGenesis→grantAdmin→
+    // birthCloud chain as data; the provider replays it opaquely. (refine guarantees principal + bornAt here.)
+    if (p.foundingAdminHash) {
+      rec.set("genesisChain", buildGenesisChain({ name: p.name, principal: p.principal, tier: p.tier, foundingAdminHash: p.foundingAdminHash, bornAt: p.bornAt as string, requestedAt: p.requestedAt }));
+    }
     return [];
   })
-  .requires("platformCreator"); // invite-only: an active #platformCreator tuple admits the birth
+  .requires("creator"); // THE ONE birth authority — a #creator may birth a leaf OR a platform (tier collapsed)
 
-// ─────────────────────────── BIRTH AS A NOMOS PRIMITIVE ──────────────────────────────────────────────
-// THE RECORD IS THE OBLIGATION (architecture/githolon_host_contract.md "Birth is a capability"). Birth is
-// an IMPURE capability: the parent ORDERS (the law-gated birthPlatform mints a CloudWorkspace at
-// status:requested, kind:platform, carrying foundingAdminHash — gated by .requires("platformCreator")),
-// the BIRTH CAPABILITY PROVIDER fulfils it (materialize: install the PARENT's law + seed genesis + grant
-// the founding admin + birthCloud — the child's OWN kernel admitting each), and authors provisionWorkspace
-// (the receipt) the parent TRUSTS. No separate obligation aggregate — the minted CloudWorkspace IS the
-// order (it sidesteps the id-mint gate and reuses the requested→provisioned lifecycle). The provider knows
-// HOW (the Capability Exception sanctions a declared effect); the law owns WHO/WHAT; the parent trusts the
-// DID-IT-HAPPEN. A child born this way runs THIS SAME law and births its children identically.
-
-/** workspacesByStatus — the birth provider drains `requested` CloudWorkspaces (kind:platform, no
- *  ownerGrantHash) → materialize → provisionWorkspace. The law's order queue; the host polls, never decides. */
+/** workspacesByStatus — the birth provider drains `requested` CloudWorkspaces that CARRY A foundingAdminHash
+ *  (a genesis order, no ownerGrantHash) → materialize → provisionWorkspace. Plain requested records (no
+ *  foundingAdminHash) are lineage only, boot-on-touch. The law's order queue; the host polls, never decides. */
 export const workspacesByStatus = query("workspacesByStatus").key("status").returns(CloudWorkspace);
 
 /** setPlatformPool — the pool edition of a granted quota request. */
@@ -632,39 +725,10 @@ export const setPlatformPool = directive("setPlatformPool")
   })
   .requires("admin");
 
-/**
- * grantPlatformCreation / revokePlatformCreation — open and close the
- * become-a-platform door for one principal (see {@link PlatformGrant}).
- */
-// grantPlatformCreation — become-a-platform authority IS the self-relative `#platformCreator` tuple
-// (one authz spine, all the way down). Writes `workspace:self#platformCreator@user:<principal>` (no
-// PlatformGrant aggregate) — the host's platform-birth invite check reads the SAME tuple via Check.
-export const grantPlatformCreation = directive("grantPlatformCreation")
-  .ensures(RelationTuple)
-  .payload(
-    z.object({
-      principal: z.string().min(1),
-      label: z.string().min(1),
-      grantedBy: z.string().min(1),
-      grantedAt: epochMs,
-    }),
-  )
-  .plan((p) => writeTuple({ object: SELF_ADMIN_OBJECT, relation: "platformCreator", subject: "user:" + p.principal, grantedBy: p.grantedBy, grantedAt: String(p.grantedAt) }))
-  .requires("admin"); // only an admin opens the become-a-platform door
-
-// revokePlatformCreation — flip the `#platformCreator@user:<principal>` leaf to revoked. BREAKING vs the
-// aggregate model: keyed by PRINCIPAL (the tuple subject), not a minted grantId.
-export const revokePlatformCreation = directive("revokePlatformCreation")
-  .ensures(RelationTuple)
-  .payload(
-    z.object({
-      principal: z.string().min(1),
-      revokedBy: z.string().min(1),
-      revokedAt: epochMs,
-    }),
-  )
-  .plan((p) => removeTuple({ object: SELF_ADMIN_OBJECT, relation: "platformCreator", subject: "user:" + p.principal, grantedBy: p.revokedBy, grantedAt: String(p.revokedAt), revokedBy: p.revokedBy, revokedAt: String(p.revokedAt) }))
-  .requires("admin");
+// grantPlatformCreation / revokePlatformCreation — REMOVED (the tier collapsed onto #creator, 2026-06-24).
+// Platform-birth authority is now just #creator (grantCreation, which takes a user OR key subject). The
+// `#platformCreator` relation + its (vestigial) PlatformGrant aggregate / platformGrantByPrincipal query
+// retire in the same #58 disposition pass as kind/role; any historical #platformCreator tuple is inert data.
 
 /**
  * AuthProvider — BYOAuth: WHO VOUCHES FOR THIS SUBTREE'S PRINCIPALS. A law-state
@@ -980,30 +1044,41 @@ export const revokeAdmin = directive("revokeAdmin")
 // grantCreation — creation authority IS the self-relative `#creator` tuple the CreationGate reads.
 // Writes `workspace:self#creator@key:<keyHash>` (no CreationGrant aggregate). Under posture invite/closed
 // the gate admits only holders of an active #creator subject; under open/unset it admits anyone.
+// #creator is ONE relation over ONE principal graph; a subject is `key:<hash>` (proof by holding a secret —
+// a Bearer) OR `user:<uid>` (proof of identity — an auth-provider token). The relation allows BOTH
+// (allow:[user(),key()]); these are not two authorities, just two ways a principal authenticates. So
+// grantCreation takes EITHER — exactly one of keyHash / principal. This is what lets a USER birth platforms
+// via birthChild (no "creator key" dance) and dissolves the user/key migration wrinkle.
 export const grantCreation = directive("grantCreation")
   .ensures(RelationTuple)
   .payload(
-    z.object({
-      keyHash: sha256Hex,
-      label: z.string().min(1),
-      grantedBy: z.string().min(1),
-      grantedAt: epochMs,
-    }),
+    z
+      .object({
+        keyHash: sha256Hex.optional(),
+        principal: z.string().min(1).optional(),
+        label: z.string().min(1),
+        grantedBy: z.string().min(1),
+        grantedAt: epochMs,
+      })
+      .refine((d) => !!d.keyHash !== !!d.principal, { message: "grantCreation needs exactly one of keyHash (a key: subject) or principal (a user: subject)", path: ["keyHash"] }),
   )
-  .plan((p) => writeTuple({ object: SELF_ADMIN_OBJECT, relation: "creator", subject: "key:" + p.keyHash, grantedBy: p.grantedBy, grantedAt: String(p.grantedAt) }))
+  .plan((p) => writeTuple({ object: SELF_ADMIN_OBJECT, relation: "creator", subject: p.principal ? "user:" + p.principal : "key:" + p.keyHash, grantedBy: p.grantedBy, grantedAt: String(p.grantedAt) }))
   .requires("admin"); // only an admin grants creation authority
 
-/** revokeCreation — flip the `#creator@key:<keyHash>` leaf to revoked (see {@link revokeAdmin}). */
+/** revokeCreation — flip the `#creator@<subject>` leaf to revoked (key OR user, mirroring grantCreation). */
 export const revokeCreation = directive("revokeCreation")
   .ensures(RelationTuple)
   .payload(
-    z.object({
-      keyHash: sha256Hex,
-      revokedBy: z.string().min(1),
-      revokedAt: epochMs,
-    }),
+    z
+      .object({
+        keyHash: sha256Hex.optional(),
+        principal: z.string().min(1).optional(),
+        revokedBy: z.string().min(1),
+        revokedAt: epochMs,
+      })
+      .refine((d) => !!d.keyHash !== !!d.principal, { message: "revokeCreation needs exactly one of keyHash or principal", path: ["keyHash"] }),
   )
-  .plan((p) => removeTuple({ object: SELF_ADMIN_OBJECT, relation: "creator", subject: "key:" + p.keyHash, grantedBy: p.revokedBy, grantedAt: String(p.revokedAt), revokedBy: p.revokedBy, revokedAt: String(p.revokedAt) }))
+  .plan((p) => removeTuple({ object: SELF_ADMIN_OBJECT, relation: "creator", subject: p.principal ? "user:" + p.principal : "key:" + p.keyHash, grantedBy: p.revokedBy, grantedAt: String(p.revokedAt), revokedBy: p.revokedBy, revokedAt: String(p.revokedAt) }))
   .requires("admin");
 
 // --- declared read queries (the worker's ENTIRE enforcement surface) -----------------
@@ -1156,8 +1231,9 @@ export const founderSignerWriteOnce = workspaceInvariant("FounderSignerWriteOnce
 export const birthCloudOnce = workspaceInvariant("BirthCloudOnce")
   .on("birthCloud")
   .reads(() => [refAs("self", "WorkspaceSelf", "pre:" + WORKSPACE_SELF_ID)])
+  // WRITE-ONCE on the self-record's PRESENCE via `name` (not the vestigial `role`) — a workspace is born once.
   .assert(({ self }) =>
-    (self as { role?: string })?.role ? { reject: "cloud-already-born" } : { accept: true },
+    (self as { name?: string })?.name ? { reject: "cloud-already-born" } : { accept: true },
   );
 
 /** provisionWorkspace: the birth RECEIPT may only close a `requested` record (no hijacking a live