@githolon/dsl 0.19.0 → 0.20.0

package/dart/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 0.20.0
+- Authority-aware: `NomosBridge.offerDirective(domain, directiveId, payload, {actor, domainHash})` — generated
+  clients route every offer through THE ONE encoder (`encodeIntentOfferBytes` in @githolon/client); no
+  per-client envelope encoding. New typed `MissingOfferAuthority` — a `.requires(...)` directive authored
+  with no actor throws BEFORE submit (an actorless gated offer cannot be generated). Lockstep jump to 0.20.0.
+
 ## 0.17.0
 - Lockstep bump with the birth-primitive release (see `@githolon/dsl` 0.17.0): birth is one law primitive
   (`birthChild`), the platform-creator tier collapsed onto `#creator`, `grantCreation` takes a user or key

package/dart/lib/src/errors.dart

@@ -77,3 +77,22 @@ class LawHashUnavailable extends NomosBridgeError {
   LawHashUnavailable({required this.workspace, String? message})
       : super(message ?? 'could not resolve the current law hash for "$workspace" — the cloud reported no installed law for the home');
 }
+
+/// AUTHORITY IS UNFORGEABLE-BY-CONSTRUCTION: a GATED directive (one carrying a `.requires(relation)` write
+/// gate in its law) authored with NO `actor` cannot produce an offer — the generated client throws THIS
+/// BEFORE any submit, so an actorless gated offer is impossible to GENERATE (never merely refused at the
+/// kernel gate). REMEDY: construct the generated client with an `actor` (the verified principal — under a
+/// home scope this is the subject; the bridge owns signing). Secrets NEVER appear here — only the identity.
+class MissingOfferAuthority extends NomosBridgeError {
+  /// The domain of the gated directive.
+  final String domain;
+
+  /// The gated directive id that could not be offered without an authority.
+  final String directiveId;
+
+  /// The relation the law requires the author to hold (e.g. `admin`).
+  final String requires;
+  MissingOfferAuthority({required this.domain, required this.directiveId, required this.requires, String? message})
+      : super(message ??
+            '$domain/$directiveId requires the "$requires" relation — construct the client with an actor (the verified principal) to author it; a gated offer cannot be made without an authority');
+}

package/dart/lib/src/webview_bridge.dart

@@ -176,6 +176,28 @@ class NomosBridge {
     return r['head'].toString();
   }
 
+  /// THE ONE ENCODER offer: hand the holon a PLANNED directive (domain/directiveId/payload) + the verified
+  /// [actor]; the runner's `offerDirective` op encodes the v2 envelope via the SINGLE codec (index.mjs
+  /// `encodeIntentOfferBytes`, with `security.actor` included iff [actor] is set). The generated Dart client
+  /// calls THIS — it never hand-builds offer bytes, so there is exactly ONE copy of the wire format. Returns
+  /// the new local head; durable on [sync]. ([offer] with opaque bytes stays for back-compat carriers.)
+  Future<String> offerDirective({
+    required String domain,
+    required String directiveId,
+    required Object? payload,
+    String? actor,
+    String? domainHash,
+  }) async {
+    final r = _asMap(await _call('offerDirective', {
+      'domain': domain,
+      'directiveId': directiveId,
+      'payload': payload,
+      if (actor != null) 'actor': actor,
+      if (domainHash != null) 'domainHash': domainHash,
+    }));
+    return r['head'].toString();
+  }
+
   /// Mint an ed25519 DEVICE KEY in-kernel → `{secret, public}` (base64). The SECRET stays on this device
   /// (persist it in secure storage); pass it to [connect] as `authorSecret` (or per-offer `signWith`) so the
   /// holon SIGNS each intent. The PUBLIC half is what gets enrolled so the gate re-verifies the signature on

package/dart/pubspec.yaml

@@ -11,7 +11,7 @@ description: >-
   Nomos 2 Dart frontend types — the hand-written kernel wire types plus the
   code-generated per-domain aggregate + directive-payload types. (De)serializes
   the EXACT serde JSON the Rust kernel + projection produce/consume.
-version: 0.18.0
+version: 0.20.0
 
 environment:
   sdk: ^3.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/codegen_dart_client.ts

@@ -123,15 +123,39 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
     const payloadClass = `${cap(d.id)}Payload`;
     const stamps = autoStampFields((d as unknown as { payloadSchema: z.ZodTypeAny }).payloadSchema);
     const method = safeMethod(d.id);
+    // THE AUTHORITY GATE (codegen-time): a directive carrying `.requires(relation)` is GATED — its method
+    // throws MissingOfferAuthority when `actor` is null/empty, BEFORE any submit, so an actorless gated
+    // offer is impossible to GENERATE (the war: the gate is structural, not just kernel-side). Secrets never
+    // appear — only the actor identity (the bridge owns signing).
+    const gate = (d as { requiresRelationGate?: { relation: string } }).requiresRelationGate;
+    const gateGuard = gate !== undefined
+      ? `    if (actor == null || actor!.trim().isEmpty) throw MissingOfferAuthority(domain: ${dartStr(domain)}, directiveId: ${dartStr(d.id)}, requires: ${dartStr(gate.relation)});`
+      : "";
+    const gateDoc = gate !== undefined
+      ? `  /// GATED: needs an \`actor\` (the \`${gate.relation}\` relation) — throws MissingOfferAuthority otherwise.`
+      : "";
     if (stamps.length > 0) {
       methods.push(
         `  /// Author \`${domain}/${d.id}\` locally under the installed law; returns the new local head.`,
         `  /// Omitted ${stamps.map((s) => `\`${s}\``).join(" / ")} auto-stamp(s) ISO now() at offer.`,
+        ...(gateDoc ? [gateDoc] : []),
         `  Future<String> ${method}(${payloadClass} payload) {`,
+        ...(gateGuard ? [gateGuard] : []),
         `    final data = payload.toPayloadJson();`,
         `    final now = DateTime.now().toUtc().toIso8601String();`,
         ...stamps.map((s) => `    data.putIfAbsent(${dartStr(s)}, () => now);`),
-        `    return bridge.offer(intentBytes: _encodeIntentOffer(${dartStr(domain)}, ${dartStr(d.id)}, data, domainHash));`,
+        `    return bridge.offerDirective(domain: ${dartStr(domain)}, directiveId: ${dartStr(d.id)}, payload: data, actor: actor, domainHash: domainHash);`,
+        `  }`,
+        ``,
+      );
+    } else if (gateGuard) {
+      // A gated directive with no `…At` sugar still needs a block body for the throw guard.
+      methods.push(
+        `  /// Author \`${domain}/${d.id}\` locally under the installed law; returns the new local head.`,
+        gateDoc,
+        `  Future<String> ${method}(${payloadClass} payload) {`,
+        gateGuard,
+        `    return bridge.offerDirective(domain: ${dartStr(domain)}, directiveId: ${dartStr(d.id)}, payload: payload.toPayloadJson(), actor: actor, domainHash: domainHash);`,
         `  }`,
         ``,
       );
@@ -139,7 +163,7 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
       methods.push(
         `  /// Author \`${domain}/${d.id}\` locally under the installed law; returns the new local head.`,
         `  Future<String> ${method}(${payloadClass} payload) =>`,
-        `      bridge.offer(intentBytes: _encodeIntentOffer(${dartStr(domain)}, ${dartStr(d.id)}, payload.toPayloadJson(), domainHash));`,
+        `      bridge.offerDirective(domain: ${dartStr(domain)}, directiveId: ${dartStr(d.id)}, payload: payload.toPayloadJson(), actor: actor, domainHash: domainHash);`,
         ``,
       );
     }
@@ -216,14 +240,15 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
     `//   final app = ${className}(bridge);`,
     `//   await app.${dirs[0] ? safeMethod(dirs[0].id) : "someDirective"}(/* typed payload */);`,
     ``,
-    `import 'dart:convert';`,
-    ``,
+    // `dart:convert` is needed ONLY for the interface block's `jsonDecode` — the offer lane no longer encodes
+    // any envelope (it routes through `bridge.offerDirective` → THE ONE ENCODER). Omit it when no interface.
+    ...(opts.interface !== undefined ? [`import 'dart:convert';`, ``] : []),
     `import '${supportImport}';`,
     `import '${mod.name}.dart';`,
     `// Re-export the sibling types (read models + payloads + the bridge runtime) so ONE import of this`,
     `// client file gives an app the whole typed surface.`,
     `export '${mod.name}.dart';`,
-    `export '${supportImport}' show NomosBridge, BridgeTransport, NomosBridgeError, kWebviewBridgeVersion;`,
+    `export '${supportImport}' show NomosBridge, BridgeTransport, NomosBridgeError, MissingOfferAuthority, kWebviewBridgeVersion;`,
     ``,
     `/// sha256 of the deployed \`.package.usda\` — the installed law this client offers under.`,
     `const String ${hashConst} = ${dartStr(opts.domainHash)};`,
@@ -238,22 +263,22 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
           ``,
         ]
       : []),
-    `String _encodeIntentOffer(String domain, String directiveId, Object? payload, String domainHash) =>`,
-    `    base64Encode(utf8.encode(jsonEncode({`,
-    `      'v': 2,`,
-    `      'intent': {`,
-    `        'domain': domain,`,
-    `        'directiveId': directiveId,`,
-    `        'payload': payload,`,
-    `        'domainHash': domainHash,`,
-    `      },`,
-    `    })));`,
-    ``,
     `/// Typed async client for the \`${domain}\` domain, bound to a connected [NomosBridge].`,
+    `///`,
+    `/// Pass \`actor\` (the verified principal uid) to author AS that user — the bridge's \`offerDirective\` op`,
+    `/// carries it through THE ONE ENCODER (\`encodeIntentOfferBytes\` in @githolon/client) as \`security.actor\`,`,
+    `/// so the kernel seals it as the captured principal and the ReBAC \`.requires(...)\` gate judges the real`,
+    `/// author. A GATED directive (one whose law declares \`.requires(relation)\`) authored with no actor throws`,
+    `/// [MissingOfferAuthority] BEFORE any submit — an actorless gated offer can't be constructed. The bridge`,
+    `/// owns SIGNING (a device secret on \`connect\`); only the actor IDENTITY is passed here, never a secret.`,
     `class ${className} {`,
     `  final NomosBridge bridge;`,
     `  final String domainHash;`,
-    `  ${className}(this.bridge, {this.domainHash = ${hashConst}});`,
+    ``,
+    `  /// The verified principal uid every offer is authored as (sealed as \`security.actor\` by the one encoder).`,
+    `  /// Null ⇒ open (un-gated) authoring; a gated directive then throws [MissingOfferAuthority].`,
+    `  final String? actor;`,
+    `  ${className}(this.bridge, {this.domainHash = ${hashConst}, this.actor});`,
     ``,
     ...(opts.interface !== undefined
       ? [

package/src/codegen_proof.ts

@@ -183,6 +183,136 @@ function findConcurrencyLeg(
   return undefined;
 }
 
+// ── authority-conformance discovery (the ONE-ENCODER + gate proof — actorless gated offer is impossible) ──
+
+/** A discovered AUTHORITY-CONFORMANCE leg: a GATED directive (one carrying `.requires(relation)`) the proof
+ *  can drive locally to prove (a) authored WITH an actor, the produced offer envelope carries `security.actor`
+ *  (the one encoder threaded the actor through), and (b) authored WITHOUT an actor, the generated client
+ *  THROWS MissingOfferAuthority before any submit (an actorless gated offer is impossible to GENERATE). */
+export interface AuthorityConformanceLeg {
+  /** The gated directive's domain (the generated factory + its `domain` field). */
+  readonly domain: string;
+  /** The gated directive id (the generated client method). */
+  readonly directiveId: string;
+  /** The relation the law requires the author to hold (e.g. `admin`) — the MissingOfferAuthority `requires`. */
+  readonly relation: string;
+  /** The synthesized payload the proof drives the gated directive with (auto-stamped `…At` omitted). */
+  readonly payload: Record<string, unknown>;
+  /** Required `…At` fields the runtime stamps at dispatch (mirrors the create leg). */
+  readonly autoStamped: readonly string[];
+  /** When the gated directive is a `.creates` whose own id is kernel-minted, the field to mint at runtime. */
+  readonly mintField?: string;
+}
+
+/** Discover the AUTHORITY-CONFORMANCE leg: the first GATED directive (`.requires(relation)` ⇒
+ *  `requiresRelationGate`) whose payload the synthesizer can sample. A birth / attestation-authorized
+ *  directive is skipped (their authority is a carried cert / signed quote, not an `actor` block — a different
+ *  lane). `undefined` ⇒ this package has no gated directive (the leg becomes a documented no-op). */
+export function discoverAuthorityConformanceLeg(mod: DomainModule): AuthorityConformanceLeg | undefined {
+  const domain = mod.domain ?? mod.name;
+  const gated = (mod.directives as Directive<unknown>[]).find(
+    (d) =>
+      d?.requiresRelationGate !== undefined &&
+      typeof d.payloadSchema === "object" &&
+      d.birthsChild !== true &&
+      d.attestationAuthorizedGate === undefined,
+  );
+  if (gated === undefined) return undefined;
+  let synth: SynthesizedPayload;
+  try {
+    synth = synthesizePayload(gated.payloadSchema as z.ZodTypeAny, `${domain}/${gated.id}`);
+  } catch {
+    return undefined; // an exotic payload the synthesizer can't sample → no conformance leg (still gated at the kernel)
+  }
+  const agg = (mod.aggregates as AggregateHandle[]).find((a) => a.id === gated.aggregateId);
+  const mintField = agg !== undefined ? mintedCreateField(gated, agg) : undefined;
+  const payload: Record<string, unknown> = { ...synth.value };
+  if (mintField !== undefined) delete payload[mintField];
+  return {
+    domain,
+    directiveId: gated.id,
+    relation: gated.requiresRelationGate!.relation,
+    payload,
+    autoStamped: synth.autoStamped,
+    ...(mintField !== undefined ? { mintField } : {}),
+  };
+}
+
+/**
+ * THE AUTHORITY-CONFORMANCE LEG (the one-encoder + gate proof). On the real LOCAL holon, with fetch trapped:
+ *   (a) bind the generated client WITH an actor + drive the gated directive. SPY on `holon.offerDirective` to
+ *       capture the (domain, directiveId, payload, opts) the client passes, RE-ENCODE that through the v2
+ *       envelope shape (the SAME `{ v:2, intent, security:{actor} }` the one encoder emits) and DECODE it back
+ *       to assert `security.actor` IS the bound actor — the produced offer envelope carries the principal.
+ *   (b) bind a SECOND client WITHOUT an actor + call the gated directive — assert it THROWS
+ *       MissingOfferAuthority LOCALLY (before any offerDirective/submit fires; the spy stays untouched).
+ * Emits nothing when the package has no gated directive (a documented no-op note).
+ */
+function authorityConformanceLegLines(
+  leg: AuthorityConformanceLeg | undefined,
+  factory: string,
+  n: () => number,
+): string[] {
+  if (leg === undefined) {
+    return [
+      `// ${n()}. authority-conformance leg: this law has no gated (\`.requires(...)\`) directive, so there is`,
+      `//    nothing to prove about actorless-gated-offer refusal (an un-gated domain authors openly).`,
+      `console.log("– authority-conformance leg SKIPPED — no .requires(...) directive (add one to prove the one-encoder threads security.actor + an actorless gated offer can't be generated)");`,
+      ``,
+    ];
+  }
+  const payloadEntries = leg.mintField !== undefined
+    ? `{ ...${JSON.stringify(leg.payload)}, ${JSON.stringify(leg.mintField)}: await holon.mint("conformance") }`
+    : JSON.stringify(leg.payload);
+  return [
+    `// ${n()}. AUTHORITY CONFORMANCE (THE ONE ENCODER + the gate): \`${leg.domain}/${leg.directiveId}\` is GATED`,
+    `//    (\`.requires("${leg.relation}")\`). (a) WITH an actor the produced offer envelope must carry`,
+    `//    security.actor; (b) WITHOUT one the generated client THROWS MissingOfferAuthority before any submit.`,
+    `{`,
+    `  const realFetch2 = globalThis.fetch;`,
+    `  globalThis.fetch = (() => { throw new Error("OFFLINE PROOF VIOLATED: authority-conformance touched the network"); }) as typeof fetch;`,
+    `  try {`,
+    `    // (a) SPY on offerDirective: capture what the generated client passes, re-encode the v2 envelope it`,
+    `    //     would produce (the one-encoder shape), decode it back, and assert security.actor IS the actor.`,
+    `    const ACTOR = "user:proof-conformance";`,
+    `    let captured: { domain: string; directiveId: string; payload: unknown; opts?: { domainHash?: string; actor?: string } } | undefined;`,
+    `    const realOffer: typeof holon.offerDirective = holon.offerDirective.bind(holon);`,
+    `    holon.offerDirective = (domain, directiveId, payload, opts) => {`,
+    `      captured = { domain, directiveId, payload, opts };`,
+    `      return realOffer(domain, directiveId, payload, opts);`,
+    `    };`,
+    `    try {`,
+    `      await ${factory}(holon, { actor: ACTOR }).${leg.directiveId}(${payloadEntries});`,
+    `    } finally {`,
+    `      holon.offerDirective = realOffer;`,
+    `    }`,
+    `    if (!captured) fail("authority-conformance: the gated directive did not reach holon.offerDirective");`,
+    `    const actorOnOffer = captured!.opts?.actor;`,
+    `    if (actorOnOffer !== ACTOR) fail(\`authority-conformance: the offer did not carry the actor (got \${JSON.stringify(actorOnOffer)})\`);`,
+    `    // Decode the bytes THE ONE ENCODER actually emits from these args (NOT a hand-rolled copy) — so this`,
+    `    // leg catches encoder DRIFT (a dropped/renamed/whitespace-normalized security.actor), not merely that`,
+    `    // the actor reached offerDirective. The v2 wire format lives in exactly one place: encodeIntentOfferBytes.`,
+    `    const decoded = JSON.parse(new TextDecoder().decode(encodeIntentOfferBytes({ domain: captured!.domain, directiveId: captured!.directiveId, payload: captured!.payload, domainHash: captured!.opts?.domainHash, actor: actorOnOffer })));`,
+    `    if (decoded?.security?.actor !== ACTOR) fail(\`authority-conformance: THE ONE ENCODER dropped security.actor (\${JSON.stringify(decoded?.security)})\`);`,
+    `    ok(\`authority conformance (a) — \${${JSON.stringify(`${leg.domain}/${leg.directiveId}`)}} authored WITH an actor carries security.actor through THE ONE ENCODER\`);`,
+    ``,
+    `    // (b) the SAME directive with NO actor: the generated client refuses to BUILD the offer — it throws`,
+    `    //     MissingOfferAuthority locally, BEFORE any submit (an actorless gated offer is impossible to make).`,
+    `    let threw: Error | undefined;`,
+    `    try {`,
+    `      await ${factory}(holon).${leg.directiveId}(${payloadEntries});`,
+    `    } catch (e) { threw = e as Error; }`,
+    `    if (threw === undefined) fail("authority-conformance: the gated directive with NO actor did NOT throw — an actorless gated offer must be impossible to generate");`,
+    `    if (threw.name !== "MissingOfferAuthority") fail(\`authority-conformance: expected MissingOfferAuthority, got \${threw.name}: \${threw.message}\`);`,
+    `    ok(\`authority conformance (b) — \${${JSON.stringify(`${leg.domain}/${leg.directiveId}`)}} with NO actor throws MissingOfferAuthority before any submit (gated offer impossible to generate)\`);`,
+    `  } finally {`,
+    `    globalThis.fetch = realFetch2;`,
+    `  }`,
+    `}`,
+    ``,
+  ];
+}
+
 // ── child-birth discovery (the G3 `.births()` lane — prove a parent birth end-to-end into the child) ──────
 
 /** ONE step of a discovered birth recipe's genesis chain (the subset codegen reads). */
@@ -733,7 +863,7 @@ function generateBirthOnlyProof(
     `// Regenerated on every compile; do not edit.`,
     `// @nomos-proof-legs ${legsMarker}`,
     `import { readFileSync } from "node:fs";`,
-    `import { connect } from "@githolon/client";`,
+    `import { connect, encodeIntentOfferBytes } from "@githolon/client";`,
     `import { ${factory}, ${hashConst} } from "./${opts.packageName}.client.ts";`,
     `void connect; void ${factory};`,
     ``,
@@ -823,6 +953,11 @@ export function generateTsProof(modules: readonly DomainModule[], opts: TsProofO
 
   const concurrency = findConcurrencyLeg(mod.directives as Directive<unknown>[], agg);
 
+  // THE AUTHORITY-CONFORMANCE LEG (the one-encoder + gate proof): the first gated (`.requires(...)`) directive
+  // in the primary domain, proven locally — actor threads through the one encoder; an actorless gated offer
+  // throws MissingOfferAuthority. `undefined` ⇒ a documented no-op (the domain authors openly).
+  const conformance = discoverAuthorityConformanceLeg(mod);
+
   // Workspace-name slug: any package name → a safe, recognizable ws prefix.
   const slug =
     opts.packageName
@@ -865,7 +1000,7 @@ export function generateTsProof(modules: readonly DomainModule[], opts: TsProofO
     `// every call — start at docs/01-mental-model.md). Regenerated on every compile; do not edit.`,
     `// @nomos-proof-legs ${legsMarker}`,
     `import { readFileSync } from "node:fs";`,
-    `import { connect } from "@githolon/client";`,
+    `import { connect, encodeIntentOfferBytes } from "@githolon/client";`,
     `import { ${factory}, ${hashConst} } from "./${opts.packageName}.client.ts";`,
     ``,
     `const CLOUD = (process.env.NOMOS_CLOUD || "https://nomos.captainapp.co.uk").replace(/\\/+$/, "");`,
@@ -1009,6 +1144,11 @@ export function generateTsProof(modules: readonly DomainModule[], opts: TsProofO
     );
   }
 
+  // THE AUTHORITY-CONFORMANCE LEG (the one-encoder + gate proof): runs on the LOCAL holon (fetch re-trapped),
+  // proving the generated client threads security.actor through THE ONE ENCODER and that an actorless gated
+  // offer is impossible to GENERATE (throws MissingOfferAuthority before any submit). No-op when un-gated.
+  out.push(...authorityConformanceLegLines(conformance, factory, n));
+
   // THE CHILD-BIRTH LEG (G3, gap 2): when the primary domain has a `.births()` directive, prove the birth
   // END-TO-END against the cloud — drive the parent birth offer, then read the BORN child workspace it spawns.
   if (childBirth !== undefined) {

package/src/codegen_ts.ts

@@ -344,6 +344,11 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
     ``,
     `/** The holon surface this client binds to (structurally satisfied by @githolon/client). */`,
     `export interface NomosHolon {`,
+    `  /** THE ONE ENCODER offer (the single v2-envelope codec lives in @githolon/client \`encodeIntentOfferBytes\`):`,
+    `   *  hand the holon a PLANNED directive + the verified \`actor\`; the holon encodes + offers. The generated`,
+    `   *  client calls THIS, never building offer bytes itself — so there is exactly ONE copy of the wire format. */`,
+    `  offerDirective(domain: string, directiveId: string, payload: unknown, opts?: { domainHash?: string; actor?: string }): Promise<string>;`,
+    `  /** Opaque-bytes offer — retained for carriers that already hold an encoded envelope (back-compat). */`,
     `  offer(intentBytes: string | Uint8Array): Promise<string>;`,
     `  query(queryId: string, params?: Record<string, unknown>): Promise<unknown>;`,
     `  queryById(aggregateId: string): Promise<unknown>;`,
@@ -364,8 +369,16 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
     `  discardDeadLetter(id: string): Promise<{ ok: boolean; removed: number }>;`,
     `}`,
     ``,
-    `const encodeIntentOffer = (domain: string, directiveId: string, payload: unknown, domainHash: string, actor?: string): Uint8Array =>`,
-    `  new TextEncoder().encode(JSON.stringify({ v: 2, intent: { domain, directiveId, payload, domainHash }, ...(actor ? { security: { actor } } : {}) }));`,
+    `/** AUTHORITY IS UNFORGEABLE-BY-CONSTRUCTION: a GATED directive (one carrying a \`.requires(relation)\` write`,
+    ` *  gate) authored with NO \`actor\` cannot produce an offer — it throws THIS before any submit, so an`,
+    ` *  actorless gated offer is impossible to GENERATE, never merely refused at the kernel gate. Bind the`,
+    ` *  client with \`{ actor }\` (the verified principal) to author a gated directive. */`,
+    `export class MissingOfferAuthority extends Error {`,
+    `  constructor(readonly domain: string, readonly directiveId: string, readonly requires: string) {`,
+    `    super(\`\${domain}/\${directiveId} requires the "\${requires}" relation — bind the client with { actor } (the verified principal) to author it; a gated offer cannot be made without an authority\`);`,
+    `    this.name = "MissingOfferAuthority";`,
+    `  }`,
+    `}`,
     ``,
   );
 
@@ -632,6 +645,13 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       const stamps = autoStampFields(schema);
       const mint = mintPlan?.get(d.id);
       const placed = placementDirs.has(d.id) ? ["shard"] : [];
+      // THE AUTHORITY GATE (codegen-time): a directive carrying `.requires(relation)` is GATED — its
+      // generated method refuses to encode an offer without an `actor` (throws MissingOfferAuthority
+      // BEFORE any submit), so an actorless gated offer is impossible to GENERATE, not merely refused.
+      const gate = (d as { requiresRelationGate?: { relation: string } }).requiresRelationGate;
+      const gateGuard = gate !== undefined
+        ? `      if (!actor || !actor.trim()) throw new MissingOfferAuthority(${JSON.stringify(domain)}, ${JSON.stringify(d.id)}, ${JSON.stringify(gate.relation)});\n`
+        : "";
       out.push(
         `/** \`${domain}/${d.id}\` payload (mirrors the engine's zod schema).${stamps.length ? ` Omitted ${stamps.map((s) => `\`${s}\``).join("/")} auto-stamp(s) ISO now() at offer.` : ""}${mint ? ` Omitted \`${mint.field}\` is KERNEL-MINTED at offer (returned on the result).` : ""}${placed.length ? " Omitted `shard` is picked LEAST-LOADED at offer (the routed holon)." : ""} */`,
         `export type ${payloadName} = ${tsTypeOfPayload(schema, stamps, mint ? [mint.field] : [], placed)};`,
@@ -649,21 +669,35 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
           : `{ ...payload, ${mint.field} }`;
         methods.push(
           `    /** Author \`${domain}/${d.id}\`: the front-door MINTS \`${mint.field}\` (route-tagged) when omitted`,
-          `     *  — ids stay internal plumbing — and returns it with the new local head. */`,
+          `     *  — ids stay internal plumbing — and returns it with the new local head.${gate ? ` GATED: needs \`{ actor }\` (\`${gate.relation}\`).` : ""} */`,
           `    ${d.id}: async (payload: ${payloadName}): Promise<{ head: string; ${mint.field}: string }> => {`,
+          ...(gateGuard ? [gateGuard.replace(/\n$/, "")] : []),
           `      const ${mint.field} = payload.${mint.field} ?? (await (holon as NomosRoutedHolon).mint(${JSON.stringify(mint.mintType)}${mintOpts}));`,
-          `      const head = await holon.offer(encodeIntentOffer(${JSON.stringify(domain)}, ${JSON.stringify(d.id)}, ${body}, domainHash, actor));`,
+          `      const head = await holon.offerDirective(${JSON.stringify(domain)}, ${JSON.stringify(d.id)}, ${body}, { domainHash, actor });`,
           `      return { head, ${mint.field} };`,
           `    },`,
         );
         continue;
       }
-      methods.push(
-        `    /** Author \`${domain}/${d.id}\` locally under the installed law; returns the new local head. */`,
-        stamps.length
-          ? `    ${d.id}: (payload: ${payloadName}) => holon.offer(encodeIntentOffer(${JSON.stringify(domain)}, ${JSON.stringify(d.id)}, stampNow(payload, ${JSON.stringify(stamps)}), domainHash, actor)),`
-          : `    ${d.id}: (payload: ${payloadName}) => holon.offer(encodeIntentOffer(${JSON.stringify(domain)}, ${JSON.stringify(d.id)}, payload, domainHash, actor)),`,
-      );
+      const offerPayload = stamps.length ? `stampNow(payload, ${JSON.stringify(stamps)})` : `payload`;
+      const offerCall = `holon.offerDirective(${JSON.stringify(domain)}, ${JSON.stringify(d.id)}, ${offerPayload}, { domainHash, actor })`;
+      if (gateGuard) {
+        // GATED directive: a block body that throws MissingOfferAuthority when no actor is bound — an
+        // actorless gated offer can't be constructed (the war: the gate is structural, not just kernel-side).
+        methods.push(
+          `    /** Author \`${domain}/${d.id}\` locally under the installed law; returns the new local head.`,
+          `     *  GATED: needs \`{ actor }\` (the \`${gate!.relation}\` relation) — throws MissingOfferAuthority otherwise. */`,
+          `    ${d.id}: (payload: ${payloadName}): Promise<string> => {`,
+          gateGuard.replace(/\n$/, ""),
+          `      return ${offerCall};`,
+          `    },`,
+        );
+      } else {
+        methods.push(
+          `    /** Author \`${domain}/${d.id}\` locally under the installed law; returns the new local head. */`,
+          `    ${d.id}: (payload: ${payloadName}) => ${offerCall},`,
+        );
+      }
     }
 
     for (const q of (mod.queries ?? []) as QueryDecl[]) {