@githolon/dsl 0.29.0 → 0.29.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.29.0",
+  "version": "0.29.1",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/codegen_proof.ts

@@ -696,13 +696,17 @@ export function resolveGrantableBaseRelations(
 export function discoverRelationBootstrapLeg(mod: DomainModule): RelationBootstrapLeg | undefined {
   const domain = mod.domain ?? mod.name;
   const directives = mod.directives as Directive<unknown>[];
-  const gated = directives.find(
-    (d) =>
-      d?.requiresRelationGate !== undefined &&
-      typeof d.payloadSchema === "object" &&
-      d.birthsChild !== true &&
-      d.attestationAuthorizedGate === undefined,
-  );
+  const isGatedProvable = (d: Directive<unknown> | undefined): boolean =>
+    d?.requiresRelationGate !== undefined &&
+    typeof d.payloadSchema === "object" &&
+    d.birthsChild !== true &&
+    d.attestationAuthorizedGate === undefined;
+  // PREFER a gated `.creates` as the bootstrap target: a gated create is exactly the shape excluded from the
+  // naive standalone-create leg (isStandaloneCreate), so the bootstrap leg is its ONLY positive proof — seed
+  // authority, then prove the CREATE is admitted. When no gated create exists, fall back to any gated write
+  // (a gated `.mutates`/`.ensures`), so an un-created gated law is still proven.
+  const gated = directives.find((d) => isGatedProvable(d) && d.marker === "creates")
+    ?? directives.find((d) => isGatedProvable(d));
   if (gated === undefined) return undefined;
   const relation = gated.requiresRelationGate!.relation;
 
@@ -1185,13 +1189,17 @@ export interface ProofLegs {
  *  The SINGLE source of the create-leg selection — `generateTsProof` (the .mts marker) and
  *  `proofLegsIndex` (the per-domain index) both call this, so the offline lane proves any domain the
  *  same way the generated proof proves its primary one. */
-/** A `.creates` directive the proof can DRIVE from a synthesized sample offline: not a `.births()` (a birth
- *  is the child-birth lane), not ATTESTATION-AUTHORIZED (needs a signed §3 quote no synthesizer can produce —
- *  e.g. the home law's `recordShare`). Those are NOT standalone-provable offline; the domain proves via its
- *  child-birth leg / compile-valid instead. */
+/** A `.creates` directive the proof can DRIVE from a synthesized sample offline WITH NO SEEDED AUTHORITY: not
+ *  a `.births()` (a birth is the child-birth lane), not ATTESTATION-AUTHORIZED (needs a signed §3 quote no
+ *  synthesizer can produce — e.g. the home law's `recordShare`), and NOT AUTHZ-GATED (`.requires(R)` — a
+ *  gated create dispatched with no seeded authority is REFUSED at the gate; its metadata already says it
+ *  needs authority, so the naive standalone leg must not touch it — it is proven POSITIVELY by the
+ *  relation-bootstrap leg / the born-child genesis instead). Those are NOT standalone-provable offline; the
+ *  domain proves via its bootstrap / child-birth / compile-valid legs instead. */
 function isStandaloneCreate(d: Directive<unknown> | undefined): boolean {
   return d?.marker === "creates" && typeof d.payloadSchema === "object"
-    && d.birthsChild !== true && d.attestationAuthorizedGate === undefined;
+    && d.birthsChild !== true && d.attestationAuthorizedGate === undefined
+    && d.requiresRelationGate === undefined;
 }
 
 export function proofLegsForModule(mod: DomainModule): ProofLegs | null {
@@ -1545,19 +1553,94 @@ function generateBirthOnlyProof(
   return out.join("\n");
 }
 
+/**
+ * THE BOOTSTRAP-ONLY PROOF (gated-create isolation): a package whose ONLY creating write is AUTHZ-GATED
+ * (`.creates(...).requires(R)` — co2's estate `createSite`). It has no ungated standalone create to dispatch
+ * naively (that would be REFUSED at the gate with no seeded authority) and no `.births()` genesis. So the
+ * proof deploys the law, connects, and drives the RELATION-BOOTSTRAP leg as its primary write: seed authority
+ * (layers 1-3), THEN prove the gated create is ADMITTED — the ordering (seed BEFORE the gated dispatch) is
+ * correct by construction. If authority genuinely can't be seeded, the leg emits the loud diagnostic (never a
+ * false green). The offline runner proves the same leg locally (`githolon proof`); this `.mts` is `--live`.
+ */
+function generateBootstrapOnlyProof(
+  mod: DomainModule,
+  opts: TsProofOptions,
+  primaryLegs: ProofLegs,
+): string {
+  const domain = mod.domain ?? mod.name;
+  const factory = tsClientFactoryName(domain);
+  const hashConst = tsHashConstName(opts.packageName);
+  const rb = primaryLegs.relationBootstrap;
+  if (rb === undefined) {
+    // Only reached defensively — the caller gates on relationBootstrap !== undefined.
+    throw new Error(`domain '${domain}' has a gated create but no relation-bootstrap leg to prove it (no seedable authority)`);
+  }
+  const slug =
+    opts.packageName.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 24) || "domain";
+  const legsMarker = JSON.stringify(primaryLegs);
+  let step = 0;
+  const n = () => ++step;
+  const out: string[] = [];
+  out.push(
+    `// AUTO-GENERATED by nomos-compile — the RUNNABLE PROOF for package "${opts.packageName}",`,
+    `// synthesized from the domain's OWN law. This package's ONLY creating write is AUTHZ-GATED`,
+    `// (\`${domain}/${rb.gatedDirectiveId}\` .requires("${rb.relation}")), so the proof SEEDS authority first,`,
+    `// then proves the gated create is admitted — never a naive dispatch the gate would refuse. Reshape the`,
+    `// law, recompile, and this proof reshapes itself — no test rewriting. Run it:`,
+    `//`,
+    `//   npx githolon proof        (offline legs on a local holon)`,
+    `//   npx githolon proof --live (or: npx tsx build/${opts.packageName}.proof.mts — the full cloud loop)`,
+    `//`,
+    `// Regenerated on every compile; do not edit.`,
+    `// @nomos-proof-legs ${legsMarker}`,
+    `import { readFileSync } from "node:fs";`,
+    `import { connect, encodeIntentOfferBytes } from "@githolon/client";`,
+    `import { ${factory}, ${hashConst} } from "./${opts.packageName}.client.ts";`,
+    `void connect; void encodeIntentOfferBytes; void ${factory};`,
+    ``,
+    `const CLOUD = (process.env.NOMOS_CLOUD || "https://nomos.captainapp.co.uk").replace(/\\/+$/, "");`,
+    `const WS = process.env.NOMOS_WS || ${JSON.stringify(slug + "-proof-")} + Math.random().toString(36).slice(2, 8);`,
+    ``,
+    ...v2IdentityAndCleanupPreamble(opts, hashConst, n),
+    ``,
+    `// ${n()}. connect + bind the GENERATED typed client (the relation-bootstrap leg drives it with an actor)`,
+    `const holon = await connect({ cloud: CLOUD, workspace: WS, clientId: "proof-1" });`,
+    `ok(\`web client connected — ${factory} bound (replica \${holon.replica.slice(0, 6)}…)\`);`,
+    ``,
+    // The SAME relation-bootstrap emitter the standalone proof uses — seed authority, then prove the GATED
+    // CREATE is admitted (layers 1-3; a speculative seed-path degrades to a diagnostic, never a false green).
+    ...relationSeedLegLines(rb, factory, n),
+    `console.log(\`\\nALL GREEN — generated proof for "${opts.packageName}": deploy → seed authority → gated create ${rb.gatedDirectiveId} admitted (\${WS})\`);`,
+    ``,
+    ...v2CatchFinally(),
+    ``,
+  );
+  return out.join("\n");
+}
+
 export function generateTsProof(modules: readonly DomainModule[], opts: TsProofOptions): string {
-  // PRIMARY-DOMAIN SELECTION: the live `.mts` drives a STANDALONE create when the package has one (the full
-  // deploy → write → query → sync → cloud loop). A BIRTH-ONLY package (every `.creates` is also a `.births()`
-  // — the home/estate composable shape) has no standalone create to drive, so the primary becomes the first
-  // `.births()` domain and the live `.mts` drives the birth as its primary write. Either way, the marker =
-  // the primary domain's FULL legs (so the offline runner + the index never describe different directives).
+  // PRIMARY-DOMAIN SELECTION: the live `.mts` drives a STANDALONE (ungated) create when the package has one
+  // (the full deploy → write → query → sync → cloud loop). Else a BIRTH package (`.births()`) drives the
+  // birth. Else a GATED-CREATE package — whose only creating write `.requires(R)` (co2's estate `createSite`)
+  // — drives the RELATION-BOOTSTRAP leg as its primary write: seed authority, THEN the gated create is
+  // admitted (never a naive first dispatch that the gate would refuse). Either way, the marker = the primary
+  // domain's FULL legs (so the offline runner + the index never describe different directives).
   const hasStandaloneCreate = (m: DomainModule): boolean =>
     (m.directives as Directive<unknown>[]).some((d) => isStandaloneCreate(d));
   const hasBirth = (m: DomainModule): boolean => birthDirectiveOf(m) !== undefined;
-  const mod = modules.find(hasStandaloneCreate) ?? modules.find(hasBirth);
+  const isBootstrapProvable = (m: DomainModule): boolean => {
+    try { return discoverRelationBootstrapLeg(m) !== undefined; } catch { return false; }
+  };
+  const mod = modules.find(hasStandaloneCreate) ?? modules.find(hasBirth) ?? modules.find(isBootstrapProvable);
   if (mod === undefined) {
+    // No provable creating write anywhere. If a GATED create exists but its authority can't be seeded, surface
+    // the loud bootstrap diagnostic (never a false green); else the generic "add a .creates" remedy.
+    const gapMod = modules.find((m) => diagnoseRelationBootstrapGap(m) !== undefined);
+    const gap = gapMod !== undefined ? diagnoseRelationBootstrapGap(gapMod) : undefined;
     throw new Error(
-      `no .creates directive in any domain — a generated proof needs one creating write (or a .births() birth directive); add a directive(...).creates(...) (test/e2e.mts remains the hand-authored lane)`,
+      gap !== undefined
+        ? `no proof could be synthesized: ${gap}`
+        : `no .creates directive in any domain — a generated proof needs one creating write (or a .births() birth directive); add a directive(...).creates(...) (test/e2e.mts remains the hand-authored lane)`,
     );
   }
   const domain = mod.domain ?? mod.name;
@@ -1565,18 +1648,24 @@ export function generateTsProof(modules: readonly DomainModule[], opts: TsProofO
   const hashConst = tsHashConstName(opts.packageName);
   // THE MARKER (since 0.5.0) + the per-domain index are ONE synthesis (`legsForDomain`) — the proof body, its
   // marker, and the index can never describe different directives. The primary domain's legs carry whichever
-  // of standalone / child-birth it has.
+  // of standalone / child-birth / relation-bootstrap it has.
   const primaryLegs = legsForDomain(mod, modules);
   const childBirth = primaryLegs.childBirth;
 
-  // The standalone-create lane (when the primary has one). A birth-only primary skips this — its primary
-  // write is the child-birth leg below.
-  const createDir = (mod.directives as Directive<unknown>[]).find(
-    (d) => d?.marker === "creates" && typeof d.payloadSchema === "object" && d.birthsChild !== true,
-  );
+  // The standalone-create lane needs an UNGATED create (isStandaloneCreate — never a gated/birth/attestation
+  // create, which the gate would refuse dispatched with no seeded authority). Absent one, the primary write
+  // is the birth leg (a `.births()` domain) or the relation-bootstrap leg (a gated-create domain).
+  const createDir = (mod.directives as Directive<unknown>[]).find((d) => isStandaloneCreate(d));
   if (createDir === undefined) {
-    // BIRTH-ONLY PRIMARY: emit a birth-shaped proof (no standalone create/query/count/concurrency legs).
-    return generateBirthOnlyProof(mod, modules, opts, primaryLegs);
+    // BIRTH-ONLY PRIMARY: emit a birth-shaped proof (the birth replays genesis, seating authority, then the
+    // born child self-validates — a gated child-domain create is proven INSIDE the born child context).
+    if (primaryLegs.childBirth !== undefined) return generateBirthOnlyProof(mod, modules, opts, primaryLegs);
+    // BOOTSTRAP-ONLY PRIMARY: the only creating write is GATED — deploy, then seed authority + prove the
+    // gated create is admitted (the relation-bootstrap leg is its ONLY positive proof).
+    if (primaryLegs.relationBootstrap !== undefined) return generateBootstrapOnlyProof(mod, opts, primaryLegs);
+    // A gated create with no seedable authority: loud diagnostic (compile skips the proof, law still ships).
+    const gap = diagnoseRelationBootstrapGap(mod);
+    throw new Error(gap !== undefined ? `no proof could be synthesized for '${domain}': ${gap}` : `domain '${domain}' has no provable creating write`);
   }
   const agg = (mod.aggregates as AggregateHandle[]).find((a) => a.id === createDir.aggregateId);
   if (agg === undefined) {