@githolon/dsl 0.30.0 → 0.30.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.30.0",
+  "version": "0.30.1",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/codegen_proof.ts

@@ -383,6 +383,27 @@ function relationSeedLegLines(
     ? ` — a COMPUTED gate: granting "${leg.grantedRelation}" makes the actor satisfy "${leg.relation}" via the rewrite`
     : ``;
 
+  if (leg.bornContext !== undefined) {
+    // LAYER 4 — THE BORN-DOMAIN GENESIS-AUTHORITY PATH (co2 home). R is established ONLY by the birth genesis
+    // (e.g. birthHome → seedHomeCreator seats creator), and the seed carries an owner-binding PREREQUISITE a
+    // standalone re-seed can't satisfy. This leg is proven by `githolon proof` (offline, on the local wasm):
+    // the runner BIRTHS the workspace as the proof actor (= owner), then dispatches the gated directive INSIDE
+    // the born workspace as that owner, asserting ADMITTED at the real kernel gate (a refusal degrades to a
+    // diagnostic — never a false green). The LIVE `--live` lane proves the underlying birth via the child-birth
+    // leg; the gated-directive-in-born-context proof is the offline runner's (birthing a throwaway home per
+    // gated directive live would leave orphan workspaces).
+    const bc = leg.bornContext;
+    return [
+      `// ${n()}. RELATION BOOTSTRAP — LAYER 4 (born-domain genesis authority): \`${leg.domain}/${leg.gatedDirectiveId}\``,
+      `//    is GATED (\`.requires("${leg.relation}")\`), established ONLY by the birth genesis (\`${bc.birthDirectiveId}\` →`,
+      `//    \`${bc.seatsViaDirectiveId}\` seats "${leg.relation}") — NOT a standalone-replayable seed (its owner-binding`,
+      `//    prerequisite would false-fail). Proven by \`githolon proof\` (offline): birth the workspace as the owner,`,
+      `//    then dispatch \`${leg.gatedDirectiveId}\` INSIDE the born workspace as that owner (real-gate admitted).`,
+      `console.log("– relation-bootstrap leg (born-context) — \`${leg.domain}/${leg.gatedDirectiveId}\` .requires(\\"${leg.relation}\\") is proven in the BORN workspace by \`githolon proof\` (offline); the birth is proven live by the child-birth leg");`,
+      ``,
+    ];
+  }
+
   if (speculative) {
     // LAYER 3 (seed-path replay). The gate relation is reachable only through ttu/intersection/exclusion — no
     // directly-grantable base. We REPLAY the domain's declared seed and let the REAL GATE arbitrate: if the
@@ -493,8 +514,10 @@ export interface RelationBootstrapLeg {
    *  `writeTuple(R)`), `"computed-base"` (R is computed; the grant seats a rewrite BASE relation the granter
    *  was found for), or `"seed-path"` (LAYER 3: R is reachable only through ttu/intersection/exclusion — no
    *  directly-grantable base — so a DECLARED SEED directive that establishes root authority is replayed and
-   *  the REAL KERNEL GATE is the arbiter of whether it authorizes the write). Audit + runner semantics. */
-  readonly via: "marker" | "inferred" | "computed-base" | "seed-path";
+   *  the REAL KERNEL GATE is the arbiter of whether it authorizes the write), or `"born-context"` (LAYER 4:
+   *  R is established by the domain's BIRTH GENESIS — the gated directive is proven INSIDE the born workspace
+   *  as the owner; see {@link BornContextAuthority}). Audit + runner semantics. */
+  readonly via: "marker" | "inferred" | "computed-base" | "seed-path" | "born-context";
   /** LAYER-3 ANTI-FALSE-GREEN FLAG. `true` ⇒ this is a SPECULATIVE seed-path leg: codegen could NOT prove
    *  (via rewrite resolution) that replaying `grantDirectiveId` authorizes the gated write — it discovered a
    *  seed that writes relation tuples and is DEFERRING to the real kernel gate. The runner replays the seed,
@@ -504,6 +527,37 @@ export interface RelationBootstrapLeg {
   readonly seedSpeculative?: boolean;
   /** The relations the discovered seed directive writes (layer-3 audit/diagnostic — what authority it seats). */
   readonly seedWritesRelations?: readonly string[];
+  /** LAYER 4 — THE BORN-DOMAIN GENESIS-AUTHORITY PATH. Present iff the gate relation is established by the
+   *  domain's BIRTH GENESIS (not a standalone-replayable seed): a `.births()` directive whose genesis chain
+   *  seats R (e.g. co2's `birthHome` → `seedHomeCreator` seats `creator`), and whose born workspace runs the
+   *  SAME law — so the gated directive can be proven INSIDE the born context, dispatched as the genesis-
+   *  established OWNER, where the seed's own prerequisite invariants (HomeCreatorSeedBindsOwner) hold. This
+   *  TAKES PRECEDENCE over a standalone seed (`grantDirectiveId`) for a born domain: a standalone re-seed
+   *  would trip the seed's owner-binding prerequisite (HomeOwner unset) and FALSE-fail. When present, the
+   *  runner IGNORES the standalone grant fields and proves via {@link BornContextAuthority}. */
+  readonly bornContext?: BornContextAuthority;
+}
+
+/** THE BORN-DOMAIN GENESIS AUTHORITY (layer 4): the self-birth directive whose genesis seats the gate relation
+ *  for the OWNER, plus what the runner needs to birth it (as the proof actor = the home owner) and then prove
+ *  the gated directive INSIDE the born workspace. The real kernel gate is the arbiter — a refusal degrades to
+ *  a diagnostic (never a false green). */
+export interface BornContextAuthority {
+  /** The self-birth directive (`birthHome`) whose genesis chain seats the gate relation. */
+  readonly birthDirectiveId: string;
+  /** The synthesized birth payload (auto-stamped `…At` omitted; framework/law-hash placeholders removed — the
+   *  runtime injects the REAL hashes + the proof actor as owner). */
+  readonly birthPayload: Record<string, unknown>;
+  readonly birthAutoStamped: readonly string[];
+  /** The birth payload field carrying the home OWNER — the runtime sets it to the proof actor, so the born
+   *  home is owned by (and seats the relation for) the actor the gated dispatch then runs as. */
+  readonly ownerField?: string;
+  /** The birth payload field carrying the framework-controller hash (runtime injects the real one). */
+  readonly frameworkHashField?: string;
+  /** The birth payload field carrying the child law hash (runtime injects the deployed package hash). */
+  readonly lawHashField?: string;
+  /** The genesis step directive that actually seats the relation (audit — e.g. `seedHomeCreator`). */
+  readonly seatsViaDirectiveId: string;
 }
 
 /** Run a directive's plan with a synthesized+probe payload under birth-probe globals and return the drained
@@ -687,6 +741,127 @@ export function resolveGrantableBaseRelations(
   return out;
 }
 
+// ── LAYER 4: born-domain genesis-authority discovery (the co2 home case) ─────────────────────────────────
+//
+// A gate relation R may be established ONLY by the domain's BIRTH GENESIS — a `.births()` directive whose
+// genesis chain seats R for the owner (co2's `birthHome` genesis runs `seedHomeCreator`, seating `creator`).
+// The seed itself carries a PREREQUISITE (an owner-binding workspaceInvariant reading state set by an EARLIER
+// genesis step), so a standalone re-seed FALSE-fails (the prior state is absent). The law-true authority path
+// is to BIRTH the workspace (replaying the whole genesis, seating R for the owner) and prove the gated
+// directive INSIDE the born workspace, dispatched as that owner. Discovery probes each `.births()` directive's
+// genesis chain for a step that writeTuples R; if found, the born workspace (running the SAME law) is where
+// the gated directive proves.
+
+/** Probe a `.births()` directive's genesis chain (birth-probe globals) → the recorded steps + the synthesized
+ *  parent payload. `undefined` ⇒ not probeable / no recipe. Mirrors {@link discoverChildBirthLeg}'s probe. */
+function probeBirthGenesis(
+  birthDir: Directive<unknown>,
+  where: string,
+): { chain: Array<{ domain?: string; directiveId?: string; actor?: unknown }>; synth: SynthesizedPayload } | undefined {
+  let synth: SynthesizedPayload;
+  try {
+    synth = synthesizePayload(birthDir.payloadSchema as z.ZodTypeAny, where);
+  } catch {
+    return undefined;
+  }
+  const probePayload: Record<string, unknown> = { ...synth.value };
+  for (const f of synth.autoStamped) probePayload[f] = "2026-01-01T00:00:00Z";
+  let recipe: { genesisChain?: unknown } | undefined;
+  try {
+    withBirthProbeGlobals(() => {
+      __resetAuthoring();
+      __resetReads();
+      __resetBirths();
+      try {
+        birthDir.plan(probePayload as never, deterministicPorts({ physical: 1, replica: 1, principal: "principal:probe" }));
+      } finally {
+        try { __drainAuthoring(); __drainReads(); } catch { /* drained */ }
+      }
+      recipe = __drainBirths()[0] as typeof recipe;
+    });
+  } catch {
+    return undefined;
+  }
+  if (recipe === undefined || !Array.isArray(recipe.genesisChain)) return undefined;
+  return { chain: recipe.genesisChain as Array<{ domain?: string; directiveId?: string; actor?: unknown }>, synth };
+}
+
+/**
+ * Discover the BORN-DOMAIN genesis authority for a gate `relation`: a `.births()` directive in `mod` whose
+ * genesis chain seats `relation` (a genesis step whose directive `writeTuple`s R) AND whose born workspace
+ * runs the SAME law (so the gated directive is addressable there). Returns what the runner needs to birth the
+ * workspace as the proof actor (= the owner) + the owner/hash payload fields. `undefined` ⇒ no birth seats R.
+ */
+export function discoverBornContextAuthority(
+  mod: DomainModule,
+  relation: string,
+): BornContextAuthority | undefined {
+  const domain = mod.domain ?? mod.name;
+  const directives = mod.directives as Directive<unknown>[];
+  const byId = new Map(directives.map((d) => [d.id, d]));
+  for (const bd of directives) {
+    if (bd?.birthsChild !== true || typeof bd.payloadSchema !== "object") continue;
+    const probed = probeBirthGenesis(bd, `${domain}/${bd.id}`);
+    if (probed === undefined) continue;
+    const { chain, synth } = probed;
+    // Find the genesis step (in THIS domain) whose directive writeTuples `relation` — that step seats R.
+    let seatsVia: string | undefined;
+    for (const step of chain) {
+      if (step === null || typeof step !== "object" || step.domain !== domain || typeof step.directiveId !== "string") continue;
+      const stepDir = byId.get(step.directiveId);
+      if (stepDir === undefined) continue;
+      if (probeRelationsWritten(stepDir, `${domain}/${stepDir.id}`).includes(relation)) {
+        seatsVia = step.directiveId;
+        break;
+      }
+    }
+    if (seatsVia === undefined) continue;
+
+    // Resolve the owner field (the payload field whose value the genesis routes as the seed's subject/actor)
+    // + the framework/law-hash fields (matched by value against the genesis install steps), mirroring
+    // discoverChildBirthLeg. The owner field is the payload field carried as a genesis step actor.
+    const fieldForValue = (v: unknown): string | undefined =>
+      Object.entries(synth.value).find(([, sv]) => sv === v && typeof v === "string" && v.length > 0)?.[0];
+    const ownerField = (() => {
+      for (const step of chain as Array<{ actor?: unknown }>) {
+        const exact = fieldForValue(step?.actor);
+        if (exact !== undefined) return exact;
+        if (typeof step?.actor === "string") {
+          for (const [field, value] of Object.entries(synth.value)) {
+            if (typeof value === "string" && value.length > 0 && (step.actor === `user:${value}` || step.actor === `key:${value}`)) return field;
+          }
+        }
+      }
+      return undefined;
+    })();
+    const installSteps = chain.filter((s) => s !== null && typeof s === "object" && s.directiveId === "installDomain") as Array<{ domain?: string; payload?: { domainHash?: unknown } }>;
+    const frameworkHashField = fieldForValue(installSteps.find((s) => s.domain === "bootstrap")?.payload?.domainHash);
+    const lawHashField = fieldForValue(installSteps.find((s) => s.domain === "nomos")?.payload?.domainHash);
+
+    const birthPayload: Record<string, unknown> = { ...synth.value };
+    if (frameworkHashField !== undefined) delete birthPayload[frameworkHashField];
+    if (lawHashField !== undefined) delete birthPayload[lawHashField];
+
+    return {
+      birthDirectiveId: bd.id,
+      birthPayload,
+      birthAutoStamped: synth.autoStamped,
+      ...(ownerField !== undefined ? { ownerField } : {}),
+      ...(frameworkHashField !== undefined ? { frameworkHashField } : {}),
+      ...(lawHashField !== undefined ? { lawHashField } : {}),
+      seatsViaDirectiveId: seatsVia,
+    };
+  }
+  return undefined;
+}
+
+/** Does any workspaceInvariant fire ON `directiveId` — i.e. does that directive carry a PREREQUISITE (a
+ *  declared invariant reading state another step must establish first)? A standalone replay of such a
+ *  directive can FALSE-fail (the prior state is absent), so a born domain must prove via the genesis path. */
+function directiveHasPrerequisiteInvariant(mod: DomainModule, directiveId: string): boolean {
+  return (mod.workspaceInvariants ?? []).some((inv) => inv.on === directiveId);
+}
+
 /** Discover the RELATION-BOOTSTRAP leg for a module: the first gated (`.requires(R)`) directive plus the
  *  sibling that ESTABLISHES the actor's authority for R. In priority order: (1) a DIRECT granter of R (a
  *  `.grants(R)` marker or a plan-probed `writeTuple(R)`) — the original lane; (2) REWRITE-AWARE — when R is
@@ -765,14 +940,54 @@ export function discoverRelationBootstrapLeg(mod: DomainModule): RelationBootstr
       // guard: `seedSpeculative`). Prefer a seed that seats the MOST relations (a genesis/owner seed like
       // estate's, which lands admin/creator/estateOwner together — the broadest root authority).
       const seed = discoverSeedDirective(candidates, domain);
-      if (seed === undefined) return undefined; // no seed path → the caller emits the diagnostic
-      found = { granter: seed.dir, via: "inferred" };
-      grantedRelation = seed.relationsWritten[0] ?? relation; // cosmetic — the seed's primary relation
-      via = "seed-path";
-      seedSpeculative = true;
-      seedWritesRelations = seed.relationsWritten;
+      if (seed !== undefined) {
+        found = { granter: seed.dir, via: "inferred" };
+        grantedRelation = seed.relationsWritten[0] ?? relation; // cosmetic — the seed's primary relation
+        via = "seed-path";
+        seedSpeculative = true;
+        seedWritesRelations = seed.relationsWritten;
+      }
     }
   }
+
+  // (4) BORN-DOMAIN GENESIS AUTHORITY (the co2 home case) — precedence over a standalone seed. The standalone
+  // path is "clean" ONLY when a granter was found, it isn't the speculative seed-path lane, AND that granter
+  // carries NO prerequisite invariant (a standalone re-seed of a prerequisite-gated granter — e.g.
+  // seedHomeCreator, gated by HomeCreatorSeedBindsOwner — would FALSE-fail because the prior genesis state is
+  // absent). When the standalone path is NOT clean, prefer proving the gated directive INSIDE the born
+  // workspace, whose genesis seats R for the owner.
+  const standaloneClean =
+    found !== undefined && !seedSpeculative && !directiveHasPrerequisiteInvariant(mod, found.granter.id);
+  if (!standaloneClean) {
+    const bornContext = discoverBornContextAuthority(mod, relation);
+    if (bornContext !== undefined) {
+      return {
+        domain,
+        gatedDirectiveId: gated.id,
+        relation,
+        grantedRelation: relation,
+        gatedPayload,
+        gatedAutoStamped: gatedSynth.autoStamped,
+        ...(gatedMintField !== undefined ? { gatedMintField, gatedAggregateId: gated.aggregateId } : {}),
+        // grant fields are UNUSED for a born-context leg (the runner births + dispatches inside); populate them
+        // with the genesis seed's id / empty payload so the shape stays uniform (never dispatched standalone).
+        grantDirectiveId: bornContext.seatsViaDirectiveId,
+        grantPayload: {},
+        grantAutoStamped: [],
+        grantSubjectFields: [],
+        grantGrantedByFields: [],
+        via: "born-context",
+        bornContext,
+      };
+    }
+    // No born-domain path. If a standalone granter exists but carries a prerequisite it can't satisfy alone
+    // (and isn't the speculative lane), do NOT emit a doomed passing leg — return undefined so the caller's
+    // loud diagnostic names the unmet prerequisite. A speculative seed-path stays (it degrades safely).
+    if (found !== undefined && !seedSpeculative && directiveHasPrerequisiteInvariant(mod, found.granter.id)) {
+      return undefined;
+    }
+  }
+  if (found === undefined) return undefined; // no granter at all → the caller emits the diagnostic
   const granter = found.granter;
 
   // Synthesize the grant payload + resolve which fields route into subject / grantedBy (so runtime seats the
@@ -845,6 +1060,19 @@ export function diagnoseRelationBootstrapGap(mod: DomainModule): string | undefi
   if (discoverRelationBootstrapLeg(mod) !== undefined) return undefined; // resolved — no gap
   const relation = gated.requiresRelationGate!.relation;
   const object = gated.requiresRelationGate!.object;
+  // NAME THE UNMET PREREQUISITE (co2 home diagnostic): when a granter of R exists but carries a prerequisite
+  // invariant a standalone re-seed can't satisfy AND no birth genesis seats R, say so precisely.
+  const directivesAll = mod.directives as Directive<unknown>[];
+  const prereqGranter = directivesAll.find(
+    (d) => d !== gated && typeof d?.payloadSchema === "object" && d.birthsChild !== true
+      && probeGrantsRelation(d, relation, `${domain}/${d.id}`) && directiveHasPrerequisiteInvariant(mod, d.id),
+  );
+  if (prereqGranter !== undefined) {
+    const inv = (mod.workspaceInvariants ?? []).find((i) => i.on === prereqGranter.id);
+    return `${domain}/${gated.id} is gated by .requires("${relation}") but the proof cannot seed authority: the only granter of "${relation}" is `
+      + `${domain}/${prereqGranter.id}, which carries the prerequisite invariant '${inv?.id ?? "?"}' (it reads state an EARLIER step must establish), so a standalone re-seed FALSE-fails — and no \`.births()\` genesis seats "${relation}" to prove it in a born workspace. `
+      + `Establish "${relation}" via a birth genesis (a \`.births()\` whose chain runs ${prereqGranter.id} after seeding its prerequisite), or prove ${gated.id} by hand. (The negative conformance leg still proves the gate refuses an actorless offer.)`;
+  }
   const bases = resolveGrantableBaseRelations(mod.relationTypes, object, relation).filter((b) => b !== relation);
   const tried = bases.length > 0
     ? `no directive grants "${relation}" directly, nor any of its directly-grantable rewrite bases [${bases.join(", ")}]`
@@ -1544,7 +1772,7 @@ function generateBirthOnlyProof(
     `import { readFileSync } from "node:fs";`,
     `import { connect, encodeIntentOfferBytes } from "@githolon/client";`,
     `import { ${factory}, ${hashConst} } from "./${opts.packageName}.client.ts";`,
-    `void connect; void ${factory};`,
+    `void connect; void encodeIntentOfferBytes; void ${factory};`,
     ``,
     `const CLOUD = (process.env.NOMOS_CLOUD || "https://nomos.captainapp.co.uk").replace(/\\/+$/, "");`,
     `const WS = process.env.NOMOS_WS || ${JSON.stringify(slug + "-proof-")} + Math.random().toString(36).slice(2, 8);`,
@@ -1552,6 +1780,11 @@ function generateBirthOnlyProof(
     ...v2IdentityAndCleanupPreamble(opts, hashConst, n),
     ``,
     ...liveChildBirthLegLines(cb, opts, n),
+    // THE RELATION-BOOTSTRAP LEG (incl. LAYER 4 born-context): a birth-only domain may ALSO carry a gated
+    // non-birth directive whose authority is established by the birth genesis (co2 home's updateHomeProfile
+    // via birthHome→seedHomeCreator). Emit it so the birth-only proof names it (the born-context proof itself
+    // runs in the offline `githolon proof` lane). No-op when the domain has no gated directive.
+    ...relationSeedLegLines(primaryLegs.relationBootstrap, factory, n, primaryLegs.relationBootstrap === undefined ? diagnoseRelationBootstrapGap(mod) : undefined),
     `console.log(\`\\nALL GREEN — generated proof for "${opts.packageName}": deploy → child birth (\${WS} → the born child) → verified\`);`,
     ``,
     ...v2CatchFinally(),