@githolon/dsl 0.55.0 → 0.56.0

package/dart/pubspec.yaml

@@ -11,7 +11,7 @@ description: >-
   Nomos 2 Dart frontend types — the hand-written kernel wire types plus the
   code-generated per-domain aggregate + directive-payload types. (De)serializes
   the EXACT serde JSON the Rust kernel + projection produce/consume.
-version: 0.34.0
+version: 0.35.0
 
 environment:
   sdk: ^3.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.55.0",
+  "version": "0.56.0",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/attested.ts

@@ -32,12 +32,21 @@ export {
   PARENT_TRUST_SENTINEL,
   foreignQuery,
   isTrustSourceDecl,
+  trustPolicy,
+  isTrustPolicyDecl,
+  fromPayload,
+  isFromPayloadRef,
   NomosSourceFrontier,
   sourceFrontierId,
   SOURCE_FRONTIER_PREFIX,
   __trustFor,
+  __policyFor,
   type TrustSourceDecl,
   type TrustSourceOptions,
+  type TrustPolicyDecl,
+  type TrustPolicyOptions,
+  type FromPayloadRef,
+  type ForeignReadEdge,
   type ForeignQueryRef,
 } from "./attested_core.js";
 

package/src/attested_core.ts

@@ -10,8 +10,8 @@
  * module-init cycle. The sanctioning ensure directive + the merge-seam injector live in
  * `attested.ts`. Full doctrine: `architecture/attested_reads_design.md`.
  */
-import { aggregate } from "./aggregate.js";
-import { t } from "./fields.js";
+import { aggregate, type AggregateHandle } from "./aggregate.js";
+import { t, type Field } from "./fields.js";
 import { Lww } from "./drivers.js";
 
 /** A lightweight reference to a query declared in the SOURCE workspace's law — the reader
@@ -125,6 +125,203 @@ export function isTrustSourceDecl(v: unknown): v is TrustSourceDecl {
   );
 }
 
+// ── DYNAMIC-SOURCE trust: a policy over a LAW-STATE allow-list (dynamic_source_attested_reads.md) ──
+// The static `trustSource("ws", …)` edge names a FIXED workspace; a `trustPolicy` instead names a
+// reader-side aggregate whose folded rows ARE the acceptable-source set — so the routed workspace is
+// chosen at RUNTIME (the payload names it) while the trust judgment (genesis + accepted keys) stays a
+// deterministic fold of the reader's own gated-enrolment writes. The gate resolves `att.source_genesis`
+// against the allow-list rows; the NAME is routing, the genesis + keys are identity.
+
+/** A marker naming a PAYLOAD FIELD that carries the routed source-workspace name at runtime — the
+ *  first argument of the dynamic `.readsFrom(fromPayload("field"), query, { policy })` overload. */
+export interface FromPayloadRef {
+  readonly payloadField: string;
+  /** brand — distinguishes the dynamic (payload-routed) lane from a static workspace-name string. */
+  readonly __nomosFromPayload: true;
+}
+
+/** Name the PAYLOAD FIELD whose value routes a dynamic attested read (see {@link FromPayloadRef}). */
+export function fromPayload(field: string): FromPayloadRef {
+  if (typeof field !== "string" || field.length === 0) {
+    throw new Error(`fromPayload(): the payload field name must be a non-empty string`);
+  }
+  return { payloadField: field, __nomosFromPayload: true };
+}
+
+/** Shape predicate — a {@link FromPayloadRef} vs a static workspace-name string. Library-internal. */
+export function isFromPayloadRef(v: unknown): v is FromPayloadRef {
+  return (
+    v !== null &&
+    typeof v === "object" &&
+    (v as { __nomosFromPayload?: unknown }).__nomosFromPayload === true &&
+    typeof (v as { payloadField?: unknown }).payloadField === "string"
+  );
+}
+
+/** The §4.4 freshness + allow-list vocabulary of one declared trust POLICY. */
+export interface TrustPolicyOptions {
+  /** The reader-side aggregate whose folded rows are the acceptable-source set (genesis + keyHashes
+   *  per row). Enrolling a row is a GATED WRITE (owner authority); revoking = archiving the row. */
+  readonly allowList: AggregateHandle;
+  /** The allow-list field (a `t.string()`) holding a row's source GENESIS oid. Inferred when the
+   *  aggregate has exactly one string field whose name contains "genesis"; else required. */
+  readonly genesisField?: string;
+  /** The allow-list field (a `t.set(t.string())`) holding a row's accepted attestor keyHashes.
+   *  Inferred when the aggregate has exactly one set-of-string field; else required. */
+  readonly keysField?: string;
+  /** §4.4a — wall-clock freshness bound in ms (judged against the intent's frozen HLC). */
+  readonly maxAgeMs?: number;
+  /** §4.4b — the epoch anchor: `"birth"` (the reader's own birth-cert epoch) or an integer floor. */
+  readonly minSourceEpoch?: "birth" | number;
+  /** §4.4c — maintain + enforce the monotone `SourceFrontier` (no regression per source genesis). */
+  readonly monotone?: boolean;
+  /** §5.3 — what a folded `SourceDishonor` fact does at verify: `"refuse"` or `"record"`. */
+  readonly onDishonor?: "refuse" | "record";
+}
+
+/** One declared trust POLICY — an exported {@link trustPolicy} value, auto-discovered by shape.
+ *  Lowered into the `nomosAttestedReadGate` era key's `policies` map. */
+export interface TrustPolicyDecl {
+  readonly policyId: string;
+  /** The resolved allow-list aggregate TYPE id. */
+  readonly allowListType: string;
+  /** The resolved genesis field LABEL. */
+  readonly genesisField: string;
+  /** The resolved keyHashes field LABEL. */
+  readonly keysField: string;
+  readonly maxAgeMs?: number;
+  readonly minSourceEpoch?: "birth" | number;
+  readonly monotone?: boolean;
+  readonly onDishonor?: "refuse" | "record";
+  readonly __nomosTrustPolicy: true;
+}
+
+// The runtime policy registry — the dynamic read lane resolves a policy's monotone posture through
+// the directive's readsFrom (which registers the queryId); this map lets the compile discovery + the
+// validators resolve a decl by id. Keyed by policyId; later declaration wins.
+const policyRegistry = new Map<string, TrustPolicyDecl>();
+
+/** The registered trust policy for an id (`undefined` = undeclared). Library-internal. */
+export function __policyFor(policyId: string): TrustPolicyDecl | undefined {
+  return policyRegistry.get(policyId);
+}
+
+/**
+ * DECLARE a dynamic trust POLICY (dynamic_source_attested_reads.md): the acceptable-source set is
+ * LAW-STATE — the folded rows of `allowList`, each a `{ <genesisField>: string, <keysField>:
+ * set-of-string }`. A directive routes a runtime-named source through this policy with
+ * `.readsFrom(fromPayload("wsField"), theQuery, { policy: thisDecl })`. Auto-discovered by shape and
+ * lowered into the `nomosAttestedReadGate` era key's `policies` map. The field names are inferred by
+ * shape (see {@link TrustPolicyOptions}) or given explicitly; a bad allow-list is a NAMED compile error.
+ */
+export function trustPolicy(policyId: string, opts: TrustPolicyOptions): TrustPolicyDecl {
+  const al = opts.allowList as AggregateHandle | undefined;
+  if (
+    al === null ||
+    typeof al !== "object" ||
+    (al as { __isAggregateHandle?: unknown }).__isAggregateHandle !== true
+  ) {
+    throw new Error(
+      `trustPolicy('${policyId}'): 'allowList' must be an aggregate handle — pass the aggregate(...) ` +
+        `whose rows hold the trusted sources ({ <genesis> string, <keyHashes> set-of-string })`,
+    );
+  }
+  const fields = al.fields as Record<string, Field>;
+  const stringFields = Object.keys(fields).filter((n) => (fields[n] as Field).kind === "string");
+  const setFields = Object.keys(fields).filter((n) => (fields[n] as Field).kind === "set");
+
+  let genesisField: string;
+  if (opts.genesisField !== undefined) {
+    if (!(opts.genesisField in fields)) {
+      throw new Error(
+        `trustPolicy('${policyId}'): genesisField '${opts.genesisField}' is not a field of aggregate '${al.id}'`,
+      );
+    }
+    if ((fields[opts.genesisField] as Field).kind !== "string") {
+      throw new Error(
+        `trustPolicy('${policyId}'): genesisField '${opts.genesisField}' must be a t.string() field (the source genesis oid)`,
+      );
+    }
+    genesisField = opts.genesisField;
+  } else {
+    const cands = stringFields.filter((n) => n.toLowerCase().includes("genesis"));
+    if (cands.length !== 1) {
+      throw new Error(
+        `trustPolicy('${policyId}'): cannot infer genesisField on aggregate '${al.id}' — declare exactly ` +
+          `ONE t.string() field whose name contains "genesis", or pass genesisField: "<name>" explicitly`,
+      );
+    }
+    genesisField = cands[0]!;
+  }
+
+  let keysField: string;
+  if (opts.keysField !== undefined) {
+    if (!(opts.keysField in fields)) {
+      throw new Error(
+        `trustPolicy('${policyId}'): keysField '${opts.keysField}' is not a field of aggregate '${al.id}'`,
+      );
+    }
+    if ((fields[opts.keysField] as Field).kind !== "set") {
+      throw new Error(
+        `trustPolicy('${policyId}'): keysField '${opts.keysField}' must be a t.set(t.string()) field (the accepted attestor keyHashes)`,
+      );
+    }
+    keysField = opts.keysField;
+  } else {
+    if (setFields.length !== 1) {
+      throw new Error(
+        `trustPolicy('${policyId}'): cannot infer keysField on aggregate '${al.id}' — declare exactly ` +
+          `ONE t.set(t.string()) field (the accepted attestor keyHashes), or pass keysField: "<name>" explicitly`,
+      );
+    }
+    keysField = setFields[0]!;
+  }
+
+  const decl: TrustPolicyDecl = {
+    policyId,
+    allowListType: al.id,
+    genesisField,
+    keysField,
+    ...(opts.maxAgeMs !== undefined ? { maxAgeMs: opts.maxAgeMs } : {}),
+    ...(opts.minSourceEpoch !== undefined ? { minSourceEpoch: opts.minSourceEpoch } : {}),
+    ...(opts.monotone !== undefined ? { monotone: opts.monotone } : {}),
+    ...(opts.onDishonor !== undefined ? { onDishonor: opts.onDishonor } : {}),
+    __nomosTrustPolicy: true,
+  };
+  policyRegistry.set(policyId, decl);
+  return decl;
+}
+
+/** Shape predicate for compile discovery (the `isTrustSourceDecl` pattern). */
+export function isTrustPolicyDecl(v: unknown): v is TrustPolicyDecl {
+  return (
+    v !== null &&
+    typeof v === "object" &&
+    (v as { __nomosTrustPolicy?: unknown }).__nomosTrustPolicy === true &&
+    typeof (v as { policyId?: unknown }).policyId === "string"
+  );
+}
+
+/** One declared foreign-read edge on a directive — a STATIC workspace edge or a dynamic policy edge.
+ *  The static edge emits `{queryId, from}`; the policy edge emits `{queryId, policy}` (the routing
+ *  `fromPayload` field is DSL-internal — the gate judges by genesis, the name is transport). */
+export type ForeignReadEdge =
+  | { readonly queryId: string; readonly from: string }
+  | { readonly queryId: string; readonly policy: string; readonly fromPayload: string };
+
+// A dynamic (policy-routed) read carries no declared `from` string, so the read lane cannot resolve
+// its monotone posture through `__trustFor(name)`. The directive's readsFrom registers the queryId of
+// every MONOTONE policy edge here; the foreign read lane consults it to record the SourceFrontier.
+const monotoneForeignQueries = new Set<string>();
+/** Register a foreign query id whose governing policy is monotone. Library-internal. */
+export function __registerMonotoneForeignQuery(queryId: string): void {
+  monotoneForeignQueries.add(queryId);
+}
+/** Is a foreign query governed by a monotone policy edge? Library-internal. */
+export function __isMonotoneForeignQuery(queryId: string): boolean {
+  return monotoneForeignQueries.has(queryId);
+}
+
 // ── the SourceFrontier (§4.4c) — the reader-side monotone record of the source's position ──────
 
 /** The deterministic instance-id prefix — `source-frontier:<source_genesis>` (keyed by the source's

package/src/build_package.ts

@@ -61,7 +61,13 @@ import {
 } from "./birth_meter.js";
 import { withBirthMeterExports } from "./birth_meter_ensure.js";
 import { withClearDirectives } from "./clear_directive.js";
-import { withAttestedReadExports, isTrustSourceDecl, type TrustSourceDecl } from "./attested.js";
+import {
+  withAttestedReadExports,
+  isTrustSourceDecl,
+  isTrustPolicyDecl,
+  type TrustSourceDecl,
+  type TrustPolicyDecl,
+} from "./attested.js";
 import type { RelationTypeDecl } from "./relation_schema.js";
 import { domainHash, emitManifestBytes } from "./manifest.js";
 import { collectValueObjectDescriptors } from "./value_object.js";
@@ -336,6 +342,15 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   const trustSources = [...trustByWs.values()].sort((a, b) =>
     a.workspace < b.workspace ? -1 : a.workspace > b.workspace ? 1 : 0,
   );
+  // Dynamic-source trust POLICIES (dynamic_source_attested_reads.md) — discovered by shape like
+  // trustSource. Later-wins by policy id; sorted for byte-determinism.
+  const policyById = new Map<string, TrustPolicyDecl>();
+  for (const v of Object.values(merged)) {
+    if (isTrustPolicyDecl(v)) policyById.set(v.policyId, v);
+  }
+  const trustPolicies = [...policyById.values()].sort((a, b) =>
+    a.policyId < b.policyId ? -1 : a.policyId > b.policyId ? 1 : 0,
+  );
   const pabMarker =
     parentAttestedBirthMarker(merged) ??
     spec.modules.map((m) => parentAttestedBirthMarker(m)).find((x) => x !== null) ??
@@ -385,6 +400,7 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
     // Omit-when-empty — the nomosAttestedReadGate era rule: a domain with no declared trust
     // edge is byte-identical in the canonical manifest/USD.
     ...(trustSources.length > 0 ? { trustSources } : {}),
+    ...(trustPolicies.length > 0 ? { trustPolicies } : {}),
     ...(dartImports.length > 0 ? { dartImports } : {}),
     ...(spec.dartRefImports !== undefined && spec.dartRefImports.length > 0
       ? { dartRefImports: [...spec.dartRefImports] }

package/src/codegen_dart.ts

@@ -3488,6 +3488,13 @@ export interface DomainModule {
    * ADDITIVE + OPTIONAL: a domain with no trust edge omits this and is byte-identical (era rule).
    */
   trustSources?: import("./attested.js").TrustSourceDecl[];
+  /**
+   * The domain's DYNAMIC-SOURCE TRUST POLICIES (dynamic_source_attested_reads.md): the exported
+   * `trustPolicy(id, { allowList, … })` declarations, discovered by shape. Lowered — together with
+   * directives' `.readsFrom(fromPayload(…), query, { policy })` edges — into the `nomosAttestedReadGate`
+   * era key's `policies` map. ADDITIVE + OPTIONAL: a policy-free domain omits this (era rule).
+   */
+  trustPolicies?: import("./attested.js").TrustPolicyDecl[];
   /**
    * The domain's NATIVE ZANZIBAR RELATION SCHEMA (`relation_schema.ts` — the userset-rewrite law,
    * P1). Pure-data per-type relation rewrites lowered to the `nomosRelations` USD era key (NO JS on

package/src/codegen_proof.ts

@@ -44,6 +44,7 @@ import type { FieldOp } from "./ops.js";
 import type { RelationTypeDecl, Rewrite } from "./relation_schema.js";
 import type { WorkspaceInvariantDecl } from "./framework/workspace_invariant.js";
 import { finishCount } from "./count.js";
+import { clearDirectiveId } from "./clear_directive.js";
 import { voMetaOf, voSample } from "./value_object.js";
 import { mintedCreateField } from "./workspace_routing.js";
 import { deterministicPorts } from "./ctx.js";
@@ -1883,7 +1884,20 @@ export interface ProofLegs {
 function isStandaloneCreate(d: Directive<unknown> | undefined): boolean {
   return d?.marker === "creates" && typeof d.payloadSchema === "object"
     && d.birthsChild !== true && d.attestationAuthorizedGate === undefined
-    && d.requiresRelationGate === undefined;
+    && d.requiresRelationGate === undefined
+    // NOT a foreign-read directive (`.readsFrom(...)` — a static attested edge or a dynamic
+    // policy edge): its plan reads a SIGNED cross-workspace attestation the single-workspace
+    // offline proof plane cannot mint (that needs a second SOURCE workspace + its attestor key).
+    // Dispatched offline it would throw at the un-served read; proven instead by the two-workspace
+    // smoke (bench/scale/{attested_reads.test,dynamic_attested_reads.smoke}.mjs). Named below.
+    && (((d as { declaredForeignReads?: readonly unknown[] }).declaredForeignReads?.length ?? 0) === 0);
+}
+
+/** Does this module carry ≥1 foreign-read directive (a static or dynamic-policy `.readsFrom`)? */
+function hasForeignReadDirective(mod: DomainModule): boolean {
+  return (mod.directives as Directive<unknown>[]).some(
+    (d) => ((d as { declaredForeignReads?: readonly unknown[] }).declaredForeignReads?.length ?? 0) > 0,
+  );
 }
 
 /** Does `v` carry an RFC 7946 geometry object at `segs` (walked into the composite)? */
@@ -2660,6 +2674,39 @@ export function generateTsProof(modules: readonly DomainModule[], opts: TsProofO
     );
   }
 
+  // CLEAR-LANE PROOF (null_semantics.md): a `t.clearable(...)` field's compose-injected clear directive
+  // (`clearDirectiveId(agg, field)`) LOWERS to a Set of json null — dispatch it on the created instance
+  // and read the field back as null (ExplicitNull). Only UN-GATED clear directives (the proof binds no
+  // actor); a gated clear needs authority the negative/positive gate legs already cover. Empty for a
+  // clearable-free aggregate (byte-identical proof).
+  const clearLegs = Object.entries(agg.fields as Record<string, Field>)
+    .filter(([, f]) => f.isClearable === true)
+    .map(([field]) => ({ field, dirId: clearDirectiveId(agg.id, field) }))
+    .filter(({ dirId }) => {
+      const cd = (mod.directives as Directive<unknown>[]).find((d) => d.id === dirId);
+      return cd !== undefined && (cd as { requiresRelationGate?: unknown }).requiresRelationGate === undefined;
+    });
+  for (const { field, dirId } of clearLegs) {
+    out.push(
+      `// ${n()}. CLEAR-LANE PROOF — \`${field}\` is clearable: \`${dirId}\` lowers to Set(json null); after it,`,
+      `//    the field reads back null (ExplicitNull), never omitted.`,
+      `try {`,
+      `  await app.${dirId}({ id: createdId });`,
+      `} catch (e) {`,
+      `  fail(\`clear-lane ${dirId} was REFUSED — an un-gated clear of a clearable field must be admitted: \${(e as Error).message}\`);`,
+      `}`,
+      `{`,
+      `  const clearedRows = await holon.queryById(createdId) as { data?: Record<string, unknown> }[];`,
+      `  const clearedRow = clearedRows[0];`,
+      `  if (clearedRow !== undefined && clearedRow.data !== undefined && clearedRow.data[${JSON.stringify(field)}] != null) {`,
+      `    fail(\`clear-lane ${field}: expected null after clear, got \${JSON.stringify(clearedRow.data[${JSON.stringify(field)}])}\`);`,
+      `  }`,
+      `  ok(${JSON.stringify(`clear-lane — ${domain}/${dirId} admitted; \`${field}\` reads back null (ExplicitNull)`)});`,
+      `}`,
+      ``,
+    );
+  }
+
   out.push(
     `globalThis.fetch = realFetch;`,
     `ok("offline proof ENFORCED — fetch was trapped: local write/read touched no network");`,
@@ -2738,6 +2785,23 @@ export function generateTsProof(modules: readonly DomainModule[], opts: TsProofO
     );
   }
 
+  // THE ATTESTED / DYNAMIC-POLICY FOREIGN-READ LEG — named, honestly SKIPPED here. A `.readsFrom(...)`
+  // directive's plan reads a SIGNED cross-workspace attestation; proving it needs a SECOND source
+  // workspace, its read-attestor key, and a served+signed envelope — none of which the single-workspace,
+  // client-driven offline proof plane can mint (the client has no `attestedRead` serving op). The full
+  // offline two-workspace proof (birth a scratch source → seed a row → enrol its genesis → attested read
+  // through the policy edge → admitted, plus the wrong-genesis/unenrolled negative + revocation +
+  // verify_chain) lives in the bench harness against the real wasm.
+  if (hasForeignReadDirective(mod)) {
+    out.push(
+      `// ${n()}. attested foreign-read leg: a .readsFrom(...) directive reads a SIGNED cross-workspace`,
+      `//    attestation — proving it needs a second SOURCE workspace + its attestor key, which this`,
+      `//    single-workspace client proof cannot mint. Proven in the two-workspace bench smoke.`,
+      `console.log("– attested foreign-read leg SKIPPED — a .readsFrom(...) attested/policy read is proven in the two-workspace bench harness (bench/scale/{attested_reads.test,dynamic_attested_reads.smoke}.mjs), not this single-workspace offline proof");`,
+      ``,
+    );
+  }
+
   // THE AUTHORITY-CONFORMANCE LEG (the one-encoder + gate proof): runs on the LOCAL holon (fetch re-trapped),
   // proving the generated client threads security.actor through THE ONE ENCODER and that an actorless gated
   // offer is impossible to GENERATE (throws MissingOfferAuthority before any submit). No-op when un-gated.

package/src/directive.ts

@@ -24,6 +24,14 @@ import type { CertifiedReadDecl } from "./certified_read.js";
 import type { RelationDecl } from "./relation.js";
 import type { QueryDecl } from "./query.js";
 import { BIRTH_METER_QUERIES } from "./birth_meter.js";
+import {
+  isFromPayloadRef,
+  isTrustPolicyDecl,
+  __registerMonotoneForeignQuery,
+  type FromPayloadRef,
+  type TrustPolicyDecl,
+  type ForeignReadEdge,
+} from "./attested_core.js";
 
 export type ReferentialMarker = "creates" | "mutates" | "ensures" | "archives";
 
@@ -183,7 +191,7 @@ export interface Directive<P = unknown> {
    * era key. OPTIONAL + ADDITIVE; OMITTED when empty (a foreign-read-free directive is
    * byte-identical — the era rule).
    */
-  readonly declaredForeignReads?: { queryId: string; from: string }[];
+  readonly declaredForeignReads?: ForeignReadEdge[];
   /**
    * The directive's DECLARED emit boundary: the event types its `plan` may EMIT,
    * each with an optional `max` bound. Part of the domain identity. Defaults to `{}`
@@ -331,6 +339,18 @@ export interface RequirableDirective<P> extends Directive<P> {
    * times; deduped by `(queryId, from)`. Purely additive (the era rule).
    */
   readsFrom(sourceWorkspace: string, query: { id: string }): RequirableDirective<P>;
+  /**
+   * Declare ONE DYNAMIC (payload-routed) foreign read (dynamic_source_attested_reads.md): the plan may
+   * `read(theQuery, args, { from: payload.<field> })` — the routed workspace is chosen at runtime by the
+   * named payload field, while the trust judgment (genesis + accepted attestor keys) is a fold of the
+   * reader's own {@link TrustPolicyDecl} allow-list. Lowered into the era key as a `{queryId, policy}`
+   * edge (the routing field is DSL-internal — the gate judges by genesis, the name is transport).
+   */
+  readsFrom(
+    source: FromPayloadRef,
+    query: { id: string },
+    opts: { policy: TrustPolicyDecl },
+  ): RequirableDirective<P>;
   /**
    * Declare ONE entry of the directive's EMIT boundary: an `eventType` its `plan` may
    * emit, with an optional `max` count bound. Callable MULTIPLE times to accumulate
@@ -671,17 +691,41 @@ function makeRequirable<P>(base: Directive<P>): RequirableDirective<P> {
       const mergedQueries = [...byId.values()].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
       return makeRequirable({ ...base, declaredReads: merged, declaredQueryReads: mergedQueries });
     },
-    readsFrom(sourceWorkspace: string, query: { id: string }): RequirableDirective<P> {
-      // ATTESTED CROSS-WORKSPACE READ (slice B): accumulate the (queryId, from) trust edge,
-      // dedup by pair, sort (only the SET is the contract — byte-determinism for the era key).
+    readsFrom(
+      source: string | FromPayloadRef,
+      query: { id: string },
+      opts?: { policy: TrustPolicyDecl },
+    ): RequirableDirective<P> {
+      // ATTESTED CROSS-WORKSPACE READ (slice B + dynamic policies): accumulate a STATIC (queryId, from)
+      // edge OR a DYNAMIC (queryId, policy, fromPayload) edge, dedup by canonical key, sort (only the
+      // SET is the contract — byte-determinism for the era key).
+      let entry: ForeignReadEdge;
+      if (isFromPayloadRef(source)) {
+        const policy = opts?.policy;
+        if (policy === undefined) {
+          throw new Error(
+            `readsFrom(fromPayload('${source.payloadField}'), '${query.id}'): a payload-routed foreign ` +
+              `read REQUIRES a trust policy — pass { policy: <trustPolicy(...) decl> } (the acceptable ` +
+              `sources are LAW-STATE, so the runtime-named workspace is judged against a folded allow-list).`,
+          );
+        }
+        if (!isTrustPolicyDecl(policy)) {
+          throw new Error(
+            `readsFrom(fromPayload('${source.payloadField}'), '${query.id}'): { policy } must be a ` +
+              `trustPolicy(...) declaration.`,
+          );
+        }
+        entry = { queryId: query.id, policy: policy.policyId, fromPayload: source.payloadField };
+        if (policy.monotone === true) __registerMonotoneForeignQuery(query.id);
+      } else {
+        entry = { queryId: query.id, from: source };
+      }
+      const canon = (e: ForeignReadEdge): string =>
+        "from" in e ? `0${e.from}${e.queryId}` : `1${e.policy}${e.fromPayload}${e.queryId}`;
       const prior = base.declaredForeignReads ?? [];
-      const key = (e: { queryId: string; from: string }) => `${e.from}\u0000${e.queryId}`;
-      const byKey = new Map<string, { queryId: string; from: string }>(prior.map((e) => [key(e), e]));
-      const entry = { queryId: query.id, from: sourceWorkspace };
-      byKey.set(key(entry), entry);
-      const merged = [...byKey.values()].sort((a, b) =>
-        a.from !== b.from ? (a.from < b.from ? -1 : 1) : a.queryId < b.queryId ? -1 : a.queryId > b.queryId ? 1 : 0,
-      );
+      const byKey = new Map<string, ForeignReadEdge>(prior.map((e) => [canon(e), e]));
+      byKey.set(canon(entry), entry);
+      const merged = [...byKey.values()].sort((a, b) => (canon(a) < canon(b) ? -1 : canon(a) > canon(b) ? 1 : 0));
       return makeRequirable({ ...base, declaredForeignReads: merged });
     },
     emits(eventType: string, opts?: { max?: number }): RequirableDirective<P> {

package/src/index.ts

@@ -148,12 +148,18 @@ export {
   trustParent,
   PARENT_TRUST_SENTINEL,
   foreignQuery,
+  trustPolicy,
+  fromPayload,
   NomosSourceFrontier,
   sourceFrontierId,
   SOURCE_FRONTIER_PREFIX,
   nomosSourceFrontierEnsure,
   type TrustSourceDecl,
   type TrustSourceOptions,
+  type TrustPolicyDecl,
+  type TrustPolicyOptions,
+  type FromPayloadRef,
+  type ForeignReadEdge,
   type ForeignQueryRef,
 } from "./attested.js";
 // ATTESTATION RECEIPTS + EQUIVOCATION ACCOUNTABILITY (slice B stage 3 — §5): the source-side

package/src/law_check.ts

@@ -44,6 +44,7 @@ import { finishSum } from "./sum.js";
 import { finishExtremum } from "./extremum.js";
 import { finishExists } from "./exists.js";
 import { clearDirectiveId } from "./clear_directive.js";
+import type { ForeignReadEdge } from "./attested_core.js";
 
 /** One author-time finding — the gate refusal pre-fired at compile, or a courtesy note. */
 export interface Finding {
@@ -994,6 +995,111 @@ function topLevelPortReadFindings(mod: DomainModule, portReadingDomains: Readonl
   ];
 }
 
+// ── ATTESTED-READ twins (dynamic_source_attested_reads.md §"proof + check") ──────────────────────
+// (a) a foreign read whose (directive, query) has no declared trust edge → REFUSE naming the fix;
+// (b) a trustPolicy whose allow-list aggregate has no directive writing it → WARN (unpopulatable);
+// (c) a query declared BOTH as a local .reads() premise AND a foreign policy read → REFUSE (laundering).
+
+/** The FOREIGN query ids a directive's plan actually reads (`read(q, …, { from })`) on the one probe
+ *  sample — `undefined` when the plan can't be probed (unsynthesizable payload / it threw). A clean re-run
+ *  under a read port that answers both lanes; every side-effect sink is drained (never leaks). */
+function foreignReadsPerformed(dir: Directive<unknown>, where: string): Set<string> | undefined {
+  let synth: SynthesizedPayload;
+  try {
+    synth = synthesizePayload(dir.payloadSchema as z.ZodTypeAny, where);
+  } catch {
+    return undefined;
+  }
+  const payload: Record<string, unknown> = { ...synth.value };
+  for (const f of synth.autoStamped) payload[f] = "2026-01-01T00:00:00Z";
+  const performed = new Set<string>();
+  let ok = true;
+  withBirthProbeGlobals(() => {
+    const g = globalThis as unknown as { nomos: Record<string, unknown> };
+    const prevRead = g.nomos.read;
+    const stubRows = [{ id: "probe", data: {} }];
+    g.nomos.read = (_q: string, _a: unknown, o?: { from?: string }) =>
+      o?.from
+        ? {
+            rows: stubRows,
+            attestation: { v: 1, source_genesis: "probe-genesis", source_head: "h", source_epoch: 0, attested_at_ms: 0 },
+          }
+        : stubRows;
+    __resetAuthoring();
+    __resetReads();
+    try {
+      dir.plan(payload as never, deterministicPorts({ physical: 1, replica: 1, principal: "principal:probe" }));
+      for (const r of __drainReads()) {
+        if ((r as { attestation?: unknown }).attestation !== undefined) performed.add(r.queryId);
+      }
+    } catch {
+      ok = false;
+    } finally {
+      try { __drainAuthoring(); } catch { /* drained */ }
+      try { __drainReads(); } catch { /* drained */ }
+      g.nomos.read = prevRead;
+    }
+  });
+  return ok ? performed : undefined;
+}
+
+function attestedReadFindings(mod: DomainModule): Finding[] {
+  const domain = mod.domain ?? mod.name;
+  const findings: Finding[] = [];
+  const directives = mod.directives as Directive<unknown>[];
+
+  // (b) unpopulatable trust set — a policy allow-list no directive writes.
+  const writtenTypes = new Set(directives.map((d) => (d as { aggregateId?: string }).aggregateId).filter(Boolean) as string[]);
+  for (const pol of mod.trustPolicies ?? []) {
+    if (!writtenTypes.has(pol.allowListType)) {
+      findings.push({
+        domain,
+        level: "warn",
+        what: `trustPolicy '${pol.policyId}' trusts sources enrolled in aggregate '${pol.allowListType}', but NO directive in this domain writes that aggregate — the trust set is unpopulatable (no gated enrolment lane), so every dynamic read under this policy will refuse (untrusted source)`,
+        fix: `add a gated enrolment directive, e.g. directive("enroll…").creates(${pol.allowListType}).requires("<ownerCap>") whose payload carries { <genesis> string, <keyHashes> string[] }`,
+      });
+    }
+  }
+
+  for (const dir of directives) {
+    const edges = (dir as { declaredForeignReads?: ForeignReadEdge[] }).declaredForeignReads ?? [];
+    const declaredQueryIds = new Set(edges.map((e) => e.queryId));
+    const localQueryIds = new Set(
+      ((dir as { declaredQueryReads?: { id: string }[] }).declaredQueryReads ?? []).map((q) => q.id),
+    );
+
+    // (c) laundering — a query cannot be both a local .reads() premise AND a foreign read.
+    for (const qid of declaredQueryIds) {
+      if (localQueryIds.has(qid)) {
+        findings.push({
+          domain,
+          directiveId: dir.id,
+          level: "refuse",
+          what: `query '${qid}' is declared BOTH as a local .reads() premise AND a foreign read on directive '${dir.id}' — a query cannot be both local (same-workspace CAS) and foreign (a signed cross-workspace attestation)`,
+          fix: `drop one: keep .reads(${qid}) for a same-workspace captured read, OR keep the foreign .readsFrom(...) edge and remove the local .reads(${qid})`,
+        });
+      }
+    }
+
+    // (a) an undeclared foreign read — the plan routes read(q, …, { from }) with no trust edge for q.
+    const performed = foreignReadsPerformed(dir, `${domain}/${dir.id}`);
+    if (performed !== undefined) {
+      for (const qid of performed) {
+        if (!declaredQueryIds.has(qid)) {
+          findings.push({
+            domain,
+            directiveId: dir.id,
+            level: "refuse",
+            what: `directive '${dir.id}' reads a foreign workspace — read('${qid}', …, { from }) — but declares no trust edge for '${qid}', so the gate refuses it on every lane`,
+            fix: `declare the edge: .readsFrom(fromPayload("<wsField>"), <${qid} query>, { policy: <trustPolicy(...) decl> }) for a payload-routed source, or .readsFrom("<ws>", <query>) + trustSource("<ws>", …) for a fixed one`,
+          });
+        }
+      }
+    }
+  }
+  return findings;
+}
+
 /**
  * Run every author-time twin over the composed domain modules and return the findings, ordered
  * refuse → warn → note (stable within a level, by domain/directive appearance). This is the ONE
@@ -1044,6 +1150,7 @@ export function checkDomainModules(
     findings.push(...dottedQueryKeyFindings(mod, aggById));
     findings.push(...nullBanFindings(mod, aggById));
     findings.push(...nullClearAuthorityFindings(mod, aggById));
+    findings.push(...attestedReadFindings(mod));
   }
 
   // The BIRTH-RECIPE twin (unify): fold the scattered `.births()` recipe diagnostics into the

package/src/read.ts

@@ -19,7 +19,7 @@
  */
 import type { QueryDecl } from "./query.js";
 import type { WireRead, WireReadAttestation } from "./wire.js";
-import { NomosSourceFrontier, sourceFrontierId, __trustFor, __ensure } from "./attested_core.js";
+import { NomosSourceFrontier, sourceFrontierId, __trustFor, __isMonotoneForeignQuery, __ensure } from "./attested_core.js";
 
 // ── the per-dispatch read footprint — library state drained by `executeDirectiveToIntent` (mirrors the authoring sink) ──
 let footprint: WireRead[] = [];
@@ -101,7 +101,10 @@ export function read<T = unknown>(
     );
   }
   footprint.push({ queryId: query.id, args, result: answer.rows, attestation: att });
-  if (__trustFor(from)?.monotone === true) {
+  // `from` is a STATIC declared workspace for a trustSource edge, or a RUNTIME payload value for a
+  // dynamic policy edge — so the monotone posture comes either from the static edge (`__trustFor`) or
+  // from the policy the directive registered for this query id. Either way the frontier is genesis-keyed.
+  if (__trustFor(from)?.monotone === true || __isMonotoneForeignQuery(query.id)) {
     const frontier = __ensure(NomosSourceFrontier, sourceFrontierId(att.source_genesis)) as {
       set(f: string, v: unknown): unknown;
     };

package/src/shape_compat.ts

@@ -54,10 +54,13 @@ export interface DomainInterface {
   readonly directives: Record<string, DirectivePayloadShape>;
   /** keyed by AGGREGATE SID. */
   readonly aggregates: Record<string, AggregateReadShape>;
-  /** ATTESTED READS (slice B): directive id → its declared `(queryId, from)` trust edges —
-   *  the cross-workspace dependencies this law consumes on its write path. OMITTED when the
-   *  law declares none (the era rule). */
-  readonly foreignReads?: Record<string, { queryId: string; from: string }[]>;
+  /** ATTESTED READS (slice B + dynamic policies): directive id → its declared foreign-read edges —
+   *  a STATIC `{queryId, from}` edge or a dynamic `{queryId, policy, fromPayload}` edge — the
+   *  cross-workspace dependencies this law consumes on its write path. OMITTED when none (era rule). */
+  readonly foreignReads?: Record<
+    string,
+    { queryId: string; from?: string; policy?: string; fromPayload?: string }[]
+  >;
 }
 
 /** The verdict: compatible iff nothing is missing and nothing is type-incompatible.
@@ -161,8 +164,9 @@ export function domainInterface(mod: DomainModule, stableIds?: StableIds): Domai
   Object.assign(aggregates, sortedRec(aggEntries));
   // ATTESTED READS (slice B): the declared trust edges — so shape-compat + client codegen can
   // SEE the cross-workspace dependency (typed clients don't call it; it's write-path-internal).
-  const foreignReadEntries: Array<[string, { queryId: string; from: string }[]]> = [];
-  for (const d of (mod.directives ?? []) as Array<{ id?: unknown; declaredForeignReads?: { queryId: string; from: string }[] }>) {
+  type ForeignEdge = { queryId: string; from?: string; policy?: string; fromPayload?: string };
+  const foreignReadEntries: Array<[string, ForeignEdge[]]> = [];
+  for (const d of (mod.directives ?? []) as Array<{ id?: unknown; declaredForeignReads?: ForeignEdge[] }>) {
     if (!d || typeof d.id !== "string") continue;
     if (d.declaredForeignReads !== undefined && d.declaredForeignReads.length > 0) {
       foreignReadEntries.push([d.id, d.declaredForeignReads.map((e) => ({ ...e }))]);

package/src/usd.ts

@@ -44,6 +44,7 @@ import type { DomainModule } from "./codegen_dart.js";
 import { domainInterface } from "./shape_compat.js";
 import { relationType, user, key, anyUser, qualifiedTypeId, qualifyRelationType } from "./relation_schema.js";
 import { harvestPrincipalFlows } from "./wire_encode.js";
+import { zodKind, zodObjectShape } from "./codegen_ts.js";
 import { composeSharedRelationTypes } from "./relation_composition.js";
 import { collectValueObjectUsages } from "./value_object.js";
 import {
@@ -459,7 +460,29 @@ export interface UsdLayer {
         onDishonor: "refuse" | "record";
       }
     >;
-    readonly directives: Record<string, { queryId: string; from: string }[]>;
+    /**
+     * DYNAMIC-SOURCE trust POLICIES (dynamic_source_attested_reads.md): the acceptable-source SET is
+     * law-state — a reader-side allow-list aggregate. A directive edge may route through a policy
+     * (`{queryId, policy}`) instead of a fixed workspace; the gate resolves the envelope's genesis
+     * against the folded `allowList` rows (genesis field) → the row's `keysField` accepted keys.
+     * OMITTED when no policy is declared (byte-identical to a policy-free bundle — the era rule).
+     */
+    readonly policies?: Record<
+      string,
+      {
+        allowList: string;
+        genesisField: string;
+        keysField: string;
+        maxAgeMs?: number;
+        minSourceEpoch?: "birth" | number;
+        monotone?: boolean;
+        onDishonor?: "refuse" | "record";
+      }
+    >;
+    readonly directives: Record<
+      string,
+      ({ queryId: string; from: string } | { queryId: string; policy: string })[]
+    >;
   };
   /**
    * THE READ-VISIBILITY GATE DECLARATION (the native-relations read gate).
@@ -566,6 +589,27 @@ export interface UsdDocument {
   readonly layers: UsdLayer[];
 }
 
+/** The payload field kinds of a directive — `"string-required"` for a required `z.string()`, else the
+ *  zod kind (`"optional"`, `"number"`, …). Used to validate a `fromPayload` routing field. Empty when
+ *  the payload isn't a plain object (a shape the check can't reason about — the runtime gate arbitrates). */
+function payloadFieldKinds(dir: { payloadSchema?: unknown } | undefined): Map<string, string> {
+  const m = new Map<string, string>();
+  const schema = dir?.payloadSchema as Parameters<typeof zodKind>[0] | undefined;
+  if (schema === undefined) return m;
+  let shape: Record<string, Parameters<typeof zodKind>[0]>;
+  try {
+    if (zodKind(schema) !== "object") return m;
+    shape = zodObjectShape(schema);
+  } catch {
+    return m;
+  }
+  for (const [name, f] of Object.entries(shape)) {
+    const k = zodKind(f);
+    m.set(name, k === "string" ? "string-required" : k);
+  }
+  return m;
+}
+
 /** Sort prims by their `path` (canonical structure). */
 function sortPrims(prims: UsdPrim[]): UsdPrim[] {
   return [...prims].sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
@@ -984,47 +1028,122 @@ export function emitUsd(
       // trustSource declarations. Emitted iff ≥1 directive declares a foreign read (the era
       // rule). A declared `from` with NO matching trustSource is a NAMED COMPILE ERROR — the
       // kernel would fail it closed anyway; refuse loudly at build instead.
-      const foreignDirectives: Record<string, { queryId: string; from: string }[]> = {};
+      type ForeignEdgeInternal =
+        | { queryId: string; from: string }
+        | { queryId: string; policy: string; fromPayload: string };
+      type ForeignEdgeEmit = { queryId: string; from: string } | { queryId: string; policy: string };
+      const foreignDirectives: Record<string, ForeignEdgeInternal[]> = {};
       for (const d of [...l.module.directives].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0))) {
-        const fr = (d as { declaredForeignReads?: { queryId: string; from: string }[] }).declaredForeignReads;
+        const fr = (d as { declaredForeignReads?: ForeignEdgeInternal[] }).declaredForeignReads;
         if (fr !== undefined && fr.length > 0) foreignDirectives[d.id] = fr.map((e) => ({ ...e }));
       }
       let nomosAttestedReadGate: UsdLayer["nomosAttestedReadGate"];
       if (Object.keys(foreignDirectives).length > 0) {
         const trust = (l.module as { trustSources?: readonly import("./attested.js").TrustSourceDecl[] }).trustSources ?? [];
         const trustByWs = new Map(trust.map((tsrc) => [tsrc.workspace, tsrc]));
+        const policies = (l.module as { trustPolicies?: readonly import("./attested.js").TrustPolicyDecl[] }).trustPolicies ?? [];
+        const policyById = new Map(policies.map((p) => [p.policyId, p]));
+        const aggIds = new Set(l.module.aggregates.map((a) => a.id));
+        // A policy-referenced allow-list must be a real aggregate of THIS module (the fold happens in
+        // the reader's own state) — else the gate could never resolve it (fail-closed at build).
+        for (const p of policies) {
+          if (!aggIds.has(p.allowListType)) {
+            throw new Error(
+              `trustPolicy('${p.policyId}'): its allowList aggregate '${p.allowListType}' is not an ` +
+                `aggregate of this domain — the acceptable-source set is the reader's OWN folded state, ` +
+                `so the allow-list must be declared (and written by a gated enrolment directive) here.`,
+            );
+          }
+        }
         const sourcesRec: NonNullable<UsdLayer["nomosAttestedReadGate"]>["sources"] = {};
+        const policiesRec: NonNullable<NonNullable<UsdLayer["nomosAttestedReadGate"]>["policies"]> = {};
+        const emitDirectives: Record<string, ForeignEdgeEmit[]> = {};
         for (const [dirId, edges] of Object.entries(foreignDirectives)) {
+          const dir = l.module.directives.find((d) => d.id === dirId);
+          const payloadShape = payloadFieldKinds(dir);
+          const emitted: ForeignEdgeEmit[] = [];
           for (const e of edges) {
-            const tsrc = trustByWs.get(e.from);
-            if (tsrc === undefined) {
-              throw new Error(
-                `directive '${dirId}' declares .readsFrom('${e.from}', '${e.queryId}') but the ` +
-                  `module exports no trustSource('${e.from}', …) — the trust edge must be declared ` +
-                  `in law (attested_reads_design.md §3.1)`,
-              );
-            }
-            if (sourcesRec[e.from] === undefined) {
-              sourcesRec[e.from] = {
-                genesis: tsrc.genesis,
-                ...(tsrc.keyHashes !== undefined && tsrc.keyHashes.length > 0
-                  ? { keyHashes: [...tsrc.keyHashes].sort() }
-                  : {}),
-                ...(tsrc.maxAgeMs !== undefined ? { maxAgeMs: tsrc.maxAgeMs } : {}),
-                ...(tsrc.minSourceEpoch !== undefined ? { minSourceEpoch: tsrc.minSourceEpoch } : {}),
-                ...(tsrc.monotone === true ? { monotone: true } : {}),
-                roster: tsrc.roster ?? "pinned",
-                onDishonor: tsrc.onDishonor ?? "refuse",
-              };
+            if ("from" in e) {
+              const tsrc = trustByWs.get(e.from);
+              if (tsrc === undefined) {
+                throw new Error(
+                  `directive '${dirId}' declares .readsFrom('${e.from}', '${e.queryId}') but the ` +
+                    `module exports no trustSource('${e.from}', …) — the trust edge must be declared ` +
+                    `in law (attested_reads_design.md §3.1)`,
+                );
+              }
+              if (sourcesRec[e.from] === undefined) {
+                sourcesRec[e.from] = {
+                  genesis: tsrc.genesis,
+                  ...(tsrc.keyHashes !== undefined && tsrc.keyHashes.length > 0
+                    ? { keyHashes: [...tsrc.keyHashes].sort() }
+                    : {}),
+                  ...(tsrc.maxAgeMs !== undefined ? { maxAgeMs: tsrc.maxAgeMs } : {}),
+                  ...(tsrc.minSourceEpoch !== undefined ? { minSourceEpoch: tsrc.minSourceEpoch } : {}),
+                  ...(tsrc.monotone === true ? { monotone: true } : {}),
+                  roster: tsrc.roster ?? "pinned",
+                  onDishonor: tsrc.onDishonor ?? "refuse",
+                };
+              }
+              emitted.push({ queryId: e.queryId, from: e.from });
+            } else {
+              const pol = policyById.get(e.policy);
+              if (pol === undefined) {
+                throw new Error(
+                  `directive '${dirId}' declares .readsFrom(fromPayload('${e.fromPayload}'), '${e.queryId}', ` +
+                    `{ policy: '${e.policy}' }) but the module exports no trustPolicy('${e.policy}', …) — the ` +
+                    `policy must be declared in law (dynamic_source_attested_reads.md).`,
+                );
+              }
+              // The routing field must be a REQUIRED string in the directive's payload (the workspace
+              // name is chosen at runtime; a missing/optional/non-string field could never route).
+              const kind = payloadShape.get(e.fromPayload);
+              if (kind === undefined) {
+                throw new Error(
+                  `directive '${dirId}': .readsFrom(fromPayload('${e.fromPayload}'), …) names a payload ` +
+                    `field that is not declared in the directive's payload — add a required z.string() ` +
+                    `'${e.fromPayload}' to the payload (it carries the routed source workspace name).`,
+                );
+              }
+              if (kind !== "string-required") {
+                throw new Error(
+                  `directive '${dirId}': the fromPayload routing field '${e.fromPayload}' must be a ` +
+                    `REQUIRED z.string() in the payload (it names the routed source workspace) — got '${kind}'.`,
+                );
+              }
+              if (policiesRec[e.policy] === undefined) {
+                policiesRec[e.policy] = {
+                  // Qualify the allow-list type by the owning domain iff it is namespaced — the
+                  // gate scans rows by their stored `__type`, which the engine stamps qualified
+                  // (`qaType`, the SAME read-projection namespacing rows/schema keys use). A bare
+                  // (unqualified) allowList would match no folded row → every dynamic read refuses.
+                  allowList: qaType(pol.allowListType),
+                  genesisField: pol.genesisField,
+                  keysField: pol.keysField,
+                  ...(pol.maxAgeMs !== undefined ? { maxAgeMs: pol.maxAgeMs } : {}),
+                  ...(pol.minSourceEpoch !== undefined ? { minSourceEpoch: pol.minSourceEpoch } : {}),
+                  ...(pol.monotone === true ? { monotone: true } : {}),
+                  ...(pol.onDishonor !== undefined ? { onDishonor: pol.onDishonor } : {}),
+                };
+              }
+              emitted.push({ queryId: e.queryId, policy: e.policy });
             }
           }
+          emitDirectives[dirId] = emitted;
         }
         // SORTED-KEY records (byte-determinism — matching the layered flatten).
         const sortedSources: typeof sourcesRec = {};
         for (const k of Object.keys(sourcesRec).sort()) sortedSources[k] = sourcesRec[k]!;
-        const sortedDirectives: Record<string, { queryId: string; from: string }[]> = {};
-        for (const k of Object.keys(foreignDirectives).sort()) sortedDirectives[k] = foreignDirectives[k]!;
-        nomosAttestedReadGate = { v: 1 as const, sources: sortedSources, directives: sortedDirectives };
+        const sortedPolicies: typeof policiesRec = {};
+        for (const k of Object.keys(policiesRec).sort()) sortedPolicies[k] = policiesRec[k]!;
+        const sortedDirectives: Record<string, ForeignEdgeEmit[]> = {};
+        for (const k of Object.keys(emitDirectives).sort()) sortedDirectives[k] = emitDirectives[k]!;
+        nomosAttestedReadGate = {
+          v: 1 as const,
+          sources: sortedSources,
+          ...(Object.keys(sortedPolicies).length > 0 ? { policies: sortedPolicies } : {}),
+          directives: sortedDirectives,
+        };
       }
       // THE BIRTH GATE (G3 — birth is a declared kernel primitive): the SORTED set of directive ids
       // declaring `.births()`. The kernel reads this off the manifest (never a domain aggregate) to know an

package/src/usd_layers.ts

@@ -835,20 +835,32 @@ export function flattenLayeredUsd(layers: readonly UsdLayer[]): UsdDocument {
     // layers, SORTED keys (matching the composed emission). Omit-when-empty (era rule).
     let attestedReadGate: UsdLayer["nomosAttestedReadGate"];
     {
-      type SrcSpec = NonNullable<UsdLayer["nomosAttestedReadGate"]>["sources"][string];
+      type Gate = NonNullable<UsdLayer["nomosAttestedReadGate"]>;
+      type SrcSpec = Gate["sources"][string];
+      type PolSpec = NonNullable<Gate["policies"]>[string];
+      type EdgeList = Gate["directives"][string];
       const srcs = new Map<string, SrcSpec>();
-      const dirs = new Map<string, { queryId: string; from: string }[]>();
+      const pols = new Map<string, PolSpec>();
+      const dirs = new Map<string, EdgeList>();
       for (const l of stack) {
         if (l.nomosAttestedReadGate === undefined) continue;
         for (const [ws, spec] of Object.entries(l.nomosAttestedReadGate.sources)) srcs.set(ws, spec);
+        for (const [id, spec] of Object.entries(l.nomosAttestedReadGate.policies ?? {})) pols.set(id, spec);
         for (const [id, edges] of Object.entries(l.nomosAttestedReadGate.directives)) dirs.set(id, edges);
       }
       if (dirs.size > 0) {
         const sourcesRec: Record<string, SrcSpec> = {};
         for (const k of [...srcs.keys()].sort()) sourcesRec[k] = srcs.get(k)!;
-        const directivesRec: Record<string, { queryId: string; from: string }[]> = {};
+        const policiesRec: Record<string, PolSpec> = {};
+        for (const k of [...pols.keys()].sort()) policiesRec[k] = pols.get(k)!;
+        const directivesRec: Record<string, EdgeList> = {};
         for (const k of [...dirs.keys()].sort()) directivesRec[k] = dirs.get(k)!;
-        attestedReadGate = { v: 1, sources: sourcesRec, directives: directivesRec };
+        attestedReadGate = {
+          v: 1,
+          sources: sourcesRec,
+          ...(Object.keys(policiesRec).length > 0 ? { policies: policiesRec } : {}),
+          directives: directivesRec,
+        };
       }
     }
     // THE BIRTH GATE (G3): the SORTED union of every layer's `.births()` directive ids. Omit-when-empty