@githolon/dsl 0.55.1 → 0.57.0

package/dart/test/webview_bridge_test.dart

@@ -239,6 +239,18 @@ Future<Object?> _invoke(
       return b.sync(admit: a['admit'] as bool);
     case 'lawStatus':
       return b.lawStatus(a['hash'] as String);
+    case 'offerDirective':
+      return b.offerDirective(
+        domain: a['domain'] as String,
+        directiveId: a['directiveId'] as String,
+        payload: a['payload'],
+        actor: a['actor'] as String?,
+        domainHash: a['domainHash'] as String?,
+        attestations: (a['attestations'] as List?)
+            ?.map((e) => (e as Map).cast<String, Object?>())
+            .toList(),
+        force: a['force'] as bool?,
+      );
     default:
       fail('corpus op not wired into the Dart bridge: $op');
   }
@@ -248,6 +260,7 @@ Future<Object?> _invoke(
 Object? _expectedTyped(String op, Map<String, Object?> result) {
   switch (op) {
     case 'offer':
+    case 'offerDirective':
       return result['head'];
     case 'query':
     case 'queryById':

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.55.1",
+  "version": "0.57.0",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/attested.ts

@@ -32,12 +32,21 @@ export {
   PARENT_TRUST_SENTINEL,
   foreignQuery,
   isTrustSourceDecl,
+  trustPolicy,
+  isTrustPolicyDecl,
+  fromPayload,
+  isFromPayloadRef,
   NomosSourceFrontier,
   sourceFrontierId,
   SOURCE_FRONTIER_PREFIX,
   __trustFor,
+  __policyFor,
   type TrustSourceDecl,
   type TrustSourceOptions,
+  type TrustPolicyDecl,
+  type TrustPolicyOptions,
+  type FromPayloadRef,
+  type ForeignReadEdge,
   type ForeignQueryRef,
 } from "./attested_core.js";
 

package/src/attested_core.ts

@@ -10,8 +10,8 @@
  * module-init cycle. The sanctioning ensure directive + the merge-seam injector live in
  * `attested.ts`. Full doctrine: `architecture/attested_reads_design.md`.
  */
-import { aggregate } from "./aggregate.js";
-import { t } from "./fields.js";
+import { aggregate, type AggregateHandle } from "./aggregate.js";
+import { t, type Field } from "./fields.js";
 import { Lww } from "./drivers.js";
 
 /** A lightweight reference to a query declared in the SOURCE workspace's law — the reader
@@ -125,6 +125,203 @@ export function isTrustSourceDecl(v: unknown): v is TrustSourceDecl {
   );
 }
 
+// ── DYNAMIC-SOURCE trust: a policy over a LAW-STATE allow-list (dynamic_source_attested_reads.md) ──
+// The static `trustSource("ws", …)` edge names a FIXED workspace; a `trustPolicy` instead names a
+// reader-side aggregate whose folded rows ARE the acceptable-source set — so the routed workspace is
+// chosen at RUNTIME (the payload names it) while the trust judgment (genesis + accepted keys) stays a
+// deterministic fold of the reader's own gated-enrolment writes. The gate resolves `att.source_genesis`
+// against the allow-list rows; the NAME is routing, the genesis + keys are identity.
+
+/** A marker naming a PAYLOAD FIELD that carries the routed source-workspace name at runtime — the
+ *  first argument of the dynamic `.readsFrom(fromPayload("field"), query, { policy })` overload. */
+export interface FromPayloadRef {
+  readonly payloadField: string;
+  /** brand — distinguishes the dynamic (payload-routed) lane from a static workspace-name string. */
+  readonly __nomosFromPayload: true;
+}
+
+/** Name the PAYLOAD FIELD whose value routes a dynamic attested read (see {@link FromPayloadRef}). */
+export function fromPayload(field: string): FromPayloadRef {
+  if (typeof field !== "string" || field.length === 0) {
+    throw new Error(`fromPayload(): the payload field name must be a non-empty string`);
+  }
+  return { payloadField: field, __nomosFromPayload: true };
+}
+
+/** Shape predicate — a {@link FromPayloadRef} vs a static workspace-name string. Library-internal. */
+export function isFromPayloadRef(v: unknown): v is FromPayloadRef {
+  return (
+    v !== null &&
+    typeof v === "object" &&
+    (v as { __nomosFromPayload?: unknown }).__nomosFromPayload === true &&
+    typeof (v as { payloadField?: unknown }).payloadField === "string"
+  );
+}
+
+/** The §4.4 freshness + allow-list vocabulary of one declared trust POLICY. */
+export interface TrustPolicyOptions {
+  /** The reader-side aggregate whose folded rows are the acceptable-source set (genesis + keyHashes
+   *  per row). Enrolling a row is a GATED WRITE (owner authority); revoking = archiving the row. */
+  readonly allowList: AggregateHandle;
+  /** The allow-list field (a `t.string()`) holding a row's source GENESIS oid. Inferred when the
+   *  aggregate has exactly one string field whose name contains "genesis"; else required. */
+  readonly genesisField?: string;
+  /** The allow-list field (a `t.set(t.string())`) holding a row's accepted attestor keyHashes.
+   *  Inferred when the aggregate has exactly one set-of-string field; else required. */
+  readonly keysField?: string;
+  /** §4.4a — wall-clock freshness bound in ms (judged against the intent's frozen HLC). */
+  readonly maxAgeMs?: number;
+  /** §4.4b — the epoch anchor: `"birth"` (the reader's own birth-cert epoch) or an integer floor. */
+  readonly minSourceEpoch?: "birth" | number;
+  /** §4.4c — maintain + enforce the monotone `SourceFrontier` (no regression per source genesis). */
+  readonly monotone?: boolean;
+  /** §5.3 — what a folded `SourceDishonor` fact does at verify: `"refuse"` or `"record"`. */
+  readonly onDishonor?: "refuse" | "record";
+}
+
+/** One declared trust POLICY — an exported {@link trustPolicy} value, auto-discovered by shape.
+ *  Lowered into the `nomosAttestedReadGate` era key's `policies` map. */
+export interface TrustPolicyDecl {
+  readonly policyId: string;
+  /** The resolved allow-list aggregate TYPE id. */
+  readonly allowListType: string;
+  /** The resolved genesis field LABEL. */
+  readonly genesisField: string;
+  /** The resolved keyHashes field LABEL. */
+  readonly keysField: string;
+  readonly maxAgeMs?: number;
+  readonly minSourceEpoch?: "birth" | number;
+  readonly monotone?: boolean;
+  readonly onDishonor?: "refuse" | "record";
+  readonly __nomosTrustPolicy: true;
+}
+
+// The runtime policy registry — the dynamic read lane resolves a policy's monotone posture through
+// the directive's readsFrom (which registers the queryId); this map lets the compile discovery + the
+// validators resolve a decl by id. Keyed by policyId; later declaration wins.
+const policyRegistry = new Map<string, TrustPolicyDecl>();
+
+/** The registered trust policy for an id (`undefined` = undeclared). Library-internal. */
+export function __policyFor(policyId: string): TrustPolicyDecl | undefined {
+  return policyRegistry.get(policyId);
+}
+
+/**
+ * DECLARE a dynamic trust POLICY (dynamic_source_attested_reads.md): the acceptable-source set is
+ * LAW-STATE — the folded rows of `allowList`, each a `{ <genesisField>: string, <keysField>:
+ * set-of-string }`. A directive routes a runtime-named source through this policy with
+ * `.readsFrom(fromPayload("wsField"), theQuery, { policy: thisDecl })`. Auto-discovered by shape and
+ * lowered into the `nomosAttestedReadGate` era key's `policies` map. The field names are inferred by
+ * shape (see {@link TrustPolicyOptions}) or given explicitly; a bad allow-list is a NAMED compile error.
+ */
+export function trustPolicy(policyId: string, opts: TrustPolicyOptions): TrustPolicyDecl {
+  const al = opts.allowList as AggregateHandle | undefined;
+  if (
+    al === null ||
+    typeof al !== "object" ||
+    (al as { __isAggregateHandle?: unknown }).__isAggregateHandle !== true
+  ) {
+    throw new Error(
+      `trustPolicy('${policyId}'): 'allowList' must be an aggregate handle — pass the aggregate(...) ` +
+        `whose rows hold the trusted sources ({ <genesis> string, <keyHashes> set-of-string })`,
+    );
+  }
+  const fields = al.fields as Record<string, Field>;
+  const stringFields = Object.keys(fields).filter((n) => (fields[n] as Field).kind === "string");
+  const setFields = Object.keys(fields).filter((n) => (fields[n] as Field).kind === "set");
+
+  let genesisField: string;
+  if (opts.genesisField !== undefined) {
+    if (!(opts.genesisField in fields)) {
+      throw new Error(
+        `trustPolicy('${policyId}'): genesisField '${opts.genesisField}' is not a field of aggregate '${al.id}'`,
+      );
+    }
+    if ((fields[opts.genesisField] as Field).kind !== "string") {
+      throw new Error(
+        `trustPolicy('${policyId}'): genesisField '${opts.genesisField}' must be a t.string() field (the source genesis oid)`,
+      );
+    }
+    genesisField = opts.genesisField;
+  } else {
+    const cands = stringFields.filter((n) => n.toLowerCase().includes("genesis"));
+    if (cands.length !== 1) {
+      throw new Error(
+        `trustPolicy('${policyId}'): cannot infer genesisField on aggregate '${al.id}' — declare exactly ` +
+          `ONE t.string() field whose name contains "genesis", or pass genesisField: "<name>" explicitly`,
+      );
+    }
+    genesisField = cands[0]!;
+  }
+
+  let keysField: string;
+  if (opts.keysField !== undefined) {
+    if (!(opts.keysField in fields)) {
+      throw new Error(
+        `trustPolicy('${policyId}'): keysField '${opts.keysField}' is not a field of aggregate '${al.id}'`,
+      );
+    }
+    if ((fields[opts.keysField] as Field).kind !== "set") {
+      throw new Error(
+        `trustPolicy('${policyId}'): keysField '${opts.keysField}' must be a t.set(t.string()) field (the accepted attestor keyHashes)`,
+      );
+    }
+    keysField = opts.keysField;
+  } else {
+    if (setFields.length !== 1) {
+      throw new Error(
+        `trustPolicy('${policyId}'): cannot infer keysField on aggregate '${al.id}' — declare exactly ` +
+          `ONE t.set(t.string()) field (the accepted attestor keyHashes), or pass keysField: "<name>" explicitly`,
+      );
+    }
+    keysField = setFields[0]!;
+  }
+
+  const decl: TrustPolicyDecl = {
+    policyId,
+    allowListType: al.id,
+    genesisField,
+    keysField,
+    ...(opts.maxAgeMs !== undefined ? { maxAgeMs: opts.maxAgeMs } : {}),
+    ...(opts.minSourceEpoch !== undefined ? { minSourceEpoch: opts.minSourceEpoch } : {}),
+    ...(opts.monotone !== undefined ? { monotone: opts.monotone } : {}),
+    ...(opts.onDishonor !== undefined ? { onDishonor: opts.onDishonor } : {}),
+    __nomosTrustPolicy: true,
+  };
+  policyRegistry.set(policyId, decl);
+  return decl;
+}
+
+/** Shape predicate for compile discovery (the `isTrustSourceDecl` pattern). */
+export function isTrustPolicyDecl(v: unknown): v is TrustPolicyDecl {
+  return (
+    v !== null &&
+    typeof v === "object" &&
+    (v as { __nomosTrustPolicy?: unknown }).__nomosTrustPolicy === true &&
+    typeof (v as { policyId?: unknown }).policyId === "string"
+  );
+}
+
+/** One declared foreign-read edge on a directive — a STATIC workspace edge or a dynamic policy edge.
+ *  The static edge emits `{queryId, from}`; the policy edge emits `{queryId, policy}` (the routing
+ *  `fromPayload` field is DSL-internal — the gate judges by genesis, the name is transport). */
+export type ForeignReadEdge =
+  | { readonly queryId: string; readonly from: string }
+  | { readonly queryId: string; readonly policy: string; readonly fromPayload: string };
+
+// A dynamic (policy-routed) read carries no declared `from` string, so the read lane cannot resolve
+// its monotone posture through `__trustFor(name)`. The directive's readsFrom registers the queryId of
+// every MONOTONE policy edge here; the foreign read lane consults it to record the SourceFrontier.
+const monotoneForeignQueries = new Set<string>();
+/** Register a foreign query id whose governing policy is monotone. Library-internal. */
+export function __registerMonotoneForeignQuery(queryId: string): void {
+  monotoneForeignQueries.add(queryId);
+}
+/** Is a foreign query governed by a monotone policy edge? Library-internal. */
+export function __isMonotoneForeignQuery(queryId: string): boolean {
+  return monotoneForeignQueries.has(queryId);
+}
+
 // ── the SourceFrontier (§4.4c) — the reader-side monotone record of the source's position ──────
 
 /** The deterministic instance-id prefix — `source-frontier:<source_genesis>` (keyed by the source's

package/src/build_package.ts

@@ -61,7 +61,13 @@ import {
 } from "./birth_meter.js";
 import { withBirthMeterExports } from "./birth_meter_ensure.js";
 import { withClearDirectives } from "./clear_directive.js";
-import { withAttestedReadExports, isTrustSourceDecl, type TrustSourceDecl } from "./attested.js";
+import {
+  withAttestedReadExports,
+  isTrustSourceDecl,
+  isTrustPolicyDecl,
+  type TrustSourceDecl,
+  type TrustPolicyDecl,
+} from "./attested.js";
 import type { RelationTypeDecl } from "./relation_schema.js";
 import { domainHash, emitManifestBytes } from "./manifest.js";
 import { collectValueObjectDescriptors } from "./value_object.js";
@@ -336,6 +342,15 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   const trustSources = [...trustByWs.values()].sort((a, b) =>
     a.workspace < b.workspace ? -1 : a.workspace > b.workspace ? 1 : 0,
   );
+  // Dynamic-source trust POLICIES (dynamic_source_attested_reads.md) — discovered by shape like
+  // trustSource. Later-wins by policy id; sorted for byte-determinism.
+  const policyById = new Map<string, TrustPolicyDecl>();
+  for (const v of Object.values(merged)) {
+    if (isTrustPolicyDecl(v)) policyById.set(v.policyId, v);
+  }
+  const trustPolicies = [...policyById.values()].sort((a, b) =>
+    a.policyId < b.policyId ? -1 : a.policyId > b.policyId ? 1 : 0,
+  );
   const pabMarker =
     parentAttestedBirthMarker(merged) ??
     spec.modules.map((m) => parentAttestedBirthMarker(m)).find((x) => x !== null) ??
@@ -385,6 +400,7 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
     // Omit-when-empty — the nomosAttestedReadGate era rule: a domain with no declared trust
     // edge is byte-identical in the canonical manifest/USD.
     ...(trustSources.length > 0 ? { trustSources } : {}),
+    ...(trustPolicies.length > 0 ? { trustPolicies } : {}),
     ...(dartImports.length > 0 ? { dartImports } : {}),
     ...(spec.dartRefImports !== undefined && spec.dartRefImports.length > 0
       ? { dartRefImports: [...spec.dartRefImports] }

package/src/codegen_dart.ts

@@ -3488,6 +3488,13 @@ export interface DomainModule {
    * ADDITIVE + OPTIONAL: a domain with no trust edge omits this and is byte-identical (era rule).
    */
   trustSources?: import("./attested.js").TrustSourceDecl[];
+  /**
+   * The domain's DYNAMIC-SOURCE TRUST POLICIES (dynamic_source_attested_reads.md): the exported
+   * `trustPolicy(id, { allowList, … })` declarations, discovered by shape. Lowered — together with
+   * directives' `.readsFrom(fromPayload(…), query, { policy })` edges — into the `nomosAttestedReadGate`
+   * era key's `policies` map. ADDITIVE + OPTIONAL: a policy-free domain omits this (era rule).
+   */
+  trustPolicies?: import("./attested.js").TrustPolicyDecl[];
   /**
    * The domain's NATIVE ZANZIBAR RELATION SCHEMA (`relation_schema.ts` — the userset-rewrite law,
    * P1). Pure-data per-type relation rewrites lowered to the `nomosRelations` USD era key (NO JS on

package/src/codegen_proof.ts

@@ -1884,7 +1884,20 @@ export interface ProofLegs {
 function isStandaloneCreate(d: Directive<unknown> | undefined): boolean {
   return d?.marker === "creates" && typeof d.payloadSchema === "object"
     && d.birthsChild !== true && d.attestationAuthorizedGate === undefined
-    && d.requiresRelationGate === undefined;
+    && d.requiresRelationGate === undefined
+    // NOT a foreign-read directive (`.readsFrom(...)` — a static attested edge or a dynamic
+    // policy edge): its plan reads a SIGNED cross-workspace attestation the single-workspace
+    // offline proof plane cannot mint (that needs a second SOURCE workspace + its attestor key).
+    // Dispatched offline it would throw at the un-served read; proven instead by the two-workspace
+    // smoke (bench/scale/{attested_reads.test,dynamic_attested_reads.smoke}.mjs). Named below.
+    && (((d as { declaredForeignReads?: readonly unknown[] }).declaredForeignReads?.length ?? 0) === 0);
+}
+
+/** Does this module carry ≥1 foreign-read directive (a static or dynamic-policy `.readsFrom`)? */
+function hasForeignReadDirective(mod: DomainModule): boolean {
+  return (mod.directives as Directive<unknown>[]).some(
+    (d) => ((d as { declaredForeignReads?: readonly unknown[] }).declaredForeignReads?.length ?? 0) > 0,
+  );
 }
 
 /** Does `v` carry an RFC 7946 geometry object at `segs` (walked into the composite)? */
@@ -2772,6 +2785,23 @@ export function generateTsProof(modules: readonly DomainModule[], opts: TsProofO
     );
   }
 
+  // THE ATTESTED / DYNAMIC-POLICY FOREIGN-READ LEG — named, honestly SKIPPED here. A `.readsFrom(...)`
+  // directive's plan reads a SIGNED cross-workspace attestation; proving it needs a SECOND source
+  // workspace, its read-attestor key, and a served+signed envelope — none of which the single-workspace,
+  // client-driven offline proof plane can mint (the client has no `attestedRead` serving op). The full
+  // offline two-workspace proof (birth a scratch source → seed a row → enrol its genesis → attested read
+  // through the policy edge → admitted, plus the wrong-genesis/unenrolled negative + revocation +
+  // verify_chain) lives in the bench harness against the real wasm.
+  if (hasForeignReadDirective(mod)) {
+    out.push(
+      `// ${n()}. attested foreign-read leg: a .readsFrom(...) directive reads a SIGNED cross-workspace`,
+      `//    attestation — proving it needs a second SOURCE workspace + its attestor key, which this`,
+      `//    single-workspace client proof cannot mint. Proven in the two-workspace bench smoke.`,
+      `console.log("– attested foreign-read leg SKIPPED — a .readsFrom(...) attested/policy read is proven in the two-workspace bench harness (bench/scale/{attested_reads.test,dynamic_attested_reads.smoke}.mjs), not this single-workspace offline proof");`,
+      ``,
+    );
+  }
+
   // THE AUTHORITY-CONFORMANCE LEG (the one-encoder + gate proof): runs on the LOCAL holon (fetch re-trapped),
   // proving the generated client threads security.actor through THE ONE ENCODER and that an actorless gated
   // offer is impossible to GENERATE (throws MissingOfferAuthority before any submit). No-op when un-gated.

package/src/directive.ts

@@ -24,6 +24,14 @@ import type { CertifiedReadDecl } from "./certified_read.js";
 import type { RelationDecl } from "./relation.js";
 import type { QueryDecl } from "./query.js";
 import { BIRTH_METER_QUERIES } from "./birth_meter.js";
+import {
+  isFromPayloadRef,
+  isTrustPolicyDecl,
+  __registerMonotoneForeignQuery,
+  type FromPayloadRef,
+  type TrustPolicyDecl,
+  type ForeignReadEdge,
+} from "./attested_core.js";
 
 export type ReferentialMarker = "creates" | "mutates" | "ensures" | "archives";
 
@@ -183,7 +191,7 @@ export interface Directive<P = unknown> {
    * era key. OPTIONAL + ADDITIVE; OMITTED when empty (a foreign-read-free directive is
    * byte-identical — the era rule).
    */
-  readonly declaredForeignReads?: { queryId: string; from: string }[];
+  readonly declaredForeignReads?: ForeignReadEdge[];
   /**
    * The directive's DECLARED emit boundary: the event types its `plan` may EMIT,
    * each with an optional `max` bound. Part of the domain identity. Defaults to `{}`
@@ -331,6 +339,18 @@ export interface RequirableDirective<P> extends Directive<P> {
    * times; deduped by `(queryId, from)`. Purely additive (the era rule).
    */
   readsFrom(sourceWorkspace: string, query: { id: string }): RequirableDirective<P>;
+  /**
+   * Declare ONE DYNAMIC (payload-routed) foreign read (dynamic_source_attested_reads.md): the plan may
+   * `read(theQuery, args, { from: payload.<field> })` — the routed workspace is chosen at runtime by the
+   * named payload field, while the trust judgment (genesis + accepted attestor keys) is a fold of the
+   * reader's own {@link TrustPolicyDecl} allow-list. Lowered into the era key as a `{queryId, policy}`
+   * edge (the routing field is DSL-internal — the gate judges by genesis, the name is transport).
+   */
+  readsFrom(
+    source: FromPayloadRef,
+    query: { id: string },
+    opts: { policy: TrustPolicyDecl },
+  ): RequirableDirective<P>;
   /**
    * Declare ONE entry of the directive's EMIT boundary: an `eventType` its `plan` may
    * emit, with an optional `max` count bound. Callable MULTIPLE times to accumulate
@@ -671,17 +691,41 @@ function makeRequirable<P>(base: Directive<P>): RequirableDirective<P> {
       const mergedQueries = [...byId.values()].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
       return makeRequirable({ ...base, declaredReads: merged, declaredQueryReads: mergedQueries });
     },
-    readsFrom(sourceWorkspace: string, query: { id: string }): RequirableDirective<P> {
-      // ATTESTED CROSS-WORKSPACE READ (slice B): accumulate the (queryId, from) trust edge,
-      // dedup by pair, sort (only the SET is the contract — byte-determinism for the era key).
+    readsFrom(
+      source: string | FromPayloadRef,
+      query: { id: string },
+      opts?: { policy: TrustPolicyDecl },
+    ): RequirableDirective<P> {
+      // ATTESTED CROSS-WORKSPACE READ (slice B + dynamic policies): accumulate a STATIC (queryId, from)
+      // edge OR a DYNAMIC (queryId, policy, fromPayload) edge, dedup by canonical key, sort (only the
+      // SET is the contract — byte-determinism for the era key).
+      let entry: ForeignReadEdge;
+      if (isFromPayloadRef(source)) {
+        const policy = opts?.policy;
+        if (policy === undefined) {
+          throw new Error(
+            `readsFrom(fromPayload('${source.payloadField}'), '${query.id}'): a payload-routed foreign ` +
+              `read REQUIRES a trust policy — pass { policy: <trustPolicy(...) decl> } (the acceptable ` +
+              `sources are LAW-STATE, so the runtime-named workspace is judged against a folded allow-list).`,
+          );
+        }
+        if (!isTrustPolicyDecl(policy)) {
+          throw new Error(
+            `readsFrom(fromPayload('${source.payloadField}'), '${query.id}'): { policy } must be a ` +
+              `trustPolicy(...) declaration.`,
+          );
+        }
+        entry = { queryId: query.id, policy: policy.policyId, fromPayload: source.payloadField };
+        if (policy.monotone === true) __registerMonotoneForeignQuery(query.id);
+      } else {
+        entry = { queryId: query.id, from: source };
+      }
+      const canon = (e: ForeignReadEdge): string =>
+        "from" in e ? `0${e.from}${e.queryId}` : `1${e.policy}${e.fromPayload}${e.queryId}`;
       const prior = base.declaredForeignReads ?? [];
-      const key = (e: { queryId: string; from: string }) => `${e.from}\u0000${e.queryId}`;
-      const byKey = new Map<string, { queryId: string; from: string }>(prior.map((e) => [key(e), e]));
-      const entry = { queryId: query.id, from: sourceWorkspace };
-      byKey.set(key(entry), entry);
-      const merged = [...byKey.values()].sort((a, b) =>
-        a.from !== b.from ? (a.from < b.from ? -1 : 1) : a.queryId < b.queryId ? -1 : a.queryId > b.queryId ? 1 : 0,
-      );
+      const byKey = new Map<string, ForeignReadEdge>(prior.map((e) => [canon(e), e]));
+      byKey.set(canon(entry), entry);
+      const merged = [...byKey.values()].sort((a, b) => (canon(a) < canon(b) ? -1 : canon(a) > canon(b) ? 1 : 0));
       return makeRequirable({ ...base, declaredForeignReads: merged });
     },
     emits(eventType: string, opts?: { max?: number }): RequirableDirective<P> {

package/src/index.ts

@@ -148,12 +148,18 @@ export {
   trustParent,
   PARENT_TRUST_SENTINEL,
   foreignQuery,
+  trustPolicy,
+  fromPayload,
   NomosSourceFrontier,
   sourceFrontierId,
   SOURCE_FRONTIER_PREFIX,
   nomosSourceFrontierEnsure,
   type TrustSourceDecl,
   type TrustSourceOptions,
+  type TrustPolicyDecl,
+  type TrustPolicyOptions,
+  type FromPayloadRef,
+  type ForeignReadEdge,
   type ForeignQueryRef,
 } from "./attested.js";
 // ATTESTATION RECEIPTS + EQUIVOCATION ACCOUNTABILITY (slice B stage 3 — §5): the source-side

package/src/law_check.ts

@@ -44,6 +44,7 @@ import { finishSum } from "./sum.js";
 import { finishExtremum } from "./extremum.js";
 import { finishExists } from "./exists.js";
 import { clearDirectiveId } from "./clear_directive.js";
+import type { ForeignReadEdge } from "./attested_core.js";
 
 /** One author-time finding — the gate refusal pre-fired at compile, or a courtesy note. */
 export interface Finding {
@@ -994,6 +995,111 @@ function topLevelPortReadFindings(mod: DomainModule, portReadingDomains: Readonl
   ];
 }
 
+// ── ATTESTED-READ twins (dynamic_source_attested_reads.md §"proof + check") ──────────────────────
+// (a) a foreign read whose (directive, query) has no declared trust edge → REFUSE naming the fix;
+// (b) a trustPolicy whose allow-list aggregate has no directive writing it → WARN (unpopulatable);
+// (c) a query declared BOTH as a local .reads() premise AND a foreign policy read → REFUSE (laundering).
+
+/** The FOREIGN query ids a directive's plan actually reads (`read(q, …, { from })`) on the one probe
+ *  sample — `undefined` when the plan can't be probed (unsynthesizable payload / it threw). A clean re-run
+ *  under a read port that answers both lanes; every side-effect sink is drained (never leaks). */
+function foreignReadsPerformed(dir: Directive<unknown>, where: string): Set<string> | undefined {
+  let synth: SynthesizedPayload;
+  try {
+    synth = synthesizePayload(dir.payloadSchema as z.ZodTypeAny, where);
+  } catch {
+    return undefined;
+  }
+  const payload: Record<string, unknown> = { ...synth.value };
+  for (const f of synth.autoStamped) payload[f] = "2026-01-01T00:00:00Z";
+  const performed = new Set<string>();
+  let ok = true;
+  withBirthProbeGlobals(() => {
+    const g = globalThis as unknown as { nomos: Record<string, unknown> };
+    const prevRead = g.nomos.read;
+    const stubRows = [{ id: "probe", data: {} }];
+    g.nomos.read = (_q: string, _a: unknown, o?: { from?: string }) =>
+      o?.from
+        ? {
+            rows: stubRows,
+            attestation: { v: 1, source_genesis: "probe-genesis", source_head: "h", source_epoch: 0, attested_at_ms: 0 },
+          }
+        : stubRows;
+    __resetAuthoring();
+    __resetReads();
+    try {
+      dir.plan(payload as never, deterministicPorts({ physical: 1, replica: 1, principal: "principal:probe" }));
+      for (const r of __drainReads()) {
+        if ((r as { attestation?: unknown }).attestation !== undefined) performed.add(r.queryId);
+      }
+    } catch {
+      ok = false;
+    } finally {
+      try { __drainAuthoring(); } catch { /* drained */ }
+      try { __drainReads(); } catch { /* drained */ }
+      g.nomos.read = prevRead;
+    }
+  });
+  return ok ? performed : undefined;
+}
+
+function attestedReadFindings(mod: DomainModule): Finding[] {
+  const domain = mod.domain ?? mod.name;
+  const findings: Finding[] = [];
+  const directives = mod.directives as Directive<unknown>[];
+
+  // (b) unpopulatable trust set — a policy allow-list no directive writes.
+  const writtenTypes = new Set(directives.map((d) => (d as { aggregateId?: string }).aggregateId).filter(Boolean) as string[]);
+  for (const pol of mod.trustPolicies ?? []) {
+    if (!writtenTypes.has(pol.allowListType)) {
+      findings.push({
+        domain,
+        level: "warn",
+        what: `trustPolicy '${pol.policyId}' trusts sources enrolled in aggregate '${pol.allowListType}', but NO directive in this domain writes that aggregate — the trust set is unpopulatable (no gated enrolment lane), so every dynamic read under this policy will refuse (untrusted source)`,
+        fix: `add a gated enrolment directive, e.g. directive("enroll…").creates(${pol.allowListType}).requires("<ownerCap>") whose payload carries { <genesis> string, <keyHashes> string[] }`,
+      });
+    }
+  }
+
+  for (const dir of directives) {
+    const edges = (dir as { declaredForeignReads?: ForeignReadEdge[] }).declaredForeignReads ?? [];
+    const declaredQueryIds = new Set(edges.map((e) => e.queryId));
+    const localQueryIds = new Set(
+      ((dir as { declaredQueryReads?: { id: string }[] }).declaredQueryReads ?? []).map((q) => q.id),
+    );
+
+    // (c) laundering — a query cannot be both a local .reads() premise AND a foreign read.
+    for (const qid of declaredQueryIds) {
+      if (localQueryIds.has(qid)) {
+        findings.push({
+          domain,
+          directiveId: dir.id,
+          level: "refuse",
+          what: `query '${qid}' is declared BOTH as a local .reads() premise AND a foreign read on directive '${dir.id}' — a query cannot be both local (same-workspace CAS) and foreign (a signed cross-workspace attestation)`,
+          fix: `drop one: keep .reads(${qid}) for a same-workspace captured read, OR keep the foreign .readsFrom(...) edge and remove the local .reads(${qid})`,
+        });
+      }
+    }
+
+    // (a) an undeclared foreign read — the plan routes read(q, …, { from }) with no trust edge for q.
+    const performed = foreignReadsPerformed(dir, `${domain}/${dir.id}`);
+    if (performed !== undefined) {
+      for (const qid of performed) {
+        if (!declaredQueryIds.has(qid)) {
+          findings.push({
+            domain,
+            directiveId: dir.id,
+            level: "refuse",
+            what: `directive '${dir.id}' reads a foreign workspace — read('${qid}', …, { from }) — but declares no trust edge for '${qid}', so the gate refuses it on every lane`,
+            fix: `declare the edge: .readsFrom(fromPayload("<wsField>"), <${qid} query>, { policy: <trustPolicy(...) decl> }) for a payload-routed source, or .readsFrom("<ws>", <query>) + trustSource("<ws>", …) for a fixed one`,
+          });
+        }
+      }
+    }
+  }
+  return findings;
+}
+
 /**
  * Run every author-time twin over the composed domain modules and return the findings, ordered
  * refuse → warn → note (stable within a level, by domain/directive appearance). This is the ONE
@@ -1044,6 +1150,7 @@ export function checkDomainModules(
     findings.push(...dottedQueryKeyFindings(mod, aggById));
     findings.push(...nullBanFindings(mod, aggById));
     findings.push(...nullClearAuthorityFindings(mod, aggById));
+    findings.push(...attestedReadFindings(mod));
   }
 
   // The BIRTH-RECIPE twin (unify): fold the scattered `.births()` recipe diagnostics into the

package/src/read.ts

@@ -19,7 +19,7 @@
  */
 import type { QueryDecl } from "./query.js";
 import type { WireRead, WireReadAttestation } from "./wire.js";
-import { NomosSourceFrontier, sourceFrontierId, __trustFor, __ensure } from "./attested_core.js";
+import { NomosSourceFrontier, sourceFrontierId, __trustFor, __isMonotoneForeignQuery, __ensure } from "./attested_core.js";
 
 // ── the per-dispatch read footprint — library state drained by `executeDirectiveToIntent` (mirrors the authoring sink) ──
 let footprint: WireRead[] = [];
@@ -101,7 +101,10 @@ export function read<T = unknown>(
     );
   }
   footprint.push({ queryId: query.id, args, result: answer.rows, attestation: att });
-  if (__trustFor(from)?.monotone === true) {
+  // `from` is a STATIC declared workspace for a trustSource edge, or a RUNTIME payload value for a
+  // dynamic policy edge — so the monotone posture comes either from the static edge (`__trustFor`) or
+  // from the policy the directive registered for this query id. Either way the frontier is genesis-keyed.
+  if (__trustFor(from)?.monotone === true || __isMonotoneForeignQuery(query.id)) {
     const frontier = __ensure(NomosSourceFrontier, sourceFrontierId(att.source_genesis)) as {
       set(f: string, v: unknown): unknown;
     };