@githolon/dsl 0.7.1 → 0.9.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.7.1",
+  "version": "0.9.0",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/aggregate.ts

@@ -26,25 +26,28 @@ export type AggregateInvariantVerdict = { accept: true } | { reject: string };
 export type AggregateInvariantFn = (snapshot: Record<string, unknown>) => AggregateInvariantVerdict;
 
 /**
- * READ VISIBILITY (slice 5.1, `host_routes_only.md` §5.1) — the DECLARED posture
- * of an aggregate's data on the read side. `public` (the DEFAULT, and the only
- * value before this existed) means any peer may read the type; `requires(cap)`
- * makes the type PRIVATE: a read that touches it (a `query` returning it, a
- * `count`/`sum` over it, a by-id read of one of its instances) is served ONLY to a
- * principal that effectively holds `cap` in THIS workspace's own folded
- * role-bindings (the kernel `identity::authz` path, lifted from the write gate).
+ * READ VISIBILITY (the native-relations read gate) — the DECLARED posture of an
+ * aggregate's data on the read side. `public` (the DEFAULT, and the only value
+ * before this existed) means any peer may read the type; `requires(cap)` makes the
+ * type PRIVATE: a read that touches it (a `query` returning it, a `count`/`sum`
+ * over it, a by-id read of one of its instances) is served ONLY to a principal that
+ * holds the read RELATION `cap` on the workspace-scope object — decided by the ONE
+ * native Zanzibar `RewriteEngine.check` over THIS workspace's own folded relation
+ * tuples (`nomos_identity::relations`, the SAME evaluator the write gate uses).
  *
  * THE LAW DECIDES, NOT THE HOST: the visibility rides IN the law package (the
- * `nomosReadVisibility` USD era key — OMITTED when every aggregate is public, so
- * an all-public domain hashes byte-identically to before this existed) and the
- * githolon enforces it at the one wasm read boundary. The host only STAMPS the
- * presented principal (an impure identity read) and relays the githolon's verdict.
+ * `nomosReadVisibility` USD era key — type → required cap — OMITTED when every
+ * aggregate is public, so an all-public domain hashes byte-identically to before
+ * this existed), and the compiler ALSO synthesizes a `workspace#<cap>` relation into
+ * `nomosRelations` so the cap is a checkable native relation. The githolon enforces
+ * it at the one wasm read boundary; the host only STAMPS the presented principal (an
+ * impure identity read) and relays the githolon's verdict.
  *
- * `cap` is a CAPABILITY NAME (the same vocabulary as a role's caps / a directive
- * name — see `framework/rbac.ts`): the workspace's owner authors a `grant` of a
- * role carrying `cap` to the reader's principal (e.g. at birth, over the
- * secret-gated author lane). A degenerate identity catalogue (role ≡ cap) means
- * "holds an active, unexpired, non-revoked binding whose role grants `cap`".
+ * `cap` is the read RELATION NAME (the same vocabulary as a directive's required
+ * relation): the workspace's owner authors a `relateSubject` tuple
+ * `workspace:self#<cap>@user:<principal>` to the reader (e.g. at birth, over the
+ * secret-gated author lane). Holding the relation (an active, non-revoked tuple) =
+ * may read.
  */
 export type ReadVisibility = { readonly requires: string };
 

package/src/build_package.ts

@@ -52,6 +52,7 @@ import type { CombinedDecl } from "./combined.js";
 import type { ImpureCapabilityDecl } from "./codegen_provider_dart.js";
 import type { WorkspaceTypeDecl } from "./workspace_type.js";
 import type { WorkspaceInvariantDecl } from "./framework/workspace_invariant.js";
+import type { RelationTypeDecl } from "./relation_schema.js";
 import { domainHash, emitManifestBytes } from "./manifest.js";
 import { emitUsd } from "./usd.js";
 import { expandCapabilityExports } from "./capability_exports.js";
@@ -121,6 +122,8 @@ export interface DomainModuleSpec {
   readonly workspaceTypes?: readonly WorkspaceTypeDecl[];
   /** Declared workspace invariants (#266) — presence is hashed; bodies ship in the lump. */
   readonly workspaceInvariants?: readonly WorkspaceInvariantDecl[];
+  /** Native Zanzibar relation schema (P1) — pure-data rewrites → the `nomosRelations` era key. */
+  readonly relationTypes?: readonly RelationTypeDecl[];
   readonly dartImports?: readonly DartImport[];
   readonly dartRefImports?: DomainModule["dartRefImports"];
   readonly permissionVocabulary?: PermissionVocabulary;
@@ -176,6 +179,7 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   const maxes = [...(spec.maxes ?? [])];
   const workspaceTypes = [...(spec.workspaceTypes ?? [])];
   const workspaceInvariants = [...(spec.workspaceInvariants ?? [])];
+  const relationTypes = [...(spec.relationTypes ?? [])];
   const dartImports = [...(spec.dartImports ?? [])];
 
   return {
@@ -200,6 +204,9 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
     // Omit-when-empty — presence-only hashed law (#266): an invariant-free domain's
     // canonical manifest must stay byte-identical (adding/removing an invariant moves it).
     ...(workspaceInvariants.length > 0 ? { workspaceInvariants } : {}),
+    // Omit-when-empty — the relation schema is hashed law (P1); a relation-free domain's
+    // canonical manifest/USD stays byte-identical (the nomosRelations era rule).
+    ...(relationTypes.length > 0 ? { relationTypes } : {}),
     ...(dartImports.length > 0 ? { dartImports } : {}),
     ...(spec.dartRefImports !== undefined && spec.dartRefImports.length > 0
       ? { dartRefImports: [...spec.dartRefImports] }

package/src/codegen_dart.ts

@@ -31,6 +31,7 @@
 import { z } from "zod";
 import type { AggregateHandle } from "./aggregate.js";
 import type { WorkspaceInvariantDecl } from "./framework/workspace_invariant.js";
+import type { RelationTypeDecl } from "./relation_schema.js";
 import type { Field, FieldKind } from "./fields.js";
 import type { Directive } from "./directive.js";
 import { executeDirectiveToIntent } from "./wire_encode.js";
@@ -611,6 +612,13 @@ function aggFieldSpec(
     }
     case "int":
       return { name, wireName, kind: field.kind, dartType: "int", optional };
+    // A PN-COUNTER reads as its net count and a POSITION as its order-key — the read model collapses
+    // them (kernel `observed_value`) to a scalar Int / Str, so codegen treats them AS `int` / `string`
+    // (the spec carries the NORMALIZED kind so every downstream reader path is unchanged).
+    case "counter":
+      return { name, wireName, kind: "int", dartType: "int", optional };
+    case "position":
+      return { name, wireName, kind: "string", dartType: valueClass ?? "String", optional, ...(valueClass !== undefined ? { valueClass } : {}) };
     case "bool":
       return { name, wireName, kind: field.kind, dartType: "bool", optional };
     case "enum": {
@@ -1194,6 +1202,8 @@ function parseField(s: AggFieldSpec, aggregate: string): string {
         ? `() { final v = ${reader}; return v == null ? null : ${s.refIdClass}.fromRow(v); }()`
         : `${s.refIdClass}.fromRow(${reader})`;
     }
+    // `position` normalizes to `string`, `counter` to `int` in `aggFieldSpec` — unreachable here.
+    case "position":
     case "string":
       if (s.valueClass !== undefined) {
         const reader = opt
@@ -1216,6 +1226,7 @@ function parseField(s: AggFieldSpec, aggregate: string): string {
       // The projection decodes a bool field to a real JSON boolean — read it directly (no runtime
       // helper). Optional → nullable cast; required → a plain cast (absent ⇒ throws, like readInt).
       return opt ? `(data['${s.wireName}'] as bool?)` : `(data['${s.wireName}'] as bool)`;
+    case "counter":
     case "int":
       return opt
         ? `readIntOrNull(data, '${aggregate}', '${s.wireName}')`
@@ -1276,8 +1287,12 @@ function readModelDartType(s: AggFieldSpec): string {
       // leaf — the kernel `Value` is Str|Int only), so it is surfaced as the permissive
       // `Object?` (the read engine's decoded value as-is — never coerced/thrown).
       return isJsonObjectLeaf(s) ? "Map<String, Object?>" : "Object?";
+    // `position`/`counter` are normalized to `string`/`int` in `aggFieldSpec` (read-collapsed scalars),
+    // so these labels are unreachable at runtime — present for FieldKind exhaustiveness.
+    case "position":
     case "string":
       return s.valueClass ?? "String";
+    case "counter":
     case "int":
       return "int";
     case "bool":
@@ -1326,6 +1341,7 @@ function parseReadModelField(s: AggFieldSpec, aggregate: string): string {
         ? `() { final v = ${reader}; return v == null ? null : ${s.refIdClass}.fromRow(v); }()`
         : `${s.refIdClass}.fromRow(${reader})`;
     }
+    case "position":
     case "string":
       if (s.valueClass !== undefined) {
         const reader = opt
@@ -1354,6 +1370,7 @@ function parseReadModelField(s: AggFieldSpec, aggregate: string): string {
         : `readJsonObject(data, '${aggregate}', '${s.wireName}')`;
     case "bool":
       return opt ? `(data['${s.wireName}'] as bool?)` : `(data['${s.wireName}'] as bool)`;
+    case "counter":
     case "int":
       return opt
         ? `readIntOrNull(data, '${aggregate}', '${s.wireName}')`
@@ -2427,6 +2444,14 @@ export interface DomainModule {
    * aggregate `hasInvariant` / a directive `plan`). See `docs/workspace_invariant.md`.
    */
   workspaceInvariants?: WorkspaceInvariantDecl[];
+  /**
+   * The domain's NATIVE ZANZIBAR RELATION SCHEMA (`relation_schema.ts` — the userset-rewrite law,
+   * P1). Pure-data per-type relation rewrites lowered to the `nomosRelations` USD era key (NO JS on
+   * the schema path). ADDITIVE + OPTIONAL: a domain that declares none omits this entirely and is
+   * byte-identical in the canonical manifest to before the key existed (era rule). PRESENCE + the
+   * AST is hashed; the recursive Check/Expand EVALUATOR is the Rust engine substrate, never authored.
+   */
+  relationTypes?: RelationTypeDecl[];
   /**
    * The domain's FIRST-CLASS WORKSPACE TYPES (`workspace_type.ts`; sharding §10
    * RATIFIED, slice 1) — the law-declared workspace taxonomy

package/src/codegen_ts.ts

@@ -229,6 +229,12 @@ function tsTypeOfField(field: Field): string {
       return "string";
     case "int":
       return "number";
+    // STRUCTURAL CRDT scalars (read-collapsed): a counter reads as its net number, a position as its
+    // order-key string (kernel `observed_value` → the projection surfaces a plain scalar).
+    case "counter":
+      return "number";
+    case "position":
+      return "string";
     case "bool":
       return "boolean";
     case "enum":
@@ -451,8 +457,11 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       `  authToken?: string;`,
       `  /** Transitional bare principal uid, sent as \`x-nomos-principal\` (no token). */`,
       `  principal?: string;`,
-      `  /** Bearer credential when the lane is gated (platform admin key / invite key). */`,
+      `  /** Bearer credential when the lane is gated (an invite/creation key). */`,
       `  bearer?: string;`,
+      `  /** Platform births: the founding admin key YOU choose (sent as \`x-nomos-platform-admin-key\`). The`,
+      `   *  host never mints or returns one — keep this; it is the AdminGrant of the platform's governance. */`,
+      `  platformAdminKey?: string;`,
       `}`,
       ``,
       `/** A birth lane's response — \`workspace\` is the born holon's addressable name. */`,
@@ -462,8 +471,6 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       `  workspace?: string;`,
       `  /** Returned ONCE at birth — the workspace's deploy credential. SAVE IT. */`,
       `  workspaceSecret?: string;`,
-      `  /** Platform births only — the platform's own governance credential, ONCE. */`,
-      `  platformAdminKey?: string;`,
       `  error?: string;`,
       `  [k: string]: unknown;`,
       `}`,
@@ -473,6 +480,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       `  if (auth.authToken !== undefined) headers["x-nomos-auth"] = auth.authToken;`,
       `  if (auth.principal !== undefined) headers["x-nomos-principal"] = auth.principal;`,
       `  if (auth.bearer !== undefined) headers["authorization"] = \`Bearer \${auth.bearer}\`;`,
+      `  if (auth.platformAdminKey !== undefined) headers["x-nomos-platform-admin-key"] = auth.platformAdminKey;`,
       `  const res = await fetch(\`\${cloud.replace(/\\/$/, "")}\${path}\`, { method: "POST", headers });`,
       `  return (await res.json()) as NomosBirthResult;`,
       `};`,
@@ -507,11 +515,11 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
           // A TOP-LEVEL type: births directly under the cloud.
           emit(
             fnName(t.id),
-            `Birth a '${t.id}' workspace${isPlatform ? " (a platform-kind coordinator: hosts its own subtree)" : ""} — derived from the taxonomy over the existing ${isPlatform ? "platform" : "workspace"} lane.`,
-            isPlatform ? [`name: string`] : [`name: string`, `tier?: "edge" | "heavy"`],
+            `Birth a '${t.id}' workspace${isPlatform ? " (a platform-kind coordinator: hosts its own subtree; PRESENT your chosen platformAdminKey)" : ""} — derived from the taxonomy over the existing ${isPlatform ? "platform" : "workspace"} lane. Placement is automatic (measured shape) — no tier to pick.`,
+            isPlatform ? [`name: string`, `platformAdminKey: string`] : [`name: string`],
             isPlatform
               ? `\`/v1/platforms/\${encodeURIComponent(opts.name)}\``
-              : `\`/v1/workspaces/\${encodeURIComponent(opts.name)}\${opts.tier === "heavy" ? "?tier=heavy" : ""}\``,
+              : `\`/v1/workspaces/\${encodeURIComponent(opts.name)}\``,
           );
         }
         for (const childId of t.childIds) {
@@ -521,13 +529,13 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
           const childIsPlatform = child.childIds.length > 0;
           emit(
             fnName(child.id),
-            `Birth a '${child.id}' under a '${t.id}' — the taxonomy's hasMany edge over the existing platform lane (lineage + pool enforced by the parent's law).`,
+            `Birth a '${child.id}' under a '${t.id}' — the taxonomy's hasMany edge over the existing platform lane (lineage + pool enforced by the parent's law).${childIsPlatform ? " PRESENT your chosen platformAdminKey." : ""} Placement is automatic (measured shape).`,
             childIsPlatform
-              ? [`${parentParam}: string`, `name: string`]
-              : [`${parentParam}: string`, `name: string`, `tier?: "edge" | "heavy"`],
+              ? [`${parentParam}: string`, `name: string`, `platformAdminKey: string`]
+              : [`${parentParam}: string`, `name: string`],
             childIsPlatform
               ? `\`/v1/platforms/\${encodeURIComponent(opts.${parentParam})}/platforms/\${encodeURIComponent(opts.name)}\``
-              : `\`/v1/platforms/\${encodeURIComponent(opts.${parentParam})}/workspaces/\${encodeURIComponent(opts.name)}\${opts.tier === "heavy" ? "?tier=heavy" : ""}\``,
+              : `\`/v1/platforms/\${encodeURIComponent(opts.${parentParam})}/workspaces/\${encodeURIComponent(opts.name)}\``,
           );
         }
       }

package/src/compile_package_main.ts

@@ -88,6 +88,7 @@ import { canonicalTaxonomyFragment, validateWorkspaceTaxonomyAndRoutes } from ".
 import { shardingLawModule, type ShardingLawSpec } from "./workspace_sharding.js";
 import type { AnyExtremum } from "./extremum.js";
 import type { WorkspaceInvariantDecl } from "./framework/workspace_invariant.js";
+import { type RelationTypeDecl, isRelationTypeDecl, validateRelationType } from "./relation_schema.js";
 import {
   emitLayeredDomain,
   flattenLayeredUsd,
@@ -126,6 +127,8 @@ interface DomainConfig {
   readonly workspaceTypes?: readonly string[];
   /** Export-name escape hatch for workspace invariants (auto-discovered by shape otherwise). */
   readonly workspaceInvariants?: readonly string[];
+  /** Export-name escape hatch for relation types (auto-discovered by brand otherwise). */
+  readonly relationTypes?: readonly string[];
   readonly impureCapabilities?: readonly string[];
   readonly extraAggregates?: readonly string[];
   readonly readModelAggregates?: readonly string[];
@@ -691,6 +694,12 @@ async function main(): Promise<void> {
       ...discover<WorkspaceInvariantDecl>(merged, isWorkspaceInvariantDecl),
       ...resolveNamed<WorkspaceInvariantDecl>(merged, d.workspaceInvariants, "workspaceInvariants"),
     ];
+    // Native Zanzibar relation schema (P1) — auto-discovered by brand, like workspaceInvariants.
+    const relationTypes = [
+      ...discover<RelationTypeDecl>(merged, isRelationTypeDecl),
+      ...resolveNamed<RelationTypeDecl>(merged, d.relationTypes, "relationTypes"),
+    ];
+    for (const rt of relationTypes) validateRelationType(rt); // DX fast-fail (Rust resolve is authoritative)
     // Sums are AUTO-DISCOVERED like queries/counts (#57 — an exported SumDecl used to be
     // SILENTLY DROPPED unless config-named; the config lane stays as the escape hatch).
     // Reference-dedupe: a sum that is BOTH exported and config-named is the same object.
@@ -758,6 +767,7 @@ async function main(): Promise<void> {
         ...(maxes.length > 0 ? { maxes } : {}),
         ...(workspaceTypes.length > 0 ? { workspaceTypes } : {}),
         ...(workspaceInvariants.length > 0 ? { workspaceInvariants } : {}),
+        ...(relationTypes.length > 0 ? { relationTypes } : {}),
         ...(spatials.length > 0 ? { spatials } : {}),
         ...(d.dartImports !== undefined && d.dartImports.length > 0
           ? { dartImports: d.dartImports }

package/src/directive.ts

@@ -32,7 +32,6 @@ export type ReferentialMarker = "creates" | "mutates" | "ensures" | "archives";
  * replay, and `admit`'s authz gate folds the permission projection strictly-before
  * the intent's HLC against exactly this scope.
  */
-export type ScopeFrom<P> = (payload: P) => string[];
 
 export interface Directive<P = unknown> {
   readonly id: string;
@@ -50,20 +49,49 @@ export interface Directive<P = unknown> {
    */
   readonly description?: string;
   /**
-   * The capability an actor must hold to author this directive (the DECLARATIVE
-   * authz pre-condition). `undefined` ⇒ the directive declares no requirement and
-   * the gate's authz slot stays inert for it. When set, the kernel threads this
-   * into `Authored.required_caps` so `admit`'s authz step flips to `Enforce` once a
-   * `RoleCatalogue` is supplied. Defaults to the directive `id` (a directive's name
-   * IS its capability — the same convention the `RoleCatalogue` keys caps by).
+   * NATIVE ZANZIBAR write-authz (P4): the RELATION the captured author must HOLD to author this
+   * directive, and the OBJECT it is checked on. The ONE gate runs `engine.check(schema, object,
+   * relation, principal)` over the pre-apply folded tuple store — refusing an author who does not
+   * hold it (the side-door fix made real). `object` is SELF-RELATIVE by default (`"workspace:self"`,
+   * the governance convention). A PER-RECORD object (home_holons §6) is set via `objectFrom`: the gate
+   * then checks the relation on `<recordType>:<validated_payload[idField]>` — the specific record this
+   * directive writes, not the whole workspace (`record ⊂ object`; the engine is already object-generic).
+   * DISTINCT from the legacy `requiresCapability` (RBAC) and `declaredRelations` (cross-workspace) axes.
+   * Emitted into the `nomosRelationGate` USD era key; enforced IFF the law also declares a relation schema.
    */
-  readonly requiresCapability?: string;
+  readonly requiresRelationGate?: {
+    readonly relation: string;
+    readonly object: string;
+    /** PER-RECORD (§6): when set, the gate object is `<recordType>:<payload[idField]>` (the static
+     *  `object` is the fallback). `undefined` ⇒ the static object — era-ruled, byte-identical replay. */
+    readonly objectFrom?: { readonly recordType: string; readonly idField: string };
+  };
   /**
-   * Pure payload→scope derivation feeding `admit`'s `target` (see {@link ScopeFrom}).
-   * `undefined` ⇒ root scope. Authz checks the actor holds `requiresCapability` at
-   * a scope COVERING this target.
+   * CROSS-CUSTODY ATTESTATION-AUTHORIZED (home_holons §3/§5). When `true`, this directive's authorization
+   * is a carried §3 SIGNED QUOTE (the asserter's pubkey + a signature over the edge), NOT an author block —
+   * so a key-less bailiff can deliver it host-free to an OFFLINE subject. Lowered into the
+   * `nomosAttestationGate` USD era key: the one gate then re-verifies the quote (bound to the home's warrant
+   * owner) AND pins the captured principal to the proven, unprivileged attestation key, and the signed-author
+   * doors exempt it. The directive's payload MUST carry the framework-convention fields the gate reads
+   * (`asserterWorkspace` / `object` / `relation` / `attestedAt` / `publicKey` / `signature` — the
+   * `recordShare` shape). FRAMEWORK-ONLY today (the home law's `recordShare`); a true E2E authority-free fact.
    */
-  readonly scopeFrom?: ScopeFrom<P>;
+  readonly attestationAuthorizedGate?: {
+    /** The singleton aggregate INSTANCE id whose field holds the home owner (e.g. `home-owner:self`). */
+    readonly ownerObject: string;
+    /** The field on that singleton holding the owner principal (e.g. `principal`). */
+    readonly ownerField: string;
+    /** The payload field names the §3 quote rides in — the law's declared wire shape (defaulted to the
+     *  framework `recordShare` convention by `.attestationAuthorized()`, so the kernel hardcodes none). */
+    readonly fields: {
+      readonly asserterWorkspace: string;
+      readonly object: string;
+      readonly relation: string;
+      readonly attestedAt: string;
+      readonly publicKey: string;
+      readonly signature: string;
+    };
+  };
   /**
    * The directive's DECLARED read boundary: the ref types its `plan` may READ (the
    * "IR for law boundaries" decision — the boundary is part of the domain identity).
@@ -141,7 +169,17 @@ export interface RequirableDirective<P> extends Directive<P> {
    * to the directive id) at the scope `scopeFrom(payload)` derives (defaults to root).
    * Returns a new `Directive` carrying `requiresCapability` + `scopeFrom`.
    */
-  requires(capability?: string, scopeFrom?: ScopeFrom<P>): RequirableDirective<P>;
+  requires(
+    relation: string,
+    opts?: { object?: string; objectFrom?: { recordType: string; idField: string } },
+  ): RequirableDirective<P>;
+  /**
+   * Declare this directive ATTESTATION-AUTHORIZED (home_holons §3/§5): its authorization is a carried §3
+   * signed quote rather than an author block — lowered into the `nomosAttestationGate` era key so the one
+   * gate verifies the quote + pins the principal to the attestation key, and the bailiff delivers it
+   * host-free. Framework-only (the home law's `recordShare`). Returns a NEW requirable directive.
+   */
+  attestationAuthorized(owner: { ownerObject: string; ownerField: string }): RequirableDirective<P>;
   /**
    * Declare the directive's READ boundary. TWO argument kinds, one declaration site:
    *   * a STRING declares a ref TYPE its `plan` may read (the original boundary —
@@ -266,6 +304,19 @@ class DirectivePlanStep<Id extends string, P> {
   }
 }
 
+/**
+ * Build a PER-RECORD authz object template (home_holons §6) for `.requires(rel, { objectFrom })`. The
+ * gate then checks the relation on `<Agg>:<validated_payload[idField]>` — the specific record this
+ * directive writes (e.g. `recordObject(Entry, "entryId")` ⇒ `Entry:<payload.entryId>`), not the whole
+ * workspace. `record ⊂ object`: the same engine, pointed at one record.
+ */
+export function recordObject(
+  agg: AggregateHandle,
+  idField: string,
+): { recordType: string; idField: string } {
+  return { recordType: agg.id, idField };
+}
+
 /**
  * Wrap a `Directive` with the chainable `.requires(...)` declaration. `.requires`
  * is non-destructive: it returns a NEW requirable directive carrying the resolved
@@ -275,11 +326,46 @@ class DirectivePlanStep<Id extends string, P> {
 function makeRequirable<P>(base: Directive<P>): RequirableDirective<P> {
   return {
     ...base,
-    requires(capability?: string, scopeFrom?: ScopeFrom<P>): RequirableDirective<P> {
+    requires(
+      relation: string,
+      opts?: { object?: string; objectFrom?: { recordType: string; idField: string } },
+    ): RequirableDirective<P> {
+      // THE ONE write-authz declaration (full-native Zanzibar, no mixed systems): the captured author
+      // must HOLD `relation` on the object for the one gate to admit. Default object is self-relative
+      // (`"workspace:self"`, the governance convention); `objectFrom` (home_holons §6) gates on the
+      // PER-RECORD object the payload names (`recordObject(Agg, "idField")`) instead. Lowers to the
+      // `nomosRelationGate` era key; `admit` runs `engine.check`. (Replaces the deleted RBAC capability
+      // axis — a capability WAS just a relation.)
+      return makeRequirable({
+        ...base,
+        requiresRelationGate: {
+          relation,
+          object: opts?.object ?? "workspace:self",
+          ...(opts?.objectFrom !== undefined ? { objectFrom: opts.objectFrom } : {}),
+        },
+      });
+    },
+    attestationAuthorized(owner: { ownerObject: string; ownerField: string }): RequirableDirective<P> {
+      // CROSS-CUSTODY ATTESTATION-AUTHORIZED (home_holons §3/§5): this directive's authorization is a
+      // carried §3 signed quote, not an author block — lowered into the `nomosAttestationGate` era key, so
+      // the one gate verifies the quote (binding its subject to the LAW-DECLARED `owner`), pins the principal
+      // to the attestation key, and the signed-author doors exempt it. `owner` names the singleton + field
+      // holding the home owner; the QUOTE FIELD NAMES default to the framework `recordShare` convention HERE
+      // (in the DSL — the kernel reads them from the law's declaration, hardcoding nothing).
       return makeRequirable({
         ...base,
-        requiresCapability: capability ?? base.id,
-        ...(scopeFrom !== undefined ? { scopeFrom } : {}),
+        attestationAuthorizedGate: {
+          ownerObject: owner.ownerObject,
+          ownerField: owner.ownerField,
+          fields: {
+            asserterWorkspace: "asserterWorkspace",
+            object: "object",
+            relation: "relation",
+            attestedAt: "attestedAt",
+            publicKey: "publicKey",
+            signature: "signature",
+          },
+        },
       });
     },
     reads(...reads: (string | QueryDecl)[]): RequirableDirective<P> {

package/src/engine_entry.ts

@@ -536,6 +536,7 @@ export function registerEngine(config: EngineEntryConfig): RegisteredEngine {
   /** `{workspaceInvariantReads:{id}, payload}` → the bounded ref-set `[{name,aggregate,id},…]`. */
   function planWorkspaceInvariantReads(job: {
     intent?: { workspaceInvariantReads?: { id?: string }; payload?: unknown };
+    capturedPorts?: { principal?: string };
   }): string {
     const id = job.intent?.workspaceInvariantReads?.id;
     if (typeof id !== "string") {
@@ -548,13 +549,17 @@ export function registerEngine(config: EngineEntryConfig): RegisteredEngine {
       throw new Error(`engine workspaceInvariantReads: no workspace invariant registered for "${id}"`);
     }
     const intent = (job.intent?.payload ?? {}) as Record<string, unknown>;
-    return JSON.stringify(decl.reads({ intent }));
+    // LAW-GATED AUTHZ: the captured author identity (a top-level sibling of `intent`, set by the wasm
+    // author leg + replayed verbatim) — the governance invariant reads it to gate by the AUTHOR.
+    const principal = (job.capturedPorts?.principal ?? "") as string;
+    return JSON.stringify(decl.reads({ intent, principal }));
   }
 
   /** `{workspaceInvariant:{id,on}, payload?}` + priorState (named snapshots) → {accept}|{reject}. */
   function planWorkspaceInvariantAssert(job: {
     intent?: { workspaceInvariant?: { id?: string }; payload?: unknown };
     priorState?: Record<string, unknown>;
+    capturedPorts?: { principal?: string };
   }): string {
     const id = job.intent?.workspaceInvariant?.id;
     if (typeof id !== "string") {
@@ -568,7 +573,8 @@ export function registerEngine(config: EngineEntryConfig): RegisteredEngine {
     }
     const snapshots = (job.priorState ?? {}) as Record<string, Record<string, unknown>>;
     const intent = (job.intent?.payload ?? {}) as Record<string, unknown>;
-    return JSON.stringify(decl.assert(snapshots, { intent }));
+    const principal = (job.capturedPorts?.principal ?? "") as string;
+    return JSON.stringify(decl.assert(snapshots, { intent, principal }));
   }
 
   function planDerive(job: {

package/src/fields.ts

@@ -15,7 +15,7 @@
  * the value type (via Zod) is preserved.
  */
 import { z } from "zod";
-import { Conflict, Lww, type Driver } from "./drivers.js";
+import { Conflict, Counter, LastPosition, Lww, type Driver } from "./drivers.js";
 import type { AggregateHandle } from "./aggregate.js";
 
 export type FieldKind =
@@ -35,7 +35,14 @@ export type FieldKind =
   // evidence.md §6/§9.2 — a content-addressed EvidenceRef. The migration target of the
   // hand-wired `blobRef` `t.jsonObject()` string (thing_structures.ts). The authored
   // value is the typed EvidenceRef shape; it encodes to a kernel `Value::Evidence`.
-  | "evidence";
+  | "evidence"
+  // ── STRUCTURAL CRDT scalar kinds (the read-collapsible drivers) ──
+  // `t.counter()` — a PN-counter (`Driver::Counter`): driven by `increment`/`decrement`, read as the
+  // net `Int` (Σpos − Σneg). `t.position()` — an LWW order-key (`Driver::LastPosition`): driven by
+  // `set`, read as the `String` key. Both collapse to a scalar at read time (kernel `observed_value`),
+  // so the read model + codegen treat them as `number` / `string`.
+  | "counter"
+  | "position";
 
 /**
  * The authored shape of an `EvidenceRef` (`evidence.md` §1) — a content-addressed
@@ -224,6 +231,21 @@ export const t = {
   bool(): Field<boolean, "bool"> {
     return makeField("bool", z.boolean(), Lww);
   },
+  /** A PN-COUNTER (`Driver::Counter`) — a number that CONVERGES under concurrent edits: two replicas
+   *  that each `increment` while offline both land (the merge is the per-replica sum), so nobody's count
+   *  is lost. Drive it with `increment(handle, "field", n)` / `decrement(...)`, NOT `set()` (set would
+   *  clobber the convergent state). Reads back as the net `number` (Σincrements − Σdecrements; may be
+   *  negative). The kernel owns the CRDT; the field tag picks it. */
+  counter(): Field<number, "counter"> {
+    return makeField<number, "counter">("counter", z.number().int(), Counter);
+  },
+  /** An LWW ORDER-KEY POSITION (`Driver::LastPosition`) — an opaque fractional/index string (e.g. `"a0"`,
+   *  `"a0V"`) that orders an item among siblings, resolved last-writer-wins by HLC. Drive it with
+   *  `set(handle, "pos", key)`; concurrent moves converge to one position (the later HLC). Reads back as
+   *  the `string` key. (Compute the key client-side — fractional indexing — and ride it in the payload.) */
+  position(): Field<string, "position"> {
+    return makeField<string, "position">("position", z.string(), LastPosition);
+  },
   /** Enum via `as const` literal union — value typos squeal at compile time. */
   enum<const E extends readonly [string, ...string[]]>(values: E): Field<E[number], "enum"> {
     return makeField<E[number], "enum">(

package/src/framework/encryption_identity.ts

@@ -6,7 +6,7 @@
 /**
  * framework/encryption_identity.ts — the E2E ENCRYPTION KEY REGISTRY (slice 1 of the
  * `architecture/e2e_encryption.md` arc). Tenant-agnostic framework MECHANISM, the
- * encryption sibling of `framework/rbac.ts`'s authority registry.
+ * encryption sibling of the native authority registry (`framework/relations.ts`).
  *
  * THE ROLE: the key-handoff lane (slice 4) wraps a scope's epoch secret TO a grant
  * recipient's X25519 PUBLIC key. To do that it must look up "principal → encryption
@@ -15,7 +15,7 @@
  * / ~/.holon, never on any chain), and `grant`/the fan-out gate resolve it by principal.
  *
  * PRINCIPAL-KEYED, NOT device-keyed — deliberately. The read-visibility grant
- * (`rbac.ts`) targets a `principal` (the auth-provider uid), and the launch platforms use
+ * (a native `relateSubject` tuple) targets a `principal` (the auth-provider uid), and the launch platforms use
  * bare auth-provider principals with no full Actor/DeviceKey model. So the encryption key
  * is keyed by the SAME principal the grant targets — one decoupled registry a tenant
  * composes WITHOUT the full `identity.ts` domain. (Multi-device per principal, and the
@@ -42,7 +42,7 @@ const X25519_PUB_B64_RE = /^[A-Za-z0-9+/]{42,44}={0,2}$/;
 
 /**
  * The per-principal encryption-key record. Multi-instance, keyed
- * `enc-key-<principal>` (mirrors `rbac.ts`'s `user-permissions-<userId>`). `encPublicKey`
+ * `enc-key-<principal>` (mirrors the native `reltuple-<object>-<relation>` keying). `encPublicKey`
  * is the published X25519 public key; a re-publish (Lww) is a client-driven key rotation
  * (which the owner should follow with a scope epoch rotation so new wraps target it).
  */