@githolon/dsl 0.7.1 → 0.9.0

package/src/framework/workspaces.ts

@@ -66,12 +66,77 @@ export const GOVERNANCE_REVISION = "2026-06-12-capability-bindings"; // hash-bea
  */
 import { z } from "zod";
 import { aggregate, instance } from "../aggregate.js";
-import { create } from "../authoring.js";
+import { create, ensure } from "../authoring.js";
 import { directive } from "../directive.js";
 import { Lww } from "../drivers.js";
 import { t } from "../fields.js";
 import { set, withMarker } from "../ops.js";
 import { query } from "../query.js";
+import { workspaceInvariant, refAs } from "./workspace_invariant.js";
+import { writeTuple, removeTuple, RelationTuple } from "./relations.js";
+import { relationType, self, user, key } from "../relation_schema.js";
+
+// ── WORKSPACE SELF-IDENTITY (the law reads its OWN install-context) ──────────────────────────────────
+// The governance bundle runs on root AND every born platform. A workspace knows its ROLE via this
+// singleton, at a CONSTANT fixed instance id (the RelationTuple discipline — a literal, never minted, so
+// the id is identical on every peer + the sid is additive/era-safe). Seeded by the birth plan (ungated).
+// The gate keys authority off the CONSTANT object literal `workspace:self` — because custody guarantees a
+// workspace only ever folds its OWN relations table, `workspace:root#admin` collapses to `workspace:self#
+// admin`, so the gate is self-relative with NO name plumbing. A tenant runs no governance ⇒ no WorkspaceSelf.
+export const WORKSPACE_ROLES = ["cloud-root", "platform", "tenant"] as const;
+const WORKSPACE_SELF_ID = "workspaceself-self";
+const SELF_ADMIN_OBJECT = "workspace:self";
+export const WorkspaceSelf = aggregate("WorkspaceSelf", {
+  role: t.enum(WORKSPACE_ROLES).merge(Lww),
+  name: t.string().merge(Lww),
+});
+// The one-off SELF-IDENTITY backfill for an already-born workspace (root predates WorkspaceSelf). UNGATED
+// by the admin gate — it must run BEFORE the admin tuple/gate are live — but WRITE-ONCE (the invariant
+// below refuses a re-set once the role exists), so a race or a malicious re-set cannot flip the role and
+// freeze governance. The HOST authors this in the serialized genesis re-entry, winning any race.
+export const ensureWorkspaceSelf = directive("ensureWorkspaceSelf")
+  .ensures(WorkspaceSelf)
+  .payload(z.object({ role: z.enum(WORKSPACE_ROLES), name: z.string().min(1) }))
+  .plan((p) => {
+    ensure(WorkspaceSelf, WORKSPACE_SELF_ID).set("role", p.role).set("name", p.name);
+    return [];
+  });
+export const workspaceSelfWriteOnce = workspaceInvariant("WorkspaceSelfWriteOnce")
+  // BARE directive id — the gate filters `on == directiveId` and the engine dispatches by the
+  // BARE id within a domain slice (`directive("ensureWorkspaceSelf")`), so the produced intent
+  // carries `directiveId:"ensureWorkspaceSelf"`. A domain-QUALIFIED `on` ("workspaces.…") would
+  // NEVER match the bare runtime id ⇒ the gate stays silently INERT (the #266 side-door bug,
+  // 2026-06-15). Bare matches — exactly the convention the sharding invariants already fire under.
+  .on("ensureWorkspaceSelf")
+  .reads(() => [refAs("self", "WorkspaceSelf", "pre:" + WORKSPACE_SELF_ID)])
+  .assert(({ self }) =>
+    (self as { role?: string })?.role ? { reject: "workspace-self-already-set" } : { accept: true },
+  );
+
+// ── THE GOVERNANCE RELATION SCHEMA (full-native Zanzibar — the ONE authz model) ──────────────────────
+// The control-plane authority of the cloud is a NATIVE Zanzibar namespace. A directive declares its
+// requirement with `.requires("<relation>")` (object defaults to the self-relative `"workspace:self"`),
+// and the ONE wasm gate runs `engine.check(schema, "workspace:self", relation, principal)` over the
+// pre-apply folded relation tuples — refusing any author who does not HOLD the relation. The schema +
+// the `.requires` together arm the gate (the `nomosRelations` + `nomosRelationGate` era keys); the
+// bespoke `workspaceInvariant` authz gates are GONE (this IS their replacement, as real native law).
+//
+// THE CONTROL-PLANE CARVE-OUT — LEAF-ONLY (`allow: [user(), key()]`, never a userset/wildcard). A
+// `workspace:self#admin@<group>#member` or `@<type>:*` would let a group/wildcard escalate to admin
+// (the admin-via-group forge); the fail-closed `allow` makes such a subject UNSTORABLE + (the Check
+// side) DISCARDED at evaluation. Each relation is a flat `self()` (directly-stored tuples) — NO rewrite
+// algebra (no computed/from/union): control-plane authority is direct membership only.
+//   * admin           — grantAdmin/revokeAdmin + every admin-mutating governance directive.
+//   * creator         — createWorkspace (under invite/closed posture; see the host's _creationLawOk).
+//   * platformCreator — birthPlatform (always invite-only).
+// SELF-RELATIVE: custody guarantees a workspace only ever folds its OWN relations table, so
+// `workspace:root#admin` collapses to `workspace:self#admin` — the SAME law governs root and every
+// born platform with no name plumbing. (A pure tenant runs no governance ⇒ no schema ⇒ the gate is
+// inert there; an un-backfilled workspace with no admin tuple refuses fail-closed.)
+export const workspaceRelations = relationType("workspace")
+  .relation("admin", { rewrite: self(), allow: [user(), key()] })
+  .relation("creator", { rewrite: self(), allow: [user(), key()] })
+  .relation("platformCreator", { rewrite: self(), allow: [user(), key()] });
 
 // --- vocabulary ----------------------------------------------------------------
 
@@ -161,43 +226,11 @@ export const CloudWorkspace = aggregate("CloudWorkspace", {
   pool: t.int().merge(Lww).optional(),
 });
 
-/**
- * AdminGrant — one admin credential of the cloud itself. An `active` AdminGrant's
- * `keyHash` is the WHOLE of admin power: the worker admits an admin bearer iff
- * `adminGrantByKeyHash(sha256(bearer))` yields an active grant. Genesis seeds the
- * first one; after that, admins make admins — on the record.
- */
-export const AdminGrant = aggregate("AdminGrant", {
-  /** sha256 hex of the admin bearer secret (the secret itself never lands here). */
-  keyHash: t.string().merge(Lww),
-  /** Human label for audit ("jack", "ci-deployer", ...). */
-  label: t.string().merge(Lww),
-  /** The principal that authored the grant (attribution, on the ledger forever). */
-  grantedBy: t.string().merge(Lww),
-  /** Epoch-ms the grant was authored (caller-stamped). */
-  grantedAt: t.int().merge(Lww),
-  /** `active` | `revoked` — revocation is the law's kill switch for a key. */
-  status: t.enum(GRANT_STATUSES).merge(Lww),
-});
-
-/**
- * CreationGrant — the narrower power to CREATE workspaces (the invite key,
- * lawful edition). Same shape and same enforcement path as AdminGrant, but the
- * worker honours it ONLY for `createWorkspace`-shaped access — separation of the
- * "may invite tenants" power from the "may govern the cloud" power.
- */
-export const CreationGrant = aggregate("CreationGrant", {
-  /** sha256 hex of the creation bearer secret. */
-  keyHash: t.string().merge(Lww),
-  /** Human label for audit. */
-  label: t.string().merge(Lww),
-  /** The principal that authored the grant. */
-  grantedBy: t.string().merge(Lww),
-  /** Epoch-ms the grant was authored (caller-stamped). */
-  grantedAt: t.int().merge(Lww),
-  /** `active` | `revoked`. */
-  status: t.enum(GRANT_STATUSES).merge(Lww),
-});
+// AdminGrant / CreationGrant aggregates: DELETED (full-native Zanzibar). Admin/creation authority is
+// now a NATIVE RELATION TUPLE — `workspace:self#admin@key:<keyHash>` / `…#creator@key:<keyHash>` —
+// written by grantAdmin/grantCreation via `writeTuple`, gated by `.requires("admin")`, and read by the
+// host's `_rootCheck` (the wasm `check` op) and the one gate's `engine.check`. A grant WAS just a
+// relation; the aggregate + its `adminGrantByKeyHash`/`creationGrantByKeyHash` queries are gone.
 
 /**
  * CloudPolicy — THE QUOTA LAW, a law-state singleton (id `cloud-policy:cloud`).
@@ -342,7 +375,8 @@ export const createWorkspace = directive("createWorkspace")
       .set("createdBy", p.requestedBy)
       .set("createdAt", p.requestedAt);
     return [];
-  });
+  })
+  .requires("creator"); // posture-gated creation: only a #creator holder may request a workspace
 
 /**
  * birthCloud — THE CLOUD'S OWN BIRTH INTENT. Root authors this once, into its own
@@ -360,6 +394,9 @@ export const birthCloud = directive("birthCloud")
       /** The genesis auth-provider principal uid upon which the world rests. */
       principal: z.string().min(1),
       name: z.string().min(1).default("root"),
+      /** The workspace's ROLE for the governance domain — the host stamps "cloud-root" at root genesis,
+       *  "platform" when birthing a platform's own chain. Drives the self-relative authz gate. */
+      role: z.enum(WORKSPACE_ROLES).default("cloud-root"),
       tier: z.enum(WORKSPACE_TIERS).default("edge"),
       bornAt: epochMs,
     }),
@@ -375,6 +412,9 @@ export const birthCloud = directive("birthCloud")
       .set("createdBy", p.principal)
       .set("createdAt", p.bornAt)
       .set("provisionedAt", p.bornAt);
+    // The self-identity singleton at the CONSTANT id (ungated — birthCloud is not admin-mutating), so the
+    // gate's self-record exists before any admin write. ensure() = deterministic-id sibling birth.
+    ensure(WorkspaceSelf, WORKSPACE_SELF_ID).set("role", p.role).set("name", p.name);
     return [];
   });
 
@@ -530,7 +570,8 @@ export const birthPlatform = directive("birthPlatform")
       .set("createdBy", p.requestedBy)
       .set("createdAt", p.requestedAt);
     return [];
-  });
+  })
+  .requires("platformCreator"); // invite-only: an active #platformCreator tuple admits the birth
 
 /** setPlatformPool — the pool edition of a granted quota request. */
 export const setPlatformPool = directive("setPlatformPool")
@@ -546,14 +587,18 @@ export const setPlatformPool = directive("setPlatformPool")
   .plan((p) => {
     const ws = instance(CloudWorkspace, p.workspaceId);
     return [set(ws, "pool", p.pool)];
-  });
+  })
+  .requires("admin");
 
 /**
  * grantPlatformCreation / revokePlatformCreation — open and close the
  * become-a-platform door for one principal (see {@link PlatformGrant}).
  */
+// grantPlatformCreation — become-a-platform authority IS the self-relative `#platformCreator` tuple
+// (one authz spine, all the way down). Writes `workspace:self#platformCreator@user:<principal>` (no
+// PlatformGrant aggregate) — the host's platform-birth invite check reads the SAME tuple via Check.
 export const grantPlatformCreation = directive("grantPlatformCreation")
-  .creates(PlatformGrant)
+  .ensures(RelationTuple)
   .payload(
     z.object({
       principal: z.string().min(1),
@@ -562,29 +607,22 @@ export const grantPlatformCreation = directive("grantPlatformCreation")
       grantedAt: epochMs,
     }),
   )
-  .plan((p) => {
-    create(PlatformGrant)
-      .set("principal", p.principal)
-      .set("label", p.label)
-      .set("grantedBy", p.grantedBy)
-      .set("grantedAt", p.grantedAt)
-      .set("status", "active" as const);
-    return [];
-  });
+  .plan((p) => writeTuple({ object: SELF_ADMIN_OBJECT, relation: "platformCreator", subject: "user:" + p.principal, grantedBy: p.grantedBy, grantedAt: String(p.grantedAt) }))
+  .requires("admin"); // only an admin opens the become-a-platform door
 
+// revokePlatformCreation — flip the `#platformCreator@user:<principal>` leaf to revoked. BREAKING vs the
+// aggregate model: keyed by PRINCIPAL (the tuple subject), not a minted grantId.
 export const revokePlatformCreation = directive("revokePlatformCreation")
-  .mutates(PlatformGrant)
+  .ensures(RelationTuple)
   .payload(
     z.object({
-      grantId: z.string().min(1),
+      principal: z.string().min(1),
       revokedBy: z.string().min(1),
       revokedAt: epochMs,
     }),
   )
-  .plan((p) => {
-    const grant = instance(PlatformGrant, p.grantId);
-    return [set(grant, "status", "revoked" as const)];
-  });
+  .plan((p) => removeTuple({ object: SELF_ADMIN_OBJECT, relation: "platformCreator", subject: "user:" + p.principal, grantedBy: p.revokedBy, grantedAt: String(p.revokedAt), revokedBy: p.revokedBy, revokedAt: String(p.revokedAt) }))
+  .requires("admin");
 
 /**
  * AuthProvider — BYOAuth: WHO VOUCHES FOR THIS SUBTREE'S PRINCIPALS. A law-state
@@ -638,7 +676,8 @@ export const setAuthProvider = directive("setAuthProvider")
       set(ap, "setBy", p.setBy),
       set(ap, "setAt", p.setAt),
     ];
-  });
+  })
+  .requires("admin");
 
 /**
  * HostnameClaim — a CUSTOM HOSTNAME bound to a platform: `api.acme.com` serving
@@ -789,7 +828,8 @@ export const setCloudPolicy = directive("setCloudPolicy")
       set(pol, "setBy", p.setBy),
       set(pol, "setAt", p.setAt),
     ];
-  });
+  })
+  .requires("admin");
 
 /**
  * grantQuota — grant a quota request: a principal's workspace allowance. The
@@ -812,7 +852,8 @@ export const grantQuota = directive("grantQuota")
       .set("grantedBy", p.grantedBy)
       .set("grantedAt", p.grantedAt);
     return [];
-  });
+  })
+  .requires("admin");
 
 /**
  * setWorkspaceByteCap — grant one workspace a bigger (or smaller) ledger than the
@@ -831,7 +872,8 @@ export const setWorkspaceByteCap = directive("setWorkspaceByteCap")
   .plan((p) => {
     const ws = instance(CloudWorkspace, p.workspaceId);
     return [set(ws, "byteCap", p.byteCap)];
-  });
+  })
+  .requires("admin");
 
 // --- grant directives ---------------------------------------------------------------
 
@@ -840,8 +882,12 @@ export const setWorkspaceByteCap = directive("setWorkspaceByteCap")
  * authors the FIRST one from the bootstrap env var — which is then spent forever;
  * every later grant is an admin granting, attributed and admitted under this law.
  */
+// ZANZIBAR ALL THE WAY DOWN: admin authority IS the self-relative tuple the gate reads. grantAdmin writes
+// `workspace:self#admin@key:<keyHash>` (no AdminGrant aggregate) — a typed alias for relateSubject(#admin);
+// the AuthorHoldsAdmin gate's PRE-APPLY roster prevents self-grant. `label` stays in the payload contract
+// (provenance) though the keyHash-keyed tuple leaf does not carry it.
 export const grantAdmin = directive("grantAdmin")
-  .creates(AdminGrant)
+  .ensures(RelationTuple)
   .payload(
     z.object({
       keyHash: sha256Hex,
@@ -850,42 +896,39 @@ export const grantAdmin = directive("grantAdmin")
       grantedAt: epochMs,
     }),
   )
-  .plan((p) => {
-    create(AdminGrant)
-      .set("keyHash", p.keyHash)
-      .set("label", p.label)
-      .set("grantedBy", p.grantedBy)
-      .set("grantedAt", p.grantedAt)
-      .set("status", "active" as const);
-    return [];
-  });
+  .plan((p) => writeTuple({ object: SELF_ADMIN_OBJECT, relation: "admin", subject: "key:" + p.keyHash, grantedBy: p.grantedBy, grantedAt: String(p.grantedAt) }))
+  .requires("admin"); // only an admin grants admin (pre-apply roster ⇒ no self-grant)
 
 /**
  * revokeAdmin — flip an AdminGrant to `revoked`. The key stops verifying at fold
  * time; the grant record (who granted it, when, who killed it) stays on the
  * ledger — audit is structural, not a log file.
  */
+// revokeAdmin — flip the `#admin@key:<keyHash>` subject leaf to revoked (an Lww write over the same map
+// entry; the projection drops the row, Check fails closed). Keyed by keyHash now (the tuple subject), not
+// a minted grantId. Audit stays structural — the revoked leaf rides the chain forever.
 export const revokeAdmin = directive("revokeAdmin")
-  .mutates(AdminGrant)
+  .ensures(RelationTuple)
   .payload(
     z.object({
-      grantId: z.string().min(1),
+      keyHash: sha256Hex,
       revokedBy: z.string().min(1),
       revokedAt: epochMs,
     }),
   )
-  .plan((p) => {
-    const grant = instance(AdminGrant, p.grantId);
-    return [set(grant, "status", "revoked" as const)];
-  });
+  .plan((p) => removeTuple({ object: SELF_ADMIN_OBJECT, relation: "admin", subject: "key:" + p.keyHash, grantedBy: p.revokedBy, grantedAt: String(p.revokedAt), revokedBy: p.revokedBy, revokedAt: String(p.revokedAt) }))
+  .requires("admin");
 
 /**
  * grantCreation — mint a workspace-creation credential record (`status:"active"`).
  * The lawful replacement for the `NOMOS_CLOUD_INVITE_KEY` env var: who may invite
  * tenants is law state, grantable and revocable on the record.
  */
+// grantCreation — creation authority IS the self-relative `#creator` tuple the CreationGate reads.
+// Writes `workspace:self#creator@key:<keyHash>` (no CreationGrant aggregate). Under posture invite/closed
+// the gate admits only holders of an active #creator subject; under open/unset it admits anyone.
 export const grantCreation = directive("grantCreation")
-  .creates(CreationGrant)
+  .ensures(RelationTuple)
   .payload(
     z.object({
       keyHash: sha256Hex,
@@ -894,30 +937,21 @@ export const grantCreation = directive("grantCreation")
       grantedAt: epochMs,
     }),
   )
-  .plan((p) => {
-    create(CreationGrant)
-      .set("keyHash", p.keyHash)
-      .set("label", p.label)
-      .set("grantedBy", p.grantedBy)
-      .set("grantedAt", p.grantedAt)
-      .set("status", "active" as const);
-    return [];
-  });
+  .plan((p) => writeTuple({ object: SELF_ADMIN_OBJECT, relation: "creator", subject: "key:" + p.keyHash, grantedBy: p.grantedBy, grantedAt: String(p.grantedAt) }))
+  .requires("admin"); // only an admin grants creation authority
 
-/** revokeCreation — flip a CreationGrant to `revoked` (see {@link revokeAdmin}). */
+/** revokeCreation — flip the `#creator@key:<keyHash>` leaf to revoked (see {@link revokeAdmin}). */
 export const revokeCreation = directive("revokeCreation")
-  .mutates(CreationGrant)
+  .ensures(RelationTuple)
   .payload(
     z.object({
-      grantId: z.string().min(1),
+      keyHash: sha256Hex,
       revokedBy: z.string().min(1),
       revokedAt: epochMs,
     }),
   )
-  .plan((p) => {
-    const grant = instance(CreationGrant, p.grantId);
-    return [set(grant, "status", "revoked" as const)];
-  });
+  .plan((p) => removeTuple({ object: SELF_ADMIN_OBJECT, relation: "creator", subject: "key:" + p.keyHash, grantedBy: p.revokedBy, grantedAt: String(p.revokedAt), revokedBy: p.revokedBy, revokedAt: String(p.revokedAt) }))
+  .requires("admin");
 
 // --- declared read queries (the worker's ENTIRE enforcement surface) -----------------
 //
@@ -928,15 +962,10 @@ export const revokeCreation = directive("revokeCreation")
 /** Resolve a workspace by its unique name (the `:ws` URL segment → the law record). */
 export const workspaceByName = query("workspaceByName").key("name").returns(CloudWorkspace);
 
-/** "Is this bearer an admin?" — probe by sha256(bearer); active grant = yes. */
-export const adminGrantByKeyHash = query("adminGrantByKeyHash")
-  .key("keyHash")
-  .returns(AdminGrant);
-
-/** "May this bearer create workspaces?" — probe by sha256(bearer). */
-export const creationGrantByKeyHash = query("creationGrantByKeyHash")
-  .key("keyHash")
-  .returns(CreationGrant);
+// adminGrantByKeyHash / creationGrantByKeyHash queries: DELETED (full-native Zanzibar). "Is this bearer
+// an admin / a creator?" is now `Check(workspace:self#admin@key:<keyHash>)` / `…#creator@…` over the
+// projected relation tuples (the wasm `check` op / the one gate's `engine.check`) — never an aggregate
+// probe. The AdminGrant/CreationGrant aggregates that backed these are gone; the tuple IS the grant.
 
 /** All children of a workspace (`""` = the roots) — the workspace tree's read side. */
 export const workspacesByParent = query("workspacesByParent")
@@ -983,3 +1012,29 @@ export const capabilityBindingsByWorkspace = query("capabilityBindingsByWorkspac
 export const capabilityBindingByKeyHash = query("capabilityBindingByKeyHash")
   .key("keyHash")
   .returns(CapabilityBinding);
+
+// ── THE ZANZIBAR SPINE comes to the CONTROL PLANE (governance → tuples) ──────────────────────────
+// The authority grants above ARE relation tuples in disguise (the same smell as the deleted
+// UserPermission): admin=`workspace:self#admin@key:<keyHash>`, creator=`…#creator@key:…`,
+// platformCreator=`workspace:self#platformCreator@user:<principal>`. grantAdmin/grantCreation/
+// grantPlatformCreation write them via `writeTuple`; the bespoke AdminGrant/CreationGrant aggregates +
+// their queries are GONE. Re-export the framework tuple surface so the COMPILED governance package mints
+// RelationTuple's stable id into the lockfile + identity manifest, the engine registers relateSubject/
+// unrelateSubject for dispatch, and the projected relationTuplesByObject read routes. (QuotaGrant stays
+// an aggregate — a numeric allowance, not a membership.)
+export { relateSubject, unrelateSubject, relationTuplesByObject } from "./relations.js";
+export { RelationTuple };
+
+// ── GOVERNANCE WRITE-AUTHZ IS NATIVE ZANZIBAR — the ONE gate, no bespoke predicates ───────────────────
+// The bespoke `workspaceInvariant` authz gates (AuthorHoldsAdmin / CreationGate / PlatformCreationGate)
+// are DELETED. Their job is now done by the full-native relation gate: each governance directive carries
+// `.requires("<relation>")` (above), the compiler emits `nomosRelations` (the schema) + `nomosRelationGate`
+// (directive→relation), and the ONE wasm gate runs `engine.check(schema, "workspace:self", relation,
+// principal)` over the PRE-APPLY folded relation tuples — refusing any author who does not HOLD the
+// relation, on every door (author / edge admission / verify_chain replay). The author is the CAPTURED
+// principal (`key:<sha256(bearer)>` for admin/creator, `user:<uid>` for platformCreator), pinned to the
+// sealed Attribution.actor on every peer — so "who may grant" is a LAW fact, never a host pre-check. The
+// pre-apply roster means `grantAdmin(@key:self)` cannot self-grant (the not-yet-written subject is absent
+// in the pre-apply state). SELF-RELATIVE: custody guarantees a workspace only folds its OWN tuples, so the
+// SAME law governs root and every born platform. The host's `_adminOk`/`_creationLawOk`/`_platformCheck`
+// pre-checks are GONE too (a pure bailiff) — the native gate refuses a non-holder at admission.

package/src/index.ts

@@ -51,6 +51,9 @@ export {
   set,
   addToSet,
   setEntry,
+  increment,
+  decrement,
+  removeFromSet,
   withMarker,
   strike,
   type PlannedOp,
@@ -58,7 +61,7 @@ export {
   type PlannedEventMarker,
   type StrikeOp,
 } from "./ops.js";
-export { directive, type Directive, type ReferentialMarker } from "./directive.js";
+export { directive, recordObject, type Directive, type ReferentialMarker } from "./directive.js";
 // FIRST-CLASS WORKSPACE TYPES (sharding §10 RATIFIED, slice 1) live on the SUBPATH
 // `@githolon/dsl/workspace-type` (`workspaceType("estate").root(Estate).hasMany(...)`),
 // NOT this runtime barrel — the barrel is bundled into EVERY tenant's engine lump, and
@@ -191,24 +194,11 @@ export {
   type EqFilter,
   type RequiredIndex,
 } from "./query/compile.js";
-export {
-  PERMISSION_STATUSES,
-  roleBindingSchema,
-  userPermissionAggregate,
-  userPermissionsInstanceId,
-  permissionId,
-  grant,
-  revoke,
-  delegate,
-  revokeDelegation,
-  updateMetadata,
-  roleCatalogue,
-  type PermissionStatus,
-  type FrameworkRoleBinding,
-  type UserPermissionAggregateHandle,
-  type Scope,
-  type RoleCatalogue,
-} from "./framework/rbac.js";
+// THE LEGACY RBAC (framework/rbac.ts: userPermissionAggregate / grant / revoke / delegate /
+// roleCatalogue) is DELETED — the one-model teardown. Read-visibility + grants are NATIVE relations:
+// a `requires(cap)` aggregate's cap IS a read relation (synthesized into nomosRelations at compile),
+// and a grant is a `relateSubject({ object:"workspace:self", relation:cap, ... })` tuple. See
+// framework/relations.ts + relation_schema.ts below.
 // NATIVE ZANZIBAR / ReBAC (architecture/zanzibar_native_plan.md, slice 1) — object-keyed
 // relation-tuple events `object#relation@subject`, the clean-slate-native authz spine.
 export {
@@ -234,6 +224,37 @@ export {
   encKeyByPrincipal,
   type EncKeyHandle,
 } from "./framework/encryption_identity.js";
+// IDENTITY KEYS (identity_keys.md) — the `signer` RELATION: the key↔identity binding is
+// native Zanzibar (`identity:<principal>#signer@key:<hash>`, enrolled/revoked via
+// relateSubject/unrelateSubject, checked by the engine), NOT a bespoke roster. The only
+// sub-Zanzibar primitive is the SIGNATURE itself (the crypto attestation).
+export {
+  identityRelations,
+  signerObject,
+  SIGNER_RELATION,
+  enrollSigner,
+} from "./framework/signing_identity.js";
+// THE HOME HOLON (home_holons_and_cross_custody.md §4) — the identity-role law: the shared-with-me access
+// index + the owner lane to maintain it (the key directory is the `signer` relation above).
+export {
+  SharedWithMe,
+  recordShare,
+  pruneShare,
+  sharedByWorkspace,
+  HomeOwner,
+  HOME_OWNER_ID,
+  seedHomeOwner,
+  writeHomeOwner,
+} from "./framework/home.js";
+// THE GENESIS WARRANT (identity_keys.md step 0) — the in-history birth fact that lets
+// the gate's genesis clause admit a founding control-plane grant on a virgin chain.
+export {
+  GenesisWarrant,
+  GENESIS_WARRANT_ID,
+  writeGenesisWarrant,
+  seedGenesis,
+  type GenesisWarrantHandle,
+} from "./framework/genesis.js";
 // E2E ENCRYPTION (slice 4) — the group-key events (RFC 9420 sender-keys on the ledger).
 export {
   KeyScope,
@@ -307,6 +328,54 @@ export {
   type WorkspaceInvariantAssert,
   type InvariantRef,
 } from "./framework/workspace_invariant.js";
+// NATIVE ZANZIBAR RELATION SCHEMA (P1) — the userset-rewrite law as pure data.
+export {
+  relationType,
+  isRelationTypeDecl,
+  validateRelationType,
+  self,
+  computed,
+  via,
+  viaAll,
+  union,
+  intersection,
+  exclusion,
+  user,
+  key,
+  object,
+  anyUser,
+  group,
+  DEFAULT_RELATION_CAPS,
+  type RelationTypeDecl,
+  type RelationTypeBuilder,
+  type RelationDefAst,
+  type Rewrite,
+  type AllowedSubject,
+  type RelationCaps,
+} from "./relation_schema.js";
+// SECURE-BY-DEFAULT SUGAR over the relation schema — plain-English combinators, audiences, presets.
+// Pure sugar: every export here BUILDS the existing Rewrite/RelationTypeDecl AST (no new wire shape).
+export {
+  // tier 1 — plain-English combinator aliases (OpenFGA-shaped)
+  directly,
+  inheritedFrom,
+  fromParent,
+  fromEveryParent,
+  or,
+  and,
+  butNot,
+  // tier 1.5 — the un-forgettable type-restriction pairing
+  storedFor,
+  roles,
+  // tier 2 — secure-by-default audiences
+  withAudiences,
+  secureType,
+  // tier 3 — one-shot patterns
+  roleHierarchy,
+  docSharingModel,
+  type RelationOpts,
+  type SugaredRelationTypeBuilder,
+} from "./relation_sugar.js";
 export { csv, csvRows } from "./report/csv.js";
 // CertifiedRead — the DECLARED write-path read surface (survival Constraint 5;
 // `certified_read.md`). A directive declares profiled reads via `.readsCertified({ name:

package/src/manifest.ts

@@ -113,10 +113,6 @@ export interface CanonicalDirective {
   /** The target aggregate id. */
   readonly target: string;
   readonly marker: WireRefMode;
-  /** The required capability — defaults to the directive id. */
-  readonly requiresCapability: string;
-  /** Whether the directive declares a `scopeFrom` (presence only, not behaviour). */
-  readonly scopeFrom: boolean;
   /** The payload's top-level object shape as SORTED `[name, type]` pairs. */
   readonly payload: CanonicalPayloadField[];
   /**
@@ -1046,8 +1042,6 @@ export function domainManifest(mod: DomainModule): CanonicalManifest {
       id: d.id,
       target: d.aggregateId,
       marker: encodeRefMode(d.marker),
-      requiresCapability: d.requiresCapability ?? d.id,
-      scopeFrom: d.scopeFrom !== undefined,
       payload: canonicalPayload(d.payloadSchema),
       payloadJsonSchema: canonicalPayloadJsonSchema(d.payloadSchema),
       // Omit-when-empty: a directive declaring NO boundary contributes neither key,

package/src/ops.ts

@@ -37,7 +37,7 @@ export interface FieldOp {
    */
   readonly marker?: PlannedEventMarker;
   readonly field: string;
-  readonly kind: "set" | "addToSet" | "setEntry";
+  readonly kind: "set" | "addToSet" | "setEntry" | "increment" | "decrement" | "removeFromSet";
   readonly value?: unknown;
   readonly items?: readonly string[];
   readonly entryKey?: string;
@@ -147,6 +147,55 @@ export function addToSet<
   return { ...addressOf(agg), field, kind: "addToSet", items };
 }
 
+/**
+ * `increment(handle, "field", amount)` — add to a PN-COUNTER field (`t.counter()`). The ONLY way to
+ * advance a counter (set() would clobber the convergent CRDT state). Concurrent increments on different
+ * replicas all land (the merge sums the per-replica totals), so nobody's count is lost. `amount` is a
+ * non-negative integer; the field must be `kind:"counter"`. `decrement` is the symmetric subtract.
+ */
+function counterDelta<A extends Target, K extends CounterKey<A>>(
+  agg: A,
+  field: K,
+  amount: number,
+  kind: "increment" | "decrement",
+): FieldOp {
+  if (!Number.isInteger(amount) || amount < 0) {
+    throw new Error(`${kind}('${String(field)}', ${amount}): amount must be a non-negative integer.`);
+  }
+  return { ...addressOf(agg), field: field as string, kind, value: amount };
+}
+/** A counter field key — `kind:"counter"` only (an `int` is NOT a counter; that would not converge). */
+type CounterKey<A> = {
+  [P in keyof Fields<A>]: Fields<A>[P] extends { kind: "counter" } ? P : never;
+}[keyof Fields<A>] &
+  string;
+
+export function increment<A extends Target, K extends CounterKey<A>>(agg: A, field: K, amount = 1): FieldOp {
+  return counterDelta(agg, field, amount, "increment");
+}
+/** `decrement(handle, "field", amount)` — subtract from a PN-counter field. See {@link increment}. */
+export function decrement<A extends Target, K extends CounterKey<A>>(agg: A, field: K, amount = 1): FieldOp {
+  return counterDelta(agg, field, amount, "decrement");
+}
+
+/**
+ * `removeFromSet(handle, "field", items)` — tombstone items in a REMOVE-WINS set (`t.set(...).merge(
+ * RemoveWins)`). The remove permanently WINS over any concurrent or later add of the same element
+ * (2-phase-set semantics), so a concurrent add+remove converges to "removed". The additive partner is
+ * {@link addToSet}; on a RemoveWins field both are encoded to the kernel's 2-phase ops. (On a plain
+ * AddWins set there is no remove — that's the whole point of AddWins — so this targets set fields and
+ * the encoder refuses a non-RemoveWins set at compile output.)
+ */
+export function removeFromSet<
+  A extends Target,
+  K extends {
+    [P in keyof Fields<A>]: FieldValue<Fields<A>[P]> extends string[] ? P : never;
+  }[keyof Fields<A>] &
+    string,
+>(agg: A, field: K, items: readonly string[]): FieldOp {
+  return { ...addressOf(agg), field, kind: "removeFromSet", items };
+}
+
 /** Set one entry of a map field. The map's value type is checked. */
 export function setEntry<
   A extends Target,