@githolon/dsl 0.80.1 → 0.81.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.80.1",
+  "version": "0.81.0",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/births.ts

@@ -79,6 +79,81 @@ export function birth(recipe: BirthRecipe): void {
   footprint.push(recipe);
 }
 
+// `nomos.sha256` — the trustless pure hash bound in the sealed engine (like `nomos.mint`), used to derive a
+// singleton child's DETERMINISTIC name in-law so every peer re-derives the same name.
+declare const nomos: { sha256(input: string): string };
+
+/** A genesis chain, or a builder that receives the resolved child workspace name (so a seed step can embed
+ *  it — e.g. `seedEstate` needs to write its own `estateName`). Passing a builder is the common case. */
+export type GenesisChainOrBuilder = unknown | ((childWorkspace: string) => unknown);
+function resolveChain(child: string, c: GenesisChainOrBuilder): unknown {
+  return typeof c === "function" ? (c as (w: string) => unknown)(child) : c;
+}
+
+/** A `create()`d aggregate reference — the birth's audit record, whose MINTED (captured, replay-stable) id
+ *  becomes the instance child's workspace name. Only its `__id` is read. */
+interface MintedRef {
+  readonly __id: string;
+}
+
+/**
+ * THE BIRTH CARDINALITY DECISION — stated at the call site so an agent models it right by default.
+ *
+ * A born child's workspace name is its IDENTITY. The wrong instinct (births are deterministic, so derive the
+ * name from a stable field like the owner) silently caps the parent at ONE child per owner. So the choice is
+ * explicit and NAMED, exactly like a merge driver states convergence:
+ *
+ *   • `birth.instance(...)` — MANY children per parent. The child's workspace id is MINTED from `from` (an
+ *     aggregate you `create()` for the birth) — its id already rides the committed intent (captured), so the
+ *     child name reproduces byte-identically at replay. Nomos mints the identity; you never hand-roll it.
+ *
+ *   • `birth.singleton(...)` — EXACTLY ONE child per `keyedBy`. The name is DERIVED deterministically in-law,
+ *     so a re-birth is idempotent (same name → the child self-validates to the same identity). This is the
+ *     RIGHT tool for a home (one home per user), and the ONLY case where a name-from-a-field is correct.
+ *
+ * Raw {@link birth} stays the low-level escape hatch for an externally-determined name.
+ */
+export const birthInstance = ({
+  from,
+  prefix = "",
+  genesisChain,
+}: {
+  /** The `create()`d audit record whose minted, captured id names the child (replay-stable uniqueness). */
+  from: MintedRef;
+  /** Optional human-legible workspace-name prefix (e.g. `"estate-"`). */
+  prefix?: string;
+  genesisChain: GenesisChainOrBuilder;
+}): string => {
+  const child = prefix + from.__id;
+  footprint.push({ workspace: child, genesisChain: resolveChain(child, genesisChain) });
+  return child;
+};
+
+export const birthSingleton = ({
+  keyedBy,
+  namespace,
+  genesisChain,
+}: {
+  /** The key the child is a singleton OF (e.g. the owner). One child per distinct key; re-birth idempotent. */
+  keyedBy: string | readonly string[];
+  /** Optional name namespace/prefix (e.g. `"home"` → `home-<hash>`). */
+  namespace?: string;
+  genesisChain: GenesisChainOrBuilder;
+}): string => {
+  const parts = (Array.isArray(keyedBy) ? keyedBy : [keyedBy]).map(String);
+  const child = (namespace ? namespace + "-" : "") + nomos.sha256(JSON.stringify(parts)).slice(0, 40);
+  footprint.push({ workspace: child, genesisChain: resolveChain(child, genesisChain) });
+  return child;
+};
+
+// Function/namespace declaration merging: attach the two cardinality verbs to `birth` so the call site reads
+// `birth.instance(...)` / `birth.singleton(...)` — with full types AND the runtime assignment in one place.
+// eslint-disable-next-line @typescript-eslint/no-namespace
+export namespace birth {
+  export const instance = birthInstance;
+  export const singleton = birthSingleton;
+}
+
 /**
  * THE PEER-SOVEREIGN ROOT-OF-TRUST SENTINEL (the BirthAttestation cert chain). A home/child law EXPORTS
  * this marker to declare it REQUIRES a parent-attested-birth: a warranted workspace running this law must

package/src/compile_package_main.ts

@@ -124,6 +124,7 @@ import {
 } from "./stable_ids.js";
 import { emitUsd, type UsdLayer } from "./usd.js";
 import { emitLayeredRelationUsda, type RelationLayerInput } from "./relation_composition.js";
+import { assertNoDartBarrelCollisions, type BarrelExportedFile } from "./dart_barrel_guard.js";
 import { generateTsClient, tsClientFactoryName, recursiveLazyTypes } from "./codegen_ts.js";
 import { generateOpenApiFragment, mergeOpenApiFragments } from "./codegen_openapi.js";
 import { domainInterface, type DomainInterface } from "./shape_compat.js";
@@ -892,6 +893,17 @@ function emitDart(
   //    dedup above makes the exports collision-free by construction; re-exporting the same library
   //    through two paths — e.g. a client's own `nomos_framework.dart` re-export — is not ambiguous).
   const genRel = DART_GENERATED_SUBDIR.split(path.sep).join("/");
+  // STRUCTURAL GUARD (dart_barrel_guard.ts): the barrel flat-exports every generated TYPES file, so no
+  // public name may be declared in ≥2 of them — else `dart analyze` fails the package with
+  // ambiguous_export. Refuse the compile NOW (before we write an uncompilable surface) with a named,
+  // actionable error. The framework-shared dedup keeps this green; this catches any future gap in it.
+  try {
+    assertNoDartBarrelCollisions(
+      [...sourceByFile.entries()].map(([label, src]): BarrelExportedFile => ({ label, src })),
+    );
+  } catch (e) {
+    fail((e as Error).message);
+  }
   const barrelLines = [
     "// GENERATED by nomos-compile — the package's public entrypoint. DO NOT EDIT.",
     "// Regenerated on every compile; generated implementation lives under src/generated/.",
@@ -1196,6 +1208,16 @@ function emitDartPackages(
         `// Import a domain with a prefix instead, e.g. \`import '${genRel}/<domain>.dart' as <domain>;\`.`,
       ]
     : [];
+  // STRUCTURAL GUARD (dart_barrel_guard.ts): refuse a types barrel that would flat-export the SAME public
+  // name from ≥2 files (ambiguous_export). Only the files the barrel ACTUALLY flat-exports are checked —
+  // under `barrelExports: 'explicit'` per-domain files are withheld, so they cannot collide there.
+  try {
+    assertNoDartBarrelCollisions(
+      typesExportKeys.map((f): BarrelExportedFile => ({ label: f, src: typesSources.get(f) ?? "" })),
+    );
+  } catch (e) {
+    fail((e as Error).message);
+  }
   const typesBarrel = [
     "// GENERATED by nomos-compile — the TYPES package's public entrypoint. DO NOT EDIT.",
     "// Pure data: payload classes, read models, VOs/enums, typed read accessors over the",

package/src/dart_barrel_guard.ts

@@ -0,0 +1,78 @@
+// NOMOS — Nomos Sovereign: participants act · verify · remember LOCALLY; hosted
+// remotes are replaceable custody/transport, not truth. ⇒ ONE Nomos GitHolon wasm.
+// If a file isn't this / hosting this / authoring for this / proving this — it's gone.
+
+/**
+ * DART BARREL COLLISION GUARD — compile self-refuses an uncompilable Dart surface.
+ *
+ * A Nomos package's generated Dart is exposed through ONE package barrel that FLAT-EXPORTS each
+ * generated file (`export 'src/generated/estate.dart';`, …). Dart's `export` brings every PUBLIC
+ * top-level declaration into the barrel's namespace; if the SAME public name is declared in ≥2
+ * flat-exported files, `dart analyze` fails the whole package with `ambiguous_export` — an error the
+ * tenant cannot fix without hand-editing generated code or restructuring their package.
+ *
+ * The framework-shared dedup (`nomos_framework.dart`) is meant to make this impossible by
+ * construction (framework symbols emit ONCE), but any gap in that dedup — a framework payload class
+ * NOT routed to the shared file, a VO emitted per-domain — reintroduces the collision silently. This
+ * guard is the STRUCTURAL backstop: we KNOW the public names we emit and which files the barrel
+ * flat-exports, so we detect the ambiguity at COMPILE time (no `dart analyze` needed) and REFUSE with
+ * a named, actionable error. Third occurrence of this bug class in layered Dart — this closes it for good.
+ */
+
+/** One flat-exported generated file the barrel re-exports: a human label (the domain / file name) + its Dart source. */
+export interface BarrelExportedFile {
+  /** The file's identifying label used in the error message (e.g. the domain key `estate`). */
+  readonly label: string;
+  /** The generated Dart source. */
+  readonly src: string;
+}
+
+/** Declared PUBLIC top-level type/typedef names in a Dart source (class/enum/mixin/extension type/typedef).
+ *  Private (`_`-prefixed) names never leak through an `export`, so they cannot collide — excluded. */
+export function publicDartDeclarations(src: string): Set<string> {
+  const names = new Set<string>();
+  const re =
+    /^(?:abstract\s+|base\s+|final\s+|sealed\s+|interface\s+|mixin\s+)*(?:class|enum|mixin|extension type|typedef)\s+([A-Za-z][A-Za-z0-9_]*)/gm;
+  for (let m = re.exec(src); m !== null; m = re.exec(src)) {
+    if (!m[1]!.startsWith("_")) names.add(m[1]!);
+  }
+  return names;
+}
+
+/** name → the sorted labels of the flat-exported files that each DECLARE it. Only entries with ≥2 files
+ *  are collisions (an `ambiguous_export`); a name declared in exactly one file is fine. */
+export function findDartBarrelCollisions(
+  files: readonly BarrelExportedFile[],
+): Map<string, string[]> {
+  const byName = new Map<string, Set<string>>();
+  for (const f of files) {
+    for (const name of publicDartDeclarations(f.src)) {
+      const set = byName.get(name) ?? new Set<string>();
+      set.add(f.label);
+      byName.set(name, set);
+    }
+  }
+  const collisions = new Map<string, string[]>();
+  for (const [name, labels] of byName) {
+    if (labels.size >= 2) collisions.set(name, [...labels].sort());
+  }
+  return collisions;
+}
+
+/** THROW a named, actionable error if the flat-exported files declare any public name more than once.
+ *  Green (no-op) when the surface is collision-free — the state every valid package MUST be in. */
+export function assertNoDartBarrelCollisions(files: readonly BarrelExportedFile[]): void {
+  const collisions = findDartBarrelCollisions(files);
+  if (collisions.size === 0) return;
+  const lines = [...collisions.entries()]
+    .sort(([a], [b]) => (a < b ? -1 : 1))
+    .map(([name, labels]) => `  • '${name}' is declared in ${labels.map((l) => `'${l}'`).join(", ")}`);
+  throw new Error(
+    `generated Dart would not compile — the package barrel flat-exports the SAME public name from ` +
+      `multiple files, so 'dart analyze' fails with ambiguous_export:\n${lines.join("\n")}\n` +
+      `A public name emitted per-domain must be FRAMEWORK-SHARED (emitted ONCE in nomos_framework.dart) ` +
+      `— this is a compiler bug, not a tenant one; do not hand-edit generated code. If a FRAMEWORK ` +
+      `directive/aggregate/value-object payload is colliding, it must carry the framework brand so the ` +
+      `dedup routes it to the shared file (see framework_aggregates.ts / secondary_ensure.ts).`,
+  );
+}

package/src/directive.ts

@@ -169,6 +169,28 @@ export interface Directive<P = unknown> {
       readonly signature: string;
     };
   };
+  /**
+   * DELEGATED-AUTHORITY DELIVERY (`delegatedRole`/`.delegatedFrom(parent)`,
+   * architecture/delegated_authority_births.md). When set, this directive folds a DELEGATED relation tuple
+   * ONLY if its payload carries a valid `DelegationCert` — a platform P's SIGNED grant, rooting at `K_root`,
+   * binding the SAME (relation, subject) the tuple writes, and (`.delegatedFrom(parent)`) whose grantor key
+   * is THIS workspace's declared parent key. Lowered into the `nomosDelegationGate` era key so the one gate
+   * (author / admission / verify_chain) re-verifies the grant OFFLINE — the delivered fact H's own
+   * `.requires(relation)` birth gate then reads locally. The kernel hardcodes no id/field — all law-declared.
+   */
+  readonly delegatedRoleGate?: {
+    /** The delegated relation the folded tuple writes (`co2EstateCreator`) — the cert must grant exactly it. */
+    readonly relation: string;
+    /** The payload field carrying the delegated subject (a `user:`/`key:` string). */
+    readonly subjectField: string;
+    /** The payload field carrying the `DelegationCert` (JSON string). */
+    readonly certField: string;
+    /** `.delegatedFrom(parent)`: the singleton INSTANCE id whose field holds this workspace's parent key
+     *  (e.g. `birth-attestation:self` / a seeded `platform-key:self`). "" ⇒ from-parent binding inert. */
+    readonly parentKeyObject: string;
+    /** The field on that singleton holding the parent's base64 ed25519 public key (e.g. `parentKey`). */
+    readonly parentKeyField: string;
+  };
   /**
    * THE KEYLESS VERIFIED-FIRST-DEVICE GATE (architecture/keyless_verified_onboard.md). When set, this
    * directive bootstraps a principal's FIRST device-signer from an ON-CHAIN, device-bound IdP attestation:
@@ -365,6 +387,21 @@ export interface RequirableDirective<P> extends Directive<P> {
    * host-free. Framework-only (the home law's `recordShare`). Returns a NEW requirable directive.
    */
   attestationAuthorized(owner: { ownerObject: string; ownerField: string }): RequirableDirective<P>;
+  /**
+   * Declare this directive a DELEGATED-AUTHORITY delivery (`delegated_authority_births.md`): its write folds
+   * the delegated `relation` tuple ONLY behind a carried `DelegationCert` P signed — lowered into the
+   * `nomosDelegationGate` era key so the one gate re-verifies the grant to `K_root` OFFLINE on every peer.
+   * `subjectField`/`certField` default to `"subject"`/`"delegationCert"`. Chain `.delegatedFrom(parent)` to
+   * bind the grantor to this workspace's parent key. Returns a NEW requirable directive.
+   */
+  delegatedRole(relation: string, opts?: { subjectField?: string; certField?: string }): RequirableDirective<P>;
+  /**
+   * `.delegatedFrom(parent)` — bind the delegating grantor to THIS workspace's parent key (the platform P
+   * that bore this home): the `DelegationCert`'s grantor key MUST equal the base64 key at
+   * `parentKeyObject.parentKeyField` (e.g. the birth-cert `birth-attestation:self`.`parentKey`, or a seeded
+   * `platform-key:self`.`grantorKey`). Refines the `.delegatedRole()` gate. Returns a NEW requirable directive.
+   */
+  delegatedFrom(parent: { parentKeyObject: string; parentKeyField: string }): RequirableDirective<P>;
   /**
    * Declare this directive a KEYLESS VERIFIED-FIRST-DEVICE bootstrap (keyless_verified_onboard.md): its
    * authorization is a carried, device-bound IdP `idpToken` re-verified against the workspace AuthProvider —
@@ -762,6 +799,44 @@ function makeRequirable<P>(base: Directive<P>): RequirableDirective<P> {
         },
       });
     },
+    delegatedRole(relation: string, opts?: { subjectField?: string; certField?: string }): RequirableDirective<P> {
+      // DELEGATED-AUTHORITY DELIVERY (delegated_authority_births.md): this directive's write folds the
+      // delegated `relation` tuple ONLY behind a carried DelegationCert — lowered into the `nomosDelegationGate`
+      // era key, so the one gate re-verifies P's grant to K_root OFFLINE on every peer. Field names default to
+      // the framework convention here (the kernel reads them from the law's declaration, hardcoding nothing).
+      const prior = (base as { delegatedRoleGate?: { parentKeyObject?: string; parentKeyField?: string } })
+        .delegatedRoleGate;
+      return makeRequirable({
+        ...base,
+        delegatedRoleGate: {
+          relation,
+          subjectField: opts?.subjectField ?? "subject",
+          certField: opts?.certField ?? "delegationCert",
+          parentKeyObject: prior?.parentKeyObject ?? "",
+          parentKeyField: prior?.parentKeyField ?? "",
+        },
+      });
+    },
+    delegatedFrom(parent: { parentKeyObject: string; parentKeyField: string }): RequirableDirective<P> {
+      // .delegatedFrom(parent): bind the grantor to this workspace's parent key (the platform P). Refines the
+      // .delegatedRole() gate (a preceding .delegatedRole() supplies relation/fields; this adds the binding).
+      const g = (base as { delegatedRoleGate?: {
+        relation: string; subjectField: string; certField: string;
+      } }).delegatedRoleGate;
+      if (g === undefined) {
+        throw new Error("directive.delegatedFrom(): call .delegatedRole(relation) before .delegatedFrom(parent)");
+      }
+      return makeRequirable({
+        ...base,
+        delegatedRoleGate: {
+          relation: g.relation,
+          subjectField: g.subjectField,
+          certField: g.certField,
+          parentKeyObject: parent.parentKeyObject,
+          parentKeyField: parent.parentKeyField,
+        },
+      });
+    },
     verifiedFirstDevice(opts?: {
       tokenField?: string;
       keyHashField?: string;

package/src/secondary_ensure.ts

@@ -53,10 +53,22 @@ export function sanctioningEnsureDirectiveId(aggId: string): string {
  * lane for a plan's secondary deterministic `ensure(agg, …)`.
  */
 export function sanctioningEnsureDirective(agg: AggregateHandle): Directive<unknown> {
-  return directive(sanctioningEnsureDirectiveId(agg.id))
+  const dir = directive(sanctioningEnsureDirectiveId(agg.id))
     .ensures(agg)
     .payload(z.object({}).strict())
     .plan(() => []) as unknown as Directive<unknown>;
+  // FRAMEWORK-SHARED DEDUP (Dart codegen): when the sanctioned aggregate is a FRAMEWORK singleton
+  // (e.g. RelationTuple — auto-ensured into EVERY relation-using domain), this directive is injected
+  // per-domain but its payload class (`NomosEnsure_<Agg>Payload`, zero-field) is byte-identical across
+  // all of them. Left unbranded, each domain's Dart file re-defines the class and a layered types
+  // barrel flat-exporting ≥2 domains collides (`ambiguous_export`). Brand it framework — exactly the
+  // `nomosSourceFrontierEnsure` precedent — so its payload dedups into `nomos_framework.dart` ONCE.
+  // A sanction over a TENANT aggregate stays per-domain (its aggregate lives in that one domain, so no
+  // cross-domain collision is possible) — hence gating on the framework brand, not blanket branding.
+  if ((agg as { framework?: true }).framework === true) {
+    (dir as { framework?: true }).framework = true;
+  }
+  return dir;
 }
 
 /**

package/src/usd.ts

@@ -347,6 +347,25 @@ export interface UsdLayer {
       }
     >;
   };
+  /**
+   * THE DELEGATED-AUTHORITY GATE (delegated_authority_births.md). Present IFF ≥1 directive declares
+   * `.delegatedRole()`: directiveId → {relation, subjectField, certField, parentKeyObject, parentKeyField}.
+   * The one gate folds the delegated tuple ONLY behind a DelegationCert P signed (rooting at K_root, binding
+   * the same relation+subject, `.delegatedFrom(parent)`). OMITTED for law with no such directive (era rule).
+   */
+  readonly nomosDelegationGate?: {
+    readonly v: 1;
+    readonly directives: Record<
+      string,
+      {
+        readonly relation: string;
+        readonly subjectField: string;
+        readonly certField: string;
+        readonly parentKeyObject: string;
+        readonly parentKeyField: string;
+      }
+    >;
+  };
   /**
    * THE KEYLESS VERIFIED-FIRST-DEVICE GATE (architecture/keyless_verified_onboard.md). Present IFF ≥1
    * directive declares `.verifiedFirstDevice()`: a per-directive payload FIELD MAPPING. A principal's FIRST
@@ -1136,6 +1155,30 @@ export function emitUsd(
       }
       const nomosAttestationGate =
         Object.keys(attestationReq).length > 0 ? { v: 1 as const, directives: attestationReq } : undefined;
+      // THE DELEGATED-AUTHORITY GATE (delegated_authority_births.md): directives declaring `.delegatedRole()`
+      // → directiveId → its {relation, subjectField, certField, parentKeyObject, parentKeyField}. SORTED keys
+      // (byte-determinism). Omit-when-empty (era rule) — a law with no delegation is byte-identical. The one
+      // gate verifies the carried DelegationCert to K_root + binds (relation, subject) + `.delegatedFrom(parent)`.
+      const delegationReq: Record<
+        string,
+        { relation: string; subjectField: string; certField: string; parentKeyObject: string; parentKeyField: string }
+      > = {};
+      for (const d of [...l.module.directives].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0))) {
+        const g = (d as { delegatedRoleGate?: {
+          relation: string; subjectField: string; certField: string; parentKeyObject: string; parentKeyField: string;
+        } }).delegatedRoleGate;
+        if (g !== undefined) {
+          delegationReq[d.id] = {
+            relation: g.relation,
+            subjectField: g.subjectField,
+            certField: g.certField,
+            parentKeyObject: g.parentKeyObject,
+            parentKeyField: g.parentKeyField,
+          };
+        }
+      }
+      const nomosDelegationGate =
+        Object.keys(delegationReq).length > 0 ? { v: 1 as const, directives: delegationReq } : undefined;
       // THE ATTESTED-READ GATE (slice B): per-directive `(queryId, from)` edges + the module's
       // trustSource declarations. Emitted iff ≥1 directive declares a foreign read (the era
       // rule). A declared `from` with NO matching trustSource is a NAMED COMPILE ERROR — the
@@ -1492,6 +1535,7 @@ export function emitUsd(
         ...(nomosReadProjectionNamespace !== undefined ? { nomosReadProjectionNamespace } : {}),
         ...(nomosRelationGate !== undefined ? { nomosRelationGate } : {}),
         ...(nomosAttestationGate !== undefined ? { nomosAttestationGate } : {}),
+        ...(nomosDelegationGate !== undefined ? { nomosDelegationGate } : {}),
         ...(nomosAttestedReadGate !== undefined ? { nomosAttestedReadGate } : {}),
         ...(nomosBirthGate !== undefined ? { nomosBirthGate } : {}),
         ...(nomosBirthRecordGate !== undefined ? { nomosBirthRecordGate } : {}),

package/src/usd_layers.ts

@@ -198,6 +198,9 @@ function domainLayerAttrLines(domain: string, layer: UsdLayer, indent: string):
     ...(layer.nomosAttestationGate !== undefined
       ? [`${indent}custom string nomos:attestationGateHex = ${usdaString(hexUtf8(JSON.stringify(layer.nomosAttestationGate)))}`]
       : []),
+    ...(layer.nomosDelegationGate !== undefined
+      ? [`${indent}custom string nomos:delegationGateHex = ${usdaString(hexUtf8(JSON.stringify(layer.nomosDelegationGate)))}`]
+      : []),
     ...(layer.nomosAttestedReadGate !== undefined
       ? [`${indent}custom string nomos:attestedReadGateHex = ${usdaString(hexUtf8(JSON.stringify(layer.nomosAttestedReadGate)))}`]
       : []),
@@ -875,6 +878,22 @@ export function flattenLayeredUsd(layers: readonly UsdLayer[]): UsdDocument {
         attestationGate = { v: 1, directives: rec };
       }
     }
+    // THE DELEGATED-AUTHORITY GATE (delegated_authority_births.md): directiveId → delegation spec merged
+    // later-wins across layers, SORTED keys. Omit-when-empty (era rule).
+    let delegationGate: UsdLayer["nomosDelegationGate"];
+    {
+      type DelSrc = NonNullable<UsdLayer["nomosDelegationGate"]>["directives"][string];
+      const a = new Map<string, DelSrc>();
+      for (const l of stack) {
+        if (l.nomosDelegationGate === undefined) continue;
+        for (const [id, src] of Object.entries(l.nomosDelegationGate.directives)) a.set(id, src);
+      }
+      if (a.size > 0) {
+        const rec: Record<string, DelSrc> = {};
+        for (const k of [...a.keys()].sort()) rec[k] = a.get(k)!;
+        delegationGate = { v: 1, directives: rec };
+      }
+    }
     // THE ATTESTED-READ GATE (slice B): sources + per-directive edges merged later-wins across
     // layers, SORTED keys (matching the composed emission). Omit-when-empty (era rule).
     let attestedReadGate: UsdLayer["nomosAttestedReadGate"];
@@ -1031,6 +1050,7 @@ return {
       ...(readProjectionNamespace !== undefined ? { nomosReadProjectionNamespace: readProjectionNamespace } : {}),
       ...(relationGate !== undefined ? { nomosRelationGate: relationGate } : {}),
       ...(attestationGate !== undefined ? { nomosAttestationGate: attestationGate } : {}),
+      ...(delegationGate !== undefined ? { nomosDelegationGate: delegationGate } : {}),
       ...(attestedReadGate !== undefined ? { nomosAttestedReadGate: attestedReadGate } : {}),
       ...(birthGate !== undefined ? { nomosBirthGate: birthGate } : {}),
       ...(birthRecordGate !== undefined ? { nomosBirthRecordGate: birthRecordGate } : {}),
@@ -1173,6 +1193,7 @@ export function parseUsdaDocument(text: string): UsdDocument {
   const relationNamespaceByDomain = new Map<string, UsdLayer["nomosRelationNamespace"]>();
   const readProjectionNamespaceByDomain = new Map<string, UsdLayer["nomosReadProjectionNamespace"]>();
   const attestationGateByDomain = new Map<string, UsdLayer["nomosAttestationGate"]>();
+  const delegationGateByDomain = new Map<string, UsdLayer["nomosDelegationGate"]>();
   const attestedReadGateByDomain = new Map<string, UsdLayer["nomosAttestedReadGate"]>();
   const birthGateByDomain = new Map<string, UsdLayer["nomosBirthGate"]>();
   const birthRecordGateByDomain = new Map<string, UsdLayer["nomosBirthRecordGate"]>();
@@ -1248,6 +1269,11 @@ export function parseUsdaDocument(text: string): UsdDocument {
       if (typeof attGateHex === "string") {
         attestationGateByDomain.set(domain, JSON.parse(unhexUtf8(attGateHex)) as UsdLayer["nomosAttestationGate"]);
       }
+      // THE DELEGATED-AUTHORITY GATE (delegated_authority_births.md): the hex-carried delegation spec.
+      const delGateHex = p.attrs.get("nomos:delegationGateHex");
+      if (typeof delGateHex === "string") {
+        delegationGateByDomain.set(domain, JSON.parse(unhexUtf8(delGateHex)) as UsdLayer["nomosDelegationGate"]);
+      }
       // THE ATTESTED-READ GATE (slice B): the hex-carried trust-edge declaration.
       const attReadGateHex = p.attrs.get("nomos:attestedReadGateHex");
       if (typeof attReadGateHex === "string") {
@@ -1395,6 +1421,7 @@ export function parseUsdaDocument(text: string): UsdDocument {
       const relNs = relationNamespaceByDomain.get(domain);
       const rpNs = readProjectionNamespaceByDomain.get(domain);
       const attGate = attestationGateByDomain.get(domain);
+      const delGate = delegationGateByDomain.get(domain);
       const attReadGate = attestedReadGateByDomain.get(domain);
       const birthGate = birthGateByDomain.get(domain);
       const birthRecordGate = birthRecordGateByDomain.get(domain);
@@ -1423,6 +1450,7 @@ export function parseUsdaDocument(text: string): UsdDocument {
         ...(rpNs !== undefined ? { nomosReadProjectionNamespace: rpNs } : {}),
         ...(relGate !== undefined ? { nomosRelationGate: relGate } : {}),
         ...(attGate !== undefined ? { nomosAttestationGate: attGate } : {}),
+        ...(delGate !== undefined ? { nomosDelegationGate: delGate } : {}),
         ...(attReadGate !== undefined ? { nomosAttestedReadGate: attReadGate } : {}),
         ...(birthGate !== undefined ? { nomosBirthGate: birthGate } : {}),
         ...(birthRecordGate !== undefined ? { nomosBirthRecordGate: birthRecordGate } : {}),