@githolon/dsl 0.80.2 → 0.82.0

package/dart/lib/nomos_client.dart

@@ -31,6 +31,7 @@ library;
 export 'package:nomos_types/nomos_types.dart';
 // homeNameOf(subject) — the canonical home-workspace name (parity with @githolon/client + the law side).
 export 'src/home.dart';
+export 'src/workspace_name.dart';
 // THE WEBVIEW BRIDGE (app-binding boundary) — the async Dart runtime that drives the REAL githolon running
 // in a WebView, so the generated typed client never needs a `MemoryPersistence` fake.
 export 'src/webview_bridge.dart';

package/dart/lib/src/webview_bridge.dart

@@ -1827,6 +1827,33 @@ class NomosBridge {
           Map<String, Object?> args) async =>
       _asMap(await _call('attestationSign', {'args': args}));
 
+  /// Issue a ROLE-DELEGATION cert (the `.delegatedRole()` lane, kernel `delegationCertSign` op). A platform
+  /// signs — with its grantor secret `signerSecret` (base64) — a cert granting `relation` to `subject`,
+  /// carrying the lineage `certChain` up to K_root. Returns `{ certString }`; deliver it into the target
+  /// home via the tenant's `acceptDelegatedRole` directive (the one gate re-verifies it to K_root on every
+  /// lane). OURS = the op; operating the grantor secret + choosing who to grant is the TENANT.
+  ///   final res = await bridge.issueDelegationCert(signerSecret: sP, grantorId: 'co2-platform',
+  ///       relation: 'co2EstateCreator', subject: userSubject, epoch: 1, certChain: [rootLink]);
+  ///   final certString = res['certString'] as String;
+  Future<Map<String, Object?>> issueDelegationCert({
+    required String signerSecret,
+    required String grantorId,
+    required String relation,
+    required String subject,
+    int epoch = 1,
+    List<Object?>? certChain,
+  }) async =>
+      _asMap(await _call('issueDelegationCert', {
+        'args': {
+          'signerSecret': signerSecret,
+          'grantorId': grantorId,
+          'relation': relation,
+          'subject': subject,
+          'epoch': epoch,
+          if (certChain != null) 'certChain': certChain,
+        },
+      }));
+
   /// A declared query's rows from the local projection. `keys` (E2E sealing) injects the reader's held
   /// scope keys so encrypted fields AEAD-open in-wasm; absent ⇒ they stay opaque envelopes (today's
   /// behavior). `principal` stamps the private-read gate (defaults to the connection's bound principal).

package/dart/lib/src/workspace_name.dart

@@ -0,0 +1,24 @@
+import 'dart:convert';
+
+import 'package:crypto/crypto.dart';
+
+/// The unit separator (0x1F) that disambiguates `(namespace, key)` in the name hash input.
+final String workspaceNameSep = String.fromCharCode(31);
+
+/// Re-derive the workspace name a keyed birth produced, so you can ADDRESS a born workspace from a key you
+/// own — with zero persistence, on any device, any time.
+///
+/// A workspace exists to be used, and using it means finding it again. When a law births a child with
+/// `birth.keyed({ key, namespace })` (the `@githolon/dsl` verb), the workspace name is
+/// `<namespace>-<sha256(namespace + SEP + key)[:40]>`. This function computes the IDENTICAL name — it is the
+/// byte-for-byte mirror of `@githolon/dsl`'s `workspaceNameForKey` and `@githolon/client`'s
+/// `deriveWorkspaceName`, contract-tested against shared vectors. So instead of persisting a minted name or
+/// hand-rolling an `estateWorkspaceForEstateId` helper, you write:
+///
+/// ```dart
+/// final ws = deriveWorkspaceName('estate', estateId); // open / sync / mount it
+/// ```
+String deriveWorkspaceName(String namespace, String key) {
+  final digest = sha256.convert(utf8.encode('$namespace$workspaceNameSep$key')).toString();
+  return '$namespace-${digest.substring(0, 40)}';
+}

package/dart/test/workspace_name_test.dart

@@ -0,0 +1,24 @@
+import 'package:nomos_client/src/workspace_name.dart';
+import 'package:test/test.dart';
+
+// CONTRACT VECTORS — shared byte-for-byte with @githolon/dsl `workspaceNameForKey` and @githolon/client
+// `deriveWorkspaceName`. Generated with real sha256 (node crypto). If any of the three derivations drifts,
+// a workspace born by one peer becomes unaddressable by another — so these must never change silently.
+void main() {
+  group('deriveWorkspaceName — the shared birth-name derivation', () {
+    test('matches the cross-language reference vectors', () {
+      expect(deriveWorkspaceName('estate', 'estate-abc123'),
+          'estate-83662e729ba18cd04bde52c7a8d854594833d70e');
+      expect(deriveWorkspaceName('home', 'user:ada'),
+          'home-561af44c94b5b80824f1a9e8cfa1095105f3cb34');
+      expect(deriveWorkspaceName('catalogue', 'cat-42'),
+          'catalogue-f50bf3b9732dc36961b05b8e6503d96df5f3e88e');
+    });
+
+    test('is deterministic and namespaced (no cross-namespace collision)', () {
+      expect(deriveWorkspaceName('estate', 'z'), deriveWorkspaceName('estate', 'z'));
+      expect(deriveWorkspaceName('estate', 'z'), isNot(deriveWorkspaceName('catalogue', 'z')));
+      expect(deriveWorkspaceName('estate', 'z').startsWith('estate-'), isTrue);
+    });
+  });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.80.2",
+  "version": "0.82.0",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/births.ts

@@ -79,6 +79,133 @@ export function birth(recipe: BirthRecipe): void {
   footprint.push(recipe);
 }
 
+// `nomos.sha256` — the trustless pure hash bound in the sealed engine (like `nomos.mint`), used to derive a
+// keyed child's DETERMINISTIC, ADDRESSABLE name in-law so every peer — and every CLIENT — re-derives the
+// same name from the same key.
+declare const nomos: { sha256(input: string): string };
+
+/**
+ * THE ONE WORKSPACE-NAME DERIVATION — shared verbatim by the law (this engine), the Dart client, and the TS
+ * client, so a workspace born under a key is ADDRESSABLE from that key on every peer with zero persistence.
+ *
+ *   name = `<namespace>-<sha256(namespace + "" + key)[:40]>`
+ *
+ * A workspace exists to be USED, and using it means finding it again — so a birth's name is NEVER opaque or
+ * minted-and-forgotten; it is a pure function of a key the caller already owns (a business id, an owner uid).
+ * The `` (unit separator) makes `(ns,key)` unambiguous. `nomos.sha256` returns lowercase hex.
+ *
+ * The client mirror is `deriveWorkspaceName(namespace, key)` in `nomos_client` (Dart) and `@githolon/client`
+ * (TS) — byte-identical output is contract-tested against {@link WORKSPACE_NAME_VECTORS}.
+ */
+export const WORKSPACE_NAME_SEP = "\u001f"; // unit separator disambiguates (namespace,key)
+export function workspaceNameForKey(namespace: string, key: string): string {
+  return namespace + "-" + nomos.sha256(String(namespace) + WORKSPACE_NAME_SEP + String(key)).slice(0, 40);
+}
+
+/** A genesis chain, or a builder that receives the resolved child workspace name (so a seed step can embed
+ *  it — e.g. `seedEstate` needs to write its own `estateName`). Passing a builder is the common case. */
+// An array of genesis steps, OR a builder that receives the resolved child name. Typed as `unknown[]`
+// (not `unknown`) so the union doesn't collapse — the builder's `childWorkspace` param infers as `string`.
+export type GenesisChainOrBuilder = readonly unknown[] | ((childWorkspace: string) => readonly unknown[]);
+function resolveChain(child: string, c: GenesisChainOrBuilder): unknown {
+  return typeof c === "function" ? c(child) : c;
+}
+
+/** A `create()`d aggregate reference — the birth's audit record, whose MINTED (captured, replay-stable) id
+ *  becomes the instance child's workspace name. Only its `__id` is read. */
+interface MintedRef {
+  readonly __id: string;
+}
+
+/**
+ * `birth.keyed(...)` — THE way to birth a child workspace. A workspace exists to be USED, and using it means
+ * FINDING IT AGAIN, so its name is ALWAYS derived from a `key` the caller owns (a business id, an owner uid)
+ * via {@link workspaceNameForKey}. The client re-derives the SAME name with `deriveWorkspaceName(namespace,
+ * key)` — so the born workspace is addressable from the key alone, with zero persistence. Same key ⇒ same
+ * workspace (re-birth is idempotent). This is the only birth verb you need.
+ *
+ * ```ts
+ * export const birthEstate = directive("birthEstate")
+ *   .creates(EstateBirth)
+ *   .payload(z.object({ estateId: z.string(), owner: z.string(), frameworkHash: z.string(), lawHash: z.string(), bornAt: z.string() }))
+ *   .plan((p) => {
+ *     birth.keyed({ key: p.estateId, namespace: "estate", genesisChain: (ws) => [
+ *       { domain: "bootstrap", directiveId: "installDomain", actor: p.owner, payload: { domainHash: p.frameworkHash }, domainHash: p.frameworkHash, domainPackageB64: "" },
+ *       { domain: "nomos",     directiveId: "installDomain", actor: p.owner, payload: { domainHash: p.lawHash },       domainHash: p.lawHash,       domainPackageB64: "" },
+ *       { domain: "estate",    directiveId: "seedEstate", actor: p.owner, payload: { estateId: p.estateId, workspaceName: ws, bornAt: p.bornAt } },
+ *     ] });
+ *     return [];
+ *   })
+ *   .births().requires("estateCreator");
+ * // app (Dart / TS): final ws = client.deriveWorkspaceName('estate', estateId); // open it, any time, any device
+ * ```
+ */
+export const birthKeyed = ({
+  key,
+  namespace,
+  genesisChain,
+}: {
+  /** The id you already own that this workspace is FOR (an estateId, an owner uid). The client addresses the
+   *  born workspace by re-deriving its name from this same key — so pick a key the client will have in hand. */
+  key: string;
+  /** The workspace-name namespace (e.g. `"estate"` → `estate-<hash>`). Groups a domain's children. */
+  namespace: string;
+  genesisChain: GenesisChainOrBuilder;
+}): string => {
+  const child = workspaceNameForKey(namespace, String(key));
+  footprint.push({ workspace: child, genesisChain: resolveChain(child, genesisChain) });
+  return child;
+};
+
+/**
+ * @deprecated Use {@link birthKeyed}. `birth.instance` mints a name the caller THROWS AWAY — so the born
+ * workspace can never be found again except via the birth result. A workspace is a custodial thing you birth
+ * in order to use; there is no workspace you make and never address later. Birth by a key you own instead.
+ */
+export const birthInstance = ({
+  from,
+  prefix = "",
+  genesisChain,
+}: {
+  from: MintedRef;
+  prefix?: string;
+  genesisChain: GenesisChainOrBuilder;
+}): string => {
+  const child = prefix + from.__id;
+  footprint.push({ workspace: child, genesisChain: resolveChain(child, genesisChain) });
+  return child;
+};
+
+/**
+ * `birth.singleton(...)` — a keyed birth whose key is a NATURAL single key (one home per user: key = owner).
+ * Sugar over {@link birthKeyed}: `birth.singleton({ keyedBy: owner, namespace: "home" })`. Same addressing
+ * story — the client re-derives with `deriveWorkspaceName(namespace, keyedBy)`.
+ */
+export const birthSingleton = ({
+  keyedBy,
+  namespace,
+  genesisChain,
+}: {
+  /** The natural single key (e.g. the owner). One workspace per key; re-birth idempotent. */
+  keyedBy: string | readonly string[];
+  /** The workspace-name namespace (e.g. `"home"`). */
+  namespace: string;
+  genesisChain: GenesisChainOrBuilder;
+}): string => {
+  const key = (Array.isArray(keyedBy) ? keyedBy : [keyedBy]).map(String).join(WORKSPACE_NAME_SEP);
+  return birthKeyed({ key, namespace, genesisChain });
+};
+
+// Function/namespace declaration merging: attach the birth verbs to `birth` so the call site reads
+// `birth.keyed(...)` — with full types AND the runtime assignment in one place.
+// eslint-disable-next-line @typescript-eslint/no-namespace
+export namespace birth {
+  export const keyed = birthKeyed;
+  export const singleton = birthSingleton;
+  /** @deprecated Use `birth.keyed` — see {@link birthInstance}. */
+  export const instance = birthInstance;
+}
+
 /**
  * THE PEER-SOVEREIGN ROOT-OF-TRUST SENTINEL (the BirthAttestation cert chain). A home/child law EXPORTS
  * this marker to declare it REQUIRES a parent-attested-birth: a warranted workspace running this law must

package/src/directive.ts

@@ -169,6 +169,28 @@ export interface Directive<P = unknown> {
       readonly signature: string;
     };
   };
+  /**
+   * DELEGATED-AUTHORITY DELIVERY (`delegatedRole`/`.delegatedFrom(parent)`,
+   * architecture/delegated_authority_births.md). When set, this directive folds a DELEGATED relation tuple
+   * ONLY if its payload carries a valid `DelegationCert` — a platform P's SIGNED grant, rooting at `K_root`,
+   * binding the SAME (relation, subject) the tuple writes, and (`.delegatedFrom(parent)`) whose grantor key
+   * is THIS workspace's declared parent key. Lowered into the `nomosDelegationGate` era key so the one gate
+   * (author / admission / verify_chain) re-verifies the grant OFFLINE — the delivered fact H's own
+   * `.requires(relation)` birth gate then reads locally. The kernel hardcodes no id/field — all law-declared.
+   */
+  readonly delegatedRoleGate?: {
+    /** The delegated relation the folded tuple writes (`co2EstateCreator`) — the cert must grant exactly it. */
+    readonly relation: string;
+    /** The payload field carrying the delegated subject (a `user:`/`key:` string). */
+    readonly subjectField: string;
+    /** The payload field carrying the `DelegationCert` (JSON string). */
+    readonly certField: string;
+    /** `.delegatedFrom(parent)`: the singleton INSTANCE id whose field holds this workspace's parent key
+     *  (e.g. `birth-attestation:self` / a seeded `platform-key:self`). "" ⇒ from-parent binding inert. */
+    readonly parentKeyObject: string;
+    /** The field on that singleton holding the parent's base64 ed25519 public key (e.g. `parentKey`). */
+    readonly parentKeyField: string;
+  };
   /**
    * THE KEYLESS VERIFIED-FIRST-DEVICE GATE (architecture/keyless_verified_onboard.md). When set, this
    * directive bootstraps a principal's FIRST device-signer from an ON-CHAIN, device-bound IdP attestation:
@@ -365,6 +387,21 @@ export interface RequirableDirective<P> extends Directive<P> {
    * host-free. Framework-only (the home law's `recordShare`). Returns a NEW requirable directive.
    */
   attestationAuthorized(owner: { ownerObject: string; ownerField: string }): RequirableDirective<P>;
+  /**
+   * Declare this directive a DELEGATED-AUTHORITY delivery (`delegated_authority_births.md`): its write folds
+   * the delegated `relation` tuple ONLY behind a carried `DelegationCert` P signed — lowered into the
+   * `nomosDelegationGate` era key so the one gate re-verifies the grant to `K_root` OFFLINE on every peer.
+   * `subjectField`/`certField` default to `"subject"`/`"delegationCert"`. Chain `.delegatedFrom(parent)` to
+   * bind the grantor to this workspace's parent key. Returns a NEW requirable directive.
+   */
+  delegatedRole(relation: string, opts?: { subjectField?: string; certField?: string }): RequirableDirective<P>;
+  /**
+   * `.delegatedFrom(parent)` — bind the delegating grantor to THIS workspace's parent key (the platform P
+   * that bore this home): the `DelegationCert`'s grantor key MUST equal the base64 key at
+   * `parentKeyObject.parentKeyField` (e.g. the birth-cert `birth-attestation:self`.`parentKey`, or a seeded
+   * `platform-key:self`.`grantorKey`). Refines the `.delegatedRole()` gate. Returns a NEW requirable directive.
+   */
+  delegatedFrom(parent: { parentKeyObject: string; parentKeyField: string }): RequirableDirective<P>;
   /**
    * Declare this directive a KEYLESS VERIFIED-FIRST-DEVICE bootstrap (keyless_verified_onboard.md): its
    * authorization is a carried, device-bound IdP `idpToken` re-verified against the workspace AuthProvider —
@@ -762,6 +799,44 @@ function makeRequirable<P>(base: Directive<P>): RequirableDirective<P> {
         },
       });
     },
+    delegatedRole(relation: string, opts?: { subjectField?: string; certField?: string }): RequirableDirective<P> {
+      // DELEGATED-AUTHORITY DELIVERY (delegated_authority_births.md): this directive's write folds the
+      // delegated `relation` tuple ONLY behind a carried DelegationCert — lowered into the `nomosDelegationGate`
+      // era key, so the one gate re-verifies P's grant to K_root OFFLINE on every peer. Field names default to
+      // the framework convention here (the kernel reads them from the law's declaration, hardcoding nothing).
+      const prior = (base as { delegatedRoleGate?: { parentKeyObject?: string; parentKeyField?: string } })
+        .delegatedRoleGate;
+      return makeRequirable({
+        ...base,
+        delegatedRoleGate: {
+          relation,
+          subjectField: opts?.subjectField ?? "subject",
+          certField: opts?.certField ?? "delegationCert",
+          parentKeyObject: prior?.parentKeyObject ?? "",
+          parentKeyField: prior?.parentKeyField ?? "",
+        },
+      });
+    },
+    delegatedFrom(parent: { parentKeyObject: string; parentKeyField: string }): RequirableDirective<P> {
+      // .delegatedFrom(parent): bind the grantor to this workspace's parent key (the platform P). Refines the
+      // .delegatedRole() gate (a preceding .delegatedRole() supplies relation/fields; this adds the binding).
+      const g = (base as { delegatedRoleGate?: {
+        relation: string; subjectField: string; certField: string;
+      } }).delegatedRoleGate;
+      if (g === undefined) {
+        throw new Error("directive.delegatedFrom(): call .delegatedRole(relation) before .delegatedFrom(parent)");
+      }
+      return makeRequirable({
+        ...base,
+        delegatedRoleGate: {
+          relation: g.relation,
+          subjectField: g.subjectField,
+          certField: g.certField,
+          parentKeyObject: parent.parentKeyObject,
+          parentKeyField: parent.parentKeyField,
+        },
+      });
+    },
     verifiedFirstDevice(opts?: {
       tokenField?: string;
       keyHashField?: string;

package/src/index.ts

@@ -198,7 +198,16 @@ export {
 // child's genesis recipe via `birth(recipe)` (reuse `buildGenesisChain`); it rides the committed intent as a
 // declared output, and the kernel — reading the `.births` declaration off the law manifest (the
 // `nomosBirthGate` era key, never domain state) — spawns + self-validates the child after the offer admits.
-export { birth, type BirthRecipe } from "./births.js";
+export {
+  birth,
+  workspaceNameForKey,
+  WORKSPACE_NAME_SEP,
+  birthKeyed,
+  birthSingleton,
+  birthInstance,
+  type BirthRecipe,
+  type GenesisChainOrBuilder,
+} from "./births.js";
 // THE PEER-SOVEREIGN ROOT-OF-TRUST (the BirthAttestation cert chain): a home/child law exports
 // `requireParentAttestedBirth` to declare it requires a parent-attested-birth cert chain (the
 // `nomosParentAttestedBirth` era key); the kernel verify doors then verify the travelling chain to K_root.

package/src/usd.ts

@@ -347,6 +347,25 @@ export interface UsdLayer {
       }
     >;
   };
+  /**
+   * THE DELEGATED-AUTHORITY GATE (delegated_authority_births.md). Present IFF ≥1 directive declares
+   * `.delegatedRole()`: directiveId → {relation, subjectField, certField, parentKeyObject, parentKeyField}.
+   * The one gate folds the delegated tuple ONLY behind a DelegationCert P signed (rooting at K_root, binding
+   * the same relation+subject, `.delegatedFrom(parent)`). OMITTED for law with no such directive (era rule).
+   */
+  readonly nomosDelegationGate?: {
+    readonly v: 1;
+    readonly directives: Record<
+      string,
+      {
+        readonly relation: string;
+        readonly subjectField: string;
+        readonly certField: string;
+        readonly parentKeyObject: string;
+        readonly parentKeyField: string;
+      }
+    >;
+  };
   /**
    * THE KEYLESS VERIFIED-FIRST-DEVICE GATE (architecture/keyless_verified_onboard.md). Present IFF ≥1
    * directive declares `.verifiedFirstDevice()`: a per-directive payload FIELD MAPPING. A principal's FIRST
@@ -1136,6 +1155,30 @@ export function emitUsd(
       }
       const nomosAttestationGate =
         Object.keys(attestationReq).length > 0 ? { v: 1 as const, directives: attestationReq } : undefined;
+      // THE DELEGATED-AUTHORITY GATE (delegated_authority_births.md): directives declaring `.delegatedRole()`
+      // → directiveId → its {relation, subjectField, certField, parentKeyObject, parentKeyField}. SORTED keys
+      // (byte-determinism). Omit-when-empty (era rule) — a law with no delegation is byte-identical. The one
+      // gate verifies the carried DelegationCert to K_root + binds (relation, subject) + `.delegatedFrom(parent)`.
+      const delegationReq: Record<
+        string,
+        { relation: string; subjectField: string; certField: string; parentKeyObject: string; parentKeyField: string }
+      > = {};
+      for (const d of [...l.module.directives].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0))) {
+        const g = (d as { delegatedRoleGate?: {
+          relation: string; subjectField: string; certField: string; parentKeyObject: string; parentKeyField: string;
+        } }).delegatedRoleGate;
+        if (g !== undefined) {
+          delegationReq[d.id] = {
+            relation: g.relation,
+            subjectField: g.subjectField,
+            certField: g.certField,
+            parentKeyObject: g.parentKeyObject,
+            parentKeyField: g.parentKeyField,
+          };
+        }
+      }
+      const nomosDelegationGate =
+        Object.keys(delegationReq).length > 0 ? { v: 1 as const, directives: delegationReq } : undefined;
       // THE ATTESTED-READ GATE (slice B): per-directive `(queryId, from)` edges + the module's
       // trustSource declarations. Emitted iff ≥1 directive declares a foreign read (the era
       // rule). A declared `from` with NO matching trustSource is a NAMED COMPILE ERROR — the
@@ -1492,6 +1535,7 @@ export function emitUsd(
         ...(nomosReadProjectionNamespace !== undefined ? { nomosReadProjectionNamespace } : {}),
         ...(nomosRelationGate !== undefined ? { nomosRelationGate } : {}),
         ...(nomosAttestationGate !== undefined ? { nomosAttestationGate } : {}),
+        ...(nomosDelegationGate !== undefined ? { nomosDelegationGate } : {}),
         ...(nomosAttestedReadGate !== undefined ? { nomosAttestedReadGate } : {}),
         ...(nomosBirthGate !== undefined ? { nomosBirthGate } : {}),
         ...(nomosBirthRecordGate !== undefined ? { nomosBirthRecordGate } : {}),

package/src/usd_layers.ts

@@ -198,6 +198,9 @@ function domainLayerAttrLines(domain: string, layer: UsdLayer, indent: string):
     ...(layer.nomosAttestationGate !== undefined
       ? [`${indent}custom string nomos:attestationGateHex = ${usdaString(hexUtf8(JSON.stringify(layer.nomosAttestationGate)))}`]
       : []),
+    ...(layer.nomosDelegationGate !== undefined
+      ? [`${indent}custom string nomos:delegationGateHex = ${usdaString(hexUtf8(JSON.stringify(layer.nomosDelegationGate)))}`]
+      : []),
     ...(layer.nomosAttestedReadGate !== undefined
       ? [`${indent}custom string nomos:attestedReadGateHex = ${usdaString(hexUtf8(JSON.stringify(layer.nomosAttestedReadGate)))}`]
       : []),
@@ -875,6 +878,22 @@ export function flattenLayeredUsd(layers: readonly UsdLayer[]): UsdDocument {
         attestationGate = { v: 1, directives: rec };
       }
     }
+    // THE DELEGATED-AUTHORITY GATE (delegated_authority_births.md): directiveId → delegation spec merged
+    // later-wins across layers, SORTED keys. Omit-when-empty (era rule).
+    let delegationGate: UsdLayer["nomosDelegationGate"];
+    {
+      type DelSrc = NonNullable<UsdLayer["nomosDelegationGate"]>["directives"][string];
+      const a = new Map<string, DelSrc>();
+      for (const l of stack) {
+        if (l.nomosDelegationGate === undefined) continue;
+        for (const [id, src] of Object.entries(l.nomosDelegationGate.directives)) a.set(id, src);
+      }
+      if (a.size > 0) {
+        const rec: Record<string, DelSrc> = {};
+        for (const k of [...a.keys()].sort()) rec[k] = a.get(k)!;
+        delegationGate = { v: 1, directives: rec };
+      }
+    }
     // THE ATTESTED-READ GATE (slice B): sources + per-directive edges merged later-wins across
     // layers, SORTED keys (matching the composed emission). Omit-when-empty (era rule).
     let attestedReadGate: UsdLayer["nomosAttestedReadGate"];
@@ -1031,6 +1050,7 @@ return {
       ...(readProjectionNamespace !== undefined ? { nomosReadProjectionNamespace: readProjectionNamespace } : {}),
       ...(relationGate !== undefined ? { nomosRelationGate: relationGate } : {}),
       ...(attestationGate !== undefined ? { nomosAttestationGate: attestationGate } : {}),
+      ...(delegationGate !== undefined ? { nomosDelegationGate: delegationGate } : {}),
       ...(attestedReadGate !== undefined ? { nomosAttestedReadGate: attestedReadGate } : {}),
       ...(birthGate !== undefined ? { nomosBirthGate: birthGate } : {}),
       ...(birthRecordGate !== undefined ? { nomosBirthRecordGate: birthRecordGate } : {}),
@@ -1173,6 +1193,7 @@ export function parseUsdaDocument(text: string): UsdDocument {
   const relationNamespaceByDomain = new Map<string, UsdLayer["nomosRelationNamespace"]>();
   const readProjectionNamespaceByDomain = new Map<string, UsdLayer["nomosReadProjectionNamespace"]>();
   const attestationGateByDomain = new Map<string, UsdLayer["nomosAttestationGate"]>();
+  const delegationGateByDomain = new Map<string, UsdLayer["nomosDelegationGate"]>();
   const attestedReadGateByDomain = new Map<string, UsdLayer["nomosAttestedReadGate"]>();
   const birthGateByDomain = new Map<string, UsdLayer["nomosBirthGate"]>();
   const birthRecordGateByDomain = new Map<string, UsdLayer["nomosBirthRecordGate"]>();
@@ -1248,6 +1269,11 @@ export function parseUsdaDocument(text: string): UsdDocument {
       if (typeof attGateHex === "string") {
         attestationGateByDomain.set(domain, JSON.parse(unhexUtf8(attGateHex)) as UsdLayer["nomosAttestationGate"]);
       }
+      // THE DELEGATED-AUTHORITY GATE (delegated_authority_births.md): the hex-carried delegation spec.
+      const delGateHex = p.attrs.get("nomos:delegationGateHex");
+      if (typeof delGateHex === "string") {
+        delegationGateByDomain.set(domain, JSON.parse(unhexUtf8(delGateHex)) as UsdLayer["nomosDelegationGate"]);
+      }
       // THE ATTESTED-READ GATE (slice B): the hex-carried trust-edge declaration.
       const attReadGateHex = p.attrs.get("nomos:attestedReadGateHex");
       if (typeof attReadGateHex === "string") {
@@ -1395,6 +1421,7 @@ export function parseUsdaDocument(text: string): UsdDocument {
       const relNs = relationNamespaceByDomain.get(domain);
       const rpNs = readProjectionNamespaceByDomain.get(domain);
       const attGate = attestationGateByDomain.get(domain);
+      const delGate = delegationGateByDomain.get(domain);
       const attReadGate = attestedReadGateByDomain.get(domain);
       const birthGate = birthGateByDomain.get(domain);
       const birthRecordGate = birthRecordGateByDomain.get(domain);
@@ -1423,6 +1450,7 @@ export function parseUsdaDocument(text: string): UsdDocument {
         ...(rpNs !== undefined ? { nomosReadProjectionNamespace: rpNs } : {}),
         ...(relGate !== undefined ? { nomosRelationGate: relGate } : {}),
         ...(attGate !== undefined ? { nomosAttestationGate: attGate } : {}),
+        ...(delGate !== undefined ? { nomosDelegationGate: delGate } : {}),
         ...(attReadGate !== undefined ? { nomosAttestedReadGate: attReadGate } : {}),
         ...(birthGate !== undefined ? { nomosBirthGate: birthGate } : {}),
         ...(birthRecordGate !== undefined ? { nomosBirthRecordGate: birthRecordGate } : {}),