@githolon/dsl 0.9.0 → 0.10.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/framework/home.ts

@@ -32,8 +32,14 @@ import { directive } from "../directive.js";
 import { create } from "../authoring.js";
 import { set, type PlannedOp } from "../ops.js";
 import { query } from "../query.js";
+import { workspaceInvariant, refAs } from "./workspace_invariant.js";
 import { identityRelations } from "./signing_identity.js";
 
+// `nomos.sha256` — the TRUSTLESS, pure hash computed IN the githolon (Rust sha2 bound in the sealed engine;
+// see deterministic-rquickjs). Available as a global to plans + invariant predicates (like `nomos.mint`); it
+// lets the home law re-derive `home-<hash(owner)>` itself, so the SQUAT invariant runs in-law on every peer.
+declare const nomos: { sha256(input: string): string };
+
 /** The KEY DIRECTORY is the `signer` relation — re-exported so a home holon's law composes it (the
  *  identity's public device keys, enrolled via `enrollSigner`, checked by the gate). */
 export { identityRelations };
@@ -47,30 +53,58 @@ export { identityRelations };
  * `seedHomeOwner`, kept off the open session lane), so a tenant cannot forge ownership.
  */
 export const HOME_OWNER_ID = "home-owner:self";
+/** A home holon's SELF-COMMITTED NAME prefix — `home-<sha256(subject)>` (the client's `homeNameOf` + the
+ *  squat invariant both derive it). The home's chain commits to its own routing name, so the bailiff can
+ *  bind the name to the CONTENT (custody) while the LAW guarantees the name hashes its owner. */
+export const HOME_NAME_PREFIX = "home-";
+export const HOME_NAME_HASH_LEN = 40;
 export const HomeOwner = aggregate("HomeOwner", {
   /** The identity this home belongs to — the canonical `user:<uid>` subject the §3 gate binds quotes to. */
   principal: t.string().merge(Lww),
+  /** THE HOME'S SELF-COMMITTED NAME (`home-<sha256(principal)>`) — the squat invariant asserts it hashes the
+   *  owner, so the chain's claimed name can ONLY be its rightful owner's slot (home_holons §5). */
+  homeName: t.string().merge(Lww),
   /** ISO-8601, caller-stamped (determinism — no clock in the plan). */
   bornAt: t.string().merge(Lww),
 });
 
-/** The framework PRIMITIVE plan: stamp the home's owner (singleton at the fixed id the gate reads). */
-export function writeHomeOwner(p: { principal: string; bornAt: string }): PlannedOp[] {
+/** The framework PRIMITIVE plan: stamp the home's owner + its self-committed name (singleton at the fixed id). */
+export function writeHomeOwner(p: { principal: string; homeName: string; bornAt: string }): PlannedOp[] {
   const h = instance(HomeOwner, HOME_OWNER_ID);
-  return [set(h, "principal", p.principal), set(h, "bornAt", p.bornAt)];
+  return [set(h, "principal", p.principal), set(h, "homeName", p.homeName), set(h, "bornAt", p.bornAt)];
 }
 
 /**
- * `seedHomeOwner` — the birth-door directive that stamps the home's owner at the fixed singleton id. A
- * CONTROL-PLANE write: the host authors it once at lazy birth (after resolving who the home is for); the
- * open session lane structurally REFUSES it (by directive id, like the §6 handoff seals), so a tenant
- * cannot overwrite ownership. `.ensures` (a deterministic-keyed singleton, not a minted record).
+ * `seedHomeOwner` — the birth-door directive that stamps the home's owner + its self-committed `homeName` at
+ * the fixed singleton id. A CONTROL-PLANE write: the host authors it once at lazy birth; the open session
+ * lane structurally REFUSES it (by directive id). `.ensures` (a deterministic-keyed singleton). The `homeName`
+ * is caller-supplied but the {@link homeNameBindsOwner} invariant proves it `== home-<sha256(principal)>`,
+ * so a squatter cannot claim a name slot that doesn't hash to ITS own owner.
  */
 export const seedHomeOwner = directive("seedHomeOwner")
   .ensures(HomeOwner)
-  .payload(z.object({ principal: z.string().min(1), bornAt: z.string().min(1) }))
+  .payload(z.object({ principal: z.string().min(1), homeName: z.string().min(1), bornAt: z.string().min(1) }))
   .plan((p) => writeHomeOwner(p));
 
+/**
+ * THE SQUAT INVARIANT (home_holons §5) — a home holon's self-committed `homeName` MUST be the hash of its
+ * owner: `homeName == home-<sha256(principal)>`. Declared by the home law, it EXECUTES at the one gate — and
+ * crucially at `verify_chain` (the bailiff's upload-birth): a squatter's chain (claiming `home-<hash(bob)>`
+ * but owned by `mallory`) FAILS the home law's OWN gate during adoption — refused IN THE GITHOLON, BY THE LAW,
+ * never by a host check. The host only routes the chain to the name it commits to (custody). `nomos.sha256`
+ * re-derives the hash in-law on every peer, so the verdict is identical everywhere.
+ */
+export const homeNameBindsOwner = workspaceInvariant("HomeNameBindsOwner")
+  .on("seedHomeOwner")
+  .reads(() => [refAs("owner", "HomeOwner", HOME_OWNER_ID)])
+  .assert(({ owner }) => {
+    const o = (owner ?? {}) as { principal?: string; homeName?: string };
+    const expected = HOME_NAME_PREFIX + nomos.sha256(String(o.principal ?? "")).slice(0, HOME_NAME_HASH_LEN);
+    return o.homeName === expected
+      ? { accept: true }
+      : { reject: "a home's name must hash its owner (home-<sha256(principal)>) — refusing a squatted home" };
+  });
+
 /**
  * THE SHARED-WITH-ME INDEX (§5) — one record per cross-custody attestation delivered to this home holon:
  * a signed edge `<asserterWorkspace> : <object> # <relation> @ this-identity`, indexed LOCALLY so the

package/src/index.ts

@@ -243,8 +243,11 @@ export {
   sharedByWorkspace,
   HomeOwner,
   HOME_OWNER_ID,
+  HOME_NAME_PREFIX,
+  HOME_NAME_HASH_LEN,
   seedHomeOwner,
   writeHomeOwner,
+  homeNameBindsOwner,
 } from "./framework/home.js";
 // THE GENESIS WARRANT (identity_keys.md step 0) — the in-history birth fact that lets
 // the gate's genesis clause admit a founding control-plane grant on a virgin chain.