@githolon/dsl 0.94.2 → 0.95.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.94.2",
+  "version": "0.95.1",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/framework/signing_identity.ts

@@ -322,6 +322,18 @@ export const enrollFirstDevice = directive("enrollFirstDevice")
       /** THE CAPTURED PREMISE: the IdP's signed identity assertion (JWT), re-verified on every lane against
        *  the on-chain AuthProvider keys. */
       idpToken: z.string().min(1),
+      /** THE KEYLESS DELEGATION CERT (JSON `executor::birth_cert::BirthCert`) — the self-serve sibling of
+       *  `enrollDelegation.certJson`. Built CLIENT-SIDE via the `cert_sign` op: DEVICE-self-signed by this
+       *  same device key `P_U` (parent_key == P_U), founder == `user:<uid>`, carrying `verifiedVia` +
+       *  `idpToken` + `capturedClock`. There is NO tenant `S_P` in the loop — the kernel's home-birth chain
+       *  walk (`verify_to_root`, keyless branch) RE-VERIFIES the token against the platform-attested
+       *  AuthProvider (bound to K_root by the terminal platform_cert), so a forged/swapped cert fails the
+       *  child's own gate. Writing it as the user's `SignerDelegation` is what lets `birthHome`'s offer-effect
+       *  assemble a WARRANTED travelling chain (closes co2's `birth-cert-not-seeded` / empty signerDelegation).
+       *  OPTIONAL — an enroll-only flow (seat the signer, no imminent home birth) omits it and seeds no
+       *  delegation (backward-compatible with every pre-B `enrollFirstDevice` caller). The keyless home-birth
+       *  ceremony ALWAYS supplies it (that is what seeds the delegation the chain needs). */
+      delegationCert: z.string().min(1).optional(),
     }),
   )
   .plan((p, ctx) => {
@@ -329,7 +341,8 @@ export const enrollFirstDevice = directive("enrollFirstDevice")
     // evidence — the framework may; an author cannot). The kernel arm proves the principal is the IdP subject.
     const me = ctx.principal().asAuthoritySubject<string>("bootstrap my first device signer key from a verified IdP token");
     const rawPrincipal = endorsementOf(me)?.principal ?? "";
-    return writeTuple({
+    // (1) seat the signer leaf (the RelationTuple — this directive's primary `.ensures`).
+    const tupleOps = writeTuple({
       object: signerObject(rawPrincipal),
       relation: SIGNER_RELATION,
       subject: "key:" + p.keyHash,
@@ -338,6 +351,22 @@ export const enrollFirstDevice = directive("enrollFirstDevice")
       verifiedVia: p.verifiedVia,
       validFromEpoch: p.validFromEpoch,
     });
+    // (2) fold the KEYLESS delegation cert as the user's `SignerDelegation` singleton (a SECONDARY ensures,
+    // per-op marked — the id is deterministic-by-user, an upsert). This is the seed `birthHome` reads to
+    // assemble the warranted chain; without it the home is born headless (co2's block).
+    // The delegation is keyed by the AUTHENTICATED principal — EXACTLY the `founder` the kernel's birth
+    // offer-effect reads it back by (`read_signer_delegation(state, &founder)`, founder == captured principal
+    // == this `rawPrincipal`, already in `user:<uid>` form). Do NOT re-prefix.
+    // Absent delegationCert ⇒ enroll-only (no delegation seeded), byte-identical to a pre-B enroll.
+    if (!p.delegationCert) return tupleOps;
+    const d = instance(SignerDelegation, signerDelegationInstanceId(rawPrincipal));
+    const delegationOps: PlannedOp[] = [
+      withMarker(set(d, "user", rawPrincipal), "ensures"),
+      withMarker(set(d, "deviceKey", "key:" + p.keyHash), "ensures"),
+      withMarker(set(d, "certJson", p.delegationCert), "ensures"),
+      withMarker(set(d, "enrolledAt", p.grantedAt), "ensures"),
+    ];
+    return [...tupleOps, ...delegationOps];
   })
   // THE KEYLESS GATE DECLARATION: the carried device-bound `idpToken` IS this directive's authorization
   // (re-verified against the workspace AuthProvider on every lane), not a pre-enrolled signer. This lowers