@githolon/dsl 0.95.2 → 0.97.0

package/dart/test/four_layer_nested_topology_test.dart

@@ -24,6 +24,7 @@
 import 'dart:convert';
 import 'dart:io';
 
+import 'package:crypto/crypto.dart' show sha256;
 import 'package:nomos_client/nomos_headless.dart';
 import 'package:test/test.dart';
 
@@ -55,7 +56,7 @@ void main() {
     final diag = Platform.environment['NOMOS_HARNESS_DIAG'] == '1'
         ? (String l) => stderr.writeln(l)
         : null;
-    final cloud = await NomosTestCloud.start(serverEntry: _devServer, onDiagnostic: diag);
+    final cloud = await NomosTestCloud.start(serverEntry: _devServer, platform: 'four-layer-platform', deployJsonPath: _deploy, onDiagnostic: diag);
     NomosTestHarness? harness1;
     NomosTestHarness? harness2;
     try {
@@ -87,6 +88,7 @@ void main() {
           'frameworkHash': harness1.frameworkHash,
           'lawHash': harness1.lawHashes(home1.workspace).first,
           'bornAt': '2026-07-15T00:00:00Z',
+          'ownerKeyHash': sha256.convert(base64Decode(harness1.devicePublicKey(home1.workspace)!)).toString(),
         },
         actor: _subject1,
       );
@@ -103,6 +105,7 @@ void main() {
           'frameworkHash': harness1.frameworkHash,
           'lawHash': harness1.lawHashes(home1.workspace).first,
           'bornAt': '2026-07-15T00:00:01Z',
+          'ownerKeyHash': sha256.convert(base64Decode(harness1.devicePublicKey(home1.workspace)!)).toString(),
         },
         actor: _subject1,
       );
@@ -111,8 +114,8 @@ void main() {
       expect(projectWs, startsWith('project-'));
 
       // LAYER 3+4: Open both space and project as sibling sessions + make WRITES while offline
-      final space = await harness1.bridge.acquireSession(spaceWs);
-      final project = await harness1.bridge.acquireSession(projectWs);
+      final space = await harness1.bridge.acquireSession(spaceWs, authorSecret: harness1.deviceSecret(home1.workspace));
+      final project = await harness1.bridge.acquireSession(projectWs, authorSecret: harness1.deviceSecret(home1.workspace));
 
       // Write to space
       await space.offerCreates(
@@ -186,11 +189,12 @@ void main() {
           'frameworkHash': harness2.frameworkHash,
           'lawHash': harness2.lawHashes(home2.workspace).first,
           'bornAt': '2026-07-15T00:00:04Z',
+          'ownerKeyHash': sha256.convert(base64Decode(harness2.devicePublicKey(home2.workspace)!)).toString(),
         },
         actor: _subject2,
       );
       final space2Ws = space2Outcome.born.single;
-      final space2 = await harness2.bridge.acquireSession(space2Ws);
+      final space2 = await harness2.bridge.acquireSession(space2Ws, authorSecret: harness2.deviceSecret(home2.workspace));
 
       // User2 writes to its own space while partitioned
       await space2.offerCreates(

package/dart/test/parent_signer_recovery_test.dart

@@ -101,7 +101,8 @@ void main() {
       // 3. THE REPAIR — idempotent; the signing directive is DISCOVERED from the installed law
       //    (this fixture composes it under domain "home", NOT the framework "workspaces").
       final r1 = await session.ensureParentSignerEnrollment(
-          parent: _ws, principal: _principal, publicKey: pub, authorSecret: secret);
+          // era-0: BOTH domains compose enrollSigner (the estate is signer-ready too) — name the parent's.
+          parent: _ws, principal: _principal, publicKey: pub, authorSecret: secret, domain: 'home');
       expect(r1['enrolled'], true);
       expect(r1['repaired'], true);
       expect(r1['domain'], 'home',
@@ -109,7 +110,7 @@ void main() {
 
       // 4. Re-run = pure no-op (the idempotence contract).
       final r2 = await session.ensureParentSignerEnrollment(
-          parent: _ws, principal: _principal, publicKey: pub, authorSecret: secret);
+          parent: _ws, principal: _principal, publicKey: pub, authorSecret: secret, domain: 'home');
       expect(r2['enrolled'], true);
       expect(r2['repaired'], false);
 

package/dart/test/session_bound_test.dart

@@ -13,8 +13,11 @@
 @TestOn('vm')
 library;
 
+import 'dart:convert';
 import 'dart:io';
 
+import 'package:crypto/crypto.dart' show sha256;
+
 // ignore: deprecated_member_use
 import 'package:nomos_client/nomos_headless.dart';
 import 'package:test/test.dart';
@@ -52,6 +55,11 @@ String? _missingPrereq() {
   return null;
 }
 
+/// The owner-device keyHash (the harness device the install lane minted) — the estate enrols it at birth
+/// so the born child accepts the owner's signed writes (era-0 signer-ready births).
+String _ownerKeyHash(NomosTestHarness h) =>
+    sha256.convert(base64Decode(h.devicePublicKey(h.workspace)!)).toString();
+
 Future<NomosTestHarness> _harness() => NomosTestHarness.ephemeral(
       deployJsonPaths: [_deployJson],
       nodeEntry: _repoEntry,
@@ -86,6 +94,7 @@ void main() {
           frameworkHash: harness.frameworkHash!,
           lawHash: harness.lawHashes(harness.workspace).first,
           bornAt: DateTime.now().toUtc().toIso8601String(),
+          ownerKeyHash: _ownerKeyHash(harness),
         ),
       );
       expect(birth.workspace, harness.workspace,
@@ -95,7 +104,7 @@ void main() {
       expect(birth.birthOutcomes.first['status'], 'born');
 
       // FOLLOW THE REF (ask 8): NomosRef in, mounted session out — never a string pair.
-      final estate = await harness.bridge.follow(birth.bornRefs.single);
+      final estate = await harness.bridge.follow(birth.bornRefs.single, authorSecret: harness.deviceSecret(harness.workspace));
       expect(estate.workspace, birth.born.single);
 
       // SECOND CLIENT + a typed read AND a directive on it.
@@ -144,6 +153,7 @@ void main() {
           frameworkHash: harness.frameworkHash!,
           lawHash: harness.lawHashes(harness.workspace).first,
           bornAt: DateTime.now().toUtc().toIso8601String(),
+          ownerKeyHash: _ownerKeyHash(harness),
         ),
       );
       final rows = await first.timeout(const Duration(seconds: 30));

package/dart/test/watch_surfaces_test.QUARANTINED.md

@@ -0,0 +1,17 @@
+# watch_surfaces_test.dart + co2_acceptance_test.dart — QUARANTINED 2026-07-16 (removed, not skipped)
+
+The test was committed importing a generated Dart client from
+`bench/scale/fixtures/co2-acceptance/build/dart/src/generated/estate.client.dart` — a path that has
+NEVER existed (the fixture's dart codegen emits layered packages under
+`dart/co2_nomos_domain_client/lib/...`), from a fixture whose SOURCE was never tracked. It could not
+run anywhere but its author's machine, and it broke `dart analyze` (and therefore the CI dart-gauntlet)
+for everyone else. Removing it makes CI reflect reality: the typed reactive surfaces it exercised
+(watchSpatial bbox stream / watchCompatibility across an evolve / watchActivity) are currently
+UNCOVERED at the Dart layer — stated here loudly, not masked.
+
+RECONSTRUCTION (tracked task): re-author against a SMALL tracked fixture (grow
+`bench/scale/fixtures/estate-geo` with the SiteLocation VO + a `sitesByBounds` spatial + dart codegen),
+compile it in the gauntlet's fixture step, and import the layered client via a path dependency in a
+dedicated test pubspec (the layered `co2_nomos_types` path-dep does not resolve from `dsl/dart` itself).
+Original test bodies: `git show 78ccf013:dsl/dart/test/watch_surfaces_test.dart` and `git show 78ccf013:dsl/dart/test/co2_acceptance_test.dart` (same phantom import, same fixture).
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.95.2",
+  "version": "0.97.0",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/build_package.ts

@@ -75,6 +75,7 @@ import { collectValueObjectDescriptors } from "./value_object.js";
 import { emitUsd } from "./usd.js";
 import { expandCapabilityExports } from "./capability_exports.js";
 import { RelationTuple, relationTuplesByObject } from "./framework/relations.js";
+import { AuthProvider, setAuthProvider, authProvider } from "./framework/workspaces.js";
 import { parentAttestedBirthMarker } from "./births.js";
 import { discoverUnsanctionedEnsures, sanctioningEnsureDirective } from "./secondary_ensure.js";
 import { assertIdOfLint } from "./idof_lint.js";
@@ -209,7 +210,24 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   // insertion order does not perturb the hash. Era-safe: only a relation-using domain gains the aggregate,
   // so no existing (relation-free) manifest hash drifts, and a tenant that already had the explicit export
   // sees NO further move (identical bytes).
+  // AUTH-PROVIDER AUTO-COMPOSE — the "a private workspace can always declare a verifier" DX fix (kills the
+  // `no-authprovider-verifier` dead-workspace trap). A package declaring ANY private read (an aggregate
+  // `visibility: requires(cap)` — also the ONLY host for `.encrypted()` fields) MUST be able to author its
+  // identity verifier, else it is born PERMANENTLY unable to verify a reader's token. Auto-carry the framework
+  // `AuthProvider` aggregate + the admin-gated `setAuthProvider` directive (its `.requires("admin")` gate
+  // travels with it, so a SHARED private workspace can't let a non-admin swap the verifier) + the
+  // `authProvider` query — exactly as RelationTuple is carried. Placed BEFORE the usesRelations check so
+  // setAuthProvider's admin gate pulls RelationTuple in too. ERA-SAFE: a PUBLIC package declares no private
+  // aggregate, gains nothing, stays byte-identical; a private package recompiled under this DSL moves hash anyway.
+  const declaresPrivateRead = [...byId.values()].some(
+    (a) => (a as { visibility?: unknown }).visibility !== undefined,
+  );
+  if (declaresPrivateRead) {
+    if (!byId.has(AuthProvider.id)) byId.set(AuthProvider.id, AuthProvider);
+    if (!directives.some((d) => d.id === setAuthProvider.id)) directives.push(setAuthProvider);
+  }
   const usesRelations =
+    declaresPrivateRead ||
     (spec.relationTypes ?? []).length > 0 ||
     directives.some((d) => (d as { requiresRelationGate?: unknown }).requiresRelationGate !== undefined) ||
     directives.some((d) => d.aggregateId === RelationTuple.id);
@@ -311,6 +329,11 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   // `usesRelations` was computed above the aggregate snapshot (so RelationTuple could be injected into the
   // schema); reuse it here to append the audit query. The two MUST agree — the aggregate and the query it
   // returns have to enter the manifest together, or the read projection can't resolve the return schema.
+  // Auth-provider auto-compose (sibling of the RelationTuple query carry): a private package gets the
+  // `authProvider` read so the workspace can surface its declared verifier.
+  if (declaresPrivateRead && !queries.some((q) => q.id === authProvider.id)) {
+    queries.push(authProvider);
+  }
   if (usesRelations && !queries.some((q) => q.id === relationTuplesByObject.id)) {
     queries.push(relationTuplesByObject);
   }

package/src/compile_package_main.ts

@@ -1051,7 +1051,7 @@ const NOMOS_TYPES_DEP = "^0.6.0";
 // 0.48.x: session-bound clients (XClient.bind/NomosClientInterface/DomainClientSessionMismatch/
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
-const NOMOS_CLIENT_DEP = "^0.60.0";
+const NOMOS_CLIENT_DEP = "^0.61.0";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in dsl/dart/pubspec.yaml
 // and dsl/dart_types/pubspec.yaml — a Dart release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).

package/src/framework/genesis.ts

@@ -81,11 +81,11 @@ export const seedGenesis = directive("seedGenesis")
   .payload(
     z.object({
       principal: z.string().min(1),
-      // `seedGenesis` is GENERIC over the warrant: it records whatever self-id the genesis recipe hands it.
-      //   EMPTY ⇒ the workspace stays UNWARRANTED (host-stamped authorship) — the LEGACY/compat lane: a
-      //     pre-VA chain or a recipe that explicitly opted out (`requiresWarrant: false`) replays byte-identical.
-      //   NON-EMPTY ⇒ WARRANTED: the self-id is the source binding author signatures cover, so the kernel
-      //     enforces SIGNED control-plane authorship on every lane (author / receive / verify_chain).
+      // `seedGenesis` records the self-id the genesis recipe hands it. ERA 0 — every birth is WARRANTED:
+      //   the self-id is the real workspace name (NON-EMPTY), the source binding author signatures cover, so
+      //   the kernel enforces SIGNED control-plane authorship on every lane (author / receive / verify_chain).
+      //   (The empty-self-id UNWARRANTED lane was the legacy host-stamped compat path — purged; no pre-VA
+      //   chain survives to need it.)
       // THE WARRANT-FLIP (THE GOVERNANCE DEFAULT, 2026-06-27): `buildGenesisChain` now seeds a NON-EMPTY
       // self-id (the workspace name) by default for every governance/platform birth — control-plane authority
       // is born warranted unless the recipe explicitly opts out. The choice lives in the recipe builder, not

package/src/framework/home.ts

@@ -26,6 +26,8 @@
  */
 import { z } from "zod";
 import { aggregate, instance } from "../aggregate.js";
+// The device-key-hash wire shape (same validator signing_identity/workspaces use module-locally).
+const sha256Hex = z.string().regex(/^[0-9a-f]{64}$/, "expected lowercase sha256 hex (the owner's device pubkey hash)");
 import { t } from "../fields.js";
 import { Lww } from "../drivers.js";
 import { directive } from "../directive.js";
@@ -195,12 +197,21 @@ export const birthHome = directive("birthHome")
       lawHash: z.string().min(1),
       /** ISO-8601 birth time, caller-stamped (the timestamp doctrine — the plan reads no clock). */
       bornAt: z.string().min(1),
+      /** THE OWNER'S DEVICE KEY HASH (sha256hex of the ed25519 public half — the SAME key `homeCert` is signed
+       *  by and the `signer` relation enrols). The platform holds it from the user's onboarding and ENROLS it
+       *  in the home's genesis, so the born home is SIGNER-READY: it can sign + birth its own children (estates,
+       *  catalogues) from intent 0. WITHOUT this the home is born warranted + owned but signer-less — it can
+       *  never act (the co2 estate-birth bug). Mirrors `buildGenesisChain`'s `enrollSigner` for a platform.
+       *  REQUIRED — a payload without it refuses at compile/validation, not an hour into a live deploy with a
+       *  bricked signer-less home. (The kernel injecting it from the verified cert's `parent_key` is the
+       *  eventual generalization; until then the field is loud.) */
+      ownerKeyHash: sha256Hex,
       /** THE DEVICE-SIGNED HOME CERT (JSON `executor::birth_cert::BirthCert`), signed CLIENT-SIDE by the
-       *  owner's device key `S_U` (the SAME key the `signer` relation enrolls). The kernel's birth offer-
-       *  effect VERIFIES this cert's signature against U's enrolled signer pubkey `P_U` AND that its
-       *  `founder == ctx.principal()` (the gate verdict, CAS-as-law) BEFORE accepting it as `links[0]` of
-       *  the travelling chain — the kernel signs nothing (it holds no secret; it only verifies). Optional:
-       *  absent ⇒ the era stays inert for this birth (no warranted home cert is seeded; pre-feature lane). */
+       *  owner's device key `S_U` (the SAME key `ownerKeyHash` hashes + the `signer` relation enrols). The
+       *  kernel's birth offer-effect VERIFIES this cert's signature against U's enrolled signer pubkey `P_U`
+       *  AND that its `founder == ctx.principal()` (the gate verdict, CAS-as-law) BEFORE accepting it as
+       *  `links[0]` of the travelling chain — the kernel signs nothing (it holds no secret; it only verifies).
+       *  Optional: absent ⇒ the era stays inert for this birth (pre-feature lane). */
       homeCert: z.string().optional(),
     }),
   )
@@ -214,15 +225,17 @@ export const birthHome = directive("birthHome")
       { domain: "nomos", directiveId: "installDomain", actor: founder, payload: { domainHash: p.lawHash }, domainHash: p.lawHash, domainPackageB64: "" },
       // SEED THE OWNER — the home is born OWNED; the homeNameBindsOwner invariant in the child's law proves
       // homeName == home-<sha256(owner)> at the child's own gate, so the slot can ONLY be its rightful owner's.
-      // THE GENESIS ORDER IS THE CONTRACT (BREAK 1): the parent's offer-effect APPENDS `seedBirthAttestation`
-      // (the travelling cert) and THEN `seedGenesis` (the WARRANT) after this step — so the warrant lands LAST,
-      // exactly like `enrollSigner → seedGenesis → grantAdmin(SIGNED)`: every genesis seed runs UNSIGNED on a
-      // still-warrant-free prefix (door + signed-author both inert), the warrant lands at the very end, and
-      // ALL post-genesis writes are then signed AND cert-gated. The home is born WARRANTED (its self-id ==
-      // homeName), so `workspace_self_id` resolves and the parent-attested-birth cert door FIRES on every
-      // post-genesis write (without a warrant the door was inert for every home it protects). ERA-SAFE: a
-      // non-AuthProvider / legacy chain never born under THIS recipe carries no warrant + replays byte-identical.
       { domain: HOME_LAW_DOMAIN, directiveId: "seedHomeOwner", actor: founder, payload: { principal: p.owner, homeName, bornAt: p.bornAt } },
+      // ENROL THE OWNER'S DEVICE on the warrant-free prefix (when supplied) — enrollSigner self-binds to
+      // ctx.principal() (the owner), so this binds `ownerKeyHash` as the owner's signer BEFORE the warrant
+      // closes bootstrap. This is what makes the born home SIGNER-READY (able to sign + self-serve-birth its own
+      // estates/catalogues). Mirrors buildGenesisChain's founding-admin enrollSigner for a platform — homes were
+      // the inconsistent one. THE GENESIS ORDER IS THE CONTRACT (BREAK 1): the parent's offer-effect APPENDS
+      // `seedBirthAttestation` + `seedGenesis` (the WARRANT) AFTER these steps — the warrant lands LAST (E→W
+      // ladder: every seed runs UNSIGNED on the still-warrant-free prefix; the warrant closes it). ERA-SAFE: a
+      // home born earlier (pre-feature law, no such step in its recipe) replays byte-identical — the era rule
+      // rides the LAW hash, not this branch.
+      { domain: HOME_LAW_DOMAIN, directiveId: "enrollSigner", actor: founder, payload: { keyHash: p.ownerKeyHash, grantedBy: p.owner, grantedAt: 1 } },
     ];
     // THE DECLARED BIRTH EFFECT (the unix model): the recipe rides the committed intent as a declared output
     // (captured_ports.births). The kernel — reading the `.births()` declaration off the law manifest — takes

package/src/framework/workspaces.ts

@@ -86,6 +86,12 @@ import { signerObject, SIGNER_RELATION } from "./signing_identity.js";
 // them up as part of the `workspaces` domain. (architecture/platform_birth_genesis_bootstrap.md)
 export { GenesisWarrant, seedGenesis } from "./genesis.js";
 export { identityRelations, enrollSigner } from "./signing_identity.js";
+// ERA 0 — the keyless verified first-device door rides the GOVERNANCE law too: a freshly BORN platform
+// has a virgin roster and a cert-ATTESTED AuthProvider (the S_root-signed platformCert), so its founder's
+// FIRST action is `enrollFirstDevice` (token-verified against the attested provider) followed by a SIGNED
+// self-`grantAdmin` (admitted by the kernel genesis clause). Without this export a born platform is
+// un-administrable — the admin bootstrap has no door.
+export { enrollFirstDevice, revokeSigner } from "./signing_identity.js";
 // THE BIRTH-ATTESTATION CARRIER (the K_root attestation spine for platform-hosted homes). A platform must
 // CARRY its own `platform_cert` at `birth-attestation:self` so the kernel's `assemble_home_cert_chain`
 // PREPENDS `[home_cert, delegation]` to it and the child home roots at K_root. Governance carries the cert
@@ -522,24 +528,6 @@ export function buildGenesisChain(p: {
    *  from there. Absent ⇒ the recipe resolves an already-installed law by shape (pre-G3 / test lanes). */
   frameworkHash?: string;
   lawHash?: string;
-  /**
-   * THE WARRANT-FLIP (VA-1, architecture/identity_keys.md). Controls whether `seedGenesis` records a REAL
-   * `workspaceId` (the workspace name as the unique self-id) so the chain is born WARRANTED — meaning
-   * `verify_captured_principal` enforces SIGNED control-plane authorship on every lane (author / edge
-   * receive / verify_chain). An empty `workspaceId` keeps the workspace UNWARRANTED (host-stamped authorship,
-   * the legacy lane), so a control-plane offer (grantAdmin etc.) is taken at its word — the forge that was
-   * open on unwarranted root/co2.
-   *
-   * THE GOVERNANCE DEFAULT (THE WARRANT-FLIP, 2026-06-27): `buildGenesisChain` only ever runs for a
-   * PLATFORM/GOVERNANCE birth (every call sits inside the `if (p.foundingAdminHash)` guard — a genesis that
-   * carries control-plane authority: grantAdmin/grantCreation). Control-plane authority is EXACTLY what the
-   * signed-author regime protects, so a governance birth is born WARRANTED by DEFAULT (`requiresWarrant`
-   * undefined/true ⇒ warranted). The ONLY escape is an explicit `requiresWarrant === false`, retained as an
-   * era-safe compat hatch (a pre-VA chain re-built byte-identical). NO flag-day: the era is per-workspace,
-   * decided at genesis — existing UNWARRANTED chains keep replaying; only newly-born/re-born governance
-   * chains arm the signature requirement.
-   */
-  requiresWarrant?: boolean;
   /**
    * METERED BIRTH (slice A3 — the descendant budget). When present, the child's genesis includes a
    * `seedBirthPolicy` step so it is BORN BOUNDED (its own default birth allowance per subject).
@@ -601,13 +589,25 @@ export function buildGenesisChain(p: {
   return JSON.stringify([
     ...installSteps,
     ...poolSteps,
-    // THE WARRANT-FLIP (THE GOVERNANCE DEFAULT): a governance birth is born WARRANTED by default — a REAL
-    // self-id (the workspace name) so signed control-plane authorship is enforced on every lane. The ONLY
-    // way to stay on the legacy host-stamped lane ("" self-id, byte-identical to a pre-VA chain) is an
-    // EXPLICIT `requiresWarrant === false` (the era-safe compat hatch). `p.requiresWarrant !== false`
-    // ⇒ warranted whenever the flag is undefined OR true.
-    { domain: "workspaces", directiveId: "seedGenesis", actor: founder, payload: { principal: founder, workspaceId: p.requiresWarrant !== false ? p.name : "", bornAt: p.bornAt } },
-    { domain: "workspaces", directiveId: "grantAdmin", actor: founder, payload: { keyHash: p.foundingAdminHash, label: `founding admin (born for ${p.principal})`, grantedBy: p.principal, grantedAt: p.requestedAt } },
+    // ERA 0 — THE GENESIS-ORDER CONTRACT (the birthHome ordering, unified): every recipe seed below runs
+    // UNSIGNED on the still-WARRANT-FREE prefix; the recipe carries NO seedGenesis and NO grantAdmin. The
+    // KERNEL's birth effect — after verifying the offer's S_root-signed platformCert against the pinned
+    // K_root — appends `seedBirthAttestation` (the travelling cert) and THEN `seedGenesis` (the warrant,
+    // self-id == name) LAST, so the platform is born WARRANTED + ATTESTED and every post-genesis write is
+    // signed AND cert-gated. A birth whose cert fails verification seeds neither and is REFUSED atomically
+    // (the era-0 gate) — there is no unwarranted platform lane.
+    //
+    // THE FOUNDING KEY — ENROLLED ON THE WARRANT-FREE PREFIX (root's own E→W ladder, uniform): the
+    // founder's device key (`foundingAdminHash` = sha256 of its public half) self-binds BEFORE the warrant
+    // lands, exactly like root's `enrollSigner`. Once the kernel seeds the warrant LAST, the platform's
+    // signed-author regime is armed with this key already enrolled — so the FOUNDING ADMIN arrives
+    // POST-BIRTH as one SIGNED `grantAdmin` by this key, admitted by the kernel genesis clause
+    // (`genesis_admits`: a virgin #admin roster + the warrant binding the captured principal). A baked
+    // in-genesis grantAdmin can never fold (post-warrant writes need a signature the birth effect cannot
+    // produce — the pre-era-0 recipe was structurally unbornable); pre-warrant enroll + post-birth signed
+    // self-grant is the lawful shape. (The keyless variant — enrollFirstDevice against the platformCert's
+    // ATTESTED AuthProvider — remains for founders with an IdP instead of a key.)
+    { domain: "workspaces", directiveId: "enrollSigner", actor: founder, payload: { keyHash: p.foundingAdminHash, grantedBy: p.principal, grantedAt: p.requestedAt } },
     // No `role` — it was a vestigial node-class label (collapsed with `kind`); birthCloud ignores it now.
     { domain: "workspaces", directiveId: "birthCloud", actor: "", payload: { principal: p.principal, name: p.name, tier: p.tier, bornAt: p.requestedAt, bornUnder, ...(p.rebornFrom ? { rebornFrom: p.rebornFrom } : {}) } },
   ]);
@@ -1263,10 +1263,13 @@ export const birthChild = directive("birthChild")
          *  own custody (never the host). Absent ⇒ the recipe resolves an already-installed law by shape. */
         frameworkHash: sha256Hex.optional(),
         lawHash: sha256Hex.optional(),
-        /** THE WARRANT-FLIP (VA-1): TRUE iff the child's genesis recipe declares an AuthProvider — the child
-         *  is born WARRANTED (signed authorship enforced on every lane). Absent/false ⇒ the legacy
-         *  host-stamped lane (byte-identical to a pre-VA birth). Only meaningful with a genesis. */
-        requiresWarrant: z.boolean().optional(),
+        /** THE PLATFORM ATTESTATION (era 0 — one attested birth lane for every holon kind): the 1-link
+         *  platform_cert JSON (`executor::birth_cert::BirthCert`), SIGNED OFFLINE BY S_root (the K_root
+         *  holder). The kernel's birth effect VERIFIES it (child == name, founder == `user:<principal>`,
+         *  signature vs the pinned K_root) and injects `seedBirthAttestation` + `seedGenesis` (the warrant)
+         *  LAST into the child's genesis. REQUIRED for a genesis birth to complete — a birth without a
+         *  valid cert is refused atomically (no unwarranted platform lane survives era 0). */
+        platformCert: z.string().optional(),
         /** METERED BIRTH (slice A3): the child's own descendant budget — when present, the genesis
          *  recipe seeds the child's BirthPolicy (`seedBirthPolicy`) so it is BORN BOUNDED. OPT-IN:
          *  only pass it when the `lawHash` the order names carries `seedBirthPolicy` (a governance
@@ -1292,11 +1295,9 @@ export const birthChild = directive("birthChild")
     // LAW AUTHORS THE GENESIS RECIPE (P1): a genesis birth carries its child's [installDomain×2 →]
     // seedGenesis→grantAdmin→birthCloud chain. (refine guarantees principal + bornAt here.)
     if (p.foundingAdminHash) {
-      // THE GOVERNANCE DEFAULT (THE WARRANT-FLIP): a governance birth is warranted unless the request
-      // EXPLICITLY opts out (`requiresWarrant === false`). Thread the flag through ONLY when the request set
-      // it — undefined falls to buildGenesisChain's warranted default; an explicit `false` rides the compat
-      // hatch (an era-safe legacy re-build).
-      const genesisChain = buildGenesisChain({ name: p.name, principal: p.principal, parent: p.parent, tier: p.tier, foundingAdminHash: p.foundingAdminHash, bornAt: p.bornAt as string, requestedAt: p.requestedAt, ...(p.frameworkHash ? { frameworkHash: p.frameworkHash } : {}), ...(p.lawHash ? { lawHash: p.lawHash } : {}), ...(p.requiresWarrant !== undefined ? { requiresWarrant: p.requiresWarrant } : {}), ...(p.descendantPool !== undefined ? { descendantPool: p.descendantPool } : {}) });
+      // ERA 0 — every governance/platform birth is WARRANTED (no compat hatch to thread; buildGenesisChain
+      // always records the real self-id).
+      const genesisChain = buildGenesisChain({ name: p.name, principal: p.principal, parent: p.parent, tier: p.tier, foundingAdminHash: p.foundingAdminHash, bornAt: p.bornAt as string, requestedAt: p.requestedAt, ...(p.frameworkHash ? { frameworkHash: p.frameworkHash } : {}), ...(p.lawHash ? { lawHash: p.lawHash } : {}), ...(p.descendantPool !== undefined ? { descendantPool: p.descendantPool } : {}) });
       // THE GENESIS RECIPE IS ALSO A LINEAGE/AUDIT FACT on the parent's chain (the parent records what it
       // ORDERED — law naming law, legitimate). The kernel does NOT read this field to detect the birth.
       rec.set("genesisChain", genesisChain);

package/dart/test/co2_acceptance_test.dart

@@ -1,101 +0,0 @@
-// THE CO2 ACCEPTANCE — DART LEG (task #32). Their feedback's Dart snippet, near-verbatim:
-// construct a rich nested DrawingGeoreference with typed constructors, dispatch it through the
-// generated client against REAL law on a local holon, and read BOTH aggregates back typed —
-// the primary georeference row AND the sibling EstateDrawing.transform write.
-@TestOn('vm')
-library;
-
-import 'dart:io';
-
-import 'package:nomos_client/nomos_headless.dart';
-import 'package:test/test.dart';
-
-import '../../../bench/scale/fixtures/co2-acceptance/build/dart/src/generated/estate.client.dart';
-
-String get _root => '${Directory.current.path}/../..';
-String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.ts';
-String get _deployJson =>
-    '$_root/bench/scale/fixtures/co2-acceptance/build/co2-acceptance.deploy.json';
-String get _runtimeDir => '${Platform.environment['HOME'] ?? ''}/.holon/runtime';
-
-String? _missingPrereq() {
-  if (!File(_repoEntry).existsSync()) return 'in-repo runner not found at $_repoEntry';
-  if (!File(_deployJson).existsSync()) {
-    return 'compile the fixture: cd bench/scale/fixtures/co2-acceptance && npx nomos-compile';
-  }
-  if (!File('$_runtimeDir/holon.wasm').existsSync() ||
-      !File('$_runtimeDir/packages.json').existsSync()) {
-    return 'warm ~/.holon/runtime first (run any `githolon` command once)';
-  }
-  return null;
-}
-
-void main() {
-  test('co2 acceptance: rich typed VO construction → multi-aggregate write → typed reads',
-      () async {
-    final skip = _missingPrereq();
-    if (skip != null) {
-      markTestSkipped(skip);
-      return;
-    }
-    final harness = await NomosTestHarness.ephemeral(
-      deployJsonPaths: [_deployJson],
-      nodeEntry: _repoEntry,
-      runtimeDir: _runtimeDir,
-      workspace: 'co2-acceptance',
-    );
-    try {
-      final estate = EstateClient(harness.bridge, actor: 'user:ada');
-
-      // Register a site whose location composes address + geo point (nested VOs).
-      await estate.registerSite(RegisterSitePayload(
-        name: 'Trafford Depot',
-        location: SiteLocation(
-          address: PostalAddress(
-              line1: '1 Wharf Rd', city: 'Manchester', postcode: 'M17 1AB', countryCode: 'GB'),
-          point: GeoPoint(coordinates: [-2.24, 53.48]),
-          source: SiteLocationSource.addressSearch,
-        ),
-        registeredAt: DateTime.now().toUtc().toIso8601String(),
-      ));
-      await estate.addDrawing(AddDrawingPayload(
-          title: 'Level 2 plan', addedAt: DateTime.now().toUtc().toIso8601String()));
-
-      final drawings = await estate.drawingsByTitle(title: 'Level 2 plan');
-      expect(drawings, hasLength(1));
-      final drawingId = drawings.single.aggregateId.value;
-      final sites = await estate.sitesByName(name: 'Trafford Depot');
-      expect(sites, hasLength(1));
-
-      // ── THEIR SNIPPET, VERBATIM SHAPE ──
-      await estate.recordDrawingGeoreference(RecordDrawingGeoreferencePayload(
-        drawingId: drawingId,
-        siteId: sites.single.aggregateId.value,
-        georeference: DrawingGeoreference(
-          transform: DrawingTransform2d(rotationDeg: 2.4),
-          controlPoints: [
-            DrawingGeoControlPoint(
-              drawingPosition: DrawingPositionMm(xMm: 1200, yMm: 800),
-              geoPoint: GeoPoint(coordinates: [-2.24, 53.48]),
-            ),
-          ],
-        ),
-        recordedAt: DateTime.now().toUtc().toIso8601String(),
-      ));
-
-      // Primary aggregate: the full nested VO reads back TYPED.
-      final georefs = await estate.georefsByDrawing(drawingId: drawingId);
-      expect(georefs, hasLength(1));
-      final g = georefs.single.georeference!;
-      expect(g.transform!.rotationDeg, 2.4);
-      expect(g.controlPoints.single.drawingPosition.xMm, 1200);
-      expect(g.controlPoints.single.geoPoint.coordinates.first, -2.24);
-
-      // THE SIBLING WRITE: EstateDrawing.transform got the VO subfield, typed.
-      final again = await estate.drawingsByTitle(title: 'Level 2 plan');
-      expect(again.single.transform!.rotationDeg, 2.4);
-    } finally {
-      await harness.dispose();
-    }
-  }, timeout: const Timeout(Duration(minutes: 3)));
-}