@githolon/dsl 0.97.5 → 0.98.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.97.5",
+  "version": "0.98.1",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/build_package.ts

@@ -245,6 +245,12 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
     for (const a of BIRTH_METER_AGGREGATES) {
       if (!byId.has(a.id)) byId.set(a.id, a);
     }
+    // AUTHPROVIDER INHERITANCE (birthHome's default-on parent read — the same courtesy): a birth-capable
+    // law serves the `authProvider` captured read (parent side) AND can fold the inherited
+    // `setAuthProvider` genesis step (child side; the one-package fixture shape is both at once). Without
+    // this carry, default-on inheritance would refuse on every law that never hand-exported the trio.
+    if (!byId.has(AuthProvider.id)) byId.set(AuthProvider.id, AuthProvider);
+    if (!directives.some((d) => d.id === setAuthProvider.id)) directives.push(setAuthProvider);
   }
   // SECONDARY-CREATE AUTO-DECLARE (secondary_ensure.ts — the id-mint-gate DX): a plan may `ensure(B, "det:id")`
   // a SECOND aggregate at a deterministic id of a type its directive does NOT declare `.ensures()` for. The
@@ -316,6 +322,8 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
     for (const q of BIRTH_METER_QUERIES) {
       if (!haveQuery.has(q.id)) queries.push(q);
     }
+    // The inheritance read (`.reads("authProvider")` on birthHome) routes like any declared query.
+    if (!haveQuery.has(authProvider.id)) queries.push(authProvider);
   }
   const relationTypes = [...(spec.relationTypes ?? [])];
   // RELATION-USING LAW AUTO-COMPOSES ITS AUDIT READ (co2 recovery DX — same idiom as the meter

package/src/engine_entry.ts

@@ -55,6 +55,7 @@ import { executeDirectiveToIntent } from "./wire_encode.js";
 import { expandCapabilityExports } from "./capability_exports.js";
 import { RelationTuple, __setDispatchContext } from "./framework/relations.js";
 import { BIRTH_METER_AGGREGATES } from "./birth_meter.js";
+import { AuthProvider as FrameworkAuthProvider, setAuthProvider as frameworkSetAuthProvider } from "./framework/auth_provider_law.js";
 import { namespacedAggregateIds, qualifyReadProjectionType, READ_PROJECTION_DELIMITER } from "./read_projection_namespace.js";
 import { isRelationTypeDecl } from "./relation_schema.js";
 import { synthesizePreconditionInvariants } from "./precondition.js";
@@ -313,6 +314,18 @@ function buildDomainSlice(mod: DomainModuleExports): DomainSlice {
       aggs.set(fw.id, fw);
     }
   }
+  // AUTHPROVIDER AUTO-ENSURE (the compile-side declaresBirth/declaresPrivateRead carry, MIRRORED — the
+  // P2-001 rule: every compile-side injection needs its engine twin or the manifest and the dispatch
+  // registry skew into "no directive registered"). A births-declaring or private module can always fold
+  // `setAuthProvider` (the inherited genesis step / the verifier author) + its AuthProvider aggregate.
+  {
+    const declaresBirthHere = [...dirs.values()].some((d) => (d as { birthsChild?: boolean }).birthsChild === true);
+    const declaresPrivateHere = [...aggs.values()].some((a) => (a as { visibility?: unknown }).visibility !== undefined);
+    if (declaresBirthHere || declaresPrivateHere) {
+      if (!aggs.has(FrameworkAuthProvider.id)) aggs.set(FrameworkAuthProvider.id, FrameworkAuthProvider);
+      if (!dirs.has(frameworkSetAuthProvider.id)) dirs.set(frameworkSetAuthProvider.id, frameworkSetAuthProvider as unknown as Directive<unknown>);
+    }
+  }
   for (const [dirId, directive] of dirs) {
     const agg = aggs.get(directive.aggregateId);
     if (agg === undefined) {

package/src/framework/auth_provider_law.ts

@@ -0,0 +1,121 @@
+// NOMOS — framework/auth_provider_law.ts — THE AUTHPROVIDER LAW SURFACE, as a LEAF module.
+//
+// Extracted from workspaces.ts so the ENGINE ENTRY (and birthHome's inheritance) can import the
+// aggregate + directive WITHOUT dragging the whole workspaces/home graph into every sealed lump
+// (workspaces re-exports from home.js, whose birthHome plan calls read() — bundling that into a
+// read-free law trips the captured-read compile gate). workspaces.ts re-exports everything here,
+// so the public surface (`@githolon/dsl` names, ids, law bytes) is unchanged.
+import { z } from "zod";
+import { aggregate, instance } from "../aggregate.js";
+import { directive } from "../directive.js";
+import { t } from "../fields.js";
+import { Lww } from "../drivers.js";
+import { set, withMarker } from "../ops.js";
+import { query } from "../query.js";
+
+const epochMs = z.number().int().nonnegative();
+
+/** THE AUTHPROVIDER SINGLETON INSTANCE ID — the ONE place this string lives DSL-side (the kernel owns the
+ *  matching `nomos_identity::auth_provider::AUTH_PROVIDER_ID`; a drift-guard test keeps them identical). The
+ *  kernel verifies presented tokens against the AuthProvider at this id, so its SHAPE is kernel-owned
+ *  first-class machinery; `setAuthProvider`/`rotateKeys` compile to it. */
+export const AUTH_PROVIDER_ID = "auth-provider:platform";
+
+export const AuthProvider = aggregate("AuthProvider", {
+  /** The singleton key — always `"platform"`. */
+  scope: t.string().merge(Lww),
+  /** The token issuer (the `iss` claim tokens must carry). */
+  issuer: t.string().merge(Lww),
+  /** The provider's public JWKS endpoint (asymmetric verification keys). The KERNEL never fetches — it's a
+   *  reference for the rotation capability that re-fetches + re-sets {@link keys}. */
+  jwksUrl: t.string().merge(Lww),
+  /** THE VERIFYING KEYS — the JWKS JSON (`{keys:[{kid,kty,alg,crv,x,y,n,e,...}]}`) as an OPAQUE STRING the
+   *  KERNEL parses + verifies a presented token against (sovereign-auth arc — see
+   *  architecture/sovereign_adapter.md). `t.string` (NOT `t.json`): the kernel `Value` has no JSON variant,
+   *  so the raw JWKS text must ride verbatim as a scalar — the kernel does `serde_json` on it, no projection
+   *  parse, no double-encoding. LAW-STATE: set by {@link setAuthProvider} (gated), refreshed by the
+   *  JWKS-fetch rotation capability (the host FETCHES — impure — but the law OWNS the keys + the kernel does
+   *  the verification). Absent ⇒ no in-kernel verify for this workspace (shell-issuer fallback, transitional). */
+  keys: t.string().merge(Lww).optional(),
+  /** OPTIONAL expected `aud` claim. When the platform sets it, a token's `aud` MUST carry this value
+   *  (defense-in-depth beyond the issuer match — e.g. a Firebase project id, an Auth0 API audience).
+   *  Absent ⇒ issuer match alone. This is LAW-STATE the PLATFORM owns; the host merely enforces it as a
+   *  capability (it never chooses the audience). */
+  audience: t.string().merge(Lww),
+  /** OPTIONAL — the JWT claim that carries the PRINCIPAL (default `"sub"` when absent). Azure AD's stable
+   *  user id is `oid` (its `sub` is pairwise-per-app, useless as identity); some setups key on a custom
+   *  claim. The KERNEL extracts THIS claim as the principal — never hardcoded to `sub`. */
+  principalClaim: t.string().merge(Lww).optional(),
+  /** OPTIONAL — the PINNED CA ROOT (base64 DER) for TRUSTLESS key rotation. When set, {@link rotateKeys}
+   *  accepts a new JWKS IFF each key's `x5c` chain validates to THIS root IN THE KERNEL (RFC 5280, the IdP's
+   *  CA vouches) and each key matches its leaf cert — no host trust, no admin. Pinned once via the
+   *  admin-gated {@link setAuthProvider}. Absent ⇒ no trustless rotation (rotate via setAuthProvider). */
+  rootCert: t.string().merge(Lww).optional(),
+  /** OPTIONAL — the JWT claim carrying the DEVICE BINDING for the keyless first-device enroll
+   *  (the `enrollFirstDevice` lane, keyless_verified_onboard.md): the kernel asserts
+   *  `token[deviceBindingClaim] == sha256(the signing device pubkey)`, so an on-chain token is useless to a
+   *  thief (no device secret). Standard values: `"nonce"` (OIDC) or `"cnf"`. Absent ⇒ none configured. */
+  deviceBindingClaim: t.string().merge(Lww).optional(),
+  /** OPTIONAL — `"false"` to OPT OUT of the device-binding requirement (accept the bounded ~token-lifetime
+   *  replay window — for IdPs that can't carry a nonce, eyes-open). The kernel applies STRICT (require the
+   *  binding) when this is absent or `"true"` — strict-by-default, so a naked token never lands unless the
+   *  tenant explicitly relaxes it. */
+  requireDeviceBinding: t.string().merge(Lww).optional(),
+  /** Human label for audit ("acme supabase", ...). */
+  label: t.string().merge(Lww),
+  /** Who set it (attribution). */
+  setBy: t.string().merge(Lww),
+  /** Epoch-ms it was set (caller-stamped). */
+  setAt: t.int().merge(Lww),
+});
+
+/**
+ * setAuthProvider — declare (or amend) the platform's identity provider. An
+ * Ensure on the singleton; every change is an attributed, replayable intent.
+ */
+export const setAuthProvider = directive("setAuthProvider")
+  .ensures(AuthProvider)
+  .payload(
+    z.object({
+      // NOT z.url(): zod's url() needs the URL global, which the sealed
+      // deterministic engine does not provide — a regex keeps the plan pure.
+      issuer: z.string().regex(/^https?:\/\/\S+$/, "expected an http(s) URL"),
+      jwksUrl: z.string().regex(/^https?:\/\/\S+$/, "expected an http(s) URL"),
+      audience: z.string().min(1).optional(),
+      /** The JWKS JSON (the public verifying keys) the KERNEL checks tokens against. Optional so the
+       *  rotation capability can re-set just the keys; absent keeps the prior keys (Lww). */
+      keys: z.string().min(1).optional(),
+      /** OPTIONAL — the claim carrying the principal (default "sub"; e.g. "oid" for Azure AD). */
+      principalClaim: z.string().min(1).optional(),
+      /** OPTIONAL — the pinned CA root (base64 DER) enabling trustless {@link rotateKeys}. */
+      rootCert: z.string().min(1).optional(),
+      /** OPTIONAL — the device-binding claim for keyless first-device enroll ("nonce" | "cnf"). */
+      deviceBindingClaim: z.string().min(1).optional(),
+      /** OPTIONAL — "false" to accept the bounded replay window (strict device-binding is the default). */
+      requireDeviceBinding: z.enum(["true", "false"]).optional(),
+      label: z.string().min(1),
+      setBy: z.string().min(1),
+      setAt: epochMs,
+    }),
+  )
+  .plan((p) => {
+    const ap = instance(AuthProvider, AUTH_PROVIDER_ID);
+    return [
+      withMarker(set(ap, "scope", "platform"), "ensures"),
+      set(ap, "issuer", p.issuer),
+      set(ap, "jwksUrl", p.jwksUrl),
+      ...(p.audience ? [set(ap, "audience", p.audience)] : []),
+      ...(p.keys ? [set(ap, "keys", p.keys)] : []),
+      ...(p.principalClaim ? [set(ap, "principalClaim", p.principalClaim)] : []),
+      ...(p.rootCert ? [set(ap, "rootCert", p.rootCert)] : []),
+      ...(p.deviceBindingClaim ? [set(ap, "deviceBindingClaim", p.deviceBindingClaim)] : []),
+      ...(p.requireDeviceBinding ? [set(ap, "requireDeviceBinding", p.requireDeviceBinding)] : []),
+      set(ap, "label", p.label),
+      set(ap, "setBy", p.setBy),
+      set(ap, "setAt", p.setAt),
+    ];
+  })
+  .requires("admin");
+
+/** The declared read serving a workspace's OWN AuthProvider row (and birthHome's inheritance capture). */
+export const authProvider = query("authProvider").key("scope").returns(AuthProvider);

package/src/framework/home.ts

@@ -35,6 +35,8 @@ import { create } from "../authoring.js";
 import { set, type PlannedOp } from "../ops.js";
 import { query } from "../query.js";
 import { birth } from "../births.js";
+import { readFrameworkDeclared } from "../read.js";
+import { authProvider as authProviderQuery } from "./auth_provider_law.js";
 import { workspaceInvariant, refAs } from "./workspace_invariant.js";
 import { identityRelations } from "./signing_identity.js";
 import { writeTuple } from "./relations.js";
@@ -213,12 +215,23 @@ export const birthHome = directive("birthHome")
        *  `links[0]` of the travelling chain — the kernel signs nothing (it holds no secret; it only verifies).
        *  Optional: absent ⇒ the era stays inert for this birth (pre-feature lane). */
       homeCert: z.string().optional(),
+      /** AUTHPROVIDER INHERITANCE — DEFAULT ON, opt out with `false`. Verification is PER-WORKSPACE (the
+       *  kernel never walks up to the parent), so a PRIVATE child born without its own AuthProvider cannot
+       *  verify any token — its own owner is locked out of verified reads (the co2 phase-6 wall). By
+       *  default the birth READS the parent's `authProvider` row (the #58 captured-read lane — live at
+       *  author, CAS-re-derived at the gate) and, when one is declared, COPIES it AS DATA into the child's
+       *  genesis (a `setAuthProvider` step) — the child still OWNS its verifier as its own law-state; the
+       *  parent's later rotations do NOT propagate (re-set on the child to rotate). Requirements the
+       *  refusals name: the parent law must compose the `authProvider` query and the child law the
+       *  `setAuthProvider` directive (both ride the framework export set). Pass `false` for a child that
+       *  must NOT trust the parent's IdP (it then seeds its own or stays bare-principal). */
+      inheritAuthProvider: z.boolean().optional(),
     }),
   )
   .plan((p) => {
     const founder = p.owner; // the actor for the child's own genesis steps (its self-bound owner subject)
     const homeName = homeNameOf(p.owner); // workspace name == seeded homeName — derived from the SAME owner
-    const genesisChain = [
+    const genesisChain: Array<{ domain: string; directiveId: string; actor: string; payload: Record<string, unknown>; domainHash?: string; domainPackageB64?: string }> = [
       // THE ORDER-DECLARED LAW INSTALL: two layers, bytes-by-hash (empty package — the kernel resolves them
       // from the parent's custody when it folds the birth; never the host). Matches buildGenesisChain's shape.
       { domain: "bootstrap", directiveId: "installDomain", actor: founder, payload: { domainHash: p.frameworkHash }, domainHash: p.frameworkHash, domainPackageB64: "" },
@@ -237,12 +250,49 @@ export const birthHome = directive("birthHome")
       // rides the LAW hash, not this branch.
       { domain: HOME_LAW_DOMAIN, directiveId: "enrollSigner", actor: founder, payload: { keyHash: p.ownerKeyHash, grantedBy: p.owner, grantedAt: 1 } },
     ];
+    // AUTHPROVIDER INHERITANCE (default ON — see the payload doc): read the PARENT's declared provider
+    // (captured read, re-derived at the gate) and copy it AS DATA into the child genesis. The child owns
+    // the copy as its own law-state; nothing is inherited-by-reference. Opt out: `inheritAuthProvider: false`.
+    if (p.inheritAuthProvider !== false) {
+      const rows = readFrameworkDeclared<Array<Record<string, unknown>>>("authProvider", { scope: "platform" });
+      const raw = Array.isArray(rows) && rows.length > 0 ? rows[0] : undefined;
+      // Projected rows are `{type,id,data:{…fields}}`; folded shapes may be flat — accept both.
+      const ap = (raw && typeof raw === "object" && typeof (raw as { data?: unknown }).data === "object"
+        ? (raw as { data: Record<string, unknown> }).data
+        : raw) as Record<string, unknown> | undefined;
+      const str = (k: string): string | undefined => {
+        const v = ap?.[k];
+        return typeof v === "string" && v.length > 0 ? v : undefined;
+      };
+      const issuer = str("issuer");
+      if (issuer !== undefined) {
+        genesisChain.push({
+          domain: HOME_LAW_DOMAIN,
+          directiveId: "setAuthProvider",
+          actor: founder,
+          payload: {
+            issuer,
+            jwksUrl: str("jwksUrl") ?? issuer, // required by the framework schema; a keys-only provider mirrors its issuer
+            ...(str("keys") !== undefined ? { keys: str("keys") } : {}),
+            ...(str("audience") !== undefined ? { audience: str("audience") } : {}),
+            ...(str("principalClaim") !== undefined ? { principalClaim: str("principalClaim") } : {}),
+            ...(str("rootCert") !== undefined ? { rootCert: str("rootCert") } : {}),
+            ...(str("deviceBindingClaim") !== undefined ? { deviceBindingClaim: str("deviceBindingClaim") } : {}),
+            ...(str("requireDeviceBinding") !== undefined ? { requireDeviceBinding: str("requireDeviceBinding") } : {}),
+            label: str("label") ?? "inherited-from-parent",
+            setBy: p.owner,
+            setAt: 1, // genesis position — deterministic, like enrollSigner's grantedAt
+          },
+        });
+      }
+    }
     // THE DECLARED BIRTH EFFECT (the unix model): the recipe rides the committed intent as a declared output
     // (captured_ports.births). The kernel — reading the `.births()` declaration off the law manifest — takes
     // the recipe and spawns + self-validates the child through the child's OWN gate (each step self-verifies).
     birth({ workspace: homeName, genesisChain });
     return [];
   })
+  .reads(authProviderQuery) // the parent-side AuthProvider capture the inheritance copies (the #58 lane)
   .births(); // BIRTH IS A DECLARED KERNEL PRIMITIVE — emits the `nomosBirthGate` era key; the kernel folds the recipe
 
 /**

package/src/framework/workspaces.ts

@@ -1351,107 +1351,11 @@ export const setPlatformPool = directive("setPlatformPool")
  * principals only WITHIN that platform's own tree. The cloud's own provider
  * (captain app) is the depth-0 case, configured by the host.
  */
-/** THE AUTHPROVIDER SINGLETON INSTANCE ID — the ONE place this string lives DSL-side (the kernel owns the
- *  matching `nomos_identity::auth_provider::AUTH_PROVIDER_ID`; a drift-guard test keeps them identical). The
- *  kernel verifies presented tokens against the AuthProvider at this id, so its SHAPE is kernel-owned
- *  first-class machinery; `setAuthProvider`/`rotateKeys` compile to it. */
-export const AUTH_PROVIDER_ID = "auth-provider:platform";
-
-export const AuthProvider = aggregate("AuthProvider", {
-  /** The singleton key — always `"platform"`. */
-  scope: t.string().merge(Lww),
-  /** The token issuer (the `iss` claim tokens must carry). */
-  issuer: t.string().merge(Lww),
-  /** The provider's public JWKS endpoint (asymmetric verification keys). The KERNEL never fetches — it's a
-   *  reference for the rotation capability that re-fetches + re-sets {@link keys}. */
-  jwksUrl: t.string().merge(Lww),
-  /** THE VERIFYING KEYS — the JWKS JSON (`{keys:[{kid,kty,alg,crv,x,y,n,e,...}]}`) as an OPAQUE STRING the
-   *  KERNEL parses + verifies a presented token against (sovereign-auth arc — see
-   *  architecture/sovereign_adapter.md). `t.string` (NOT `t.json`): the kernel `Value` has no JSON variant,
-   *  so the raw JWKS text must ride verbatim as a scalar — the kernel does `serde_json` on it, no projection
-   *  parse, no double-encoding. LAW-STATE: set by {@link setAuthProvider} (gated), refreshed by the
-   *  JWKS-fetch rotation capability (the host FETCHES — impure — but the law OWNS the keys + the kernel does
-   *  the verification). Absent ⇒ no in-kernel verify for this workspace (shell-issuer fallback, transitional). */
-  keys: t.string().merge(Lww).optional(),
-  /** OPTIONAL expected `aud` claim. When the platform sets it, a token's `aud` MUST carry this value
-   *  (defense-in-depth beyond the issuer match — e.g. a Firebase project id, an Auth0 API audience).
-   *  Absent ⇒ issuer match alone. This is LAW-STATE the PLATFORM owns; the host merely enforces it as a
-   *  capability (it never chooses the audience). */
-  audience: t.string().merge(Lww),
-  /** OPTIONAL — the JWT claim that carries the PRINCIPAL (default `"sub"` when absent). Azure AD's stable
-   *  user id is `oid` (its `sub` is pairwise-per-app, useless as identity); some setups key on a custom
-   *  claim. The KERNEL extracts THIS claim as the principal — never hardcoded to `sub`. */
-  principalClaim: t.string().merge(Lww).optional(),
-  /** OPTIONAL — the PINNED CA ROOT (base64 DER) for TRUSTLESS key rotation. When set, {@link rotateKeys}
-   *  accepts a new JWKS IFF each key's `x5c` chain validates to THIS root IN THE KERNEL (RFC 5280, the IdP's
-   *  CA vouches) and each key matches its leaf cert — no host trust, no admin. Pinned once via the
-   *  admin-gated {@link setAuthProvider}. Absent ⇒ no trustless rotation (rotate via setAuthProvider). */
-  rootCert: t.string().merge(Lww).optional(),
-  /** OPTIONAL — the JWT claim carrying the DEVICE BINDING for the keyless first-device enroll
-   *  (the `enrollFirstDevice` lane, keyless_verified_onboard.md): the kernel asserts
-   *  `token[deviceBindingClaim] == sha256(the signing device pubkey)`, so an on-chain token is useless to a
-   *  thief (no device secret). Standard values: `"nonce"` (OIDC) or `"cnf"`. Absent ⇒ none configured. */
-  deviceBindingClaim: t.string().merge(Lww).optional(),
-  /** OPTIONAL — `"false"` to OPT OUT of the device-binding requirement (accept the bounded ~token-lifetime
-   *  replay window — for IdPs that can't carry a nonce, eyes-open). The kernel applies STRICT (require the
-   *  binding) when this is absent or `"true"` — strict-by-default, so a naked token never lands unless the
-   *  tenant explicitly relaxes it. */
-  requireDeviceBinding: t.string().merge(Lww).optional(),
-  /** Human label for audit ("acme supabase", ...). */
-  label: t.string().merge(Lww),
-  /** Who set it (attribution). */
-  setBy: t.string().merge(Lww),
-  /** Epoch-ms it was set (caller-stamped). */
-  setAt: t.int().merge(Lww),
-});
-
-/**
- * setAuthProvider — declare (or amend) the platform's identity provider. An
- * Ensure on the singleton; every change is an attributed, replayable intent.
- */
-export const setAuthProvider = directive("setAuthProvider")
-  .ensures(AuthProvider)
-  .payload(
-    z.object({
-      // NOT z.url(): zod's url() needs the URL global, which the sealed
-      // deterministic engine does not provide — a regex keeps the plan pure.
-      issuer: z.string().regex(/^https?:\/\/\S+$/, "expected an http(s) URL"),
-      jwksUrl: z.string().regex(/^https?:\/\/\S+$/, "expected an http(s) URL"),
-      audience: z.string().min(1).optional(),
-      /** The JWKS JSON (the public verifying keys) the KERNEL checks tokens against. Optional so the
-       *  rotation capability can re-set just the keys; absent keeps the prior keys (Lww). */
-      keys: z.string().min(1).optional(),
-      /** OPTIONAL — the claim carrying the principal (default "sub"; e.g. "oid" for Azure AD). */
-      principalClaim: z.string().min(1).optional(),
-      /** OPTIONAL — the pinned CA root (base64 DER) enabling trustless {@link rotateKeys}. */
-      rootCert: z.string().min(1).optional(),
-      /** OPTIONAL — the device-binding claim for keyless first-device enroll ("nonce" | "cnf"). */
-      deviceBindingClaim: z.string().min(1).optional(),
-      /** OPTIONAL — "false" to accept the bounded replay window (strict device-binding is the default). */
-      requireDeviceBinding: z.enum(["true", "false"]).optional(),
-      label: z.string().min(1),
-      setBy: z.string().min(1),
-      setAt: epochMs,
-    }),
-  )
-  .plan((p) => {
-    const ap = instance(AuthProvider, AUTH_PROVIDER_ID);
-    return [
-      withMarker(set(ap, "scope", "platform"), "ensures"),
-      set(ap, "issuer", p.issuer),
-      set(ap, "jwksUrl", p.jwksUrl),
-      ...(p.audience ? [set(ap, "audience", p.audience)] : []),
-      ...(p.keys ? [set(ap, "keys", p.keys)] : []),
-      ...(p.principalClaim ? [set(ap, "principalClaim", p.principalClaim)] : []),
-      ...(p.rootCert ? [set(ap, "rootCert", p.rootCert)] : []),
-      ...(p.deviceBindingClaim ? [set(ap, "deviceBindingClaim", p.deviceBindingClaim)] : []),
-      ...(p.requireDeviceBinding ? [set(ap, "requireDeviceBinding", p.requireDeviceBinding)] : []),
-      set(ap, "label", p.label),
-      set(ap, "setBy", p.setBy),
-      set(ap, "setAt", p.setAt),
-    ];
-  })
-  .requires("admin");
+// THE AUTHPROVIDER LAW SURFACE moved to ./auth_provider_law.js (a LEAF module the engine entry +
+// birthHome inheritance import without dragging this whole graph into every lump). Re-exported
+// here verbatim — the public surface and the law bytes are unchanged.
+export { AUTH_PROVIDER_ID, AuthProvider, setAuthProvider, authProvider } from "./auth_provider_law.js";
+import { AUTH_PROVIDER_ID, AuthProvider, setAuthProvider, authProvider } from "./auth_provider_law.js";
 
 /**
  * rotateKeys — TRUSTLESS key rotation. Replace {@link AuthProvider.keys} with a new JWKS whose every key
@@ -1805,7 +1709,6 @@ export const platformGrantByPrincipal = query("platformGrantByPrincipal")
   .returns(PlatformGrant);
 
 /** The platform's identity provider (BYOAuth) — `scope: "platform"` singleton. */
-export const authProvider = query("authProvider").key("scope").returns(AuthProvider);
 
 /** Host → platform: the router's resolver (active claim = the hostname serves). */
 export const hostnameClaimByHostname = query("hostnameClaimByHostname")

package/src/read.ts

@@ -80,6 +80,30 @@ export function read<T = unknown>(
     footprint.push({ queryId: query.id, args, result });
     return result;
   }
+  return readForeign(query, args, from);
+}
+
+/**
+ * FRAMEWORK-INTERNAL local read for plans whose directive ALWAYS declares the query (birthHome's
+ * authProvider inheritance). Same serve + same footprint capture as {@link read}'s local lane — but a
+ * DIFFERENT missing-host error: the compile gate's lump marker lives ONLY in `read()`'s body so it
+ * fingers UNDECLARED tenant usage; a framework plan bundled via the `@githolon/dsl` barrel must not pin
+ * that marker into read-free lumps (the framework caller is declared by construction).
+ */
+export function readFrameworkDeclared<T = unknown>(queryId: string, args: Record<string, string>): T {
+  const h = host() as { read?: unknown } | undefined;
+  if (typeof h?.read !== "function") {
+    throw new Error(
+      `framework read('${queryId}'): this engine serves no captured reads — the composing law must ` +
+        `carry the directive's declared read (recompile the law under this DSL; the declaration rides the framework directive).`,
+    );
+  }
+  const result = host().read(queryId, args) as T;
+  footprint.push({ queryId, args, result });
+  return result;
+}
+
+function readForeign<T = unknown>(query: QueryDecl | { id: string }, args: Record<string, string>, from: string): T {
   // ── THE FOREIGN (attested cross-workspace) LANE (slice B — attested_reads_design.md §4.1).
   // The port answers the `{rows, attestation}` wrapper: at AUTHOR the kernel verified the
   // injected source envelope before serving it; at VERIFY the recorded capture replays