@githolon/dsl 0.98.2 → 0.98.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.98.2",
+  "version": "0.98.3",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/framework/home.ts

@@ -231,6 +231,30 @@ export const birthHome = directive("birthHome")
   .plan((p) => {
     const founder = p.owner; // the actor for the child's own genesis steps (its self-bound owner subject)
     const homeName = homeNameOf(p.owner); // workspace name == seeded homeName — derived from the SAME owner
+    // THE PARENT'S DECLARED VERIFIER (one captured read serves BOTH consumers below): the inherited
+    // `setAuthProvider` genesis step AND the enroll step's `verifiedVia` provenance stamp. Read it up
+    // front so the enroll step (which precedes the inheritance step in the chain) can see the issuer.
+    const apRows = p.inheritAuthProvider !== false
+      ? readFrameworkDeclared<Array<Record<string, unknown>>>("authProvider", { scope: "platform" })
+      : undefined;
+    const apRaw = Array.isArray(apRows) && apRows.length > 0 ? apRows[0] : undefined;
+    // Projected rows are `{type,id,data:{…fields}}`; folded shapes may be flat — accept both.
+    const ap = (apRaw && typeof apRaw === "object" && typeof (apRaw as { data?: unknown }).data === "object"
+      ? (apRaw as { data: Record<string, unknown> }).data
+      : apRaw) as Record<string, unknown> | undefined;
+    const apStr = (k: string): string | undefined => {
+      const v = ap?.[k];
+      return typeof v === "string" && v.length > 0 ? v : undefined;
+    };
+    // PROVENANCE (the verified-lineage thread, 2026-07-16): the kernel derives every later write's
+    // `principal_verified` from the ENROLL LEAF's `verifiedVia` — so a verified birth must stamp it or the
+    // born home's owner writes UNVERIFIED forever (and its own children are then born `verified:false`,
+    // whose chains refuse `verify_to_root`). The cert's `verified` IS the gate verdict post-admission
+    // (assemble_birth_attestation CAS-refuses a mismatch), so reading it in-plan is trustworthy — a lying
+    // cert never reaches this fold. An unverified birth stamps nothing (the unverified lane stays honest).
+    let certVerified = false;
+    try { certVerified = p.homeCert !== undefined && JSON.parse(p.homeCert).verified === true; } catch { /* malformed cert ⇒ unverified (the gate will refuse the birth anyway) */ }
+    const verifiedVia = certVerified ? apStr("issuer") : undefined;
     const genesisChain: Array<{ domain: string; directiveId: string; actor: string; payload: Record<string, unknown>; domainHash?: string; domainPackageB64?: string }> = [
       // THE ORDER-DECLARED LAW INSTALL: two layers, bytes-by-hash (empty package — the kernel resolves them
       // from the parent's custody when it folds the birth; never the host). Matches buildGenesisChain's shape.
@@ -248,22 +272,13 @@ export const birthHome = directive("birthHome")
       // ladder: every seed runs UNSIGNED on the still-warrant-free prefix; the warrant closes it). ERA-SAFE: a
       // home born earlier (pre-feature law, no such step in its recipe) replays byte-identical — the era rule
       // rides the LAW hash, not this branch.
-      { domain: HOME_LAW_DOMAIN, directiveId: "enrollSigner", actor: founder, payload: { keyHash: p.ownerKeyHash, grantedBy: p.owner, grantedAt: 1 } },
+      { domain: HOME_LAW_DOMAIN, directiveId: "enrollSigner", actor: founder, payload: { keyHash: p.ownerKeyHash, grantedBy: p.owner, grantedAt: 1, ...(verifiedVia !== undefined ? { verifiedVia } : {}) } },
     ];
-    // AUTHPROVIDER INHERITANCE (default ON — see the payload doc): read the PARENT's declared provider
-    // (captured read, re-derived at the gate) and copy it AS DATA into the child genesis. The child owns
-    // the copy as its own law-state; nothing is inherited-by-reference. Opt out: `inheritAuthProvider: false`.
+    // AUTHPROVIDER INHERITANCE (default ON — see the payload doc): copy the parent's declared provider
+    // (the up-front captured read above) AS DATA into the child genesis. The child owns the copy as its
+    // own law-state; nothing is inherited-by-reference. Opt out: `inheritAuthProvider: false`.
     if (p.inheritAuthProvider !== false) {
-      const rows = readFrameworkDeclared<Array<Record<string, unknown>>>("authProvider", { scope: "platform" });
-      const raw = Array.isArray(rows) && rows.length > 0 ? rows[0] : undefined;
-      // Projected rows are `{type,id,data:{…fields}}`; folded shapes may be flat — accept both.
-      const ap = (raw && typeof raw === "object" && typeof (raw as { data?: unknown }).data === "object"
-        ? (raw as { data: Record<string, unknown> }).data
-        : raw) as Record<string, unknown> | undefined;
-      const str = (k: string): string | undefined => {
-        const v = ap?.[k];
-        return typeof v === "string" && v.length > 0 ? v : undefined;
-      };
+      const str = apStr;
       const issuer = str("issuer");
       if (issuer !== undefined) {
         genesisChain.push({

package/src/framework/signing_identity.ts

@@ -212,6 +212,14 @@ export const enrollSigner = directive("enrollSigner")
       keyHash: sha256Hex, // sha256hex of the ed25519 device PUBLIC key
       grantedBy: z.string().min(1),
       grantedAt: z.number().int().nonnegative(), // epoch ms, caller-stamped (determinism)
+      /** OPTIONAL PROVENANCE — the IdP/issuer that VOUCHED for this principal at the enrolling birth.
+       *  The kernel's `verify_captured_principal` derives `principal_verified` from THIS leaf field on
+       *  every later write, so a genesis enroll that omits it leaves the workspace's owner permanently
+       *  UNVERIFIED (their children are then born `verified:false` and their chains refuse
+       *  `verify_to_root` — the 2026-07-16 estate holarchy RED). Birth recipes stamp it from the
+       *  CAS-verified birth cert (`cert.verified` IS the gate verdict post-admission) + the inherited
+       *  AuthProvider issuer; an unverified birth omits it (the unverified lane stays honest). */
+      verifiedVia: z.string().min(1).optional(),
     }),
   )
   .plan((p, ctx) => {
@@ -227,6 +235,7 @@ export const enrollSigner = directive("enrollSigner")
       subject: "key:" + p.keyHash,
       grantedBy: p.grantedBy,
       grantedAt: String(p.grantedAt),
+      ...(p.verifiedVia !== undefined ? { verifiedVia: p.verifiedVia } : {}),
     });
   });
 

package/src/index.ts

@@ -416,6 +416,15 @@ export {
   type SignerEpochHandle,
   type SignerAuthority,
 } from "./framework/signing_identity.js";
+// THE WORKSPACE VERIFIER is framework-owned law-state. Ordinary birth/onboarding flows compose and
+// inherit it automatically; these exports exist for governance and acceptance laws that need to author
+// the provider explicitly, without re-declaring the kernel's security schema in tenant code.
+export {
+  AUTH_PROVIDER_ID,
+  AuthProvider,
+  setAuthProvider,
+  authProvider,
+} from "./framework/auth_provider_law.js";
 // THE HOME HOLON (home_holons_and_cross_custody.md §4) — the identity-role law: the shared-with-me access
 // index + the owner lane to maintain it (the key directory is the `signer` relation above).
 export {