@githolon/testing 0.20.0 → 0.21.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/testing",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "type": "module",
   "description": "@githolon/testing — law TDD for Nomos domains: boot the REAL engine plane in-process (the exact machinery every cloud DO, heavy container and web client runs), dispatch directives, assert rows, assert TYPED REFUSALS, fork for what-ifs — fully offline inside vitest.",
   "license": "SEE LICENSE IN LICENSE.md",

package/vendor/engine/engine.mjs

@@ -995,8 +995,7 @@ export async function replicateIntents(eng, ws, ledger, intents, { push = true }
  * main once. This is still untrusted work: owner-only/control-plane/receipt
  * writes are refused or dead-lettered exactly like session refs.
  */
-export async function admitIntentOffers(eng, ws, ledger, offers, { refuseDomains = [], receiptFence = null, shardRouting = null, clientBase = null, defer = false } = {}) {
-  const refuse = new Set(refuseDomains);
+export async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null, shardRouting = null, clientBase = null, defer = false } = {}) {
   const main = await mainIntentIds(eng, ws);
   const sessions = new Map();
   const deadLetters = [];
@@ -1048,14 +1047,13 @@ export async function admitIntentOffers(eng, ws, ledger, offers, { refuseDomains
       const dirId = typeof doc?.payload?.directiveId === "string" ? doc.payload.directiveId : null;
       const oid = String(offer?.oid || intentId || "").slice(0, 10);
       // THE GATE DECIDES (offer-kernel doctrine — OFFER_KERNEL_ARCHITECTURE.dot): the adapter does NOT
-      // pre-filter control-plane (`nomos`/`bootstrap`) intents by domain string — that was the adapter
-      // "choosing admission", which the doctrine forbids. An install/governance offer rides the SAME lane;
-      // the kernel gate refuses an author who lacks the declared relation (installDomain.requiresRelationGate
-      // = {relation:"installDomain", object:"workspace:self"}), so an unauthorized control-plane write is a
-      // TYPED GATE refusal, not a adapter verdict. Only `!dom` (malformed) and the explicit per-workspace
-      // `refuse` fence (root's `workspaces` governance lane) stay — those are structural, not authority.
-      if (!dom || refuse.has(dom)) {
-        rec.rejected.push({ oid, error: `${dom ? `'${dom}' is adapter-fenced on this workspace` : "non-authored intent"} — governance enters its own admin lane` });
+      // pre-filter ANY intent by domain string. An install/governance offer rides the SAME lane; the kernel
+      // gate refuses an author who lacks the declared relation, so an unauthorized control-plane write is a
+      // TYPED GATE refusal, never an adapter verdict. host does no authority — the kernel gates the control
+      // plane (open until the warrant-flip arms signature verification on root/co2). Only `!dom` (malformed
+      // bytes — structural, not authority) stays.
+      if (!dom) {
+        rec.rejected.push({ oid, error: "non-authored intent — governance enters its own admin lane" });
         continue;
       }
       if (receiptFence && dirId && Array.isArray(receiptFence[dom]) && receiptFence[dom].includes(dirId)) {
@@ -2031,8 +2029,7 @@ async function mainIntentIds(eng, ws) {
  * engine has no durable store), obvious attacks drop. Admitted intents merge to main,
  * durably push, the branch is consumed.
  */
-export async function admitAll(eng, ws, ledger, { refuseDomains = [], receiptFence = null, shardRouting = null, defer = false } = {}) {
-  const refuse = new Set(refuseDomains);
+export async function admitAll(eng, ws, ledger, { receiptFence = null, shardRouting = null, defer = false } = {}) {
   const routes = shardRouting ? directiveRoutes(eng) : null;
   const gitdir = gitdirOf(ws);
   // FRESH HEADER COPY PER GIT OP. isomorphic-git's `discover` MUTATES the headers object it's given
@@ -2146,12 +2143,13 @@ export async function admitAll(eng, ws, ledger, { refuseDomains = [], receiptFen
           const blob = bytesFromB64(c.intentB64);
           let dom = null, intentId = null, dirId = null;
           try { const doc = JSON.parse(dec.decode(blob)); intentId = typeof doc.id === "string" ? doc.id : null; dom = doc && doc.payload && typeof doc.payload.domain === "string" ? doc.payload.domain : null; dirId = doc && doc.payload && typeof doc.payload.directiveId === "string" ? doc.payload.directiveId : null; } catch {}
-          // THE GATE DECIDES (offer-kernel doctrine): no adapter domain-string filter for control-plane —
-          // an install/governance offer rides the SAME lane and the kernel gate refuses an author lacking
-          // the declared relation (a TYPED gate refusal, not a adapter verdict). Only `!dom` (malformed) and
-          // the explicit `refuse` fence (root's `workspaces` governance lane) stay — structural, not authority.
-          if (!dom || refuse.has(dom)) {
-            rejected.push({ oid: oid.slice(0, 10), error: `${dom ? `'${dom}' is adapter-fenced on this workspace` : "non-authored intent"} — governance enters its own admin lane` });
+          // THE GATE DECIDES (offer-kernel doctrine): no adapter domain-string filter for ANY intent — an
+          // install/governance offer rides the SAME lane and the kernel gate refuses an author lacking the
+          // declared relation (a TYPED gate refusal, never an adapter verdict). host does no authority — the
+          // kernel gates the control plane (open until the warrant-flip arms signature verification on
+          // root/co2). Only `!dom` (malformed bytes — structural, not authority) stays.
+          if (!dom) {
+            rejected.push({ oid: oid.slice(0, 10), error: "non-authored intent — governance enters its own admin lane" });
             continue;
           }
           // THE RECEIPT FENCE (capability_marketplace.md slice 1.5 — the ratified
@@ -2643,12 +2641,16 @@ export async function boot(eng, ws, ledger) {
 }
 
 /** Install a tenant package under the nomos controller (validation is the ADAPTER's job). */
-export async function deploy(eng, ws, ledger, usda, domainHash, dispositions) {
+export async function deploy(eng, ws, ledger, usda, domainHash, dispositions, opts = {}) {
   // THE EVOLVE-GATE ANSWER LANE (#58): `dispositions` ({retired, retyped, rebinds,
   // ackBy}) ride the committed installDomain payload — IN-HISTORY facts the one gate
   // adjudicates the stable-id diff against. Absent for the common (non-destructive)
   // upgrade; the gate's typed refusal names the remedy when one is needed.
-  const result = author(eng, ws, "nomos", "installDomain", installPayload(domainHash, usda, eng.installedBy, dispositions), eng.hashes.nomos);
+  // THE DEPLOYER's attested identity (actor + raw token) rides the install author exactly as the `offer`
+  // verb threads it — the kernel judges whether this principal holds the `installDomain` relation. Empty
+  // actor (the default) preserves the genesis-virgin / broadly-held-relation install path (backward-compat);
+  // a present actor lets an AUTHORIZED non-virgin evolve admit instead of being refused for want of authority.
+  const result = author(eng, ws, "nomos", "installDomain", installPayload(domainHash, usda, eng.installedBy, dispositions), eng.hashes.nomos, { actor: opts.actor ?? "", ...(opts.authToken ? { authToken: opts.authToken } : {}) });
   // ATOMICITY: VALIDATE the post-install projection BEFORE committing to custody. The install's
   // read manifest is re-derived on this read; if it cannot fold (e.g. a divergent read-projection
   // declaration the kernel refuses), this THROWS — and because we have NOT yet pushed, custody