githolon 0.100.0 → 0.100.2

package/dist/cli.mjs

@@ -3098,6 +3098,8 @@ __export(governance_exports, {
   certifyEra: () => certifyEra,
   consentRebirth: () => consentRebirth,
   discoverSigningDomain: () => discoverSigningDomain,
+  ensureSovereignHome: () => ensureSovereignHome,
+  exchangeOnboardingToken: () => exchangeOnboardingToken,
   executeRepairRebirth: () => executeRepairRebirth,
   governanceOffer: () => governanceOffer,
   governanceRelay: () => governanceRelay,
@@ -3120,6 +3122,8 @@ __export(governance_exports, {
   resolveGovernancePrincipal: () => resolveGovernancePrincipal,
   signAndPostGovernance: () => signAndPostGovernance,
   signAndPostOffer: () => signAndPostOffer,
+  signAndPostWorkspaceBirth: () => signAndPostWorkspaceBirth,
+  signAndPostWorkspaceRetirement: () => signAndPostWorkspaceRetirement,
   validatePlanForApply: () => validatePlanForApply,
   verifyWorkspaceVerdict: () => verifyWorkspaceVerdict
 });
@@ -3195,28 +3199,239 @@ function canonicalPrincipal(principal) {
   return s.includes(":") ? s : `user:${s}`;
 }
 async function signAndPostOffer(ws, domain, directiveId, payload, opts) {
+  return signAndPostPreparedOffer(ws, domain, () => ({ directiveId, payload }), opts);
+}
+async function signAndPostPreparedOffer(ws, domain, prepare, opts, authorMode = "account", preferActor) {
   const cloud = cloudBase(opts.cloud);
   const principal = resolveGovernancePrincipal(opts);
   const holon = await connectGovernance(cloud, ws);
-  const resolvedDomain = domain ?? await discoverSigningDomain(holon, ws, directiveId, void 0);
   const device = await ensureDeviceKey(holon, principal);
+  const accountActor = canonicalPrincipal(principal);
+  const keyActor = `key:${device.keyHash}`;
+  let actor = accountActor;
+  if (preferActor !== void 0 && preferActor === keyActor) {
+    actor = keyActor;
+  } else if (preferActor !== void 0 && sameIdentity(preferActor, accountActor)) {
+    actor = accountActor;
+  } else if (authorMode === "self-if-unenrolled" && typeof holon.parentSignerEnrollment === "function") {
+    try {
+      const posture = await holon.parentSignerEnrollment({ parent: ws, principal: accountActor, keyHash: device.keyHash });
+      if (!posture.enrolled) actor = keyActor;
+    } catch {
+    }
+  }
+  const prepared = prepare(actor);
+  const resolvedDomain = domain ?? await discoverSigningDomain(holon, ws, prepared.directiveId, void 0);
   const sealed = await holon.signGovernanceOffer({
     domain: resolvedDomain,
-    directiveId,
-    payload,
+    directiveId: prepared.directiveId,
+    payload: prepared.payload,
     authorSecret: device.secret,
-    actor: canonicalPrincipal(principal)
+    actor
   });
   if (sealed.intentBytes.length > STAGE_THRESHOLD_CHARS) {
-    const staged = await relaySealedOfferViaStage(cloud, ws, directiveId, sealed.intentBytes, fetch);
+    const staged = await relaySealedOfferViaStage(cloud, ws, prepared.directiveId, sealed.intentBytes, fetch);
     if (staged !== null) {
       out2(`  staged ${staged.size} sealed bytes content-addressed (sha256 ${staged.sha256.slice(0, 16)}\u2026) \u2014 the signed offer names the hash`);
-      return { ...staged.verdict, principal };
+      return { ...staged.verdict, principal, actor, directiveId: prepared.directiveId };
     }
     err2(`this cloud has no /v2/stage content-addressed lane \u2014 relaying the ${sealed.intentBytes.length}-char sealed offer inline (a 413 here means the worker needs upgrading to accept law this large signed)`);
   }
-  const verdict = await holon.postGovernanceOffer({ directiveId, intentBytes: sealed.intentBytes, ws, domain: resolvedDomain });
-  return { ...verdict, principal };
+  const verdict = await holon.postGovernanceOffer({ directiveId: prepared.directiveId, intentBytes: sealed.intentBytes, ws, domain: resolvedDomain });
+  return { ...verdict, principal, actor, directiveId: prepared.directiveId };
+}
+async function signAndPostWorkspaceBirth(parent, name, opts) {
+  return signAndPostPreparedOffer(
+    parent,
+    "workspaces",
+    (actor) => {
+      const identity = lineageIdentity(actor);
+      return {
+        directiveId: "createWorkspace",
+        payload: {
+          name,
+          tier: "edge",
+          parent: parent === "root" ? "" : parent,
+          principal: identity,
+          requestedBy: identity,
+          requestedAt: Date.now()
+        }
+      };
+    },
+    opts,
+    "self-if-unenrolled"
+  );
+}
+async function exchangeOnboardingToken(session, keyHash, idp = process.env["NOMOS_ONBOARDING_IDP"] ?? DEFAULT_ONBOARDING_IDP, fetchImpl = fetch) {
+  const r = await fetchImpl(`${idp.replace(/\/+$/, "")}/token`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${session}`, "content-type": "application/json" },
+    body: JSON.stringify({ nonce: keyHash })
+  });
+  const body = await r.json().catch(() => null);
+  if (!r.ok || typeof body?.token !== "string" || typeof body.issuer !== "string" || typeof body.subject !== "string") {
+    throw new Error(
+      `Nomos could not establish the first device identity (${r.status}): ${String(body?.error ?? "invalid identity-provider response")}`
+    );
+  }
+  return { token: body.token, issuer: body.issuer, subject: body.subject };
+}
+async function ensureSovereignHome(opts = {}) {
+  const cloud = cloudBase(opts.cloud);
+  const uid = opts.principal ?? currentPrincipal();
+  if (!uid) throw new Error("a Nomos session is required \u2014 githolon login --agent");
+  const actor = canonicalPrincipal(uid);
+  if (!actor.startsWith("user:")) throw new Error("blank-session bootstrap requires an identity-provider principal");
+  const bare = actor.slice("user:".length);
+  const auth = await sessionToken();
+  if (!auth) throw new Error("blank-session bootstrap needs the live login session \u2014 githolon login --agent");
+  const client = await import("@githolon/client");
+  const home = await client.homeNameOf(actor);
+  const exists = await fetch(`${cloud}/v2/workspaces/${encodeURIComponent(home)}`).then((r) => r.ok).catch(() => false);
+  const root = await connectGovernance(cloud, "root");
+  const device = await ensureDeviceKey(root, bare);
+  let signerReady = false;
+  if (typeof root.parentSignerEnrollment === "function") {
+    signerReady = await root.parentSignerEnrollment({ parent: "root", principal: actor, keyHash: device.keyHash, authToken: auth }).then((p) => p.enrolled && p.revoked !== true).catch(() => false);
+  }
+  const delegationReady = await fetch(
+    `${cloud}/v2/workspaces/root/workspaces/signerDelegationByUser?user=${encodeURIComponent(actor)}`
+  ).then(async (r) => {
+    if (!r.ok) return false;
+    const d = await r.json();
+    return Array.isArray(d.rows) && d.rows.length > 0;
+  }).catch(() => false);
+  if (!signerReady || !delegationReady) {
+    if (typeof root.enrollFirstDevice !== "function") {
+      throw new Error("the installed @githolon/client predates automatic first-device enrollment");
+    }
+    const assertion = await exchangeOnboardingToken(auth, device.keyHash);
+    if (assertion.subject !== bare) {
+      throw new Error(`identity provider returned '${assertion.subject}' for logged-in principal '${bare}'`);
+    }
+    await root.enrollFirstDevice({
+      parent: "root",
+      domain: "workspaces",
+      principal: actor,
+      device,
+      idToken: assertion.token,
+      authToken: assertion.token,
+      verifiedVia: assertion.issuer
+    });
+  }
+  if (!exists) {
+    const domains = await fetch(`${cloud}/v2/workspaces/root/domains`).then(async (r) => {
+      if (!r.ok) throw new Error(`root law discovery failed (${r.status})`);
+      return await r.json();
+    });
+    const frameworkHash = domains.currentLaw?.["nomos"];
+    const lawHash = domains.currentLaw?.["workspaces"];
+    if (!frameworkHash || !lawHash) throw new Error("root does not report the framework and governance laws needed for birth");
+    const birthCert = await root.certSign({
+      child: home,
+      founder: actor,
+      verified: true,
+      parentKey: device.public,
+      parentId: "root",
+      epoch: 0,
+      secret: device.secret
+    });
+    const now = Date.now();
+    const birth = await fetch(`${cloud}/v2/workspaces/root/workspaces/birthChild`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        name: home,
+        parent: "",
+        principal: bare,
+        tier: "edge",
+        requestedBy: bare,
+        requestedAt: now,
+        foundingAdminHash: device.keyHash,
+        bornAt: new Date(now).toISOString(),
+        frameworkHash,
+        lawHash,
+        platformCert: JSON.stringify(birthCert),
+        actor,
+        authorSecret: device.secret
+      })
+    });
+    const body = await birth.json().catch(() => null);
+    const failed = body?.birthOutcomes?.find((o) => o.status !== "born");
+    if (!birth.ok || body?.ok === false || failed) {
+      throw new Error(
+        `Nomos could not birth the session home (${birth.status}): ${failed?.reason ?? String(body?.error ?? JSON.stringify(body))}`
+      );
+    }
+    const deadline = Date.now() + 3e4;
+    while (Date.now() < deadline) {
+      if (await fetch(`${cloud}/v2/workspaces/${encodeURIComponent(home)}`).then((r) => r.ok).catch(() => false)) break;
+      await new Promise((resolve6) => setTimeout(resolve6, 250));
+    }
+    if (!await fetch(`${cloud}/v2/workspaces/${encodeURIComponent(home)}`).then((r) => r.ok).catch(() => false)) {
+      throw new Error(`Nomos admitted the birth of '${home}' but its custody did not become readable`);
+    }
+    const admin = await signAndPostOffer(
+      home,
+      "workspaces",
+      "grantAdmin",
+      { principal: bare, label: "founding admin", grantedBy: bare, grantedAt: now },
+      { ...opts, principal: bare }
+    );
+    if (!admin.ok) throw new Error(`the born home refused its founding admin (${admin.status}): ${JSON.stringify(admin.body)}`);
+  }
+  const homeHolon = await connectGovernance(cloud, home);
+  const homeSigner = typeof homeHolon.parentSignerEnrollment === "function" ? await homeHolon.parentSignerEnrollment({ parent: home, principal: actor, keyHash: device.keyHash, authToken: auth }).catch(() => null) : null;
+  if (!homeSigner?.verifiedVia) {
+    if (typeof homeHolon.enrollFirstDevice !== "function") {
+      throw new Error("the installed @githolon/client predates verified session-home enrollment");
+    }
+    const assertion = await exchangeOnboardingToken(auth, device.keyHash);
+    if (assertion.subject !== bare) {
+      throw new Error(`identity provider returned '${assertion.subject}' for logged-in principal '${bare}'`);
+    }
+    const domain = await discoverSigningDomain(homeHolon, home, "enrollFirstDevice", "workspaces");
+    await homeHolon.enrollFirstDevice({
+      parent: home,
+      domain,
+      principal: actor,
+      device,
+      idToken: assertion.token,
+      authToken: assertion.token,
+      verifiedVia: assertion.issuer,
+      includeDelegation: false
+    });
+    const object = `identity:${actor}`;
+    const deadline = Date.now() + 3e4;
+    let visible = false;
+    while (Date.now() < deadline) {
+      visible = await fetch(
+        `${cloud}/v2/workspaces/${encodeURIComponent(home)}/workspaces/relationTuplesByObject?object=${encodeURIComponent(object)}`
+      ).then(async (r) => {
+        if (!r.ok) return false;
+        const body = await r.json();
+        const leaf = body.rows?.[0]?.data?.subjects?.[`key:${device.keyHash}`];
+        return typeof leaf?.verifiedVia === "string" && leaf.verifiedVia.length > 0;
+      }).catch(() => false);
+      if (visible) break;
+      await new Promise((resolve6) => setTimeout(resolve6, 250));
+    }
+    if (!visible) throw new Error(`the session home's verified device enrollment did not become readable`);
+  }
+  return { home, principal: actor, device, created: !exists };
+}
+async function signAndPostWorkspaceRetirement(parent, workspaceId, creator, opts) {
+  return signAndPostPreparedOffer(
+    parent,
+    "workspaces",
+    (actor) => ({
+      directiveId: creator !== "" && sameIdentity(creator, actor) ? "retireOwnWorkspace" : "retireWorkspace",
+      payload: { workspaceId, retiredBy: lineageIdentity(actor), retiredAt: Date.now() }
+    }),
+    opts,
+    "self-if-unenrolled",
+    creator
+  );
 }
 async function relaySealedOfferViaStage(cloud, ws, directiveId, intentBytesB64, fetchImpl) {
   const raw = Buffer.from(intentBytesB64, "base64");
@@ -4517,13 +4732,16 @@ function readSealedIntentBytes(eng, ws, intentOut) {
   if (f?.data === void 0) return void 0;
   return Buffer.from(f.data).toString("base64");
 }
-var out2, err2, STAGE_THRESHOLD_CHARS, HONEST_CEILING, ROOT_CUSTODIAN_SECRET, CLIENT_IMPACT;
+var out2, err2, lineageIdentity, sameIdentity, DEFAULT_ONBOARDING_IDP, STAGE_THRESHOLD_CHARS, HONEST_CEILING, ROOT_CUSTODIAN_SECRET, CLIENT_IMPACT;
 var init_governance = __esm({
   "src/governance.ts"() {
     "use strict";
     init_cloud();
     out2 = (s) => void process.stdout.write(s + "\n");
     err2 = (s) => void process.stderr.write("error: " + s + "\n");
+    lineageIdentity = (actor) => actor.startsWith("user:") ? actor.slice("user:".length) : actor;
+    sameIdentity = (a, b) => lineageIdentity(a) === lineageIdentity(b);
+    DEFAULT_ONBOARDING_IDP = "https://id.nomos.captainapp.co.uk";
     STAGE_THRESHOLD_CHARS = 4 * 1024 * 1024;
     HONEST_CEILING = `The operator controls root's law and could deploy law removing the consent check \u2014 but that act is itself a signed, ordered, permanent fact in root's chain, visible to every tenant running \`replay root\`, and grounds for exit-with-everything. Not "we can't" \u2014 "we can't secretly, and you can always leave."`;
     ROOT_CUSTODIAN_SECRET = "nomos-root-custodian-key";
@@ -4948,6 +5166,7 @@ var init_lifecycle = __esm({
 var cloud_exports = {};
 __export(cloud_exports, {
   activePrincipal: () => activePrincipal,
+  advertisedMainHead: () => advertisedMainHead,
   authUse: () => authUse,
   clearActAs: () => clearActAs,
   cloudBase: () => cloudBase,
@@ -4969,6 +5188,7 @@ __export(cloud_exports, {
   setDeviceKey: () => setDeviceKey,
   setPrincipal: () => setPrincipal,
   setSecret: () => setSecret,
+  waitForDurableMainAdvance: () => waitForDurableMainAdvance,
   whoami: () => whoami,
   wsCreate: () => wsCreate,
   wsReclaim: () => wsReclaim,
@@ -5181,16 +5401,10 @@ async function logout() {
 async function wsCreate(name, opts) {
   const cloud = cloudBase(opts.cloud);
   if (opts.via !== void 0) {
-    const { signAndPostGovernance: signAndPostGovernance2, resolveGovernancePrincipal: resolveGovernancePrincipal2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
+    const { signAndPostWorkspaceBirth: signAndPostWorkspaceBirth2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
     let v;
     try {
-      const principal2 = resolveGovernancePrincipal2(opts);
-      v = await signAndPostGovernance2(
-        opts.via,
-        "createWorkspace",
-        { name, tier: "edge", parent: opts.via === "root" ? "" : opts.via, principal: principal2, requestedBy: principal2, requestedAt: Date.now() },
-        opts
-      );
+      v = await signAndPostWorkspaceBirth2(opts.via, name, opts);
     } catch (e) {
       err4(e.message);
       return 1;
@@ -5259,7 +5473,7 @@ async function wsStatus(name, opts) {
 }
 async function wsRetire(ws, opts) {
   const cloud = cloudBase(opts.cloud);
-  const { signAndPostGovernance: signAndPostGovernance2, resolveGovernancePrincipal: resolveGovernancePrincipal2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
+  const { signAndPostWorkspaceRetirement: signAndPostWorkspaceRetirement2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
   const parent = opts.parent ?? "root";
   let record;
   try {
@@ -5280,12 +5494,8 @@ async function wsRetire(ws, opts) {
   }
   let v;
   try {
-    const principal = resolveGovernancePrincipal2(opts);
-    const payload = { workspaceId: recordId, retiredBy: principal, retiredAt: Date.now() };
-    const bare = (s) => s.startsWith("user:") ? s.slice(5) : s;
     const creator = record?.data?.createdBy ?? record?.data?.principal ?? "";
-    const own = creator !== "" && bare(creator) === bare(principal);
-    v = await signAndPostGovernance2(parent, own ? "retireOwnWorkspace" : "retireWorkspace", payload, opts);
+    v = await signAndPostWorkspaceRetirement2(parent, recordId, creator, opts);
   } catch (e) {
     err4(e.message);
     return 1;
@@ -5332,6 +5542,24 @@ async function wsReclaim(ws, opts) {
   out4("  the custodian drops the ledger bytes on seeing this fact folded; the reclaimed FACT is append-only");
   return 0;
 }
+function advertisedMainHead(text) {
+  return /([0-9a-f]{40}) refs\/heads\/main\b/.exec(text)?.[1];
+}
+async function durableMainHead(cloud, ws, fetchImpl = fetch) {
+  return fetchImpl(`${cloud}/v2/workspaces/${encodeURIComponent(ws)}/git/info/refs?service=git-upload-pack`).then(async (r) => r.ok ? advertisedMainHead(await r.text()) : void 0).catch(() => void 0);
+}
+async function waitForDurableMainAdvance(cloud, ws, previousHead, opts = {}) {
+  const timeoutMs = Math.max(100, Number(opts.timeoutMs) || 3e4);
+  const pollMs = Math.max(1, Number(opts.pollMs) || 250);
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const head = await durableMainHead(cloud, ws, fetchImpl);
+    if (head !== void 0 && head !== previousHead) return head;
+    await new Promise((resolve6) => setTimeout(resolve6, pollMs));
+  }
+  return void 0;
+}
 async function deploy2(ws, opts) {
   const cloud = cloudBase(opts.cloud);
   let file;
@@ -5345,6 +5573,7 @@ async function deploy2(ws, opts) {
   const beforeLaw = await fetch(`${cloud}/v2/workspaces/${ws}/domains`).then((br) => br.json()).then((bd) => bd.ok === true ? bd : {}).catch(() => ({}));
   const before = beforeLaw.domains ?? [];
   const currentLaw2 = beforeLaw.currentLaw ?? {};
+  const beforeDurableHead = await durableMainHead(cloud, ws);
   try {
     const compat = JSON.parse(readFileSync5(file, "utf8")).nomosCompat;
     const requires = compat?.requiresKernel ?? [];
@@ -5469,6 +5698,15 @@ async function deploy2(ws, opts) {
     }
   };
   if (deployedHash !== void 0 && isCurrent) {
+    const wasCurrentBefore = Object.values(currentLaw2).includes(deployedHash);
+    if (!wasCurrentBefore && beforeDurableHead !== void 0) {
+      const durableHead = await waitForDurableMainAdvance(cloud, ws, beforeDurableHead);
+      if (durableHead === void 0) {
+        err4(`deploy '${ws}' was admitted, but canonical Git main did not advance within 30000ms`);
+        err4(`  Nomos will not start application code against a law that fresh peers cannot clone yet; retry the deploy.`);
+        return 2;
+      }
+    }
     out4(`\u2713 deployed ${fileName} \u2192 ${ws}${phaseSuffix}`);
     out4(`  law ${describeLawMove(before, deployedHash)}`);
     emitPlan();
@@ -8840,9 +9078,9 @@ var HELP = {
     examples: ["githolon compile", "githolon compile nomos.package.mjs --layered"]
   },
   proof: {
-    usage: "githolon proof [build/<name>.proof.mts] [--domain <key>] [--live] [--keep]",
+    usage: "githolon proof [build/<name>.proof.mts] [--domain <key>] [--live]",
     what: "Run the proof GENERATED from your business law. By default it drives the real local engine:\nbirth, full-history verification, durable custody, eviction, restore, and read-back. --live runs the\nsame business proof against Nomos Cloud; identity, provisioning, persistence, and cleanup remain\ninside Nomos. --domain selects one domain in a multi-domain package. ALL GREEN or it names the jam.",
-    examples: ["githolon proof", "githolon proof --domain co2_platform", "githolon proof --live", "githolon proof --live --keep"]
+    examples: ["githolon proof", "githolon proof --domain co2_platform", "githolon proof --live"]
   },
   dev: {
     usage: "githolon dev [--port <n>] [--cloud <url>] [--once]",
@@ -9706,8 +9944,7 @@ async function runProof(args) {
     return 1;
   };
   const live = args.includes("--live");
-  const keep = args.includes("--keep");
-  if (keep && !live) return refuse("--keep only applies to --live (the offline proof creates no cloud workspace to keep)");
+  if (args.includes("--keep")) return refuse("--keep no longer applies: proof --live uses your durable signed Nomos home and creates only the requested business aggregate");
   let domain;
   let domainValueIdx = -1;
   const di = args.findIndex((a) => a === "--domain" || a.startsWith("--domain="));
@@ -9774,54 +10011,40 @@ async function runProof(args) {
   const tsxPkg = JSON.parse(readFileSync16(join17(tsxDir, "package.json"), "utf8"));
   const tsxBinRel = typeof tsxPkg.bin === "string" ? tsxPkg.bin : tsxPkg.bin?.["tsx"];
   const tsxCli = join17(tsxDir, tsxBinRel ?? "dist/cli.mjs");
-  console.log("githolon proof --live \u2014 the generated business proof against Nomos Cloud" + (keep ? " (--keep preserves its temporary custody)" : ""));
-  const { wsCreate: wsCreate2, wsRetire: wsRetire2 } = await Promise.resolve().then(() => (init_cloud(), cloud_exports));
-  const { resolveGovernancePrincipal: resolveGovernancePrincipal2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
-  const { login: login2, activePrincipal: activePrincipal2 } = await Promise.resolve().then(() => (init_cloud(), cloud_exports));
-  let principal = process.env.NOMOS_PRINCIPAL;
-  try {
-    principal ??= resolveGovernancePrincipal2({});
-  } catch {
-    const lr = await login2({ agent: true });
-    principal = lr === 0 ? activePrincipal2() : void 0;
+  console.log("githolon proof --live \u2014 one generated app.birth against Nomos Cloud");
+  const { ensureSovereignHome: ensureSovereignHome2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
+  if (currentPrincipal() === void 0) {
+    const lr = await login({ agent: true });
+    if (lr !== 0) {
+      return refuse("proof --live needs a login \u2014 githolon login --agent failed; try it directly");
+    }
   }
-  if (principal === void 0) {
+  if (currentPrincipal() === void 0) {
     return refuse("proof --live needs a principal \u2014 githolon login --agent (self-onboarding) failed; try it directly or pass NOMOS_PRINCIPAL");
   }
-  const proofSlug = proofPath.split("/").pop().replace(/\.proof\.mts$/, "").toLowerCase().replace(/[^a-z0-9-]+/g, "-");
-  const ws = process.env.NOMOS_WS ?? `${proofSlug}-proof-${Math.random().toString(36).slice(2, 8)}`;
-  if (process.env.NOMOS_WS === void 0) {
-    const cr = await wsCreate2(ws, { via: "root", principal });
-    if (cr !== 0) {
-      return refuse(
-        `proof --live: Nomos could not establish safe custody for birth as ${principal}. This is a framework failure: no manual grant, key, parent, or provisioning step is part of the application contract. The local business proof remains available with: githolon proof`
-      );
-    }
+  let home;
+  try {
+    home = await ensureSovereignHome2();
+  } catch (e) {
+    return refuse(
+      `proof --live: Nomos could not establish the signed session home: ${e.message}. No certificate, signer, parent, or provisioning step is part of the application contract.`
+    );
   }
+  const barePrincipal = home.principal.startsWith("user:") ? home.principal.slice("user:".length) : home.principal;
+  const deployed = await deploy2(home.home, { principal: barePrincipal });
+  if (deployed !== 0) return refuse("proof --live: Nomos could not install the compiled business law into the signed session home");
   const r = spawnSync6(process.execPath, [tsxCli, proofPath], {
     stdio: "inherit",
     cwd: process.cwd(),
     env: {
       ...process.env,
-      NOMOS_WS: ws,
-      NOMOS_PRINCIPAL: principal,
-      NOMOS_PROOF_MANAGED: "1",
-      // the proof skips its own (dead) cleanup lane; the CLI retires below
-      ...keep ? { PROOF_KEEP: "1" } : {}
+      NOMOS_WS: home.home,
+      NOMOS_PRINCIPAL: home.principal,
+      NOMOS_AUTHOR_SECRET: home.device.secret,
+      NOMOS_PROOF_MANAGED: "1"
     }
   });
-  const proofStatus = r.status ?? 1;
-  if (keep) {
-    console.log(`workspace ${ws} KEPT (--keep) \u2014 retire it when done: githolon ws retire ${ws}`);
-    return proofStatus;
-  }
-  const rr = await wsRetire2(ws, { principal }).catch(() => 1);
-  if (rr !== 0) {
-    console.error(`\u26A0 THROWAWAY WORKSPACE NOT RETIRED: ${ws}`);
-    console.error(`\u26A0 retire it manually: githolon ws retire ${ws}`);
-    console.error(`\u26A0 (if it has no root registry row it was born unregistered and needs a custodian sweep)`);
-  }
-  return proofStatus;
+  return r.status ?? 1;
 }
 function parseArgs(argv) {
   const [command, ...rest] = argv;

package/dist/dev-server.mjs

@@ -1851,7 +1851,21 @@ function resolveGatewayOperation(spec, opName, method) {
   const exactPath = `/${String(opName).replace(/^\/+/, "")}`;
   const exact = spec.paths[exactPath]?.[normalizedMethod];
   if (exact) return { op: exact, path: exactPath, ambiguous: null };
-  if (String(opName).includes("/")) return { op: null };
+  const slash = String(opName).indexOf("/");
+  if (slash > 0) {
+    const requestedDomain = String(opName).slice(0, slash);
+    const requestedAlias = String(opName).slice(slash + 1);
+    const matches2 = [];
+    for (const [path2, methods] of Object.entries(spec.paths)) {
+      const op = methods?.[normalizedMethod];
+      const x = op?.["x-nomos"];
+      if (!op || !x || x.domain !== requestedDomain) continue;
+      if (aliasIdsFor(x, path2).has(requestedAlias)) matches2.push({ op, path: path2 });
+    }
+    if (matches2.length === 1) return { ...matches2[0], ambiguous: null };
+    if (matches2.length > 1) return { op: null, ambiguous: matches2.map((m) => m.path).sort() };
+    return { op: null, ambiguous: null };
+  }
   const matches = [];
   for (const [path2, methods] of Object.entries(spec.paths)) {
     const op = methods?.[normalizedMethod];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.100.0",
+  "version": "0.100.2",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -29,8 +29,8 @@
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/client": "^0.100.0",
-    "@githolon/dsl": "^0.100.0",
+    "@githolon/client": "^0.100.2",
+    "@githolon/dsl": "^0.100.2",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {