githolon 0.100.6 → 0.101.1

package/dist/dev-server.mjs

@@ -328,6 +328,13 @@ var init_custody_transport = __esm({
   }
 });
 
+// ../adapter/managed-promotion.ts
+var init_managed_promotion = __esm({
+  "../adapter/managed-promotion.ts"() {
+    "use strict";
+  }
+});
+
 // ../adapter/engine.ts
 import { WASI, File, Directory, OpenFile, ConsoleStdout, PreopenDirectory } from "@bjorn3/browser_wasi_shim";
 function b64Bytes(bytes) {
@@ -598,7 +605,7 @@ function summaryOfCapture(ctx, fromOid, toOid) {
     rowsByHome: Object.fromEntries([...ctx.rowsByHome.entries()].sort((a, b) => a[0] < b[0] ? -1 : 1))
   };
 }
-async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null, shardRouting = null, clientBase = null, defer = false } = {}) {
+async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null, shardRouting = null, clientBase = null } = {}) {
   const main = await mainIntentIds(eng, ws);
   const sessions = /* @__PURE__ */ new Map();
   const deadLetters = [];
@@ -665,8 +672,8 @@ async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null,
       }
       const cap = summaryCtx ? beginSummaryCapture(eng, ws, summaryCtx, blob) : null;
       const _tOffer = Date.now();
-      const res = offerAdmit(eng, ws, blob, { defer: !summaryCtx });
-      log("offer-admit-ms", { ws, ms: Date.now() - _tOffer, deferred: !summaryCtx, ok: res.ok });
+      const res = offerAdmit(eng, ws, blob, { defer: false });
+      log("offer-admit-ms", { ws, ms: Date.now() - _tOffer, deferred: false, ok: res.ok });
       if (res.ok) {
         if (intentId) main.ids.add(intentId);
         main.oids.add(res.head);
@@ -689,7 +696,6 @@ async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null,
   }
   timings.sessions = sessions.size;
   timings.intents = admittedTotal;
-  if (admittedTotal && !summaryCtx) (eng.pendingProjection ??= /* @__PURE__ */ new Set()).add(ws);
   if (deadLetters.length) {
     try {
       await materializeRefused(eng, ws, ledger, deadLetters);
@@ -697,8 +703,7 @@ async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null,
       log("refused-materialize-failed", { ws, error: String(e).slice(0, 200) });
     }
   }
-  const deferDurability = defer && !summaryCtx;
-  if (admittedTotal && !deferDurability) {
+  if (admittedTotal) {
     const sealDone = span("seal offered intents", "cseal", 1, { admitted: admittedTotal });
     await commitAndPush(eng, ws, ledger);
     sealDone();
@@ -716,7 +721,7 @@ async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null,
   }
   log("admit-intent-offers", { ws, sessions: sessions.size, admitted: admittedTotal, rejected: [...sessions.values()].reduce((n, s) => n + s.rejected.length, 0), resultPack: resultPackB64 ? "inline" : "none" });
   const bornPacked = born.length ? packBornChildren(eng, born) : born;
-  return { sessions: [...sessions.values()].map((s) => ({ ...s, ...s.skipped.length ? {} : { skipped: void 0 } })), main: head, deadLetters, timings, summary: summary ?? null, born: bornPacked, birthOutcomes, ...resultPackB64 ? { resultPackB64, resultBase: clientBase } : {}, ...deferDurability && admittedTotal && head ? { deferred: true, head } : {} };
+  return { sessions: [...sessions.values()].map((s) => ({ ...s, ...s.skipped.length ? {} : { skipped: void 0 } })), main: head, deadLetters, timings, summary: summary ?? null, born: bornPacked, birthOutcomes, ...resultPackB64 ? { resultPackB64, resultBase: clientBase } : {} };
 }
 async function authorOn(eng, ws, ledger, domain, directiveId, payload, lawHash, opts = {}) {
   await mountWorkspace(eng, ws, ledger);
@@ -780,6 +785,9 @@ function evolveDryRun(eng, ws, usda, domainHash, dispositions = null) {
 function author(eng, ws, domain, directiveId, payload, controllerHash, opts = {}) {
   const seq = eng.seq++;
   const capPorts = { clock: { physical: Date.now(), logical: 0, replica: eng.replica }, rng: osEntropyBuffer(opts.rngDraws ?? 64) };
+  if (opts.__nomosConflictSnapshots !== void 0 && opts.__nomosConflictSnapshots.length > 0) {
+    capPorts.conflict_snapshots = opts.__nomosConflictSnapshots;
+  }
   if (opts.validFromEpoch !== void 0) capPorts.valid_from_epoch = opts.validFromEpoch;
   if (opts.principalVerified !== void 0) {
     capPorts.principal = opts.actor ?? "";
@@ -1376,26 +1384,89 @@ async function boot(eng, ws, ledger) {
   );
 }
 async function deploy(eng, ws, ledger, usda, domainHash, dispositions, opts = {}) {
-  const result = author(eng, ws, "nomos", "installDomain", installPayload(domainHash, usda, eng.installedBy, dispositions), eng.hashes.nomos, { actor: opts.actor ?? "", ...opts.authToken ? { authToken: opts.authToken } : {} });
-  if (result.ok === false) {
+  const existing = qById(eng, ws, `domain-installation:${domainHash}`);
+  if (existing.length > 0) {
+    const phase = String(existing[0]?.data?.["status.phase"] ?? "");
+    return {
+      head: kgit.resolveRef(eng, gitdirOf(ws), BRANCH),
+      installation: existing,
+      staged: phase === "Pending",
+      alreadyInstalled: true
+    };
+  }
+  const before = currentLaw(eng, ws);
+  const tenantHashes = [...new Set(Object.values(before).filter(
+    (hash) => typeof hash === "string" && hash !== eng.hashes.bootstrap && hash !== eng.hashes.nomos
+  ))];
+  const upgrade = tenantHashes.length > 0;
+  let supersedes = opts.supersedes?.trim() || void 0;
+  if (supersedes !== void 0 && !tenantHashes.includes(supersedes)) {
     throw new Error(
-      `deploy-refused: installing ${domainHash.slice(0, 12)}\u2026 was REFUSED by the one gate (custody unchanged): ${result.error ?? "unknown refusal"}`
+      `deploy-predecessor-changed: the client named ${supersedes.slice(0, 12)}\u2026 as the current model, but this workspace no longer serves it. Refresh and deploy again; nothing was committed.`
     );
   }
-  const installation = qById(eng, ws, `domain-installation:${domainHash}`);
-  const keys = installation[0]?.data?.domainKeys ?? installation[0]?.domainKeys ?? [];
-  if (keys.length > 0) {
-    const law = installedLaw(eng, ws);
-    const currentLaw2 = law?.currentLaw ?? {};
-    const stale = keys.filter((k) => currentLaw2[k] !== void 0 && currentLaw2[k] !== domainHash);
-    if (stale.length > 0) {
+  if (upgrade && supersedes === void 0) {
+    if (tenantHashes.length === 1) supersedes = tenantHashes[0];
+    else {
       throw new Error(
-        `deploy-did-not-advance: the install of ${domainHash.slice(0, 12)}\u2026 ADMITTED but the workspace's current law still serves ${stale.map((k) => `'${k}' from ${String(currentLaw2[k]).slice(0, 12)}\u2026`).join(", ")} \u2014 refusing (custody unchanged) instead of a silent no-op. This usually means the existing installation's era/lineage prevents supersession: run \`githolon deploy --dry-run=evolve\` for the gate's verdict, supply #58 dispositions for a true removal/retype, or re-forge the workspace onto the current lineage.`
+        `deploy-predecessor-ambiguous: this workspace currently serves ${tenantHashes.length} business-model packages. Nomos will not guess which one this candidate follows; use the generated deploy client, which binds the candidate to the current model before staging. Nothing was committed.`
       );
     }
   }
-  await commitAndPush(eng, ws, ledger);
-  return { head: result.head, installation };
+  if (upgrade && dispositions && Object.keys(dispositions).length > 0) {
+    throw new Error(
+      "deploy-manual-evolution-refused: successor deployment no longer accepts caller-chosen schema dispositions. Schema evolution belongs to the candidate model's adoption proof; nothing was committed."
+    );
+  }
+  const directiveId = upgrade ? "stageDomain" : "installDomain";
+  const payload = upgrade ? stagePayload(domainHash, usda, eng.installedBy, supersedes) : installPayload(domainHash, usda, eng.installedBy, dispositions);
+  const result = author(eng, ws, "nomos", directiveId, payload, eng.hashes.nomos, {
+    actor: opts.actor ?? "",
+    ...opts.authToken ? { authToken: opts.authToken } : {}
+  });
+  if (result.ok === false) {
+    unmount(eng, ws);
+    throw new Error(
+      `deploy-refused: ${upgrade ? "staging" : "installing"} ${domainHash.slice(0, 12)}\u2026 was REFUSED by the one gate (custody unchanged): ${result.error ?? "unknown refusal"}`
+    );
+  }
+  try {
+    const installation = qById(eng, ws, `domain-installation:${domainHash}`);
+    if (upgrade) {
+      const phase = String(installation[0]?.data?.["status.phase"] ?? "");
+      if (phase !== "Pending") {
+        throw new Error(
+          `deploy-did-not-stage: candidate ${domainHash.slice(0, 12)}\u2026 admitted but its lifecycle phase is '${phase || "missing"}', not Pending. Custody was not pushed.`
+        );
+      }
+      const after = currentLaw(eng, ws);
+      const moved = Object.entries(before).filter(([key, hash]) => after[key] !== hash);
+      if (moved.length > 0 || Object.values(after).includes(domainHash)) {
+        throw new Error(
+          `deploy-activated-candidate: staging ${domainHash.slice(0, 12)}\u2026 changed served law (${moved.map(([key]) => key).join(", ") || "candidate became current"}). Nomos refuses to persist an upgrade that bypassed model.adopt().`
+        );
+      }
+      await commitAndPush(eng, ws, ledger);
+      return { head: result.head, installation, staged: true, supersedes };
+    }
+    const law = installedLaw(eng, ws);
+    const installed = (law?.domains ?? []).find((row) => row?.domainHash === domainHash);
+    const keys = installed?.domainKeys ?? installation[0]?.data?.domainKeys ?? installation[0]?.domainKeys ?? [];
+    if (keys.length > 0) {
+      const currentLaw2 = law?.currentLaw ?? {};
+      const stale = keys.filter((k) => currentLaw2[k] !== domainHash);
+      if (stale.length > 0) {
+        throw new Error(
+          `deploy-did-not-advance: the install of ${domainHash.slice(0, 12)}\u2026 ADMITTED but the workspace's current law still serves ${stale.map((k) => `'${k}' from ${String(currentLaw2[k]).slice(0, 12)}\u2026`).join(", ")} \u2014 refusing (custody unchanged) instead of a silent no-op. This usually means the existing installation's era/lineage prevents supersession: run \`githolon deploy --dry-run=evolve\` for the gate's verdict, supply #58 dispositions for a true removal/retype, or re-forge the workspace onto the current lineage.`
+        );
+      }
+    }
+    await commitAndPush(eng, ws, ledger);
+    return { head: result.head, installation, staged: false };
+  } catch (error) {
+    unmount(eng, ws);
+    throw error;
+  }
 }
 function snapshot(eng, ws) {
   const wsDir = dirOf(eng.preopen.dir.contents.get("ws")).contents.get(ws);
@@ -1428,13 +1499,14 @@ async function ledgerStats(eng, ws, ledger = null) {
   if (mounted) mounted.ledgerStats = out;
   return out;
 }
-var enc3, dec3, BRANCH, RESULT_PACK_INLINE_MAX, dirOf, repoArgOf, gitdirOf, unpack, log, repoArgOfGitdir, bytesFromB64, kgit, installPayload, routeTagHexOfHomeKey, SUMMARY_SEP, summaryKey, splitSummaryKey, NOMOS_SHARD_ROWS_READ, groupOf, tallyOf, isExtremumRead, extremumMonotone, pushVia, fullRef, applyPackInto, custodyLsRefs, qById, query, authorKeygen, attestedRead, certSign, readPosture, count, sum, pendingConflicts, spatialBboxParams, spatialWithin, extremum, nomosActive, refusedRefName, GENESIS_WARRANT_ID, isWarranted;
+var enc3, dec3, BRANCH, RESULT_PACK_INLINE_MAX, dirOf, repoArgOf, gitdirOf, unpack, log, repoArgOfGitdir, bytesFromB64, kgit, installPayload, stagePayload, routeTagHexOfHomeKey, SUMMARY_SEP, summaryKey, splitSummaryKey, NOMOS_SHARD_ROWS_READ, groupOf, tallyOf, isExtremumRead, extremumMonotone, pushVia, fullRef, applyPackInto, custodyLsRefs, qById, query, authorKeygen, attestedRead, certSign, readPosture, count, sum, pendingConflicts, pendingConflictSummary, spatialBboxParams, spatialWithin, extremum, nomosActive, refusedRefName, GENESIS_WARRANT_ID, isWarranted;
 var init_engine = __esm({
   "../adapter/engine.ts"() {
     "use strict";
     init_git_fs();
     init_tree();
     init_custody_transport();
+    init_managed_promotion();
     enc3 = new TextEncoder();
     dec3 = new TextDecoder();
     BRANCH = "main";
@@ -1480,6 +1552,14 @@ var init_engine = __esm({
       }, eng.STDERR)).oid
     };
     installPayload = (hash, usda, installedBy, dispositions) => ({ domainHash: hash, packageUsda: usda, installedBy, dependencies: [], finalizers: [], ...dispositions ? { dispositions } : {} });
+    stagePayload = (hash, usda, installedBy, supersedes) => ({
+      domainHash: hash,
+      packageUsda: usda,
+      installedBy,
+      dependencies: [],
+      ...supersedes ? { supersedes } : {},
+      finalizers: []
+    });
     routeTagHexOfHomeKey = async (homeKey) => (await sha256hex(`nomos-route:${homeKey}`)).slice(0, 12);
     SUMMARY_SEP = "";
     summaryKey = (readId, group) => `${readId}${SUMMARY_SEP}${group}`;
@@ -1547,7 +1627,8 @@ var init_engine = __esm({
     readPosture = (eng, ws, principal = "", authToken = "", nowUnix = 0) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "readPosture", authToken, nowUnix }), principal, branch: BRANCH }, eng.STDERR));
     count = (eng, ws, countId, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "count", countId, groupKey }), principal, branch: BRANCH }, eng.STDERR));
     sum = (eng, ws, sumId, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "sum", sumId, groupKey }), principal, branch: BRANCH }, eng.STDERR));
-    pendingConflicts = (eng, ws, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "pendingConflicts" }), principal, branch: BRANCH }, eng.STDERR));
+    pendingConflicts = (eng, ws, principal = "", aggregateType = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "pendingConflicts", aggregateType }), principal, branch: BRANCH }, eng.STDERR));
+    pendingConflictSummary = (eng, ws, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "pendingConflictSummary" }), principal, branch: BRANCH }, eng.STDERR));
     spatialBboxParams = (bbox) => {
       const minX = bbox.minX ?? bbox.minLng, minY = bbox.minY ?? bbox.minLat, maxX = bbox.maxX ?? bbox.maxLng, maxY = bbox.maxY ?? bbox.maxLat;
       return { minX, minY, maxX, maxY, minLng: minX, minLat: minY, maxLng: maxX, maxLat: maxY };
@@ -1579,6 +1660,7 @@ var init_types = __esm({
 var bootstrap_exports = {};
 __export(bootstrap_exports, {
   bootstrapPlatform: () => bootstrapPlatform,
+  completeDevAuthProviderPayload: () => completeDevAuthProviderPayload,
   homeDomainOf: () => homeDomainOf,
   isTestMint: () => isTestMint
 });
@@ -1592,10 +1674,42 @@ function isTestMint(eng) {
     return !/poisoned|unknown|adapter-visible API/.test(errMsg(e));
   }
 }
+function completeDevAuthProviderPayload(deployBody, homeDomain, initial, nowMillis = Date.now(), operator = "user:dev-operator") {
+  const payload = { ...initial };
+  const iface = deployBody?.interface ?? {};
+  const legacy = iface.domains?.[homeDomain]?.directives?.setAuthProvider?.fields ?? iface[homeDomain]?.directives?.setAuthProvider?.fields ?? {};
+  const openapi = deployBody?.openapi;
+  const frameworkPaths = openapi?.["x-nomos-framework-routes"]?.paths ?? {};
+  const setAuthOperation = Object.values(frameworkPaths).map((pathItem) => pathItem.post).filter((operation) => operation?.["x-nomos"]?.directiveId === "setAuthProvider").sort((a, b) => Number(b?.["x-nomos"]?.domain === homeDomain) - Number(a?.["x-nomos"]?.domain === homeDomain))[0] ?? frameworkPaths["/setAuthProvider"]?.post;
+  const schema = setAuthOperation?.requestBody?.content?.["application/json"]?.schema;
+  const required = new Set(schema?.required ?? []);
+  const fields = { ...legacy };
+  for (const [name, spec] of Object.entries(schema?.properties ?? {})) {
+    fields[name] = {
+      kind: spec.type === "integer" ? "int" : spec.type,
+      optional: !required.has(name)
+    };
+  }
+  for (const [name, spec] of Object.entries(fields)) {
+    if (spec.optional === true || payload[name] !== void 0) continue;
+    if (spec.kind === "int" && /At$/.test(name)) payload[name] = nowMillis;
+    else if (spec.kind === "string" && /At$/.test(name)) payload[name] = new Date(nowMillis).toISOString();
+    else if (spec.kind === "string" && /By$/.test(name)) payload[name] = operator;
+    else if (spec.kind === "string" && /url$/i.test(name)) payload[name] = `${payload.issuer}/jwks.json`;
+    else if (spec.kind === "string") payload[name] = "dev";
+    else log2(`dev test IdP: required setAuthProvider field '${name}' (kind ${spec.kind}) is not synthesizable \u2014 the author below may refuse typed`);
+  }
+  return payload;
+}
 function homeDomainOf(opts) {
   if (!opts || !opts.deploy) return null;
   try {
     const body = JSON.parse(readFileSync(opts.deploy, "utf8"));
+    const frameworkPaths = body.openapi?.["x-nomos-framework-routes"]?.paths ?? {};
+    for (const pathItem of Object.values(frameworkPaths)) {
+      const route = pathItem.post?.["x-nomos"];
+      if (route?.directiveId === "birthHome" && typeof route.domain === "string") return route.domain;
+    }
     const domains = body.summary && body.summary.domains || [];
     const hit = domains.find((d) => Array.isArray(d.directives) && d.directives.includes("seedBirthAttestation"));
     return hit ? hit.domain : null;
@@ -1655,6 +1769,19 @@ async function bootstrapPlatform(dev, opts) {
     setTestKRoot(eng, kRoot.public);
     log2(`K_root ceremony: pinned LOCAL test K_root ${kRoot.public.slice(0, 16)}\u2026`);
     const sP = authorKeygen(eng);
+    const { generateKeyPairSync, sign: nodeSign } = await import("node:crypto");
+    const { privateKey: idpPrivateKey, publicKey: idpPublicKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
+    const idpJwk = idpPublicKey.export({ format: "jwk" });
+    const idpIssuer = `https://dev-idp.local/${platform}`;
+    const idpAudience = `${platform}-app`;
+    const idpJwks = JSON.stringify({ keys: [{ kty: "EC", crv: "P-256", kid: "dev-idp", alg: "ES256", use: "sig", x: idpJwk.x, y: idpJwk.y }] });
+    const b64url = (b) => Buffer.from(b).toString("base64url");
+    const mintDevToken = (claims) => {
+      const header = b64url(JSON.stringify({ alg: "ES256", typ: "JWT", kid: "dev-idp" }));
+      const payload = b64url(JSON.stringify({ iss: idpIssuer, aud: idpAudience, nbf: 0, exp: 4102444800, ...claims }));
+      const si = `${header}.${payload}`;
+      return `${si}.${b64url(nodeSign("sha256", Buffer.from(si), { key: idpPrivateKey, dsaEncoding: "ieee-p1363" }))}`;
+    };
     const platformCert = certSign(eng, {
       child: platform,
       founder: OPERATOR,
@@ -1663,6 +1790,9 @@ async function bootstrapPlatform(dev, opts) {
       // P_P — the onboarding signer the platform vouches for
       parentId: "root",
       epoch: 0,
+      authProviderIssuer: idpIssuer,
+      authProviderJwks: idpJwks,
+      authProviderAudience: idpAudience,
       secret: kRoot.secret
       // signed by S_root
     });
@@ -1681,38 +1811,14 @@ async function bootstrapPlatform(dev, opts) {
       let devIdP;
       let pendingIdP;
       {
-        const { generateKeyPairSync, sign: nodeSign } = await import("node:crypto");
-        const { privateKey, publicKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
-        const jwk = publicKey.export({ format: "jwk" });
-        const ISS = `https://dev-idp.local/${platform}`;
-        const AUD = `${platform}-app`;
-        const JWKS = JSON.stringify({ keys: [{ kty: "EC", crv: "P-256", kid: "dev-idp", alg: "ES256", use: "sig", x: jwk.x, y: jwk.y }] });
-        const b64url = (b) => Buffer.from(b).toString("base64url");
-        const mint = (claims) => {
-          const header = b64url(JSON.stringify({ alg: "ES256", typ: "JWT", kid: "dev-idp" }));
-          const payload = b64url(JSON.stringify({ iss: ISS, aud: AUD, nbf: 0, exp: 4102444800, ...claims }));
-          const si = `${header}.${payload}`;
-          return `${si}.${b64url(nodeSign("sha256", Buffer.from(si), { key: privateKey, dsaEncoding: "ieee-p1363" }))}`;
-        };
-        const apPayload = { issuer: ISS, keys: JWKS, audience: AUD, principalClaim: "sub", deviceBindingClaim: "nonce" };
+        let apPayload = { issuer: idpIssuer, keys: idpJwks, audience: idpAudience, principalClaim: "sub", deviceBindingClaim: "nonce" };
         try {
           const deployBody = opts.deploy ? JSON.parse(readFileSync(opts.deploy, "utf8")) : null;
-          const iface = deployBody?.interface ?? {};
-          const domIface = iface.domains?.[homeDomain] ?? iface[homeDomain];
-          const fields = domIface?.directives?.["setAuthProvider"]?.fields ?? {};
-          for (const [name, spec] of Object.entries(fields)) {
-            if (spec?.optional === true || apPayload[name] !== void 0) continue;
-            if (spec?.kind === "int" && /At$/.test(name)) apPayload[name] = Date.now();
-            else if (spec?.kind === "string" && /At$/.test(name)) apPayload[name] = (/* @__PURE__ */ new Date()).toISOString();
-            else if (spec?.kind === "string" && /By$/.test(name)) apPayload[name] = OPERATOR;
-            else if (spec?.kind === "string" && /url$/i.test(name)) apPayload[name] = `${ISS}/jwks.json`;
-            else if (spec?.kind === "string") apPayload[name] = "dev";
-            else log2(`dev test IdP: required setAuthProvider field '${name}' (kind ${spec?.kind}) is not synthesizable \u2014 the author below may refuse typed`);
-          }
+          apPayload = completeDevAuthProviderPayload(deployBody, homeDomain, apPayload, Date.now(), OPERATOR);
         } catch (e) {
           log2(`dev test IdP: BYO-shape fill failed (${errMsg(e).slice(0, 200)}) \u2014 the canonical payload stands`);
         }
-        pendingIdP = { ISS, AUD, JWKS, mint, apPayload };
+        pendingIdP = { ISS: idpIssuer, AUD: idpAudience, JWKS: idpJwks, mint: mintDevToken, apPayload };
       }
       const sOp = authorKeygen(eng);
       const opKeyHash = createHash("sha256").update(Buffer.from(sOp.public, "base64")).digest("hex");
@@ -1890,6 +1996,12 @@ function resolveGatewayOperation(spec, opName, method) {
   return { op: null, ambiguous: null };
 }
 
+// ../cloud/cloudflare-shell/src/kernel-registry.generated.ts
+var DEPLOYED_KERNELS = [
+  { prefix: "cf01b3ae", hash: "cf01b3ae327618b26da3af8eb6abe5e16a7f050e8a9d9b6ca92e2a1d78dd280b", version: "kernel-cf01b3ae", note: "production (this candidate)", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"] },
+  { prefix: "4f8ffb62", hash: "4f8ffb623c3717d973b1ced653e23f7a8f63fe73b83aa5a0f83f4dd8c46bd81f", version: "kernel-4f8ffb62", note: "test-mint (this candidate) \u2014 feature-equivalent to production", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"] }
+];
+
 // ../cloud/cloudflare-shell/src/staged-intents.ts
 var STAGE_THRESHOLD_CHARS = 4 * 1024 * 1024;
 var MAX_INLINE_INTENT_CHARS = 8 * 1024 * 1024;
@@ -2108,7 +2220,13 @@ function firstExisting(...paths) {
 }
 var TEST_MINT_MARKER = Buffer.from("set_test_k_root");
 var isTestMintBytes = (bytes) => bytes.includes(TEST_MINT_MARKER);
-var KERNEL_CAPABILITY_REGISTRY = [
+var HISTORICAL_KERNEL_CAPABILITY_REGISTRY = [
+  {
+    prefix: "f50d0cc5",
+    version: "kernel-f50d0cc5",
+    note: "current local production build",
+    features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads"]
+  },
   {
     prefix: "846c6bf8",
     version: "kernel-846c6bf8",
@@ -2128,6 +2246,10 @@ var KERNEL_CAPABILITY_REGISTRY = [
     features: ["capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads"]
   }
 ];
+var KERNEL_CAPABILITY_REGISTRY = [
+  ...DEPLOYED_KERNELS,
+  ...HISTORICAL_KERNEL_CAPABILITY_REGISTRY
+];
 function capabilitiesForKernelHash(hash) {
   const h = String(hash || "").toLowerCase();
   const hit = KERNEL_CAPABILITY_REGISTRY.find((e) => h.startsWith(e.prefix) || e.prefix.startsWith(h.slice(0, 8)));
@@ -2367,7 +2489,10 @@ async function startDevCloud(opts = {}) {
           dataDir,
           wasmPath,
           workspaces: custody.list(),
-          ...devSelf?.platformReady !== void 0 ? { platformReady: devSelf.platformReady } : {}
+          ...devSelf?.platformReady !== void 0 ? { platformReady: devSelf.platformReady } : {},
+          // DEV/HARNESS ONLY: every peer in this ephemeral trust universe must pin the same K_root before
+          // replaying or birthing descendants. Production bakes the one real anchor into the kernel.
+          ...devSelf?.testKRoot?.public ? { testKRootPublic: devSelf.testKRoot.public } : {}
         });
       }
       if (url.pathname === "/dev/mint-token" && req.method === "POST") {
@@ -2500,10 +2625,19 @@ async function startDevCloud(opts = {}) {
               const authToken = authTokenOf(req);
               try {
                 const out = await deploy(eng, ws, ledger, usda, domainHash, dispositions, { actor, ...authToken ? { authToken } : {} });
-                sendJson(res, { ok: true, ws, domainHash, head: out.head, installation: out.installation }, 201);
+                sendJson(res, {
+                  ok: true,
+                  ws,
+                  domainHash,
+                  head: out.head,
+                  installation: out.installation,
+                  staged: out.staged === true,
+                  ...out.supersedes ? { supersedes: out.supersedes } : {},
+                  ...out.alreadyInstalled ? { alreadyInstalled: true } : {}
+                }, 201);
               } catch (e) {
                 const msg = errMsg(e);
-                const status = /deploy-did-not-advance/.test(msg) ? 409 : 422;
+                const status = /deploy-did-not-advance|deploy-did-not-stage|deploy-predecessor|deploy-activated-candidate/.test(msg) ? 409 : 422;
                 sendJson(res, { ok: false, refused: true, error: msg.slice(0, 600) }, status);
               }
             });
@@ -2535,6 +2669,15 @@ async function startDevCloud(opts = {}) {
         }
         if (sub[0] === "intent-offers" && req.method === "POST") {
           return await serialize(async () => {
+            if (!custody.get(`holon-${ws}`)) {
+              sendJson(res, {
+                ok: false,
+                retryable: true,
+                ws,
+                error: `custody-provisioning: workspace '${ws}' is awaiting its parent birth; Nomos will retry automatically`
+              }, 409);
+              return;
+            }
             const ledger = ledgerFor(ws);
             await mountWorkspace(eng, ws, ledger);
             const body = JSON.parse((await readBody(req)).toString("utf8") || "{}");
@@ -2721,7 +2864,8 @@ async function startDevCloud(opts = {}) {
                 if (x.kind === "sum") return sendJson(res, { ok: true, ws, ...sum(eng, ws, x.sumId, group, principal) });
                 if (x.kind === "extremum") return sendJson(res, { ok: true, ws, ...extremum(eng, ws, x.extremumId, x.extremumKind || url.searchParams.get("kind") || "", group, principal) });
                 if (x.kind === "spatial") return sendJson(res, { ok: true, ws, ...spatialWithin(eng, ws, x.spatialId, url.searchParams.get("bbox") || {}, principal) });
-                if (x.kind === "pendingConflicts") return sendJson(res, { ok: true, ws, rows: pendingConflicts(eng, ws, principal) });
+                if (x.kind === "pendingConflicts") return sendJson(res, { ok: true, ws, rows: pendingConflicts(eng, ws, principal, url.searchParams.get("aggregateType") || "") });
+                if (x.kind === "pendingConflictSummary") return sendJson(res, { ok: true, ws, ...pendingConflictSummary(eng, ws, principal) });
               } catch (e) {
                 return sendJson(res, { ok: false, error: errMsg(e).slice(0, 600) }, 403);
               }