githolon 0.107.2 → 0.107.4

package/dist/full-cli.mjs

@@ -1046,6 +1046,58 @@ var init_value_object = __esm({
   }
 });
 
+// ../dsl/src/evolution.ts
+function formerAggregate(id, fieldNames = []) {
+  if (!id.trim()) throw new Error("formerAggregate(id) needs the prior aggregate's non-empty name");
+  const fields = {};
+  for (const name of fieldNames) {
+    if (!name.trim()) throw new Error(`formerAggregate(${id}) has an empty prior field name`);
+    if (fields[name] !== void 0) throw new Error(`formerAggregate(${id}) repeats prior field '${name}'`);
+    fields[name] = Object.freeze({
+      [FORMER_FIELD_BRAND]: true,
+      aggregate: id,
+      name
+    });
+  }
+  return Object.freeze({
+    [FORMER_AGGREGATE_BRAND]: true,
+    id,
+    fields: Object.freeze(fields)
+  });
+}
+function retirement(entity) {
+  if (entity === null || typeof entity !== "object") {
+    throw new Error("retirement(entity) needs a handle from formerAggregate(...)");
+  }
+  if (entity[FORMER_AGGREGATE_BRAND] === true) {
+    const aggregate2 = entity;
+    return Object.freeze({
+      [RETIREMENT_BRAND]: true,
+      kind: "aggregate",
+      aggregate: aggregate2.id
+    });
+  }
+  if (entity[FORMER_FIELD_BRAND] === true) {
+    const field = entity;
+    return Object.freeze({
+      [RETIREMENT_BRAND]: true,
+      kind: "field",
+      aggregate: field.aggregate,
+      field: field.name
+    });
+  }
+  throw new Error("retirement(entity) needs a handle from formerAggregate(...)");
+}
+var FORMER_AGGREGATE_BRAND, FORMER_FIELD_BRAND, RETIREMENT_BRAND;
+var init_evolution = __esm({
+  "../dsl/src/evolution.ts"() {
+    "use strict";
+    FORMER_AGGREGATE_BRAND = "__nomos_former_aggregate_v1";
+    FORMER_FIELD_BRAND = "__nomos_former_field_v1";
+    RETIREMENT_BRAND = "__nomos_retirement_v1";
+  }
+});
+
 // ../dsl/src/principal_evidence.ts
 function endorsementOf(value) {
   return typeof value === "object" && value !== null && REGISTRY.has(value) ? REGISTRY.get(value) ?? null : null;
@@ -1063,9 +1115,9 @@ function activityKey(kind, slot) {
   return `activity.${kind}.${slot}`;
 }
 function templateVars(template) {
-  const out14 = [];
-  for (const m of template.matchAll(/\{([a-zA-Z0-9_]+)\}/g)) out14.push(m[1]);
-  return out14;
+  const out15 = [];
+  for (const m of template.matchAll(/\{([a-zA-Z0-9_]+)\}/g)) out15.push(m[1]);
+  return out15;
 }
 function payloadFieldNames(schema) {
   const def = schema?._def ?? schema?.def;
@@ -2253,7 +2305,7 @@ function releaseReceiptAggregateId(candidateHash, atStateRoot) {
 function releaseReceiptInstance(candidateHash, atStateRoot) {
   return instance(ReleaseReceipt, releaseReceiptAggregateId(candidateHash, atStateRoot));
 }
-var MODEL_LIFECYCLE_AUTHORITY, DOMAIN_LIFECYCLE_DIRECTIVES, INSTALL_DOMAIN_DIRECTIVE, modelLifecycleRelations, DOMAIN_INSTALLATION_PHASES, DomainInstallation, RELEASE_RECEIPT_AGGREGATE, RELEASE_RECEIPT_PREFIX, ReleaseReceipt, dispositions, lowerHex64, gitOid, preflightReceipt, installPackagePayload, stagedPackagePayload, installDomain, stageDomain, promoteDomain, rollbackDomain;
+var MODEL_LIFECYCLE_AUTHORITY, DOMAIN_LIFECYCLE_DIRECTIVES, INSTALL_DOMAIN_DIRECTIVE, modelLifecycleRelations, DOMAIN_INSTALLATION_PHASES, DomainInstallation, RELEASE_RECEIPT_AGGREGATE, RELEASE_RECEIPT_PREFIX, ReleaseReceipt, counterfactualReleaseReceipt, baselineRootRetired, candidateIntentsRetired, candidateRootRetired, completeRetired, divergenceCountRetired, historyHashRetired, projectionEqualRetired, rawPromotableRetired, replayedIntentsRetired, reportHashRetired, reportJsonRetired, dispositions, lowerHex64, gitOid, preflightReceipt, installPackagePayload, stagedPackagePayload, installDomain, stageDomain, promoteDomain, rollbackDomain;
 var init_domain_lifecycle = __esm({
   "../dsl/src/framework/domain_lifecycle.ts"() {
     "use strict";
@@ -2261,6 +2313,7 @@ var init_domain_lifecycle = __esm({
     init_drivers();
     init_fields();
     init_directive();
+    init_evolution();
     init_ops();
     init_relation_schema();
     MODEL_LIFECYCLE_AUTHORITY = relationRef("installDomain");
@@ -2309,6 +2362,30 @@ var init_domain_lifecycle = __esm({
       acceptedBy: attributionField(t.string().merge(Lww)),
       acceptedAt: t.int().merge(Lww)
     }).public();
+    counterfactualReleaseReceipt = formerAggregate(RELEASE_RECEIPT_AGGREGATE, [
+      "baselineRoot",
+      "candidateIntents",
+      "candidateRoot",
+      "complete",
+      "divergenceCount",
+      "historyHash",
+      "projectionEqual",
+      "rawPromotable",
+      "replayedIntents",
+      "reportHash",
+      "reportJson"
+    ]);
+    baselineRootRetired = retirement(counterfactualReleaseReceipt.fields.baselineRoot);
+    candidateIntentsRetired = retirement(counterfactualReleaseReceipt.fields.candidateIntents);
+    candidateRootRetired = retirement(counterfactualReleaseReceipt.fields.candidateRoot);
+    completeRetired = retirement(counterfactualReleaseReceipt.fields.complete);
+    divergenceCountRetired = retirement(counterfactualReleaseReceipt.fields.divergenceCount);
+    historyHashRetired = retirement(counterfactualReleaseReceipt.fields.historyHash);
+    projectionEqualRetired = retirement(counterfactualReleaseReceipt.fields.projectionEqual);
+    rawPromotableRetired = retirement(counterfactualReleaseReceipt.fields.rawPromotable);
+    replayedIntentsRetired = retirement(counterfactualReleaseReceipt.fields.replayedIntents);
+    reportHashRetired = retirement(counterfactualReleaseReceipt.fields.reportHash);
+    reportJsonRetired = retirement(counterfactualReleaseReceipt.fields.reportJson);
     dispositions = z4.object({
       retired: z4.array(z4.string()).optional(),
       retyped: z4.record(z4.string(), z4.string()).optional(),
@@ -2943,15 +3020,15 @@ var init_git_fs = __esm({
 });
 
 // ../cloud/web-client/src/_adapter/tree.ts
-function flatten(dir, prefix, out14) {
+function flatten(dir, prefix, out15) {
   const children2 = [...(dir.contents ?? /* @__PURE__ */ new Map()).entries()].sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0);
   for (const [name, inode] of children2) {
     const path2 = prefix ? prefix + "/" + name : name;
     if (inode.contents instanceof Map) {
-      out14.push({ path: path2, dir: true });
-      flatten(inode, path2, out14);
+      out15.push({ path: path2, dir: true });
+      flatten(inode, path2, out15);
     } else {
-      out14.push({ path: path2, dir: false, bytes: inode.data ?? new Uint8Array(0) });
+      out15.push({ path: path2, dir: false, bytes: inode.data ?? new Uint8Array(0) });
     }
   }
 }
@@ -2974,13 +3051,13 @@ function serializeTree(workTree) {
   }
   let total = 0;
   for (const c of chunks) total += c.length;
-  const out14 = new Uint8Array(total);
+  const out15 = new Uint8Array(total);
   let off = 0;
   for (const c of chunks) {
-    out14.set(c, off);
+    out15.set(c, off);
     off += c.length;
   }
-  return out14;
+  return out15;
 }
 function deserializeTree(bytes, { File: File4, Directory: Directory4 }) {
   const u8 = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
@@ -3965,13 +4042,13 @@ var init_offer_args = __esm({
 function concatBytes(chunks) {
   let n = 0;
   for (const c of chunks) n += c.length;
-  const out14 = new Uint8Array(n);
+  const out15 = new Uint8Array(n);
   let o = 0;
   for (const c of chunks) {
-    out14.set(c, o);
+    out15.set(c, o);
     o += c.length;
   }
-  return out14;
+  return out15;
 }
 function pkt(payload) {
   const body = typeof payload === "string" ? enc3.encode(payload) : payload;
@@ -4300,7 +4377,7 @@ function compatible(client, workspace) {
   return { ok: missing.length === 0 && incompatible.length === 0, missing, incompatible };
 }
 function memberVerdicts(client, workspace) {
-  const out14 = {};
+  const out15 = {};
   const cDirs = client && client.directives || {};
   const wDirs = workspace && workspace.directives || {};
   const cAggs = client && client.aggregates || {};
@@ -4308,7 +4385,7 @@ function memberVerdicts(client, workspace) {
   for (const [did, cShape] of Object.entries(cDirs)) {
     const wShape = wDirs[did];
     if (!wShape) {
-      out14[did] = { ok: false, reason: `directive '${did}' is not installed on the workspace` };
+      out15[did] = { ok: false, reason: `directive '${did}' is not installed on the workspace` };
       continue;
     }
     const cf = cShape.fields || {};
@@ -4323,13 +4400,13 @@ function memberVerdicts(client, workspace) {
       const w = wf[f];
       if (w && w.kind !== c.kind) reasons.push(`field '${f}' kind ${c.kind} \u2260 workspace ${w.kind}`);
     }
-    out14[did] = reasons.length ? { ok: false, reason: reasons.join("; ") } : { ok: true };
+    out15[did] = reasons.length ? { ok: false, reason: reasons.join("; ") } : { ok: true };
   }
   for (const [sid, cAgg] of Object.entries(cAggs)) {
     const label = cAgg.label || sid;
     const wAgg = wAggs[sid];
     if (!wAgg) {
-      out14[label] = { ok: false, reason: `aggregate '${label}' is not served by the workspace` };
+      out15[label] = { ok: false, reason: `aggregate '${label}' is not served by the workspace` };
       continue;
     }
     const cFields = cAgg.fields || {};
@@ -4340,9 +4417,9 @@ function memberVerdicts(client, workspace) {
       if (!w) reasons.push(`field '${label}.${c.label || fsid}' is not served`);
       else if (w.kind !== c.kind) reasons.push(`field '${label}.${c.label || fsid}' read kind ${c.kind} \u2260 workspace ${w.kind}`);
     }
-    out14[label] = reasons.length ? { ok: false, reason: reasons.join("; ") } : { ok: true };
+    out15[label] = reasons.length ? { ok: false, reason: reasons.join("; ") } : { ok: true };
   }
-  return out14;
+  return out15;
 }
 function interfaceDomains(byDomain) {
   const map = byDomain && typeof byDomain === "object" ? byDomain : {};
@@ -4352,17 +4429,17 @@ function interfaceDomains(byDomain) {
   );
 }
 function mergeDomainInterfaces(byDomain, onlyDomains) {
-  const out14 = { directives: {}, aggregates: {} };
+  const out15 = { directives: {}, aggregates: {} };
   const map = byDomain && typeof byDomain === "object" ? byDomain : {};
   const entries = map.directives ? [[String(map.domain ?? "?"), map]] : Object.entries(map);
   for (const [domain, value] of entries) {
     if (onlyDomains !== void 0 && !onlyDomains.has(domain)) continue;
     if (!value || typeof value !== "object") continue;
     const di = value;
-    Object.assign(out14.directives, di.directives || {});
-    Object.assign(out14.aggregates, di.aggregates || {});
+    Object.assign(out15.directives, di.directives || {});
+    Object.assign(out15.aggregates, di.aggregates || {});
   }
-  return out14;
+  return out15;
 }
 var init_shape_compat = __esm({
   "../cloud/web-client/src/shape_compat.ts"() {
@@ -5780,13 +5857,13 @@ async function actorForShareQuote(quote) {
 function osEntropyBuffer(n) {
   const bytes = new Uint8Array(n * 8);
   crypto.getRandomValues(bytes);
-  const out14 = new Array(n), T = 2 ** 53;
+  const out15 = new Array(n), T = 2 ** 53;
   for (let i = 0; i < n; i++) {
     let z6 = 0n;
     for (let b = 7; b >= 0; b--) z6 = z6 << 8n | BigInt(bytes[i * 8 + b]);
-    out14[i] = Number(z6 >> 11n) / T;
+    out15[i] = Number(z6 >> 11n) / T;
   }
-  return out14;
+  return out15;
 }
 async function replicaIdFromValue(str) {
   const b = new Uint8Array(await crypto.subtle.digest("SHA-256", enc4.encode(str)));
@@ -5798,14 +5875,14 @@ async function routeTagHexOfHomeKey(homeKey) {
   return (await sha256hex(`nomos-route:${homeKey}`)).slice(0, 12);
 }
 function installedLawOfRows(rows) {
-  const out14 = [];
+  const out15 = [];
   for (const r of rows || []) {
     const d = r && r.data;
     if (!d || d["status.phase"] !== "Active") continue;
     const h = d["spec.domainHash"];
-    if (typeof h === "string" && h && !out14.includes(h)) out14.push(h);
+    if (typeof h === "string" && h && !out15.includes(h)) out15.push(h);
   }
-  return out14;
+  return out15;
 }
 function lawStatusOf(installed, clientHash) {
   const known = Array.isArray(installed);
@@ -5830,14 +5907,14 @@ function birthOutcomeFailure(birthOutcomes) {
   const first = bad[0];
   const list = bad.map((o) => `${o.workspace || "?"} [${o.status}${o.code ? `: ${o.code}` : ""}]${o.reason ? ` \u2014 ${o.reason}` : ""}`).join("; ");
   const lawUnavailable = bad.some((o) => o.code === "BirthLawPackageUnavailable");
-  const err14 = new Error(
+  const err15 = new Error(
     `birth incomplete: ${bad.length} child workspace(s) did NOT come up \u2014 ${list}. The parent offer admitted, but the child was not fully born, so opening it would poll head:null until timeout. ` + (lawUnavailable ? `The child's law package is not resolvable from the parent's custody \u2014 deploy it to the parent (POST /v2/workspaces/<parent>/domains) BEFORE birthing.` : `See the outcome's reason/code for the cause.`) + ` [birth-failed]`
   );
-  err14.code = first.code || "BirthFailed";
-  err14.status = first.status;
-  err14.failedBirths = bad;
-  err14.birthOutcomes = birthOutcomes;
-  return err14;
+  err15.code = first.code || "BirthFailed";
+  err15.status = first.status;
+  err15.failedBirths = bad;
+  err15.birthOutcomes = birthOutcomes;
+  return err15;
 }
 function isColdFrameworkDescribe(spec) {
   if (!spec || typeof spec !== "object") return false;
@@ -6812,15 +6889,15 @@ ${String(commit).toLowerCase()}`;
     typeof principal === "string" && principal ? principal : typeof tokenSubject === "string" ? tokenSubject : ""
   );
   const readAuthFields = (keys, p) => {
-    const out14 = { nowUnix: Math.floor(Date.now() / 1e3) };
+    const out15 = { nowUnix: Math.floor(Date.now() / 1e3) };
     const pr = typeof p === "string" && p ? p : connectionPrincipal;
-    if (pr) out14.principal = pr;
+    if (pr) out15.principal = pr;
     if (activeAuthToken) {
-      out14.authToken = activeAuthToken;
+      out15.authToken = activeAuthToken;
     }
-    if (deviceSecret) out14.authorSecret = deviceSecret;
-    if (Array.isArray(keys) && keys.length) out14.keys = keys;
-    return out14;
+    if (deviceSecret) out15.authorSecret = deviceSecret;
+    if (Array.isArray(keys) && keys.length) out15.keys = keys;
+    return out15;
   };
   let clientLawHash;
   let warnedDrift = false;
@@ -7250,9 +7327,9 @@ ${String(commit).toLowerCase()}`;
     } catch {
     }
     const missingObject = (text.match(/\b[0-9a-f]{40}\b/) || [null])[0];
-    const err14 = new Error(text);
-    err14.code = code;
-    err14.errorInfo = {
+    const err15 = new Error(text);
+    err15.code = code;
+    err15.errorInfo = {
       code,
       message: text,
       component: "nomos.custody",
@@ -7270,7 +7347,7 @@ ${String(commit).toLowerCase()}`;
         "nomos.custody.recommended_action": source === "localSnapshot" ? "quarantineLocalSnapshotAndReclone" : "refetchFullHistoryAndRetry"
       }
     };
-    return err14;
+    return err15;
   };
   if (ckptBlobStr || ckptFrontierStr || ckptStagedFrontierFile || ckptCursor) {
     const _ckptSpan = span("receive", restoreFrom ? "boot: restore folded state (snapshot)" : "boot: restore checkpoint", "boot");
@@ -8897,13 +8974,13 @@ ${String(commit).toLowerCase()}`;
     if (!deviceSecret || !connectionPrincipal) {
       throw new Error("owned device recovery needs a signed-in session with its persisted device credential");
     }
-    const out14 = namedQueryTyped(QueryOperation.CRYPTO_OWNED_DEVICE_REQUEST, {
+    const out15 = namedQueryTyped(QueryOperation.CRYPTO_OWNED_DEVICE_REQUEST, {
       authorSecret: deviceSecret,
       workspace,
       principal: connectionPrincipal,
       scope
     });
-    return String(out14.request || "");
+    return String(out15.request || "");
   };
   const ownedRecoveryPolicyRaw = (owner) => ownedTupleData(ownedRecoveryPolicyId(owner));
   const ownedRecoveryOrdersRaw = async (recoveryPrincipal) => (await ownedQueryRows("nomosOwnedRecoveryOrdersByRecoveryPrincipal", { recoveryPrincipal })).map((row) => ({ id: String(row.id || ""), ...ownedRowData(row) }));
@@ -10239,11 +10316,11 @@ ${String(commit).toLowerCase()}`;
             await sleep(pollMs);
           }
           if (!sawDelegation) {
-            const err14 = new Error(
+            const err15 = new Error(
               `receiving-group setup: parent '${parent}' still holds NO SignerDelegation for '${owner}' after ${pollTimeoutMs}ms. enrollFirstDevice seated the device SIGNER, but the home cert chain's links[1] (the platform-signed delegation) never surfaced \u2014 the birth would come up UNWARRANTED/headless (birth-cert-not-seeded). The enroll must record the keyless delegation (enrollFirstDevice.delegationCert) BEFORE birth. [ParentSignerDelegationMissing]`
             );
-            err14.code = "ParentSignerDelegationMissing";
-            throw err14;
+            err15.code = "ParentSignerDelegationMissing";
+            throw err15;
           }
         } finally {
           delegationSpan.end();
@@ -10476,10 +10553,10 @@ ${String(commit).toLowerCase()}`;
       const off = installedInterfaceInner();
       if (off === null && _lastInterfaceReadError) {
         const e = _lastInterfaceReadError;
-        const err14 = new Error(`projection read failed on workspace '${workspace}': ${e.message}`);
-        err14.code = "nomos.projection.read_failed";
-        err14.errorInfo = { code: "nomos.projection.read_failed", message: e.message, component: "nomos.projection", workspace, attributes: { "nomos.projection.workspace": workspace } };
-        throw err14;
+        const err15 = new Error(`projection read failed on workspace '${workspace}': ${e.message}`);
+        err15.code = "nomos.projection.read_failed";
+        err15.errorInfo = { code: "nomos.projection.read_failed", message: e.message, component: "nomos.projection", workspace, attributes: { "nomos.projection.workspace": workspace } };
+        throw err15;
       }
       return off;
     }),
@@ -11774,12 +11851,12 @@ function routedHolon(coordinator, { cloud, workspace, clientId, authToken, fetch
   }
   async function frontierMap() {
     const rows = await coordinator.query("aggregatesByType", { __type: "NomosSummaryFrontier" });
-    const out14 = {};
+    const out15 = {};
     for (const r of rows || []) {
       const d = r.data || {};
-      if (typeof d.shard === "string" && typeof d.frontier === "string") out14[d.shard] = d.frontier;
+      if (typeof d.shard === "string" && typeof d.frontier === "string") out15[d.shard] = d.frontier;
     }
-    return out14;
+    return out15;
   }
   async function scopedValue(kind, readId, groupKey, opts = {}) {
     if (kind === "min" || kind === "max") {
@@ -12528,15 +12605,15 @@ var init_git_fs2 = __esm({
 });
 
 // vendor/engine/tree.ts
-function flatten2(dir, prefix, out14) {
+function flatten2(dir, prefix, out15) {
   const children2 = [...(dir.contents ?? /* @__PURE__ */ new Map()).entries()].sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0);
   for (const [name, inode] of children2) {
     const path2 = prefix ? prefix + "/" + name : name;
     if (inode.contents instanceof Map) {
-      out14.push({ path: path2, dir: true });
-      flatten2(inode, path2, out14);
+      out15.push({ path: path2, dir: true });
+      flatten2(inode, path2, out15);
     } else {
-      out14.push({ path: path2, dir: false, bytes: inode.data ?? new Uint8Array(0) });
+      out15.push({ path: path2, dir: false, bytes: inode.data ?? new Uint8Array(0) });
     }
   }
 }
@@ -12559,13 +12636,13 @@ function serializeTree2(workTree) {
   }
   let total = 0;
   for (const c of chunks) total += c.length;
-  const out14 = new Uint8Array(total);
+  const out15 = new Uint8Array(total);
   let off = 0;
   for (const c of chunks) {
-    out14.set(c, off);
+    out15.set(c, off);
     off += c.length;
   }
-  return out14;
+  return out15;
 }
 var enc5, dec5;
 var init_tree2 = __esm({
@@ -12580,13 +12657,13 @@ var init_tree2 = __esm({
 function concatBytes2(chunks) {
   let n = 0;
   for (const c of chunks) n += c.length;
-  const out14 = new Uint8Array(n);
+  const out15 = new Uint8Array(n);
   let o = 0;
   for (const c of chunks) {
-    out14.set(c, o);
+    out15.set(c, o);
     o += c.length;
   }
-  return out14;
+  return out15;
 }
 function pkt2(payload) {
   const body = typeof payload === "string" ? enc6.encode(payload) : payload;
@@ -13113,13 +13190,13 @@ async function sha256hex2(t2) {
 function osEntropyBuffer2(n) {
   const bytes = new Uint8Array(n * 8);
   for (let o = 0; o < bytes.length; o += 65536) crypto.getRandomValues(bytes.subarray(o, Math.min(o + 65536, bytes.length)));
-  const out14 = new Array(n), T = 2 ** 53;
+  const out15 = new Array(n), T = 2 ** 53;
   for (let i = 0; i < n; i++) {
     let z6 = 0n;
     for (let b = 7; b >= 0; b--) z6 = z6 << 8n | BigInt(bytes[i * 8 + b]);
-    out14[i] = Number(z6 >> 11n) / T;
+    out15[i] = Number(z6 >> 11n) / T;
   }
-  return out14;
+  return out15;
 }
 function callProto(ex, operation, STDERR) {
   const requestId = `adapter-${++protoRequestSequence2}`;
@@ -13820,15 +13897,15 @@ function contribution(read, cur) {
   return { group, value: typeof raw === "number" ? raw : 0 };
 }
 function contributionDiff(read, before, after) {
-  const out14 = [];
+  const out15 = [];
   if (before && after && before.group === after.group) {
     const d = after.value - before.value;
-    if (d !== 0) out14.push({ readId: read.id, group: after.group, delta: d });
-    return out14;
+    if (d !== 0) out15.push({ readId: read.id, group: after.group, delta: d });
+    return out15;
   }
-  if (before) out14.push({ readId: read.id, group: before.group, delta: -before.value });
-  if (after) out14.push({ readId: read.id, group: after.group, delta: after.value });
-  return out14.filter((d) => d.delta !== 0);
+  if (before) out15.push({ readId: read.id, group: before.group, delta: -before.value });
+  if (after) out15.push({ readId: read.id, group: after.group, delta: after.value });
+  return out15.filter((d) => d.delta !== 0);
 }
 function countTenantRows(eng, ws) {
   let total = 0;
@@ -13841,16 +13918,16 @@ async function countTenantRowsByHome(eng, ws, homeKeys) {
   const keySet = new Set(homeKeys);
   const tagOf = /* @__PURE__ */ new Map();
   for (const hk of homeKeys) tagOf.set(await routeTagHexOfHomeKey2(hk), hk);
-  const out14 = /* @__PURE__ */ new Map();
-  for (const hk of homeKeys) out14.set(hk, 0);
+  const out15 = /* @__PURE__ */ new Map();
+  for (const hk of homeKeys) out15.set(hk, 0);
   for (const type of tenantTypes(eng)) {
     for (const r of query2(eng, ws, "aggregatesByType", JSON.stringify({ __type: type }))) {
       const id = String(r.id || "");
       const hk = keySet.has(id) ? id : tagOf.get(routeTagHexOfMintedId(id) ?? "");
-      if (hk !== void 0) out14.set(hk, (out14.get(hk) ?? 0) + 1);
+      if (hk !== void 0) out15.set(hk, (out15.get(hk) ?? 0) + 1);
     }
   }
-  return out14;
+  return out15;
 }
 async function collectHomedIntents(eng, ws, homeKeys) {
   const routes = directiveRoutes(eng);
@@ -13875,7 +13952,7 @@ async function collectHomedIntents(eng, ws, homeKeys) {
       strikeParity.set(target, (strikeParity.get(target) ?? 0) + 1);
     }
   }
-  const out14 = [];
+  const out15 = [];
   for (const { oid, blob, doc } of docs) {
     const id = doc && typeof doc.id === "string" ? doc.id : null;
     if (!id || (strikeParity.get(id) ?? 0) % 2 === 1) continue;
@@ -13891,9 +13968,9 @@ async function collectHomedIntents(eng, ws, homeKeys) {
       const tag = routeTagHexOfMintedId(value);
       homeKey = tag !== void 0 ? tagOf.get(tag) ?? null : null;
     }
-    if (homeKey !== null) out14.push({ oid, id, homeKey, blob });
+    if (homeKey !== null) out15.push({ oid, id, homeKey, blob });
   }
-  return out14;
+  return out15;
 }
 async function migrateHomes(eng, ws, ledger, sourceWs, homeKeys, { onlyIds = null } = {}) {
   const wanted = onlyIds ? new Set(onlyIds) : null;
@@ -14002,7 +14079,7 @@ async function collectGlobalIntents(eng, ws) {
       strikeParity.set(target, (strikeParity.get(target) ?? 0) + 1);
     }
   }
-  const out14 = [];
+  const out15 = [];
   for (const { oid, blob, doc } of docs) {
     const id = doc && typeof doc.id === "string" ? doc.id : null;
     let touches = false;
@@ -14013,9 +14090,9 @@ async function collectGlobalIntents(eng, ws) {
       if (t2 !== void 0 && globals.has(t2)) touches = true;
     }
     if (!touches || !id || (strikeParity.get(id) ?? 0) % 2 === 1) continue;
-    out14.push({ oid, id, blob });
+    out15.push({ oid, id, blob });
   }
-  return out14;
+  return out15;
 }
 async function replicateIntents(eng, ws, ledger, intents, { push = true } = {}) {
   const main2 = await mainIntentIds(eng, ws);
@@ -14481,8 +14558,8 @@ function stageLawClosure(eng, lawUsdz, label = "candidate-law") {
   }, "lawClosureInfo");
 }
 function currentLaw(eng, ws) {
-  const out14 = namedQueryProto(eng, ws, QueryOperation3.CURRENT_LAW);
-  return out14.keyMap || {};
+  const out15 = namedQueryProto(eng, ws, QueryOperation3.CURRENT_LAW);
+  return out15.keyMap || {};
 }
 function installedLaw(eng, ws) {
   return namedQueryProto(eng, ws, QueryOperation3.INSTALLED_LAW);
@@ -14511,8 +14588,8 @@ function kernelResource(eng, ws) {
   return response.outcome.value.result.value;
 }
 function declaredCapabilities(eng, ws) {
-  const out14 = namedQueryProto(eng, ws, QueryOperation3.DECLARED_CAPABILITIES);
-  return out14.capabilities || [];
+  const out15 = namedQueryProto(eng, ws, QueryOperation3.DECLARED_CAPABILITIES);
+  return out15.capabilities || [];
 }
 function outboundOffers(eng, ws, nowMillis = Date.now()) {
   const response = callProto(eng.ex, {
@@ -14553,8 +14630,8 @@ function evolveDryRun(eng, ws, lawUsdz, domainHash, dispositions2 = null) {
   return r.ok ? { admits: true } : { admits: false, detail: r.error };
 }
 function mintId(eng, typeTag) {
-  const out14 = namedQueryProto(eng, "root", QueryOperation3.MINT, { typeTag, nowMillis: Date.now() });
-  return out14.id;
+  const out15 = namedQueryProto(eng, "root", QueryOperation3.MINT, { typeTag, nowMillis: Date.now() });
+  return out15.id;
 }
 function author(eng, ws, domain, directiveId, payload, controllerHash, opts = {}) {
   const seq = eng.seq++;
@@ -14779,13 +14856,13 @@ async function streamAll(stream) {
   }
   let len = 0;
   for (const c of chunks) len += c.length;
-  const out14 = new Uint8Array(len);
+  const out15 = new Uint8Array(len);
   let at = 0;
   for (const c of chunks) {
-    out14.set(c, at);
+    out15.set(c, at);
     at += c.length;
   }
-  return out14;
+  return out15;
 }
 async function gzip(bytes) {
   const cs = new CompressionStream("gzip");
@@ -16117,7 +16194,7 @@ async function writeRefusedRef(eng, ws, dl) {
 async function listRefusedRefs(eng, ws) {
   const gitdir = gitdirOf(ws);
   const refs = kgit.listRefs(eng, gitdir, "refs/heads/refused/");
-  const out14 = [];
+  const out15 = [];
   for (const { ref, oid } of refs) {
     try {
       const vb = kgit.readBlob(eng, gitdir, oid, "verdict.usda") ?? new Uint8Array();
@@ -16129,7 +16206,7 @@ async function listRefusedRefs(eng, ws) {
         law = null;
       }
       const v = kgit.inspectRefusalVerdict(eng, vb);
-      out14.push({
+      out15.push({
         ref,
         ...v,
         verdict: { reason: v.reason },
@@ -16139,7 +16216,7 @@ async function listRefusedRefs(eng, ws) {
     } catch {
     }
   }
-  return out14;
+  return out15;
 }
 async function refusedSummary(eng, ws) {
   const gitdir = gitdirOf(ws);
@@ -16278,9 +16355,9 @@ async function ledgerStats(eng, ws, ledger = null) {
   const mounted = eng.mounted.get(ws);
   if (mounted && mounted.ledgerStats?.head === head) return mounted.ledgerStats;
   const commits = kgit.intentsAbove(eng, gitdir, head).length;
-  const out14 = { head, commits };
-  if (mounted) mounted.ledgerStats = out14;
-  return out14;
+  const out15 = { head, commits };
+  if (mounted) mounted.ledgerStats = out15;
+  return out15;
 }
 async function countRemoteCommits(eng, ledger) {
   const head = (await custodyLsRefs(ledger, "refs/heads/main"))["refs/heads/main"] || null;
@@ -17277,6 +17354,7 @@ __export(governance_exports, {
   ROOT_CUSTODIAN_SECRET: () => ROOT_CUSTODIAN_SECRET,
   STAGE_THRESHOLD_CHARS: () => STAGE_THRESHOLD_CHARS,
   adoptRootModelLifecycle: () => adoptRootModelLifecycle,
+  adoptWorkspaceModel: () => adoptWorkspaceModel,
   buildCertificate: () => buildCertificate,
   buildRebirthPlan: () => buildRebirthPlan,
   canonicalPrincipal: () => canonicalPrincipal2,
@@ -17472,6 +17550,41 @@ async function adoptRootModelLifecycle(candidateHash, opts, acceptance) {
   const ok = sync.pushFailed !== true && sync.offline !== true && admission?.ok === true && rejected.length === 0;
   return { ok, adoption, sync };
 }
+async function adoptWorkspaceModel(workspace, domain, candidateHash, opts, acceptance) {
+  const cloud = cloudBase(opts.cloud);
+  const principal = resolveGovernancePrincipal(opts);
+  const device = getDeviceKey(principal);
+  if (device === void 0) {
+    throw new Error(
+      `no signing device is stored for '${principal}' \u2014 use githolon key import/enroll before adopting a model`
+    );
+  }
+  const connect2 = await clientConnect();
+  const holon = await connect2({
+    cloud,
+    workspace,
+    clientId: `githolon-model-adopt-${Date.now().toString(16)}`,
+    principal: canonicalPrincipal2(principal),
+    authorSecret: device.secret
+  });
+  try {
+    if (typeof holon.__nomosAdoptModel !== "function") {
+      throw new Error("the installed @githolon/client has no typed model-adoption surface");
+    }
+    const adoption = await holon.__nomosAdoptModel(domain, candidateHash, acceptance);
+    if (adoption.ok !== true) return { ok: false, adoption };
+    if (typeof holon.sync !== "function") {
+      throw new Error("the installed @githolon/client cannot synchronize the adopted model");
+    }
+    const sync = await holon.sync({ admit: true, discoverRemote: true });
+    const admission = sync.admission;
+    const rejected = (admission?.sessions ?? []).flatMap((session) => session.rejected ?? []);
+    const ok = sync.pushFailed !== true && sync.offline !== true && admission?.ok === true && rejected.length === 0;
+    return { ok, adoption, sync };
+  } finally {
+    holon._dispose?.();
+  }
+}
 async function signAndPostPreparedOffer(ws, domain, prepare, opts, authorMode = "account", preferActor, lawUsdz, birthCertificate, explicitAuthority) {
   const cloud = cloudBase(opts.cloud);
   const principal = explicitAuthority?.actor ?? resolveGovernancePrincipal(opts);
@@ -20218,7 +20331,7 @@ async function deployPackage(ws, opts, file, placement) {
     (installed) => installed.domainHash === targetHash && installed.phase === "Pending" /* Pending */
   )) {
     out4(`\u2713 ${fileName} is already staged on ${ws} (${targetHash.slice(0, 16)}\u2026 pending)`);
-    out4("  the generated application client owns review and adoption; no second offer was submitted");
+    out4("  the model lifecycle owns review and adoption; no second offer was submitted");
     return 0;
   }
   if ((plan?.predecessorCandidates.length ?? 0) > 1) {
@@ -20284,7 +20397,7 @@ async function deployPackage(ws, opts, file, placement) {
     out4(`\u2713 staged ${fileName} \u2192 ${ws} (pending)`);
     if (plan?.supersedes) out4(`  current model ${plan.supersedes.slice(0, 16)}\u2026 keeps serving`);
     out4(`  candidate ${deployedHash.slice(0, 16)}\u2026 is in custody but cannot serve yet`);
-    out4(`  next: use the candidate generated client and call model.adopt()`);
+    out4(`  next: githolon model adopt ${ws} --domain <candidate-home-domain> --file ${file}`);
     return 0;
   }
   if (deployedHash !== void 0 && isCurrent) {
@@ -21160,22 +21273,22 @@ async function doctor(opts = {}) {
   const cloud = cloudBase(opts.cloud);
   const localLaw = await readLocalLaw(process.cwd(), cloud, opts.file);
   const report = await probeKernelCapabilities(cloud);
-  const out14 = [];
-  out14.push(`githolon doctor \u2014 release coherence`);
-  out14.push(`  cloud       : ${cloud}`);
-  out14.push(`  local law   : ${localLaw ? `${localLaw.identity.slice(0, 16)}\u2026 (${localLaw.domains.join(", ") || "no domains"})` : "(not admitted \u2014 run `githolon compile` or inspect the error with `githolon deploy`)"}`);
-  out14.push(stampLine("prod kernel", report?.prod));
-  out14.push(stampLine("test kernel", report?.testmint));
+  const out15 = [];
+  out15.push(`githolon doctor \u2014 release coherence`);
+  out15.push(`  cloud       : ${cloud}`);
+  out15.push(`  local law   : ${localLaw ? `${localLaw.identity.slice(0, 16)}\u2026 (${localLaw.domains.join(", ") || "no domains"})` : "(not admitted \u2014 run `githolon compile` or inspect the error with `githolon deploy`)"}`);
+  out15.push(stampLine("prod kernel", report?.prod));
+  out15.push(stampLine("test kernel", report?.testmint));
   if (!localLaw) {
-    out14.push(``);
-    out14.push(`  \u26A0 no local build found \u2014 cannot check the law\u2194kernel fit. Run \`githolon compile\` first.`);
-    process.stdout.write(out14.join("\n") + "\n");
+    out15.push(``);
+    out15.push(`  \u26A0 no local build found \u2014 cannot check the law\u2194kernel fit. Run \`githolon compile\` first.`);
+    process.stdout.write(out15.join("\n") + "\n");
     return report ? 0 : 1;
   }
-  out14.push(``);
-  out14.push(`  \u2713 ARCHIVE COHERENT \u2014 the selected kernel admitted and composed ${localLaw.identity.slice(0, 16)}\u2026 directly from typed USDA.`);
-  out14.push(`    Full schema/projection compatibility is enforced again by the ordinary install offer.`);
-  process.stdout.write(out14.join("\n") + "\n");
+  out15.push(``);
+  out15.push(`  \u2713 ARCHIVE COHERENT \u2014 the selected kernel admitted and composed ${localLaw.identity.slice(0, 16)}\u2026 directly from typed USDA.`);
+  out15.push(`    Full schema/projection compatibility is enforced again by the ordinary install offer.`);
+  process.stdout.write(out15.join("\n") + "\n");
   return 0;
 }
 var init_doctor = __esm({
@@ -21604,11 +21717,11 @@ function bareTypeLabel(t2) {
   return i > 0 && i < t2.length - 1 ? t2.slice(i + 1) : t2;
 }
 function geoFieldsOfInstalls(installs) {
-  const out14 = /* @__PURE__ */ new Map();
+  const out15 = /* @__PURE__ */ new Map();
   const add2 = (type, field) => {
-    const set2 = out14.get(type) ?? /* @__PURE__ */ new Set();
+    const set2 = out15.get(type) ?? /* @__PURE__ */ new Set();
     set2.add(field);
-    out14.set(type, set2);
+    out15.set(type, set2);
   };
   for (const inst of installs) {
     for (const layer of inst.layers) {
@@ -21624,7 +21737,7 @@ function geoFieldsOfInstalls(installs) {
       }
     }
   }
-  return out14;
+  return out15;
 }
 function pointOfOpValue(setOp) {
   let v = setOp["Json"];
@@ -22376,6 +22489,126 @@ var init_scene = __esm({
   }
 });
 
+// src/model.ts
+var model_exports = {};
+__export(model_exports, {
+  modelAdopt: () => modelAdopt
+});
+function domainInventory(value) {
+  if (typeof value !== "object" || value === null) throw new Error("domain inventory is not an object");
+  const row = value;
+  if (row.ok !== true || !Array.isArray(row.domains) || typeof row.currentLaw !== "object" || row.currentLaw === null) {
+    throw new Error("domain inventory has no typed lifecycle projection");
+  }
+  const domains = row.domains.map((candidate) => {
+    if (typeof candidate !== "object" || candidate === null) throw new Error("domain inventory contains a non-record installation");
+    const install = candidate;
+    if (typeof install.domainHash !== "string" || typeof install.phase !== "string" || !Array.isArray(install.domainKeys) || !install.domainKeys.every((key2) => typeof key2 === "string")) {
+      throw new Error("domain inventory contains an invalid installation record");
+    }
+    return { domainHash: install.domainHash, phase: install.phase, domainKeys: install.domainKeys };
+  });
+  const currentLaw2 = Object.fromEntries(Object.entries(row.currentLaw).map(([key2, hash]) => {
+    if (typeof hash !== "string") throw new Error(`domain inventory has a non-string current law for '${key2}'`);
+    return [key2, hash];
+  }));
+  return { ok: true, domains, currentLaw: currentLaw2 };
+}
+async function modelAdopt(workspace, opts) {
+  const cloud = cloudBase(opts.cloud);
+  let file;
+  let identity;
+  let domainKeys;
+  try {
+    file = discoverLawUsdz(process.cwd(), opts.file);
+    const { eng } = await holonEngine(cloud, "githolon-model-adopt-inspect");
+    const inspected = inspectLawArchive(eng, file);
+    identity = inspected.identity;
+    domainKeys = inspected.domainKeys;
+  } catch (cause) {
+    err13(`could not derive the candidate from typed USDA: ${cause.message}`);
+    return 1;
+  }
+  if (!domainKeys.includes(opts.domain)) {
+    err13(`candidate ${identity.slice(0, 16)}\u2026 does not contain domain '${opts.domain}' (${domainKeys.join(", ")})`);
+    return 1;
+  }
+  out13(`candidate  ${identity}  (kernel-derived from ${file})`);
+  out13(`workspace  ${workspace} on ${cloud}`);
+  out13(`domain     ${opts.domain}`);
+  const startedAt = Date.now();
+  const heartbeat = setInterval(() => {
+    const elapsed = Math.round((Date.now() - startedAt) / 1e3);
+    out13(`  ${elapsed}s \u2014 verifying current history and preparing the signed lifecycle decision\u2026`);
+  }, 5e3);
+  heartbeat.unref();
+  try {
+    const result = await adoptWorkspaceModel(
+      workspace,
+      opts.domain,
+      sha256Digest().parse(identity),
+      opts,
+      opts.because === void 0 ? void 0 : { because: opts.because }
+    );
+    if (!result.ok) {
+      const stage = typeof result.adoption.stage === "string" ? result.adoption.stage : "refused";
+      const message = typeof result.adoption.error === "string" ? result.adoption.error : "the candidate remained unchanged";
+      err13(`model adoption ${stage}: ${message}`);
+      const report = result.adoption.report;
+      if (typeof report === "object" && report !== null) {
+        const r = report;
+        out13(`  history   replayed=${String(r.replayedIntents ?? "?")} candidate=${String(r.candidateIntents ?? "?")}`);
+        out13(`  evidence  sourceVerified=${String(r.sourceVerified ?? "?")} complete=${String(r.complete ?? "?")}`);
+      }
+      if (stage === "acceptance" && opts.because === void 0) {
+        out13("  next: review the reported divergence, then repeat with --because <accountable business reason>");
+      }
+      return 2;
+    }
+    let inventory;
+    const deadline = Date.now() + 3e4;
+    do {
+      const response = await fetch(`${cloud}/v2/workspaces/${encodeURIComponent(workspace)}/domains`);
+      if (!response.ok) throw new Error(`domain inventory returned ${response.status}`);
+      const observed = domainInventory(await response.json());
+      const candidate2 = observed.domains.find((installed) => installed.domainHash === identity);
+      const keys2 = candidate2?.domainKeys ?? domainKeys;
+      if (candidate2?.phase === "Active" && keys2.every((key2) => observed.currentLaw[key2] === identity)) {
+        inventory = observed;
+        break;
+      }
+      await new Promise((resolve8) => setTimeout(resolve8, 250));
+    } while (Date.now() < deadline);
+    if (inventory === void 0) throw new Error("the active-law projection did not converge within 30 seconds");
+    const candidate = inventory.domains.find((installed) => installed.domainHash === identity);
+    const keys = candidate?.domainKeys ?? domainKeys;
+    const drift = keys.filter((key2) => inventory.currentLaw[key2] !== identity);
+    if (candidate?.phase !== "Active" || drift.length > 0) {
+      err13(`adoption synced but ${identity} is not current for ${drift.join(", ") || "its declared domain keys"}`);
+      return 1;
+    }
+    out13(`\u2713 adopted ${identity} across ${keys.length} domain key${keys.length === 1 ? "" : "s"} in ${Date.now() - startedAt} ms`);
+    return 0;
+  } catch (cause) {
+    err13(cause.message);
+    return 1;
+  } finally {
+    clearInterval(heartbeat);
+  }
+}
+var out13, err13;
+var init_model = __esm({
+  "src/model.ts"() {
+    "use strict";
+    init_src();
+    init_cloud();
+    init_governance();
+    init_local_holon();
+    out13 = (line) => void process.stdout.write(line + "\n");
+    err13 = (line) => void process.stderr.write("error: " + line + "\n");
+  }
+});
+
 // src/dlq.ts
 var dlq_exports = {};
 __export(dlq_exports, {
@@ -22405,33 +22638,33 @@ async function dlqSweep(ws, opts = {}) {
     const res = await fetch(url);
     body = await res.json();
     if (body.ok !== true || body.root === void 0) {
-      err13(`dlq sweep refused: ${String(body.error ?? "no sweep in the response").slice(0, 300)}`);
+      err14(`dlq sweep refused: ${String(body.error ?? "no sweep in the response").slice(0, 300)}`);
       return 1;
     }
   } catch (e) {
-    err13(`dlq sweep failed against ${cloud}: ${e.message}`);
+    err14(`dlq sweep failed against ${cloud}: ${e.message}`);
     return 1;
   }
   if (opts.json === true) {
-    out13(JSON.stringify(body, null, 2));
+    out14(JSON.stringify(body, null, 2));
     return body.jammed ? 2 : 0;
   }
-  out13(`DLQ sweep of '${ws}' \u2014 ${body.nodes} node(s), ${body.jammed} jammed`);
-  for (const line of renderSweepNode(body.root)) out13(line);
+  out14(`DLQ sweep of '${ws}' \u2014 ${body.nodes} node(s), ${body.jammed} jammed`);
+  for (const line of renderSweepNode(body.root)) out14(line);
   if (body.jammed) {
-    out13("");
-    out13("unjam: fix/deploy the law on the jammed workspace, then POST /v2/workspaces/<node>/dead-letters/retry");
-    out13("       (or from the app: holon.retryDeadLetter(id); discard is the app's explicit choice)");
+    out14("");
+    out14("unjam: fix/deploy the law on the jammed workspace, then POST /v2/workspaces/<node>/dead-letters/retry");
+    out14("       (or from the app: holon.retryDeadLetter(id); discard is the app's explicit choice)");
   }
   return body.jammed ? 2 : 0;
 }
-var out13, err13;
+var out14, err14;
 var init_dlq = __esm({
   "src/dlq.ts"() {
     "use strict";
     init_cloud();
-    out13 = (s) => void process.stdout.write(s + "\n");
-    err13 = (s) => void process.stderr.write("error: " + s + "\n");
+    out14 = (s) => void process.stdout.write(s + "\n");
+    err14 = (s) => void process.stderr.write("error: " + s + "\n");
   }
 });
 
@@ -25221,7 +25454,7 @@ var HELP = {
   },
   deploy: {
     usage: "githolon deploy [<ws>] [--as <uid>] [--parent <ws>] [--file <application.usda|law.usdz>] [--cloud <url>] [--target <name>]\n       provider handover: --auth-provider-issuer <url> --auth-provider-jwks-file <path> --auth-provider-jwks-url <url> --auth-provider-audience <aud> --auth-provider-principal-claim <claim> --auth-provider-device-binding-claim <claim>",
-    what: "Deploy the compiled application from its OpenUSD composition. Reference-only packages serve on\nthe application workspace; payload packages are staged for child birth and never made current there.\nFor a one-package project, the compiled law archive is the shorthand. There is one model lifecycle:\nthe first serving model becomes active; a successor stays Pending while the current model keeps serving,\nand the generated candidate client owns exact-history adoption. Re-deploying the same content hash is\nidempotent. With no <ws>, the project's workspace binding resolves it.",
+    what: "Deploy the compiled application from its OpenUSD composition. Reference-only packages serve on\nthe application workspace; payload packages are staged for child birth and never made current there.\nFor a one-package project, the compiled law archive is the shorthand. There is one model lifecycle:\nthe first serving model becomes active; a successor stays Pending while the current model keeps serving,\nand exact-history adoption is driven by the generated client or `githolon model adopt`. Re-deploying the\nsame content hash is idempotent. With no <ws>, the project's workspace binding resolves it.",
     flags: [
       ["--as <uid>", "attribute the deployment to this principal (needs its enrolled signing key)"],
       ["--parent <ws>", "birth an unborn application directly below this parent; existing lineage must match"],
@@ -25239,6 +25472,18 @@ var HELP = {
     ],
     examples: ["githolon deploy", "githolon deploy my-guestbook", "githolon deploy co2-platform --as <admin-uid>"]
   },
+  model: {
+    usage: "githolon model adopt [<workspace>] --domain <domain> [--file <law.usdz>] [--because <reason>] [--as <uid>] [--cloud <url>]",
+    what: "Adopt one already-staged application model. The kernel derives the candidate identity directly\nfrom the compiled OpenUSD closure, replays current history under the lifecycle gate, and the selected\nworkspace principal signs the resulting decision. Nothing is promoted when proof or synchronization fails.",
+    flags: [
+      ["--domain <domain>", "a domain key carried by the candidate; required so tooling never guesses the application root"],
+      ["--file <path>", "the exact compiled .law.usdz candidate (default: the single build/*.law.usdz)"],
+      ["--because <reason>", "explicitly accept an intentional historical outcome change; omitted for equivalent evolution"],
+      ["--as <uid>", "sign as this stored workspace principal"],
+      ["--cloud <url>", "target cloud"]
+    ],
+    examples: ["githolon model adopt --domain home", "githolon model adopt co2-platform --domain home --file build/co2.law.usdz"]
+  },
   domains: {
     usage: "githolon domains <status <ws> [--explain-current-interface] | retire <ws> <hashOrKey> [--with <hashOrKey>]>",
     what: "Framework lifecycle inspection and explicit withdrawal.\n\u2022 status: per domain KEY, the active hash, then the superseded/retired lineage behind it.\n  Lifecycle vocabulary: active = served now; superseded = replaced by a newer install for the same domain\n  key, replayable, not served; retired = explicitly withdrawn, replayable, not served.\n  --explain-current-interface spells out why active reads/dispatch use only that active map.\n\u2022 retire: mark an install Retired via a signed installDomain offer. The framework retires only as the\n  consequence of installing a SUCCESSOR \u2014 by default the local compiled law (build/*.law.usdz),\n  or --with <hashOrKey> names an already-installed successor. A key the successor does not cover is left\n  with NO active law \u2014 WARNED loudly, never blocked. A key resolves to its active hash; a 64-hex arg is\n  taken as the install hash.",
@@ -25388,9 +25633,9 @@ function capJsonStrings(v, max = 2048) {
   if (typeof v === "string") return v.length > max ? `${v.slice(0, max)}\u2026(${v.length} chars)` : v;
   if (Array.isArray(v)) return v.map((x) => capJsonStrings(x, max));
   if (typeof v === "object" && v !== null) {
-    const out14 = {};
-    for (const [k, x] of Object.entries(v)) out14[k] = capJsonStrings(x, max);
-    return out14;
+    const out15 = {};
+    for (const [k, x] of Object.entries(v)) out15[k] = capJsonStrings(x, max);
+    return out15;
   }
   return v;
 }
@@ -26053,7 +26298,7 @@ Options:
 function cloudArgs(rest) {
   const pos = [];
   const opts = {};
-  const VALUE_FLAGS = ["--cloud", "--principal", "--as", "--file", "--target", "--parent", "--via", "--max", "--pool", "--label", "--secret", "--payload", "--payload-file", "--save", "--format", "--with", "--out", "--reason", "--oid", "--seed-secret", "--gcp-secret", "--auth-provider-issuer", "--auth-provider-jwks-file", "--auth-provider-jwks-url", "--auth-provider-audience", "--auth-provider-principal-claim", "--auth-provider-device-binding-claim", "--controller-hash", "--plan", "--depth", "--domain", "--directive"];
+  const VALUE_FLAGS = ["--cloud", "--principal", "--as", "--file", "--target", "--parent", "--via", "--max", "--pool", "--label", "--secret", "--payload", "--payload-file", "--save", "--format", "--with", "--out", "--reason", "--because", "--oid", "--seed-secret", "--gcp-secret", "--auth-provider-issuer", "--auth-provider-jwks-file", "--auth-provider-jwks-url", "--auth-provider-audience", "--auth-provider-principal-claim", "--auth-provider-device-binding-claim", "--controller-hash", "--plan", "--depth", "--domain", "--directive"];
   const BOOL_FLAGS = ["--sha256", "--stamp", "--yes", "--clear", "--explain-current-interface", "--dry-run", "--json", "--full"];
   for (let i = 0; i < rest.length; i++) {
     const a = rest[i];
@@ -26095,6 +26340,7 @@ function cloudArgs(rest) {
       else if (a === "--with") opts.with = v;
       else if (a === "--domain") opts.domain = v;
       else if (a === "--directive") opts.directive = v;
+      else if (a === "--because") opts.because = v;
       else if (a === "--out") opts.out = v;
       else if (a === "--max") {
         const n = Number(v);
@@ -26530,10 +26776,10 @@ async function main(argv) {
     };
     const lawArg = pull("--law");
     const workspace = pull("--workspace") ?? "test-ws";
-    const out14 = pull("--out");
+    const out15 = pull("--out");
     const runtime = pull("--runtime");
     const law = (lawArg ?? "").split(",").map((s) => s.trim()).filter(Boolean);
-    if (law.length === 0 || out14 === void 0) {
+    if (law.length === 0 || out15 === void 0) {
       process.stderr.write(
         `error: usage: githolon harness-install --law <law.usdz[,law.usdz...]> --workspace <ws> --out <snapshotPath> [--runtime <dir>]
 `
@@ -26541,7 +26787,7 @@ async function main(argv) {
       return 1;
     }
     const { harnessInstall: harnessInstall2 } = await Promise.resolve().then(() => (init_harness(), harness_exports));
-    return harnessInstall2({ law, workspace, out: out14, ...runtime !== void 0 ? { runtime } : {} });
+    return harnessInstall2({ law, workspace, out: out15, ...runtime !== void 0 ? { runtime } : {} });
   }
   if (argv[0] === "dev") {
     const rest = argv.slice(1);
@@ -26711,6 +26957,31 @@ ${commandHelp("status")}`);
     }
     return status(pos[0], opts);
   }
+  if (argv[0] === "model") {
+    const { pos, opts, bad } = cloudArgs(argv.slice(1));
+    if (bad !== void 0) {
+      process.stderr.write(`error: ${bad}
+
+${commandHelp("model") ?? USAGE}`);
+      return 1;
+    }
+    const [sub2, explicitWorkspace] = pos;
+    if (sub2 !== "adopt" || opts.domain === void 0) {
+      process.stderr.write(`error: expected: githolon model adopt [<workspace>] --domain <domain> [--file <law.usdz>] [--because <reason>]
+
+${commandHelp("model") ?? USAGE}`);
+      return 1;
+    }
+    try {
+      const workspace = await resolveWorkspace(explicitWorkspace, process.cwd(), opts.target, "githolon model adopt <workspace>");
+      const { modelAdopt: modelAdopt2 } = await Promise.resolve().then(() => (init_model(), model_exports));
+      return modelAdopt2(workspace, { ...opts, domain: opts.domain, ...opts.because === void 0 ? {} : { because: opts.because } });
+    } catch (cause) {
+      process.stderr.write(`error: ${cause.message}
+`);
+      return 1;
+    }
+  }
   if (argv[0] === "ws" && argv[1] === "create") {
     process.stderr.write(
       "error: `githolon ws create` is not an application birth API. Declare birth(Aggregate, spec) and call the generated app.birth(businessFacts); Nomos owns custody beneath it.\n"
@@ -27064,8 +27335,8 @@ ${USAGE}`);
   let parsed;
   try {
     parsed = parseArgs(argv);
-  } catch (err14) {
-    process.stderr.write(`error: ${err14.message}
+  } catch (err15) {
+    process.stderr.write(`error: ${err15.message}
 
 ${USAGE}`);
     return 1;
@@ -27084,8 +27355,8 @@ ${USAGE}`);
     process.stdout.write(`created ${path2}
 `);
     return 0;
-  } catch (err14) {
-    process.stderr.write(`error: ${err14.message}
+  } catch (err15) {
+    process.stderr.write(`error: ${err15.message}
 `);
     return 1;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.107.2",
+  "version": "0.107.4",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -30,7 +30,7 @@
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
     "@bufbuild/protobuf": "^2.13.0",
-    "@githolon/dsl": "^0.107.2",
+    "@githolon/dsl": "^0.107.4",
     "fast-xml-parser": "5.10.1",
     "isomorphic-git": "^1.38.4",
     "tsx": "^4.19.2"