githolon 0.108.3 → 0.108.4

package/dist/compile_mountability_entry.js

@@ -1548,7 +1548,7 @@ var init_lifecycle_calls = __esm({
 
 // vendor/engine/proto/nomos/kernel/v1/kernel_pb.js
 import { enumDesc, fileDesc, messageDesc, serviceDesc, tsEnum } from "@bufbuild/protobuf/codegenv2";
-var file_nomos_kernel_v1_kernel, CallRequestSchema, CallResponseSchema, PrepareRemoteOfferRequestSchema, PrepareRemoteOfferResponseSchema, ApplyWorkspaceEffectRequestSchema, ApplyWorkspaceEffectResponseSchema, WorkspaceTargetSchema, InitializeWorkspaceRequestSchema, DirectiveCallSchema, AuthoringOptionsSchema, CapturedClockSchema, BirthCertificateSchema, SignBirthCertificateRequestSchema, OfferRequestSchema, QueryRequestSchema, QueryAuthoritySchema, InjectedKeySchema, RowsQuerySchema, PageQuerySchema, ByIdQuerySchema, ByTypeQuerySchema, TallyQuerySchema, SpatialQuerySchema, PendingConflictsQuerySchema, PendingConflictSummaryQuerySchema, NamedQuerySchema, FrontierTransitionRequestSchema, AuthorizationObjectSchema, AuthorizationSubjectSchema, AuthorizationConsistencySchema, AuthorizationCheckRequestSchema, AuthorizationExpandRequestSchema, OutboxRequestSchema, SyncRequestSchema, TestRequestSchema, SetTestRootRequestSchema, CustodyRequestSchema, ResidentFootprintRequestSchema, PackDeltaRequestSchema, ApplyPackRequestSchema, RepoStatsRequestSchema, IntentsAboveRequestSchema, InspectChangeRequestSchema, RefusalVerdictSchema, EncodeRefusalVerdictRequestSchema, InspectRefusalVerdictRequestSchema, ProveCompactionEquivalenceRequestSchema, ReadBlobRequestSchema, ResolveRefRequestSchema, ListRefsRequestSchema, WriteRefRequestSchema, DeleteRefRequestSchema, WriteMetaCommitRequestSchema, LawClosureInfoRequestSchema, CheckpointExportRequestSchema, VerifiedFrontierReceiptSchema, StoredCheckpointManifestSchema, CheckpointImportRequestSchema, CapacityReserveRequestSchema, RestoreMainRequestSchema, ResolveStatePositionRequestSchema, NomosValueSchema, NomosStructSchema, BirthOutcomeStatusSchema, BirthOutcomeStatus, QueryResultFormatSchema, QueryResultFormat, QueryOperationSchema, QueryOperation, KernelLawCapabilitySchema, KernelLawCapability, CheckpointCompressionSchema, CheckpointCompression, CheckpointVerificationPolicySchema, CheckpointVerificationPolicy, CheckpointAssuranceSchema, CheckpointAssurance, IntentTransportRequirementSchema, IntentTransportRequirement, LifecycleInstallPhaseSchema, LifecycleInstallPhase;
+var file_nomos_kernel_v1_kernel, CallRequestSchema, CallResponseSchema, PrepareRemoteOfferRequestSchema, PrepareRemoteOfferResponseSchema, ApplyWorkspaceEffectRequestSchema, ApplyWorkspaceEffectResponseSchema, WorkspaceTargetSchema, InitializeWorkspaceRequestSchema, DirectiveCallSchema, AuthoringOptionsSchema, CapturedClockSchema, BirthCertificateSchema, SignBirthCertificateRequestSchema, ModelLifecycleIntentSchema, OfferRequestSchema, QueryRequestSchema, QueryAuthoritySchema, InjectedKeySchema, RowsQuerySchema, PageQuerySchema, ByIdQuerySchema, ByTypeQuerySchema, TallyQuerySchema, SpatialQuerySchema, PendingConflictsQuerySchema, PendingConflictSummaryQuerySchema, NamedQuerySchema, FrontierTransitionRequestSchema, FrontierTransitionDispositionMapEntrySchema, FrontierTransitionDispositionsSchema, FrontierTransitionViolationSchema, FrontierTransitionResponseSchema, AuthorizationObjectSchema, AuthorizationSubjectSchema, AuthorizationConsistencySchema, AuthorizationCheckRequestSchema, AuthorizationExpandRequestSchema, OutboxRequestSchema, SyncRequestSchema, TestRequestSchema, SetTestRootRequestSchema, CustodyRequestSchema, ResidentFootprintRequestSchema, PackDeltaRequestSchema, ApplyPackRequestSchema, RepoStatsRequestSchema, IntentsAboveRequestSchema, InspectChangeRequestSchema, RefusalVerdictSchema, EncodeRefusalVerdictRequestSchema, InspectRefusalVerdictRequestSchema, ProveCompactionEquivalenceRequestSchema, ReadBlobRequestSchema, ResolveRefRequestSchema, ListRefsRequestSchema, WriteRefRequestSchema, DeleteRefRequestSchema, WriteMetaCommitRequestSchema, LawClosureInfoRequestSchema, CheckpointExportRequestSchema, VerifiedFrontierReceiptSchema, StoredCheckpointManifestSchema, CheckpointImportRequestSchema, CapacityReserveRequestSchema, RestoreMainRequestSchema, ResolveStatePositionRequestSchema, NomosValueSchema, NomosStructSchema, BirthOutcomeStatusSchema, BirthOutcomeStatus, ModelLifecycleOperationSchema, ModelLifecycleOperation, QueryResultFormatSchema, QueryResultFormat, QueryOperationSchema, QueryOperation, KernelLawCapabilitySchema, KernelLawCapability, CheckpointCompressionSchema, CheckpointCompression, CheckpointVerificationPolicySchema, CheckpointVerificationPolicy, CheckpointAssuranceSchema, CheckpointAssurance, IntentTransportRequirementSchema, IntentTransportRequirement, LifecycleInstallPhaseSchema, LifecycleInstallPhase;
 var init_kernel_pb = __esm({
   "vendor/engine/proto/nomos/kernel/v1/kernel_pb.js"() {
     "use strict";
@@ -1566,6 +1566,7 @@ var init_kernel_pb = __esm({
     CapturedClockSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 49);
     BirthCertificateSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 50);
     SignBirthCertificateRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 51);
+    ModelLifecycleIntentSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 53);
     OfferRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 54);
     QueryRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 57);
     QueryAuthoritySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 64);
@@ -1580,6 +1581,10 @@ var init_kernel_pb = __esm({
     PendingConflictSummaryQuerySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 77);
     NamedQuerySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 78);
     FrontierTransitionRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 79);
+    FrontierTransitionDispositionMapEntrySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 80);
+    FrontierTransitionDispositionsSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 81);
+    FrontierTransitionViolationSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 82);
+    FrontierTransitionResponseSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 83);
     AuthorizationObjectSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 84);
     AuthorizationSubjectSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 85);
     AuthorizationConsistencySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 87);
@@ -1618,6 +1623,8 @@ var init_kernel_pb = __esm({
     NomosStructSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 166);
     BirthOutcomeStatusSchema = /* @__PURE__ */ enumDesc(file_nomos_kernel_v1_kernel, 0);
     BirthOutcomeStatus = /* @__PURE__ */ tsEnum(BirthOutcomeStatusSchema);
+    ModelLifecycleOperationSchema = /* @__PURE__ */ enumDesc(file_nomos_kernel_v1_kernel, 3);
+    ModelLifecycleOperation = /* @__PURE__ */ tsEnum(ModelLifecycleOperationSchema);
     QueryResultFormatSchema = /* @__PURE__ */ enumDesc(file_nomos_kernel_v1_kernel, 5);
     QueryResultFormat = /* @__PURE__ */ tsEnum(QueryResultFormatSchema);
     QueryOperationSchema = /* @__PURE__ */ enumDesc(file_nomos_kernel_v1_kernel, 6);
@@ -1727,6 +1734,8 @@ __export(engine_exports, {
   author: () => author,
   authorEphemeral: () => authorEphemeral,
   authorKeygen: () => authorKeygen,
+  authorModelLifecyclePromotion: () => authorModelLifecyclePromotion,
+  authorModelLifecycleStage: () => authorModelLifecycleStage,
   authorOn: () => authorOn,
   authorOperatorCall: () => authorOperatorCall,
   backupHead: () => backupHead,
@@ -2179,6 +2188,100 @@ function workspaceGenesis(eng, ws) {
 function authorOperatorCall(eng, ws, call, controllerHash, opts = {}) {
   return author(eng, ws, call.domain, call.directive, call.canonicalUsda, controllerHash, opts);
 }
+function authorModelLifecycleStage(eng, ws, lawUsdz, installedBy, supersedes, opts = {}) {
+  const sequence = eng.seq++;
+  const captured = {
+    physical: Date.now(),
+    logical: 0,
+    replica: eng.replica
+  };
+  const response = offerRequestResponse(eng, create(OfferRequestSchema, {
+    target: protoTarget(ws),
+    intent: {
+      case: "modelLifecycle",
+      value: create(ModelLifecycleIntentSchema, {
+        operation: ModelLifecycleOperation.STAGE,
+        installedBy,
+        supersedes
+      })
+    },
+    authoring: create(AuthoringOptionsSchema, {
+      actor: opts.actor ?? "",
+      authToken: opts.authToken ? enc3.encode(opts.authToken) : new Uint8Array(),
+      authorSecret: opts.authorSecret ? bytesFromB64(opts.authorSecret) : new Uint8Array(),
+      validFromEpoch: opts.validFromEpoch === void 0 ? void 0 : BigInt(opts.validFromEpoch),
+      rng: osEntropyBuffer(opts.rngDraws ?? 64),
+      deferProjection: opts.deferProjection !== false,
+      spans: opts.spans ?? false,
+      sequence: BigInt(sequence),
+      clock: create(CapturedClockSchema, {
+        physicalMillis: BigInt(captured.physical),
+        logical: captured.logical,
+        replica: BigInt(captured.replica)
+      })
+    }),
+    lawUsdz
+  }));
+  return offerResult(response);
+}
+function authorModelLifecyclePromotion(eng, ws, transition, replaces, acceptanceReason, opts = {}) {
+  const sequence = eng.seq++;
+  const captured = {
+    physical: Date.now(),
+    logical: 0,
+    replica: eng.replica
+  };
+  const dispositions = transition.dispositions === void 0 ? void 0 : create(FrontierTransitionDispositionsSchema, {
+    retired: [...transition.dispositions.retired],
+    retyped: Object.entries(transition.dispositions.retyped).map(
+      ([sourceStableId, acknowledgement]) => create(FrontierTransitionDispositionMapEntrySchema, { sourceStableId, acknowledgement })
+    ),
+    rebinds: Object.entries(transition.dispositions.rebinds).map(
+      ([sourceStableId, acknowledgement]) => create(FrontierTransitionDispositionMapEntrySchema, { sourceStableId, acknowledgement })
+    ),
+    acknowledgedBy: transition.dispositions.ackBy
+  });
+  const response = offerRequestResponse(eng, create(OfferRequestSchema, {
+    target: protoTarget(ws),
+    intent: {
+      case: "modelLifecycle",
+      value: create(ModelLifecycleIntentSchema, {
+        operation: ModelLifecycleOperation.PROMOTE,
+        replaces,
+        acceptanceReason,
+        transition: create(FrontierTransitionResponseSchema, {
+          atHash: transition.atHash,
+          currentHash: transition.currentHash,
+          atStateRoot: transition.atStateRoot ?? "",
+          candidateHash: transition.candidateHash,
+          domain: transition.domain,
+          domains: [...transition.domains ?? []],
+          ready: transition.ready,
+          violations: transition.evolve.violations.map(
+            ({ domain, detail }) => create(FrontierTransitionViolationSchema, { domain, detail })
+          ),
+          dispositions
+        })
+      })
+    },
+    authoring: create(AuthoringOptionsSchema, {
+      actor: opts.actor ?? "",
+      authToken: opts.authToken ? enc3.encode(opts.authToken) : new Uint8Array(),
+      authorSecret: opts.authorSecret ? bytesFromB64(opts.authorSecret) : new Uint8Array(),
+      validFromEpoch: opts.validFromEpoch === void 0 ? void 0 : BigInt(opts.validFromEpoch),
+      rng: osEntropyBuffer(opts.rngDraws ?? 64),
+      deferProjection: opts.deferProjection !== false,
+      spans: opts.spans ?? false,
+      sequence: BigInt(sequence),
+      clock: create(CapturedClockSchema, {
+        physicalMillis: BigInt(captured.physical),
+        logical: captured.logical,
+        replica: BigInt(captured.replica)
+      })
+    })
+  }));
+  return offerResult(response);
+}
 function initializeWorkspace(eng, ws, installedBy = eng.installedBy) {
   const sequence = eng.seq++;
   const captured = {
@@ -4690,11 +4793,12 @@ function promotePreflighted(eng, ws, domain, candidateHash, opts = {}) {
     acceptanceReason: _acceptance,
     ...authorOpts
   } = opts;
-  const result = authorOperatorCall(
+  const result = authorModelLifecyclePromotion(
     eng,
     ws,
-    promoteDomainCall(ws, prepared.payload),
-    requireCurrentControllerLawHash(eng, ws),
+    report,
+    prepared.payload.replaces,
+    prepared.payload.preflight.acceptanceReason,
     {
       ...authorOpts,
       ...actingPrincipal ? { actor: actingPrincipal } : {}

package/dist/full-cli.mjs

@@ -7821,8 +7821,24 @@ function firstDeviceDelegationPayload(route, certificate, typedPayload) {
   if (declared.has("delegationCertificate")) {
     return { delegationCertificate: typedPayload };
   }
-  throw new Error(
-    `Nomos application route '${route.domain}${route.path}' does not declare the typed 'delegationCertificate' contract [nomos.application.contract_missing]`
+  throw new NomosClientError(
+    `Nomos application route '${route.domain}${route.path}' does not declare the typed 'delegationCertificate' contract`,
+    {
+      code: "nomos.application.contract_missing",
+      operation: "enrollFirstDevice",
+      recommendedAction: NomosRecommendedAction.redeployLaw,
+      info: {
+        code: "nomos.application.contract_missing",
+        message: `Nomos application route '${route.domain}${route.path}' does not declare the typed 'delegationCertificate' contract`,
+        component: "nomos.application",
+        domain: route.domain,
+        operation: "enrollFirstDevice",
+        attributes: {
+          "nomos.application.missing_contract": "delegationCertificate",
+          "nomos.recovery.action": "repeat-parent-authorized-birth"
+        }
+      }
+    }
   );
 }
 function jwtClaimOf(token, claim) {
@@ -18511,7 +18527,7 @@ var init_lifecycle_calls2 = __esm({
 
 // vendor/engine/proto/nomos/kernel/v1/kernel_pb.js
 import { enumDesc as enumDesc4, fileDesc as fileDesc5, messageDesc as messageDesc5, serviceDesc as serviceDesc3, tsEnum as tsEnum4 } from "@bufbuild/protobuf/codegenv2";
-var file_nomos_kernel_v1_kernel2, CallRequestSchema2, CallResponseSchema2, PrepareRemoteOfferRequestSchema2, PrepareRemoteOfferResponseSchema2, ApplyWorkspaceEffectRequestSchema, ApplyWorkspaceEffectResponseSchema, WorkspaceTargetSchema2, InitializeWorkspaceRequestSchema, DirectiveCallSchema3, AuthoringOptionsSchema3, CapturedClockSchema3, BirthCertificateSchema3, SignBirthCertificateRequestSchema2, OfferRequestSchema3, QueryRequestSchema3, QueryAuthoritySchema3, InjectedKeySchema2, RowsQuerySchema3, PageQuerySchema3, ByIdQuerySchema3, ByTypeQuerySchema2, TallyQuerySchema3, SpatialQuerySchema3, PendingConflictsQuerySchema2, PendingConflictSummaryQuerySchema2, NamedQuerySchema3, FrontierTransitionRequestSchema2, AuthorizationObjectSchema3, AuthorizationSubjectSchema3, AuthorizationConsistencySchema3, AuthorizationCheckRequestSchema3, AuthorizationExpandRequestSchema, OutboxRequestSchema, SyncRequestSchema3, TestRequestSchema3, SetTestRootRequestSchema3, CustodyRequestSchema2, ResidentFootprintRequestSchema, PackDeltaRequestSchema2, ApplyPackRequestSchema2, RepoStatsRequestSchema2, IntentsAboveRequestSchema3, InspectChangeRequestSchema, RefusalVerdictSchema, EncodeRefusalVerdictRequestSchema, InspectRefusalVerdictRequestSchema, ProveCompactionEquivalenceRequestSchema, ReadBlobRequestSchema, ResolveRefRequestSchema2, ListRefsRequestSchema, WriteRefRequestSchema3, DeleteRefRequestSchema3, WriteMetaCommitRequestSchema, LawClosureInfoRequestSchema2, CheckpointExportRequestSchema2, VerifiedFrontierReceiptSchema, StoredCheckpointManifestSchema, CheckpointImportRequestSchema3, CapacityReserveRequestSchema2, RestoreMainRequestSchema2, ResolveStatePositionRequestSchema, NomosValueSchema2, NomosStructSchema2, BirthOutcomeStatusSchema2, BirthOutcomeStatus2, QueryResultFormatSchema2, QueryResultFormat2, QueryOperationSchema2, QueryOperation3, KernelLawCapabilitySchema2, KernelLawCapability2, CheckpointCompressionSchema, CheckpointCompression, CheckpointVerificationPolicySchema, CheckpointVerificationPolicy, CheckpointAssuranceSchema, CheckpointAssurance, IntentTransportRequirementSchema2, IntentTransportRequirement3, LifecycleInstallPhaseSchema, LifecycleInstallPhase;
+var file_nomos_kernel_v1_kernel2, CallRequestSchema2, CallResponseSchema2, PrepareRemoteOfferRequestSchema2, PrepareRemoteOfferResponseSchema2, ApplyWorkspaceEffectRequestSchema, ApplyWorkspaceEffectResponseSchema, WorkspaceTargetSchema2, InitializeWorkspaceRequestSchema, DirectiveCallSchema3, AuthoringOptionsSchema3, CapturedClockSchema3, BirthCertificateSchema3, SignBirthCertificateRequestSchema2, ModelLifecycleIntentSchema2, OfferRequestSchema3, QueryRequestSchema3, QueryAuthoritySchema3, InjectedKeySchema2, RowsQuerySchema3, PageQuerySchema3, ByIdQuerySchema3, ByTypeQuerySchema2, TallyQuerySchema3, SpatialQuerySchema3, PendingConflictsQuerySchema2, PendingConflictSummaryQuerySchema2, NamedQuerySchema3, FrontierTransitionRequestSchema2, FrontierTransitionDispositionMapEntrySchema, FrontierTransitionDispositionsSchema, FrontierTransitionViolationSchema, FrontierTransitionResponseSchema, AuthorizationObjectSchema3, AuthorizationSubjectSchema3, AuthorizationConsistencySchema3, AuthorizationCheckRequestSchema3, AuthorizationExpandRequestSchema, OutboxRequestSchema, SyncRequestSchema3, TestRequestSchema3, SetTestRootRequestSchema3, CustodyRequestSchema2, ResidentFootprintRequestSchema, PackDeltaRequestSchema2, ApplyPackRequestSchema2, RepoStatsRequestSchema2, IntentsAboveRequestSchema3, InspectChangeRequestSchema, RefusalVerdictSchema, EncodeRefusalVerdictRequestSchema, InspectRefusalVerdictRequestSchema, ProveCompactionEquivalenceRequestSchema, ReadBlobRequestSchema, ResolveRefRequestSchema2, ListRefsRequestSchema, WriteRefRequestSchema3, DeleteRefRequestSchema3, WriteMetaCommitRequestSchema, LawClosureInfoRequestSchema2, CheckpointExportRequestSchema2, VerifiedFrontierReceiptSchema, StoredCheckpointManifestSchema, CheckpointImportRequestSchema3, CapacityReserveRequestSchema2, RestoreMainRequestSchema2, ResolveStatePositionRequestSchema, NomosValueSchema2, NomosStructSchema2, BirthOutcomeStatusSchema2, BirthOutcomeStatus2, ModelLifecycleOperationSchema2, ModelLifecycleOperation3, QueryResultFormatSchema2, QueryResultFormat2, QueryOperationSchema2, QueryOperation3, KernelLawCapabilitySchema2, KernelLawCapability2, CheckpointCompressionSchema, CheckpointCompression, CheckpointVerificationPolicySchema, CheckpointVerificationPolicy, CheckpointAssuranceSchema, CheckpointAssurance, IntentTransportRequirementSchema2, IntentTransportRequirement3, LifecycleInstallPhaseSchema, LifecycleInstallPhase;
 var init_kernel_pb2 = __esm({
   "vendor/engine/proto/nomos/kernel/v1/kernel_pb.js"() {
     "use strict";
@@ -18529,6 +18545,7 @@ var init_kernel_pb2 = __esm({
     CapturedClockSchema3 = /* @__PURE__ */ messageDesc5(file_nomos_kernel_v1_kernel2, 49);
     BirthCertificateSchema3 = /* @__PURE__ */ messageDesc5(file_nomos_kernel_v1_kernel2, 50);
     SignBirthCertificateRequestSchema2 = /* @__PURE__ */ messageDesc5(file_nomos_kernel_v1_kernel2, 51);
+    ModelLifecycleIntentSchema2 = /* @__PURE__ */ messageDesc5(file_nomos_kernel_v1_kernel2, 53);
     OfferRequestSchema3 = /* @__PURE__ */ messageDesc5(file_nomos_kernel_v1_kernel2, 54);
     QueryRequestSchema3 = /* @__PURE__ */ messageDesc5(file_nomos_kernel_v1_kernel2, 57);
     QueryAuthoritySchema3 = /* @__PURE__ */ messageDesc5(file_nomos_kernel_v1_kernel2, 64);
@@ -18543,6 +18560,10 @@ var init_kernel_pb2 = __esm({
     PendingConflictSummaryQuerySchema2 = /* @__PURE__ */ messageDesc5(file_nomos_kernel_v1_kernel2, 77);
     NamedQuerySchema3 = /* @__PURE__ */ messageDesc5(file_nomos_kernel_v1_kernel2, 78);
     FrontierTransitionRequestSchema2 = /* @__PURE__ */ messageDesc5(file_nomos_kernel_v1_kernel2, 79);
+    FrontierTransitionDispositionMapEntrySchema = /* @__PURE__ */ messageDesc5(file_nomos_kernel_v1_kernel2, 80);
+    FrontierTransitionDispositionsSchema = /* @__PURE__ */ messageDesc5(file_nomos_kernel_v1_kernel2, 81);
+    FrontierTransitionViolationSchema = /* @__PURE__ */ messageDesc5(file_nomos_kernel_v1_kernel2, 82);
+    FrontierTransitionResponseSchema = /* @__PURE__ */ messageDesc5(file_nomos_kernel_v1_kernel2, 83);
     AuthorizationObjectSchema3 = /* @__PURE__ */ messageDesc5(file_nomos_kernel_v1_kernel2, 84);
     AuthorizationSubjectSchema3 = /* @__PURE__ */ messageDesc5(file_nomos_kernel_v1_kernel2, 85);
     AuthorizationConsistencySchema3 = /* @__PURE__ */ messageDesc5(file_nomos_kernel_v1_kernel2, 87);
@@ -18581,6 +18602,8 @@ var init_kernel_pb2 = __esm({
     NomosStructSchema2 = /* @__PURE__ */ messageDesc5(file_nomos_kernel_v1_kernel2, 166);
     BirthOutcomeStatusSchema2 = /* @__PURE__ */ enumDesc4(file_nomos_kernel_v1_kernel2, 0);
     BirthOutcomeStatus2 = /* @__PURE__ */ tsEnum4(BirthOutcomeStatusSchema2);
+    ModelLifecycleOperationSchema2 = /* @__PURE__ */ enumDesc4(file_nomos_kernel_v1_kernel2, 3);
+    ModelLifecycleOperation3 = /* @__PURE__ */ tsEnum4(ModelLifecycleOperationSchema2);
     QueryResultFormatSchema2 = /* @__PURE__ */ enumDesc4(file_nomos_kernel_v1_kernel2, 5);
     QueryResultFormat2 = /* @__PURE__ */ tsEnum4(QueryResultFormatSchema2);
     QueryOperationSchema2 = /* @__PURE__ */ enumDesc4(file_nomos_kernel_v1_kernel2, 6);
@@ -18690,6 +18713,8 @@ __export(engine_exports, {
   author: () => author,
   authorEphemeral: () => authorEphemeral,
   authorKeygen: () => authorKeygen,
+  authorModelLifecyclePromotion: () => authorModelLifecyclePromotion,
+  authorModelLifecycleStage: () => authorModelLifecycleStage,
   authorOn: () => authorOn,
   authorOperatorCall: () => authorOperatorCall,
   backupHead: () => backupHead,
@@ -19142,6 +19167,100 @@ function workspaceGenesis(eng, ws) {
 function authorOperatorCall(eng, ws, call, controllerHash, opts = {}) {
   return author(eng, ws, call.domain, call.directive, call.canonicalUsda, controllerHash, opts);
 }
+function authorModelLifecycleStage(eng, ws, lawUsdz, installedBy, supersedes, opts = {}) {
+  const sequence = eng.seq++;
+  const captured = {
+    physical: Date.now(),
+    logical: 0,
+    replica: eng.replica
+  };
+  const response = offerRequestResponse(eng, create7(OfferRequestSchema3, {
+    target: protoTarget2(ws),
+    intent: {
+      case: "modelLifecycle",
+      value: create7(ModelLifecycleIntentSchema2, {
+        operation: ModelLifecycleOperation3.STAGE,
+        installedBy,
+        supersedes
+      })
+    },
+    authoring: create7(AuthoringOptionsSchema3, {
+      actor: opts.actor ?? "",
+      authToken: opts.authToken ? enc7.encode(opts.authToken) : new Uint8Array(),
+      authorSecret: opts.authorSecret ? bytesFromB64(opts.authorSecret) : new Uint8Array(),
+      validFromEpoch: opts.validFromEpoch === void 0 ? void 0 : BigInt(opts.validFromEpoch),
+      rng: osEntropyBuffer2(opts.rngDraws ?? 64),
+      deferProjection: opts.deferProjection !== false,
+      spans: opts.spans ?? false,
+      sequence: BigInt(sequence),
+      clock: create7(CapturedClockSchema3, {
+        physicalMillis: BigInt(captured.physical),
+        logical: captured.logical,
+        replica: BigInt(captured.replica)
+      })
+    }),
+    lawUsdz
+  }));
+  return offerResult(response);
+}
+function authorModelLifecyclePromotion(eng, ws, transition, replaces, acceptanceReason, opts = {}) {
+  const sequence = eng.seq++;
+  const captured = {
+    physical: Date.now(),
+    logical: 0,
+    replica: eng.replica
+  };
+  const dispositions2 = transition.dispositions === void 0 ? void 0 : create7(FrontierTransitionDispositionsSchema, {
+    retired: [...transition.dispositions.retired],
+    retyped: Object.entries(transition.dispositions.retyped).map(
+      ([sourceStableId, acknowledgement]) => create7(FrontierTransitionDispositionMapEntrySchema, { sourceStableId, acknowledgement })
+    ),
+    rebinds: Object.entries(transition.dispositions.rebinds).map(
+      ([sourceStableId, acknowledgement]) => create7(FrontierTransitionDispositionMapEntrySchema, { sourceStableId, acknowledgement })
+    ),
+    acknowledgedBy: transition.dispositions.ackBy
+  });
+  const response = offerRequestResponse(eng, create7(OfferRequestSchema3, {
+    target: protoTarget2(ws),
+    intent: {
+      case: "modelLifecycle",
+      value: create7(ModelLifecycleIntentSchema2, {
+        operation: ModelLifecycleOperation3.PROMOTE,
+        replaces,
+        acceptanceReason,
+        transition: create7(FrontierTransitionResponseSchema, {
+          atHash: transition.atHash,
+          currentHash: transition.currentHash,
+          atStateRoot: transition.atStateRoot ?? "",
+          candidateHash: transition.candidateHash,
+          domain: transition.domain,
+          domains: [...transition.domains ?? []],
+          ready: transition.ready,
+          violations: transition.evolve.violations.map(
+            ({ domain, detail }) => create7(FrontierTransitionViolationSchema, { domain, detail })
+          ),
+          dispositions: dispositions2
+        })
+      })
+    },
+    authoring: create7(AuthoringOptionsSchema3, {
+      actor: opts.actor ?? "",
+      authToken: opts.authToken ? enc7.encode(opts.authToken) : new Uint8Array(),
+      authorSecret: opts.authorSecret ? bytesFromB64(opts.authorSecret) : new Uint8Array(),
+      validFromEpoch: opts.validFromEpoch === void 0 ? void 0 : BigInt(opts.validFromEpoch),
+      rng: osEntropyBuffer2(opts.rngDraws ?? 64),
+      deferProjection: opts.deferProjection !== false,
+      spans: opts.spans ?? false,
+      sequence: BigInt(sequence),
+      clock: create7(CapturedClockSchema3, {
+        physicalMillis: BigInt(captured.physical),
+        logical: captured.logical,
+        replica: BigInt(captured.replica)
+      })
+    })
+  }));
+  return offerResult(response);
+}
 function initializeWorkspace(eng, ws, installedBy = eng.installedBy) {
   const sequence = eng.seq++;
   const captured = {
@@ -21653,11 +21772,12 @@ function promotePreflighted(eng, ws, domain, candidateHash, opts = {}) {
     acceptanceReason: _acceptance,
     ...authorOpts
   } = opts;
-  const result = authorOperatorCall(
+  const result = authorModelLifecyclePromotion(
     eng,
     ws,
-    promoteDomainCall(ws, prepared.payload),
-    requireCurrentControllerLawHash(eng, ws),
+    report,
+    prepared.payload.replaces,
+    prepared.payload.preflight.acceptanceReason,
     {
       ...authorOpts,
       ...actingPrincipal ? { actor: actingPrincipal } : {}
@@ -31905,7 +32025,6 @@ async function status(wsArg, opts) {
 
 // src/proof_upgrade.ts
 init_engine();
-init_lifecycle_calls2();
 init_cloud();
 init_governance();
 init_local_holon();
@@ -32033,27 +32152,33 @@ async function mountReadOnlyCopy(eng, source, cloud) {
 function tenantPredecessors(candidateDomains, current, frameworkHashes) {
   return [...new Set(candidateDomains.map((domain) => current[domain]).filter((hash) => typeof hash === "string" && !frameworkHashes.has(hash)))];
 }
-function printDifferences(report) {
-  out11(`  replayed  ${report.replayedIntents} historical intent(s); ${report.candidateIntents} candidate action(s)`);
-  for (const difference of report.divergences.slice(0, 12)) {
-    const location = [difference.domain, difference.directiveId].filter(Boolean).join(".");
-    out11(`  changed   ${difference.kind}${location ? ` at ${location}` : ""}: ${difference.detail}`);
+function upgradeControllerLawHash(installed, bundledControllerHash) {
+  const active = installed["nomos"];
+  if (typeof active === "string" && /^[0-9a-f]{64}$/.test(active)) return active;
+  if (/^[0-9a-f]{64}$/.test(bundledControllerHash)) return bundledControllerHash;
+  throw new Error("the copied workspace declares no active Nomos lifecycle controller");
+}
+function printFrontier(report) {
+  out11(`  frontier  ${report.atHash.slice(0, 12)}\u2026 state ${report.atStateRoot?.slice(0, 12) ?? "unknown"}\u2026`);
+  out11(`  evolution ${report.ready ? "admissible" : "refused"}`);
+  for (const violation of report.evolve.violations) {
+    out11(`  violation ${violation.domain}: ${violation.detail}`);
   }
-  if (report.divergences.length > 12) out11(`  changed   + ${report.divergences.length - 12} more difference(s)`);
 }
 function localAuthorIdentity(explicitPrincipal) {
   const selectedPrincipal = explicitPrincipal ?? activePrincipal() ?? ACTOR;
   const actor = canonicalPrincipal2(selectedPrincipal);
   const bareActor = actor.startsWith("user:") ? actor.slice("user:".length) : actor;
   const device = getDeviceKey(selectedPrincipal) ?? getDeviceKey(actor) ?? getDeviceKey(bareActor);
-  if (device?.secret === void 0) {
+  const authorSecret = process.env["NOMOS_AUTHOR_SECRET"]?.trim() || device?.secret;
+  if (authorSecret === void 0) {
     throw new Error(
       `upgrade proof needs an enrolled signing device for '${actor}' \u2014 select one with --as <uid> or import/enroll its key first`
     );
   }
   return {
     actor,
-    authorSecret: device.secret
+    authorSecret
   };
 }
 async function runUpgradeProof(sourceArg, lawUsdzPath, opts = {}) {
@@ -32071,7 +32196,11 @@ async function runUpgradeProof(sourceArg, lawUsdzPath, opts = {}) {
     return 1;
   }
   try {
-    const identity = localAuthorIdentity(opts.principal);
+    const localIdentity = localAuthorIdentity(opts.principal);
+    const identity = {
+      ...localIdentity,
+      ...process.env["NOMOS_AUTH_TOKEN"] ? { authToken: process.env["NOMOS_AUTH_TOKEN"] } : {}
+    };
     const { eng: sourceEngine, runtime } = await holonEngine(cloud, identity.actor);
     const mounted = await mountReadOnlyCopy(sourceEngine, source, cloud);
     const sourceVerdict = verifyChainLocal(sourceEngine, WORKSPACE);
@@ -32092,10 +32221,11 @@ async function runUpgradeProof(sourceArg, lawUsdzPath, opts = {}) {
     const candidate = inspectLawArchive(eng, lawUsdzPath);
     if (candidate.domainKeys.length === 0) throw new Error("candidate law archive carries no business domains");
     const before = currentLaw(eng, WORKSPACE);
+    const controllerLawHash = upgradeControllerLawHash(before, eng.hashes.nomos);
     const predecessors = tenantPredecessors(
       candidate.domainKeys,
       before,
-      /* @__PURE__ */ new Set([eng.hashes.bootstrap, eng.hashes.nomos])
+      /* @__PURE__ */ new Set([eng.hashes.bootstrap, eng.hashes.nomos, controllerLawHash])
     );
     const alreadyCurrent = candidate.domainKeys.every((domain) => before[domain] === candidate.identity);
     if (alreadyCurrent) {
@@ -32113,20 +32243,23 @@ async function runUpgradeProof(sourceArg, lawUsdzPath, opts = {}) {
         );
       }
       const predecessor = predecessors[0];
-      const staged = authorOperatorCall(
+      const staged = authorModelLifecycleStage(
         eng,
         WORKSPACE,
-        stageDomainCall(
-          WORKSPACE,
-          closureInstallPayload(candidate.identity, identity.actor, { supersedes: predecessor })
-        ),
-        eng.hashes.nomos,
-        { ...identity, lawUsdz: candidate.lawUsdz }
+        candidate.lawUsdz,
+        identity.actor,
+        predecessor,
+        identity
       );
-      if (staged.ok === false) throw new Error(`candidate staging refused: ${staged.error ?? "unknown refusal"}`);
+      if (staged.ok === false) {
+        const authority = /authoriz|not permitted/i.test(staged.error ?? "") ? expand(eng, WORKSPACE, "workspace:self", "installDomain").subjects : [];
+        throw new Error(
+          `candidate staging refused: ${staged.error ?? "unknown refusal"}` + (authority.length > 0 ? `; lifecycle authority is held by ${authority.join(", ")}` : "")
+        );
+      }
       const stagedHead = kgit.resolveRef(eng, gitdirOf(WORKSPACE), "refs/heads/main");
       if (!stagedHead) throw new Error("candidate staging produced no current head");
-      const report = historyPreflight(
+      const report = frontierTransition(
         eng,
         WORKSPACE,
         candidate.domainKeys[0],
@@ -32137,21 +32270,13 @@ async function runUpgradeProof(sourceArg, lawUsdzPath, opts = {}) {
       out11(`githolon proof --upgrade \u2014 ${source} (${mounted.location}, never modified)`);
       out11(`  current   ${predecessor.slice(0, 16)}\u2026`);
       out11(`  candidate ${candidate.identity.slice(0, 16)}\u2026  (${candidate.domainKeys.join(", ")})`);
-      printDifferences(report);
-      if (!report.sourceVerified || !report.complete || !report.evolve.ok) {
-        throw new Error(
-          !report.sourceVerified ? "the source history did not verify" : !report.complete ? "the candidate could not re-derive every historical premise" : `typed evolution refused: ${report.evolve.violations.map((violation) => violation.detail).join("; ")}`
-        );
-      }
-      if (!report.promotable && !opts.acceptanceReason?.trim()) {
-        throw new Error(
-          'the candidate deliberately changes historical business outcomes; review the differences above, then rerun with --acceptance-reason "why this change is correct"'
-        );
+      printFrontier(report);
+      if (!report.ready || !report.evolve.ok) {
+        throw new Error(`typed evolution refused: ${report.evolve.violations.map((violation) => violation.detail).join("; ")}`);
       }
       const promoted = promotePreflighted(eng, WORKSPACE, candidate.domainKeys[0], candidate.identity, {
         ...identity,
         replaces: predecessor,
-        retireReplaced: true,
         ...opts.acceptanceReason?.trim() ? { acceptanceReason: opts.acceptanceReason.trim() } : {}
       });
       if (!promoted.ok) throw new Error(`disposable promotion refused at ${promoted.stage}: ${promoted.error}`);
@@ -32161,7 +32286,7 @@ async function runUpgradeProof(sourceArg, lawUsdzPath, opts = {}) {
           throw new Error(`promotion completed but ${domain} does not resolve to the candidate model`);
         }
       }
-      out11(`\u2713 exact-history promotion admitted in the disposable copy`);
+      out11(`\u2713 current-frontier promotion admitted in the disposable copy`);
     }
     const warmVerdict = verifyChainLocal(eng, WORKSPACE);
     if (warmVerdict.valid !== true) throw new Error(`promoted chain failed verification: ${String(warmVerdict.error ?? "unknown refusal")}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.108.3",
+  "version": "0.108.4",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -30,7 +30,7 @@
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
     "@bufbuild/protobuf": "^2.13.0",
-    "@githolon/dsl": "^0.108.3",
+    "@githolon/dsl": "^0.108.4",
     "fast-xml-parser": "5.10.1",
     "isomorphic-git": "^1.38.4",
     "tsx": "^4.19.2"