githolon 0.15.0 → 0.16.1

package/dist/cli.mjs

@@ -190,7 +190,7 @@ async function wsCreate(name, opts) {
     out(`  session saved \u2192 ${credsPath()} (auto-refreshed; births ride x-nomos-auth)`);
     principal = s.accessToken;
   }
-  const r = await fetch(`${cloud}/v1/workspaces/${name}`, {
+  const r = await fetch(`${cloud}/v2/workspaces/${name}`, {
     method: "POST",
     headers: principalHeaders(principal)
   });
@@ -214,7 +214,7 @@ async function wsCreate(name, opts) {
 }
 async function wsStatus(name, opts) {
   const cloud = cloudBase(opts.cloud);
-  const r = await fetch(`${cloud}/v1/workspaces/${name}`);
+  const r = await fetch(`${cloud}/v2/workspaces/${name}`);
   const text = await r.text();
   if (!r.ok) {
     err(`status '${name}' (${r.status}): ${text}`);
@@ -233,7 +233,7 @@ async function wsRetire(ws, opts) {
     );
     return 1;
   }
-  const r = await fetch(`${cloud}/v1/workspaces/${ws}/retire`, {
+  const r = await fetch(`${cloud}/v2/workspaces/${ws}/retire`, {
     method: "POST",
     headers: { authorization: `Bearer ${secret}` }
   });
@@ -249,7 +249,7 @@ async function wsRetire(ws, opts) {
   out(`\u2713 workspace ${ws} retired on ${cloud}${d.alreadyRetired === true ? " (it was already retired)" : ""}`);
   out("  nothing was deleted \u2014 the ledger and its data are retained per the Nomos Pre-Release License");
   out("  it no longer counts toward your workspace allowance; reads keep serving, deploys/pushes refuse");
-  out("  to un-retire: contact the operator (an admin restores the record via POST /v1/root/governance)");
+  out("  to un-retire: contact the operator (an admin restores the record via root's governance offer, POST /v2/workspaces/root/createWorkspace)");
   return 0;
 }
 async function deploy(ws, opts) {
@@ -270,8 +270,8 @@ async function deploy(ws, opts) {
     );
     return 1;
   }
-  const before = await fetch(`${cloud}/v1/workspaces/${ws}/domains`).then((br) => br.json()).then((bd) => bd.ok === true ? bd.domains ?? [] : []).catch(() => []);
-  const r = await fetch(`${cloud}/v1/workspaces/${ws}/domains`, {
+  const before = await fetch(`${cloud}/v2/workspaces/${ws}/domains`).then((br) => br.json()).then((bd) => bd.ok === true ? bd.domains ?? [] : []).catch(() => []);
+  const r = await fetch(`${cloud}/v2/workspaces/${ws}/domains`, {
     method: "POST",
     headers: { "content-type": "application/json", authorization: `Bearer ${secret}` },
     body: readFileSync(file, "utf8")
@@ -310,7 +310,7 @@ async function secretRotate(ws, opts) {
     err(`no stored secret for ${ws} on ${cloud} \u2014 githolon secret set ${ws} <secret> first`);
     return 1;
   }
-  const r = await fetch(`${cloud}/v1/workspaces/${ws}/rotate-secret`, {
+  const r = await fetch(`${cloud}/v2/workspaces/${ws}/rotate-secret`, {
     method: "POST",
     headers: { authorization: `Bearer ${current}` }
   });
@@ -449,30 +449,182 @@ var init_tree = __esm({
   }
 });
 
+// vendor/engine/custody-transport.mjs
+function concatBytes(chunks) {
+  let n = 0;
+  for (const c of chunks) n += c.length;
+  const out9 = new Uint8Array(n);
+  let o = 0;
+  for (const c of chunks) {
+    out9.set(c, o);
+    o += c.length;
+  }
+  return out9;
+}
+function pkt(payload) {
+  const body = typeof payload === "string" ? enc2.encode(payload) : payload;
+  const len = (body.length + 4).toString(16).padStart(4, "0");
+  return concatBytes([enc2.encode(len), body]);
+}
+function readPktLines(buf, off = 0) {
+  const lines = [];
+  while (off + 4 <= buf.length) {
+    const hex = dec2.decode(buf.subarray(off, off + 4));
+    if (!/^[0-9a-f]{4}$/.test(hex)) break;
+    const len = parseInt(hex, 16);
+    if (len === 0) {
+      off += 4;
+      break;
+    }
+    if (len < 4 || off + len > buf.length) break;
+    lines.push(buf.subarray(off + 4, off + len));
+    off += len;
+  }
+  return { lines, rest: off };
+}
+async function lsRefs(remote, headers = {}, { service = "git-upload-pack", prefix = null } = {}) {
+  const r = await fetch(`${remote}/info/refs?service=${service}`, { headers });
+  if (!r.ok) {
+    if (r.status === 404) return {};
+    throw new Error(`info/refs ${r.status}: ${(await r.text()).slice(0, 180)}`);
+  }
+  const buf = new Uint8Array(await r.arrayBuffer());
+  const banner = readPktLines(buf, 0);
+  const { lines } = readPktLines(buf, banner.rest);
+  const refs = {};
+  for (const line of lines) {
+    let s = dec2.decode(line).replace(/\n$/, "");
+    if (s.startsWith("#")) continue;
+    const nul = s.indexOf("\0");
+    if (nul >= 0) s = s.slice(0, nul);
+    const sp = s.indexOf(" ");
+    if (sp !== 40) continue;
+    const oid = s.slice(0, 40), name = s.slice(41);
+    if (!/^[0-9a-f]{40}$/.test(oid)) continue;
+    if (prefix && !name.startsWith(prefix)) continue;
+    refs[name] = oid;
+  }
+  return refs;
+}
+async function fetchPack(remote, headers = {}, { wants = [], haves = [] } = {}) {
+  wants = wants.filter((w) => /^[0-9a-f]{40}$/.test(w) && w !== ZERO_OID);
+  if (!wants.length) return null;
+  const caps = "thin-pack ofs-delta agent=nomos-cloud";
+  const parts = [];
+  wants.forEach((w, i) => parts.push(pkt(`want ${w}${i === 0 ? " " + caps : ""}
+`)));
+  parts.push(FLUSH);
+  for (const h of haves) if (/^[0-9a-f]{40}$/.test(h) && h !== ZERO_OID) parts.push(pkt(`have ${h}
+`));
+  parts.push(pkt("done\n"));
+  const r = await fetch(`${remote}/git-upload-pack`, {
+    method: "POST",
+    headers: { "content-type": "application/x-git-upload-pack-request", "accept": "application/x-git-upload-pack-result", ...headers },
+    body: concatBytes(parts)
+  });
+  if (!r.ok) throw new Error(`upload-pack ${r.status}: ${(await r.text()).slice(0, 180)}`);
+  const buf = new Uint8Array(await r.arrayBuffer());
+  const { lines, rest } = readPktLines(buf, 0);
+  const packChunks = [];
+  let sideband = false;
+  for (const line of lines) {
+    if (line.length === 0) continue;
+    const head = dec2.decode(line.subarray(0, Math.min(line.length, 3)));
+    if (head === "NAK" || head === "ACK" || head === "ERR" || head.startsWith("sha")) continue;
+    const band = line[0];
+    if (band === 1) {
+      packChunks.push(line.subarray(1));
+      sideband = true;
+    } else if (band === 2) {
+    } else if (band === 3) {
+      throw new Error("upload-pack fatal: " + dec2.decode(line.subarray(1)).slice(0, 180));
+    }
+  }
+  const pack = sideband ? concatBytes(packChunks) : buf.subarray(rest);
+  if (pack.length < 12 || dec2.decode(pack.subarray(0, 4)) !== "PACK") {
+    throw new Error(`upload-pack: no pack in response (${pack.length}B, sideband=${sideband})`);
+  }
+  return pack;
+}
+var enc2, dec2, ZERO_OID, EMPTY_PACK, FLUSH;
+var init_custody_transport = __esm({
+  "vendor/engine/custody-transport.mjs"() {
+    "use strict";
+    enc2 = new TextEncoder();
+    dec2 = new TextDecoder();
+    ZERO_OID = "0".repeat(40);
+    EMPTY_PACK = new Uint8Array([
+      80,
+      65,
+      67,
+      75,
+      0,
+      0,
+      0,
+      2,
+      0,
+      0,
+      0,
+      0,
+      // "PACK", ver 2, 0 objects
+      2,
+      157,
+      8,
+      130,
+      59,
+      216,
+      168,
+      234,
+      181,
+      16,
+      173,
+      106,
+      // sha1(the 12 header bytes)
+      199,
+      92,
+      130,
+      60,
+      253,
+      62,
+      211,
+      30
+    ]);
+    FLUSH = enc2.encode("0000");
+  }
+});
+
 // vendor/engine/engine.mjs
 import { WASI, File, Directory, OpenFile, ConsoleStdout, PreopenDirectory } from "@bjorn3/browser_wasi_shim";
-import git from "isomorphic-git";
-import http from "isomorphic-git/http/web";
+function b64Bytes(bytes) {
+  let s = "";
+  for (let i = 0; i < bytes.length; i += 32768) {
+    s += String.fromCharCode(...bytes.subarray(i, i + 32768));
+  }
+  return btoa(s);
+}
+function b64Json(o) {
+  return b64Bytes(enc3.encode(JSON.stringify(o)));
+}
 async function sha256hex(t) {
-  const b = await crypto.subtle.digest("SHA-256", enc2.encode(t));
+  const b = await crypto.subtle.digest("SHA-256", enc3.encode(t));
   return [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, "0")).join("");
 }
 function osEntropyBuffer(n) {
   const bytes = new Uint8Array(n * 8);
   for (let o = 0; o < bytes.length; o += 65536) crypto.getRandomValues(bytes.subarray(o, Math.min(o + 65536, bytes.length)));
-  const out10 = new Array(n), T = 2 ** 53;
+  const out9 = new Array(n), T = 2 ** 53;
   for (let i = 0; i < n; i++) {
     let z = 0n;
     for (let b = 7; b >= 0; b--) z = z << 8n | BigInt(bytes[i * 8 + b]);
-    out10[i] = Number(z >> 11n) / T;
+    out9[i] = Number(z >> 11n) / T;
   }
-  return out10;
+  return out9;
 }
 function stringifyBig(o) {
   return JSON.stringify(o, (_k, v) => typeof v === "bigint" ? `@@B:${v}@@` : v).replace(/"@@B:(\d+)@@"/g, "$1");
 }
 function call(ex, mode, fields, STDERR) {
-  const req = enc2.encode(JSON.stringify({ mode, ...fields }));
+  const req = enc3.encode(JSON.stringify({ mode, ...fields }));
   const reqPtr = ex.git_holon_alloc(req.length);
   try {
     new Uint8Array(ex.memory.buffer, reqPtr, req.length).set(req);
@@ -485,7 +637,7 @@ function call(ex, mode, fields, STDERR) {
     }
     const { ptr, len } = unpack(packed);
     try {
-      const e = JSON.parse(dec2.decode(new Uint8Array(ex.memory.buffer, ptr, len).slice()));
+      const e = JSON.parse(dec3.decode(new Uint8Array(ex.memory.buffer, ptr, len).slice()));
       if (!e.ok) throw new Error((e.error || "holon error") + (STDERR.length ? ` | ${STDERR.slice(-4).join(" / ")}` : ""));
       return e.result;
     } finally {
@@ -498,7 +650,7 @@ function call(ex, mode, fields, STDERR) {
 async function createEngine({ wasmModule, bootstrapPkg, nomosPkg, replica, installedBy = "nomos-cloud" }) {
   const hashes = { bootstrap: await sha256hex(bootstrapPkg), nomos: await sha256hex(nomosPkg) };
   const root = /* @__PURE__ */ new Map();
-  root.set("domain.package.usda", new File(enc2.encode(bootstrapPkg)));
+  root.set("domain.package.usda", new File(enc3.encode(bootstrapPkg)));
   root.set("ws", new Directory(/* @__PURE__ */ new Map()));
   const preopen = new PreopenDirectory("/work", root);
   const STDERR = [];
@@ -535,39 +687,18 @@ async function mountWorkspace(eng, ws, ledger) {
   if (eng.mounted.has(ws)) return eng.mounted.get(ws);
   stageWorkspaceDir(eng, ws);
   const gitdir = gitdirOf(ws);
-  let restored = false, remoteMain = null, restoreError = null, checkpoint = null;
+  let restored = false, remoteMain = null, restoreError = null;
   try {
-    const info = await git.getRemoteInfo({ http, url: ledger.remote, headers: ledger.headers });
-    remoteMain = info.refs && info.refs.heads && info.refs.heads.main || null;
+    await custodySkeleton(eng, gitdir);
+    remoteMain = await custodyFetch(eng, ws, ledger, { remoteRef: "refs/heads/main" });
     if (remoteMain) {
-      await git.init({ fs: eng.fs, gitdir, bare: true, defaultBranch: "main" });
-      await git.addRemote({ fs: eng.fs, gitdir, remote: "origin", url: ledger.remote, force: true });
-      const ckpt = await discoverCheckpointFromCustody(ledger).catch(() => null);
-      let shallowOk = false;
-      if (ckpt?.cursor && ckpt.frontier) {
-        const steps = [32, 96, 256, 1024];
-        for (let i = 0; i < steps.length; i++) {
-          const depth = steps[i], relative = i > 0;
-          await git.fetch({ fs: eng.fs, http, gitdir, remote: "origin", ref: "main", singleBranch: true, depth, relative, headers: ledger.headers });
-          if (await git.readCommit({ fs: eng.fs, gitdir, oid: ckpt.cursor }).then(() => true, () => false)) {
-            shallowOk = true;
-            break;
-          }
-        }
-      }
-      if (!shallowOk) await git.fetch({ fs: eng.fs, http, gitdir, remote: "origin", ref: "main", singleBranch: true, headers: ledger.headers });
-      await git.writeRef({ fs: eng.fs, gitdir, ref: "refs/heads/main", value: remoteMain, force: true });
-      await git.writeRef({ fs: eng.fs, gitdir, ref: "HEAD", value: "ref: refs/heads/main", force: true, symbolic: true });
-      if (shallowOk && ckpt?.blob) {
-        const r = importCheckpoint(eng, ws, ckpt.blob, ckpt.frontier);
-        checkpoint = { restored: !!(r && r.restored), frontierSeeded: !!(r && r.frontierSeeded), cursor: r && r.cursor ? r.cursor : ckpt.cursor, ref: ckpt.ref };
-      }
+      kgit.writeRef(eng, gitdir, "HEAD", "ref: refs/heads/main");
       restored = true;
     }
   } catch (e) {
     restoreError = String(e && e.stack || e).split("\n").slice(0, 5).join(" | ");
   }
-  const m = { restored, remoteMain, restoreError, checkpoint };
+  const m = { restored, remoteMain, restoreError };
   eng.mounted.set(ws, m);
   return m;
 }
@@ -586,108 +717,120 @@ function mintId(eng, typeTag) {
 function author(eng, ws, domain, directiveId, payload, controllerHash, opts = {}) {
   const seq = eng.seq++;
   const envelope = { payload: { domain, directiveId, payload }, captured_ports: { clock: { physical: Date.now(), logical: 0, replica: eng.replica }, rng: osEntropyBuffer(opts.rngDraws ?? 64) }, policy_version: 1, policy_domain: "Nomos", policy_gas: 0, policy_memory: 0 };
-  writeWork(eng, `payload-${seq}.json`, enc2.encode(JSON.stringify(payload)));
-  writeWork(eng, `envelope-${seq}.json`, enc2.encode(stringifyBig(envelope)));
+  writeWork(eng, `payload-${seq}.json`, enc3.encode(JSON.stringify(payload)));
+  writeWork(eng, `envelope-${seq}.json`, enc3.encode(stringifyBig(envelope)));
   const genesis = !controllerHash;
   const defer = opts.deferProjection !== false;
-  const res = JSON.parse(call(eng.ex, "author", { repoArg: repoArgOf(ws), workspace: ws, domain, directiveId, payloadFile: `/work/payload-${seq}.json`, envelopeFile: `/work/envelope-${seq}.json`, seq, actor: opts.actor ?? "", domainFile: genesis ? "/work/domain.package.usda" : "", domainHash: genesis ? "" : controllerHash, branch: BRANCH, ...opts.authorSecret ? { authorSecret: opts.authorSecret } : {}, ...defer ? { deferProjection: true } : {} }, eng.STDERR));
+  const v = JSON.parse(call(eng.ex, "offer", { repoArg: repoArgOf(ws), workspace: ws, domain, directiveId, payloadFile: `/work/payload-${seq}.json`, envelopeFile: `/work/envelope-${seq}.json`, seq, actor: opts.actor ?? "", domainFile: genesis ? "/work/domain.package.usda" : "", domainHash: genesis ? "" : controllerHash, branch: BRANCH, ...opts.authorSecret ? { authorSecret: opts.authorSecret } : {}, ...opts.dryRun ? { dryRun: true } : defer ? { deferProjection: true } : {} }, eng.STDERR));
+  const res = v.outcome === "admitted" ? { ok: true, head: v.head, intentOut: v.intentOut } : v.outcome === "refused" ? { ok: false, error: v.verdict?.reason ?? v.error } : v;
   if (defer && res.ok) (eng.pendingProjection ??= /* @__PURE__ */ new Set()).add(ws);
   return res;
 }
-function importCheckpoint(eng, ws, blobB64, frontierB64) {
-  return JSON.parse(call(eng.ex, "checkpoint_import", { repoArg: repoArgOf(ws), workspace: ws, branch: BRANCH, blob: blobB64, ...frontierB64 ? { frontier: frontierB64 } : {} }, eng.STDERR));
-}
-async function streamAll(stream) {
-  const chunks = [];
-  const reader = stream.getReader();
-  for (; ; ) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    chunks.push(value);
-  }
-  let len = 0;
-  for (const c of chunks) len += c.length;
-  const out10 = new Uint8Array(len);
-  let at = 0;
-  for (const c of chunks) {
-    out10.set(c, at);
-    at += c.length;
-  }
-  return out10;
-}
-async function gunzip(bytes) {
-  const ds = new DecompressionStream("gzip");
-  return streamAll(new Response(bytes).body.pipeThrough(ds));
-}
-async function discoverCheckpointFromCustody(ledger) {
-  const freshHeaders = () => ({ ...ledger.headers || {} });
-  const refs = (await git.listServerRefs({ http, url: ledger.remote, headers: freshHeaders(), prefix: "refs/meta/checkpoint/", protocolVersion: 2 }) || []).filter((r) => r.ref && r.ref.startsWith("refs/meta/checkpoint/") && r.oid);
-  if (!refs.length) return null;
-  const root = /* @__PURE__ */ new Map();
-  root.set("ckpt", new Directory(/* @__PURE__ */ new Map()));
-  const preopen = new PreopenDirectory("/work", root);
-  const fs = makeGitFs(preopen, "/work", { File, Directory });
-  const gitdir = "/work/ckpt/nomos.git";
-  await git.init({ fs, gitdir, bare: true, defaultBranch: BRANCH });
-  await git.addRemote({ fs, gitdir, remote: "origin", url: ledger.remote, force: true });
-  const readFile = async (oid, filepath) => {
-    try {
-      return (await git.readBlob({ fs, gitdir, oid, filepath })).blob;
-    } catch {
-      return null;
-    }
-  };
-  for (let i = refs.length - 1; i >= 0 && i >= refs.length - 3; i--) {
-    const { ref, oid } = refs[i];
+async function custodySkeleton(eng, gitdir) {
+  const p = eng.fs.promises;
+  for (const d of ["", "/objects", "/objects/pack", "/objects/info", "/refs", "/refs/heads"]) {
     try {
-      await git.fetch({ fs, http, gitdir, remote: "origin", ref, singleBranch: true, depth: 1, headers: freshHeaders() });
-      const gz = await readFile(oid, "checkpoint");
-      if (!gz) continue;
-      let meta = {};
-      try {
-        const mb = await readFile(oid, "meta");
-        if (mb) meta = JSON.parse(dec2.decode(mb));
-      } catch {
-      }
-      const codec = meta.codec ?? "gzip";
-      const blob = dec2.decode(codec === "gzip" ? await gunzip(gz) : gz);
-      const fgz = await readFile(oid, "frontier");
-      const frontier = fgz ? dec2.decode(codec === "gzip" ? await gunzip(fgz) : fgz) : null;
-      return { ref, oid, cursor: meta.cursor || null, blob, frontier };
-    } catch {
+      await p.mkdir(`${gitdir}${d}`);
+    } catch (e) {
+      if (e && e.code !== "EEXIST") throw e;
     }
   }
-  return null;
+  try {
+    await p.writeFile(`${gitdir}/HEAD`, `ref: refs/heads/${BRANCH}
+`);
+  } catch {
+  }
+  try {
+    await p.writeFile(`${gitdir}/config`, "[core]\n	repositoryformatversion = 0\n	bare = true\n");
+  } catch {
+  }
 }
-function applyIntentBytes(eng, ws, bytes) {
-  const name = `intent-in-${eng.seq++}.json`;
+async function custodyFetch(eng, ws, ledger, { remoteRef = "refs/heads/main", localRef = null, have = null } = {}) {
+  const remoteRefFull = fullRef(remoteRef);
+  const refs = await custodyLsRefs(ledger, remoteRefFull);
+  const tip = refs[remoteRefFull] || null;
+  if (!tip) return null;
+  if (tip !== have) applyPackInto(eng, ws, await fetchPack(ledger.remote, ledger.headers || {}, { wants: [tip], haves: have ? [have] : [] }));
+  kgit.writeRef(eng, gitdirOf(ws), fullRef(localRef || remoteRef), tip);
+  return tip;
+}
+function offerIntent(eng, ws, bytes, opts) {
+  const name = `offer-in-${eng.seq++}.json`;
   writeWork(eng, name, bytes);
-  return JSON.parse(call(eng.ex, "apply_intent", { repoArg: repoArgOf(ws), workspace: ws, intentFile: `/work/${name}`, branch: BRANCH }, eng.STDERR));
+  const deferProjection = !!(opts && opts.defer);
+  const branch = opts && opts.branch || BRANCH;
+  return JSON.parse(call(eng.ex, "offer", { repoArg: repoArgOf(ws), workspace: ws, intentFile: `/work/${name}`, branch, deferProjection }, eng.STDERR));
+}
+function offerAdmit(eng, ws, bytes, opts) {
+  const v = offerIntent(eng, ws, bytes, opts);
+  return v.outcome === "admitted" ? { ok: true, head: v.head } : { ok: false, error: v.verdict?.reason ?? v.error ?? "the offer was refused" };
+}
+function applyIntentBytes(eng, ws, bytes, opts) {
+  return offerAdmit(eng, ws, bytes, opts);
 }
 function verifyChainLocal(eng, ws) {
-  return JSON.parse(call(eng.ex, "verify_chain", { repoArg: repoArgOf(ws), workspace: ws, branch: BRANCH }, eng.STDERR));
+  return JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "verifyChain" }), branch: BRANCH }, eng.STDERR));
 }
-var enc2, dec2, BRANCH, repoArgOf, gitdirOf, unpack, installPayload, qById, query, cryptoUnwrapKey, count, sum;
+var enc3, dec3, BRANCH, RESULT_PACK_INLINE_MAX, repoArgOf, gitdirOf, unpack, repoArgOfGitdir, bytesFromB64, kgit, installPayload, fullRef, applyPackInto, custodyLsRefs, qById, query, cryptoUnwrapKey, count, sum;
 var init_engine = __esm({
   "vendor/engine/engine.mjs"() {
     "use strict";
     init_git_fs();
     init_tree();
-    enc2 = new TextEncoder();
-    dec2 = new TextDecoder();
+    init_custody_transport();
+    enc3 = new TextEncoder();
+    dec3 = new TextDecoder();
     BRANCH = "main";
+    RESULT_PACK_INLINE_MAX = 256 * 1024;
     repoArgOf = (ws) => `/work/ws/${ws}`;
     gitdirOf = (ws) => `/work/ws/${ws}/nomos.git`;
     unpack = (p) => {
       const v = typeof p === "bigint" ? p : BigInt(p);
       return { ptr: Number(v >> 32n), len: Number(v & 0xffffffffn) };
     };
+    repoArgOfGitdir = (gitdir) => gitdir.replace(/\/nomos\.git$/, "");
+    bytesFromB64 = (b64) => Uint8Array.from(atob(b64), (c) => c.charCodeAt(0));
+    kgit = {
+      // resolveRef → tip oid hex, or null if the ref is absent (replaces git.resolveRef(...).catch(()=>null)).
+      resolveRef: (eng, gitdir, ref) => JSON.parse(call(eng.ex, "resolve_ref", { repoArg: repoArgOfGitdir(gitdir), ref }, eng.STDERR)).oid,
+      // readBlob → the blob bytes at `path` inside commit `oid`, or null if not found (no throw).
+      readBlob: (eng, gitdir, oid, path) => {
+        const r = JSON.parse(call(eng.ex, "read_blob", { repoArg: repoArgOfGitdir(gitdir), oid, path }, eng.STDERR));
+        return r.ok ? bytesFromB64(r.blobB64) : null;
+      },
+      // intentsAbove → [{ oid, intentB64 }] oldest→newest over (base, head] (replaces log + readBlob intent.json).
+      // `limit` (0 = all) caps to the most-recent N intent commits (replaces git.log depth).
+      intentsAbove: (eng, gitdir, head, base = "", limit = 0) => JSON.parse(call(eng.ex, "intents_above", { repoArg: repoArgOfGitdir(gitdir), head, base, limit }, eng.STDERR)).intents,
+      // listRefs → [{ ref, oid }] under prefix (replaces git.listRefs for LOCAL refs).
+      listRefs: (eng, gitdir, prefix) => JSON.parse(call(eng.ex, "list_refs", { repoArg: repoArgOfGitdir(gitdir), prefix }, eng.STDERR)).refs,
+      // writeRef → force-point a ref (plain oid or `ref:`-symbolic) (replaces git.writeRef).
+      writeRef: (eng, gitdir, ref, value) => JSON.parse(call(eng.ex, "write_ref", { repoArg: repoArgOfGitdir(gitdir), ref, value }, eng.STDERR)),
+      // deleteRef → remove a local ref, idempotent (replaces git.deleteRef).
+      deleteRef: (eng, gitdir, ref) => JSON.parse(call(eng.ex, "delete_ref", { repoArg: repoArgOfGitdir(gitdir), ref }, eng.STDERR)),
+      // writeMetaCommit → blobs→tree→commit→ref for a CUSTODY-META fact (checkpoint/refused/outbox/shape).
+      // `files`: [{ path, bytes:Uint8Array }]; returns the commit oid (replaces writeBlob+writeTree+writeCommit[+writeRef]).
+      writeMetaCommit: (eng, gitdir, { parents = [], files, message = "nomos custody meta", timeSecs = 0, ref = "" }) => JSON.parse(call(eng.ex, "write_meta_commit", {
+        repoArg: repoArgOfGitdir(gitdir),
+        parents,
+        files: files.map((f) => ({ path: f.path, blobB64: b64Bytes(f.bytes) })),
+        message,
+        timeSecs,
+        ref
+      }, eng.STDERR)).oid
+    };
     installPayload = (hash, usda, installedBy, dispositions) => ({ domainHash: hash, packageUsda: usda, installedBy, dependencies: [], finalizers: [], ...dispositions ? { dispositions } : {} });
-    qById = (eng, ws, id, principal = "", keys = []) => JSON.parse(call(eng.ex, "query_by_id", { repoArg: repoArgOf(ws), workspace: ws, aggregateId: id, principal, keys, branch: BRANCH }, eng.STDERR));
-    query = (eng, ws, queryId, paramsJson, principal = "", keys = []) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryId, paramsJson, principal, keys, branch: BRANCH }, eng.STDERR));
+    fullRef = (r) => r === "HEAD" || r.startsWith("refs/") ? r : `refs/heads/${r}`;
+    applyPackInto = (eng, ws, pack) => {
+      if (!pack || !pack.length) return;
+      const r = JSON.parse(call(eng.ex, "apply_pack", { repoArg: repoArgOf(ws), packB64: b64Bytes(pack) }, eng.STDERR));
+      if (!r || r.ok !== true) throw new Error(`apply_pack: ${r && r.error}`);
+    };
+    custodyLsRefs = (ledger, prefix = null) => lsRefs(ledger.remote, ledger.headers || {}, { service: "git-upload-pack", prefix });
+    qById = (eng, ws, id, principal = "", keys = []) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "byId", aggregateId: id }), principal, keys, branch: BRANCH }, eng.STDERR));
+    query = (eng, ws, queryId, paramsJson, principal = "", keys = []) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ kind: "query", queryId, paramsJson }), principal, keys, branch: BRANCH }, eng.STDERR));
     cryptoUnwrapKey = (eng, { secret, hpkeEpk, ct }) => JSON.parse(call(eng.ex, "crypto_unwrap_key", { secret, hpkeEpk, ct }, eng.STDERR)).scopeKey;
-    count = (eng, ws, countId, groupKey) => JSON.parse(call(eng.ex, "count", { repoArg: repoArgOf(ws), workspace: ws, countId, groupKey, branch: BRANCH }, eng.STDERR));
-    sum = (eng, ws, sumId, groupKey) => JSON.parse(call(eng.ex, "sum", { repoArg: repoArgOf(ws), workspace: ws, sumId, groupKey, branch: BRANCH }, eng.STDERR));
+    count = (eng, ws, countId, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "count", countId, groupKey }), principal, branch: BRANCH }, eng.STDERR));
+    sum = (eng, ws, sumId, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "sum", sumId, groupKey }), principal, branch: BRANCH }, eng.STDERR));
   }
 });
 
@@ -776,21 +919,21 @@ function sealedIntentOf(eng, ws, res) {
 }
 function printVerdict(v) {
   if (v["valid"] === true) {
-    out3(`\u2713 chain VALID \u2014 head ${String(v["head"]).slice(0, 12)}\u2026, ${v["intents"]} intent(s), ${v["plansRerun"]} plan(s) re-run`);
-    out3(`  controller ${String(v["controllerHash"]).slice(0, 12)}\u2026 | installed: ${v["installedDomains"]?.map((h) => h.slice(0, 12) + "\u2026").join(", ") ?? "\u2014"}`);
+    out2(`\u2713 chain VALID \u2014 head ${String(v["head"]).slice(0, 12)}\u2026, ${v["intents"]} intent(s), ${v["plansRerun"]} plan(s) re-run`);
+    out2(`  controller ${String(v["controllerHash"]).slice(0, 12)}\u2026 | installed: ${v["installedDomains"]?.map((h) => h.slice(0, 12) + "\u2026").join(", ") ?? "\u2014"}`);
     return true;
   }
-  err3(`chain INVALID at ${v["check"]}${v["atIndex"] !== void 0 ? ` (intent ${v["atIndex"]})` : ""}: ${v["error"]}`);
+  err2(`chain INVALID at ${v["check"]}${v["atIndex"] !== void 0 ? ` (intent ${v["atIndex"]})` : ""}: ${v["error"]}`);
   return false;
 }
-var out3, err3;
+var out2, err2;
 var init_local_holon = __esm({
   "src/local_holon.ts"() {
     "use strict";
     init_engine();
     init_cloud();
-    out3 = (s) => void process.stdout.write(s + "\n");
-    err3 = (s) => void process.stderr.write("error: " + s + "\n");
+    out2 = (s) => void process.stdout.write(s + "\n");
+    err2 = (s) => void process.stderr.write("error: " + s + "\n");
   }
 });
 
@@ -939,7 +1082,7 @@ var init_proof_offline = __esm({
 
 // src/cli.ts
 import { existsSync as existsSync9, readdirSync as readdirSync4, readFileSync as readFileSync9 } from "node:fs";
-import { spawnSync as spawnSync5 } from "node:child_process";
+import { spawnSync as spawnSync4 } from "node:child_process";
 import { createRequire as createRequire2 } from "node:module";
 import { dirname as dirname5, join as join10, resolve as resolve2 } from "node:path";
 import { pathToFileURL as pathToFileURL4 } from "node:url";
@@ -1122,171 +1265,11 @@ Re-run with --force to replace it.`
   return { path, contents };
 }
 
-// src/capability.ts
-init_cloud();
-import { spawnSync } from "node:child_process";
-var out2 = (s) => void process.stdout.write(s + "\n");
-var err2 = (s) => void process.stderr.write("error: " + s + "\n");
-var CAP_NAME = /^[a-z0-9][a-z0-9._-]{0,63}$/;
-function readStdin() {
-  if (process.stdin.isTTY === true) {
-    process.stderr.write(
-      "paste the credential value, then Ctrl-D (it never rides argv \u2014 ps/history are hosts too):\n"
-    );
-  }
-  return new Promise((resolveValue) => {
-    let buf = "";
-    process.stdin.setEncoding("utf8");
-    process.stdin.on("data", (chunk) => {
-      buf += chunk;
-    });
-    process.stdin.on("end", () => resolveValue(buf.trim()));
-    process.stdin.resume();
-  });
-}
-function readGcloud(name) {
-  const r = spawnSync("gcloud", ["secrets", "versions", "access", "latest", `--secret=${name}`], {
-    encoding: "utf8",
-    maxBuffer: 1024 * 1024
-  });
-  if (r.error !== void 0 || r.status !== 0) {
-    throw new Error(
-      `gcloud secret read failed (${r.error?.message ?? r.stderr?.trim() ?? `exit ${r.status}`}) \u2014 is gcloud installed + authed, and does secret '${name}' exist?`
-    );
-  }
-  const v = r.stdout.trim();
-  if (v === "") throw new Error(`gcloud secret '${name}' is empty`);
-  return v;
-}
-function parseExpiresAt(s) {
-  const n = /^\d+$/.test(s) ? Number(s) : Date.parse(s);
-  if (!Number.isInteger(n) || n <= 0) throw new Error(`--expires-at '${s}' is neither epoch-ms nor an ISO date`);
-  return n;
-}
-async function bindLane(lane, ws, capability, opts) {
-  const cloud = cloudBase(opts.cloud);
-  if (!CAP_NAME.test(capability)) {
-    err2(`capability must be a lowercase law name matching [a-z0-9][a-z0-9._-]{0,63} \u2014 e.g. cf-analytics, openai`);
-    return 1;
-  }
-  const secret = getSecret(cloud, ws);
-  if (secret === void 0) {
-    err2(
-      `no stored secret for ${ws} on ${cloud} \u2014 capability ${lane} is owner-gated
-  githolon secret set ${ws} <secret>  (import the workspaceSecret you hold)`
-    );
-    return 1;
-  }
-  let value;
-  try {
-    value = opts.fromGcloud !== void 0 ? readGcloud(opts.fromGcloud) : await readStdin();
-  } catch (e) {
-    err2(e.message);
-    return 1;
-  }
-  if (value === "") {
-    err2("no credential value arrived \u2014 pipe it on stdin, or pass --from-gcloud <secret-name>");
-    return 1;
-  }
-  let expiresAt;
-  try {
-    expiresAt = opts.expiresAt !== void 0 ? parseExpiresAt(opts.expiresAt) : void 0;
-  } catch (e) {
-    err2(e.message);
-    return 1;
-  }
-  const r = await fetch(`${cloud}/v1/workspaces/${ws}/capabilities/${lane}`, {
-    method: "POST",
-    headers: { "content-type": "application/json", authorization: `Bearer ${secret}` },
-    body: JSON.stringify({
-      capability,
-      secret: value,
-      ...opts.scope !== void 0 ? { scope: opts.scope } : {},
-      ...expiresAt !== void 0 ? { expiresAt } : {}
-    })
-  });
-  const d = await r.json().catch(() => void 0);
-  if (r.status === 401) {
-    err2(`${lane} refused (401) \u2014 the stored secret for ${ws} is not the workspace's. githolon secret set ${ws} <secret>`);
-    return 1;
-  }
-  if (!r.ok || d?.ok !== true) {
-    err2(`capability ${lane} '${capability}' on ${ws} failed (${r.status}): ${d ? JSON.stringify(d) : "no body"}`);
-    return 1;
-  }
-  out2(`\u2713 ${capability} ${lane === "rotate" ? "rotated" : "bound"} on ${ws} (epoch ${d.epoch})`);
-  out2(`  the VALUE lives host-side only (the workspace's holon) \u2014 it never enters the ledger`);
-  out2(`  the law fact: keyHash ${(d.keyHash ?? "").slice(0, 16)}\u2026 status ${d.status}`);
-  return 0;
-}
-async function capabilityBind(ws, capability, opts) {
-  return bindLane("bind", ws, capability, opts);
-}
-async function capabilityRotate(ws, capability, opts) {
-  return bindLane("rotate", ws, capability, opts);
-}
-async function capabilityList(ws, opts) {
-  const cloud = cloudBase(opts.cloud);
-  const secret = getSecret(cloud, ws);
-  if (secret === void 0) {
-    err2(`no stored secret for ${ws} on ${cloud} \u2014 the binding facts are owner-gated
-  githolon secret set ${ws} <secret>`);
-    return 1;
-  }
-  const r = await fetch(`${cloud}/v1/workspaces/${ws}/capabilities`, {
-    headers: { authorization: `Bearer ${secret}` }
-  });
-  const d = await r.json().catch(() => void 0);
-  if (!r.ok || d?.ok !== true) {
-    err2(`capability list '${ws}' failed (${r.status}): ${d ? JSON.stringify(d) : "no body"}`);
-    return 1;
-  }
-  const bindings = d.bindings ?? [];
-  if (bindings.length === 0) {
-    out2(`no capability bindings on ${ws} \u2014 bind one: githolon capability bind ${ws} <capability>`);
-    return 0;
-  }
-  for (const b of bindings) {
-    const bits = [
-      `epoch ${b.epoch}`,
-      `${b.status}`,
-      `keyHash ${(b.keyHash ?? "").slice(0, 16)}\u2026`,
-      ...b.scope !== void 0 ? [`scope ${b.scope}`] : [],
-      ...b.expiresAt !== void 0 ? [`expires ${new Date(b.expiresAt).toISOString()}`] : [],
-      ...b.held !== void 0 ? [b.held ? "value held" : "VALUE MISSING (rotate to restore)"] : []
-    ];
-    out2(`${b.capability}  ${bits.join(" \xB7 ")}`);
-  }
-  out2(`(facts about authority \u2014 the values live host-side and are never listed)`);
-  return 0;
-}
-async function capabilityUnbind(ws, capability, opts) {
-  const cloud = cloudBase(opts.cloud);
-  const secret = getSecret(cloud, ws);
-  if (secret === void 0) {
-    err2(`no stored secret for ${ws} on ${cloud} \u2014 unbind is owner-gated
-  githolon secret set ${ws} <secret>`);
-    return 1;
-  }
-  const r = await fetch(`${cloud}/v1/workspaces/${ws}/capabilities/unbind`, {
-    method: "POST",
-    headers: { "content-type": "application/json", authorization: `Bearer ${secret}` },
-    body: JSON.stringify({ capability })
-  });
-  const d = await r.json().catch(() => void 0);
-  if (!r.ok || d?.ok !== true) {
-    err2(`capability unbind '${capability}' on ${ws} failed (${r.status}): ${d ? JSON.stringify(d) : "no body"}`);
-    return 1;
-  }
-  out2(`\u2713 ${capability} unbound on ${ws} \u2014 the law fact is revoked (the record stays) and the host forgot the value`);
-  return 0;
-}
-
 // src/cli.ts
 init_cloud();
 
 // src/compile.ts
-import { spawn, spawnSync as spawnSync2 } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import { createRequire } from "node:module";
 import { dirname, join as join3 } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -1310,7 +1293,7 @@ function runCompile(args) {
 `);
     return 1;
   }
-  const r = spawnSync2(process.execPath, [launcher, ...args], { stdio: "inherit", cwd: process.cwd() });
+  const r = spawnSync(process.execPath, [launcher, ...args], { stdio: "inherit", cwd: process.cwd() });
   return r.status ?? 1;
 }
 function compileAsync(cwd, args = []) {
@@ -1321,10 +1304,10 @@ function compileAsync(cwd, args = []) {
   }
   return new Promise((resolveRun) => {
     const chunks = [];
-    const dec3 = new TextDecoder();
+    const dec4 = new TextDecoder();
     const child = spawn(process.execPath, [launcher, ...args], { cwd, stdio: ["ignore", "pipe", "pipe"] });
-    child.stdout?.on("data", (c) => chunks.push(dec3.decode(c)));
-    child.stderr?.on("data", (c) => chunks.push(dec3.decode(c)));
+    child.stdout?.on("data", (c) => chunks.push(dec4.decode(c)));
+    child.stderr?.on("data", (c) => chunks.push(dec4.decode(c)));
     child.on("error", (e) => resolveRun({ ok: false, ms: performance.now() - t0, output: String(e) }));
     child.on(
       "close",
@@ -1429,8 +1412,8 @@ async function resolveWorkspace(explicit, cwd, target, usageHint) {
 
 // src/dev.ts
 init_proof_offline();
-var out4 = (s) => void process.stdout.write(s + "\n");
-var err4 = (s) => void process.stderr.write("error: " + s + "\n");
+var out3 = (s) => void process.stdout.write(s + "\n");
+var err3 = (s) => void process.stderr.write("error: " + s + "\n");
 var WS = "dev";
 var DEFAULT_PORT = 7700;
 var DEBOUNCE_MS = 200;
@@ -1490,8 +1473,8 @@ function startServer(s) {
           req.on("data", (c) => chunks.push(c));
           req.on("end", () => {
             try {
-              const dec3 = new TextDecoder();
-              const body = chunks.map((c) => dec3.decode(c)).join("") || "{}";
+              const dec4 = new TextDecoder();
+              const body = chunks.map((c) => dec4.decode(c)).join("") || "{}";
               const r = author(s.eng, WS, decodeURIComponent(dispatch[1]), decodeURIComponent(dispatch[2]), JSON.parse(body), s.lawHash);
               if (r["ok"] === false) return respond(422, { ok: false, error: r["error"] });
               s.intents++;
@@ -1553,21 +1536,21 @@ async function dev(opts) {
   const cwd = process.cwd();
   const cloud = cloudBase(opts.cloud);
   const project = await loadProject(cwd).catch((e) => {
-    err4(e.message);
+    err3(e.message);
     return void 0;
   });
   if (project === void 0) {
     if (!existsSync6(join7(cwd, CONFIG_FILE))) {
-      err4(`no ${CONFIG_FILE} here (${cwd}) \u2014 \`githolon dev\` runs inside a project; scaffold one from examples/guestbook or \`githolon generate domain <name>\``);
+      err3(`no ${CONFIG_FILE} here (${cwd}) \u2014 \`githolon dev\` runs inside a project; scaffold one from examples/guestbook or \`githolon generate domain <name>\``);
     }
     return 1;
   }
   const creds = loadCreds();
   const installedBy = creds.session?.uid ?? creds.principal ?? "githolon-dev";
-  out4(`githolon dev \u2014 ${project.name}: compiling\u2026`);
+  out3(`githolon dev \u2014 ${project.name}: compiling\u2026`);
   const firstCompile = await compileAsync(cwd);
   if (!firstCompile.ok) {
-    err4(`compile failed \u2014 the dev loop needs one green compile to mint the holon:
+    err3(`compile failed \u2014 the dev loop needs one green compile to mint the holon:
 ${firstCompile.output}`);
     return 1;
   }
@@ -1575,14 +1558,14 @@ ${firstCompile.output}`);
   try {
     deployBody = readDeployBody(cwd, project.name);
   } catch (e) {
-    err4(e.message);
+    err3(e.message);
     return 1;
   }
   let engBoot;
   try {
     engBoot = await holonEngine(cloud, deployBody, installedBy);
   } catch (e) {
-    err4(`cannot boot the local holon: ${String(e.message ?? e)}
+    err3(`cannot boot the local holon: ${String(e.message ?? e)}
   the runtime rides ${cloud}/v1/runtime/* and is cached in ~/.holon/runtime after one fetch \u2014 connect once, then dev runs offline`);
     return 1;
   }
@@ -1605,19 +1588,19 @@ ${firstCompile.output}`);
   s.intents++;
   const installed = await installLaw(s, deployBody, installedBy);
   if (!installed.ok) {
-    err4(installed.error ?? "law install failed");
+    err3(installed.error ?? "law install failed");
     return 1;
   }
   s.proof = await runProofCycle(s, cwd, deployBody, installedBy);
   if (opts.once === true) {
-    out4(statusScreen({ ...s, watchRoots: ["(--once: no watch)"] }));
+    out3(statusScreen({ ...s, watchRoots: ["(--once: no watch)"] }));
     return s.proof === void 0 || s.proof.ok ? 0 : 1;
   }
   let server;
   try {
     server = await startServer(s);
   } catch (e) {
-    err4(e.message);
+    err3(e.message);
     return 1;
   }
   const moduleDirs = /* @__PURE__ */ new Set();
@@ -1645,7 +1628,7 @@ ${firstCompile.output}`);
     s.compileMs = run.ms;
     if (!run.ok) {
       s.lastError = run.output.trim() || "compile failed";
-      out4(`\u2717 cycle ${s.cycle}: compile failed \u2014 the previous law keeps serving
+      out3(`\u2717 cycle ${s.cycle}: compile failed \u2014 the previous law keeps serving
 ${run.output}`);
     } else {
       s.lastError = void 0;
@@ -1654,16 +1637,16 @@ ${run.output}`);
         const inst = await installLaw(s, body, installedBy);
         if (!inst.ok) {
           s.lastError = inst.error ?? "install failed";
-          out4(`\u2717 cycle ${s.cycle}: ${s.lastError}`);
+          out3(`\u2717 cycle ${s.cycle}: ${s.lastError}`);
         } else {
           s.proof = await runProofCycle(s, cwd, body, installedBy);
           const total = performance.now() - t0;
-          out4(statusScreen(s));
-          out4(`  cycle      edit \u2192 law-live \u2192 proof in ${total.toFixed(0)} ms total`);
+          out3(statusScreen(s));
+          out3(`  cycle      edit \u2192 law-live \u2192 proof in ${total.toFixed(0)} ms total`);
         }
       } catch (e) {
         s.lastError = String(e.message ?? e);
-        out4(`\u2717 cycle ${s.cycle}: ${s.lastError}`);
+        out3(`\u2717 cycle ${s.cycle}: ${s.lastError}`);
       }
     }
     cycling = false;
@@ -1689,8 +1672,8 @@ ${run.output}`);
     })
   );
   s.watchRoots.push(CONFIG_FILE);
-  out4(statusScreen(s));
-  out4("  (ctrl-c stops; edits in the watched paths recompile + re-prove automatically)");
+  out3(statusScreen(s));
+  out3("  (ctrl-c stops; edits in the watched paths recompile + re-prove automatically)");
   return new Promise((resolveExit) => {
     const stop = () => {
       for (const w of watchers) w.close();
@@ -1704,13 +1687,13 @@ ${run.output}`);
 
 // src/git.ts
 init_cloud();
-import { spawnSync as spawnSync3 } from "node:child_process";
+import { spawnSync as spawnSync2 } from "node:child_process";
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { readFileSync as readFileSync5 } from "node:fs";
-var out5 = (s) => void process.stdout.write(s + "\n");
-var err5 = (s) => void process.stderr.write("error: " + s + "\n");
-function git2(args, opts = {}) {
-  const r = spawnSync3("git", args, { stdio: opts.quiet === true ? "ignore" : "inherit" });
+var out4 = (s) => void process.stdout.write(s + "\n");
+var err4 = (s) => void process.stderr.write("error: " + s + "\n");
+function git(args, opts = {}) {
+  const r = spawnSync2("git", args, { stdio: opts.quiet === true ? "ignore" : "inherit" });
   return r.status ?? 1;
 }
 function ensureSecret(cloud, ws) {
@@ -1730,7 +1713,7 @@ function parseCredentialInput(input) {
   return kv;
 }
 function workspaceFromPath(path) {
-  const m = (path ?? "").match(/^v1\/workspaces\/([^/]+)\/git(\/|$)/);
+  const m = (path ?? "").match(/^v[12]\/workspaces\/([^/]+)\/git(\/|$)/);
   return m?.[1];
 }
 async function gitCredential(action) {
@@ -1740,40 +1723,40 @@ async function gitCredential(action) {
   if (kv["protocol"] !== "https" || ws === void 0) return 0;
   const cloud = `https://${kv["host"]}`;
   const token = await sessionToken().catch(() => void 0);
-  out5(`username=${token ?? "nomos"}`);
-  out5(`password=${ensureSecret(cloud, ws)}`);
-  out5("");
+  out4(`username=${token ?? "nomos"}`);
+  out4(`password=${ensureSecret(cloud, ws)}`);
+  out4("");
   return 0;
 }
 async function gitSetup(opts) {
   const cloud = cloudBase(opts.cloud);
   const self = process.argv[1];
   if (self === void 0) {
-    err5("cannot locate the githolon CLI entry to install as a credential helper");
+    err4("cannot locate the githolon CLI entry to install as a credential helper");
     return 1;
   }
   const helper = `!"${process.execPath}" "${self}" git-credential`;
-  if (git2(["config", "--global", `credential.${cloud}.helper`, helper]) !== 0 || git2(["config", "--global", `credential.${cloud}.useHttpPath`, "true"]) !== 0) {
-    err5("git config failed \u2014 is git installed?");
+  if (git(["config", "--global", `credential.${cloud}.helper`, helper]) !== 0 || git(["config", "--global", `credential.${cloud}.useHttpPath`, "true"]) !== 0) {
+    err4("git config failed \u2014 is git installed?");
     return 1;
   }
-  out5(`\u2713 git credential helper installed for ${cloud} (global gitconfig)`);
-  out5(`  pushes/clones of ${cloud}/v1/workspaces/<ws>/git now authenticate from ~/.holon`);
+  out4(`\u2713 git credential helper installed for ${cloud} (global gitconfig)`);
+  out4(`  pushes/clones of ${cloud}/v2/workspaces/<ws>/git now authenticate from ~/.holon`);
   return 0;
 }
 async function gitRemote(ws, name, opts) {
   const cloud = cloudBase(opts.cloud);
-  if (git2(["rev-parse", "--git-dir"], { quiet: true }) !== 0) {
-    err5("not a git repository \u2014 run inside your repo (git init first)");
+  if (git(["rev-parse", "--git-dir"], { quiet: true }) !== 0) {
+    err4("not a git repository \u2014 run inside your repo (git init first)");
     return 1;
   }
   const setupRc = await gitSetup(opts);
   if (setupRc !== 0) return setupRc;
   ensureSecret(cloud, ws);
-  const url = `${cloud}/v1/workspaces/${ws}/git`;
-  if (git2(["remote", "add", name, url], { quiet: true }) !== 0) {
-    if (git2(["remote", "set-url", name, url], { quiet: true }) !== 0) {
-      err5(`could not add or update remote '${name}'`);
+  const url = `${cloud}/v2/workspaces/${ws}/git`;
+  if (git(["remote", "add", name, url], { quiet: true }) !== 0) {
+    if (git(["remote", "set-url", name, url], { quiet: true }) !== 0) {
+      err4(`could not add or update remote '${name}'`);
       return 1;
     }
   }
@@ -1781,21 +1764,21 @@ async function gitRemote(ws, name, opts) {
   if (token === void 0) {
     const principal = loadCreds().principal;
     if (principal === void 0) {
-      err5(
+      err4(
         `remote '${name}' \u2192 ${url} is wired, but a BIRTH push needs a principal:
   githolon login --agent   (then just push)
   \u2014 or re-run after githolon ws create/login so a principal is on file`
       );
       return 1;
     }
-    if (git2(["config", `http.${url}.extraHeader`, `x-nomos-principal: ${principal}`]) !== 0) {
-      err5("git config failed setting the principal header");
+    if (git(["config", `http.${url}.extraHeader`, `x-nomos-principal: ${principal}`]) !== 0) {
+      err4("git config failed setting the principal header");
       return 1;
     }
   }
-  out5(`\u2713 remote '${name}' \u2192 ${url}`);
-  out5(`  workspace secret on file; ${token !== void 0 ? "births ride your session (verified)" : "births ride x-nomos-principal (bare uid)"}`);
-  out5(`  birth/deploy by push:  git push ${name} main`);
+  out4(`\u2713 remote '${name}' \u2192 ${url}`);
+  out4(`  workspace secret on file; ${token !== void 0 ? "births ride your session (verified)" : "births ride x-nomos-principal (bare uid)"}`);
+  out4(`  birth/deploy by push:  git push ${name} main`);
   return 0;
 }
 
@@ -1899,22 +1882,6 @@ var HELP = {
     what: "The workspace-secret store (~/.holon/credentials.json, 0600). `set` imports one you already\nhold; `rotate` mints a fresh one (and claims a legacy workspace).",
     examples: ["githolon secret set my-ws nws_v1_\u2026", "githolon secret rotate my-ws"]
   },
-  capability: {
-    usage: "githolon capability <bind|rotate|unbind> <ws> <capability> | list <ws>  [--from-gcloud <name>] [--scope <s>] [--expires-at <iso|ms>] [--cloud <url>]",
-    what: "Capability credentials (architecture/capability_credentials.md): the ledger holds FACTS ABOUT\nAUTHORITY (the CapabilityBinding record \u2014 keyHash/scope/expiry/epoch), the credential VALUE\nlives at exactly ONE host (the workspace's holon). `bind` ships the value over the owner-gated\nlane ONCE \u2014 from stdin (pipe it) or Google Secret Manager, NEVER argv (ps/history are hosts\ntoo). `rotate` = revoke + re-bind at epoch+1; `unbind` revokes the fact and the host forgets\nthe value; `list` shows facts only.",
-    flags: [
-      ["--from-gcloud <name>", "read the value from `gcloud secrets versions access latest --secret=<name>`"],
-      ["--scope <s>", "a narrowing label recorded on the law fact (e.g. read-only)"],
-      ["--expires-at <t>", "expiry recorded on the law fact (ISO date/datetime or epoch-ms; fail-closed at the host)"],
-      ["--cloud <url>", "target cloud (default: $NOMOS_CLOUD or the public cloud)"]
-    ],
-    examples: [
-      "cat token.txt | githolon capability bind nomos-usage cf-analytics",
-      "githolon capability bind my-ws openai --from-gcloud openai-api-key --scope read-only",
-      "githolon capability list nomos-usage",
-      "githolon capability rotate nomos-usage cf-analytics --from-gcloud cf-analytics-token"
-    ]
-  },
   git: {
     usage: "githolon git <setup | remote [<ws>] [<remoteName>]> [--cloud <url>] [--target <name>]",
     what: "Stock git push as deploy/birth. `setup` installs the credential helper for the cloud host;\n`remote` wires this repo to a workspace (then: git push nomos main). With no <ws>, the\nproject's `workspace` binding resolves it.",
@@ -1946,23 +1913,23 @@ function commandHelp(cmd) {
 init_engine();
 init_cloud();
 init_local_holon();
-import { spawnSync as spawnSync4 } from "node:child_process";
+import { spawnSync as spawnSync3 } from "node:child_process";
 import { existsSync as existsSync7, readdirSync as readdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "node:fs";
 import { join as join8 } from "node:path";
-var out6 = (s) => void process.stdout.write(s + "\n");
-var err6 = (s) => void process.stderr.write("error: " + s + "\n");
+var out5 = (s) => void process.stdout.write(s + "\n");
+var err5 = (s) => void process.stderr.write("error: " + s + "\n");
 var WS2 = "local";
 async function ledgerInit(dir, opts) {
   const cloud = cloudBase(opts.cloud);
   if (existsSync7(dir) && readdirSync3(dir).length > 0) {
-    err6(`refusing to mint into non-empty directory: ${dir}`);
+    err5(`refusing to mint into non-empty directory: ${dir}`);
     return 1;
   }
   let deployFile;
   try {
     deployFile = discoverDeployJson(process.cwd(), opts.file);
   } catch (e) {
-    err6(e.message);
+    err5(e.message);
     return 1;
   }
   const deployBody = JSON.parse(readFileSync6(deployFile, "utf8"));
@@ -1970,10 +1937,10 @@ async function ledgerInit(dir, opts) {
   const c = loadCreds();
   const principal = await sessionToken().catch(() => void 0) !== void 0 ? c.session.uid : c.principal;
   if (principal === void 0) {
-    err6("a holon is born OF someone \u2014 githolon login --agent first (or githolon ws create --principal <uid> once)");
+    err5("a holon is born OF someone \u2014 githolon login --agent first (or githolon ws create --principal <uid> once)");
     return 1;
   }
-  out6(`minting a holon locally (law ${domainHash.slice(0, 12)}\u2026, installedBy ${principal})`);
+  out5(`minting a holon locally (law ${domainHash.slice(0, 12)}\u2026, installedBy ${principal})`);
   const { eng } = await holonEngine(cloud, deployBody, principal);
   await mountFresh(eng, WS2);
   author(eng, WS2, "bootstrap", "installDomain", installPayload(eng.hashes.nomos, eng.nomosPkg, principal), "");
@@ -1985,17 +1952,17 @@ async function ledgerInit(dir, opts) {
   writeTreeToDisk(gitTree, gitDir);
   const cfgPath = join8(gitDir, "config");
   writeFileSync4(cfgPath, readFileSync6(cfgPath, "utf8").replace(/bare = true/, "bare = false"), "utf8");
-  spawnSync4("git", ["-C", dir, "reset", "--hard", "main"], { stdio: "ignore" });
-  out6(`\u2713 holon written \u2192 ${dir} (a normal git repo; git log IS the audit trail)`);
-  out6(`
+  spawnSync3("git", ["-C", dir, "reset", "--hard", "main"], { stdio: "ignore" });
+  out5(`\u2713 holon written \u2192 ${dir} (a normal git repo; git log IS the audit trail)`);
+  out5(`
 Birth it on Nomos Cloud (the cloud re-derives this exact verdict):`);
-  out6(`  cd ${dir} && npx githolon git remote <ws> && git push nomos main`);
+  out5(`  cd ${dir} && npx githolon git remote <ws> && git push nomos main`);
   return 0;
 }
 async function ledgerVerify(dir, opts) {
   const gitDir = existsSync7(join8(dir, ".git")) ? join8(dir, ".git") : dir;
   if (!existsSync7(join8(gitDir, "HEAD"))) {
-    err6(`${dir} is not a git repo (no HEAD)`);
+    err5(`${dir} is not a git repo (no HEAD)`);
     return 1;
   }
   const { eng } = await holonEngine(cloudBase(opts.cloud), void 0, "verify");
@@ -2012,9 +1979,9 @@ init_cloud();
 init_local_holon();
 import { existsSync as existsSync8 } from "node:fs";
 import { join as join9 } from "node:path";
-import git3 from "isomorphic-git";
-var out7 = (s) => void process.stdout.write(s + "\n");
-var err7 = (s) => void process.stderr.write("error: " + s + "\n");
+import git2 from "isomorphic-git";
+var out6 = (s) => void process.stdout.write(s + "\n");
+var err6 = (s) => void process.stderr.write("error: " + s + "\n");
 var SOURCE = "source";
 var REPLAY = "replay";
 function summarizePayload(payload, max = 100) {
@@ -2050,9 +2017,9 @@ function capJsonStrings(v, max = 2048) {
   if (typeof v === "string") return v.length > max ? `${v.slice(0, max)}\u2026(${v.length} chars)` : v;
   if (Array.isArray(v)) return v.map((x) => capJsonStrings(x, max));
   if (typeof v === "object" && v !== null) {
-    const out10 = {};
-    for (const [k, x] of Object.entries(v)) out10[k] = capJsonStrings(x, max);
-    return out10;
+    const out9 = {};
+    for (const [k, x] of Object.entries(v)) out9[k] = capJsonStrings(x, max);
+    return out9;
   }
   return v;
 }
@@ -2067,12 +2034,12 @@ function typeOf(ev) {
 }
 async function walkChain(eng, ws) {
   const gitdir = gitdirOf(ws);
-  const dec3 = new TextDecoder();
+  const dec4 = new TextDecoder();
   const entries = [];
-  for (const c of await git3.log({ fs: eng.fs, gitdir, ref: "main" })) {
+  for (const c of await git2.log({ fs: eng.fs, gitdir, ref: "main" })) {
     try {
-      const { blob } = await git3.readBlob({ fs: eng.fs, gitdir, oid: c.oid, filepath: "intent.json" });
-      entries.push({ oid: c.oid, bytes: blob, doc: JSON.parse(dec3.decode(blob)) });
+      const { blob } = await git2.readBlob({ fs: eng.fs, gitdir, oid: c.oid, filepath: "intent.json" });
+      entries.push({ oid: c.oid, bytes: blob, doc: JSON.parse(dec4.decode(blob)) });
     } catch {
     }
   }
@@ -2099,12 +2066,12 @@ function readKey() {
 async function replay(target, opts) {
   const cloud = cloudBase(opts.cloud);
   const json = opts.json === true;
-  const emit = (o) => out7(JSON.stringify(o));
+  const emit = (o) => out6(JSON.stringify(o));
   let eng;
   try {
     ({ eng } = await holonEngine(cloud, void 0, "githolon-replay"));
   } catch (e) {
-    err7(`cannot boot the local holon: ${String(e.message ?? e)}
+    err6(`cannot boot the local holon: ${String(e.message ?? e)}
   the runtime rides ${cloud}/v1/runtime/* (cached in ~/.holon/runtime after one fetch)`);
     return 1;
   }
@@ -2112,15 +2079,15 @@ async function replay(target, opts) {
   if (isDir) {
     const gitDir = existsSync8(join9(target, ".git")) ? join9(target, ".git") : target;
     if (!existsSync8(join9(gitDir, "HEAD"))) {
-      err7(`${target} is not a git repo (no HEAD) \u2014 pass a holon directory (githolon ledger init <dir>) or a workspace name`);
+      err6(`${target} is not a git repo (no HEAD) \u2014 pass a holon directory (githolon ledger init <dir>) or a workspace name`);
       return 1;
     }
     await mountFresh(eng, SOURCE);
     eng.preopen.dir.contents.get("ws").contents.get(SOURCE).contents.set("nomos.git", readTreeFromDisk(gitDir));
   } else {
-    const m = await mountWorkspace(eng, SOURCE, { remote: `${cloud}/v1/workspaces/${target}/git`, headers: {} });
+    const m = await mountWorkspace(eng, SOURCE, { remote: `${cloud}/v2/workspaces/${target}/git`, headers: {} });
     if (m.restored !== true) {
-      err7(
+      err6(
         `workspace '${target}' has no refs/heads/main on ${cloud} \u2014 nothing to replay` + (m.restoreError ? ` (${String(m.restoreError).split(" | ")[0]})` : "") + `
   check the name (githolon ws status ${target}), or pass a local holon directory instead`
       );
@@ -2129,7 +2096,7 @@ async function replay(target, opts) {
   }
   const chain = await walkChain(eng, SOURCE);
   if (chain.length === 0) {
-    err7(`the chain on '${target}' carries no intents \u2014 nothing to replay`);
+    err6(`the chain on '${target}' carries no intents \u2014 nothing to replay`);
     return 1;
   }
   await mountFresh(eng, REPLAY);
@@ -2138,8 +2105,8 @@ async function replay(target, opts) {
   const tallies = /* @__PURE__ */ new Map();
   let autoRun = !interactive;
   if (!json) {
-    out7(`replaying ${chain.length} intent(s) from ${isDir ? target : `${cloud} :: ${target}`} \u2014 every step re-admitted through the wasm gate`);
-    if (interactive) out7("  keys: enter = next intent \xB7 a = run to the end \xB7 q = quit\n");
+    out6(`replaying ${chain.length} intent(s) from ${isDir ? target : `${cloud} :: ${target}`} \u2014 every step re-admitted through the wasm gate`);
+    if (interactive) out6("  keys: enter = next intent \xB7 a = run to the end \xB7 q = quit\n");
   }
   for (let i = 0; i < chain.length; i++) {
     const { oid, bytes, doc } = chain[i];
@@ -2153,8 +2120,8 @@ async function replay(target, opts) {
     if (res.ok === false) {
       const msg = `replay REFUSED at intent ${i} (${domain}/${directive}, ${oid.slice(0, 10)}): ${res.error ?? "unknown"}`;
       if (json) emit({ step: i, oid, domain, directive, refused: true, error: res.error ?? "unknown" });
-      else err7(msg);
-      err7("the chain's own gate rejects this entry on a fresh fold \u2014 the source it came from would refuse it too (verify below names the check)");
+      else err6(msg);
+      err6("the chain's own gate rejects this entry on a fresh fold \u2014 the source it came from would refuse it too (verify below names the check)");
       printVerdict(verifyChainLocal(eng, SOURCE));
       return 1;
     }
@@ -2175,31 +2142,31 @@ async function replay(target, opts) {
         tallies: Object.fromEntries(tallies)
       });
     } else {
-      out7(`[${String(i + 1).padStart(String(chain.length).length)}/${chain.length}] ${domain}/${directive}  (${oid.slice(0, 10)}, ${ms.toFixed(0)} ms)`);
-      out7(`      payload  ${summarizePayload(doc.payload?.payload)}`);
+      out6(`[${String(i + 1).padStart(String(chain.length).length)}/${chain.length}] ${domain}/${directive}  (${oid.slice(0, 10)}, ${ms.toFixed(0)} ms)`);
+      out6(`      payload  ${summarizePayload(doc.payload?.payload)}`);
       for (const ev of doc.events ?? []) {
         const id = ev.aggregate ?? "?";
         const was = before.get(id);
         const verb = ev.marker === "Create" ? "+ created" : ev.marker === "Delete" ? "- deleted" : was === void 0 ? "~ touched" : "~ updated";
-        out7(`      ${verb}  ${id}`);
+        out6(`      ${verb}  ${id}`);
         const ops = summarizeOps(ev);
-        if (ops.length > 0) out7(`                ${ops}`);
+        if (ops.length > 0) out6(`                ${ops}`);
       }
       const tallyLine = [...tallies.entries()].map(([t, n]) => `${t}:${n}`).join("  ");
       const showTally = stepEvery > 0 ? (i + 1) % stepEvery === 0 || i === chain.length - 1 : true;
-      if (showTally && tallyLine.length > 0) out7(`      rows     ${tallyLine}`);
+      if (showTally && tallyLine.length > 0) out6(`      rows     ${tallyLine}`);
     }
     if (interactive && !autoRun && i < chain.length - 1) {
       const key = await readKey();
       if (key === "quit") {
-        out7(`
+        out6(`
 stopped at intent ${i + 1}/${chain.length} \u2014 the verify verdict below covers the WHOLE chain as delivered`);
         break;
       }
       if (key === "all") autoRun = true;
     }
   }
-  if (!json) out7("");
+  if (!json) out6("");
   const verdict = verifyChainLocal(eng, SOURCE);
   if (json) {
     emit({ finale: true, verdict });
@@ -2213,40 +2180,40 @@ init_local_holon();
 init_cloud();
 init_engine();
 var SOURCE2 = "source";
-var out8 = (s) => {
+var out7 = (s) => {
   process.stdout.write(s + "\n");
 };
-var err8 = (s) => {
+var err7 = (s) => {
   process.stderr.write(`error: ${s}
 `);
 };
 async function decrypt(ws, opts) {
   const cloud = cloudBase(opts.cloud);
   if (!opts.as) {
-    err8("--as <principal> is required (who to decrypt as)");
+    err7("--as <principal> is required (who to decrypt as)");
     return 1;
   }
   if (!opts.secret) {
-    err8("--secret <base64 X25519 device secret> is required");
+    err7("--secret <base64 X25519 device secret> is required");
     return 1;
   }
   if (!opts.query) {
-    err8("--query <queryId> is required (the read to decrypt)");
+    err7("--query <queryId> is required (the read to decrypt)");
     return 1;
   }
   let eng;
   try {
     ({ eng } = await holonEngine(cloud, opts.overlay, "githolon-decrypt"));
   } catch (e) {
-    err8(`cannot boot the local holon: ${String(e.message ?? e)}`);
+    err7(`cannot boot the local holon: ${String(e.message ?? e)}`);
     return 1;
   }
   const m = await mountWorkspace(eng, SOURCE2, {
-    remote: `${cloud}/v1/workspaces/${ws}/git`,
+    remote: `${cloud}/v2/workspaces/${ws}/git`,
     headers: { "x-nomos-principal": opts.as }
   });
   if (m.restored !== true) {
-    err8(`workspace '${ws}' has no main on ${cloud}, or its clone was refused for '${opts.as}'` + (m.restoreError ? ` (${String(m.restoreError).split(" | ")[0]})` : ""));
+    err7(`workspace '${ws}' has no main on ${cloud}, or its clone was refused for '${opts.as}'` + (m.restoreError ? ` (${String(m.restoreError).split(" | ")[0]})` : ""));
     return 1;
   }
   const wraps = query(eng, SOURCE2, "wrappedKeysByRecipient", JSON.stringify({ recipientPrincipal: opts.as }), opts.as);
@@ -2261,14 +2228,14 @@ async function decrypt(ws, opts) {
       }
     }
   }
-  if (opts.json !== true) out8(`# resolved ${keys.length} scope key(s) for '${opts.as}': ${keys.map((k) => `${k.scope}@${k.epoch}`).join(", ") || "(none)"}`);
+  if (opts.json !== true) out7(`# resolved ${keys.length} scope key(s) for '${opts.as}': ${keys.map((k) => `${k.scope}@${k.epoch}`).join(", ") || "(none)"}`);
   const rows = query(eng, SOURCE2, opts.query, JSON.stringify(opts.params ?? {}), opts.as, keys);
   if (rows && !Array.isArray(rows) && rows.ok === false) {
-    err8(`the read was refused: ${rows.error}` + (String(rows.error).startsWith("read-forbidden") ? `
+    err7(`the read was refused: ${rows.error}` + (String(rows.error).startsWith("read-forbidden") ? `
   '${opts.as}' is not granted this scope's read capability` : ""));
     return 1;
   }
-  out8(JSON.stringify(rows, null, opts.json === true ? 0 : 2));
+  out7(JSON.stringify(rows, null, opts.json === true ? 0 : 2));
   return 0;
 }
 
@@ -2276,8 +2243,8 @@ async function decrypt(ws, opts) {
 init_engine();
 init_cloud();
 import { readFileSync as readFileSync8 } from "node:fs";
-var out9 = (s) => void process.stdout.write(s + "\n");
-var err9 = (s) => void process.stderr.write("error: " + s + "\n");
+var out8 = (s) => void process.stdout.write(s + "\n");
+var err8 = (s) => void process.stderr.write("error: " + s + "\n");
 function lawDiffVerdict(localHash, installed, ws) {
   const active = installed.filter((d) => d.phase === "Active" && typeof d.domainHash === "string");
   const currents = active.filter((d) => d.current === true);
@@ -2315,7 +2282,7 @@ async function status(wsArg, opts) {
   try {
     ws = await resolveWorkspace(wsArg, process.cwd(), opts.target, "githolon status <ws>");
   } catch (e) {
-    err9(e.message);
+    err8(e.message);
     return 1;
   }
   let localHash;
@@ -2325,37 +2292,37 @@ async function status(wsArg, opts) {
   } catch {
     localHash = void 0;
   }
-  const r = await fetch(`${cloud}/v1/workspaces/${ws}/domains`).catch(() => void 0);
+  const r = await fetch(`${cloud}/v2/workspaces/${ws}/domains`).catch(() => void 0);
   if (r === void 0) {
-    err9(`cannot reach ${cloud} \u2014 githolon status compares against the DEPLOYED law and needs the cloud (local-only: githolon dev)`);
+    err8(`cannot reach ${cloud} \u2014 githolon status compares against the DEPLOYED law and needs the cloud (local-only: githolon dev)`);
     return 1;
   }
   const d = await r.json().catch(() => void 0);
   if (!r.ok || d?.ok !== true) {
-    err9(`status '${ws}' failed (${r.status}): ${d ? JSON.stringify(d) : "no body"}
+    err8(`status '${ws}' failed (${r.status}): ${d ? JSON.stringify(d) : "no body"}
   is the workspace born? githolon ws create ${ws}`);
     return 1;
   }
-  out9(`workspace  ${ws} on ${cloud}`);
+  out8(`workspace  ${ws} on ${cloud}`);
   const allDomains = d.domains ?? [];
   const controlPlaneHashes = new Set(CONTROL_PLANE_KEYS.map((k) => d.currentLaw?.[k]).filter(Boolean));
   const domains = allDomains.filter((dm) => !controlPlaneHashes.has(dm.domainHash));
   const controllerCount = allDomains.length - domains.length;
-  if (allDomains.length === 0) out9(`installed  (none \u2014 not even the controller; the workspace may be unborn)`);
+  if (allDomains.length === 0) out8(`installed  (none \u2014 not even the controller; the workspace may be unborn)`);
   for (const dom of domains) {
     const mark = dom.current === true ? "  \u2190 current (the holon resolves dispatch here)" : "";
-    out9(`installed  ${(dom.domainHash ?? "?").slice(0, 16)}\u2026  ${dom.phase ?? "?"}  by ${dom.installedBy ?? "?"}${mark}`);
+    out8(`installed  ${(dom.domainHash ?? "?").slice(0, 16)}\u2026  ${dom.phase ?? "?"}  by ${dom.installedBy ?? "?"}${mark}`);
   }
-  if (controllerCount > 0) out9(`           (+ ${controllerCount} control-plane install(s) \u2014 the nomos lifecycle controller; not tenant law)`);
+  if (controllerCount > 0) out8(`           (+ ${controllerCount} control-plane install(s) \u2014 the nomos lifecycle controller; not tenant law)`);
   const tenantActive = domains.filter((dm) => dm.phase === "Active").length;
-  if (tenantActive > 1) out9(`           (${tenantActive} active tenant installs \u2014 install-beside keeps every prior deploy Active; the holon serves the current one per domain)`);
+  if (tenantActive > 1) out8(`           (${tenantActive} active tenant installs \u2014 install-beside keeps every prior deploy Active; the holon serves the current one per domain)`);
   if (localHash === void 0) {
-    out9(`local      (no build/*.deploy.json here \u2014 run \`githolon compile\` to build the law this project authors)`);
+    out8(`local      (no build/*.deploy.json here \u2014 run \`githolon compile\` to build the law this project authors)`);
     return 0;
   }
-  out9(`local      ${localHash.slice(0, 16)}\u2026  (build/*.deploy.json)`);
+  out8(`local      ${localHash.slice(0, 16)}\u2026  (build/*.deploy.json)`);
   const verdict = lawDiffVerdict(localHash, domains, ws);
-  for (const line of verdict.lines) out9(line);
+  for (const line of verdict.lines) out8(line);
   return verdict.inSync ? 0 : 2;
 }
 
@@ -2399,15 +2366,6 @@ a bare <ws> resolves from nomos.package.mjs's optional \`workspace\` binding):
   githolon secret set <ws> <secret>                       import a secret you already hold
   githolon secret rotate <ws>                             rotate (and re-save) the workspace secret
 
-Capability credentials (facts on the ledger, values host-side \u2014 the value NEVER rides argv;
-stdin or --from-gcloud only; architecture/capability_credentials.md):
-  githolon capability bind <ws> <capability>              bind a credential: value from stdin (or
-                                                       --from-gcloud <name>) \u2192 the workspace's holon;
-                                                       sha256(value) \u2192 the law-state binding fact
-  githolon capability list <ws>                           the binding FACTS (never the values)
-  githolon capability rotate <ws> <capability>            revoke + re-bind at epoch+1 (new value)
-  githolon capability unbind <ws> <capability>            revoke the fact; the host forgets the value
-
 Git lane (stock git push as deploy/birth \u2014 see also: push-to-create):
   githolon git setup                                      install the credential helper for the cloud host
   githolon git remote [<ws>] [<remoteName>]               wire this repo to a workspace (default name: nomos)
@@ -2486,38 +2444,6 @@ ${USAGE}`);
   if (sub === "rotate" && ws !== void 0) return secretRotate(ws, opts);
   return usageFail("expected: githolon secret <set <ws> <secret> | rotate <ws>>");
 }
-async function runCapability(argv) {
-  const usageFail = (m) => {
-    process.stderr.write(`error: ${m}
-
-${commandHelp("capability")}`);
-    return 1;
-  };
-  const pos = [];
-  const opts = {};
-  const rest = argv.slice(1);
-  for (let i = 0; i < rest.length; i++) {
-    const a = rest[i];
-    if (a === "--cloud" || a === "--from-gcloud" || a === "--scope" || a === "--expires-at") {
-      const v = rest[++i];
-      if (v === void 0) return usageFail(`${a} requires a value`);
-      if (a === "--cloud") opts.cloud = v;
-      else if (a === "--from-gcloud") opts.fromGcloud = v;
-      else if (a === "--scope") opts.scope = v;
-      else opts.expiresAt = v;
-    } else if (a.startsWith("--")) {
-      return usageFail(`unknown flag '${a}'`);
-    } else {
-      pos.push(a);
-    }
-  }
-  const [sub, ws, capability] = pos;
-  if (sub === "bind" && ws !== void 0 && capability !== void 0) return capabilityBind(ws, capability, opts);
-  if (sub === "rotate" && ws !== void 0 && capability !== void 0) return capabilityRotate(ws, capability, opts);
-  if (sub === "unbind" && ws !== void 0 && capability !== void 0) return capabilityUnbind(ws, capability, opts);
-  if (sub === "list" && ws !== void 0) return capabilityList(ws, opts);
-  return usageFail("expected: githolon capability <bind|rotate|unbind> <ws> <capability> | list <ws>");
-}
 function isKind(s) {
   return s !== void 0 && KINDS.includes(s);
 }
@@ -2597,7 +2523,7 @@ async function runProof(args) {
   const tsxBinRel = typeof tsxPkg.bin === "string" ? tsxPkg.bin : tsxPkg.bin?.["tsx"];
   const tsxCli = join10(tsxDir, tsxBinRel ?? "dist/cli.mjs");
   console.log("githolon proof --live \u2014 the full cloud loop (throwaway workspace, retired on exit" + (keep ? "; --keep: kept, secret printed once" : "") + ")");
-  const r = spawnSync5(process.execPath, [tsxCli, proofPath], {
+  const r = spawnSync4(process.execPath, [tsxCli, proofPath], {
     stdio: "inherit",
     cwd: process.cwd(),
     env: { ...process.env, ...keep ? { PROOF_KEEP: "1" } : {} }
@@ -2608,7 +2534,7 @@ function parseArgs(argv) {
   const [command, ...rest] = argv;
   if (command !== "generate" && command !== "g") {
     throw new Error(
-      `Unknown command '${command ?? "(none)"}'. Expected dev | compile | proof | replay | status | generate | ws | deploy | secret | capability.`
+      `Unknown command '${command ?? "(none)"}'. Expected dev | compile | proof | replay | status | generate | ws | deploy | secret.`
     );
   }
   let outDir = DEFAULT_OUT;
@@ -2774,9 +2700,6 @@ ${commandHelp("status")}`);
   if (argv[0] === "ws" || argv[0] === "deploy" || argv[0] === "secret") {
     return runCloud(argv);
   }
-  if (argv[0] === "capability") {
-    return runCapability(argv);
-  }
   if (argv[0] === "login") {
     const agent = argv.includes("--agent");
     const tokenAt = argv.indexOf("--token");
@@ -2833,8 +2756,8 @@ ${USAGE}`);
   let parsed;
   try {
     parsed = parseArgs(argv);
-  } catch (err10) {
-    process.stderr.write(`error: ${err10.message}
+  } catch (err9) {
+    process.stderr.write(`error: ${err9.message}
 
 ${USAGE}`);
     return 1;
@@ -2853,8 +2776,8 @@ ${USAGE}`);
     process.stdout.write(`created ${path}
 `);
     return 0;
-  } catch (err10) {
-    process.stderr.write(`error: ${err10.message}
+  } catch (err9) {
+    process.stderr.write(`error: ${err9.message}
 `);
     return 1;
   }