githolon 0.17.0 → 0.18.0

package/dist/cli.mjs

@@ -9,14 +9,172 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/governance.ts
+var governance_exports = {};
+__export(governance_exports, {
+  grantOrRevoke: () => grantOrRevoke,
+  keyEnroll: () => keyEnroll,
+  keyShow: () => keyShow,
+  resolveGovernancePrincipal: () => resolveGovernancePrincipal,
+  signAndPostGovernance: () => signAndPostGovernance
+});
+import { connect } from "@githolon/client";
+async function connectGovernance(cloud, parent) {
+  const authToken = await sessionToken().catch(() => void 0);
+  const clientId = `githolon-cli-${Date.now().toString(16)}`;
+  return await connect({
+    cloud,
+    workspace: parent,
+    clientId,
+    ...authToken !== void 0 ? { authToken } : {}
+  });
+}
+async function ensureDeviceKey(holon, principal) {
+  const existing = getDeviceKey(principal);
+  if (existing !== void 0) return existing;
+  const minted = await holon.authorKeygen();
+  if (typeof minted.secret !== "string" || typeof minted.public !== "string") {
+    throw new Error("authorKeygen did not return a {secret, public} device key");
+  }
+  const payload = await holon.enrollSignerPayload({ principal, publicKey: minted.public });
+  const key = { secret: minted.secret, public: minted.public, keyHash: payload.keyHash };
+  setDeviceKey(principal, key);
+  return key;
+}
+function resolveGovernancePrincipal(opts) {
+  const principal = opts.principal ?? currentPrincipal();
+  if (principal === void 0) {
+    throw new Error(
+      "signed governance needs a principal \u2014 githolon login --agent (self-onboarding), or pass --principal <your-auth-uid>"
+    );
+  }
+  return principal;
+}
+async function signAndPostGovernance(parent, directiveId, payload, opts) {
+  const cloud = cloudBase(opts.cloud);
+  const principal = resolveGovernancePrincipal(opts);
+  const holon = await connectGovernance(cloud, parent);
+  const device = await ensureDeviceKey(holon, principal);
+  const sealed = await holon.signGovernanceOffer({
+    directiveId,
+    payload,
+    authorSecret: device.secret,
+    actor: `user:${principal}`
+  });
+  const verdict = await holon.postGovernanceOffer({ directiveId, intentBytes: sealed.intentBytes, ws: parent });
+  return { ...verdict, principal };
+}
+async function grantOrRevoke(verb, kind, subject, opts) {
+  const parent = opts.parent ?? "root";
+  const now = Date.now();
+  let directiveId;
+  let payload;
+  const granter = (() => {
+    try {
+      return resolveGovernancePrincipal(opts);
+    } catch (e) {
+      err(e.message);
+      return void 0;
+    }
+  })();
+  if (granter === void 0) return 1;
+  const attribution = verb === "grant" ? { grantedBy: granter, grantedAt: now } : { revokedBy: granter, revokedAt: now };
+  if (kind === "admin" || kind === "creation") {
+    directiveId = (verb === "grant" ? "grant" : "revoke") + (kind === "admin" ? "Admin" : "Creation");
+    payload = { principal: subject, ...verb === "grant" ? { label: opts.label ?? `${kind} via githolon` } : {}, ...attribution };
+  } else if (kind === "quota" && verb === "grant") {
+    if (typeof opts.max !== "number" || !Number.isInteger(opts.max) || opts.max <= 0) {
+      err("grant quota needs --max <positive int> (the principal's workspace allowance)");
+      return 1;
+    }
+    directiveId = "grantQuota";
+    payload = { principal: subject, maxWorkspaces: opts.max, ...attribution };
+  } else {
+    err(`unsupported: githolon ${verb} ${kind} \u2014 expected ${verb} <admin|creation${verb === "grant" ? "|quota" : ""}> <principal>`);
+    return 1;
+  }
+  let v;
+  try {
+    v = await signAndPostGovernance(parent, directiveId, payload, opts);
+  } catch (e) {
+    err(e.message);
+    return 1;
+  }
+  if (!v.ok) {
+    err(`${directiveId} refused (${v.status}): ${typeof v.body === "string" ? v.body : JSON.stringify(v.body)}`);
+    return 1;
+  }
+  out(`\u2713 ${directiveId} ${subject} via signed governance offer to ${parent}`);
+  return 0;
+}
+async function keyEnroll(opts) {
+  const cloud = cloudBase(opts.cloud);
+  const principal = opts.principal ?? currentPrincipal();
+  if (principal === void 0) {
+    err("enroll needs a principal \u2014 githolon login --agent first (or --principal <uid>)");
+    return 1;
+  }
+  const parent = opts.parent ?? "root";
+  let holon;
+  try {
+    holon = await connectGovernance(cloud, parent);
+  } catch (e) {
+    err(`could not connect to ${parent} on ${cloud} to enroll: ${e.message}`);
+    return 1;
+  }
+  const device = await ensureDeviceKey(holon, principal);
+  const enrollPayload = await holon.enrollSignerPayload({ principal, publicKey: device.public });
+  const sealed = await holon.signGovernanceOffer({
+    directiveId: "enrollSigner",
+    payload: enrollPayload,
+    authorSecret: device.secret,
+    actor: `user:${principal}`
+  });
+  const v = await holon.postGovernanceOffer({ directiveId: "enrollSigner", intentBytes: sealed.intentBytes, ws: parent });
+  if (!v.ok) {
+    err(`enrollSigner refused (${v.status}): ${typeof v.body === "string" ? v.body : JSON.stringify(v.body)}`);
+    return 1;
+  }
+  out(`\u2713 device key enrolled for ${principal} at ${parent} on ${cloud}`);
+  out(`  keyHash ${device.keyHash.slice(0, 16)}\u2026 (secret stays local; signed governance is now warranted)`);
+  return 0;
+}
+async function keyShow(opts) {
+  const principal = opts.principal ?? currentPrincipal();
+  if (principal === void 0) {
+    out("no principal on file \u2014 githolon login --agent, or pass --principal <uid>");
+    return 0;
+  }
+  const device = getDeviceKey(principal);
+  if (device === void 0) {
+    out(`no signing device key for ${principal} yet \u2014 githolon key enroll mints + enrolls one`);
+    return 0;
+  }
+  out(`device key for ${principal}:`);
+  out(`  public  ${device.public}`);
+  out(`  keyHash ${device.keyHash} (the on-chain key:<hash> leaf; secret stays local)`);
+  return 0;
+}
+var out, err;
+var init_governance = __esm({
+  "src/governance.ts"() {
+    "use strict";
+    init_cloud();
+    out = (s) => void process.stdout.write(s + "\n");
+    err = (s) => void process.stderr.write("error: " + s + "\n");
+  }
+});
+
 // src/cloud.ts
 var cloud_exports = {};
 __export(cloud_exports, {
   cloudBase: () => cloudBase,
   configDir: () => configDir,
+  currentPrincipal: () => currentPrincipal,
   deploy: () => deploy,
   describeLawMove: () => describeLawMove,
   discoverDeployJson: () => discoverDeployJson,
+  getDeviceKey: () => getDeviceKey,
   getSecret: () => getSecret,
   loadCreds: () => loadCreds,
   login: () => login,
@@ -25,10 +183,12 @@ __export(cloud_exports, {
   secretRotate: () => secretRotate,
   secretSet: () => secretSet,
   sessionToken: () => sessionToken,
+  setDeviceKey: () => setDeviceKey,
   setPrincipal: () => setPrincipal,
   setSecret: () => setSecret,
   whoami: () => whoami,
   wsCreate: () => wsCreate,
+  wsReclaim: () => wsReclaim,
   wsRetire: () => wsRetire,
   wsStatus: () => wsStatus
 });
@@ -72,6 +232,18 @@ function setPrincipal(principal) {
   c.principal = principal;
   saveCreds(c);
 }
+function currentPrincipal() {
+  const c = loadCreds();
+  return c.session?.uid ?? c.principal;
+}
+function getDeviceKey(principal) {
+  return loadCreds().devices?.[principal];
+}
+function setDeviceKey(principal, key) {
+  const c = loadCreds();
+  (c.devices ??= {})[principal] = key;
+  saveCreds(c);
+}
 function principalHeaders(principal) {
   return /^[\w-]+\.[\w-]+\.[\w-]+$/.test(principal) ? { "x-nomos-auth": principal } : { "x-nomos-principal": principal };
 }
@@ -133,7 +305,7 @@ function discoverDeployJson(cwd, explicit) {
 }
 async function login(opts) {
   if (opts.agent !== true && opts.token === void 0) {
-    err(
+    err2(
       "browser login is not wired up yet \u2014 use one of:\n  githolon login --agent             anonymous sign-in (verified identity, linkable later)\n  githolon login --token <refresh>   adopt an existing captain app session"
     );
     return 1;
@@ -141,43 +313,67 @@ async function login(opts) {
   const d = opts.agent === true ? await gotrue("/auth/v1/signup", "{}") : await gotrue("/auth/v1/token?grant_type=refresh_token", JSON.stringify({ refresh_token: opts.token }));
   const s = sessionFromGotrue(d);
   if (s === void 0) {
-    err(`login failed: ${d.error_description ?? d.error ?? d.msg ?? JSON.stringify(d)}`);
+    err2(`login failed: ${d.error_description ?? d.error ?? d.msg ?? JSON.stringify(d)}`);
     return 1;
   }
   saveSession(s);
-  out(`\u2713 logged in${s.anonymous ? " (anonymous agent identity \u2014 linkable to a full account later)" : ""}`);
-  out(`  principal uid ${s.uid}`);
-  out(`  session saved \u2192 ${credsPath()} (auto-refreshed; births now ride x-nomos-auth)`);
+  out2(`\u2713 logged in${s.anonymous ? " (anonymous agent identity \u2014 linkable to a full account later)" : ""}`);
+  out2(`  principal uid ${s.uid}`);
+  out2(`  session saved \u2192 ${credsPath()} (auto-refreshed; births now ride x-nomos-auth)`);
   return 0;
 }
 async function whoami() {
   const c = loadCreds();
   if (c.session !== void 0) {
-    out(`session: ${c.session.anonymous ? "anonymous agent" : "account"} uid ${c.session.uid} (auth ${c.session.url})`);
+    out2(`session: ${c.session.anonymous ? "anonymous agent" : "account"} uid ${c.session.uid} (auth ${c.session.url})`);
     return 0;
   }
   if (c.principal !== void 0) {
-    out(`bare principal (transitional, unverified): ${c.principal}`);
+    out2(`bare principal (transitional, unverified): ${c.principal}`);
     return 0;
   }
-  out("not logged in \u2014 githolon login --agent, or pass --principal <uid> per birth");
+  out2("not logged in \u2014 githolon login --agent, or pass --principal <uid> per birth");
   return 0;
 }
 async function logout() {
   const c = loadCreds();
   delete c.session;
   saveCreds(c);
-  out("\u2713 session cleared (stored workspace secrets kept)");
+  out2("\u2713 session cleared (stored workspace secrets kept)");
   return 0;
 }
 async function wsCreate(name, opts) {
   const cloud = cloudBase(opts.cloud);
-  let principal = opts.principal ?? await sessionToken().catch((e) => (err(e.message), void 0)) ?? loadCreds().principal;
+  if (opts.via !== void 0) {
+    const { signAndPostGovernance: signAndPostGovernance2, resolveGovernancePrincipal: resolveGovernancePrincipal2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
+    let v;
+    try {
+      const principal2 = resolveGovernancePrincipal2(opts);
+      v = await signAndPostGovernance2(
+        opts.via,
+        "createWorkspace",
+        { name, tier: "edge", parent: opts.via === "root" ? "" : opts.via, principal: principal2, requestedBy: principal2, requestedAt: Date.now() },
+        opts
+      );
+    } catch (e) {
+      err2(e.message);
+      return 1;
+    }
+    if (!v.ok) {
+      err2(`createWorkspace '${name}' refused (${v.status}) at ${opts.via}: ${typeof v.body === "string" ? v.body : JSON.stringify(v.body)}`);
+      return 1;
+    }
+    out2(`\u2713 createWorkspace '${name}' requested via signed governance offer to ${opts.via} on ${cloud}`);
+    out2(`  the worker provisions it on first touch; deploy is open (kernel-gated)`);
+    out2(`  (want the direct birth instead? drop --via: githolon ws create ${name})`);
+    return 0;
+  }
+  let principal = opts.principal ?? await sessionToken().catch((e) => (err2(e.message), void 0)) ?? loadCreds().principal;
   if (principal === void 0) {
     const d2 = await gotrue("/auth/v1/signup", "{}");
     const s = sessionFromGotrue(d2);
     if (s === void 0) {
-      err(
+      err2(
         `a birth needs a principal, and automatic agent login failed: ${d2.error_description ?? d2.error ?? d2.msg ?? JSON.stringify(d2)}
   githolon login --agent (self-onboarding), githolon login --token <refresh>,
   or pass --principal <your-auth-uid or access token> (saved as the default)`
@@ -185,9 +381,9 @@ async function wsCreate(name, opts) {
       return 1;
     }
     saveSession(s);
-    out(`no principal on file \u2014 self-onboarded an anonymous agent identity (githolon login --agent)`);
-    out(`  principal uid ${s.uid} (linkable to a full account later)`);
-    out(`  session saved \u2192 ${credsPath()} (auto-refreshed; births ride x-nomos-auth)`);
+    out2(`no principal on file \u2014 self-onboarded an anonymous agent identity (githolon login --agent)`);
+    out2(`  principal uid ${s.uid} (linkable to a full account later)`);
+    out2(`  session saved \u2192 ${credsPath()} (auto-refreshed; births ride x-nomos-auth)`);
     principal = s.accessToken;
   }
   const r = await fetch(`${cloud}/v2/workspaces/${name}`, {
@@ -196,20 +392,12 @@ async function wsCreate(name, opts) {
   });
   const d = await r.json().catch(() => void 0);
   if (!r.ok || d?.ok !== true) {
-    err(`create '${name}' refused (${r.status}): ${d ? JSON.stringify(d) : "no body"}`);
+    err2(`create '${name}' refused (${r.status}): ${d ? JSON.stringify(d) : "no body"}`);
     return 1;
   }
   if (opts.principal !== void 0) setPrincipal(opts.principal);
-  if (typeof d.workspaceSecret === "string") {
-    setSecret(cloud, name, d.workspaceSecret);
-    out(`\u2713 workspace ${name} created on ${cloud}`);
-    out(`\u2713 workspaceSecret saved \u2192 ${credsPath()} (githolon deploy uses it automatically)`);
-  } else {
-    out(`\u2713 workspace ${name} already exists on ${cloud} (no new secret issued)`);
-    if (getSecret(cloud, name) === void 0) {
-      out(`  no stored secret for it here \u2014 if you own it: githolon secret set ${name} <secret>`);
-    }
-  }
+  out2(`\u2713 workspace ${name} created on ${cloud}`);
+  out2(`  deploy is open (kernel-gated): githolon deploy ${name}`);
   return 0;
 }
 async function wsStatus(name, opts) {
@@ -217,39 +405,61 @@ async function wsStatus(name, opts) {
   const r = await fetch(`${cloud}/v2/workspaces/${name}`);
   const text = await r.text();
   if (!r.ok) {
-    err(`status '${name}' (${r.status}): ${text}`);
+    err2(`status '${name}' (${r.status}): ${text}`);
     return 1;
   }
-  out(text);
+  out2(text);
   return 0;
 }
 async function wsRetire(ws, opts) {
   const cloud = cloudBase(opts.cloud);
-  const secret = getSecret(cloud, ws);
-  if (secret === void 0) {
-    err(
-      `no stored secret for ${ws} on ${cloud} \u2014 retirement is owner-gated
-  githolon secret set ${ws} <secret>  (import the workspaceSecret you hold)`
+  const { signAndPostGovernance: signAndPostGovernance2, resolveGovernancePrincipal: resolveGovernancePrincipal2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
+  const parent = opts.parent ?? "root";
+  let v;
+  try {
+    const principal = resolveGovernancePrincipal2(opts);
+    v = await signAndPostGovernance2(
+      parent,
+      "retireWorkspace",
+      { workspaceId: ws, retiredBy: principal, retiredAt: Date.now() },
+      opts
     );
+  } catch (e) {
+    err2(e.message);
     return 1;
   }
-  const r = await fetch(`${cloud}/v2/workspaces/${ws}/retire`, {
-    method: "POST",
-    headers: { authorization: `Bearer ${secret}` }
-  });
-  const d = await r.json().catch(() => void 0);
-  if (r.status === 401) {
-    err(`retire refused (401) \u2014 the stored secret for ${ws} is not the workspace's. githolon secret set ${ws} <secret>`);
+  if (!v.ok) {
+    err2(`retire '${ws}' refused (${v.status}): ${typeof v.body === "string" ? v.body : JSON.stringify(v.body)}`);
     return 1;
   }
-  if (!r.ok || d?.ok !== true) {
-    err(`retire '${ws}' failed (${r.status}): ${d ? JSON.stringify(d) : "no body"}`);
+  out2(`\u2713 workspace ${ws} retired via signed governance offer to ${parent} on ${cloud}`);
+  out2("  nothing was deleted \u2014 the ledger and its data are retained per the Nomos Pre-Release License");
+  out2("  it no longer counts toward your workspace allowance; reads keep serving, deploys/pushes refuse");
+  return 0;
+}
+async function wsReclaim(ws, opts) {
+  const cloud = cloudBase(opts.cloud);
+  const { signAndPostGovernance: signAndPostGovernance2, resolveGovernancePrincipal: resolveGovernancePrincipal2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
+  const parent = opts.parent ?? "root";
+  let v;
+  try {
+    const principal = resolveGovernancePrincipal2(opts);
+    v = await signAndPostGovernance2(
+      parent,
+      "reclaimWorkspace",
+      { workspaceId: ws, reclaimedBy: principal, reclaimedAt: Date.now() },
+      opts
+    );
+  } catch (e) {
+    err2(e.message);
     return 1;
   }
-  out(`\u2713 workspace ${ws} retired on ${cloud}${d.alreadyRetired === true ? " (it was already retired)" : ""}`);
-  out("  nothing was deleted \u2014 the ledger and its data are retained per the Nomos Pre-Release License");
-  out("  it no longer counts toward your workspace allowance; reads keep serving, deploys/pushes refuse");
-  out("  to un-retire: contact the operator (an admin restores the record via root's governance offer, POST /v2/workspaces/root/createWorkspace)");
+  if (!v.ok) {
+    err2(`reclaim '${ws}' refused (${v.status}): ${typeof v.body === "string" ? v.body : JSON.stringify(v.body)}`);
+    return 1;
+  }
+  out2(`\u2713 workspace ${ws} reclaimed via signed governance offer to ${parent} on ${cloud}`);
+  out2("  the custodian drops the ledger bytes on seeing this fact folded; the reclaimed FACT is append-only");
   return 0;
 }
 async function deploy(ws, opts) {
@@ -258,37 +468,24 @@ async function deploy(ws, opts) {
   try {
     file = discoverDeployJson(process.cwd(), opts.file);
   } catch (e) {
-    err(e.message);
-    return 1;
-  }
-  const secret = getSecret(cloud, ws);
-  if (secret === void 0) {
-    err(
-      `no stored secret for ${ws} on ${cloud}
-  githolon ws create ${ws}            (a fresh workspace saves its secret here)
-  githolon secret set ${ws} <secret>  (import one you already hold)`
-    );
+    err2(e.message);
     return 1;
   }
   const before = await fetch(`${cloud}/v2/workspaces/${ws}/domains`).then((br) => br.json()).then((bd) => bd.ok === true ? bd.domains ?? [] : []).catch(() => []);
   const r = await fetch(`${cloud}/v2/workspaces/${ws}/domains`, {
     method: "POST",
-    headers: { "content-type": "application/json", authorization: `Bearer ${secret}` },
+    headers: { "content-type": "application/json" },
     body: readFileSync(file, "utf8")
   });
   const d = await r.json().catch(() => void 0);
-  if (r.status === 401) {
-    err(`deploy refused (401) \u2014 the stored secret for ${ws} is not the workspace's. githolon secret set ${ws} <secret>`);
-    return 1;
-  }
   if (!r.ok || d?.ok !== true) {
-    err(`deploy '${ws}' failed (${r.status}): ${d ? JSON.stringify(d) : "no body"}`);
+    err2(`deploy '${ws}' failed (${r.status}): ${d ? JSON.stringify(d) : "no body"}`);
     return 1;
   }
   const phase = d.installation?.[0]?.data?.["status.phase"];
-  out(`\u2713 deployed ${file.split("/").pop()} \u2192 ${ws}${typeof phase === "string" ? ` (${phase})` : ""}`);
+  out2(`\u2713 deployed ${file.split("/").pop()} \u2192 ${ws}${typeof phase === "string" ? ` (${phase})` : ""}`);
   if (typeof d.domainHash === "string") {
-    out(`  law ${describeLawMove(before, d.domainHash)}`);
+    out2(`  law ${describeLawMove(before, d.domainHash)}`);
   }
   return 0;
 }
@@ -300,30 +497,19 @@ function describeLawMove(before, newHash) {
 }
 async function secretSet(ws, secret, opts) {
   setSecret(cloudBase(opts.cloud), ws, secret);
-  out(`\u2713 secret for ${ws} saved \u2192 ${credsPath()}`);
+  out2(`\u2713 git push password for ${ws} saved \u2192 ${credsPath()} (used by the push-to-create birth lane)`);
   return 0;
 }
 async function secretRotate(ws, opts) {
   const cloud = cloudBase(opts.cloud);
-  const current = getSecret(cloud, ws);
-  if (current === void 0) {
-    err(`no stored secret for ${ws} on ${cloud} \u2014 githolon secret set ${ws} <secret> first`);
-    return 1;
-  }
-  const r = await fetch(`${cloud}/v2/workspaces/${ws}/rotate-secret`, {
-    method: "POST",
-    headers: { authorization: `Bearer ${current}` }
-  });
-  const d = await r.json().catch(() => void 0);
-  if (!r.ok || d?.ok !== true || typeof d.workspaceSecret !== "string") {
-    err(`rotate '${ws}' failed (${r.status}): ${d ? JSON.stringify(d) : "no body"}`);
-    return 1;
-  }
-  setSecret(cloud, ws, d.workspaceSecret);
-  out(`\u2713 secret for ${ws} rotated and saved \u2192 ${credsPath()}`);
-  return 0;
+  err2(
+    `secret rotate is retired (host-authority strip) \u2014 there is no host-held workspace secret on ${cloud}
+  ownership is sha256(push password) bound in the chain; re-own by re-birthing via the upload lane
+  with a new push password (see: githolon git remote ${ws} && git push nomos main)`
+  );
+  return 1;
 }
-var DEFAULT_CLOUD, DEFAULT_AUTH_URL, DEFAULT_AUTH_ANON_KEY, secretKey, out, err;
+var DEFAULT_CLOUD, DEFAULT_AUTH_URL, DEFAULT_AUTH_ANON_KEY, secretKey, out2, err2;
 var init_cloud = __esm({
   "src/cloud.ts"() {
     "use strict";
@@ -331,8 +517,8 @@ var init_cloud = __esm({
     DEFAULT_AUTH_URL = "https://kjbcjkihxskuwwfdqklt.supabase.co";
     DEFAULT_AUTH_ANON_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImtqYmNqa2loeHNrdXd3ZmRxa2x0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTA3MDU2OTAsImV4cCI6MjA2NjI4MTY5MH0.V9e7XsuTlTOLqefOIedTqlBiTxUSn4O5FZSPWwAxiSI";
     secretKey = (cloud, ws) => `${cloud} ${ws}`;
-    out = (s) => void process.stdout.write(s + "\n");
-    err = (s) => void process.stderr.write("error: " + s + "\n");
+    out2 = (s) => void process.stdout.write(s + "\n");
+    err2 = (s) => void process.stderr.write("error: " + s + "\n");
   }
 });
 
@@ -453,13 +639,13 @@ var init_tree = __esm({
 function concatBytes(chunks) {
   let n = 0;
   for (const c of chunks) n += c.length;
-  const out9 = new Uint8Array(n);
+  const out10 = new Uint8Array(n);
   let o = 0;
   for (const c of chunks) {
-    out9.set(c, o);
+    out10.set(c, o);
     o += c.length;
   }
-  return out9;
+  return out10;
 }
 function pkt(payload) {
   const body = typeof payload === "string" ? enc2.encode(payload) : payload;
@@ -612,13 +798,13 @@ async function sha256hex(t) {
 function osEntropyBuffer(n) {
   const bytes = new Uint8Array(n * 8);
   for (let o = 0; o < bytes.length; o += 65536) crypto.getRandomValues(bytes.subarray(o, Math.min(o + 65536, bytes.length)));
-  const out9 = new Array(n), T = 2 ** 53;
+  const out10 = new Array(n), T = 2 ** 53;
   for (let i = 0; i < n; i++) {
     let z = 0n;
     for (let b = 7; b >= 0; b--) z = z << 8n | BigInt(bytes[i * 8 + b]);
-    out9[i] = Number(z >> 11n) / T;
+    out10[i] = Number(z >> 11n) / T;
   }
-  return out9;
+  return out10;
 }
 function stringifyBig(o) {
   return JSON.stringify(o, (_k, v) => typeof v === "bigint" ? `@@B:${v}@@` : v).replace(/"@@B:(\d+)@@"/g, "$1");
@@ -716,13 +902,19 @@ function mintId(eng, typeTag) {
 }
 function author(eng, ws, domain, directiveId, payload, controllerHash, opts = {}) {
   const seq = eng.seq++;
-  const envelope = { payload: { domain, directiveId, payload }, captured_ports: { clock: { physical: Date.now(), logical: 0, replica: eng.replica }, rng: osEntropyBuffer(opts.rngDraws ?? 64) }, policy_version: 1, policy_domain: "Nomos", policy_gas: 0, policy_memory: 0 };
+  const capPorts = { clock: { physical: Date.now(), logical: 0, replica: eng.replica }, rng: osEntropyBuffer(opts.rngDraws ?? 64) };
+  if (opts.validFromEpoch !== void 0) capPorts.valid_from_epoch = opts.validFromEpoch;
+  if (opts.principalVerified !== void 0) {
+    capPorts.principal = opts.actor ?? "";
+    capPorts.principal_verified = !!opts.principalVerified;
+  }
+  const envelope = { payload: { domain, directiveId, payload }, captured_ports: capPorts, policy_version: 1, policy_domain: "Nomos", policy_gas: 0, policy_memory: 0 };
   writeWork(eng, `payload-${seq}.json`, enc3.encode(JSON.stringify(payload)));
   writeWork(eng, `envelope-${seq}.json`, enc3.encode(stringifyBig(envelope)));
   const genesis = !controllerHash;
   const defer = opts.deferProjection !== false;
-  const v = JSON.parse(call(eng.ex, "offer", { repoArg: repoArgOf(ws), workspace: ws, domain, directiveId, payloadFile: `/work/payload-${seq}.json`, envelopeFile: `/work/envelope-${seq}.json`, seq, actor: opts.actor ?? "", domainFile: genesis ? "/work/domain.package.usda" : "", domainHash: genesis ? "" : controllerHash, branch: BRANCH, ...opts.authorSecret ? { authorSecret: opts.authorSecret } : {}, ...opts.dryRun ? { dryRun: true } : defer ? { deferProjection: true } : {} }, eng.STDERR));
-  const res = v.outcome === "admitted" ? { ok: true, head: v.head, intentOut: v.intentOut } : v.outcome === "refused" ? { ok: false, error: v.verdict?.reason ?? v.error } : v;
+  const v = JSON.parse(call(eng.ex, "offer", { repoArg: repoArgOf(ws), workspace: ws, domain, directiveId, payloadFile: `/work/payload-${seq}.json`, envelopeFile: `/work/envelope-${seq}.json`, seq, actor: opts.actor ?? "", ...opts.authToken ? { authToken: opts.authToken } : {}, domainFile: genesis ? "/work/domain.package.usda" : "", domainHash: genesis ? "" : controllerHash, branch: BRANCH, ...opts.authorSecret ? { authorSecret: opts.authorSecret } : {}, ...opts.dryRun ? { dryRun: true } : defer ? { deferProjection: true } : {} }, eng.STDERR));
+  const res = v.outcome === "admitted" ? { ok: true, head: v.head, intentOut: v.intentOut, ...v.born ? { born: v.born } : {} } : v.outcome === "refused" ? { ok: false, error: v.verdict?.reason ?? v.error } : v;
   if (defer && res.ok) (eng.pendingProjection ??= /* @__PURE__ */ new Set()).add(ws);
   return res;
 }
@@ -763,7 +955,7 @@ function offerIntent(eng, ws, bytes, opts) {
 }
 function offerAdmit(eng, ws, bytes, opts) {
   const v = offerIntent(eng, ws, bytes, opts);
-  return v.outcome === "admitted" ? { ok: true, head: v.head } : { ok: false, error: v.verdict?.reason ?? v.error ?? "the offer was refused" };
+  return v.outcome === "admitted" ? { ok: true, head: v.head, ...v.born ? { born: v.born } : {} } : { ok: false, error: v.verdict?.reason ?? v.error ?? "the offer was refused" };
 }
 function applyIntentBytes(eng, ws, bytes, opts) {
   return offerAdmit(eng, ws, bytes, opts);
@@ -919,21 +1111,21 @@ function sealedIntentOf(eng, ws, res) {
 }
 function printVerdict(v) {
   if (v["valid"] === true) {
-    out2(`\u2713 chain VALID \u2014 head ${String(v["head"]).slice(0, 12)}\u2026, ${v["intents"]} intent(s), ${v["plansRerun"]} plan(s) re-run`);
-    out2(`  controller ${String(v["controllerHash"]).slice(0, 12)}\u2026 | installed: ${v["installedDomains"]?.map((h) => h.slice(0, 12) + "\u2026").join(", ") ?? "\u2014"}`);
+    out3(`\u2713 chain VALID \u2014 head ${String(v["head"]).slice(0, 12)}\u2026, ${v["intents"]} intent(s), ${v["plansRerun"]} plan(s) re-run`);
+    out3(`  controller ${String(v["controllerHash"]).slice(0, 12)}\u2026 | installed: ${v["installedDomains"]?.map((h) => h.slice(0, 12) + "\u2026").join(", ") ?? "\u2014"}`);
     return true;
   }
-  err2(`chain INVALID at ${v["check"]}${v["atIndex"] !== void 0 ? ` (intent ${v["atIndex"]})` : ""}: ${v["error"]}`);
+  err3(`chain INVALID at ${v["check"]}${v["atIndex"] !== void 0 ? ` (intent ${v["atIndex"]})` : ""}: ${v["error"]}`);
   return false;
 }
-var out2, err2;
+var out3, err3;
 var init_local_holon = __esm({
   "src/local_holon.ts"() {
     "use strict";
     init_engine();
     init_cloud();
-    out2 = (s) => void process.stdout.write(s + "\n");
-    err2 = (s) => void process.stderr.write("error: " + s + "\n");
+    out3 = (s) => void process.stdout.write(s + "\n");
+    err3 = (s) => void process.stderr.write("error: " + s + "\n");
   }
 });
 
@@ -1267,6 +1459,7 @@ Re-run with --force to replace it.`
 
 // src/cli.ts
 init_cloud();
+init_governance();
 
 // src/compile.ts
 import { spawn, spawnSync } from "node:child_process";
@@ -1412,8 +1605,8 @@ async function resolveWorkspace(explicit, cwd, target, usageHint) {
 
 // src/dev.ts
 init_proof_offline();
-var out3 = (s) => void process.stdout.write(s + "\n");
-var err3 = (s) => void process.stderr.write("error: " + s + "\n");
+var out4 = (s) => void process.stdout.write(s + "\n");
+var err4 = (s) => void process.stderr.write("error: " + s + "\n");
 var WS = "dev";
 var DEFAULT_PORT = 7700;
 var DEBOUNCE_MS = 200;
@@ -1536,21 +1729,21 @@ async function dev(opts) {
   const cwd = process.cwd();
   const cloud = cloudBase(opts.cloud);
   const project = await loadProject(cwd).catch((e) => {
-    err3(e.message);
+    err4(e.message);
     return void 0;
   });
   if (project === void 0) {
     if (!existsSync6(join7(cwd, CONFIG_FILE))) {
-      err3(`no ${CONFIG_FILE} here (${cwd}) \u2014 \`githolon dev\` runs inside a project; scaffold one from examples/guestbook or \`githolon generate domain <name>\``);
+      err4(`no ${CONFIG_FILE} here (${cwd}) \u2014 \`githolon dev\` runs inside a project; scaffold one from examples/guestbook or \`githolon generate domain <name>\``);
     }
     return 1;
   }
   const creds = loadCreds();
   const installedBy = creds.session?.uid ?? creds.principal ?? "githolon-dev";
-  out3(`githolon dev \u2014 ${project.name}: compiling\u2026`);
+  out4(`githolon dev \u2014 ${project.name}: compiling\u2026`);
   const firstCompile = await compileAsync(cwd);
   if (!firstCompile.ok) {
-    err3(`compile failed \u2014 the dev loop needs one green compile to mint the holon:
+    err4(`compile failed \u2014 the dev loop needs one green compile to mint the holon:
 ${firstCompile.output}`);
     return 1;
   }
@@ -1558,14 +1751,14 @@ ${firstCompile.output}`);
   try {
     deployBody = readDeployBody(cwd, project.name);
   } catch (e) {
-    err3(e.message);
+    err4(e.message);
     return 1;
   }
   let engBoot;
   try {
     engBoot = await holonEngine(cloud, deployBody, installedBy);
   } catch (e) {
-    err3(`cannot boot the local holon: ${String(e.message ?? e)}
+    err4(`cannot boot the local holon: ${String(e.message ?? e)}
   the runtime rides ${cloud}/v1/runtime/* and is cached in ~/.holon/runtime after one fetch \u2014 connect once, then dev runs offline`);
     return 1;
   }
@@ -1588,19 +1781,19 @@ ${firstCompile.output}`);
   s.intents++;
   const installed = await installLaw(s, deployBody, installedBy);
   if (!installed.ok) {
-    err3(installed.error ?? "law install failed");
+    err4(installed.error ?? "law install failed");
     return 1;
   }
   s.proof = await runProofCycle(s, cwd, deployBody, installedBy);
   if (opts.once === true) {
-    out3(statusScreen({ ...s, watchRoots: ["(--once: no watch)"] }));
+    out4(statusScreen({ ...s, watchRoots: ["(--once: no watch)"] }));
     return s.proof === void 0 || s.proof.ok ? 0 : 1;
   }
   let server;
   try {
     server = await startServer(s);
   } catch (e) {
-    err3(e.message);
+    err4(e.message);
     return 1;
   }
   const moduleDirs = /* @__PURE__ */ new Set();
@@ -1628,7 +1821,7 @@ ${firstCompile.output}`);
     s.compileMs = run.ms;
     if (!run.ok) {
       s.lastError = run.output.trim() || "compile failed";
-      out3(`\u2717 cycle ${s.cycle}: compile failed \u2014 the previous law keeps serving
+      out4(`\u2717 cycle ${s.cycle}: compile failed \u2014 the previous law keeps serving
 ${run.output}`);
     } else {
       s.lastError = void 0;
@@ -1637,16 +1830,16 @@ ${run.output}`);
         const inst = await installLaw(s, body, installedBy);
         if (!inst.ok) {
           s.lastError = inst.error ?? "install failed";
-          out3(`\u2717 cycle ${s.cycle}: ${s.lastError}`);
+          out4(`\u2717 cycle ${s.cycle}: ${s.lastError}`);
         } else {
           s.proof = await runProofCycle(s, cwd, body, installedBy);
           const total = performance.now() - t0;
-          out3(statusScreen(s));
-          out3(`  cycle      edit \u2192 law-live \u2192 proof in ${total.toFixed(0)} ms total`);
+          out4(statusScreen(s));
+          out4(`  cycle      edit \u2192 law-live \u2192 proof in ${total.toFixed(0)} ms total`);
         }
       } catch (e) {
         s.lastError = String(e.message ?? e);
-        out3(`\u2717 cycle ${s.cycle}: ${s.lastError}`);
+        out4(`\u2717 cycle ${s.cycle}: ${s.lastError}`);
       }
     }
     cycling = false;
@@ -1672,8 +1865,8 @@ ${run.output}`);
     })
   );
   s.watchRoots.push(CONFIG_FILE);
-  out3(statusScreen(s));
-  out3("  (ctrl-c stops; edits in the watched paths recompile + re-prove automatically)");
+  out4(statusScreen(s));
+  out4("  (ctrl-c stops; edits in the watched paths recompile + re-prove automatically)");
   return new Promise((resolveExit) => {
     const stop = () => {
       for (const w of watchers) w.close();
@@ -1690,8 +1883,8 @@ init_cloud();
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { readFileSync as readFileSync5 } from "node:fs";
-var out4 = (s) => void process.stdout.write(s + "\n");
-var err4 = (s) => void process.stderr.write("error: " + s + "\n");
+var out5 = (s) => void process.stdout.write(s + "\n");
+var err5 = (s) => void process.stderr.write("error: " + s + "\n");
 function git(args, opts = {}) {
   const r = spawnSync2("git", args, { stdio: opts.quiet === true ? "ignore" : "inherit" });
   return r.status ?? 1;
@@ -1723,31 +1916,31 @@ async function gitCredential(action) {
   if (kv["protocol"] !== "https" || ws === void 0) return 0;
   const cloud = `https://${kv["host"]}`;
   const token = await sessionToken().catch(() => void 0);
-  out4(`username=${token ?? "nomos"}`);
-  out4(`password=${ensureSecret(cloud, ws)}`);
-  out4("");
+  out5(`username=${token ?? "nomos"}`);
+  out5(`password=${ensureSecret(cloud, ws)}`);
+  out5("");
   return 0;
 }
 async function gitSetup(opts) {
   const cloud = cloudBase(opts.cloud);
   const self = process.argv[1];
   if (self === void 0) {
-    err4("cannot locate the githolon CLI entry to install as a credential helper");
+    err5("cannot locate the githolon CLI entry to install as a credential helper");
     return 1;
   }
   const helper = `!"${process.execPath}" "${self}" git-credential`;
   if (git(["config", "--global", `credential.${cloud}.helper`, helper]) !== 0 || git(["config", "--global", `credential.${cloud}.useHttpPath`, "true"]) !== 0) {
-    err4("git config failed \u2014 is git installed?");
+    err5("git config failed \u2014 is git installed?");
     return 1;
   }
-  out4(`\u2713 git credential helper installed for ${cloud} (global gitconfig)`);
-  out4(`  pushes/clones of ${cloud}/v2/workspaces/<ws>/git now authenticate from ~/.holon`);
+  out5(`\u2713 git credential helper installed for ${cloud} (global gitconfig)`);
+  out5(`  pushes/clones of ${cloud}/v2/workspaces/<ws>/git now authenticate from ~/.holon`);
   return 0;
 }
 async function gitRemote(ws, name, opts) {
   const cloud = cloudBase(opts.cloud);
   if (git(["rev-parse", "--git-dir"], { quiet: true }) !== 0) {
-    err4("not a git repository \u2014 run inside your repo (git init first)");
+    err5("not a git repository \u2014 run inside your repo (git init first)");
     return 1;
   }
   const setupRc = await gitSetup(opts);
@@ -1756,7 +1949,7 @@ async function gitRemote(ws, name, opts) {
   const url = `${cloud}/v2/workspaces/${ws}/git`;
   if (git(["remote", "add", name, url], { quiet: true }) !== 0) {
     if (git(["remote", "set-url", name, url], { quiet: true }) !== 0) {
-      err4(`could not add or update remote '${name}'`);
+      err5(`could not add or update remote '${name}'`);
       return 1;
     }
   }
@@ -1764,7 +1957,7 @@ async function gitRemote(ws, name, opts) {
   if (token === void 0) {
     const principal = loadCreds().principal;
     if (principal === void 0) {
-      err4(
+      err5(
         `remote '${name}' \u2192 ${url} is wired, but a BIRTH push needs a principal:
   githolon login --agent   (then just push)
   \u2014 or re-run after githolon ws create/login so a principal is on file`
@@ -1772,13 +1965,13 @@ async function gitRemote(ws, name, opts) {
       return 1;
     }
     if (git(["config", `http.${url}.extraHeader`, `x-nomos-principal: ${principal}`]) !== 0) {
-      err4("git config failed setting the principal header");
+      err5("git config failed setting the principal header");
       return 1;
     }
   }
-  out4(`\u2713 remote '${name}' \u2192 ${url}`);
-  out4(`  workspace secret on file; ${token !== void 0 ? "births ride your session (verified)" : "births ride x-nomos-principal (bare uid)"}`);
-  out4(`  birth/deploy by push:  git push ${name} main`);
+  out5(`\u2713 remote '${name}' \u2192 ${url}`);
+  out5(`  workspace secret on file; ${token !== void 0 ? "births ride your session (verified)" : "births ride x-nomos-principal (bare uid)"}`);
+  out5(`  birth/deploy by push:  git push ${name} main`);
   return 0;
 }
 
@@ -1858,18 +2051,50 @@ var HELP = {
     what: "Clear the session. Stored workspace secrets are KEPT."
   },
   ws: {
-    usage: "githolon ws <create|status|retire> [<name>] [--principal <uid|token>] [--cloud <url>] [--target <name>]",
-    what: "Workspace lifecycle on Nomos Cloud. `create` births one (saves its ONE-TIME secret to\n~/.holon); `status` shows lineage/phase/verdicts; `retire` frees the quota slot (owner; nothing\nis deleted). `status` with no <name> resolves the project's `workspace` binding.",
+    usage: "githolon ws <create|status|retire|reclaim> [<name>] [--principal <uid|token>] [--via <parent>] [--parent <ws>] [--cloud <url>] [--target <name>]",
+    what: "Workspace lifecycle on Nomos Cloud. `create` births one (NO host secret is issued \u2014\nownership is a ledger fact; deploy is open + kernel-gated) or, with --via <parent>, requests it\nas a SIGNED createWorkspace governance offer. `status` shows lineage/phase/verdicts. `retire`\nand `reclaim` are SIGNED governance offers to the parent (default root) \u2014 never host-author\nendpoints; retire withdraws the law (data retained), reclaim authorizes the bailiff to drop\ncustody (only a retired workspace; never root). `status` with no <name> resolves the project's\n`workspace` binding.",
     flags: [
       ["--principal <p>", "the birth's principal (uid or access token; remembered as the default)"],
+      ["--via <parent>", "ws create: sign a createWorkspace offer at <parent> instead of the raw birth"],
+      ["--parent <ws>", "retire/reclaim: the governance workspace to sign against (default root)"],
       ["--cloud <url>", "target cloud (default: $NOMOS_CLOUD or the public cloud)"],
       ["--target <name>", "ws status: pick among the project's named workspace targets"]
     ],
-    examples: ["githolon ws create my-guestbook", "githolon ws status", "githolon ws retire my-guestbook"]
+    examples: ["githolon ws create my-guestbook", "githolon ws create app1 --via co2", "githolon ws status", "githolon ws retire my-guestbook"]
+  },
+  key: {
+    usage: "githolon key <enroll|show> [--principal <uid>] [--parent <ws>] [--cloud <url>]",
+    what: "The signing DEVICE KEY (ed25519) the SIGNED-governance lane authors with. `enroll` mints one\n(if needed) and enrolls its PUBLIC half on-chain (a signed enrollSigner offer at the parent,\ndefault root) so the warrant gate can prove this device authors as the principal; `show` prints\nthe public identity. The SECRET stays in ~/.holon/credentials.json (0600) \u2014 never on chain.",
+    flags: [
+      ["--principal <p>", "the principal the key authors as (default: the logged-in session uid)"],
+      ["--parent <ws>", "the governance workspace to enroll at (default root)"],
+      ["--cloud <url>", "target cloud"]
+    ],
+    examples: ["githolon key enroll", "githolon key show"]
+  },
+  grant: {
+    usage: "githolon grant <admin|creation|quota> <principal> [--max <N>] [--label <L>] [--parent <ws>] [--cloud <url>]",
+    what: "Grant authority as a SIGNED governance offer to the parent (default root) \u2014 never a host\nendpoint. The grant is attributed to YOUR signing principal; only an admin's signature is\nadmitted by the far-side gate. `admin`/`creation` grant the principal-centric relation; `quota`\ngrants a per-principal workspace allowance (--max). Enroll a device key first (githolon key enroll).",
+    flags: [
+      ["--max <N>", "grant quota: the principal's workspace allowance (positive int)"],
+      ["--label <L>", "grant admin/creation: a provenance label"],
+      ["--parent <ws>", "the governance workspace to sign against (default root)"],
+      ["--cloud <url>", "target cloud"]
+    ],
+    examples: ["githolon grant creation 32c7100e-\u2026", "githolon grant admin 32c7100e-\u2026 --label lieutenant", "githolon grant quota 32c7100e-\u2026 --max 200"]
+  },
+  revoke: {
+    usage: "githolon revoke <admin|creation> <principal> [--parent <ws>] [--cloud <url>]",
+    what: "Revoke authority as a SIGNED governance offer to the parent (default root). The revoked FACT\n(who, when, by whom) rides the chain forever \u2014 audit is structural. Admin-gated, like grant.",
+    flags: [
+      ["--parent <ws>", "the governance workspace to sign against (default root)"],
+      ["--cloud <url>", "target cloud"]
+    ],
+    examples: ["githolon revoke creation 32c7100e-\u2026", "githolon revoke admin 32c7100e-\u2026"]
   },
   deploy: {
     usage: "githolon deploy [<ws>] [--file <deploy.json>] [--cloud <url>] [--target <name>]",
-    what: "POST build/*.deploy.json with the stored workspace secret. Prints what MOVED (old \u2192 new law\nhash). With no <ws>, the project's `workspace` binding in nomos.package.mjs resolves it.",
+    what: "POST build/*.deploy.json on the OPEN deploy lane (kernel-gated \u2014 no host secret). Prints what\nMOVED (old \u2192 new law hash). With no <ws>, the project's `workspace` binding in nomos.package.mjs\nresolves it.",
     flags: [
       ["--file <path>", "an explicit deploy body (default: the one build/*.deploy.json)"],
       ["--target <name>", "pick among named targets (workspace: { dev: \u2026, prod: \u2026 })"],
@@ -1878,9 +2103,9 @@ var HELP = {
     examples: ["githolon deploy", "githolon deploy my-guestbook", "githolon deploy --target prod"]
   },
   secret: {
-    usage: "githolon secret <set <ws> <secret> | rotate <ws>> [--cloud <url>]",
-    what: "The workspace-secret store (~/.holon/credentials.json, 0600). `set` imports one you already\nhold; `rotate` mints a fresh one (and claims a legacy workspace).",
-    examples: ["githolon secret set my-ws nws_v1_\u2026", "githolon secret rotate my-ws"]
+    usage: "githolon secret <set <ws> <push-password> | rotate <ws>> [--cloud <url>]",
+    what: "The git push-password store (~/.holon/credentials.json, 0600) for the push-to-create birth lane\n(sha256(it) becomes the workspace owner bound IN THE CHAIN). The open deploy lane uses no secret.\n`set` imports a push password you already hold; `rotate` is RETIRED (the host holds no ownership\ncredential to rotate \u2014 410).",
+    examples: ["githolon secret set my-ws holon_v1_\u2026"]
   },
   git: {
     usage: "githolon git <setup | remote [<ws>] [<remoteName>]> [--cloud <url>] [--target <name>]",
@@ -1916,20 +2141,20 @@ init_local_holon();
 import { spawnSync as spawnSync3 } from "node:child_process";
 import { existsSync as existsSync7, readdirSync as readdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "node:fs";
 import { join as join8 } from "node:path";
-var out5 = (s) => void process.stdout.write(s + "\n");
-var err5 = (s) => void process.stderr.write("error: " + s + "\n");
+var out6 = (s) => void process.stdout.write(s + "\n");
+var err6 = (s) => void process.stderr.write("error: " + s + "\n");
 var WS2 = "local";
 async function ledgerInit(dir, opts) {
   const cloud = cloudBase(opts.cloud);
   if (existsSync7(dir) && readdirSync3(dir).length > 0) {
-    err5(`refusing to mint into non-empty directory: ${dir}`);
+    err6(`refusing to mint into non-empty directory: ${dir}`);
     return 1;
   }
   let deployFile;
   try {
     deployFile = discoverDeployJson(process.cwd(), opts.file);
   } catch (e) {
-    err5(e.message);
+    err6(e.message);
     return 1;
   }
   const deployBody = JSON.parse(readFileSync6(deployFile, "utf8"));
@@ -1937,10 +2162,10 @@ async function ledgerInit(dir, opts) {
   const c = loadCreds();
   const principal = await sessionToken().catch(() => void 0) !== void 0 ? c.session.uid : c.principal;
   if (principal === void 0) {
-    err5("a holon is born OF someone \u2014 githolon login --agent first (or githolon ws create --principal <uid> once)");
+    err6("a holon is born OF someone \u2014 githolon login --agent first (or githolon ws create --principal <uid> once)");
     return 1;
   }
-  out5(`minting a holon locally (law ${domainHash.slice(0, 12)}\u2026, installedBy ${principal})`);
+  out6(`minting a holon locally (law ${domainHash.slice(0, 12)}\u2026, installedBy ${principal})`);
   const { eng } = await holonEngine(cloud, deployBody, principal);
   await mountFresh(eng, WS2);
   author(eng, WS2, "bootstrap", "installDomain", installPayload(eng.hashes.nomos, eng.nomosPkg, principal), "");
@@ -1953,16 +2178,16 @@ async function ledgerInit(dir, opts) {
   const cfgPath = join8(gitDir, "config");
   writeFileSync4(cfgPath, readFileSync6(cfgPath, "utf8").replace(/bare = true/, "bare = false"), "utf8");
   spawnSync3("git", ["-C", dir, "reset", "--hard", "main"], { stdio: "ignore" });
-  out5(`\u2713 holon written \u2192 ${dir} (a normal git repo; git log IS the audit trail)`);
-  out5(`
+  out6(`\u2713 holon written \u2192 ${dir} (a normal git repo; git log IS the audit trail)`);
+  out6(`
 Birth it on Nomos Cloud (the cloud re-derives this exact verdict):`);
-  out5(`  cd ${dir} && npx githolon git remote <ws> && git push nomos main`);
+  out6(`  cd ${dir} && npx githolon git remote <ws> && git push nomos main`);
   return 0;
 }
 async function ledgerVerify(dir, opts) {
   const gitDir = existsSync7(join8(dir, ".git")) ? join8(dir, ".git") : dir;
   if (!existsSync7(join8(gitDir, "HEAD"))) {
-    err5(`${dir} is not a git repo (no HEAD)`);
+    err6(`${dir} is not a git repo (no HEAD)`);
     return 1;
   }
   const { eng } = await holonEngine(cloudBase(opts.cloud), void 0, "verify");
@@ -1980,8 +2205,8 @@ init_local_holon();
 import { existsSync as existsSync8 } from "node:fs";
 import { join as join9 } from "node:path";
 import git2 from "isomorphic-git";
-var out6 = (s) => void process.stdout.write(s + "\n");
-var err6 = (s) => void process.stderr.write("error: " + s + "\n");
+var out7 = (s) => void process.stdout.write(s + "\n");
+var err7 = (s) => void process.stderr.write("error: " + s + "\n");
 var SOURCE = "source";
 var REPLAY = "replay";
 function summarizePayload(payload, max = 100) {
@@ -2017,9 +2242,9 @@ function capJsonStrings(v, max = 2048) {
   if (typeof v === "string") return v.length > max ? `${v.slice(0, max)}\u2026(${v.length} chars)` : v;
   if (Array.isArray(v)) return v.map((x) => capJsonStrings(x, max));
   if (typeof v === "object" && v !== null) {
-    const out9 = {};
-    for (const [k, x] of Object.entries(v)) out9[k] = capJsonStrings(x, max);
-    return out9;
+    const out10 = {};
+    for (const [k, x] of Object.entries(v)) out10[k] = capJsonStrings(x, max);
+    return out10;
   }
   return v;
 }
@@ -2066,12 +2291,12 @@ function readKey() {
 async function replay(target, opts) {
   const cloud = cloudBase(opts.cloud);
   const json = opts.json === true;
-  const emit = (o) => out6(JSON.stringify(o));
+  const emit = (o) => out7(JSON.stringify(o));
   let eng;
   try {
     ({ eng } = await holonEngine(cloud, void 0, "githolon-replay"));
   } catch (e) {
-    err6(`cannot boot the local holon: ${String(e.message ?? e)}
+    err7(`cannot boot the local holon: ${String(e.message ?? e)}
   the runtime rides ${cloud}/v1/runtime/* (cached in ~/.holon/runtime after one fetch)`);
     return 1;
   }
@@ -2079,7 +2304,7 @@ async function replay(target, opts) {
   if (isDir) {
     const gitDir = existsSync8(join9(target, ".git")) ? join9(target, ".git") : target;
     if (!existsSync8(join9(gitDir, "HEAD"))) {
-      err6(`${target} is not a git repo (no HEAD) \u2014 pass a holon directory (githolon ledger init <dir>) or a workspace name`);
+      err7(`${target} is not a git repo (no HEAD) \u2014 pass a holon directory (githolon ledger init <dir>) or a workspace name`);
       return 1;
     }
     await mountFresh(eng, SOURCE);
@@ -2087,7 +2312,7 @@ async function replay(target, opts) {
   } else {
     const m = await mountWorkspace(eng, SOURCE, { remote: `${cloud}/v2/workspaces/${target}/git`, headers: {} });
     if (m.restored !== true) {
-      err6(
+      err7(
         `workspace '${target}' has no refs/heads/main on ${cloud} \u2014 nothing to replay` + (m.restoreError ? ` (${String(m.restoreError).split(" | ")[0]})` : "") + `
   check the name (githolon ws status ${target}), or pass a local holon directory instead`
       );
@@ -2096,7 +2321,7 @@ async function replay(target, opts) {
   }
   const chain = await walkChain(eng, SOURCE);
   if (chain.length === 0) {
-    err6(`the chain on '${target}' carries no intents \u2014 nothing to replay`);
+    err7(`the chain on '${target}' carries no intents \u2014 nothing to replay`);
     return 1;
   }
   await mountFresh(eng, REPLAY);
@@ -2105,8 +2330,8 @@ async function replay(target, opts) {
   const tallies = /* @__PURE__ */ new Map();
   let autoRun = !interactive;
   if (!json) {
-    out6(`replaying ${chain.length} intent(s) from ${isDir ? target : `${cloud} :: ${target}`} \u2014 every step re-admitted through the wasm gate`);
-    if (interactive) out6("  keys: enter = next intent \xB7 a = run to the end \xB7 q = quit\n");
+    out7(`replaying ${chain.length} intent(s) from ${isDir ? target : `${cloud} :: ${target}`} \u2014 every step re-admitted through the wasm gate`);
+    if (interactive) out7("  keys: enter = next intent \xB7 a = run to the end \xB7 q = quit\n");
   }
   for (let i = 0; i < chain.length; i++) {
     const { oid, bytes, doc } = chain[i];
@@ -2120,8 +2345,8 @@ async function replay(target, opts) {
     if (res.ok === false) {
       const msg = `replay REFUSED at intent ${i} (${domain}/${directive}, ${oid.slice(0, 10)}): ${res.error ?? "unknown"}`;
       if (json) emit({ step: i, oid, domain, directive, refused: true, error: res.error ?? "unknown" });
-      else err6(msg);
-      err6("the chain's own gate rejects this entry on a fresh fold \u2014 the source it came from would refuse it too (verify below names the check)");
+      else err7(msg);
+      err7("the chain's own gate rejects this entry on a fresh fold \u2014 the source it came from would refuse it too (verify below names the check)");
       printVerdict(verifyChainLocal(eng, SOURCE));
       return 1;
     }
@@ -2142,31 +2367,31 @@ async function replay(target, opts) {
         tallies: Object.fromEntries(tallies)
       });
     } else {
-      out6(`[${String(i + 1).padStart(String(chain.length).length)}/${chain.length}] ${domain}/${directive}  (${oid.slice(0, 10)}, ${ms.toFixed(0)} ms)`);
-      out6(`      payload  ${summarizePayload(doc.payload?.payload)}`);
+      out7(`[${String(i + 1).padStart(String(chain.length).length)}/${chain.length}] ${domain}/${directive}  (${oid.slice(0, 10)}, ${ms.toFixed(0)} ms)`);
+      out7(`      payload  ${summarizePayload(doc.payload?.payload)}`);
       for (const ev of doc.events ?? []) {
         const id = ev.aggregate ?? "?";
         const was = before.get(id);
         const verb = ev.marker === "Create" ? "+ created" : ev.marker === "Delete" ? "- deleted" : was === void 0 ? "~ touched" : "~ updated";
-        out6(`      ${verb}  ${id}`);
+        out7(`      ${verb}  ${id}`);
         const ops = summarizeOps(ev);
-        if (ops.length > 0) out6(`                ${ops}`);
+        if (ops.length > 0) out7(`                ${ops}`);
       }
       const tallyLine = [...tallies.entries()].map(([t, n]) => `${t}:${n}`).join("  ");
       const showTally = stepEvery > 0 ? (i + 1) % stepEvery === 0 || i === chain.length - 1 : true;
-      if (showTally && tallyLine.length > 0) out6(`      rows     ${tallyLine}`);
+      if (showTally && tallyLine.length > 0) out7(`      rows     ${tallyLine}`);
     }
     if (interactive && !autoRun && i < chain.length - 1) {
       const key = await readKey();
       if (key === "quit") {
-        out6(`
+        out7(`
 stopped at intent ${i + 1}/${chain.length} \u2014 the verify verdict below covers the WHOLE chain as delivered`);
         break;
       }
       if (key === "all") autoRun = true;
     }
   }
-  if (!json) out6("");
+  if (!json) out7("");
   const verdict = verifyChainLocal(eng, SOURCE);
   if (json) {
     emit({ finale: true, verdict });
@@ -2180,32 +2405,32 @@ init_local_holon();
 init_cloud();
 init_engine();
 var SOURCE2 = "source";
-var out7 = (s) => {
+var out8 = (s) => {
   process.stdout.write(s + "\n");
 };
-var err7 = (s) => {
+var err8 = (s) => {
   process.stderr.write(`error: ${s}
 `);
 };
 async function decrypt(ws, opts) {
   const cloud = cloudBase(opts.cloud);
   if (!opts.as) {
-    err7("--as <principal> is required (who to decrypt as)");
+    err8("--as <principal> is required (who to decrypt as)");
     return 1;
   }
   if (!opts.secret) {
-    err7("--secret <base64 X25519 device secret> is required");
+    err8("--secret <base64 X25519 device secret> is required");
     return 1;
   }
   if (!opts.query) {
-    err7("--query <queryId> is required (the read to decrypt)");
+    err8("--query <queryId> is required (the read to decrypt)");
     return 1;
   }
   let eng;
   try {
     ({ eng } = await holonEngine(cloud, opts.overlay, "githolon-decrypt"));
   } catch (e) {
-    err7(`cannot boot the local holon: ${String(e.message ?? e)}`);
+    err8(`cannot boot the local holon: ${String(e.message ?? e)}`);
     return 1;
   }
   const m = await mountWorkspace(eng, SOURCE2, {
@@ -2213,7 +2438,7 @@ async function decrypt(ws, opts) {
     headers: { "x-nomos-principal": opts.as }
   });
   if (m.restored !== true) {
-    err7(`workspace '${ws}' has no main on ${cloud}, or its clone was refused for '${opts.as}'` + (m.restoreError ? ` (${String(m.restoreError).split(" | ")[0]})` : ""));
+    err8(`workspace '${ws}' has no main on ${cloud}, or its clone was refused for '${opts.as}'` + (m.restoreError ? ` (${String(m.restoreError).split(" | ")[0]})` : ""));
     return 1;
   }
   const wraps = query(eng, SOURCE2, "wrappedKeysByRecipient", JSON.stringify({ recipientPrincipal: opts.as }), opts.as);
@@ -2228,14 +2453,14 @@ async function decrypt(ws, opts) {
       }
     }
   }
-  if (opts.json !== true) out7(`# resolved ${keys.length} scope key(s) for '${opts.as}': ${keys.map((k) => `${k.scope}@${k.epoch}`).join(", ") || "(none)"}`);
+  if (opts.json !== true) out8(`# resolved ${keys.length} scope key(s) for '${opts.as}': ${keys.map((k) => `${k.scope}@${k.epoch}`).join(", ") || "(none)"}`);
   const rows = query(eng, SOURCE2, opts.query, JSON.stringify(opts.params ?? {}), opts.as, keys);
   if (rows && !Array.isArray(rows) && rows.ok === false) {
-    err7(`the read was refused: ${rows.error}` + (String(rows.error).startsWith("read-forbidden") ? `
+    err8(`the read was refused: ${rows.error}` + (String(rows.error).startsWith("read-forbidden") ? `
   '${opts.as}' is not granted this scope's read capability` : ""));
     return 1;
   }
-  out7(JSON.stringify(rows, null, opts.json === true ? 0 : 2));
+  out8(JSON.stringify(rows, null, opts.json === true ? 0 : 2));
   return 0;
 }
 
@@ -2243,8 +2468,8 @@ async function decrypt(ws, opts) {
 init_engine();
 init_cloud();
 import { readFileSync as readFileSync8 } from "node:fs";
-var out8 = (s) => void process.stdout.write(s + "\n");
-var err8 = (s) => void process.stderr.write("error: " + s + "\n");
+var out9 = (s) => void process.stdout.write(s + "\n");
+var err9 = (s) => void process.stderr.write("error: " + s + "\n");
 function lawDiffVerdict(localHash, installed, ws) {
   const active = installed.filter((d) => d.phase === "Active" && typeof d.domainHash === "string");
   const currents = active.filter((d) => d.current === true);
@@ -2282,7 +2507,7 @@ async function status(wsArg, opts) {
   try {
     ws = await resolveWorkspace(wsArg, process.cwd(), opts.target, "githolon status <ws>");
   } catch (e) {
-    err8(e.message);
+    err9(e.message);
     return 1;
   }
   let localHash;
@@ -2294,35 +2519,35 @@ async function status(wsArg, opts) {
   }
   const r = await fetch(`${cloud}/v2/workspaces/${ws}/domains`).catch(() => void 0);
   if (r === void 0) {
-    err8(`cannot reach ${cloud} \u2014 githolon status compares against the DEPLOYED law and needs the cloud (local-only: githolon dev)`);
+    err9(`cannot reach ${cloud} \u2014 githolon status compares against the DEPLOYED law and needs the cloud (local-only: githolon dev)`);
     return 1;
   }
   const d = await r.json().catch(() => void 0);
   if (!r.ok || d?.ok !== true) {
-    err8(`status '${ws}' failed (${r.status}): ${d ? JSON.stringify(d) : "no body"}
+    err9(`status '${ws}' failed (${r.status}): ${d ? JSON.stringify(d) : "no body"}
   is the workspace born? githolon ws create ${ws}`);
     return 1;
   }
-  out8(`workspace  ${ws} on ${cloud}`);
+  out9(`workspace  ${ws} on ${cloud}`);
   const allDomains = d.domains ?? [];
   const controlPlaneHashes = new Set(CONTROL_PLANE_KEYS.map((k) => d.currentLaw?.[k]).filter(Boolean));
   const domains = allDomains.filter((dm) => !controlPlaneHashes.has(dm.domainHash));
   const controllerCount = allDomains.length - domains.length;
-  if (allDomains.length === 0) out8(`installed  (none \u2014 not even the controller; the workspace may be unborn)`);
+  if (allDomains.length === 0) out9(`installed  (none \u2014 not even the controller; the workspace may be unborn)`);
   for (const dom of domains) {
     const mark = dom.current === true ? "  \u2190 current (the holon resolves dispatch here)" : "";
-    out8(`installed  ${(dom.domainHash ?? "?").slice(0, 16)}\u2026  ${dom.phase ?? "?"}  by ${dom.installedBy ?? "?"}${mark}`);
+    out9(`installed  ${(dom.domainHash ?? "?").slice(0, 16)}\u2026  ${dom.phase ?? "?"}  by ${dom.installedBy ?? "?"}${mark}`);
   }
-  if (controllerCount > 0) out8(`           (+ ${controllerCount} control-plane install(s) \u2014 the nomos lifecycle controller; not tenant law)`);
+  if (controllerCount > 0) out9(`           (+ ${controllerCount} control-plane install(s) \u2014 the nomos lifecycle controller; not tenant law)`);
   const tenantActive = domains.filter((dm) => dm.phase === "Active").length;
-  if (tenantActive > 1) out8(`           (${tenantActive} active tenant installs \u2014 install-beside keeps every prior deploy Active; the holon serves the current one per domain)`);
+  if (tenantActive > 1) out9(`           (${tenantActive} active tenant installs \u2014 install-beside keeps every prior deploy Active; the holon serves the current one per domain)`);
   if (localHash === void 0) {
-    out8(`local      (no build/*.deploy.json here \u2014 run \`githolon compile\` to build the law this project authors)`);
+    out9(`local      (no build/*.deploy.json here \u2014 run \`githolon compile\` to build the law this project authors)`);
     return 0;
   }
-  out8(`local      ${localHash.slice(0, 16)}\u2026  (build/*.deploy.json)`);
+  out9(`local      ${localHash.slice(0, 16)}\u2026  (build/*.deploy.json)`);
   const verdict = lawDiffVerdict(localHash, domains, ws);
-  for (const line of verdict.lines) out8(line);
+  for (const line of verdict.lines) out9(line);
   return verdict.inSync ? 0 : 2;
 }
 
@@ -2353,18 +2578,32 @@ Identity (~/.holon/credentials.json \u2014 sessions auto-refresh):
   githolon login --token <refresh_token>                  adopt an existing captain app session
   githolon whoami                                         show the principal births will ride
   githolon logout                                         clear the session (workspace secrets kept)
+  githolon key enroll [--principal <uid>] [--parent <ws>] mint a signing device key + enroll it on-chain
+                                                       (secret stays local; warrants SIGNED governance)
+  githolon key show [--principal <uid>]                   the device key's public identity (never the secret)
+
+Governance (SIGNED client-side, relayed as {intentBytes} \u2014 never a host-author endpoint):
+  githolon grant <admin|creation> <principal> [--label L] grant authority at the parent (default root)
+  githolon grant quota <principal> --max <N>              grant a per-principal workspace allowance
+  githolon revoke <admin|creation> <principal>            revoke it (the revoked fact rides the chain)
+                                                       (all gated by the parent's law: only an admin's
+                                                       signature is admitted; --parent <p> targets a platform)
 
-Nomos Cloud (secrets live in ~/.holon/credentials.json \u2014 never copy one by hand;
-a bare <ws> resolves from nomos.package.mjs's optional \`workspace\` binding):
-  githolon ws create <name> [--principal <uid|token>]     birth a workspace; SAVES its one-time secret
+Nomos Cloud (a bare <ws> resolves from nomos.package.mjs's optional \`workspace\` binding;
+deploy is OPEN + kernel-gated \u2014 births return no host secret, ownership is a ledger fact):
+  githolon ws create <name> [--principal <uid|token>]     birth a workspace (no host secret is issued)
                                                        (no identity on file? it self-onboards an agent login)
+  githolon ws create <name> --via <parent>                request it as a SIGNED createWorkspace governance
+                                                       offer at the parent
   githolon ws status [<name>]                             workspace status (lineage, phase, verdicts)
-  githolon ws retire <name>                               retire a workspace (owner) \u2014 quota freed; data retained
-                                                       per the license; reads keep serving
-  githolon deploy [<ws>] [--file <deploy.json>]           POST build/*.deploy.json with the stored secret;
+  githolon ws retire <name> [--parent <ws>]               retire a workspace via a SIGNED governance offer;
+                                                       quota freed; data retained; reads keep serving
+  githolon ws reclaim <name> [--parent <ws>]              lawful custody discard via a SIGNED governance offer
+                                                       (only a retired workspace; never root)
+  githolon deploy [<ws>] [--file <deploy.json>]           POST build/*.deploy.json (open deploy lane);
                                                        prints what moved (old \u2192 new law hash)
-  githolon secret set <ws> <secret>                       import a secret you already hold
-  githolon secret rotate <ws>                             rotate (and re-save) the workspace secret
+  githolon secret set <ws> <push-password>                store a git push password (push-to-create birth lane)
+  githolon secret rotate <ws>                             RETIRED \u2014 host holds no ownership credential (410)
 
 Git lane (stock git push as deploy/birth \u2014 see also: push-to-create):
   githolon git setup                                      install the credential helper for the cloud host
@@ -2387,15 +2626,23 @@ Options:
 function cloudArgs(rest) {
   const pos = [];
   const opts = {};
+  const VALUE_FLAGS = ["--cloud", "--principal", "--file", "--target", "--parent", "--via", "--max", "--label"];
   for (let i = 0; i < rest.length; i++) {
     const a = rest[i];
-    if (a === "--cloud" || a === "--principal" || a === "--file" || a === "--target") {
+    if (VALUE_FLAGS.includes(a)) {
       const v = rest[++i];
       if (v === void 0) return { pos, opts, bad: `${a} requires a value` };
       if (a === "--cloud") opts.cloud = v;
       else if (a === "--principal") opts.principal = v;
       else if (a === "--target") opts.target = v;
-      else opts.file = v;
+      else if (a === "--parent") opts.parent = v;
+      else if (a === "--via") opts.via = v;
+      else if (a === "--label") opts.label = v;
+      else if (a === "--max") {
+        const n = Number(v);
+        if (!Number.isInteger(n) || n <= 0) return { pos, opts, bad: `--max requires a positive integer` };
+        opts.max = n;
+      } else opts.file = v;
     } else if (a.startsWith("--")) {
       return { pos, opts, bad: `unknown flag '${a}'` };
     } else {
@@ -2428,7 +2675,8 @@ ${USAGE}`);
       }
     }
     if (sub2 === "retire" && name !== void 0) return wsRetire(name, opts);
-    return usageFail("expected: githolon ws <create|status|retire> <name>");
+    if (sub2 === "reclaim" && name !== void 0) return wsReclaim(name, opts);
+    return usageFail("expected: githolon ws <create|status|retire|reclaim> <name>");
   }
   if (command === "deploy") {
     try {
@@ -2700,6 +2948,40 @@ ${commandHelp("status")}`);
   if (argv[0] === "ws" || argv[0] === "deploy" || argv[0] === "secret") {
     return runCloud(argv);
   }
+  if (argv[0] === "key") {
+    const { pos, opts, bad } = cloudArgs(argv.slice(1));
+    if (bad !== void 0) {
+      process.stderr.write(`error: ${bad}
+
+${USAGE}`);
+      return 1;
+    }
+    const [sub] = pos;
+    if (sub === "enroll") return keyEnroll(opts);
+    if (sub === "show") return keyShow(opts);
+    process.stderr.write(`error: expected: githolon key <enroll|show> [--principal <uid>] [--parent <ws>]
+
+${USAGE}`);
+    return 1;
+  }
+  if (argv[0] === "grant" || argv[0] === "revoke") {
+    const verb = argv[0];
+    const { pos, opts, bad } = cloudArgs(argv.slice(1));
+    if (bad !== void 0) {
+      process.stderr.write(`error: ${bad}
+
+${USAGE}`);
+      return 1;
+    }
+    const [kind, subject] = pos;
+    if (kind === void 0 || subject === void 0) {
+      process.stderr.write(`error: expected: githolon ${verb} <admin|creation${verb === "grant" ? "|quota" : ""}> <principal>
+
+${USAGE}`);
+      return 1;
+    }
+    return grantOrRevoke(verb, kind, subject, opts);
+  }
   if (argv[0] === "login") {
     const agent = argv.includes("--agent");
     const tokenAt = argv.indexOf("--token");
@@ -2756,8 +3038,8 @@ ${USAGE}`);
   let parsed;
   try {
     parsed = parseArgs(argv);
-  } catch (err9) {
-    process.stderr.write(`error: ${err9.message}
+  } catch (err10) {
+    process.stderr.write(`error: ${err10.message}
 
 ${USAGE}`);
     return 1;
@@ -2776,8 +3058,8 @@ ${USAGE}`);
     process.stdout.write(`created ${path}
 `);
     return 0;
-  } catch (err9) {
-    process.stderr.write(`error: ${err9.message}
+  } catch (err10) {
+    process.stderr.write(`error: ${err10.message}
 `);
     return 1;
   }