githolon 0.34.0 → 0.35.0

package/dist/cli.mjs

@@ -924,20 +924,45 @@ async function wsRetire(ws, opts) {
   const cloud = cloudBase(opts.cloud);
   const { signAndPostGovernance: signAndPostGovernance2, resolveGovernancePrincipal: resolveGovernancePrincipal2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
   const parent = opts.parent ?? "root";
+  let record;
+  try {
+    const q = await fetch(`${cloud}/v2/workspaces/${parent}/workspaceByName?name=${encodeURIComponent(ws)}`);
+    const qd = await q.json().catch(() => void 0);
+    const rows = qd?.ok === true ? qd.rows ?? [] : [];
+    record = rows.find((r) => r.data?.status !== "retired" && r.data?.status !== "reclaimed") ?? rows[0];
+  } catch {
+  }
+  const recordId = record?.id;
+  if (recordId === void 0) {
+    err3(
+      `retire '${ws}': no CloudWorkspace record named '${ws}' in ${parent}'s registry \u2014 nothing lawful to retire.
+  (a workspace born via the OPEN lane \u2014 bare POST /v2/workspaces/${ws} \u2014 has no registry row;
+   registered births ride \`githolon ws create ${ws} --via ${parent}\`. An unregistered leak needs a custodian sweep.)`
+    );
+    return 1;
+  }
   let v;
   try {
     const principal = resolveGovernancePrincipal2(opts);
-    const payload = { workspaceId: ws, retiredBy: principal, retiredAt: Date.now() };
-    v = await signAndPostGovernance2(parent, "retireOwnWorkspace", payload, opts);
-    if (!v.ok && v.status === 422) {
-      v = await signAndPostGovernance2(parent, "retireWorkspace", payload, opts);
-    }
+    const payload = { workspaceId: recordId, retiredBy: principal, retiredAt: Date.now() };
+    const bare = (s) => s.startsWith("user:") ? s.slice(5) : s;
+    const creator = record?.data?.createdBy ?? record?.data?.principal ?? "";
+    const own = creator !== "" && bare(creator) === bare(principal);
+    v = await signAndPostGovernance2(parent, own ? "retireOwnWorkspace" : "retireWorkspace", payload, opts);
   } catch (e) {
     err3(e.message);
     return 1;
   }
   if (!v.ok) {
     err3(`retire '${ws}' refused (${v.status}): ${typeof v.body === "string" ? v.body : JSON.stringify(v.body)}`);
+    if (JSON.stringify(v.body ?? "").includes("retire-own-only")) {
+      err3(
+        `note: you appear to BE '${ws}'s creator \u2014 the parent's deployed governance law may predate the
+  0.34.1 retireOwnWorkspace creator-normalization fix (the 'user:' subject prefix vs the bare uid).
+  A governance re-deploy to ${parent} fixes the self-service lane; meanwhile an ADMIN can retire it:
+  githolon ws retire ${ws} --as <admin-uid>`
+      );
+    }
     return 1;
   }
   out3(`\u2713 workspace ${ws} retired via signed governance offer to ${parent} on ${cloud}`);
@@ -1515,11 +1540,35 @@ function author(eng, ws, domain, directiveId, payload, controllerHash, opts = {}
     capPorts.principal_verified = !!opts.principalVerified;
   }
   const envelope = { payload: { domain, directiveId, payload }, captured_ports: capPorts, policy_version: 1, policy_domain: "Nomos", policy_gas: 0, policy_memory: 0 };
+  if (opts.attestations !== void 0) envelope.attestations = opts.attestations;
   writeWork(eng, `payload-${seq}.json`, enc3.encode(JSON.stringify(payload)));
   writeWork(eng, `envelope-${seq}.json`, enc3.encode(stringifyBig(envelope)));
   const genesis = !controllerHash;
+  const attestorSecretFor = (from) => {
+    const s = opts.attestorSecrets;
+    if (!s) return null;
+    if (typeof s === "string") return s;
+    return typeof s[from] === "string" ? s[from] : null;
+  };
   const defer = opts.deferProjection !== false;
-  const v = JSON.parse(call(eng.ex, "offer", { repoArg: repoArgOf(ws), workspace: ws, domain, directiveId, payloadFile: `/work/payload-${seq}.json`, envelopeFile: `/work/envelope-${seq}.json`, seq, actor: opts.actor ?? "", ...opts.authToken ? { authToken: opts.authToken } : {}, domainFile: genesis ? "/work/domain.package.usda" : "", domainHash: genesis ? "" : controllerHash, branch: BRANCH, ...opts.authorSecret ? { authorSecret: opts.authorSecret } : {}, ...opts.dryRun ? { dryRun: true } : defer ? { deferProjection: true } : {} }, eng.STDERR));
+  const offerOnce = () => JSON.parse(call(eng.ex, "offer", { repoArg: repoArgOf(ws), workspace: ws, domain, directiveId, payloadFile: `/work/payload-${seq}.json`, envelopeFile: `/work/envelope-${seq}.json`, seq, actor: opts.actor ?? "", ...opts.authToken ? { authToken: opts.authToken } : {}, domainFile: genesis ? "/work/domain.package.usda" : "", domainHash: genesis ? "" : controllerHash, branch: BRANCH, ...opts.authorSecret ? { authorSecret: opts.authorSecret } : {}, ...opts.dryRun ? { dryRun: true } : defer ? { deferProjection: true } : {} }, eng.STDERR));
+  let v = offerOnce();
+  for (let pass = 0; pass < 8 && v.outcome === "refused"; pass++) {
+    const need = parseAttestedReadNeed(v.verdict?.reason ?? v.error);
+    if (!need || !eng.mounted.has(need.from)) break;
+    const secret = attestorSecretFor(need.from);
+    if (!secret) break;
+    const served = attestedRead(eng, need.from, {
+      queryId: need.queryId,
+      paramsJson: JSON.stringify(need.args),
+      attestorSecret: secret,
+      nowMs: opts.attestNowMs ?? Date.now()
+    });
+    if (!served || served.ok !== true) break;
+    envelope.attestations = [...envelope.attestations ?? [], { queryId: need.queryId, result: served.rows, attestation: served.attestation }];
+    writeWork(eng, `envelope-${seq}.json`, enc3.encode(stringifyBig(envelope)));
+    v = offerOnce();
+  }
   const res = v.outcome === "admitted" ? { ok: true, head: v.head, intentOut: v.intentOut, ...v.born ? { born: v.born } : {} } : v.outcome === "refused" ? { ok: false, error: v.verdict?.reason ?? v.error } : v;
   if (defer && res.ok) (eng.pendingProjection ??= /* @__PURE__ */ new Set()).add(ws);
   return res;
@@ -1552,6 +1601,19 @@ async function custodyFetch(eng, ws, ledger, { remoteRef = "refs/heads/main", lo
   kgit.writeRef(eng, gitdirOf(ws), fullRef(localRef || remoteRef), tip);
   return tip;
 }
+function parseAttestedReadNeed(error) {
+  const m = /attested-read-unreachable: read\('([^']+)', \{from: '([^']+)'\}\) args=(.*?) has no injected attestation/.exec(String(error || ""));
+  if (!m) return null;
+  let blob = m[3];
+  for (let i = 0; i < 4; i++) {
+    try {
+      return { queryId: m[1], from: m[2], args: JSON.parse(blob) };
+    } catch {
+      blob = blob.replace(/\\(["\\])/g, "$1");
+    }
+  }
+  return null;
+}
 function offerIntent(eng, ws, bytes, opts) {
   const name = `offer-in-${eng.seq++}.json`;
   writeWork(eng, name, bytes);
@@ -1569,7 +1631,7 @@ function applyIntentBytes(eng, ws, bytes, opts) {
 function verifyChainLocal(eng, ws) {
   return JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "verifyChain" }), branch: BRANCH }, eng.STDERR));
 }
-var enc3, dec3, BRANCH, RESULT_PACK_INLINE_MAX, repoArgOf, gitdirOf, unpack, repoArgOfGitdir, bytesFromB64, kgit, installPayload, fullRef, applyPackInto, custodyLsRefs, qById, query, cryptoUnwrapKey, count, sum;
+var enc3, dec3, BRANCH, RESULT_PACK_INLINE_MAX, repoArgOf, gitdirOf, unpack, repoArgOfGitdir, bytesFromB64, kgit, installPayload, fullRef, applyPackInto, custodyLsRefs, qById, query, attestedRead, cryptoUnwrapKey, count, sum;
 var init_engine = __esm({
   "vendor/engine/engine.mjs"() {
     "use strict";
@@ -1626,6 +1688,12 @@ var init_engine = __esm({
     custodyLsRefs = (ledger, prefix = null) => lsRefs(ledger.remote, ledger.headers || {}, { service: "git-upload-pack", prefix });
     qById = (eng, ws, id, principal = "", keys = []) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "byId", aggregateId: id }), principal, keys, branch: BRANCH }, eng.STDERR));
     query = (eng, ws, queryId, paramsJson, principal = "", keys = []) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ kind: "query", queryId, paramsJson }), principal, keys, branch: BRANCH }, eng.STDERR));
+    attestedRead = (eng, ws, { queryId, paramsJson, attestorSecret, nowMs }) => JSON.parse(call(eng.ex, "query", {
+      repoArg: repoArgOf(ws),
+      workspace: ws,
+      branch: BRANCH,
+      queryBytes: b64Json({ op: "attestedRead", queryId, paramsJson: paramsJson || "{}", attestorSecret, nowMs: nowMs ?? Date.now(), sourceWorkspace: ws })
+    }, eng.STDERR));
     cryptoUnwrapKey = (eng, { secret, hpkeEpk, ct }) => JSON.parse(call(eng.ex, "query", { queryBytes: b64Json({ op: "cryptoUnwrapKey", secret, hpkeEpk, ct }) }, eng.STDERR)).scopeKey;
     count = (eng, ws, countId, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "count", countId, groupKey }), principal, branch: BRANCH }, eng.STDERR));
     sum = (eng, ws, sumId, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "sum", sumId, groupKey }), principal, branch: BRANCH }, eng.STDERR));
@@ -4014,7 +4082,7 @@ var HELP = {
   },
   proof: {
     usage: "githolon proof [build/<name>.proof.mts] [--domain <key>] [--live] [--keep]",
-    what: "Run the proof GENERATED from your law. DEFAULT: the OFFLINE legs on a LOCAL holon \u2014 the\nsame engine plane the cloud edge runs; no cloud workspace is touched (develop/play/understand\nhere, deploy with confidence after). --domain <key> proves a SPECIFIC domain of a multi-domain\npackage (offline; the default is the first). --live runs the full cloud loop (throwaway\nworkspace \u2192 deploy \u2192 offline write \u2192 admission \u2192 cloud reads \u2192 convergence), RETIRED on every\nexit; --keep keeps it and prints the secret once. ALL GREEN or it names the jam. The offline\nlegs also rerun on every save in `githolon dev`.",
+    what: "Run the proof GENERATED from your law. DEFAULT: the OFFLINE legs on a LOCAL holon \u2014 the\nsame engine plane the cloud edge runs; no cloud workspace is touched (develop/play/understand\nhere, deploy with confidence after). --domain <key> proves a SPECIFIC domain of a multi-domain\npackage (offline; the default is the first). --live runs the full cloud loop (throwaway\nworkspace \u2192 deploy \u2192 offline write \u2192 admission \u2192 cloud reads \u2192 convergence). The throwaway is\ncreated REGISTERED (a signed createWorkspace at root \u2014 your principal needs creation authority\nthere) and RETIRED on every exit via the lawful retireOwnWorkspace; --keep keeps it. ALL GREEN or it names the jam. The offline\nlegs also rerun on every save in `githolon dev`.",
     examples: ["githolon proof", "githolon proof --domain co2_platform", "githolon proof --live", "githolon proof --live --keep"]
   },
   dev: {
@@ -4899,13 +4967,58 @@ async function runProof(args) {
   const tsxPkg = JSON.parse(readFileSync11(join11(tsxDir, "package.json"), "utf8"));
   const tsxBinRel = typeof tsxPkg.bin === "string" ? tsxPkg.bin : tsxPkg.bin?.["tsx"];
   const tsxCli = join11(tsxDir, tsxBinRel ?? "dist/cli.mjs");
-  console.log("githolon proof --live \u2014 the full cloud loop (throwaway workspace, retired on exit" + (keep ? "; --keep: kept, secret printed once" : "") + ")");
+  console.log("githolon proof --live \u2014 the full cloud loop (throwaway workspace, retired on exit" + (keep ? "; --keep: kept" : "") + ")");
+  const { wsCreate: wsCreate2, wsRetire: wsRetire2 } = await Promise.resolve().then(() => (init_cloud(), cloud_exports));
+  const { resolveGovernancePrincipal: resolveGovernancePrincipal2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
+  const { login: login2, activePrincipal: activePrincipal2 } = await Promise.resolve().then(() => (init_cloud(), cloud_exports));
+  let principal = process.env.NOMOS_PRINCIPAL;
+  try {
+    principal ??= resolveGovernancePrincipal2({});
+  } catch {
+    const lr = await login2({ agent: true });
+    principal = lr === 0 ? activePrincipal2() : void 0;
+  }
+  if (principal === void 0) {
+    return refuse("proof --live needs a principal \u2014 githolon login --agent (self-onboarding) failed; try it directly or pass NOMOS_PRINCIPAL");
+  }
+  const proofSlug = proofPath.split("/").pop().replace(/\.proof\.mts$/, "").toLowerCase().replace(/[^a-z0-9-]+/g, "-");
+  const ws = process.env.NOMOS_WS ?? `${proofSlug}-proof-${Math.random().toString(36).slice(2, 8)}`;
+  if (process.env.NOMOS_WS === void 0) {
+    const cr = await wsCreate2(ws, { via: "root", principal });
+    if (cr !== 0) {
+      return refuse(
+        `proof --live: registered create refused at root \u2014 principal ${principal} lacks creation authority, and the open birth lane would leak an unretirable workspace.
+  remedies:
+    \u2022 ask an operator: githolon grant creation ${principal}   (then rerun)
+    \u2022 or pre-create a REGISTERED workspace yourself and hand it over: NOMOS_WS=<ws> githolon proof --live
+    \u2022 or develop offline (no cloud workspace at all): githolon proof`
+      );
+    }
+  }
   const r = spawnSync4(process.execPath, [tsxCli, proofPath], {
     stdio: "inherit",
     cwd: process.cwd(),
-    env: { ...process.env, ...keep ? { PROOF_KEEP: "1" } : {} }
+    env: {
+      ...process.env,
+      NOMOS_WS: ws,
+      NOMOS_PRINCIPAL: principal,
+      NOMOS_PROOF_MANAGED: "1",
+      // the proof skips its own (dead) cleanup lane; the CLI retires below
+      ...keep ? { PROOF_KEEP: "1" } : {}
+    }
   });
-  return r.status ?? 1;
+  const proofStatus = r.status ?? 1;
+  if (keep) {
+    console.log(`workspace ${ws} KEPT (--keep) \u2014 retire it when done: githolon ws retire ${ws}`);
+    return proofStatus;
+  }
+  const rr = await wsRetire2(ws, { principal }).catch(() => 1);
+  if (rr !== 0) {
+    console.error(`\u26A0 THROWAWAY WORKSPACE NOT RETIRED: ${ws}`);
+    console.error(`\u26A0 retire it manually: githolon ws retire ${ws}`);
+    console.error(`\u26A0 (if it has no root registry row it was born unregistered and needs a custodian sweep)`);
+  }
+  return proofStatus;
 }
 function parseArgs(argv) {
   const [command, ...rest] = argv;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.34.0",
+  "version": "0.35.0",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -29,8 +29,8 @@
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/client": "^0.34.0",
-    "@githolon/dsl": "^0.34.0",
+    "@githolon/client": "^0.35.0",
+    "@githolon/dsl": "^0.35.0",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {