githolon 0.69.1 → 0.69.3

package/dist/cli.mjs

@@ -2828,9 +2828,151 @@ var init_local_holon = __esm({
   }
 });
 
+// src/repairs.ts
+var repairs_exports = {};
+__export(repairs_exports, {
+  discoverRepairs: () => discoverRepairs,
+  knownRepairBlock: () => knownRepairBlock,
+  matchRepair: () => matchRepair,
+  parseRefusal: () => parseRefusal
+});
+import { spawnSync } from "node:child_process";
+import { createRequire } from "node:module";
+import { existsSync as existsSync3, mkdtempSync, readdirSync as readdirSync2, readFileSync as readFileSync2, rmSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname as dirname2, isAbsolute, join as join3, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+function parseRefusal(verdict) {
+  const check2 = String(verdict["check"] ?? "");
+  const error = String(verdict["error"] ?? "");
+  const raw = `${check2}: ${error}`;
+  const kind = /evolve.?gate/i.test(raw) || /evolve/i.test(check2) ? "evolve-gate" : "other";
+  const sids = /* @__PURE__ */ new Set();
+  const structured = verdict["stableId"] ?? verdict["stableIds"];
+  if (typeof structured === "string" && SID_SHAPE.test(structured)) sids.add(structured.toLowerCase());
+  if (Array.isArray(structured)) {
+    for (const s of structured) if (typeof s === "string" && SID_SHAPE.test(s)) sids.add(s.toLowerCase());
+  }
+  for (const m of raw.matchAll(SID_RE)) sids.add(m[1].toLowerCase());
+  return { kind, stableIds: [...sids], raw };
+}
+function matchRepair(refusal, repairs) {
+  if (refusal.kind === "other") return void 0;
+  return repairs.find(
+    (r) => r.matcher.refusal === refusal.kind && refusal.stableIds.includes(r.matcher.stableId.toLowerCase())
+  );
+}
+function knownRepairBlock(repair) {
+  return [
+    "",
+    `\u2726 KNOWN REPAIR: '${repair.id}' (${repair.file}) declares a remedy for exactly this refusal.`,
+    `  reason: ${repair.reason}`,
+    "  Re-run with --repair to execute it."
+  ].join("\n");
+}
+function resolveTsxCli(cwd) {
+  const pkgDir = (name, fromDir) => {
+    try {
+      return dirname2(createRequire(pathToFileURL(join3(fromDir, "noop.js")).href).resolve(`${name}/package.json`));
+    } catch {
+      return void 0;
+    }
+  };
+  const dslDir = pkgDir("@githolon/dsl", cwd) ?? (() => {
+    try {
+      return dirname2(createRequire(import.meta.url).resolve("@githolon/dsl/package.json"));
+    } catch {
+      return void 0;
+    }
+  })();
+  const tsxDir = pkgDir("tsx", cwd) ?? (dslDir !== void 0 ? pkgDir("tsx", dslDir) : void 0);
+  if (tsxDir === void 0) return void 0;
+  try {
+    const pkg = JSON.parse(
+      readFileSync2(join3(tsxDir, "package.json"), "utf8")
+    );
+    const rel = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.["tsx"];
+    return join3(tsxDir, rel ?? "dist/cli.mjs");
+  } catch {
+    return void 0;
+  }
+}
+function resolveDslEntry(cwd) {
+  const tryFrom = (fromUrl) => {
+    try {
+      return createRequire(fromUrl).resolve("@githolon/dsl");
+    } catch {
+      return void 0;
+    }
+  };
+  return tryFrom(pathToFileURL(join3(cwd, "noop.js")).href) ?? tryFrom(import.meta.url);
+}
+function discoverRepairs(cwd) {
+  const dir = join3(cwd, "repairs");
+  if (!existsSync3(dir)) return { repairs: [] };
+  let files;
+  try {
+    files = readdirSync2(dir).filter((f) => /\.(ts|mts|cts)$/.test(f) && !/\.d\.ts$/.test(f)).sort().map((f) => resolve(dir, f));
+  } catch (e) {
+    return { error: `could not read the repairs/ folder: ${e.message}` };
+  }
+  if (files.length === 0) return { repairs: [] };
+  const tsxCli = resolveTsxCli(cwd);
+  const dslEntry = resolveDslEntry(cwd);
+  if (tsxCli === void 0 || dslEntry === void 0) {
+    return { error: "repairs/ is present but the toolchain to load it is missing \u2014 add @githolon/dsl (tsx + the DSL ride it) to the project and npm install" };
+  }
+  const scratch = mkdtempSync(join3(tmpdir(), "githolon-repairs-"));
+  const loader = join3(scratch, "discover.mts");
+  const loaderSrc = `
+import { repairsOf } from ${JSON.stringify(dslEntry)};
+const files = ${JSON.stringify(files)};
+const out = [];
+const seen = new Map();
+for (const file of files) {
+  const mod = await import(${JSON.stringify("file://")} + file);
+  for (const r of repairsOf(mod)) {
+    if (seen.has(r.id)) {
+      throw new Error("duplicate repair id '" + r.id + "' \u2014 declared in " + seen.get(r.id) + " and " + file);
+    }
+    seen.set(r.id, file);
+    out.push({ id: r.id, matcher: r.matcher, reason: r.reason, verb: r.verb, file });
+  }
+}
+process.stdout.write("\\u0001REPAIRS\\u0001" + JSON.stringify(out) + "\\u0001END\\u0001\\n");
+`;
+  try {
+    writeFileSync3(loader, loaderSrc, "utf8");
+    const r = spawnSync(process.execPath, [tsxCli, loader], { cwd, encoding: "utf8" });
+    if (r.status !== 0) {
+      const msg = (r.stderr || r.stdout || "").trim().split("\n").filter(Boolean).slice(-4).join("\n");
+      return { error: `loading repairs/ failed:
+${msg || `tsx exited ${r.status ?? "?"}`}` };
+    }
+    const m = /
REPAIRS
([\s\S]*?)
END
/.exec(r.stdout);
+    if (m === null) return { error: "the repairs loader produced no manifest (unexpected \u2014 the DSL/tsx may be too old)" };
+    const parsed = JSON.parse(m[1]);
+    const repairs = parsed.map((p) => ({ ...p, file: isAbsolute(p.file) ? p.file : resolve(cwd, p.file) }));
+    return { repairs };
+  } catch (e) {
+    return { error: `loading repairs/ failed: ${e.message}` };
+  } finally {
+    rmSync(scratch, { recursive: true, force: true });
+  }
+}
+var SID_RE, SID_SHAPE;
+var init_repairs = __esm({
+  "src/repairs.ts"() {
+    "use strict";
+    SID_RE = /stable id ([0-9a-f]{16})/gi;
+    SID_SHAPE = /^[0-9a-f]{16}$/i;
+  }
+});
+
 // src/governance.ts
 var governance_exports = {};
 __export(governance_exports, {
+  ROOT_CUSTODIAN_SECRET: () => ROOT_CUSTODIAN_SECRET,
   buildCertificate: () => buildCertificate,
   buildRebirthPlan: () => buildRebirthPlan,
   certifyEra: () => certifyEra,
@@ -2846,6 +2988,7 @@ __export(governance_exports, {
   rebirthPlanCommand: () => rebirthPlanCommand,
   rebirthWorkspace: () => rebirthWorkspace,
   renderRebirthImpact: () => renderRebirthImpact,
+  resolveGovernanceHash: () => resolveGovernanceHash,
   resolveGovernancePrincipal: () => resolveGovernancePrincipal,
   signAndPostGovernance: () => signAndPostGovernance,
   signAndPostOffer: () => signAndPostOffer,
@@ -2853,8 +2996,8 @@ __export(governance_exports, {
   verifyWorkspaceVerdict: () => verifyWorkspaceVerdict
 });
 import { createHash, createPrivateKey, createPublicKey } from "node:crypto";
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname2, join as join3 } from "node:path";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname3, join as join4 } from "node:path";
 async function clientConnect() {
   const mod = await import("@githolon/client");
   return mod.connect;
@@ -3072,7 +3215,7 @@ async function keyExport(opts) {
   return 0;
 }
 function buildOfferPayload(opts) {
-  const raw = opts.payloadFile !== void 0 ? readFileSync2(opts.payloadFile, "utf8") : opts.payload;
+  const raw = opts.payloadFile !== void 0 ? readFileSync3(opts.payloadFile, "utf8") : opts.payload;
   let payload = {};
   if (raw !== void 0 && raw.trim() !== "") payload = JSON.parse(raw);
   if (typeof payload !== "object" || payload === null || Array.isArray(payload)) {
@@ -3106,7 +3249,7 @@ async function governanceOffer(ws, directiveId, opts) {
       const holon = await connectGovernance(cloudBase(opts.cloud), ws);
       const device = await ensureDeviceKey(holon, principal);
       const sealed = await holon.signGovernanceOffer({ directiveId, payload, authorSecret: device.secret, actor: `user:${principal}` });
-      writeFileSync3(opts.save, JSON.stringify({ ws, directiveId, principal, intentBytes: sealed.intentBytes }, null, 2) + "\n");
+      writeFileSync4(opts.save, JSON.stringify({ ws, directiveId, principal, intentBytes: sealed.intentBytes }, null, 2) + "\n");
     } catch (e) {
       err2(e.message);
       return 1;
@@ -3133,7 +3276,7 @@ async function governanceOffer(ws, directiveId, opts) {
 async function governanceRelay(ws, file, opts) {
   let saved;
   try {
-    saved = JSON.parse(readFileSync2(file, "utf8"));
+    saved = JSON.parse(readFileSync3(file, "utf8"));
   } catch (e) {
     err2(`cannot read offer file ${file}: ${e.message}`);
     return 1;
@@ -3294,6 +3437,15 @@ certify-era ${ws}:`);
   out2(`  verify: githolon ledger verify ${ws}   (expect GREEN with certifiedRanges naming the oids)`);
   return 0;
 }
+async function resolveGovernanceHash(cloud, domainKey, ws = "root", fetchImpl = fetch) {
+  try {
+    const d = await (await fetchImpl(`${cloud}/v2/workspaces/${ws}/domains`)).json();
+    const h = d && d.currentLaw && d.currentLaw[domainKey];
+    return typeof h === "string" && h.length > 0 ? h : void 0;
+  } catch {
+    return void 0;
+  }
+}
 async function parkedAreAllLawInstalls(engMod, eng, ws, oids) {
   try {
     const git4 = (await import("isomorphic-git")).default;
@@ -3351,18 +3503,27 @@ async function buildRebirthPlan(cloud, ws, reason) {
   } catch {
   }
   const lawHashes = {};
+  let currentLaw2 = {};
   try {
     const d = await (await fetch(`${cloud}/v2/workspaces/${ws}/domains`)).json();
+    currentLaw2 = d.currentLaw ?? {};
+    const currentHashes = new Set(Object.values(currentLaw2));
     for (const dom of d.domains ?? []) {
-      if (typeof dom.domainHash === "string" && dom.phase === "Active") lawHashes[dom.domainHash] = dom.phase;
+      if (typeof dom.domainHash !== "string") continue;
+      lawHashes[dom.domainHash] = {
+        phase: dom.phase ?? "unknown",
+        current: dom.current === true || currentHashes.has(dom.domainHash)
+      };
     }
   } catch {
   }
   let verdict = { replay: "unknown", firstRefusal: null };
+  let rawVerdict = null;
   try {
     const m = await mountWorkspace2(eng, ws, { remote: `${cloud}/v2/workspaces/${ws}/git`, headers: {} });
     if (m.restored === true) {
       const v = verifyChainLocal2(eng, ws);
+      rawVerdict = v;
       if (v["valid"] === true) verdict = { replay: "green", firstRefusal: null };
       else verdict = { replay: "red", firstRefusal: `${String(v["check"] ?? "?")}${v["atIndex"] !== void 0 ? ` @intent ${v["atIndex"]}` : ""}: ${String(v["error"] ?? "").slice(0, 200)}` };
     }
@@ -3384,13 +3545,42 @@ async function buildRebirthPlan(cloud, ws, reason) {
   } catch {
   }
   const mode = compaction.scarShape === "mid-chain" && !((compaction.parked ?? 99) <= 2 && parkedAllLawInstalls) ? "state-seed" : "replay-compact";
+  let repairs = [];
+  if (rawVerdict !== null && rawVerdict["valid"] !== true) {
+    try {
+      const { discoverRepairs: discoverRepairs2, parseRefusal: parseRefusal2, matchRepair: matchRepair2 } = await Promise.resolve().then(() => (init_repairs(), repairs_exports));
+      const discovered = discoverRepairs2(process.cwd());
+      if (!("error" in discovered) && discovered.repairs.length > 0) {
+        const refusal = parseRefusal2(rawVerdict);
+        for (const r of discovered.repairs) {
+          if (r.matcher.refusal === refusal.kind && refusal.stableIds.includes(r.matcher.stableId.toLowerCase())) {
+            const v = r.verb;
+            repairs.push({
+              id: r.id,
+              file: r.file,
+              reason: r.reason,
+              matcher: { refusal: r.matcher.refusal, stableId: r.matcher.stableId },
+              verb: {
+                kind: String(v.kind ?? ""),
+                ...typeof v.aggregateId === "string" ? { aggregateId: v.aggregateId } : {},
+                ...typeof v.field === "string" ? { field: v.field } : {},
+                ...typeof v.through === "string" ? { through: v.through } : {}
+              },
+              execution: "recorded"
+            });
+          }
+        }
+      }
+    } catch {
+    }
+  }
   const frozenAt = priorSupersessions === 0 ? ws : `${ws}--i${priorSupersessions}`;
   const newCustodyAddress = `${ws}--i${priorSupersessions + 1}`;
   const plan = {
     v: 1,
     workspace: ws,
     reason: reason ?? null,
-    pinned: { incarnation, lawHashes, parent },
+    pinned: { incarnation, lawHashes, currentLaw: currentLaw2, parent },
     will: {
       newCustodyAddress,
       frozenAt,
@@ -3400,7 +3590,7 @@ async function buildRebirthPlan(cloud, ws, reason) {
     verdict,
     mode,
     compaction,
-    repairs: [],
+    repairs,
     clientImpact: CLIENT_IMPACT,
     generatedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
@@ -3416,8 +3606,15 @@ function renderRebirthImpact(plan, ledgerCommits) {
   L.push(`  incarnation   : ${plan.pinned.incarnation ? plan.pinned.incarnation.slice(0, 16) + "\u2026" : "(none recorded \u2014 first incarnation)"}`);
   L.push(`  verify_chain  : ${plan.verdict.replay.toUpperCase()}${plan.verdict.firstRefusal ? `  \u2014 first refusal: ${plan.verdict.firstRefusal}` : ""}`);
   L.push(`  ledger size   : ${ledgerCommits !== null ? `${ledgerCommits} commit(s)` : "(unknown)"}`);
-  const laws = Object.keys(plan.pinned.lawHashes);
-  L.push(`  installed law : ${laws.length ? laws.map((h) => h.slice(0, 12) + "\u2026").join(", ") : "(none read)"}`);
+  const laws = Object.entries(plan.pinned.lawHashes);
+  const currentLaw2 = plan.pinned.currentLaw ?? {};
+  const keysForHash = (hash) => Object.entries(currentLaw2).filter(([, h]) => h === hash).map(([k]) => k);
+  const currentHashes = laws.filter(([, m]) => m.current).map(([h]) => h);
+  const currentDesc = currentHashes.length ? currentHashes.map((h) => {
+    const ks = keysForHash(h);
+    return `${h.slice(0, 8)}\u2026${ks.length ? ` (${ks.join(", ")})` : ""}`;
+  }).join(" \xB7 ") : "(none current)";
+  L.push(`  installed law : ${laws.length} historical \xB7 current: ${currentDesc}`);
   L.push(`  parent        : ${plan.pinned.parent || "(root)"}`);
   L.push("");
   L.push("WHAT A REBIRTH WOULD DO");
@@ -3450,9 +3647,33 @@ function renderRebirthImpact(plan, ledgerCommits) {
     L.push("  \u2192 preserved by lineage continuity; their birth-cert chains stay valid (same founding key + self-id).");
   }
   L.push("");
+  L.push(`REPAIRS (${plan.repairs.length})`);
+  if (plan.repairs.length === 0) L.push("  (none matched \u2014 a plain compaction; no corrective verb declared for this refusal)");
+  else {
+    for (const r of plan.repairs) {
+      const v = r.verb;
+      const verbDesc = `${v.kind}${v.aggregateId ? ` ${v.aggregateId}${v.field ? `.${v.field}` : ""}` : ""}${v.through ? ` through ${v.through}` : ""}`;
+      L.push(`  \u2726 ${r.id}   [${r.execution}]`);
+      L.push(`      matches : ${r.matcher.refusal} \xB7 stable id ${r.matcher.stableId}`);
+      L.push(`      verb    : ${verbDesc}   (${r.file})`);
+      L.push(`      reason  : ${r.reason}`);
+    }
+    L.push("  \u2192 v1 records the repair as provenance/justification (the certificate + supersession reason name it);");
+    L.push("    state-transform verbs execute at the re-fold seam in a future release.");
+  }
+  L.push("");
   L.push("CLIENT IMPACT");
   L.push(`  ${plan.clientImpact}.`);
   L.push("  Recommend tenants DRAIN/SYNC their clients before the rebirth window.");
+  L.push("");
+  L.push("NEXT STEPS \u2014 the blessed golden path");
+  L.push("  1. plan    (this)");
+  L.push(`  2. apply   githolon rebirth apply --plan <path> --gcp-secret ${ROOT_CUSTODIAN_SECRET} [--yes]`);
+  L.push("             (apply requires the ROOT CUSTODIAN seed \u2014 --gcp-secret is the blessed path;");
+  L.push("              --seed-secret <b64> is break-glass, env NOMOS_ROOT_SEED is the CI lane)");
+  L.push(`  3. replay  githolon replay ${plan.workspace}          (expect GREEN from intent 0)`);
+  L.push(`  4. status  githolon status ${plan.workspace}          (incarnation + supersession history)`);
+  L.push("  5. compat  githolon compat                          (clients raise CustodyBreak \u2014 choose adopt/reject)");
   return L.join("\n");
 }
 async function rebirthPlanCommand(ws, opts) {
@@ -3463,19 +3684,22 @@ async function rebirthPlanCommand(ws, opts) {
     return 1;
   }
   const date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-  const dir = opts.out ?? join3("rebirths", `${date}-${ws}`);
+  const dir = opts.out ?? join4("rebirths", `${date}-${ws}`);
   try {
     mkdirSync3(dir, { recursive: true });
-    writeFileSync3(join3(dir, "plan.json"), JSON.stringify(built.plan, null, 2) + "\n");
-    writeFileSync3(join3(dir, "impact.md"), "```\n" + renderRebirthImpact(built.plan, built.ledgerCommits) + "\n```\n");
+    writeFileSync4(join4(dir, "plan.json"), JSON.stringify(built.plan, null, 2) + "\n");
+    writeFileSync4(join4(dir, "impact.md"), "```\n" + renderRebirthImpact(built.plan, built.ledgerCommits) + "\n```\n");
   } catch (e) {
     err2(`could not write the plan into ${dir}: ${e.message}`);
     return 1;
   }
   out2(renderRebirthImpact(built.plan, built.ledgerCommits));
   out2("");
-  out2(`\u2713 plan written: ${join3(dir, "plan.json")} + ${join3(dir, "impact.md")}`);
-  out2("  fill in `reason` before a future `githolon rebirth apply --plan` (apply is not yet available).");
+  out2(`\u2713 plan written: ${join4(dir, "plan.json")} + ${join4(dir, "impact.md")}`);
+  if (built.plan.reason === null) out2("  fill in the plan's `reason` (the mandatory audit justification) before apply.");
+  out2("  apply requires the ROOT CUSTODIAN seed. The blessed command:");
+  out2(`    githolon rebirth apply --plan ${join4(dir, "plan.json")} --gcp-secret ${ROOT_CUSTODIAN_SECRET} [--yes]`);
+  out2("  (--seed-secret <b64> is break-glass \u2014 avoid in shell history; env NOMOS_ROOT_SEED is the CI lane.)");
   return 0;
 }
 async function rebirthWorkspace(ws, opts) {
@@ -3503,9 +3727,12 @@ async function rebirthWorkspace(ws, opts) {
     err2("the law refuses to rebirth root \u2014 the seat of the authorizing law cannot supersede itself");
     return 1;
   }
-  if (opts.plan !== void 0 && Array.isArray(opts.plan.repairs) && opts.plan.repairs.length > 0) {
-    err2("repair verbs are not yet available \u2014 the plan may not carry repairs (the `repairs` array must be empty)");
-    return 1;
+  if (opts.plan !== void 0 && Array.isArray(opts.plan.repairs)) {
+    const unknown = opts.plan.repairs.find((r2) => r2.execution !== "recorded");
+    if (unknown !== void 0) {
+      err2(`the plan carries a repair with an unsupported execution '${String(unknown.execution)}' \u2014 v1 executes only execution:"recorded" (state-transform verbs land in a future release)`);
+      return 1;
+    }
   }
   let seed = opts.seedSecret ?? process.env["NOMOS_ROOT_SEED"];
   if (seed === void 0 && opts.gcpSecret !== void 0) {
@@ -3518,7 +3745,7 @@ async function rebirthWorkspace(ws, opts) {
     }
   }
   if (seed === void 0 || seed.trim() === "") {
-    err2("gov rebirth needs the custodian seed \u2014 --seed-secret <b64>, env NOMOS_ROOT_SEED, or --gcp-secret <name>");
+    err2(`gov rebirth needs the ROOT CUSTODIAN seed \u2014 the blessed path is --gcp-secret ${ROOT_CUSTODIAN_SECRET}; --seed-secret <b64> is break-glass (avoid in shell history), env NOMOS_ROOT_SEED is the CI lane`);
     return 1;
   }
   const cloud = cloudBase(opts.cloud);
@@ -3578,9 +3805,9 @@ gov rebirth ${ws}:`);
     }
   }
   const rebornAt = Date.now();
-  const controllerHash = opts.controllerHash ?? eng.hashes?.nomos;
+  const controllerHash = opts.controllerHash ?? await resolveGovernanceHash(cloud, "workspaces");
   if (typeof controllerHash !== "string") {
-    err2("could not resolve root's governance controller hash (pass --controller-hash)");
+    err2("could not resolve root's governance (workspaces) law hash from root currentLaw (pass --controller-hash)");
     return 1;
   }
   const res = author2(eng, "root", "workspaces", "rebirthWorkspace", { workspaceId, reason, rebornAt }, controllerHash, { authorSecret: seed, actor: "user:root-custodian" });
@@ -3628,8 +3855,11 @@ function validatePlanForApply(plan, liveIncarnation) {
   if (plan.reason === null || typeof plan.reason === "string" && plan.reason.trim() === "") {
     return { error: "the plan's `reason` is still null \u2014 fill it in (the mandatory audit justification) before apply" };
   }
-  if (Array.isArray(plan.repairs) && plan.repairs.length > 0) {
-    return { error: "repair verbs are not yet executable \u2014 the plan may not carry `repairs` (the array must be empty); state-transform verbs land in a future release" };
+  if (Array.isArray(plan.repairs)) {
+    const bad = plan.repairs.find((r) => r.execution !== "recorded");
+    if (bad !== void 0) {
+      return { error: `the plan carries a repair with an unsupported execution '${String(bad.execution)}' \u2014 this CLI executes only execution:"recorded" (state-transform verbs land in a future release)` };
+    }
   }
   if (plan.pinned.incarnation !== null) {
     if (liveIncarnation === void 0) {
@@ -3643,6 +3873,7 @@ function validatePlanForApply(plan, liveIncarnation) {
 }
 function buildCertificate(args) {
   const { plan } = args;
+  const childNames = plan.children.map((c) => c.name);
   return {
     v: 1,
     plan,
@@ -3651,12 +3882,17 @@ function buildCertificate(args) {
       custodian: args.custodian,
       oldIncarnation: args.oldIncarnation,
       newIncarnation: args.newIncarnation,
+      oldHead: args.oldHead ?? args.oldIncarnation,
+      newHead: args.newHead ?? args.newIncarnation,
+      oldCustodyAddress: plan.will.frozenAt,
       newCustodyAddress: plan.will.newCustodyAddress,
       carried: plan.compaction.carried,
       parked: plan.compaction.parked,
       verdictBefore: args.verdictBefore,
       ...args.firstRefusal ? { firstRefusal: args.firstRefusal } : {},
-      verdictAfter: args.verdictAfter
+      verdictAfter: args.verdictAfter,
+      activeLawAfter: args.activeLawAfter ?? {},
+      childrenCarried: { count: childNames.length, names: childNames }
     },
     supersessionFacts: {
       supersededBy: plan.will.newCustodyAddress,
@@ -3665,6 +3901,7 @@ function buildCertificate(args) {
       custodian: args.custodian,
       at: args.at
     },
+    repairs: Array.isArray(plan.repairs) ? plan.repairs : [],
     ...args.repair !== void 0 ? { repair: args.repair } : {}
   };
 }
@@ -3684,6 +3921,14 @@ async function verifyWorkspaceVerdict(cloud, ws) {
     return { replay: "unknown", firstRefusal: null };
   }
 }
+async function currentLawOf(cloud, ws) {
+  try {
+    const d = await (await fetch(`${cloud}/v2/workspaces/${ws}/domains`)).json();
+    return d.currentLaw ?? {};
+  } catch {
+    return {};
+  }
+}
 async function liveIncarnationOf(cloud, ws) {
   try {
     const s = await (await fetch(`${cloud}/v2/workspaces/${ws}`)).json();
@@ -3695,7 +3940,7 @@ async function liveIncarnationOf(cloud, ws) {
 async function rebirthApply(planPath, opts) {
   let plan;
   try {
-    plan = JSON.parse(readFileSync2(planPath, "utf8"));
+    plan = JSON.parse(readFileSync3(planPath, "utf8"));
   } catch (e) {
     err2(`cannot read the plan ${planPath}: ${e.message}`);
     return 1;
@@ -3730,9 +3975,11 @@ async function rebirthApply(planPath, opts) {
   }
   const verdictBefore = plan.verdict.replay === "green" ? "green" : "red";
   const custodian = opts.principal ?? activePrincipal() ?? "root-custodian";
+  const repairIds = (plan.repairs ?? []).map((r) => r.id);
+  const effectiveReason = repairIds.length ? `${plan.reason ?? ""} ${repairIds.map((id) => `[repair:${id}]`).join(" ")}`.trim() : plan.reason ?? void 0;
   const code = await rebirthWorkspace(ws, {
     ...opts,
-    reason: plan.reason ?? void 0,
+    reason: effectiveReason,
     plan,
     quiet: true,
     yes: true
@@ -3743,19 +3990,21 @@ async function rebirthApply(planPath, opts) {
   }
   const newIncarnation = await liveIncarnationOf(cloud, ws) ?? null;
   const verdictAfter = await verifyWorkspaceVerdict(cloud, ws);
+  const activeLawAfter = await currentLawOf(cloud, ws);
   const cert = buildCertificate({
     plan,
     custodian,
     at: (/* @__PURE__ */ new Date()).toISOString(),
     oldIncarnation: plan.pinned.incarnation,
     newIncarnation,
+    activeLawAfter,
     verdictBefore,
     ...plan.verdict.firstRefusal ? { firstRefusal: plan.verdict.firstRefusal } : {},
     verdictAfter
   });
-  const certPath = join3(dirname2(planPath), "certificate.json");
+  const certPath = join4(dirname3(planPath), "certificate.json");
   try {
-    writeFileSync3(certPath, JSON.stringify(cert, null, 2) + "\n");
+    writeFileSync4(certPath, JSON.stringify(cert, null, 2) + "\n");
   } catch (e) {
     err2(`the rebirth succeeded but the certificate could not be written to ${certPath}: ${e.message}`);
     return 1;
@@ -3806,12 +4055,14 @@ async function executeRepairRebirth(cloud, ws, repair, verdict, opts) {
   }
   const newIncarnation = await liveIncarnationOf(cloudBaseUrl, ws) ?? null;
   const verdictAfter = await verifyWorkspaceVerdict(cloudBaseUrl, ws);
+  const activeLawAfter = await currentLawOf(cloudBaseUrl, ws);
   const cert = buildCertificate({
     plan,
     custodian,
     at: (/* @__PURE__ */ new Date()).toISOString(),
     oldIncarnation: plan.pinned.incarnation,
     newIncarnation,
+    activeLawAfter,
     verdictBefore,
     firstRefusal,
     verdictAfter,
@@ -3822,9 +4073,9 @@ async function executeRepairRebirth(cloud, ws, repair, verdict, opts) {
       note: "repair verb recorded; state transform verbs land in a future release (v1 rebirth only)"
     }
   });
-  const certPath = join3(dirname2(repair.file), "certificate.json");
+  const certPath = join4(dirname3(repair.file), "certificate.json");
   try {
-    writeFileSync3(certPath, JSON.stringify(cert, null, 2) + "\n");
+    writeFileSync4(certPath, JSON.stringify(cert, null, 2) + "\n");
   } catch (e) {
     err2(`the repair rebirth succeeded but the certificate could not be written to ${certPath}: ${e.message}`);
     return 1;
@@ -3844,13 +4095,14 @@ function readSealedIntentBytes(eng, ws, intentOut) {
   if (f?.data === void 0) return void 0;
   return Buffer.from(f.data).toString("base64");
 }
-var out2, err2, CLIENT_IMPACT;
+var out2, err2, ROOT_CUSTODIAN_SECRET, CLIENT_IMPACT;
 var init_governance = __esm({
   "src/governance.ts"() {
     "use strict";
     init_cloud();
     out2 = (s) => void process.stdout.write(s + "\n");
     err2 = (s) => void process.stderr.write("error: " + s + "\n");
+    ROOT_CUSTODIAN_SECRET = "nomos-root-custodian-key";
     CLIENT_IMPACT = "every connected client raises CustodyBreak(superseded); unsynced client work is invisible to the cloud \u2014 drain/sync clients first";
   }
 });
@@ -3874,7 +4126,7 @@ __export(lifecycle_exports, {
   signingAvailable: () => signingAvailable
 });
 import { createHash as createHash2 } from "node:crypto";
-import { readFileSync as readFileSync3 } from "node:fs";
+import { readFileSync as readFileSync4 } from "node:fs";
 async function fetchInstalledLaw(cloud, ws) {
   try {
     const r = await fetch(`${cloud}/v2/workspaces/${ws}/domains`);
@@ -3897,7 +4149,7 @@ async function fetchInstalledPackage(cloud, ws, hash) {
 function readDeployBody(file) {
   let body;
   try {
-    body = JSON.parse(readFileSync3(file, "utf8"));
+    body = JSON.parse(readFileSync4(file, "utf8"));
   } catch (e) {
     throw new Error(`deploy body ${file} is not valid JSON \u2014 recompile (githolon compile): ${e.message}`);
   }
@@ -4197,9 +4449,9 @@ __export(cloud_exports, {
   wsRetire: () => wsRetire,
   wsStatus: () => wsStatus
 });
-import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync4, readdirSync as readdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { chmodSync, existsSync as existsSync4, mkdirSync as mkdirSync4, readdirSync as readdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "node:fs";
 import { createHash as createHash3 } from "node:crypto";
-import { join as join4 } from "node:path";
+import { join as join5 } from "node:path";
 import { homedir } from "node:os";
 function cloudBase(flag) {
   return (flag ?? process.env["NOMOS_CLOUD"] ?? DEFAULT_CLOUD).replace(/\/+$/, "");
@@ -4211,18 +4463,18 @@ function authAnonKey() {
   return process.env["HOLON_AUTH_ANON_KEY"] ?? DEFAULT_AUTH_ANON_KEY;
 }
 function configDir() {
-  return process.env["HOLON_CONFIG_DIR"] ?? join4(homedir(), ".holon");
+  return process.env["HOLON_CONFIG_DIR"] ?? join5(homedir(), ".holon");
 }
 function credsPath() {
-  return join4(configDir(), "credentials.json");
+  return join5(configDir(), "credentials.json");
 }
 function loadCreds() {
-  if (!existsSync3(credsPath())) return { version: 1, secrets: {} };
-  return JSON.parse(readFileSync4(credsPath(), "utf8"));
+  if (!existsSync4(credsPath())) return { version: 1, secrets: {} };
+  return JSON.parse(readFileSync5(credsPath(), "utf8"));
 }
 function saveCreds(c) {
   mkdirSync4(configDir(), { recursive: true });
-  writeFileSync4(credsPath(), JSON.stringify(c, null, 2) + "\n", "utf8");
+  writeFileSync5(credsPath(), JSON.stringify(c, null, 2) + "\n", "utf8");
   chmodSync(credsPath(), 384);
 }
 function getSecret(cloud, ws) {
@@ -4337,21 +4589,21 @@ async function sessionToken() {
 }
 function discoverDeployJson(cwd, explicit) {
   if (explicit !== void 0) {
-    if (!existsSync3(explicit)) throw new Error(`deploy body not found: ${explicit}`);
+    if (!existsSync4(explicit)) throw new Error(`deploy body not found: ${explicit}`);
     return explicit;
   }
-  const buildDir = join4(cwd, "build");
-  if (!existsSync3(buildDir)) {
+  const buildDir = join5(cwd, "build");
+  if (!existsSync4(buildDir)) {
     throw new Error("no build/ directory \u2014 run `githolon compile` first (or pass --file <path>)");
   }
-  const bodies = readdirSync2(buildDir).filter((f) => f.endsWith(".deploy.json"));
+  const bodies = readdirSync3(buildDir).filter((f) => f.endsWith(".deploy.json"));
   if (bodies.length === 0) {
     throw new Error("no build/*.deploy.json \u2014 run `githolon compile` first (or pass --file <path>)");
   }
   if (bodies.length > 1) {
     throw new Error(`multiple deploy bodies in build/ (${bodies.join(", ")}) \u2014 pass --file <path>`);
   }
-  return join4(buildDir, bodies[0]);
+  return join5(buildDir, bodies[0]);
 }
 async function login(opts) {
   if (opts.agent !== true && opts.token === void 0) {
@@ -4578,7 +4830,7 @@ async function deploy2(ws, opts) {
   if (signed) {
     let body;
     try {
-      body = JSON.parse(readFileSync4(file, "utf8"));
+      body = JSON.parse(readFileSync5(file, "utf8"));
     } catch (e) {
       err4(`deploy body ${file} is not valid JSON \u2014 recompile: ${e.message}`);
       return 1;
@@ -4617,7 +4869,7 @@ async function deploy2(ws, opts) {
     const r = await fetch(`${cloud}/v2/workspaces/${ws}/domains`, {
       method: "POST",
       headers: { "content-type": "application/json" },
-      body: readFileSync4(file, "utf8")
+      body: readFileSync5(file, "utf8")
     });
     const d = await r.json().catch(() => void 0);
     if (!r.ok || d?.ok !== true) {
@@ -4711,27 +4963,27 @@ __export(editor_exports, {
   initEditor: () => initEditor,
   writeEditorRecommendation: () => writeEditorRecommendation
 });
-import { existsSync as existsSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname3, join as join5 } from "node:path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname4, join as join6 } from "node:path";
 function hasEditorRecommendation(cwd) {
-  const p = join5(cwd, ".vscode", "extensions.json");
-  if (!existsSync4(p)) return false;
+  const p = join6(cwd, ".vscode", "extensions.json");
+  if (!existsSync5(p)) return false;
   try {
-    const json = JSON.parse(readFileSync5(p, "utf8"));
+    const json = JSON.parse(readFileSync6(p, "utf8"));
     return Array.isArray(json.recommendations) && json.recommendations.includes(NOMOS_LAW_EXTENSION_ID);
   } catch {
     return true;
   }
 }
 function writeEditorRecommendation(cwd) {
-  const dir = join5(cwd, ".vscode");
-  const path = join5(dir, "extensions.json");
+  const dir = join6(cwd, ".vscode");
+  const path = join6(dir, "extensions.json");
   let json = {};
   let existed = false;
-  if (existsSync4(path)) {
+  if (existsSync5(path)) {
     existed = true;
     try {
-      const parsed = JSON.parse(readFileSync5(path, "utf8"));
+      const parsed = JSON.parse(readFileSync6(path, "utf8"));
       if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) {
         json = parsed;
       } else {
@@ -4749,8 +5001,8 @@ function writeEditorRecommendation(cwd) {
   }
   recs.push(NOMOS_LAW_EXTENSION_ID);
   json.recommendations = recs;
-  mkdirSync5(dirname3(path), { recursive: true });
-  writeFileSync5(path, JSON.stringify(json, null, 2) + "\n", "utf8");
+  mkdirSync5(dirname4(path), { recursive: true });
+  writeFileSync6(path, JSON.stringify(json, null, 2) + "\n", "utf8");
   return { path, action: existed ? "updated" : "created" };
 }
 function initEditor(cwd = process.cwd()) {
@@ -4784,21 +5036,21 @@ var init_editor = __esm({
 });
 
 // src/compile.ts
-import { spawn, spawnSync } from "node:child_process";
-import { createRequire } from "node:module";
-import { dirname as dirname4, join as join6 } from "node:path";
-import { pathToFileURL } from "node:url";
+import { spawn, spawnSync as spawnSync2 } from "node:child_process";
+import { createRequire as createRequire2 } from "node:module";
+import { dirname as dirname5, join as join7 } from "node:path";
+import { pathToFileURL as pathToFileURL2 } from "node:url";
 function resolveCompileLauncher(cwd) {
   const resolveDslPkg = (fromDir) => {
     try {
-      const req = fromDir === void 0 ? createRequire(import.meta.url) : createRequire(pathToFileURL(join6(fromDir, "noop.js")));
+      const req = fromDir === void 0 ? createRequire2(import.meta.url) : createRequire2(pathToFileURL2(join7(fromDir, "noop.js")));
       return req.resolve("@githolon/dsl/package.json");
     } catch {
       return void 0;
     }
   };
   const dslPkg = resolveDslPkg(cwd) ?? resolveDslPkg(void 0);
-  return dslPkg === void 0 ? void 0 : join6(dirname4(dslPkg), "compile_package.mjs");
+  return dslPkg === void 0 ? void 0 : join7(dirname5(dslPkg), "compile_package.mjs");
 }
 function runCompile(args) {
   const launcher = resolveCompileLauncher(process.cwd());
@@ -4807,7 +5059,7 @@ function runCompile(args) {
 `);
     return 1;
   }
-  const r = spawnSync(process.execPath, [launcher, ...args], { stdio: "inherit", cwd: process.cwd() });
+  const r = spawnSync2(process.execPath, [launcher, ...args], { stdio: "inherit", cwd: process.cwd() });
   const status2 = r.status ?? 1;
   if (status2 === 0 && process.stdout.isTTY) {
     try {
@@ -4821,7 +5073,7 @@ ${INIT_EDITOR_HINT}
 }
 function resolveCheckLauncher(cwd) {
   const launcher = resolveCompileLauncher(cwd);
-  return launcher === void 0 ? void 0 : join6(dirname4(launcher), "check_package.mjs");
+  return launcher === void 0 ? void 0 : join7(dirname5(launcher), "check_package.mjs");
 }
 function runCheck(args) {
   const launcher = resolveCheckLauncher(process.cwd());
@@ -4830,12 +5082,12 @@ function runCheck(args) {
 `);
     return 1;
   }
-  const r = spawnSync(process.execPath, [launcher, ...args], { stdio: "inherit", cwd: process.cwd() });
+  const r = spawnSync2(process.execPath, [launcher, ...args], { stdio: "inherit", cwd: process.cwd() });
   return r.status ?? 1;
 }
 function resolveCompatLauncher(cwd) {
   const launcher = resolveCompileLauncher(cwd);
-  return launcher === void 0 ? void 0 : join6(dirname4(launcher), "compat_package.mjs");
+  return launcher === void 0 ? void 0 : join7(dirname5(launcher), "compat_package.mjs");
 }
 function runCompat(args) {
   const launcher = resolveCompatLauncher(process.cwd());
@@ -4844,12 +5096,12 @@ function runCompat(args) {
 `);
     return 1;
   }
-  const r = spawnSync(process.execPath, [launcher, ...args], { stdio: "inherit", cwd: process.cwd() });
+  const r = spawnSync2(process.execPath, [launcher, ...args], { stdio: "inherit", cwd: process.cwd() });
   return r.status ?? 1;
 }
 function resolveLspLauncher(cwd) {
   const launcher = resolveCompileLauncher(cwd);
-  return launcher === void 0 ? void 0 : join6(dirname4(launcher), "lsp_server.mjs");
+  return launcher === void 0 ? void 0 : join7(dirname5(launcher), "lsp_server.mjs");
 }
 function runLsp(args) {
   const launcher = resolveLspLauncher(process.cwd());
@@ -4858,7 +5110,7 @@ function runLsp(args) {
 `);
     return 1;
   }
-  const r = spawnSync(process.execPath, [launcher, ...args], { stdio: "inherit", cwd: process.cwd() });
+  const r = spawnSync2(process.execPath, [launcher, ...args], { stdio: "inherit", cwd: process.cwd() });
   return r.status ?? 1;
 }
 function compileAsync(cwd, args = []) {
@@ -4898,8 +5150,8 @@ __export(proof_offline_exports, {
   runOfflineProofStandalone: () => runOfflineProofStandalone,
   runRelationBootstrapLeg: () => runRelationBootstrapLeg
 });
-import { existsSync as existsSync6, readFileSync as readFileSync6 } from "node:fs";
-import { basename, dirname as dirname5, join as join8 } from "node:path";
+import { existsSync as existsSync7, readFileSync as readFileSync7 } from "node:fs";
+import { basename, dirname as dirname6, join as join9 } from "node:path";
 function parseOfflineLegs(proofSource) {
   if (!proofSource.includes("AUTO-GENERATED by nomos-compile")) {
     throw new Error("not a generated proof (missing the AUTO-GENERATED header) \u2014 run `githolon compile` to (re)generate build/<name>.proof.mts");
@@ -5324,16 +5576,16 @@ function actorFromPayload(payload, field) {
   return typeof value === "string" && value.trim().length > 0 ? value : void 0;
 }
 async function runOfflineProofStandalone(proofPath, cloud, domain) {
-  const src = readFileSync6(proofPath, "utf8");
+  const src = readFileSync7(proofPath, "utf8");
   const packageName = basename(proofPath).replace(/\.proof\.mts$/, "");
-  const deployFile = join8(dirname5(proofPath), `${packageName}.deploy.json`);
-  if (!existsSync6(deployFile)) {
+  const deployFile = join9(dirname6(proofPath), `${packageName}.deploy.json`);
+  if (!existsSync7(deployFile)) {
     throw new Error(`missing ${deployFile} \u2014 run \`githolon compile\` (the proof and the deploy body are built together)`);
   }
   let legs;
-  const legsFile = join8(dirname5(proofPath), `${packageName}.proof-legs.json`);
-  if (existsSync6(legsFile)) {
-    const index = JSON.parse(readFileSync6(legsFile, "utf8"));
+  const legsFile = join9(dirname6(proofPath), `${packageName}.proof-legs.json`);
+  if (existsSync7(legsFile)) {
+    const index = JSON.parse(readFileSync7(legsFile, "utf8"));
     const keys = Object.keys(index.domains);
     const chosen = domain ?? index.default;
     if (index.domains[chosen] === void 0) {
@@ -5351,7 +5603,7 @@ async function runOfflineProofStandalone(proofPath, cloud, domain) {
     if (domain !== void 0) throw new Error(`--domain needs a per-domain legs index (build/${packageName}.proof-legs.json) \u2014 recompile with \`githolon compile\` to emit it`);
     legs = parseOfflineLegs(src);
   }
-  const deployBody = JSON.parse(readFileSync6(deployFile, "utf8"));
+  const deployBody = JSON.parse(readFileSync7(deployFile, "utf8"));
   const lawHash = await sha256hex(deployBody.packageUsda);
   console.log(`githolon proof \u2014 OFFLINE legs on a local holon (the cloud loop: githolon proof --live)`);
   const { eng } = await holonEngine(cloud, deployBody, "githolon-proof");
@@ -5378,147 +5630,6 @@ var init_proof_offline = __esm({
   }
 });
 
-// src/repairs.ts
-var repairs_exports = {};
-__export(repairs_exports, {
-  discoverRepairs: () => discoverRepairs,
-  knownRepairBlock: () => knownRepairBlock,
-  matchRepair: () => matchRepair,
-  parseRefusal: () => parseRefusal
-});
-import { spawnSync as spawnSync4 } from "node:child_process";
-import { createRequire as createRequire2 } from "node:module";
-import { existsSync as existsSync9, mkdtempSync, readdirSync as readdirSync4, readFileSync as readFileSync10, rmSync, writeFileSync as writeFileSync7 } from "node:fs";
-import { tmpdir } from "node:os";
-import { dirname as dirname7, isAbsolute, join as join11, resolve as resolve2 } from "node:path";
-import { pathToFileURL as pathToFileURL4 } from "node:url";
-function parseRefusal(verdict) {
-  const check2 = String(verdict["check"] ?? "");
-  const error = String(verdict["error"] ?? "");
-  const raw = `${check2}: ${error}`;
-  const kind = /evolve.?gate/i.test(raw) || /evolve/i.test(check2) ? "evolve-gate" : "other";
-  const sids = /* @__PURE__ */ new Set();
-  const structured = verdict["stableId"] ?? verdict["stableIds"];
-  if (typeof structured === "string" && SID_SHAPE.test(structured)) sids.add(structured.toLowerCase());
-  if (Array.isArray(structured)) {
-    for (const s of structured) if (typeof s === "string" && SID_SHAPE.test(s)) sids.add(s.toLowerCase());
-  }
-  for (const m of raw.matchAll(SID_RE)) sids.add(m[1].toLowerCase());
-  return { kind, stableIds: [...sids], raw };
-}
-function matchRepair(refusal, repairs) {
-  if (refusal.kind === "other") return void 0;
-  return repairs.find(
-    (r) => r.matcher.refusal === refusal.kind && refusal.stableIds.includes(r.matcher.stableId.toLowerCase())
-  );
-}
-function knownRepairBlock(repair) {
-  return [
-    "",
-    `\u2726 KNOWN REPAIR: '${repair.id}' (${repair.file}) declares a remedy for exactly this refusal.`,
-    `  reason: ${repair.reason}`,
-    "  Re-run with --repair to execute it."
-  ].join("\n");
-}
-function resolveTsxCli(cwd) {
-  const pkgDir = (name, fromDir) => {
-    try {
-      return dirname7(createRequire2(pathToFileURL4(join11(fromDir, "noop.js")).href).resolve(`${name}/package.json`));
-    } catch {
-      return void 0;
-    }
-  };
-  const dslDir = pkgDir("@githolon/dsl", cwd) ?? (() => {
-    try {
-      return dirname7(createRequire2(import.meta.url).resolve("@githolon/dsl/package.json"));
-    } catch {
-      return void 0;
-    }
-  })();
-  const tsxDir = pkgDir("tsx", cwd) ?? (dslDir !== void 0 ? pkgDir("tsx", dslDir) : void 0);
-  if (tsxDir === void 0) return void 0;
-  try {
-    const pkg = JSON.parse(
-      readFileSync10(join11(tsxDir, "package.json"), "utf8")
-    );
-    const rel = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.["tsx"];
-    return join11(tsxDir, rel ?? "dist/cli.mjs");
-  } catch {
-    return void 0;
-  }
-}
-function resolveDslEntry(cwd) {
-  const tryFrom = (fromUrl) => {
-    try {
-      return createRequire2(fromUrl).resolve("@githolon/dsl");
-    } catch {
-      return void 0;
-    }
-  };
-  return tryFrom(pathToFileURL4(join11(cwd, "noop.js")).href) ?? tryFrom(import.meta.url);
-}
-function discoverRepairs(cwd) {
-  const dir = join11(cwd, "repairs");
-  if (!existsSync9(dir)) return { repairs: [] };
-  let files;
-  try {
-    files = readdirSync4(dir).filter((f) => /\.(ts|mts|cts)$/.test(f) && !/\.d\.ts$/.test(f)).sort().map((f) => resolve2(dir, f));
-  } catch (e) {
-    return { error: `could not read the repairs/ folder: ${e.message}` };
-  }
-  if (files.length === 0) return { repairs: [] };
-  const tsxCli = resolveTsxCli(cwd);
-  const dslEntry = resolveDslEntry(cwd);
-  if (tsxCli === void 0 || dslEntry === void 0) {
-    return { error: "repairs/ is present but the toolchain to load it is missing \u2014 add @githolon/dsl (tsx + the DSL ride it) to the project and npm install" };
-  }
-  const scratch = mkdtempSync(join11(tmpdir(), "githolon-repairs-"));
-  const loader = join11(scratch, "discover.mts");
-  const loaderSrc = `
-import { repairsOf } from ${JSON.stringify(dslEntry)};
-const files = ${JSON.stringify(files)};
-const out = [];
-const seen = new Map();
-for (const file of files) {
-  const mod = await import(${JSON.stringify("file://")} + file);
-  for (const r of repairsOf(mod)) {
-    if (seen.has(r.id)) {
-      throw new Error("duplicate repair id '" + r.id + "' \u2014 declared in " + seen.get(r.id) + " and " + file);
-    }
-    seen.set(r.id, file);
-    out.push({ id: r.id, matcher: r.matcher, reason: r.reason, verb: r.verb, file });
-  }
-}
-process.stdout.write("\\u0001REPAIRS\\u0001" + JSON.stringify(out) + "\\u0001END\\u0001\\n");
-`;
-  try {
-    writeFileSync7(loader, loaderSrc, "utf8");
-    const r = spawnSync4(process.execPath, [tsxCli, loader], { cwd, encoding: "utf8" });
-    if (r.status !== 0) {
-      const msg = (r.stderr || r.stdout || "").trim().split("\n").filter(Boolean).slice(-4).join("\n");
-      return { error: `loading repairs/ failed:
-${msg || `tsx exited ${r.status ?? "?"}`}` };
-    }
-    const m = /
REPAIRS
([\s\S]*?)
END
/.exec(r.stdout);
-    if (m === null) return { error: "the repairs loader produced no manifest (unexpected \u2014 the DSL/tsx may be too old)" };
-    const parsed = JSON.parse(m[1]);
-    const repairs = parsed.map((p) => ({ ...p, file: isAbsolute(p.file) ? p.file : resolve2(cwd, p.file) }));
-    return { repairs };
-  } catch (e) {
-    return { error: `loading repairs/ failed: ${e.message}` };
-  } finally {
-    rmSync(scratch, { recursive: true, force: true });
-  }
-}
-var SID_RE, SID_SHAPE;
-var init_repairs = __esm({
-  "src/repairs.ts"() {
-    "use strict";
-    SID_RE = /stable id ([0-9a-f]{16})/gi;
-    SID_SHAPE = /^[0-9a-f]{16}$/i;
-  }
-});
-
 // src/mcp.ts
 var mcp_exports = {};
 __export(mcp_exports, {
@@ -7258,20 +7369,20 @@ init_engine();
 init_cloud();
 init_compile();
 init_local_holon();
-import { existsSync as existsSync7, readFileSync as readFileSync7, watch } from "node:fs";
+import { existsSync as existsSync8, readFileSync as readFileSync8, watch } from "node:fs";
 import { createServer } from "node:http";
-import { dirname as dirname6, join as join9, resolve } from "node:path";
-import { pathToFileURL as pathToFileURL3 } from "node:url";
+import { dirname as dirname7, join as join10, resolve as resolve2 } from "node:path";
+import { pathToFileURL as pathToFileURL4 } from "node:url";
 
 // src/project.ts
-import { existsSync as existsSync5, statSync as statSync2 } from "node:fs";
-import { join as join7 } from "node:path";
-import { pathToFileURL as pathToFileURL2 } from "node:url";
+import { existsSync as existsSync6, statSync as statSync2 } from "node:fs";
+import { join as join8 } from "node:path";
+import { pathToFileURL as pathToFileURL3 } from "node:url";
 var CONFIG_FILE = "nomos.package.mjs";
 async function loadProject(cwd, opts = {}) {
-  const configPath = join7(cwd, CONFIG_FILE);
-  if (!existsSync5(configPath)) return void 0;
-  const href = pathToFileURL2(configPath).href + (opts.bust === true ? `?v=${statSync2(configPath).mtimeMs}-${Date.now()}` : "");
+  const configPath = join8(cwd, CONFIG_FILE);
+  if (!existsSync6(configPath)) return void 0;
+  const href = pathToFileURL3(configPath).href + (opts.bust === true ? `?v=${statSync2(configPath).mtimeMs}-${Date.now()}` : "");
   const mod = await import(href);
   const cfg = mod.default;
   if (cfg === void 0 || typeof cfg.name !== "string" || cfg.name.length === 0) {
@@ -7435,11 +7546,11 @@ function startServer(s) {
   });
 }
 function readDeployBody2(cwd, packageName) {
-  const file = join9(cwd, "build", `${packageName}.deploy.json`);
-  if (!existsSync7(file)) {
+  const file = join10(cwd, "build", `${packageName}.deploy.json`);
+  if (!existsSync8(file)) {
     throw new Error(`compile produced no ${file} \u2014 check the compile output above`);
   }
-  return JSON.parse(readFileSync7(file, "utf8"));
+  return JSON.parse(readFileSync8(file, "utf8"));
 }
 async function installLaw(s, deployBody, installedBy) {
   const newHash = await sha256hex(deployBody.packageUsda);
@@ -7455,11 +7566,11 @@ async function installLaw(s, deployBody, installedBy) {
   return { ok: true };
 }
 async function runProofCycle(s, cwd, deployBody, installedBy) {
-  const proofPath = join9(cwd, "build", `${s.packageName}.proof.mts`);
-  if (!existsSync7(proofPath)) return void 0;
+  const proofPath = join10(cwd, "build", `${s.packageName}.proof.mts`);
+  if (!existsSync8(proofPath)) return void 0;
   const scratch = `proof-${s.cycle}`;
   try {
-    const legs = parseOfflineLegs(readFileSync7(proofPath, "utf8"));
+    const legs = parseOfflineLegs(readFileSync8(proofPath, "utf8"));
     await mountFresh(s.eng, scratch);
     author(s.eng, scratch, "bootstrap", "installDomain", installPayload(s.eng.hashes.nomos, s.eng.nomosPkg, installedBy), "");
     author(s.eng, scratch, "nomos", "installDomain", installPayload(s.lawHash, deployBody.packageUsda, installedBy), s.eng.hashes.nomos);
@@ -7478,7 +7589,7 @@ async function dev(opts) {
     return void 0;
   });
   if (project === void 0) {
-    if (!existsSync7(join9(cwd, CONFIG_FILE))) {
+    if (!existsSync8(join10(cwd, CONFIG_FILE))) {
       err5(`no ${CONFIG_FILE} here (${cwd}) \u2014 \`githolon dev\` runs inside a project; scaffold one from examples/guestbook or \`githolon generate domain <name>\``);
     }
     return 1;
@@ -7543,14 +7654,14 @@ ${firstCompile.output}`);
   }
   const moduleDirs = /* @__PURE__ */ new Set();
   try {
-    const cfgModule = await import(pathToFileURL3(project.configPath).href);
+    const cfgModule = await import(pathToFileURL4(project.configPath).href);
     for (const d of cfgModule.default?.domains ?? []) {
-      for (const m of d.modules ?? []) moduleDirs.add(dirname6(resolve(cwd, m)));
+      for (const m of d.modules ?? []) moduleDirs.add(dirname7(resolve2(cwd, m)));
     }
   } catch {
-    moduleDirs.add(join9(cwd, "domains"));
+    moduleDirs.add(join10(cwd, "domains"));
   }
-  if (moduleDirs.size === 0) moduleDirs.add(join9(cwd, "domains"));
+  if (moduleDirs.size === 0) moduleDirs.add(join10(cwd, "domains"));
   let timer;
   let cycling = false;
   let queued = false;
@@ -7600,7 +7711,7 @@ ${run.output}`);
   };
   const watchers = [];
   for (const d of moduleDirs) {
-    if (!existsSync7(d)) continue;
+    if (!existsSync8(d)) continue;
     watchers.push(watch(d, { recursive: true }, (_evt, f) => onChange(f)));
     s.watchRoots.push(d.startsWith(cwd) ? d.slice(cwd.length + 1) + "/" : d);
   }
@@ -7625,13 +7736,13 @@ ${run.output}`);
 
 // src/git.ts
 init_cloud();
-import { spawnSync as spawnSync2 } from "node:child_process";
+import { spawnSync as spawnSync3 } from "node:child_process";
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { readFileSync as readFileSync8 } from "node:fs";
+import { readFileSync as readFileSync9 } from "node:fs";
 var out6 = (s) => void process.stdout.write(s + "\n");
 var err6 = (s) => void process.stderr.write("error: " + s + "\n");
 function git(args, opts = {}) {
-  const r = spawnSync2("git", args, { stdio: opts.quiet === true ? "ignore" : "inherit" });
+  const r = spawnSync3("git", args, { stdio: opts.quiet === true ? "ignore" : "inherit" });
   return r.status ?? 1;
 }
 function ensureSecret(cloud, ws) {
@@ -7656,7 +7767,7 @@ function workspaceFromPath(path) {
 }
 async function gitCredential(action) {
   if (action !== "get") return 0;
-  const kv = parseCredentialInput(readFileSync8(0, "utf8"));
+  const kv = parseCredentialInput(readFileSync9(0, "utf8"));
   const ws = workspaceFromPath(kv["path"]);
   if (kv["protocol"] !== "https" || ws === void 0) return 0;
   const cloud = `https://${kv["host"]}`;
@@ -7878,6 +7989,23 @@ var HELP = {
       "githolon gov relay root co2.offer.json"
     ]
   },
+  rebirth: {
+    usage: "githolon rebirth plan <ws> [--reason <text>] [--out <dir>]\n       githolon rebirth apply --plan <plan.json> --gcp-secret nomos-root-custodian-key [--yes]",
+    what: "LAWFUL SUPERSESSION as code (the migrations-folder workflow; architecture/rebirth_and_custody_lifecycle.md).\n`plan` writes a read-only, drift-pinned plan.json + impact.md into rebirths/<date>-<ws>/ \u2014 the reviewable\nintent (pinned incarnation, law lifecycle, children, verdict, and any MATCHED repairs from repairs/*.ts).\n`apply` drives the reviewed plan through the signed rebirth path \u2192 certificate.json beside it.\nAPPLY REQUIRES THE ROOT CUSTODIAN SEED \u2014 the blessed path is --gcp-secret nomos-root-custodian-key;\n--seed-secret <b64> is break-glass (avoid in shell history), env NOMOS_ROOT_SEED is the CI lane.\n\nTHE BLESSED GOLDEN PATH:\n  1. githolon rebirth plan <ws>\n  2. githolon rebirth apply --plan <path> --gcp-secret nomos-root-custodian-key [--yes]\n  3. githolon replay <ws>     (expect GREEN from intent 0)\n  4. githolon status <ws>     (incarnation + supersession history)\n  5. githolon compat          (clients raise CustodyBreak \u2014 choose adopt/reject)",
+    flags: [
+      ["--reason <text>", "the mandatory audit justification (fill it into the plan before apply)"],
+      ["--out <dir>", "plan: an alternate output dir (default: rebirths/<date>-<ws>)"],
+      ["--plan <plan.json>", "apply: the reviewed plan file to execute (drift-pinned)"],
+      ["--gcp-secret <name>", "apply: read the root custodian seed from this GCP secret (blessed: nomos-root-custodian-key)"],
+      ["--seed-secret <b64>", "apply: break-glass \u2014 the seed inline (avoid in shell history)"],
+      ["--yes", "apply: skip the interactive confirm"],
+      ["--cloud <url>", "target cloud"]
+    ],
+    examples: [
+      "githolon rebirth plan co2-platform --reason 'evolve-gate scar at intent 74'",
+      "githolon rebirth apply --plan rebirths/2026-07-09-co2-platform/plan.json --gcp-secret nomos-root-custodian-key --yes"
+    ]
+  },
   grant: {
     usage: "githolon grant <admin|creation|quota> <principal> [--max <N>] [--label <L>] [--parent <ws>] [--cloud <url>]",
     what: "Grant authority as a SIGNED governance offer to the parent (default root) \u2014 never a host\nendpoint. The grant is attributed to YOUR signing principal; only an admin's signature is\nadmitted by the far-side gate. `admin`/`creation` grant the principal-centric relation; `quota`\ngrants a per-principal workspace allowance (--max). Enroll a device key first (githolon key enroll).",
@@ -7958,15 +8086,15 @@ function commandHelp(cmd) {
 init_engine();
 init_cloud();
 init_local_holon();
-import { spawnSync as spawnSync3 } from "node:child_process";
-import { existsSync as existsSync8, readdirSync as readdirSync3, readFileSync as readFileSync9, writeFileSync as writeFileSync6 } from "node:fs";
-import { join as join10 } from "node:path";
+import { spawnSync as spawnSync4 } from "node:child_process";
+import { existsSync as existsSync9, readdirSync as readdirSync4, readFileSync as readFileSync10, writeFileSync as writeFileSync7 } from "node:fs";
+import { join as join11 } from "node:path";
 var out7 = (s) => void process.stdout.write(s + "\n");
 var err7 = (s) => void process.stderr.write("error: " + s + "\n");
 var WS2 = "local";
 async function ledgerInit(dir, opts) {
   const cloud = cloudBase(opts.cloud);
-  if (existsSync8(dir) && readdirSync3(dir).length > 0) {
+  if (existsSync9(dir) && readdirSync4(dir).length > 0) {
     err7(`refusing to mint into non-empty directory: ${dir}`);
     return 1;
   }
@@ -7977,7 +8105,7 @@ async function ledgerInit(dir, opts) {
     err7(e.message);
     return 1;
   }
-  const deployBody = JSON.parse(readFileSync9(deployFile, "utf8"));
+  const deployBody = JSON.parse(readFileSync10(deployFile, "utf8"));
   const domainHash = await sha256hex(deployBody.packageUsda);
   const c = loadCreds();
   const principal = await sessionToken().catch(() => void 0) !== void 0 ? c.session.uid : c.principal;
@@ -7993,11 +8121,11 @@ async function ledgerInit(dir, opts) {
   const verdict = verifyChainLocal(eng, WS2);
   if (!printVerdict(verdict)) return 1;
   const gitTree = eng.preopen.dir.contents.get("ws").contents.get(WS2).contents.get("nomos.git");
-  const gitDir = join10(dir, ".git");
+  const gitDir = join11(dir, ".git");
   writeTreeToDisk(gitTree, gitDir);
-  const cfgPath = join10(gitDir, "config");
-  writeFileSync6(cfgPath, readFileSync9(cfgPath, "utf8").replace(/bare = true/, "bare = false"), "utf8");
-  spawnSync3("git", ["-C", dir, "reset", "--hard", "main"], { stdio: "ignore" });
+  const cfgPath = join11(gitDir, "config");
+  writeFileSync7(cfgPath, readFileSync10(cfgPath, "utf8").replace(/bare = true/, "bare = false"), "utf8");
+  spawnSync4("git", ["-C", dir, "reset", "--hard", "main"], { stdio: "ignore" });
   out7(`\u2713 holon written \u2192 ${dir} (a normal git repo; git log IS the audit trail)`);
   out7(`
 Birth it on Nomos Cloud (the cloud re-derives this exact verdict):`);
@@ -8005,8 +8133,8 @@ Birth it on Nomos Cloud (the cloud re-derives this exact verdict):`);
   return 0;
 }
 async function ledgerVerify(dir, opts) {
-  const gitDir = existsSync8(join10(dir, ".git")) ? join10(dir, ".git") : dir;
-  if (!existsSync8(join10(gitDir, "HEAD"))) {
+  const gitDir = existsSync9(join11(dir, ".git")) ? join11(dir, ".git") : dir;
+  if (!existsSync9(join11(gitDir, "HEAD"))) {
     err7(`${dir} is not a git repo (no HEAD)`);
     return 1;
   }
@@ -8480,7 +8608,8 @@ Governance (SIGNED client-side, relayed as {intentBytes} \u2014 never a host-aut
   githolon gov rebirth <ws> --reason <text>               LAWFUL SUPERSESSION (recovery verb 3): supersede a
             [--dry-run [--json]] [--yes]                   scarred chain; --dry-run = READ-ONLY impact report
   githolon rebirth plan <ws> [--reason <text>] [--out D]  write a stable plan.json + impact.md (rebirths-as-code)
-  githolon rebirth apply --plan <plan.json> [--yes]       drift-pinned apply of a reviewed plan \u2192 certificate.json
+  githolon rebirth apply --plan <plan.json>               drift-pinned apply of a reviewed plan \u2192 certificate.json
+            --gcp-secret nomos-root-custodian-key [--yes]  (apply needs the ROOT CUSTODIAN seed; --gcp-secret is blessed)
   githolon replay <ws> --repair                            execute the repair matching a red verify (\u2192 certificate)
   githolon grant <admin|creation> <principal> [--label L] grant authority at the parent (default root)
   githolon grant quota <principal> --max <N>              grant a per-principal workspace allowance

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.69.1",
+  "version": "0.69.3",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -29,8 +29,8 @@
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/client": "^0.69.1",
-    "@githolon/dsl": "^0.69.1",
+    "@githolon/client": "^0.69.3",
+    "@githolon/dsl": "^0.69.3",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {