githolon 0.69.3 → 0.70.0

package/dist/cli.mjs

@@ -2972,10 +2972,12 @@ var init_repairs = __esm({
 // src/governance.ts
 var governance_exports = {};
 __export(governance_exports, {
+  HONEST_CEILING: () => HONEST_CEILING,
   ROOT_CUSTODIAN_SECRET: () => ROOT_CUSTODIAN_SECRET,
   buildCertificate: () => buildCertificate,
   buildRebirthPlan: () => buildRebirthPlan,
   certifyEra: () => certifyEra,
+  consentRebirth: () => consentRebirth,
   executeRepairRebirth: () => executeRepairRebirth,
   governanceOffer: () => governanceOffer,
   governanceRelay: () => governanceRelay,
@@ -2984,6 +2986,11 @@ __export(governance_exports, {
   keyExport: () => keyExport,
   keyImport: () => keyImport,
   keyShow: () => keyShow,
+  postureMeaning: () => postureMeaning,
+  postureSet: () => postureSet,
+  postureShow: () => postureShow,
+  readLiveConsent: () => readLiveConsent,
+  readPosture: () => readPosture2,
   rebirthApply: () => rebirthApply,
   rebirthPlanCommand: () => rebirthPlanCommand,
   rebirthWorkspace: () => rebirthWorkspace,
@@ -3095,6 +3102,129 @@ async function grantOrRevoke(verb, kind, subject, opts) {
   out2(`\u2713 ${directiveId} ${subject} via signed governance offer to ${parent}`);
   return 0;
 }
+function postureMeaning(posture) {
+  return posture === "sovereign" ? "the operator CANNOT run recovery verbs (rebirth, certifyEra, repairs) without YOUR consent \u2014 root's rebirth REFUSES for this workspace unless a live RebirthConsent fact is folded in your OWN chain (githolon consent rebirth <ws>). Restraint is law that replays, not host policy." : 'the operator CAN run recovery verbs (rebirth, certifyEra, repairs) FOR you \u2014 each a signed, attributed, permanent law fact you audit forever. "The assurance of being able to ask us for help." Revoke any time (\u2192 sovereign): githolon posture set <ws> sovereign --reason \u2026';
+}
+async function readPosture2(cloud, ws) {
+  try {
+    const r = await fetch(`${cloud}/v2/workspaces/${ws}/governancePosture?scope=self`);
+    if (!r.ok) return "managed";
+    const d = await r.json();
+    const rows = Array.isArray(d?.rows) ? d.rows : [];
+    const last = rows[rows.length - 1];
+    return last?.data?.posture === "sovereign" ? "sovereign" : "managed";
+  } catch {
+    return null;
+  }
+}
+async function readLiveConsent(cloud, ws) {
+  try {
+    const r = await fetch(`${cloud}/v2/workspaces/${ws}/rebirthConsentByWorkspace?workspaceId=${encodeURIComponent(ws)}`);
+    if (!r.ok) return [];
+    const d = await r.json();
+    const now = Date.now();
+    return (Array.isArray(d?.rows) ? d.rows : []).map((row) => row?.data ?? {}).filter((data) => {
+      const e = Number(data["expiresAt"]);
+      return !(e > 0) || e > now;
+    }).map((data) => ({
+      reason: String(data["reason"] ?? ""),
+      consentedBy: String(data["consentedBy"] ?? ""),
+      consentedAt: Number(data["consentedAt"] ?? 0),
+      ...Number(data["expiresAt"]) > 0 ? { expiresAt: Number(data["expiresAt"]) } : {}
+    }));
+  } catch {
+    return [];
+  }
+}
+async function postureShow(ws, opts) {
+  const cloud = cloudBase(opts.cloud);
+  const posture = await readPosture2(cloud, ws);
+  if (posture === null) {
+    err2(`could not read '${ws}' posture from ${cloud} \u2014 is the workspace born?`);
+    return 1;
+  }
+  out2(`governance posture \u2014 ${ws} on ${cloud}`);
+  out2("\u2550".repeat(48));
+  out2(`  posture : ${posture.toUpperCase()}${posture === "managed" ? "  (default)" : ""}`);
+  out2(`  means   : ${postureMeaning(posture)}`);
+  if (posture === "sovereign") {
+    const consents = await readLiveConsent(cloud, ws);
+    if (consents.length === 0) {
+      out2(`  consent : NONE live \u2014 a rebirth of this workspace would be REFUSED (428) until the tenant consents.`);
+      out2(`            grant it: githolon consent rebirth ${ws} --reason "\u2026"`);
+    } else {
+      out2(`  consent : ${consents.length} live consent fact(s):`);
+      for (const c of consents) out2(`    \u2022 by ${c.consentedBy || "?"} at ${c.consentedAt ? new Date(c.consentedAt).toISOString() : "?"}${c.expiresAt ? ` (expires ${new Date(c.expiresAt).toISOString()})` : ""} \u2014 ${c.reason || ""}`);
+    }
+    out2("");
+    out2(`  HONEST CEILING: ${HONEST_CEILING}`);
+  }
+  return 0;
+}
+async function postureSet(ws, posture, opts) {
+  if (posture !== "managed" && posture !== "sovereign") {
+    err2(`expected: githolon posture set ${ws} <managed|sovereign> --reason "\u2026"`);
+    return 1;
+  }
+  const reason = opts.reason;
+  if (reason === void 0 || reason.trim() === "") {
+    err2(`posture set requires a --reason (the audit justification, on the ledger forever)`);
+    return 1;
+  }
+  let principal;
+  try {
+    principal = resolveGovernancePrincipal(opts);
+  } catch (e) {
+    err2(e.message);
+    return 1;
+  }
+  const payload = { workspaceId: ws, posture, reason, setBy: principal, at: Date.now() };
+  let v;
+  try {
+    v = await signAndPostGovernance(ws, "setGovernancePosture", payload, opts);
+  } catch (e) {
+    err2(e.message);
+    return 1;
+  }
+  if (!v.ok) {
+    err2(`setGovernancePosture refused (${v.status}): ${typeof v.body === "string" ? v.body : JSON.stringify(v.body)}`);
+    return 1;
+  }
+  out2(`\u2713 ${ws} posture set to ${posture.toUpperCase()} via signed governance offer`);
+  out2(`  ${postureMeaning(posture)}`);
+  if (posture === "sovereign") out2(`  (forward-only: help already given stays in history; the operator now needs your consent to rebirth \u2014 githolon consent rebirth ${ws} --reason \u2026)`);
+  return 0;
+}
+async function consentRebirth(ws, opts) {
+  const reason = opts.reason;
+  if (reason === void 0 || reason.trim() === "") {
+    err2(`consent rebirth requires a --reason (why you consent \u2014 on the ledger forever)`);
+    return 1;
+  }
+  let principal;
+  try {
+    principal = resolveGovernancePrincipal(opts);
+  } catch (e) {
+    err2(e.message);
+    return 1;
+  }
+  const payload = { workspaceId: ws, reason, consentedBy: principal, consentedAt: Date.now() };
+  if (typeof opts.expiresAt === "number" && opts.expiresAt > 0) payload["expiresAt"] = opts.expiresAt;
+  let v;
+  try {
+    v = await signAndPostGovernance(ws, "consentToRebirth", payload, opts);
+  } catch (e) {
+    err2(e.message);
+    return 1;
+  }
+  if (!v.ok) {
+    err2(`consentToRebirth refused (${v.status}): ${typeof v.body === "string" ? v.body : JSON.stringify(v.body)}`);
+    return 1;
+  }
+  out2(`\u2713 ${ws} \u2014 rebirth consent folded in the tenant chain (by ${principal})`);
+  out2(`  the operator's rebirth custody act may now proceed (the two-key ceremony is satisfied).`);
+  return 0;
+}
 async function keyEnroll(opts) {
   const cloud = cloudBase(opts.cloud);
   const principal = opts.principal ?? activePrincipal();
@@ -3318,6 +3448,7 @@ async function certifyEra(ws, opts) {
     return 1;
   }
   let seed = opts.seedSecret ?? process.env["NOMOS_ROOT_SEED"];
+  const hasAsIdentity = typeof opts.as === "string" && opts.as.length > 0;
   if (seed === void 0 && opts.gcpSecret !== void 0) {
     try {
       const { execFileSync } = await import("node:child_process");
@@ -3576,6 +3707,9 @@ async function buildRebirthPlan(cloud, ws, reason) {
   }
   const frozenAt = priorSupersessions === 0 ? ws : `${ws}--i${priorSupersessions}`;
   const newCustodyAddress = `${ws}--i${priorSupersessions + 1}`;
+  const posture = await readPosture2(cloud, ws) ?? "managed";
+  const consents = posture === "sovereign" ? await readLiveConsent(cloud, ws) : [];
+  const consentState = posture === "managed" ? "not-required" : consents.length > 0 ? "present" : "absent";
   const plan = {
     v: 1,
     workspace: ws,
@@ -3591,6 +3725,7 @@ async function buildRebirthPlan(cloud, ws, reason) {
     mode,
     compaction,
     repairs,
+    posture: { posture, consent: consentState },
     clientImpact: CLIENT_IMPACT,
     generatedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
@@ -3662,6 +3797,18 @@ function renderRebirthImpact(plan, ledgerCommits) {
     L.push("    state-transform verbs execute at the re-fold seam in a future release.");
   }
   L.push("");
+  L.push("GOVERNANCE POSTURE");
+  const pp = plan.posture ?? { posture: "managed", consent: "not-required" };
+  L.push(`  posture       : ${pp.posture.toUpperCase()}${pp.posture === "managed" ? "  (default \u2014 the operator may run recovery verbs for the tenant)" : ""}`);
+  if (pp.posture === "sovereign") {
+    if (pp.consent === "present") {
+      L.push("  consent       : PRESENT \u2014 a live tenant RebirthConsent fact authorizes this rebirth (the two-key ceremony is satisfied).");
+    } else {
+      L.push(`  consent       : ABSENT \u2014 SOVEREIGN target: this rebirth is REFUSED until the tenant consents in THEIR OWN chain.`);
+      L.push(`                  the tenant grants it: githolon consent rebirth ${plan.workspace} --reason "\u2026"`);
+    }
+  }
+  L.push("");
   L.push("CLIENT IMPACT");
   L.push(`  ${plan.clientImpact}.`);
   L.push("  Recommend tenants DRAIN/SYNC their clients before the rebirth window.");
@@ -3735,6 +3882,7 @@ async function rebirthWorkspace(ws, opts) {
     }
   }
   let seed = opts.seedSecret ?? process.env["NOMOS_ROOT_SEED"];
+  const hasAsIdentity = typeof opts.as === "string" && opts.as.length > 0;
   if (seed === void 0 && opts.gcpSecret !== void 0) {
     try {
       const { execFileSync } = await import("node:child_process");
@@ -3745,8 +3893,10 @@ async function rebirthWorkspace(ws, opts) {
     }
   }
   if (seed === void 0 || seed.trim() === "") {
-    err2(`gov rebirth needs the ROOT CUSTODIAN seed \u2014 the blessed path is --gcp-secret ${ROOT_CUSTODIAN_SECRET}; --seed-secret <b64> is break-glass (avoid in shell history), env NOMOS_ROOT_SEED is the CI lane`);
-    return 1;
+    if (!hasAsIdentity) {
+      err2(`gov rebirth needs an identity: --as <admin-uid> (key on file \u2014 the same lane every signed governance offer uses), or the ROOT CUSTODIAN seed (--gcp-secret ${ROOT_CUSTODIAN_SECRET}; --seed-secret <b64> is break-glass, env NOMOS_ROOT_SEED the CI lane)`);
+      return 1;
+    }
   }
   const cloud = cloudBase(opts.cloud);
   const engMod = await Promise.resolve().then(() => (init_engine(), engine_exports));
@@ -3776,6 +3926,20 @@ async function rebirthWorkspace(ws, opts) {
     err2("refusing to rebirth root (the fixed point)");
     return 1;
   }
+  {
+    const planPosture = opts.plan?.posture;
+    let sovereignBlocked = false;
+    if (planPosture !== void 0) {
+      sovereignBlocked = planPosture.posture === "sovereign" && planPosture.consent === "absent";
+    } else {
+      const posture = await readPosture2(cloud, ws) ?? "managed";
+      if (posture === "sovereign") sovereignBlocked = (await readLiveConsent(cloud, ws)).length === 0;
+    }
+    if (sovereignBlocked) {
+      err2(`'${ws}' is SOVEREIGN \u2014 a rebirth needs the tenant's OWN consent first (no live RebirthConsent fact). The tenant grants it from their admin: githolon consent rebirth ${ws} --reason "\u2026" \u2014 then re-run this rebirth. (Operator restraint is law that replays here, not host policy.)`);
+      return 1;
+    }
+  }
   if (opts.quiet !== true) {
     try {
       const built = await buildRebirthPlan(cloud, ws, reason);
@@ -3810,7 +3974,19 @@ gov rebirth ${ws}:`);
     err2("could not resolve root's governance (workspaces) law hash from root currentLaw (pass --controller-hash)");
     return 1;
   }
-  const res = author2(eng, "root", "workspaces", "rebirthWorkspace", { workspaceId, reason, rebornAt }, controllerHash, { authorSecret: seed, actor: "user:root-custodian" });
+  const actorUid = opts.as;
+  let signSecret = seed;
+  let actor = "user:root-custodian";
+  if (typeof actorUid === "string" && actorUid.length > 0) {
+    const dk = getDeviceKey(actorUid);
+    if (dk === void 0) {
+      err2(`no signing key on file for --as ${actorUid} (githolon key import/enroll)`);
+      return 1;
+    }
+    signSecret = dk.secret;
+    actor = `user:${actorUid}`;
+  }
+  const res = author2(eng, "root", "workspaces", "rebirthWorkspace", { workspaceId, reason, rebornAt }, controllerHash, { authorSecret: signSecret, actor });
   if (res.ok === false) {
     err2(`rebirthWorkspace refused locally: ${res.error}`);
     return 1;
@@ -4095,13 +4271,14 @@ function readSealedIntentBytes(eng, ws, intentOut) {
   if (f?.data === void 0) return void 0;
   return Buffer.from(f.data).toString("base64");
 }
-var out2, err2, ROOT_CUSTODIAN_SECRET, CLIENT_IMPACT;
+var out2, err2, HONEST_CEILING, ROOT_CUSTODIAN_SECRET, CLIENT_IMPACT;
 var init_governance = __esm({
   "src/governance.ts"() {
     "use strict";
     init_cloud();
     out2 = (s) => void process.stdout.write(s + "\n");
     err2 = (s) => void process.stderr.write("error: " + s + "\n");
+    HONEST_CEILING = `The operator controls root's law and could deploy law removing the consent check \u2014 but that act is itself a signed, ordered, permanent fact in root's chain, visible to every tenant running \`replay root\`, and grounds for exit-with-everything. Not "we can't" \u2014 "we can't secretly, and you can always leave."`;
     ROOT_CUSTODIAN_SECRET = "nomos-root-custodian-key";
     CLIENT_IMPACT = "every connected client raises CustodyBreak(superseded); unsynced client work is invisible to the cloud \u2014 drain/sync clients first";
   }
@@ -8518,6 +8695,19 @@ async function status(wsArg, opts) {
     }
   } catch {
   }
+  try {
+    const { readPosture: readPosture3, readLiveConsent: readLiveConsent2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
+    const posture = await readPosture3(cloud, ws);
+    if (posture !== null) {
+      if (posture === "sovereign") {
+        const consents = await readLiveConsent2(cloud, ws);
+        out10(`posture    SOVEREIGN  (operator recovery verbs need tenant consent \u2014 ${consents.length} live consent fact(s))`);
+      } else {
+        out10(`posture    managed  (default \u2014 operator may run recovery verbs for the tenant)`);
+      }
+    }
+  } catch {
+  }
   const allDomains = d.domains ?? [];
   const frameworkHashes = new Set(FRAMEWORK_DOMAIN_KEYS.map((k) => d.currentLaw?.[k]).filter(Boolean));
   const domains = allDomains.filter((dm) => !frameworkHashes.has(dm.domainHash));
@@ -9196,6 +9386,7 @@ ${USAGE}`);
         ...opts,
         ...flag("--seed-secret") !== void 0 ? { seedSecret: flag("--seed-secret") } : {},
         ...flag("--gcp-secret") !== void 0 ? { gcpSecret: flag("--gcp-secret") } : {},
+        ...flag("--as") !== void 0 ? { as: flag("--as") } : {},
         ...flag("--controller-hash") !== void 0 ? { controllerHash: flag("--controller-hash") } : {},
         yes: argv.includes("--yes")
       });
@@ -9203,6 +9394,65 @@ ${USAGE}`);
     process.stderr.write("error: expected: githolon rebirth <plan <ws> | apply --plan <plan.json>>\n");
     return 1;
   }
+  if (argv[0] === "posture") {
+    const { pos, opts, bad } = cloudArgs(argv.slice(1));
+    if (bad !== void 0) {
+      process.stderr.write(`error: ${bad}
+
+${USAGE}`);
+      return 1;
+    }
+    const flag = (n) => {
+      const i = argv.indexOf(n);
+      return i >= 0 ? argv[i + 1] : void 0;
+    };
+    if (pos[0] === "set") {
+      const platform2 = pos[1];
+      const posture = pos[2];
+      if (platform2 === void 0 || posture === void 0) {
+        process.stderr.write("error: expected: githolon posture set <platform> <managed|sovereign> --reason <text>\n");
+        return 1;
+      }
+      const { postureSet: postureSet2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
+      return postureSet2(platform2, posture, { ...opts, ...flag("--reason") !== void 0 ? { reason: flag("--reason") } : {} });
+    }
+    const platform = pos[0];
+    if (platform === void 0) {
+      process.stderr.write("error: expected: githolon posture <platform> | githolon posture set <platform> <managed|sovereign> --reason <text>\n");
+      return 1;
+    }
+    const { postureShow: postureShow2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
+    return postureShow2(platform, opts);
+  }
+  if (argv[0] === "consent") {
+    const { pos, opts, bad } = cloudArgs(argv.slice(1));
+    if (bad !== void 0) {
+      process.stderr.write(`error: ${bad}
+
+${USAGE}`);
+      return 1;
+    }
+    const flag = (n) => {
+      const i = argv.indexOf(n);
+      return i >= 0 ? argv[i + 1] : void 0;
+    };
+    if (pos[0] === "rebirth") {
+      const ws = pos[1];
+      if (ws === void 0) {
+        process.stderr.write("error: expected: githolon consent rebirth <ws> --reason <text> [--expires-at <epoch-ms>]\n");
+        return 1;
+      }
+      const { consentRebirth: consentRebirth2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
+      const expiresRaw = flag("--expires-at");
+      return consentRebirth2(ws, {
+        ...opts,
+        ...flag("--reason") !== void 0 ? { reason: flag("--reason") } : {},
+        ...expiresRaw !== void 0 && Number.isFinite(Number(expiresRaw)) ? { expiresAt: Number(expiresRaw) } : {}
+      });
+    }
+    process.stderr.write("error: expected: githolon consent rebirth <ws> --reason <text>\n");
+    return 1;
+  }
   if (argv[0] === "gov") {
     const { governanceOffer: governanceOffer2, governanceRelay: governanceRelay2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
     const { pos, opts, bad } = cloudArgs(argv.slice(1));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.69.3",
+  "version": "0.70.0",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -29,8 +29,8 @@
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/client": "^0.69.3",
-    "@githolon/dsl": "^0.69.3",
+    "@githolon/client": "^0.70.0",
+    "@githolon/dsl": "^0.70.0",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {