githolon 0.91.0 → 0.93.0

package/dist/cli.mjs

@@ -4480,6 +4480,108 @@ var init_governance = __esm({
   }
 });
 
+// src/capabilities.ts
+var capabilities_exports = {};
+__export(capabilities_exports, {
+  INLINE_OFFER_CAP_CHARS: () => INLINE_OFFER_CAP_CHARS,
+  negotiateDeployRoute: () => negotiateDeployRoute,
+  openapiRoutesDirective: () => openapiRoutesDirective,
+  probeCloudCapabilities: () => probeCloudCapabilities,
+  probeKernelCapabilities: () => probeKernelCapabilities,
+  probeOfferLane: () => probeOfferLane,
+  probeStageLane: () => probeStageLane
+});
+async function probeStageLane(cloud, fetchImpl = fetch) {
+  try {
+    const r = await fetchImpl(`${cloud}/v2/stage/${ZERO_SHA}`, { method: "GET" });
+    const body = await r.json().catch(() => void 0);
+    return typeof body?.staged === "boolean";
+  } catch {
+    return void 0;
+  }
+}
+async function probeKernelCapabilities(cloud, fetchImpl = fetch) {
+  try {
+    const r = await fetchImpl(`${cloud.replace(/\/+$/, "")}/v1/runtime/capabilities`, { method: "GET" });
+    if (!r.ok) return void 0;
+    const body = await r.json().catch(() => void 0);
+    return body && typeof body === "object" ? body : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function openapiRoutesDirective(spec, domain, directiveId) {
+  const paths = spec?.paths ?? {};
+  const wantPath = `/${domain}/${directiveId}`;
+  const wantBare = `/${directiveId}`;
+  const wantOp = `${domain}__${directiveId}`;
+  for (const [p, ops] of Object.entries(paths)) {
+    if (p === wantPath || p === wantBare) return true;
+    for (const method of Object.values(ops ?? {})) {
+      if (method?.operationId === wantOp) return true;
+    }
+  }
+  return false;
+}
+async function probeOfferLane(cloud, ws, route, fetchImpl = fetch) {
+  try {
+    const r = await fetchImpl(`${cloud}/v2/workspaces/${ws}/openapi.json`, { method: "GET" });
+    if (!r.ok) return { served: false, routesTarget: void 0 };
+    const spec = await r.json().catch(() => void 0);
+    if (spec === void 0 || typeof spec !== "object") return { served: false, routesTarget: void 0 };
+    const served = true;
+    const routesTarget = route === void 0 ? void 0 : openapiRoutesDirective(spec, route.domain, route.directiveId);
+    return { served, routesTarget };
+  } catch {
+    return { served: void 0, routesTarget: void 0 };
+  }
+}
+async function probeCloudCapabilities(cloud, ws, route, fetchImpl = fetch) {
+  const [stage, offer] = await Promise.all([
+    probeStageLane(cloud, fetchImpl),
+    probeOfferLane(cloud, ws, route, fetchImpl)
+  ]);
+  return {
+    cloud,
+    stage,
+    offerLane: offer.served,
+    routesTarget: offer.routesTarget,
+    openDeploy: void 0
+    // the open /domains lane is universal in every worker/dev-server; not separately probed
+  };
+}
+function negotiateDeployRoute(caps, opts) {
+  if (opts.signed) {
+    if (caps.offerLane === false) {
+      return {
+        fail: `${caps.cloud} does not serve the SIGNED OFFER lane \u2014 POST /v2/workspaces/${opts.ws}/${opts.route.domain}/${opts.route.directiveId} is not routed (the workspace serves no self-describing OpenAPI, so this cloud has no gateway to route a signed offer). This is often a lightweight cloud (e.g. \`githolon cloud dev\`) without the offer gateway.
+  \u2192 deploy the OPEN (unsigned) lane instead (drop --as/--principal) if this workspace is unwarranted, or target a cloud that serves the offer gateway.`
+      };
+    }
+    if (caps.offerLane === true && caps.routesTarget === false) {
+      return {
+        fail: `${caps.cloud} serves the offer gateway for ${opts.ws}, but its OpenAPI does not name the route ${opts.route.domain}/${opts.route.directiveId} \u2014 the ${opts.route.domain} controller is not installed here, so a signed ${opts.route.directiveId} would 404.
+  \u2192 confirm the workspace is born and the controller is deployed, or deploy the OPEN lane (drop --as).`
+      };
+    }
+    if (opts.sealedSizeChars > INLINE_OFFER_CAP_CHARS && caps.stage === false) {
+      return {
+        fail: `this signed package is ~${Math.round(opts.sealedSizeChars / (1024 * 1024))} MiB sealed \u2014 over the ${INLINE_OFFER_CAP_CHARS / (1024 * 1024)} MiB inline offer cap \u2014 and ${caps.cloud} has no /v2/stage content-addressed lane to carry it.
+  \u2192 target a cloud that serves /v2/stage, or shrink the package (githolon compile --compact).`
+      };
+    }
+  }
+  return void 0;
+}
+var INLINE_OFFER_CAP_CHARS, ZERO_SHA;
+var init_capabilities = __esm({
+  "src/capabilities.ts"() {
+    "use strict";
+    INLINE_OFFER_CAP_CHARS = 8 * 1024 * 1024;
+    ZERO_SHA = "0".repeat(64);
+  }
+});
+
 // src/lifecycle.ts
 var lifecycle_exports = {};
 __export(lifecycle_exports, {
@@ -4791,97 +4893,6 @@ var init_lifecycle = __esm({
   }
 });
 
-// src/capabilities.ts
-var capabilities_exports = {};
-__export(capabilities_exports, {
-  INLINE_OFFER_CAP_CHARS: () => INLINE_OFFER_CAP_CHARS,
-  negotiateDeployRoute: () => negotiateDeployRoute,
-  openapiRoutesDirective: () => openapiRoutesDirective,
-  probeCloudCapabilities: () => probeCloudCapabilities,
-  probeOfferLane: () => probeOfferLane,
-  probeStageLane: () => probeStageLane
-});
-async function probeStageLane(cloud, fetchImpl = fetch) {
-  try {
-    const r = await fetchImpl(`${cloud}/v2/stage/${ZERO_SHA}`, { method: "GET" });
-    const body = await r.json().catch(() => void 0);
-    return typeof body?.staged === "boolean";
-  } catch {
-    return void 0;
-  }
-}
-function openapiRoutesDirective(spec, domain, directiveId) {
-  const paths = spec?.paths ?? {};
-  const wantPath = `/${domain}/${directiveId}`;
-  const wantBare = `/${directiveId}`;
-  const wantOp = `${domain}__${directiveId}`;
-  for (const [p, ops] of Object.entries(paths)) {
-    if (p === wantPath || p === wantBare) return true;
-    for (const method of Object.values(ops ?? {})) {
-      if (method?.operationId === wantOp) return true;
-    }
-  }
-  return false;
-}
-async function probeOfferLane(cloud, ws, route, fetchImpl = fetch) {
-  try {
-    const r = await fetchImpl(`${cloud}/v2/workspaces/${ws}/openapi.json`, { method: "GET" });
-    if (!r.ok) return { served: false, routesTarget: void 0 };
-    const spec = await r.json().catch(() => void 0);
-    if (spec === void 0 || typeof spec !== "object") return { served: false, routesTarget: void 0 };
-    const served = true;
-    const routesTarget = route === void 0 ? void 0 : openapiRoutesDirective(spec, route.domain, route.directiveId);
-    return { served, routesTarget };
-  } catch {
-    return { served: void 0, routesTarget: void 0 };
-  }
-}
-async function probeCloudCapabilities(cloud, ws, route, fetchImpl = fetch) {
-  const [stage, offer] = await Promise.all([
-    probeStageLane(cloud, fetchImpl),
-    probeOfferLane(cloud, ws, route, fetchImpl)
-  ]);
-  return {
-    cloud,
-    stage,
-    offerLane: offer.served,
-    routesTarget: offer.routesTarget,
-    openDeploy: void 0
-    // the open /domains lane is universal in every worker/dev-server; not separately probed
-  };
-}
-function negotiateDeployRoute(caps, opts) {
-  if (opts.signed) {
-    if (caps.offerLane === false) {
-      return {
-        fail: `${caps.cloud} does not serve the SIGNED OFFER lane \u2014 POST /v2/workspaces/${opts.ws}/${opts.route.domain}/${opts.route.directiveId} is not routed (the workspace serves no self-describing OpenAPI, so this cloud has no gateway to route a signed offer). This is often a lightweight cloud (e.g. \`githolon cloud dev\`) without the offer gateway.
-  \u2192 deploy the OPEN (unsigned) lane instead (drop --as/--principal) if this workspace is unwarranted, or target a cloud that serves the offer gateway.`
-      };
-    }
-    if (caps.offerLane === true && caps.routesTarget === false) {
-      return {
-        fail: `${caps.cloud} serves the offer gateway for ${opts.ws}, but its OpenAPI does not name the route ${opts.route.domain}/${opts.route.directiveId} \u2014 the ${opts.route.domain} controller is not installed here, so a signed ${opts.route.directiveId} would 404.
-  \u2192 confirm the workspace is born and the controller is deployed, or deploy the OPEN lane (drop --as).`
-      };
-    }
-    if (opts.sealedSizeChars > INLINE_OFFER_CAP_CHARS && caps.stage === false) {
-      return {
-        fail: `this signed package is ~${Math.round(opts.sealedSizeChars / (1024 * 1024))} MiB sealed \u2014 over the ${INLINE_OFFER_CAP_CHARS / (1024 * 1024)} MiB inline offer cap \u2014 and ${caps.cloud} has no /v2/stage content-addressed lane to carry it.
-  \u2192 target a cloud that serves /v2/stage, or shrink the package (githolon compile --compact).`
-      };
-    }
-  }
-  return void 0;
-}
-var INLINE_OFFER_CAP_CHARS, ZERO_SHA;
-var init_capabilities = __esm({
-  "src/capabilities.ts"() {
-    "use strict";
-    INLINE_OFFER_CAP_CHARS = 8 * 1024 * 1024;
-    ZERO_SHA = "0".repeat(64);
-  }
-});
-
 // src/cloud.ts
 var cloud_exports = {};
 __export(cloud_exports, {
@@ -5273,6 +5284,29 @@ async function deploy2(ws, opts) {
   const beforeLaw = await fetch(`${cloud}/v2/workspaces/${ws}/domains`).then((br) => br.json()).then((bd) => bd.ok === true ? bd : {}).catch(() => ({}));
   const before = beforeLaw.domains ?? [];
   const currentLaw2 = beforeLaw.currentLaw ?? {};
+  try {
+    const compat = JSON.parse(readFileSync5(file, "utf8")).nomosCompat;
+    const requires = compat?.requiresKernel ?? [];
+    if (requires.length > 0) {
+      const { probeKernelCapabilities: probeKernelCapabilities2 } = await Promise.resolve().then(() => (init_capabilities(), capabilities_exports));
+      const report = await probeKernelCapabilities2(cloud);
+      const kernel = report?.prod;
+      if (kernel?.features) {
+        const missing = requires.filter((f) => !kernel.features.includes(f));
+        if (missing.length > 0) {
+          const lawH = String(compat?.lawHash ?? "").slice(0, 8);
+          const kernH = String(kernel.hash ?? "").slice(0, 8);
+          err4(
+            `deploy '${ws}' REFUSED \u2014 release coherence: kernel ${kernH} lacks capability '${missing.join("', '")}' that law ${lawH} requires (the cloud runs a STALE kernel: ${kernel.note ?? kernel.version}).` + (missing.includes("compoundKeys") ? `
+  A compound-key query (\`.key(a, b, \u2026)\`) would be refused deep in a law fold ("query declares N index keys; the read router supports exactly one").` : "") + `
+  Point at a cloud whose kernel is coherent with this release, or upgrade the cloud's kernel.`
+          );
+          return 1;
+        }
+      }
+    }
+  } catch {
+  }
   const { readDeployBody: readDeployBody3, domainKeysOf: domainKeysOf2, packageHashOf: packageHashOf2, resolveDeployPlan: resolveDeployPlan2, describeDeployPlan: describeDeployPlan2 } = await Promise.resolve().then(() => (init_lifecycle(), lifecycle_exports));
   let plan;
   let targetHash;
@@ -5645,9 +5679,9 @@ function parseOfflineLegs(proofSource) {
   }
   const domain = dom[1];
   const autoStamped = [];
-  const stampLine = proofSource.split("\n").find((l) => l.includes("omitted \u2014 the client auto-stamps ISO now()"));
-  if (stampLine !== void 0) {
-    for (const m of stampLine.matchAll(/`(\w+)`/g)) autoStamped.push(m[1]);
+  const stampLine2 = proofSource.split("\n").find((l) => l.includes("omitted \u2014 the client auto-stamps ISO now()"));
+  if (stampLine2 !== void 0) {
+    for (const m of stampLine2.matchAll(/`(\w+)`/g)) autoStamped.push(m[1]);
   }
   let queryLeg;
   const q = proofSource.match(/local declared query (\w+):/);
@@ -6553,6 +6587,84 @@ var init_harness = __esm({
   }
 });
 
+// src/doctor.ts
+var doctor_exports = {};
+__export(doctor_exports, {
+  doctor: () => doctor
+});
+import { existsSync as existsSync14, readFileSync as readFileSync15 } from "node:fs";
+function readLocalCompat(cwd, file) {
+  try {
+    const path = discoverDeployJson(cwd, file);
+    if (!existsSync14(path)) return void 0;
+    const body = JSON.parse(readFileSync15(path, "utf8"));
+    return body.nomosCompat;
+  } catch {
+    return void 0;
+  }
+}
+function stampLine(label, stamp) {
+  if (!stamp) return `  ${label.padEnd(12)}: (not advertised)`;
+  const h = String(stamp.hash || "").slice(0, 12);
+  const caps = stamp.features?.length ? `[${stamp.features.join(", ")}]` : "[]";
+  const known = stamp.known ? "" : "  \u26A0 UNKNOWN to registry";
+  return `  ${label.padEnd(12)}: ${h}\u2026 ${stamp.version ?? ""}${known}
+                caps ${caps}`;
+}
+async function doctor(opts = {}) {
+  const cloud = cloudBase(opts.cloud);
+  const compat = readLocalCompat(process.cwd(), opts.file);
+  const report = await probeKernelCapabilities(cloud);
+  const out13 = [];
+  out13.push(`githolon doctor \u2014 release coherence`);
+  out13.push(`  cloud       : ${cloud}`);
+  out13.push(`  compiler    : @githolon/dsl ${compat?.generator?.dsl ?? "(no local build \u2014 run `githolon compile`)"}`);
+  out13.push(`  runner      : cloud expects bundle version ${report?.expectedBundleVersion ?? "(not advertised)"}`);
+  out13.push(stampLine("prod kernel", report?.prod));
+  out13.push(stampLine("test kernel", report?.testmint));
+  const requires = compat?.requiresKernel ?? [];
+  if (!compat) {
+    out13.push(``);
+    out13.push(`  \u26A0 no local build found \u2014 cannot check the law\u2194kernel fit. Run \`githolon compile\` first.`);
+    process.stdout.write(out13.join("\n") + "\n");
+    return report ? 0 : 1;
+  }
+  if (!report?.prod) {
+    out13.push(``);
+    out13.push(`  \u26A0 cloud advertises no kernel capabilities (older worker?) \u2014 coherence UNVERIFIABLE.`);
+    out13.push(`    law ${String(compat.lawHash).slice(0, 8)} requires: [${requires.join(", ") || "none"}]`);
+    process.stdout.write(out13.join("\n") + "\n");
+    return 0;
+  }
+  const feats = report.prod.features ?? [];
+  const missing = requires.filter((f) => !feats.includes(f));
+  out13.push(``);
+  const lawH = String(compat.lawHash || "").slice(0, 8);
+  const kernH = String(report.prod.hash || "").slice(0, 8);
+  if (requires.length === 0) {
+    out13.push(`  \u2713 COHERENT \u2014 law ${lawH} requires no special kernel capabilities.`);
+  } else if (missing.length === 0) {
+    out13.push(`  \u2713 COHERENT \u2014 kernel ${kernH} supports all capabilities law ${lawH} requires: [${requires.join(", ")}].`);
+  } else {
+    out13.push(`  \u2717 SKEW \u2014 kernel ${kernH} lacks capability '${missing.join("', '")}' that law ${lawH} requires.`);
+    out13.push(`    The cloud is running a STALE kernel (${report.prod.note ?? report.prod.version ?? "unknown build"}).`);
+    if (missing.includes("compoundKeys")) {
+      out13.push(`    A compound-key query (\`.key(a, b, \u2026)\`) will be refused deep in a law fold with`);
+      out13.push(`    "query declares N index keys; the read router supports exactly one".`);
+    }
+    out13.push(`    Point at a cloud whose kernel is coherent with this release, or upgrade the cloud's kernel.`);
+  }
+  process.stdout.write(out13.join("\n") + "\n");
+  return missing.length > 0 ? 1 : 0;
+}
+var init_doctor = __esm({
+  "src/doctor.ts"() {
+    "use strict";
+    init_cloud();
+    init_capabilities();
+  }
+});
+
 // src/scene_projector.ts
 import { createHash as createHash4 } from "node:crypto";
 function fnv1a32(s) {
@@ -7609,7 +7721,7 @@ var scene_exports = {};
 __export(scene_exports, {
   scene: () => scene
 });
-import { existsSync as existsSync14, mkdirSync as mkdirSync6, writeFileSync as writeFileSync9 } from "node:fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync6, writeFileSync as writeFileSync9 } from "node:fs";
 import { join as join16, resolve as resolve4 } from "node:path";
 import { createHash as createHash5 } from "node:crypto";
 import git3 from "isomorphic-git";
@@ -7631,8 +7743,8 @@ async function projectOnce(cloud, target, isDir, name) {
   const { eng } = await holonEngine(cloud, void 0, "githolon-scene");
   const SOURCE3 = "source";
   if (isDir) {
-    const gitDir = existsSync14(join16(target, ".git")) ? join16(target, ".git") : target;
-    if (!existsSync14(join16(gitDir, "HEAD"))) throw new Error(`${target} is not a git repo (no HEAD)`);
+    const gitDir = existsSync15(join16(target, ".git")) ? join16(target, ".git") : target;
+    if (!existsSync15(join16(gitDir, "HEAD"))) throw new Error(`${target} is not a git repo (no HEAD)`);
     await mountFresh(eng, SOURCE3);
     eng.preopen.dir.contents.get("ws").contents.get(SOURCE3).contents.set("nomos.git", readTreeFromDisk(gitDir));
   } else {
@@ -7691,7 +7803,7 @@ async function projectOnce(cloud, target, isDir, name) {
 }
 async function scene(target, opts) {
   const cloud = cloudBase(opts.cloud);
-  const isDir = existsSync14(target) || target.includes("/") || target.startsWith(".");
+  const isDir = existsSync15(target) || target.includes("/") || target.startsWith(".");
   const name = isDir ? (resolve4(target).split("/").filter(Boolean).pop() ?? "scene").replace(/\.git$/, "") : target;
   out11(`scene \u2014 ${name} (${isDir ? resolve4(target) : `${cloud} :: ${target}`})`);
   let first, second;
@@ -7802,7 +7914,7 @@ var init_dlq = __esm({
 });
 
 // src/cli.ts
-import { existsSync as existsSync15, readdirSync as readdirSync6, readFileSync as readFileSync15 } from "node:fs";
+import { existsSync as existsSync16, readdirSync as readdirSync6, readFileSync as readFileSync16 } from "node:fs";
 import { spawnSync as spawnSync6 } from "node:child_process";
 import { createRequire as createRequire3 } from "node:module";
 import { dirname as dirname9, join as join17, resolve as resolve5 } from "node:path";
@@ -9436,10 +9548,10 @@ async function runProof(args) {
   let proofPath;
   if (explicit !== void 0) {
     proofPath = resolve5(process.cwd(), explicit);
-    if (!existsSync15(proofPath)) return refuse(`proof not found: ${proofPath} \u2014 run \`githolon compile\` to (re)generate it`);
+    if (!existsSync16(proofPath)) return refuse(`proof not found: ${proofPath} \u2014 run \`githolon compile\` to (re)generate it`);
   } else {
     const buildDir = join17(process.cwd(), "build");
-    if (!existsSync15(buildDir)) {
+    if (!existsSync16(buildDir)) {
       return refuse("no build/ directory here \u2014 run `githolon compile` first (every compile generates build/<name>.proof.mts from your law)");
     }
     const proofs = readdirSync6(buildDir).filter((f) => f.endsWith(".proof.mts"));
@@ -9482,7 +9594,7 @@ async function runProof(args) {
   if (tsxDir === void 0) {
     return refuse("tsx not found \u2014 add @githolon/dsl to your project's dependencies (tsx rides along) and npm install");
   }
-  const tsxPkg = JSON.parse(readFileSync15(join17(tsxDir, "package.json"), "utf8"));
+  const tsxPkg = JSON.parse(readFileSync16(join17(tsxDir, "package.json"), "utf8"));
   const tsxBinRel = typeof tsxPkg.bin === "string" ? tsxPkg.bin : tsxPkg.bin?.["tsx"];
   const tsxCli = join17(tsxDir, tsxBinRel ?? "dist/cli.mjs");
   console.log("githolon proof --live \u2014 the full cloud loop (throwaway workspace, retired on exit" + (keep ? "; --keep: kept" : "") + ")");
@@ -9687,6 +9799,17 @@ ${commandHelp("dev")}`);
       ...once ? { once: true } : {}
     });
   }
+  if (argv[0] === "doctor") {
+    const rest = argv.slice(1);
+    let cloudFlag;
+    let fileFlag;
+    for (let i = 0; i < rest.length; i++) {
+      if (rest[i] === "--cloud") cloudFlag = rest[++i];
+      else if (rest[i] === "--file") fileFlag = rest[++i];
+    }
+    const { doctor: doctor2 } = await Promise.resolve().then(() => (init_doctor(), doctor_exports));
+    return doctor2({ ...cloudFlag !== void 0 ? { cloud: cloudFlag } : {}, ...fileFlag !== void 0 ? { file: fileFlag } : {} });
+  }
   if (argv[0] === "cloud") {
     const sub2 = argv[1];
     if (sub2 !== "dev") {
@@ -9707,7 +9830,7 @@ usage: githolon cloud dev [--port <n>] [--data <dir>] [--ephemeral]
       resolve5(here, "../../../cloud/dev-server/server.mjs"),
       resolve5(process.cwd(), "cloud/dev-server/server.mjs")
     ];
-    const serverPath = candidates.find((p) => existsSync15(p));
+    const serverPath = candidates.find((p) => existsSync16(p));
     if (!serverPath) {
       process.stderr.write("error: dev-server not found \u2014 reinstall `githolon` or run `npm run build` in the cli package\n");
       return 1;

package/dist/dev-server.mjs

@@ -1411,7 +1411,7 @@ async function ledgerStats(eng, ws, ledger = null) {
   if (mounted) mounted.ledgerStats = out;
   return out;
 }
-var enc3, dec3, BRANCH, RESULT_PACK_INLINE_MAX, repoArgOf, gitdirOf, unpack, log, repoArgOfGitdir, bytesFromB64, kgit, installPayload, routeTagHexOfHomeKey, SUMMARY_SEP, summaryKey, splitSummaryKey, NOMOS_SHARD_ROWS_READ, groupOf, tallyOf, isExtremumRead, extremumMonotone, pushVia, fullRef, applyPackInto, custodyLsRefs, qById, query, authorKeygen, attestedRead, count, sum, pendingConflicts, spatialBboxParams, spatialWithin, extremum, nomosActive, refusedRefName;
+var enc3, dec3, BRANCH, RESULT_PACK_INLINE_MAX, repoArgOf, gitdirOf, unpack, log, repoArgOfGitdir, bytesFromB64, kgit, installPayload, routeTagHexOfHomeKey, SUMMARY_SEP, summaryKey, splitSummaryKey, NOMOS_SHARD_ROWS_READ, groupOf, tallyOf, isExtremumRead, extremumMonotone, pushVia, fullRef, applyPackInto, custodyLsRefs, qById, query, authorKeygen, attestedRead, certSign, count, sum, pendingConflicts, spatialBboxParams, spatialWithin, extremum, nomosActive, refusedRefName;
 var init_engine = __esm({
   "../adapter/engine.mjs"() {
     init_git_fs();
@@ -1494,6 +1494,7 @@ var init_engine = __esm({
       branch: BRANCH,
       queryBytes: b64Json({ op: "attestedRead", queryId, paramsJson: paramsJson || "{}", attestorSecret, nowMs: nowMs ?? Date.now(), sourceWorkspace: ws, ...includeRosterProof ? { includeRosterProof: true } : {} })
     }, eng.STDERR));
+    certSign = (eng, { child, founder, verified, parentKey, parentId, epoch, secret }) => JSON.parse(call(eng.ex, "query", { queryBytes: b64Json({ op: "certSign", child, founder, verified, parentKey, parentId, epoch, secret }) }, eng.STDERR)).cert;
     count = (eng, ws, countId, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "count", countId, groupKey }), principal, branch: BRANCH }, eng.STDERR));
     sum = (eng, ws, sumId, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "sum", sumId, groupKey }), principal, branch: BRANCH }, eng.STDERR));
     pendingConflicts = (eng, ws, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "pendingConflicts" }), principal, branch: BRANCH }, eng.STDERR));
@@ -1512,6 +1513,7 @@ var init_engine = __esm({
 var bootstrap_exports = {};
 __export(bootstrap_exports, {
   bootstrapPlatform: () => bootstrapPlatform,
+  homeDomainOf: () => homeDomainOf,
   isTestMint: () => isTestMint
 });
 import { readFileSync } from "node:fs";
@@ -1523,6 +1525,17 @@ function isTestMint(eng) {
     return !/poisoned|unknown|adapter-visible API/.test(String(e && e.message || e));
   }
 }
+function homeDomainOf(opts) {
+  if (!opts || !opts.deploy) return null;
+  try {
+    const body = JSON.parse(readFileSync(opts.deploy, "utf8"));
+    const domains = body.summary && body.summary.domains || [];
+    const hit = domains.find((d) => Array.isArray(d.directives) && d.directives.includes("seedBirthAttestation"));
+    return hit ? hit.domain : null;
+  } catch {
+    return null;
+  }
+}
 async function bootstrapPlatform(dev, opts) {
   const { eng, custody, ledgerFor, serialize, origin } = dev;
   const platform = opts.platform || "co2-platform-local";
@@ -1535,20 +1548,23 @@ async function bootstrapPlatform(dev, opts) {
   if (opts.deploy) {
     const body = JSON.parse(readFileSync(opts.deploy, "utf8"));
     const usda = body.packageUsda || body.usda;
-    if (!usda) {
-      log2(`WARN --deploy ${opts.deploy} has no packageUsda; skipping law deploy`);
-    } else {
-      await serialize(async () => {
-        const ledger = ledgerFor(platform);
-        const domainHash = await sha256hex(usda);
-        try {
-          const out = await deploy(eng, platform, ledger, usda, domainHash, body.dispositions || null, { actor: "user:dev-admin" });
-          log2(`platform law deployed: ${domainHash.slice(0, 12)} (head ${String(out.head).slice(0, 12)})`);
-        } catch (e) {
-          log2(`WARN platform law deploy refused: ${String(e && e.message || e).slice(0, 200)}`);
+    if (!usda) throw new Error(`--deploy ${opts.deploy} has no packageUsda (nothing to install)`);
+    let deployErr = null;
+    await serialize(async () => {
+      const ledger = ledgerFor(platform);
+      const domainHash = await sha256hex(usda);
+      try {
+        const out = await deploy(eng, platform, ledger, usda, domainHash, body.dispositions || null, { actor: "user:dev-admin" });
+        if (out && out.ok === false) {
+          deployErr = String(out.error || "the law refused the platform package");
+          return;
         }
-      });
-    }
+        log2(`platform law deployed: ${domainHash.slice(0, 12)} (head ${String(out.head).slice(0, 12)})`);
+      } catch (e) {
+        deployErr = String(e && e.message || e);
+      }
+    });
+    if (deployErr) throw new Error(`platform law deploy REFUSED: ${deployErr.slice(0, 400)}`);
   } else {
     log2("no --deploy given; platform runs framework law only (deploy your platform package to enable births)");
   }
@@ -1559,18 +1575,71 @@ async function bootstrapPlatform(dev, opts) {
     log2("  \u2192 re-run:     NOMOS_LOCAL_WASM=<that.wasm> githolon cloud dev --platform " + platform + " --bootstrap");
     log2("  Without it the platform cannot roots-at-K_root-attest home births (LEG rejected by design).");
   } else {
+    const OPERATOR = opts.operator || "user:dev-operator";
     const kRoot = authorKeygen(eng);
     setTestKRoot(eng, kRoot.public);
     log2(`K_root ceremony: pinned LOCAL test K_root ${kRoot.public.slice(0, 16)}\u2026`);
-    log2("  (deliver signed DelegationCerts via the platform's grant directives; see home_delegated_estate.smoke.mjs)");
-    dev.testKRoot = kRoot;
+    const sP = authorKeygen(eng);
+    const platformCert = certSign(eng, {
+      child: platform,
+      founder: OPERATOR,
+      verified: true,
+      parentKey: sP.public,
+      // P_P — the onboarding signer the platform vouches for
+      parentId: "root",
+      epoch: 0,
+      secret: kRoot.secret
+      // signed by S_root
+    });
+    const certChain = JSON.stringify({ links: [platformCert] });
+    const homeDomain = homeDomainOf(opts) || "home";
+    const lawKeys = await serialize(async () => {
+      await mountWorkspace(eng, platform, ledgerFor(platform));
+      return currentLaw(eng, platform);
+    });
+    const lawHash = (lawKeys || {})[homeDomain] || "";
+    if (!lawHash) {
+      log2(`ATTESTED BIRTHS: the deployed platform law declares no '${homeDomain}' framework domain`);
+      log2("  (seedBirthAttestation/birthHome absent) \u2014 attested home births are not available on this platform.");
+      dev.testKRoot = kRoot;
+      dev.onboardingSigner = sP;
+    } else {
+      const seed = await serialize(async () => authorOn(
+        eng,
+        platform,
+        ledgerFor(platform),
+        homeDomain,
+        "seedBirthAttestation",
+        {
+          child: platform,
+          founder: OPERATOR,
+          verified: "true",
+          parentId: "root",
+          parentKey: sP.public,
+          epoch: 0,
+          certChain
+        },
+        lawHash,
+        { actor: OPERATOR, principalVerified: true }
+      ));
+      if (!seed.ok) throw new Error(`platform BirthAttestation seed REFUSED: ${String(seed.error).slice(0, 400)}`);
+      log2(`root-attested platform: seeded BirthAttestation certChain (platform_cert signed by K_root, P_P=${sP.public.slice(0, 12)}\u2026)`);
+      log2("  a birthHome under this platform now assembles [home_cert, u_delegation(S_P), platform_cert(K_root)] \u2014 no unwarranted-cert.");
+      log2("  ENROLL each user at your app's enroll gate: home/enrollSigner(device key) + home/enrollDelegation(S_P-signed cert).");
+      dev.testKRoot = kRoot;
+      dev.onboardingSigner = sP;
+      dev.platformCert = platformCert;
+      dev.platformBirthAttestation = { child: platform, parentKey: sP.public, certChain };
+      dev.homeDomain = homeDomain;
+    }
   }
   if (opts.authProvider || opts.firebaseProject) {
     log2(`AuthProvider: ${opts.authProvider || `firebase:${opts.firebaseProject}`} \u2014 register it via the platform's setAuthProvider governance offer;`);
     log2("  the kernel verifies x-nomos-auth JWTs against the law-declared key (host stays blind).");
   }
-  log2("bootstrap complete (verifiable local legs done; attested-birth + Firebase legs gated as noted above).");
-  return { platform, testMint };
+  const attested = testMint && !!dev.platformBirthAttestation;
+  log2(attested ? "bootstrap complete \u2014 platform law deployed + ROOT-ATTESTED (BirthAttestation certChain seeded; birthHome assembles a valid travelling cert)." : "bootstrap complete (platform law deployed; attested-birth legs gated as noted above \u2014 need the test-mint wasm).");
+  return { platform, testMint, attested };
 }
 var log2;
 var init_bootstrap = __esm({
@@ -1839,6 +1908,31 @@ function firstExisting(...paths) {
 }
 var TEST_MINT_MARKER = Buffer.from("set_test_k_root");
 var isTestMintBytes = (bytes) => bytes.includes(TEST_MINT_MARKER);
+var KERNEL_CAPABILITY_REGISTRY = [
+  {
+    prefix: "846c6bf8",
+    version: "kernel-846c6bf8",
+    note: "production (accepts compound-key law)",
+    features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads"]
+  },
+  {
+    prefix: "f6e44b3a",
+    version: "kernel-f6e44b3a",
+    note: "test-mint (DEV) \u2014 current, feature-equivalent to production",
+    features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads"]
+  },
+  {
+    prefix: "f81cb952",
+    version: "kernel-f81cb952",
+    note: "test-mint (DEV ONLY \u2014 STALE: predates compound-key read router; superseded by f6e44b3a)",
+    features: ["capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads"]
+  }
+];
+function capabilitiesForKernelHash(hash) {
+  const h = String(hash || "").toLowerCase();
+  const hit = KERNEL_CAPABILITY_REGISTRY.find((e) => h.startsWith(e.prefix) || e.prefix.startsWith(h.slice(0, 8)));
+  return hit ? { hash: h, version: hit.version, note: hit.note, features: hit.features, known: true } : { hash: h, version: null, note: "UNKNOWN kernel \u2014 not in the capability registry", features: [], known: false };
+}
 var DEFAULT_KERNEL_SOURCE = "https://nomos.captainapp.co.uk";
 async function resolveTestMintWasm(kernelSource) {
   const runtimeCache = path.join(configDir(), "runtime");
@@ -2049,6 +2143,18 @@ async function startDevCloud(opts = {}) {
         res.writeHead(200, { ...CORS, "content-type": "application/wasm", "cache-control": "no-store", "x-nomos-kernel": kernelKind, "x-nomos-kernel-sha": kernelSha });
         return res.end(Buffer.from(wasmBytes));
       }
+      if (url.pathname === "/v1/runtime/capabilities") {
+        const stamp = capabilitiesForKernelHash(kernelSha);
+        return sendJson(res, {
+          ok: true,
+          prod: stamp,
+          // the dev cloud serves ONE kernel; it is what holon.wasm returns
+          testmint: kernelKind === "test-mint" ? stamp : null,
+          kernelKind,
+          expectedBundleVersion: 1,
+          vocabulary: KERNEL_CAPABILITY_REGISTRY.flatMap((e) => e.features).filter((f, i, a) => a.indexOf(f) === i).sort()
+        });
+      }
       if (url.pathname === "/v1/runtime/packages") {
         return sendJson(res, { bootstrap: bootstrapPkg, nomos: nomosPkg });
       }
@@ -2469,10 +2575,30 @@ if (import.meta.url === `file://${process.argv[1]}`) {
   console.log(`[dev-cloud] Nomos dev cloud listening on ${dev.origin}`);
   console.log(`[dev-cloud]   data dir : ${dev.dataDir}`);
   console.log(`[dev-cloud]   kernel   : ${dev.kernelSha.slice(0, 16)}\u2026`);
+  {
+    const stamp = capabilitiesForKernelHash(dev.kernelSha);
+    if (stamp.known) {
+      console.log(`[dev-cloud]   caps     : ${stamp.version} \u2014 [${stamp.features.join(", ")}]`);
+      if (/STALE/.test(stamp.note || "")) {
+        console.log(`[dev-cloud]   \u26A0 STALE KERNEL: ${stamp.note}. Law using compound-key queries will be REFUSED here.`);
+        console.log(`[dev-cloud]     Update the dev kernel (holon-testmint.wasm) to a build coherent with your compiler/release.`);
+      }
+    } else {
+      console.log(`[dev-cloud]   \u26A0 caps  : kernel ${dev.kernelSha.slice(0, 8)} is UNKNOWN to the capability registry \u2014 coherence cannot be verified.`);
+    }
+    console.log(`[dev-cloud]   coherence: GET ${dev.origin}/v1/runtime/capabilities`);
+  }
   console.log(`[dev-cloud]   point your Flutter app's cloud: base URL at ${dev.origin}`);
   if (opts.bootstrap || opts.platform) {
     const { bootstrapPlatform: bootstrapPlatform2 } = await Promise.resolve().then(() => (init_bootstrap(), bootstrap_exports));
-    await bootstrapPlatform2(dev, opts).catch((e) => console.error("[dev-cloud] bootstrap failed:", e));
+    try {
+      await bootstrapPlatform2(dev, opts);
+    } catch (e) {
+      console.error("[dev-cloud] bootstrap FAILED:", String(e && e.message || e));
+      await dev.close().catch(() => {
+      });
+      process.exit(1);
+    }
   }
   process.on("SIGINT", async () => {
     await dev.close();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.91.0",
+  "version": "0.93.0",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -29,8 +29,8 @@
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/client": "^0.91.0",
-    "@githolon/dsl": "^0.91.0",
+    "@githolon/client": "^0.93.0",
+    "@githolon/dsl": "^0.93.0",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {