githolon 0.95.2 → 0.97.0

package/dist/cli.mjs

@@ -387,6 +387,7 @@ __export(engine_exports, {
   ingestPackAsCustody: () => ingestPackAsCustody,
   installPayload: () => installPayload,
   installedLaw: () => installedLaw,
+  isWarranted: () => isWarranted,
   kgit: () => kgit,
   lawParity: () => lawParity,
   ledgerStats: () => ledgerStats,
@@ -1256,7 +1257,7 @@ async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null,
   }
   log("admit-intent-offers", { ws, sessions: sessions.size, admitted: admittedTotal, rejected: [...sessions.values()].reduce((n, s) => n + s.rejected.length, 0), resultPack: resultPackB64 ? "inline" : "none" });
   const bornPacked = born.length ? packBornChildren(eng, born) : born;
-  return { sessions: [...sessions.values()].map((s) => ({ ...s, ...s.skipped.length ? {} : { skipped: void 0 } })), main: head, deadLetters, timings, ...summary ? { summary } : {}, ...bornPacked.length ? { born: bornPacked } : {}, ...birthOutcomes.length ? { birthOutcomes } : {}, ...resultPackB64 ? { resultPackB64, resultBase: clientBase } : {}, ...deferDurability && admittedTotal && head ? { deferred: true, head } : {} };
+  return { sessions: [...sessions.values()].map((s) => ({ ...s, ...s.skipped.length ? {} : { skipped: void 0 } })), main: head, deadLetters, timings, summary: summary ?? null, born: bornPacked, birthOutcomes, ...resultPackB64 ? { resultPackB64, resultBase: clientBase } : {}, ...deferDurability && admittedTotal && head ? { deferred: true, head } : {} };
 }
 async function checkpointStateHash(eng, ws) {
   const rows = query(eng, ws, "aggregatesByType", JSON.stringify({ __type: "NomosSummarySubtotal" }));
@@ -1277,7 +1278,7 @@ async function authorOn(eng, ws, ledger, domain, directiveId, payload, lawHash,
   if (res && res.ok === false) return { ok: false, error: String(res.error || "the law refused this intent").slice(0, 500) };
   await commitAndPush(eng, ws, ledger);
   const bornPacked = Array.isArray(res.born) && res.born.length ? packBornChildren(eng, res.born) : res.born;
-  return { ok: true, head: res.head, ...bornPacked ? { born: bornPacked } : {}, ...res.birthOutcomes ? { birthOutcomes: res.birthOutcomes } : {} };
+  return { ok: true, head: res.head, born: bornPacked ?? [], birthOutcomes: res.birthOutcomes ?? [] };
 }
 async function deepVerifyShard(eng, shardWs, shardLedger, coordinatorRows) {
   const replay2 = await verifyChain(eng, shardWs, shardLedger);
@@ -1452,7 +1453,7 @@ function author(eng, ws, domain, directiveId, payload, controllerHash, opts = {}
     writeWork(eng, `envelope-${seq}.json`, enc3.encode(stringifyBig(envelope)));
     v = offerOnce();
   }
-  const res = v.outcome === "admitted" ? { ok: true, head: v.head, intentOut: v.intentOut, ...v.born ? { born: v.born } : {}, ...v.birthOutcomes ? { birthOutcomes: v.birthOutcomes } : {}, ...v.kernelSpans ? { kernelSpans: v.kernelSpans } : {} } : v.outcome === "refused" ? { ok: false, error: v.verdict?.reason ?? v.error } : v;
+  const res = v.outcome === "admitted" ? { ok: true, head: v.head, intentOut: v.intentOut, born: v.born ?? [], birthOutcomes: v.birthOutcomes ?? [], ...v.kernelSpans ? { kernelSpans: v.kernelSpans } : {} } : v.outcome === "refused" ? { ok: false, error: v.verdict?.reason ?? v.error } : v;
   if (defer && res.ok) (eng.pendingProjection ??= /* @__PURE__ */ new Set()).add(ws);
   return res;
 }
@@ -2513,11 +2514,16 @@ async function emitOutbox(eng, ws, ledger) {
 async function boot(eng, ws, ledger) {
   const m = await mountWorkspace(eng, ws, ledger);
   if (nomosActive(eng, ws)) {
-    return { status: "already-initialized", controllerHash: eng.hashes.nomos, rows: qById(eng, ws, `domain-installation:${eng.hashes.nomos}`), mount: m };
+    if (ws !== "root" && !isWarranted(eng, ws)) {
+      throw new Error(
+        `unwarranted-workspace: '${ws}' is booted but its genesis never landed a GenesisWarrant \u2014 an era-0 workspace is born ONLY by its parent's warranted+attested birth. This is a host-authored/legacy orphan and will not serve (author its birth on its parent to bring it into the holarchy lawfully).`
+      );
+    }
+    return { status: "already-initialized", head: m.remoteMain ?? void 0, controllerHash: eng.hashes.nomos, rows: qById(eng, ws, `domain-installation:${eng.hashes.nomos}`), mount: m };
   }
-  const result = author(eng, ws, "bootstrap", "installDomain", installPayload(eng.hashes.nomos, eng.nomosPkg, eng.installedBy), "");
-  await commitAndPush(eng, ws, ledger);
-  return { status: "created", head: result.head, controllerHash: eng.hashes.nomos, rows: qById(eng, ws, `domain-installation:${eng.hashes.nomos}`), mount: m };
+  throw new Error(
+    `unborn-workspace: '${ws}' has no genesis and the host does not create workspaces \u2014 author its birth on its PARENT (birthChild/birthHome/an estate .births()); the parent's offer-effect materializes it in custody, then it serves from here. (root self-adopts via _ensureRootGenesis; this is not that path.)`
+  );
 }
 async function deploy(eng, ws, ledger, usda, domainHash, dispositions, opts = {}) {
   const result = author(eng, ws, "nomos", "installDomain", installPayload(domainHash, usda, eng.installedBy, dispositions), eng.hashes.nomos, { actor: opts.actor ?? "", ...opts.authToken ? { authToken: opts.authToken } : {} });
@@ -2634,7 +2640,7 @@ function sealAttestationBatches(eng, ws, domain, controllerHash, opts = {}) {
   }
   return outcomes;
 }
-var enc3, dec3, BRANCH, RESULT_PACK_INLINE_MAX, dirOf, repoArgOf, gitdirOf, unpack, log, repoArgOfGitdir, bytesFromB64, kgit, installPayload, routeTagHexOfHomeKey, SUMMARY_SEP, summaryKey, splitSummaryKey, NOMOS_SHARD_ROWS_READ, groupOf, tallyOf, isExtremumRead, extremumMonotone, CKPT_REF, pushVia, fullRef, applyPackInto, custodyLsRefs, qById, query, check, expand, cryptoSealField, cryptoKeygen, authorKeygen, eraCertSign, delegationCertSign, attestationSign, attestedRead, certSign, cryptoWrapKey, cryptoUnwrapKey, readPosture, count, sum, pendingConflicts, spatialBboxParams, spatialWithin, extremum, nomosActive, refusedRefName, outboxRefName, projectionStats;
+var enc3, dec3, BRANCH, RESULT_PACK_INLINE_MAX, dirOf, repoArgOf, gitdirOf, unpack, log, repoArgOfGitdir, bytesFromB64, kgit, installPayload, routeTagHexOfHomeKey, SUMMARY_SEP, summaryKey, splitSummaryKey, NOMOS_SHARD_ROWS_READ, groupOf, tallyOf, isExtremumRead, extremumMonotone, CKPT_REF, pushVia, fullRef, applyPackInto, custodyLsRefs, qById, query, check, expand, cryptoSealField, cryptoKeygen, authorKeygen, eraCertSign, delegationCertSign, attestationSign, attestedRead, certSign, cryptoWrapKey, cryptoUnwrapKey, readPosture, count, sum, pendingConflicts, spatialBboxParams, spatialWithin, extremum, nomosActive, refusedRefName, outboxRefName, GENESIS_WARRANT_ID, isWarranted, projectionStats;
 var init_engine = __esm({
   "vendor/engine/engine.ts"() {
     "use strict";
@@ -2773,6 +2779,8 @@ var init_engine = __esm({
     nomosActive = (eng, ws) => qById(eng, ws, `domain-installation:${eng.hashes.nomos}`).length > 0;
     refusedRefName = (offerId) => `refs/heads/refused/${String(offerId || "unknown").replace(/[^A-Za-z0-9._-]/g, "_")}`;
     outboxRefName = (requestId) => `refs/heads/outbox/${String(requestId || "unknown").replace(/[^A-Za-z0-9._-]/g, "_")}`;
+    GENESIS_WARRANT_ID = "genesis-warrant:self";
+    isWarranted = (eng, ws) => qById(eng, ws, GENESIS_WARRANT_ID).length > 0;
     projectionStats = (eng, ws) => JSON.parse(call(eng.ex, "query", ws ? { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "projectionStats" }), branch: BRANCH } : { queryBytes: b64Json({ op: "projectionStats" }) }, eng.STDERR));
   }
 });
@@ -5213,6 +5221,16 @@ async function wsCreate(name, opts) {
   });
   const d = await r.json().catch(() => void 0);
   if (!r.ok || d?.ok !== true) {
+    if (r.status === 409 || /unborn|does not create|author its birth/i.test(d?.error ?? "")) {
+      err4(
+        `'${name}' cannot be created directly \u2014 in era-0 the host does not create workspaces; a workspace is
+  born only by its PARENT authoring its birth (orphanless holarchy). Today:
+    \u2022 deploy your law to a platform you own and birth homes under it (birthHome), or
+    \u2022 request a child under a platform: githolon ws create ${name} --via <platform>
+  (self-serve keyless birth-under-root \u2014 the direct replacement for this flat command \u2014 is in flight.)`
+      );
+      return 1;
+    }
     err4(`create '${name}' refused (${r.status}): ${d ? JSON.stringify(d) : "no body"}`);
     return 1;
   }
@@ -5695,6 +5713,7 @@ __export(proof_offline_exports, {
   runRelationBootstrapLeg: () => runRelationBootstrapLeg
 });
 import { existsSync as existsSync7, readFileSync as readFileSync7 } from "node:fs";
+import { createHash as createHash4 } from "node:crypto";
 import { basename, dirname as dirname6, join as join9 } from "node:path";
 function parseOfflineLegs(proofSource) {
   if (!proofSource.includes("AUTO-GENERATED by nomos-compile")) {
@@ -5827,7 +5846,7 @@ async function runOfflineLegs(eng, ws, lawHash, legs, frameworkHash, deployUsda)
   const rbLegs = legs.relationBootstraps ?? (legs.relationBootstrap !== void 0 ? [legs.relationBootstrap] : []);
   for (const rbLeg of rbLegs) {
     let rbWs = ws;
-    if (rbLeg.bornContext === void 0 && deployUsda !== void 0) {
+    if (deployUsda !== void 0) {
       rbWs = await mountIsolatedProofWs(eng, ws, lawHash, deployUsda);
     }
     const v = runRelationBootstrapLeg(eng, rbWs, lawHash, rbLeg);
@@ -5839,6 +5858,56 @@ async function runOfflineLegs(eng, ws, lawHash, legs, frameworkHash, deployUsda)
   }
   return done(true, lines);
 }
+function warrantParentForBirth(eng, parentWs, parentDomain, lawHash, genesisOwner, birthActor, dev2, stamp) {
+  const authorFrameworkAs = (directiveId, payload, actor) => {
+    for (const dom of [parentDomain, "nomos"]) {
+      const r = author(eng, parentWs, dom, directiveId, payload, lawHash, { actor });
+      if (r.ok !== false || !/no directive registered/.test(r.error ?? "")) return r;
+    }
+    return { ok: false, error: `no directive registered for '${directiveId}' under '${parentDomain}' or 'nomos'` };
+  };
+  for (const principal of birthActor === genesisOwner ? [genesisOwner] : [genesisOwner, birthActor]) {
+    const en = authorFrameworkAs("enrollSigner", { keyHash: keyHashOf(dev2.public), grantedBy: principal, grantedAt: 1 }, principal);
+    if (en.ok === false && !/already|create-once|enrolled/i.test(en.error ?? "")) return { ok: false, error: `enrollSigner(${principal}) refused: ${en.error}` };
+  }
+  const cert = certSign(eng, { child: parentWs, founder: genesisOwner, verified: false, parentKey: dev2.public, parentId: parentWs, epoch: 0, secret: dev2.secret });
+  const sba = authorFrameworkAs("seedBirthAttestation", {
+    child: parentWs,
+    founder: genesisOwner,
+    verified: "false",
+    parentId: parentWs,
+    parentKey: dev2.public,
+    epoch: 0,
+    certChain: JSON.stringify({ links: [cert] })
+  }, genesisOwner);
+  if (sba.ok === false && !/already|create-once|attest/i.test(sba.error ?? "")) return { ok: false, error: `seedBirthAttestation refused: ${sba.error}` };
+  const sg = authorFrameworkAs("seedGenesis", { principal: genesisOwner, workspaceId: parentWs, bornAt: stamp }, genesisOwner);
+  if (sg.ok === false && !/already|create-once|warrant/i.test(sg.error ?? "")) return { ok: false, error: `seedGenesis refused: ${sg.error}` };
+  return { ok: true };
+}
+function attestedBirthOffer(eng, parentWs, parentDomain, directiveId, payloadNoCert, lawHash, founder, dev2) {
+  const probe = author(eng, parentWs, parentDomain, directiveId, payloadNoCert, lawHash, { actor: founder });
+  if (probe.ok !== false) {
+    return { res: probe };
+  }
+  const m = /birth-unattestable \(([^)]*)\)/.exec(probe.error ?? "");
+  if (m === null || m[1] === void 0 || m[1].length === 0) {
+    return { res: probe, ...probe.error !== void 0 ? { error: probe.error } : {} };
+  }
+  const childName = m[1];
+  const signed = certSign(eng, {
+    child: childName,
+    founder,
+    verified: false,
+    parentKey: dev2.public,
+    parentId: parentWs,
+    epoch: 0,
+    secret: dev2.secret
+  });
+  const payload = { ...payloadNoCert, birthCert: JSON.stringify(signed) };
+  const res = author(eng, parentWs, parentDomain, directiveId, payload, lawHash, { actor: founder, authorSecret: dev2.secret });
+  return { res, childName };
+}
 function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
   const t0 = performance.now();
   const lines = [];
@@ -5860,6 +5929,27 @@ function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
   if (cb.birthRequiresRelation !== void 0 && actor === void 0) {
     return done(false, `child birth ${cb.parentDomain}/${cb.birthDirectiveId} is gated by .requires("${cb.birthRequiresRelation}") but the proof could not discover an actor field from the birth recipe \u2014 route the genesis step actor from a payload subject field`);
   }
+  const SENTINEL_PRINCIPAL = /^(user:|key:)?0+(-0+)*$/;
+  const founder = actor !== void 0 && !SENTINEL_PRINCIPAL.test(actor) ? actor : "user:00000000-0000-4000-8000-000000000001";
+  if (cb.birthActorField !== void 0) payload[cb.birthActorField] = founder;
+  const seatOwnerFields = (pl) => {
+    for (const k of Object.keys(pl)) {
+      if (/^(subject|principal|owner|ownerSubject|founder|member|grantee|user)$/i.test(k) && typeof pl[k] === "string") pl[k] = founder;
+    }
+  };
+  seatOwnerFields(payload);
+  const genesisOwner = founder;
+  const dev2 = authorKeygen(eng);
+  const devKeyHash = keyHashOf(dev2.public);
+  const injectDeviceKeyHash = (pl) => {
+    for (const k of Object.keys(pl)) if (/keyhash$/i.test(k) && typeof pl[k] === "string") pl[k] = devKeyHash;
+  };
+  injectDeviceKeyHash(payload);
+  const topBirthDomain = cb.parentSetup?.parentDomain ?? cb.parentDomain;
+  const warrant = warrantParentForBirth(eng, ws, topBirthDomain, lawHash, genesisOwner, founder, dev2, stamp);
+  if (warrant.ok === false) {
+    return done(false, `child birth ${cb.parentDomain}/${cb.birthDirectiveId}: could not warrant the parent '${ws}' for attested birth \u2014 ${warrant.error}`);
+  }
   let parentWs = ws;
   if (cb.parentSetup !== void 0) {
     const setup = cb.parentSetup;
@@ -5867,22 +5957,21 @@ function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
     if (setup.frameworkHashField !== void 0) setupPayload[setup.frameworkHashField] = fw;
     if (setup.lawHashField !== void 0) setupPayload[setup.lawHashField] = lawHash;
     for (const f of setup.birthAutoStamped) setupPayload[f] = stamp;
-    if (setup.birthActorField !== void 0 && cb.birthActorField !== void 0 && payload[cb.birthActorField] !== void 0) {
-      setupPayload[setup.birthActorField] = payload[cb.birthActorField];
-    }
-    const setupActor = actorFromPayload(setupPayload, setup.birthActorField) ?? actor;
-    const setupOpts = setupActor !== void 0 ? { actor: setupActor } : {};
-    const setupRes = author(
+    if (setup.birthActorField !== void 0) setupPayload[setup.birthActorField] = founder;
+    seatOwnerFields(setupPayload);
+    injectDeviceKeyHash(setupPayload);
+    const { res: setupRes, error: setupErr } = attestedBirthOffer(
       eng,
       ws,
       setup.parentDomain,
       setup.birthDirectiveId,
       setupPayload,
       lawHash,
-      setupOpts
+      founder,
+      dev2
     );
     if (setupRes.ok === false) {
-      return done(false, `parent setup ${setup.parentDomain}/${setup.birthDirectiveId} refused: ${setupRes.error ?? "unknown"} \u2014 the proof could not birth the parent workspace needed before gated child birth`);
+      return done(false, `parent setup ${setup.parentDomain}/${setup.birthDirectiveId} refused: ${setupErr ?? setupRes.error ?? "unknown"} \u2014 the proof could not birth the parent workspace needed before gated child birth`);
     }
     const bornParent = (setupRes.born ?? []).map((b) => b?.workspace).find((w) => typeof w === "string" && w.length > 0);
     if (bornParent === void 0) {
@@ -5891,16 +5980,15 @@ function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
     parentWs = bornParent;
     lines.push(`\u2713 parent setup ${setup.parentDomain}/${setup.birthDirectiveId} \u2014 ${parentWs} born before gated child birth`);
   }
-  if (cb.relationSetup !== void 0 && actor !== void 0) {
-    const seat = seatRelationAuthority(eng, parentWs, lawHash, cb.relationSetup, actor, stamp, lines);
+  if (cb.relationSetup !== void 0) {
+    const seat = seatRelationAuthority(eng, parentWs, lawHash, cb.relationSetup, genesisOwner, stamp, lines, dev2.secret, founder);
     if (seat.error !== void 0) return done(false, `child birth ${cb.parentDomain}/${cb.birthDirectiveId}: ${seat.error}`);
     if (seat.skipped !== void 0) {
       lines.push(`\u2013 child-birth leg SKIPPED \u2014 ${cb.birthDirectiveId} .requires("${cb.birthRequiresRelation}") and the discovered authority path could not be seated: ${seat.skipped}; prove the birth by hand (or expose an ungated bootstrap seed)`);
       return done(true);
     }
   }
-  const opts = actor !== void 0 ? { actor } : {};
-  const res = author(eng, parentWs, cb.parentDomain, cb.birthDirectiveId, payload, lawHash, opts);
+  const { res } = attestedBirthOffer(eng, parentWs, cb.parentDomain, cb.birthDirectiveId, payload, lawHash, founder, dev2);
   if (res.ok === false) {
     return done(false, `child birth ${cb.parentDomain}/${cb.birthDirectiveId} refused: ${res.error ?? "unknown"} \u2014 the parent's own gate rejected the birth offer (check the .births() plan + payload)`);
   }
@@ -5976,13 +6064,13 @@ function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
   lines.push(`\u2713 verify_chain GREEN on the born child ${childWs} (${verdict.plansRerun ?? "?"} plans re-run \u2014 it self-validates from intent 0 through its OWN gate)`);
   return done(true);
 }
-function seatRelationAuthority(eng, ws, lawHash, rb, actor, stamp, lines) {
-  const actorOpts = { actor };
+function seatRelationAuthority(eng, ws, lawHash, rb, actor, stamp, lines, authorSecret, subjectActor = actor) {
+  const actorOpts = authorSecret !== void 0 ? { actor, authorSecret } : { actor };
   const bareActor = actor.replace(/^user:/, "");
   const grantedRelation = rb.grantedRelation ?? rb.relation;
   const speculative = rb.seedSpeculative === true;
   if (rb.granterAuthority !== void 0) {
-    const inner = seatRelationAuthority(eng, ws, lawHash, rb.granterAuthority, actor, stamp, lines);
+    const inner = seatRelationAuthority(eng, ws, lawHash, rb.granterAuthority, actor, stamp, lines, authorSecret, actor);
     if (!inner.ok) return inner;
   }
   const seatActorFields = (payload, routed, wrapped = []) => {
@@ -6026,14 +6114,17 @@ function seatRelationAuthority(eng, ws, lawHash, rb, actor, stamp, lines) {
     lines.push(`\u2713 relation seat (prerequisite) \u2014 ${rb.domain}/${seed.directiveId} established (as ${actor})`);
   }
   const grantPayload = { ...rb.grantPayload };
-  seatActorFields(grantPayload, [...rb.grantSubjectFields, ...rb.grantGrantedByFields], rb.grantSubjectWrappedFields ?? []);
+  seatActorFields(grantPayload, [...rb.grantGrantedByFields], []);
+  const bareSubject = subjectActor.replace(/^user:/, "");
+  for (const f of rb.grantSubjectFields) grantPayload[f] = subjectActor;
+  for (const f of rb.grantSubjectWrappedFields ?? []) grantPayload[f] = bareSubject;
   for (const f of rb.grantAutoStamped) grantPayload[f] = stamp;
   const grantRes = dispatchSeat(rb.grantDirectiveId, grantPayload);
   if (grantRes.ok === false) {
     if (speculative) return { ok: false, skipped: `the declared seed ${rb.domain}/${rb.grantDirectiveId} could not be replayed (${grantRes.error ?? "refused"})` };
-    return { ok: false, error: `relation seat ${rb.domain}/${rb.grantDirectiveId} refused: ${grantRes.error ?? "unknown"} \u2014 the grant that should seat "${grantedRelation}" on ${actor} was rejected` };
+    return { ok: false, error: `relation seat ${rb.domain}/${rb.grantDirectiveId} refused: ${grantRes.error ?? "unknown"} \u2014 the grant that should seat "${grantedRelation}" on ${subjectActor} was rejected` };
   }
-  lines.push(`\u2713 relation seat \u2014 ${rb.domain}/${rb.grantDirectiveId} granted "${grantedRelation}" to ${actor} (${rb.via})`);
+  lines.push(`\u2713 relation seat \u2014 ${rb.domain}/${rb.grantDirectiveId} granted "${grantedRelation}" to ${subjectActor} (${rb.via})`);
   return { ok: true };
 }
 function runRelationBootstrapLeg(eng, ws, lawHash, rb) {
@@ -6121,13 +6212,26 @@ function runBornContextLeg(eng, ws, lawHash, rb, ACTOR, stamp) {
   const done = (ok, error) => ({ ok, ms: performance.now() - t0, legs: lines, ...error !== void 0 ? { error } : {} });
   const bc = rb.bornContext;
   const fw = eng.hashes?.nomos;
-  const actorOpts = { actor: ACTOR };
+  const SENTINEL = /^(user:|key:)?0+(-0+)*$/;
+  const founder = ACTOR && !SENTINEL.test(ACTOR) ? ACTOR : "user:00000000-0000-4000-8000-000000000001";
+  const dev2 = authorKeygen(eng);
+  const devKeyHash = keyHashOf(dev2.public);
+  const warrant = warrantParentForBirth(eng, ws, rb.domain, lawHash, founder, founder, dev2, stamp);
+  if (warrant.ok === false) {
+    lines.push(`\u2013 relation-bootstrap leg SKIPPED (layer-4 born-context) \u2014 could not warrant '${ws}' for attested birth (${warrant.error})`);
+    return done(true);
+  }
+  const actorOpts = { actor: founder, authorSecret: dev2.secret };
   const birthPayload = { ...bc.birthPayload };
-  if (bc.ownerField !== void 0) birthPayload[bc.ownerField] = ACTOR;
+  if (bc.ownerField !== void 0) birthPayload[bc.ownerField] = founder;
+  for (const k of Object.keys(birthPayload)) {
+    if (/^(subject|principal|owner|ownerSubject|founder|member|grantee|user)$/i.test(k) && typeof birthPayload[k] === "string") birthPayload[k] = founder;
+    if (/keyhash$/i.test(k) && typeof birthPayload[k] === "string") birthPayload[k] = devKeyHash;
+  }
   if (bc.frameworkHashField !== void 0) birthPayload[bc.frameworkHashField] = fw;
   if (bc.lawHashField !== void 0) birthPayload[bc.lawHashField] = lawHash;
   for (const f of bc.birthAutoStamped) birthPayload[f] = stamp;
-  const birthRes = author(eng, ws, rb.domain, bc.birthDirectiveId, birthPayload, lawHash, actorOpts);
+  const { res: birthRes } = attestedBirthOffer(eng, ws, rb.domain, bc.birthDirectiveId, birthPayload, lawHash, founder, dev2);
   if (birthRes.ok === false) {
     lines.push(`\u2013 relation-bootstrap leg SKIPPED (layer-4 born-context) \u2014 the self-birth ${rb.domain}/${bc.birthDirectiveId} refused (${birthRes.error ?? "refused"}); could not establish born-genesis authority for "${rb.relation}"`);
     return done(true);
@@ -6140,11 +6244,11 @@ function runBornContextLeg(eng, ws, lawHash, rb, ACTOR, stamp) {
   lines.push(`\u2713 relation bootstrap (born-context) \u2014 birthed ${bornWs} via ${rb.domain}/${bc.birthDirectiveId}; its genesis (${bc.seatsViaDirectiveId}) seated "${rb.relation}" for the owner ${ACTOR}`);
   const gatedPayload = { ...rb.gatedPayload };
   for (const k of Object.keys(gatedPayload)) {
-    if (/^(subject|principal|owner|ownerSubject|grantee|member|user)$/i.test(k)) gatedPayload[k] = ACTOR;
+    if (/^(subject|principal|owner|ownerSubject|grantee|member|user)$/i.test(k)) gatedPayload[k] = founder;
   }
   for (const f of rb.gatedAutoStamped) gatedPayload[f] = stamp;
   if (rb.gatedMintField !== void 0 && rb.gatedAggregateId !== void 0) gatedPayload[rb.gatedMintField] = mintId(eng, rb.gatedAggregateId);
-  const gatedRes = author(eng, bornWs, rb.domain, rb.gatedDirectiveId, gatedPayload, lawHash, actorOpts);
+  const gatedRes = author(eng, bornWs, rb.domain, rb.gatedDirectiveId, gatedPayload, lawHash, { actor: founder, authorSecret: dev2.secret });
   if (gatedRes.ok === false) {
     lines.push(`\u2013 relation-bootstrap leg SKIPPED (layer-4 born-context) \u2014 dispatching ${rb.domain}/${rb.gatedDirectiveId} .requires("${rb.relation}") inside the born ${bornWs} as ${ACTOR} was REFUSED on the real gate (${gatedRes.error ?? "refused"}); the born genesis did not establish the authority the gate needs`);
     return done(true);
@@ -6204,11 +6308,13 @@ OFFLINE PROOF GREEN (${Math.round(v.ms)}ms) \u2014 the same legs rerun on every
   console.log(`Deploy with confidence when ready: githolon ws create <ws> && githolon deploy <ws>   (or the full cloud proof: githolon proof --live)`);
   return 0;
 }
+var keyHashOf;
 var init_proof_offline = __esm({
   "src/proof_offline.ts"() {
     "use strict";
     init_engine();
     init_local_holon();
+    keyHashOf = (pubB64) => createHash4("sha256").update(Buffer.from(pubB64, "base64")).digest("hex");
   }
 });
 
@@ -6604,7 +6710,8 @@ async function harnessInstall(opts) {
   writeFileSync8(outPath, treeBytes);
   process.stderr.write(`harness-install: snapshot written (${treeBytes.length} bytes) \u2192 ${outPath}
 `);
-  process.stdout.write(JSON.stringify({ ok: true, snapshot: outPath, workspace, lawHashes, frameworkHash: eng.hashes.nomos }) + "\n");
+  const harnessDevice = authorKeygen(eng);
+  process.stdout.write(JSON.stringify({ ok: true, snapshot: outPath, workspace, lawHashes, frameworkHash: eng.hashes.nomos, devicePublic: harnessDevice.public, deviceSecret: harnessDevice.secret }) + "\n");
   return 0;
 }
 var STALE_RUNTIME_HINT, die;
@@ -6703,7 +6810,7 @@ var init_doctor = __esm({
 });
 
 // src/scene_projector.ts
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 function fnv1a32(s) {
   let h = 2166136261;
   for (let i = 0; i < s.length; i++) {
@@ -7673,7 +7780,7 @@ var sha256Hex, add, sub, mul, norm, cross, seededAngle, r3, round3, sanitize, KI
 var init_scene_projector = __esm({
   "src/scene_projector.ts"() {
     "use strict";
-    sha256Hex = (s) => createHash4("sha256").update(s).digest("hex");
+    sha256Hex = (s) => createHash5("sha256").update(s).digest("hex");
     add = (a, b) => [a[0] + b[0], a[1] + b[1], a[2] + b[2]];
     sub = (a, b) => [a[0] - b[0], a[1] - b[1], a[2] - b[2]];
     mul = (a, k) => [a[0] * k, a[1] * k, a[2] * k];
@@ -7760,7 +7867,7 @@ __export(scene_exports, {
 });
 import { existsSync as existsSync15, mkdirSync as mkdirSync6, writeFileSync as writeFileSync9 } from "node:fs";
 import { join as join16, resolve as resolve4 } from "node:path";
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 import git3 from "isomorphic-git";
 async function walkChain2(eng, ws) {
   const gitdir = gitdirOf(ws);
@@ -7887,7 +7994,7 @@ var init_scene = __esm({
     init_scene_projector();
     out11 = (s) => void process.stdout.write(s + "\n");
     err11 = (s) => void process.stderr.write("error: " + s + "\n");
-    sha256 = (s) => createHash5("sha256").update(s).digest("hex");
+    sha256 = (s) => createHash6("sha256").update(s).digest("hex");
   }
 });
 
@@ -8839,13 +8946,13 @@ var HELP = {
   },
   secret: {
     usage: "githolon secret <set <ws> <push-password> | rotate <ws>> [--cloud <url>]",
-    what: "The git push-password store (~/.holon/credentials.json, 0600) for the push-to-create birth lane\n(sha256(it) becomes the workspace owner bound IN THE CHAIN). The open deploy lane uses no secret.\n`set` imports a push password you already hold; `rotate` is RETIRED (the host holds no ownership\ncredential to rotate \u2014 410).",
+    what: "The git push-password store (~/.holon/credentials.json, 0600) for authenticated git sync to the\ncloud host. The open deploy lane uses no secret. `set` imports a push password you already hold;\n`rotate` is RETIRED (the host holds no ownership credential to rotate \u2014 410). (There is no\npush-to-create birth: a workspace is born by its parent authoring its birth.)",
     examples: ["githolon secret set my-ws holon_v1_\u2026"]
   },
   git: {
     usage: "githolon git <setup | remote [<ws>] [<remoteName>]> [--cloud <url>] [--target <name>]",
-    what: "Stock git push as deploy/birth. `setup` installs the credential helper for the cloud host;\n`remote` wires this repo to a workspace (then: git push nomos main). With no <ws>, the\nproject's `workspace` binding resolves it.",
-    examples: ["githolon git setup", "githolon git remote my-guestbook", "git push nomos main"]
+    what: "Stock git as the sync transport. `setup` installs the credential helper for the cloud host;\n`remote` wires this repo to a workspace (then push your session branch: git push nomos\nrefs/heads/session/<id>). `main` is not push-writable \u2014 a workspace is born by its PARENT\nauthoring its birth (birthHome/birthChild), never by a push. With no <ws>, the project's\n`workspace` binding resolves it.",
+    examples: ["githolon git setup", "githolon git remote my-guestbook", "git push nomos refs/heads/session/dev"]
   },
   ledger: {
     usage: "githolon ledger <init|verify> <dir> [--file <deploy.json>] [--cloud <url>]",
@@ -8915,8 +9022,9 @@ async function ledgerInit(dir, opts) {
   spawnSync4("git", ["-C", dir, "reset", "--hard", "main"], { stdio: "ignore" });
   out7(`\u2713 holon written \u2192 ${dir} (a normal git repo; git log IS the audit trail)`);
   out7(`
-Birth it on Nomos Cloud (the cloud re-derives this exact verdict):`);
-  out7(`  cd ${dir} && npx githolon git remote <ws> && git push nomos main`);
+A workspace is born by its PARENT (birthHome/birthChild/your .births() directive) \u2014 not by a push.`);
+  out7(`Deploy your law + sync your writes:`);
+  out7(`  cd ${dir} && npx githolon ws create <ws> && npx githolon deploy <ws>`);
   return 0;
 }
 async function ledgerVerify(dir, opts) {
@@ -9439,13 +9547,13 @@ deploy is OPEN + kernel-gated \u2014 births return no host secret, ownership is
             [--with <hashOrKey>]                          no longer served) via a signed installDomain offer
   githolon dlq sweep <ws> [--depth <n>] [--full]          sweep a platform subtree's dead-letter queues
                                                        (registry-enumerated; exit 2 when jams exist)
-  githolon secret set <ws> <push-password>                store a git push password (push-to-create birth lane)
+  githolon secret set <ws> <push-password>                store a git push password (authenticated git sync)
   githolon secret rotate <ws>                             RETIRED \u2014 host holds no ownership credential (410)
 
-Git lane (stock git push as deploy/birth \u2014 see also: push-to-create):
+Git lane (stock git as the sync transport \u2014 main is not push-writable; a workspace is born by its parent):
   githolon git setup                                      install the credential helper for the cloud host
   githolon git remote [<ws>] [<remoteName>]               wire this repo to a workspace (default name: nomos)
-                                                       then: git push nomos main
+                                                       then: git push nomos refs/heads/session/<id>
 
 The local-first lane (mint + assert a holon on YOUR machine, under YOUR identity):
   githolon ledger init <dir>                              genesis + your compiled law, verified by the SAME

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.95.2",
+  "version": "0.97.0",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -29,8 +29,8 @@
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/client": "^0.95.2",
-    "@githolon/dsl": "^0.95.2",
+    "@githolon/client": "^0.97.0",
+    "@githolon/dsl": "^0.97.0",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {