githolon 0.98.2 → 0.99.0

package/dist/cli.mjs

@@ -2527,6 +2527,11 @@ async function boot(eng, ws, ledger) {
 }
 async function deploy(eng, ws, ledger, usda, domainHash, dispositions, opts = {}) {
   const result = author(eng, ws, "nomos", "installDomain", installPayload(domainHash, usda, eng.installedBy, dispositions), eng.hashes.nomos, { actor: opts.actor ?? "", ...opts.authToken ? { authToken: opts.authToken } : {} });
+  if (result.ok === false) {
+    throw new Error(
+      `deploy-refused: installing ${domainHash.slice(0, 12)}\u2026 was REFUSED by the one gate (custody unchanged): ${result.error ?? "unknown refusal"}`
+    );
+  }
   const installation = qById(eng, ws, `domain-installation:${domainHash}`);
   const keys = installation[0]?.data?.domainKeys ?? installation[0]?.domainKeys ?? [];
   if (keys.length > 0) {
@@ -2814,10 +2819,12 @@ async function fetchJsonCached(url, cacheFile) {
     throw e;
   }
 }
-async function fetchRuntime(cloud) {
+async function fetchRuntime(cloud, kind = "production") {
   const cache = join2(configDir(), "runtime");
   let wasmBytes;
-  const wasmCache = join2(cache, "holon.wasm");
+  const wasmName = kind === "test-mint" ? "holon-testmint.wasm" : "holon.wasm";
+  const wasmUrl = kind === "test-mint" ? "holon-testmint.wasm" : "holon.wasm";
+  const wasmCache = join2(cache, wasmName);
   const localWasm = process.env["NOMOS_LOCAL_WASM"];
   if (localWasm) {
     const bytes = readFileSync(localWasm);
@@ -2825,7 +2832,7 @@ async function fetchRuntime(cloud) {
     return { wasmBytes: bytes, packages: packages2 };
   }
   try {
-    const r = await fetch(`${cloud}/v1/runtime/holon.wasm`);
+    const r = await fetch(`${cloud}/v1/runtime/${wasmUrl}`);
     if (!r.ok) throw new Error(`runtime wasm \u2192 ${r.status}`);
     wasmBytes = new Uint8Array(await r.arrayBuffer());
     mkdirSync2(cache, { recursive: true });
@@ -2891,8 +2898,8 @@ function readTreeFromDisk(diskPath) {
   }
   return new Directory2(contents);
 }
-async function holonEngine(cloud, overlay, installedBy) {
-  const runtime = await fetchRuntime(cloud);
+async function holonEngine(cloud, overlay, installedBy, runtimeKind = "production") {
+  const runtime = await fetchRuntime(cloud, runtimeKind);
   const replica = BigInt(`0x${randomBytes(8).toString("hex")}`) & (1n << 63n) - 1n;
   const eng = await createEngine({
     wasmModule: await WebAssembly.compile(runtime.wasmBytes),
@@ -5839,7 +5846,7 @@ async function runOfflineLegs(eng, ws, lawHash, legs, frameworkHash, deployUsda)
     if (i > 0 && deployUsda !== void 0) {
       cbWs = await mountIsolatedProofWs(eng, ws, lawHash, deployUsda);
     }
-    const v = runChildBirthLeg(eng, cbWs, lawHash, birthLeg, frameworkHash);
+    const v = await runChildBirthLeg(eng, cbWs, lawHash, birthLeg, frameworkHash);
     lines.push(...v.legs);
     if (!v.ok) return done(false, lines, v.error);
   }
@@ -5867,25 +5874,72 @@ function warrantParentForBirth(eng, parentWs, parentDomain, lawHash, genesisOwne
     return { ok: false, error: `no directive registered for '${directiveId}' under '${parentDomain}' or 'nomos'` };
   };
   for (const principal of birthActor === genesisOwner ? [genesisOwner] : [genesisOwner, birthActor]) {
-    const en = authorFrameworkAs("enrollSigner", { keyHash: keyHashOf(dev2.public), grantedBy: principal, grantedAt: 1 }, principal);
+    const en = authorFrameworkAs("enrollSigner", {
+      keyHash: keyHashOf(dev2.public),
+      grantedBy: principal,
+      grantedAt: 1,
+      // The offline harness runs the explicit test-mint kernel. Give its synthetic founder the same
+      // on-chain provenance a real login's IdP-backed enrollment carries, so a child law that correctly
+      // requires a VERIFIED parent attestation can be proven without weakening that production rule.
+      verifiedVia: OFFLINE_PROOF_VERIFIER
+    }, principal);
     if (en.ok === false && !/already|create-once|enrolled/i.test(en.error ?? "")) return { ok: false, error: `enrollSigner(${principal}) refused: ${en.error}` };
   }
-  const cert = certSign(eng, { child: parentWs, founder: genesisOwner, verified: false, parentKey: dev2.public, parentId: parentWs, epoch: 0, secret: dev2.secret });
+  const root = authorKeygen(eng);
+  setTestKRoot(eng, root.public);
+  const parentCert = certSign(eng, {
+    child: parentWs,
+    founder: genesisOwner,
+    verified: true,
+    parentKey: dev2.public,
+    parentId: "root",
+    epoch: 0,
+    secret: dev2.secret
+  });
+  const rootDelegation = certSign(eng, {
+    child: parentWs,
+    founder: genesisOwner,
+    verified: true,
+    parentKey: dev2.public,
+    parentId: "root",
+    epoch: 0,
+    secret: root.secret
+  });
+  const childDelegation = certSign(eng, {
+    child: parentWs,
+    founder: birthActor,
+    verified: true,
+    parentKey: dev2.public,
+    parentId: parentWs,
+    epoch: 0,
+    secret: dev2.secret
+  });
+  const ed = authorFrameworkAs("enrollDelegation", {
+    user: birthActor,
+    deviceKey: dev2.public,
+    certJson: JSON.stringify(childDelegation),
+    enrolledAt: stamp
+  }, birthActor);
+  const hasDelegation = !(ed.ok === false && /no directive registered/i.test(ed.error ?? ""));
+  if (ed.ok === false && !/already|create-once|enrolled|no directive registered/i.test(ed.error ?? "")) {
+    return { ok: false, error: `enrollDelegation(${birthActor}) refused: ${ed.error}` };
+  }
   const sba = authorFrameworkAs("seedBirthAttestation", {
     child: parentWs,
     founder: genesisOwner,
-    verified: "false",
+    verified: "true",
     parentId: parentWs,
     parentKey: dev2.public,
     epoch: 0,
-    certChain: JSON.stringify({ links: [cert] })
+    certChain: JSON.stringify({ links: [parentCert, rootDelegation] })
   }, genesisOwner);
-  if (sba.ok === false && !/already|create-once|attest/i.test(sba.error ?? "")) return { ok: false, error: `seedBirthAttestation refused: ${sba.error}` };
+  const hasParentAttestation = !(sba.ok === false && /no directive registered/i.test(sba.error ?? ""));
+  if (sba.ok === false && !/already|create-once|attest|no directive registered/i.test(sba.error ?? "")) return { ok: false, error: `seedBirthAttestation refused: ${sba.error}` };
   const sg = authorFrameworkAs("seedGenesis", { principal: genesisOwner, workspaceId: parentWs, bornAt: stamp }, genesisOwner);
   if (sg.ok === false && !/already|create-once|warrant/i.test(sg.error ?? "")) return { ok: false, error: `seedGenesis refused: ${sg.error}` };
-  return { ok: true };
+  return { ok: true, attestationVerified: hasDelegation && hasParentAttestation };
 }
-function attestedBirthOffer(eng, parentWs, parentDomain, directiveId, payloadNoCert, lawHash, founder, dev2) {
+function attestedBirthOffer(eng, parentWs, parentDomain, directiveId, payloadNoCert, lawHash, founder, dev2, verified = true) {
   const probe = author(eng, parentWs, parentDomain, directiveId, payloadNoCert, lawHash, { actor: founder });
   if (probe.ok !== false) {
     return { res: probe };
@@ -5898,7 +5952,7 @@ function attestedBirthOffer(eng, parentWs, parentDomain, directiveId, payloadNoC
   const signed = certSign(eng, {
     child: childName,
     founder,
-    verified: false,
+    verified,
     parentKey: dev2.public,
     parentId: parentWs,
     epoch: 0,
@@ -5908,7 +5962,7 @@ function attestedBirthOffer(eng, parentWs, parentDomain, directiveId, payloadNoC
   const res = author(eng, parentWs, parentDomain, directiveId, payload, lawHash, { actor: founder, authorSecret: dev2.secret });
   return { res, childName };
 }
-function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
+async function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
   const t0 = performance.now();
   const lines = [];
   const done = (ok, error) => ({ ok, ms: performance.now() - t0, legs: lines, ...error !== void 0 ? { error } : {} });
@@ -5968,7 +6022,8 @@ function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
       setupPayload,
       lawHash,
       founder,
-      dev2
+      dev2,
+      true
     );
     if (setupRes.ok === false) {
       return done(false, `parent setup ${setup.parentDomain}/${setup.birthDirectiveId} refused: ${setupErr ?? setupRes.error ?? "unknown"} \u2014 the proof could not birth the parent workspace needed before gated child birth`);
@@ -5988,7 +6043,17 @@ function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
       return done(true);
     }
   }
-  const { res } = attestedBirthOffer(eng, parentWs, cb.parentDomain, cb.birthDirectiveId, payload, lawHash, founder, dev2);
+  const { res } = attestedBirthOffer(
+    eng,
+    parentWs,
+    cb.parentDomain,
+    cb.birthDirectiveId,
+    payload,
+    lawHash,
+    founder,
+    dev2,
+    cb.parentSetup === void 0 || warrant.attestationVerified === true
+  );
   if (res.ok === false) {
     return done(false, `child birth ${cb.parentDomain}/${cb.birthDirectiveId} refused: ${res.error ?? "unknown"} \u2014 the parent's own gate rejected the birth offer (check the .births() plan + payload)`);
   }
@@ -6062,6 +6127,28 @@ function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
     return done(false, `the born child ${childWs} FAILED verify_chain at ${verdict.check ?? "?"}${verdict.atIndex !== void 0 ? ` (intent ${verdict.atIndex})` : ""}: ${verdict.error ?? "invalid"} \u2014 the child's own gate refused its genesis`);
   }
   lines.push(`\u2713 verify_chain GREEN on the born child ${childWs} (${verdict.plansRerun ?? "?"} plans re-run \u2014 it self-validates from intent 0 through its OWN gate)`);
+  const bornEntry = (res.born ?? []).find((b) => b?.workspace === childWs);
+  const packed = packBornChildren(eng, bornEntry === void 0 ? [] : [bornEntry]);
+  const childPack = packed.find((b) => b.workspace === childWs);
+  if (!childPack?.packB64 || !childPack.head) {
+    return done(false, `the born child ${childWs} could not be packed for its own custody \u2014 persistence would be masked by the parent engine`);
+  }
+  try {
+    await ingestPackAsCustody(eng, childWs, new Uint8Array(Buffer.from(childPack.packB64, "base64")), childPack.head);
+  } catch (e) {
+    return done(false, `recovering ${childWs} from its custody pack failed: ${e.message}`);
+  }
+  const recoveredVerify = verifyChainLocal(eng, childWs);
+  if (recoveredVerify.valid !== true) {
+    return done(false, `the recovered child ${childWs} FAILED verify_chain from its own custody: ${recoveredVerify.error ?? "invalid"}`);
+  }
+  if (cb.childSeedInstanceId !== void 0) {
+    const recoveredRows = qById(eng, childWs, cb.childSeedInstanceId);
+    if (recoveredRows.length < 1) {
+      return done(false, `the recovered child ${childWs} verified but its business root ${cb.childSeedInstanceId} was missing`);
+    }
+  }
+  lines.push(`\u2713 persistence + recovery \u2014 child custody packed, resident copy discarded, verify_chain GREEN and ${cb.childSeedInstanceId ?? cb.childSeedAggregateId ?? "the business root"} readable after reopen`);
   return done(true);
 }
 function seatRelationAuthority(eng, ws, lawHash, rb, actor, stamp, lines, authorSecret, subjectActor = actor) {
@@ -6231,7 +6318,17 @@ function runBornContextLeg(eng, ws, lawHash, rb, ACTOR, stamp) {
   if (bc.frameworkHashField !== void 0) birthPayload[bc.frameworkHashField] = fw;
   if (bc.lawHashField !== void 0) birthPayload[bc.lawHashField] = lawHash;
   for (const f of bc.birthAutoStamped) birthPayload[f] = stamp;
-  const { res: birthRes } = attestedBirthOffer(eng, ws, rb.domain, bc.birthDirectiveId, birthPayload, lawHash, founder, dev2);
+  const { res: birthRes } = attestedBirthOffer(
+    eng,
+    ws,
+    rb.domain,
+    bc.birthDirectiveId,
+    birthPayload,
+    lawHash,
+    founder,
+    dev2,
+    true
+  );
   if (birthRes.ok === false) {
     lines.push(`\u2013 relation-bootstrap leg SKIPPED (layer-4 born-context) \u2014 the self-birth ${rb.domain}/${bc.birthDirectiveId} refused (${birthRes.error ?? "refused"}); could not establish born-genesis authority for "${rb.relation}"`);
     return done(true);
@@ -6292,7 +6389,8 @@ async function runOfflineProofStandalone(proofPath, cloud, domain) {
   const deployBody = JSON.parse(readFileSync7(deployFile, "utf8"));
   const lawHash = await sha256hex(deployBody.packageUsda);
   console.log(`githolon proof \u2014 OFFLINE legs on a local holon (the cloud loop: githolon proof --live)`);
-  const { eng } = await holonEngine(cloud, deployBody, "githolon-proof");
+  const runtimeKind = legs.childBirth !== void 0 || (legs.childBirths?.length ?? 0) > 0 ? "test-mint" : "production";
+  const { eng } = await holonEngine(cloud, deployBody, "githolon-proof", runtimeKind);
   const ws = "proof-offline";
   await mountFresh(eng, ws);
   author(eng, ws, "bootstrap", "installDomain", installPayload(eng.hashes.nomos, eng.nomosPkg, "githolon-proof"), "");
@@ -6308,13 +6406,14 @@ OFFLINE PROOF GREEN (${Math.round(v.ms)}ms) \u2014 the same legs rerun on every
   console.log(`Deploy with confidence when ready: githolon ws create <ws> && githolon deploy <ws>   (or the full cloud proof: githolon proof --live)`);
   return 0;
 }
-var keyHashOf;
+var keyHashOf, OFFLINE_PROOF_VERIFIER;
 var init_proof_offline = __esm({
   "src/proof_offline.ts"() {
     "use strict";
     init_engine();
     init_local_holon();
     keyHashOf = (pubB64) => createHash4("sha256").update(Buffer.from(pubB64, "base64")).digest("hex");
+    OFFLINE_PROOF_VERIFIER = "nomos:test-mint";
   }
 });
 

package/dist/dev-server.mjs

@@ -1377,6 +1377,11 @@ async function boot(eng, ws, ledger) {
 }
 async function deploy(eng, ws, ledger, usda, domainHash, dispositions, opts = {}) {
   const result = author(eng, ws, "nomos", "installDomain", installPayload(domainHash, usda, eng.installedBy, dispositions), eng.hashes.nomos, { actor: opts.actor ?? "", ...opts.authToken ? { authToken: opts.authToken } : {} });
+  if (result.ok === false) {
+    throw new Error(
+      `deploy-refused: installing ${domainHash.slice(0, 12)}\u2026 was REFUSED by the one gate (custody unchanged): ${result.error ?? "unknown refusal"}`
+    );
+  }
   const installation = qById(eng, ws, `domain-installation:${domainHash}`);
   const keys = installation[0]?.data?.domainKeys ?? installation[0]?.domainKeys ?? [];
   if (keys.length > 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.98.2",
+  "version": "0.99.0",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -29,8 +29,8 @@
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/client": "^0.98.2",
-    "@githolon/dsl": "^0.98.2",
+    "@githolon/client": "^0.99.0",
+    "@githolon/dsl": "^0.99.0",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {