githolon 0.98.3 → 0.100.0

package/dist/cli.mjs

@@ -2819,10 +2819,12 @@ async function fetchJsonCached(url, cacheFile) {
     throw e;
   }
 }
-async function fetchRuntime(cloud) {
+async function fetchRuntime(cloud, kind = "production") {
   const cache = join2(configDir(), "runtime");
   let wasmBytes;
-  const wasmCache = join2(cache, "holon.wasm");
+  const wasmName = kind === "test-mint" ? "holon-testmint.wasm" : "holon.wasm";
+  const wasmUrl = kind === "test-mint" ? "holon-testmint.wasm" : "holon.wasm";
+  const wasmCache = join2(cache, wasmName);
   const localWasm = process.env["NOMOS_LOCAL_WASM"];
   if (localWasm) {
     const bytes = readFileSync(localWasm);
@@ -2830,7 +2832,7 @@ async function fetchRuntime(cloud) {
     return { wasmBytes: bytes, packages: packages2 };
   }
   try {
-    const r = await fetch(`${cloud}/v1/runtime/holon.wasm`);
+    const r = await fetch(`${cloud}/v1/runtime/${wasmUrl}`);
     if (!r.ok) throw new Error(`runtime wasm \u2192 ${r.status}`);
     wasmBytes = new Uint8Array(await r.arrayBuffer());
     mkdirSync2(cache, { recursive: true });
@@ -2896,8 +2898,8 @@ function readTreeFromDisk(diskPath) {
   }
   return new Directory2(contents);
 }
-async function holonEngine(cloud, overlay, installedBy) {
-  const runtime = await fetchRuntime(cloud);
+async function holonEngine(cloud, overlay, installedBy, runtimeKind = "production") {
+  const runtime = await fetchRuntime(cloud, runtimeKind);
   const replica = BigInt(`0x${randomBytes(8).toString("hex")}`) & (1n << 63n) - 1n;
   const eng = await createEngine({
     wasmModule: await WebAssembly.compile(runtime.wasmBytes),
@@ -5844,7 +5846,7 @@ async function runOfflineLegs(eng, ws, lawHash, legs, frameworkHash, deployUsda)
     if (i > 0 && deployUsda !== void 0) {
       cbWs = await mountIsolatedProofWs(eng, ws, lawHash, deployUsda);
     }
-    const v = runChildBirthLeg(eng, cbWs, lawHash, birthLeg, frameworkHash);
+    const v = await runChildBirthLeg(eng, cbWs, lawHash, birthLeg, frameworkHash);
     lines.push(...v.legs);
     if (!v.ok) return done(false, lines, v.error);
   }
@@ -5872,25 +5874,72 @@ function warrantParentForBirth(eng, parentWs, parentDomain, lawHash, genesisOwne
     return { ok: false, error: `no directive registered for '${directiveId}' under '${parentDomain}' or 'nomos'` };
   };
   for (const principal of birthActor === genesisOwner ? [genesisOwner] : [genesisOwner, birthActor]) {
-    const en = authorFrameworkAs("enrollSigner", { keyHash: keyHashOf(dev2.public), grantedBy: principal, grantedAt: 1 }, principal);
+    const en = authorFrameworkAs("enrollSigner", {
+      keyHash: keyHashOf(dev2.public),
+      grantedBy: principal,
+      grantedAt: 1,
+      // The offline harness runs the explicit test-mint kernel. Give its synthetic founder the same
+      // on-chain provenance a real login's IdP-backed enrollment carries, so a child law that correctly
+      // requires a VERIFIED parent attestation can be proven without weakening that production rule.
+      verifiedVia: OFFLINE_PROOF_VERIFIER
+    }, principal);
     if (en.ok === false && !/already|create-once|enrolled/i.test(en.error ?? "")) return { ok: false, error: `enrollSigner(${principal}) refused: ${en.error}` };
   }
-  const cert = certSign(eng, { child: parentWs, founder: genesisOwner, verified: false, parentKey: dev2.public, parentId: parentWs, epoch: 0, secret: dev2.secret });
+  const root = authorKeygen(eng);
+  setTestKRoot(eng, root.public);
+  const parentCert = certSign(eng, {
+    child: parentWs,
+    founder: genesisOwner,
+    verified: true,
+    parentKey: dev2.public,
+    parentId: "root",
+    epoch: 0,
+    secret: dev2.secret
+  });
+  const rootDelegation = certSign(eng, {
+    child: parentWs,
+    founder: genesisOwner,
+    verified: true,
+    parentKey: dev2.public,
+    parentId: "root",
+    epoch: 0,
+    secret: root.secret
+  });
+  const childDelegation = certSign(eng, {
+    child: parentWs,
+    founder: birthActor,
+    verified: true,
+    parentKey: dev2.public,
+    parentId: parentWs,
+    epoch: 0,
+    secret: dev2.secret
+  });
+  const ed = authorFrameworkAs("enrollDelegation", {
+    user: birthActor,
+    deviceKey: dev2.public,
+    certJson: JSON.stringify(childDelegation),
+    enrolledAt: stamp
+  }, birthActor);
+  const hasDelegation = !(ed.ok === false && /no directive registered/i.test(ed.error ?? ""));
+  if (ed.ok === false && !/already|create-once|enrolled|no directive registered/i.test(ed.error ?? "")) {
+    return { ok: false, error: `enrollDelegation(${birthActor}) refused: ${ed.error}` };
+  }
   const sba = authorFrameworkAs("seedBirthAttestation", {
     child: parentWs,
     founder: genesisOwner,
-    verified: "false",
+    verified: "true",
     parentId: parentWs,
     parentKey: dev2.public,
     epoch: 0,
-    certChain: JSON.stringify({ links: [cert] })
+    certChain: JSON.stringify({ links: [parentCert, rootDelegation] })
   }, genesisOwner);
-  if (sba.ok === false && !/already|create-once|attest/i.test(sba.error ?? "")) return { ok: false, error: `seedBirthAttestation refused: ${sba.error}` };
+  const hasParentAttestation = !(sba.ok === false && /no directive registered/i.test(sba.error ?? ""));
+  if (sba.ok === false && !/already|create-once|attest|no directive registered/i.test(sba.error ?? "")) return { ok: false, error: `seedBirthAttestation refused: ${sba.error}` };
   const sg = authorFrameworkAs("seedGenesis", { principal: genesisOwner, workspaceId: parentWs, bornAt: stamp }, genesisOwner);
   if (sg.ok === false && !/already|create-once|warrant/i.test(sg.error ?? "")) return { ok: false, error: `seedGenesis refused: ${sg.error}` };
-  return { ok: true };
+  return { ok: true, attestationVerified: hasDelegation && hasParentAttestation };
 }
-function attestedBirthOffer(eng, parentWs, parentDomain, directiveId, payloadNoCert, lawHash, founder, dev2) {
+function attestedBirthOffer(eng, parentWs, parentDomain, directiveId, payloadNoCert, lawHash, founder, dev2, verified = true) {
   const probe = author(eng, parentWs, parentDomain, directiveId, payloadNoCert, lawHash, { actor: founder });
   if (probe.ok !== false) {
     return { res: probe };
@@ -5903,7 +5952,7 @@ function attestedBirthOffer(eng, parentWs, parentDomain, directiveId, payloadNoC
   const signed = certSign(eng, {
     child: childName,
     founder,
-    verified: false,
+    verified,
     parentKey: dev2.public,
     parentId: parentWs,
     epoch: 0,
@@ -5913,7 +5962,7 @@ function attestedBirthOffer(eng, parentWs, parentDomain, directiveId, payloadNoC
   const res = author(eng, parentWs, parentDomain, directiveId, payload, lawHash, { actor: founder, authorSecret: dev2.secret });
   return { res, childName };
 }
-function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
+async function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
   const t0 = performance.now();
   const lines = [];
   const done = (ok, error) => ({ ok, ms: performance.now() - t0, legs: lines, ...error !== void 0 ? { error } : {} });
@@ -5973,7 +6022,8 @@ function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
       setupPayload,
       lawHash,
       founder,
-      dev2
+      dev2,
+      true
     );
     if (setupRes.ok === false) {
       return done(false, `parent setup ${setup.parentDomain}/${setup.birthDirectiveId} refused: ${setupErr ?? setupRes.error ?? "unknown"} \u2014 the proof could not birth the parent workspace needed before gated child birth`);
@@ -5993,7 +6043,17 @@ function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
       return done(true);
     }
   }
-  const { res } = attestedBirthOffer(eng, parentWs, cb.parentDomain, cb.birthDirectiveId, payload, lawHash, founder, dev2);
+  const { res } = attestedBirthOffer(
+    eng,
+    parentWs,
+    cb.parentDomain,
+    cb.birthDirectiveId,
+    payload,
+    lawHash,
+    founder,
+    dev2,
+    cb.parentSetup === void 0 || warrant.attestationVerified === true
+  );
   if (res.ok === false) {
     return done(false, `child birth ${cb.parentDomain}/${cb.birthDirectiveId} refused: ${res.error ?? "unknown"} \u2014 the parent's own gate rejected the birth offer (check the .births() plan + payload)`);
   }
@@ -6023,7 +6083,11 @@ function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
     const checks = downgraded.certChecks !== void 0 ? ` certChecks=${JSON.stringify(downgraded.certChecks)}` : "";
     lines.push(`\u26A0 child ${childWs} was born UNWARRANTED \u2014 ${String(downgraded.reason ?? "cert not seeded")}${checks}`);
   }
-  lines.push(`\u2713 child birth ${cb.parentDomain}/${cb.birthDirectiveId} \u2014 ${childWs} born (the offer-effect folded the child genesis through the child's OWN gate)`);
+  if (cb.businessAggregateId !== void 0) {
+    lines.push(`\u2713 birth(${cb.businessAggregateId}) \u2014 business facts became a durable holon`);
+  } else {
+    lines.push(`\u2713 child birth ${cb.parentDomain}/${cb.birthDirectiveId} \u2014 ${childWs} born (the offer-effect folded the child genesis through the child's OWN gate)`);
+  }
   const installed = (hash) => {
     try {
       return qById(eng, childWs, `domain-installation:${hash}`).length > 0;
@@ -6037,7 +6101,11 @@ function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
   if (!installed(lawHash)) {
     return done(false, `the born child ${childWs} did not install the child law in-chain (domain-installation:${lawHash.slice(0, 12)}\u2026 absent) \u2014 the genesis nomos/installDomain did not fold (by-hash byte routing failed: does the parent fold this law?)`);
   }
-  lines.push(`\u2713 the born child installed the framework + child law IN-CHAIN (the genesis installDomain\xD72 folded)`);
+  if (cb.businessAggregateId !== void 0) {
+    lines.push(`\u2713 law travelled with ${cb.businessAggregateId} and admitted its first business fact`);
+  } else {
+    lines.push(`\u2713 the born child installed the framework + child law IN-CHAIN (the genesis installDomain\xD72 folded)`);
+  }
   let seedRows = [];
   if (cb.childSeedInstanceId !== void 0) {
     try {
@@ -6056,7 +6124,9 @@ function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
   if ((cb.childSeedInstanceId !== void 0 || cb.childQuery !== void 0) && seedRows.length < 1) {
     return done(false, `the born child ${childWs} did not seed ${cb.childSeedAggregateId ?? "its genesis record"} (${cb.childSeedDirectiveId} produced no readable row) \u2014 the child genesis seed did not run`);
   }
-  lines.push(`\u2713 the born child's genesis seed ran \u2014 ${cb.childSeedDirectiveId} produced ${seedRows.length} readable ${cb.childSeedAggregateId ?? "row"}(s) in ${childWs}`);
+  if (cb.businessAggregateId === void 0) {
+    lines.push(`\u2713 the born child's genesis seed ran \u2014 ${cb.childSeedDirectiveId} produced ${seedRows.length} readable ${cb.childSeedAggregateId ?? "row"}(s) in ${childWs}`);
+  }
   let verdict;
   try {
     verdict = verifyChainLocal(eng, childWs);
@@ -6066,7 +6136,37 @@ function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
   if (verdict.valid !== true) {
     return done(false, `the born child ${childWs} FAILED verify_chain at ${verdict.check ?? "?"}${verdict.atIndex !== void 0 ? ` (intent ${verdict.atIndex})` : ""}: ${verdict.error ?? "invalid"} \u2014 the child's own gate refused its genesis`);
   }
-  lines.push(`\u2713 verify_chain GREEN on the born child ${childWs} (${verdict.plansRerun ?? "?"} plans re-run \u2014 it self-validates from intent 0 through its OWN gate)`);
+  if (cb.businessAggregateId !== void 0) {
+    lines.push(`\u2713 full history replayed green locally (${verdict.plansRerun ?? "?"} plans re-run)`);
+  } else {
+    lines.push(`\u2713 verify_chain GREEN on the born child ${childWs} (${verdict.plansRerun ?? "?"} plans re-run \u2014 it self-validates from intent 0 through its OWN gate)`);
+  }
+  const bornEntry = (res.born ?? []).find((b) => b?.workspace === childWs);
+  const packed = packBornChildren(eng, bornEntry === void 0 ? [] : [bornEntry]);
+  const childPack = packed.find((b) => b.workspace === childWs);
+  if (!childPack?.packB64 || !childPack.head) {
+    return done(false, `the born child ${childWs} could not be packed for its own custody \u2014 persistence would be masked by the parent engine`);
+  }
+  try {
+    await ingestPackAsCustody(eng, childWs, new Uint8Array(Buffer.from(childPack.packB64, "base64")), childPack.head);
+  } catch (e) {
+    return done(false, `recovering ${childWs} from its custody pack failed: ${e.message}`);
+  }
+  const recoveredVerify = verifyChainLocal(eng, childWs);
+  if (recoveredVerify.valid !== true) {
+    return done(false, `the recovered child ${childWs} FAILED verify_chain from its own custody: ${recoveredVerify.error ?? "invalid"}`);
+  }
+  if (cb.childSeedInstanceId !== void 0) {
+    const recoveredRows = qById(eng, childWs, cb.childSeedInstanceId);
+    if (recoveredRows.length < 1) {
+      return done(false, `the recovered child ${childWs} verified but its business root ${cb.childSeedInstanceId} was missing`);
+    }
+  }
+  if (cb.businessAggregateId !== void 0) {
+    lines.push(`\u2713 persistence + recovery \u2014 evicted, restored from durable custody, and ${cb.businessAggregateId} read back`);
+  } else {
+    lines.push(`\u2713 persistence + recovery \u2014 child custody packed, resident copy discarded, verify_chain GREEN and ${cb.childSeedInstanceId ?? cb.childSeedAggregateId ?? "the business root"} readable after reopen`);
+  }
   return done(true);
 }
 function seatRelationAuthority(eng, ws, lawHash, rb, actor, stamp, lines, authorSecret, subjectActor = actor) {
@@ -6236,7 +6336,17 @@ function runBornContextLeg(eng, ws, lawHash, rb, ACTOR, stamp) {
   if (bc.frameworkHashField !== void 0) birthPayload[bc.frameworkHashField] = fw;
   if (bc.lawHashField !== void 0) birthPayload[bc.lawHashField] = lawHash;
   for (const f of bc.birthAutoStamped) birthPayload[f] = stamp;
-  const { res: birthRes } = attestedBirthOffer(eng, ws, rb.domain, bc.birthDirectiveId, birthPayload, lawHash, founder, dev2);
+  const { res: birthRes } = attestedBirthOffer(
+    eng,
+    ws,
+    rb.domain,
+    bc.birthDirectiveId,
+    birthPayload,
+    lawHash,
+    founder,
+    dev2,
+    true
+  );
   if (birthRes.ok === false) {
     lines.push(`\u2013 relation-bootstrap leg SKIPPED (layer-4 born-context) \u2014 the self-birth ${rb.domain}/${bc.birthDirectiveId} refused (${birthRes.error ?? "refused"}); could not establish born-genesis authority for "${rb.relation}"`);
     return done(true);
@@ -6296,8 +6406,9 @@ async function runOfflineProofStandalone(proofPath, cloud, domain) {
   }
   const deployBody = JSON.parse(readFileSync7(deployFile, "utf8"));
   const lawHash = await sha256hex(deployBody.packageUsda);
-  console.log(`githolon proof \u2014 OFFLINE legs on a local holon (the cloud loop: githolon proof --live)`);
-  const { eng } = await holonEngine(cloud, deployBody, "githolon-proof");
+  console.log(`githolon proof \u2014 generated business proof in the real local engine`);
+  const runtimeKind = legs.childBirth !== void 0 || (legs.childBirths?.length ?? 0) > 0 ? "test-mint" : "production";
+  const { eng } = await holonEngine(cloud, deployBody, "githolon-proof", runtimeKind);
   const ws = "proof-offline";
   await mountFresh(eng, ws);
   author(eng, ws, "bootstrap", "installDomain", installPayload(eng.hashes.nomos, eng.nomosPkg, "githolon-proof"), "");
@@ -6310,16 +6421,17 @@ async function runOfflineProofStandalone(proofPath, cloud, domain) {
   }
   console.log(`
 OFFLINE PROOF GREEN (${Math.round(v.ms)}ms) \u2014 the same legs rerun on every save in \`githolon dev\`.`);
-  console.log(`Deploy with confidence when ready: githolon ws create <ws> && githolon deploy <ws>   (or the full cloud proof: githolon proof --live)`);
+  console.log(`Run the same generated business proof against Nomos Cloud when ready: githolon proof --live`);
   return 0;
 }
-var keyHashOf;
+var keyHashOf, OFFLINE_PROOF_VERIFIER;
 var init_proof_offline = __esm({
   "src/proof_offline.ts"() {
     "use strict";
     init_engine();
     init_local_holon();
     keyHashOf = (pubB64) => createHash4("sha256").update(Buffer.from(pubB64, "base64")).digest("hex");
+    OFFLINE_PROOF_VERIFIER = "nomos:test-mint";
   }
 });
 
@@ -8729,7 +8841,7 @@ var HELP = {
   },
   proof: {
     usage: "githolon proof [build/<name>.proof.mts] [--domain <key>] [--live] [--keep]",
-    what: "Run the proof GENERATED from your law. DEFAULT: the OFFLINE legs on a LOCAL holon \u2014 the\nsame engine plane the cloud edge runs; no cloud workspace is touched (develop/play/understand\nhere, deploy with confidence after). --domain <key> proves a SPECIFIC domain of a multi-domain\npackage (offline; the default is the first). --live runs the full cloud loop (throwaway\nworkspace \u2192 deploy \u2192 offline write \u2192 admission \u2192 cloud reads \u2192 convergence). The throwaway is\ncreated REGISTERED (a signed createWorkspace at root \u2014 your principal needs creation authority\nthere) and RETIRED on every exit via the lawful retireOwnWorkspace; --keep keeps it. ALL GREEN or it names the jam. The offline\nlegs also rerun on every save in `githolon dev`.",
+    what: "Run the proof GENERATED from your business law. By default it drives the real local engine:\nbirth, full-history verification, durable custody, eviction, restore, and read-back. --live runs the\nsame business proof against Nomos Cloud; identity, provisioning, persistence, and cleanup remain\ninside Nomos. --domain selects one domain in a multi-domain package. ALL GREEN or it names the jam.",
     examples: ["githolon proof", "githolon proof --domain co2_platform", "githolon proof --live", "githolon proof --live --keep"]
   },
   dev: {
@@ -8817,7 +8929,7 @@ var HELP = {
   },
   login: {
     usage: "githolon login --agent | --token <refresh_token>",
-    what: "Establish the principal births ride. --agent self-onboards an anonymous VERIFIED identity\n(no human, no browser; linkable later); --token adopts an existing captain app session.\nSessions live in ~/.holon/credentials.json and auto-refresh.",
+    what: "Establish the identity Nomos uses beneath birth. --agent creates a verified development identity\n(no browser; linkable later); --token adopts an existing session. Credentials auto-refresh.",
     examples: ["githolon login --agent", "githolon login --token <refresh_token>"]
   },
   whoami: {
@@ -8838,16 +8950,14 @@ var HELP = {
     what: "Clear the session. Stored workspace secrets are KEPT."
   },
   ws: {
-    usage: "githolon ws <create|status|retire|reclaim> [<name>] [--principal <uid|token>] [--via <parent>] [--parent <ws>] [--cloud <url>] [--target <name>]",
-    what: "Workspace lifecycle on Nomos Cloud. `create` births one (NO host secret is issued \u2014\nownership is a ledger fact; deploy is open + kernel-gated) or, with --via <parent>, requests it\nas a SIGNED createWorkspace governance offer. `status` shows lineage/phase/verdicts. `retire`\nand `reclaim` are SIGNED governance offers to the parent (default root) \u2014 never host-author\nendpoints; retire withdraws the law (data retained), reclaim authorizes the bailiff to drop\ncustody (only a retired workspace; never root). `status` with no <name> resolves the project's\n`workspace` binding.",
+    usage: "githolon ws <status|retire|reclaim> [<name>] [--parent <ws>] [--cloud <url>] [--target <name>]",
+    what: "Operator inspection and disposal of existing cloud custody. Application creation is not here:\ndeclare birth(Aggregate, spec) and call the generated app.birth(businessFacts). `status` inspects\nlineage and verdicts; `retire` withdraws law while retaining data; `reclaim` discards custody only\nafter retirement.",
     flags: [
-      ["--principal <p>", "the birth's principal (uid or access token; remembered as the default)"],
-      ["--via <parent>", "ws create: sign a createWorkspace offer at <parent> instead of the raw birth"],
       ["--parent <ws>", "retire/reclaim: the governance workspace to sign against (default root)"],
       ["--cloud <url>", "target cloud (default: $NOMOS_CLOUD or the public cloud)"],
       ["--target <name>", "ws status: pick among the project's named workspace targets"]
     ],
-    examples: ["githolon ws create my-guestbook", "githolon ws create app1 --via co2", "githolon ws status", "githolon ws retire my-guestbook"]
+    examples: ["githolon ws status", "githolon ws retire my-guestbook"]
   },
   key: {
     usage: "githolon key <enroll|show|import|export> [--principal <uid>] [--secret <key>] [--sha256] [--format hex|base64] [--parent <ws>] [--yes]",
@@ -8883,9 +8993,8 @@ var HELP = {
     ],
     examples: [
       `githolon gov root grantCreation --payload '{"principal":"d205ca94-\u2026"}' --as 32c7100e-\u2026 --stamp`,
-      "githolon gov co2-platform birthHome --payload-file home.json --as d205ca94-\u2026",
-      "githolon gov root birthChild --payload-file co2.json --as 32c7100e-\u2026 --save co2.offer.json",
-      "githolon gov relay root co2.offer.json"
+      "githolon gov root setGovernancePosture --payload-file posture.json --as 32c7100e-\u2026 --save posture.offer.json",
+      "githolon gov relay root posture.offer.json"
     ]
   },
   rebirth: {
@@ -8956,12 +9065,12 @@ var HELP = {
   },
   git: {
     usage: "githolon git <setup | remote [<ws>] [<remoteName>]> [--cloud <url>] [--target <name>]",
-    what: "Stock git as the sync transport. `setup` installs the credential helper for the cloud host;\n`remote` wires this repo to a workspace (then push your session branch: git push nomos\nrefs/heads/session/<id>). `main` is not push-writable \u2014 a workspace is born by its PARENT\nauthoring its birth (birthHome/birthChild), never by a push. With no <ws>, the project's\n`workspace` binding resolves it.",
+    what: "Operator transport plumbing for existing holons. `setup` installs the credential helper;\n`remote` wires a local repo to existing cloud custody. Application code does not use git to\ncreate business things; it calls the generated birth(businessFacts).",
     examples: ["githolon git setup", "githolon git remote my-guestbook", "git push nomos refs/heads/session/dev"]
   },
   ledger: {
     usage: "githolon ledger <init|verify> <dir> [--file <deploy.json>] [--cloud <url>]",
-    what: "Mint + assert a holon ON YOUR MACHINE. `init` writes genesis + your compiled law as a normal\ngit repo, verified by the SAME wasm gate the cloud runs; `verify` re-runs the chain's\nself-verification from disk. Push the repo to an unborn workspace to birth it.",
+    what: "Low-level local custody and verification for framework development. `init` writes compiled\nlaw into a git-backed holon; `verify` replays its full history. Application packages use the\ngenerated birth(businessFacts) surface instead.",
     examples: ["githolon ledger init ./my-holon", "githolon ledger verify ./my-holon"]
   }
 };
@@ -9461,117 +9570,37 @@ async function status(wsArg, opts) {
 // src/cli.ts
 var KINDS = ["domain", "aggregate", "intent"];
 var DEFAULT_OUT = "domains";
-var USAGE = `githolon \u2014 the Nomos developer CLI
+var USAGE = `githolon \u2014 model a business; Nomos owns the compute science
 
-The inner loop:
-  githolon dev                                            watch \u2192 recompile \u2192 law LIVE in a local holon \u2192
-                                                       the generated proof's offline legs rerun \u2192 local
-                                                       reads served \u2014 sub-second, offline after warmup
-  githolon status [<ws>]                                  local law hash vs the DEPLOYED law, remedy named
-  githolon replay <ws|dir>                                the ledger as film: step the chain intent-by-
-                                                       intent; finale = the verify_chain verdict
-  githolon scene <ws|dir> [--out <dir>]                   the ledger as a PORTABLE USD scene: verify_chain-
-                                                       gated chain\u2192USD projection (.usda + .usdz, loads
-                                                       in three.js/usdview/QuickLook; timeCode = index)
-  githolon decrypt <ws> --as <p> --secret <b64>          clone + decrypt as a principal: unwrap their scope
-            --query <id> [--param k=v]                   keys from the chain, read private fields in cleartext
+Start here:
+  githolon compile                 compile aggregates, birth, directives, and reads into law + a typed client
+  githolon proof                   run the generated business proof in the real local engine
+  githolon dev                     watch, compile, and rerun that proof on every save
+  githolon check                   explain anything the law can already prove it would refuse
 
-Authoring:
-  githolon check    [config] [--json] [--against <p>]     run the author-time gate (static twins) on
-                                                       ./nomos.package.mjs \u2014 the unified report; exits
-                                                       non-zero on any REFUSE (compile runs it implicitly).
-                                                       --json emits the findings (with file:line) as an array
-  githolon compat  <ws-url|deploy.json|dir> [--json]      THE CI GATE: compare the current build's interface
-                                                       against a target's installed law, PER MEMBER (#72
-                                                       subtyping); exits non-zero on any incompatible member
-  githolon lsp                                            the author-time gate as a stdio Language Server:
-                                                       red squiggles while you write law (VS Code/Neovim/\u2026)
-  githolon mcp                                            the author-time gate as a stdio MCP server for AI
-                                                       agents (Codex/Claude): tools nomos_check +
-                                                       nomos_evolve_preview. Setup: codex mcp add nomos -- githolon mcp
-  githolon compile  [compiler args]                       compile the package by ./nomos.package.mjs
-  githolon init-editor                                     write .vscode/extensions.json recommending the
-                                                       Nomos Law extension \u2014 the check gate as red
-                                                       squiggles while you type (idempotent)
-  githolon proof    [build/<name>.proof.mts]              run the proof GENERATED from your law, live
-                                                       (every compile emits it; ALL GREEN or it names the jam)
-  githolon harness-install --deploy <deploy.json[,...]>  offline install for the headless TEST HARNESS:
-            --workspace <ws> --out <snapshot>            install tenant law IN-CHAIN (no cloud), write the
-                                                       restore snapshot, print { ok, snapshot, lawHashes }
-  githolon generate <domain|aggregate|intent> <name> [options]
-  githolon g        <domain|aggregate|intent> <name> [options]
+The application surface is one idea:
+  const thing = await app.birth(businessFacts)
 
-Identity (~/.holon/credentials.json \u2014 sessions auto-refresh):
-  githolon login --agent                                  anonymous sign-in: a verified self-onboarded identity
-  githolon login --token <refresh_token>                  adopt an existing captain app session
-  githolon whoami                                         show the principal births will ride + keys on file
-  githolon use [<uid>] [--clear]                          set/show/clear the ACTIVE signing principal: the one
-                                                       deploy/gov/grant/key author as (--as overrides per-cmd)
-  githolon logout                                         clear the session (workspace secrets kept)
-  githolon key enroll [--principal <uid>] [--parent <ws>] [--domain <d>] [--directive <id>] mint a signing device key + enroll it on-chain (the signing directive is DISCOVERED from the parent's installed law; the flags override)
-                                                       (secret stays local; warrants SIGNED governance)
-  githolon key import --principal <uid> --secret <key>    bring an EXISTING admin key into ~/.holon (accepts
-                                                       hex / base64 seed, or --sha256 <passphrase>)
-  githolon key show | export [--principal <uid>]          the device key's public identity (export --yes: secret)
+A born aggregate is a holon: its law, facts, and history travel together. Nomos owns durable identity,
+authorship, local execution, validation, persistence, synchronisation, provenance, and recovery beneath
+that call. Those mechanisms are not separate application workflows.
 
-Governance (SIGNED client-side, relayed as {intentBytes} \u2014 never a host-author endpoint):
-  githolon gov <ws> <directive> [--domain <d>]            author ANY governance directive (domain discovered
-            [--payload <json>]                            from installed law; --domain overrides) as a signed offer
-            [--as <uid>] [--stamp] [--save <file>]        to <ws> (--save signs without relaying; relay later)
-  githolon gov relay <ws> <offer-file>                    relay a saved offer (the only step that hits the cloud)
-  githolon gov rebirth <ws> --reason <text>               LAWFUL SUPERSESSION (recovery verb 3): supersede a
-            [--dry-run [--json]] [--yes]                   scarred chain; --dry-run = READ-ONLY impact report
-  githolon rebirth plan <ws> [--reason <text>] [--out D]  write a stable plan.json + impact.md (rebirths-as-code)
-  githolon rebirth apply --plan <plan.json>               drift-pinned apply of a reviewed plan \u2192 certificate.json
-            --gcp-secret nomos-root-custodian-key [--yes]  (apply needs the ROOT CUSTODIAN seed; --gcp-secret is blessed)
-  githolon replay <ws> --repair                            execute the repair matching a red verify (\u2192 certificate)
-  githolon grant <admin|creation> <principal> [--label L] grant authority at the parent (default root)
-  githolon grant quota <principal> --max <N>              grant a per-principal workspace allowance
-  githolon revoke <admin|creation> <principal>            revoke it (the revoked fact rides the chain)
-                                                       (all gated by the parent's law: only an admin's
-                                                       signature is admitted; --parent <p> targets a platform)
+Useful authoring commands:
+  githolon generate <domain|aggregate|intent> <name>
+  githolon compat <target>
+  githolon lsp
+  githolon mcp
+  githolon login --agent
 
-Nomos Cloud (a bare <ws> resolves from nomos.package.mjs's optional \`workspace\` binding;
-deploy is OPEN + kernel-gated \u2014 births return no host secret, ownership is a ledger fact):
-  githolon ws create <name> [--principal <uid|token>]     birth a workspace (no host secret is issued)
-                                                       (no identity on file? it self-onboards an agent login)
-  githolon ws create <name> --via <parent>                request it as a SIGNED createWorkspace governance
-                                                       offer at the parent
-  githolon ws status [<name>]                             workspace status (lineage, phase, verdicts)
-  githolon ws retire <name> [--parent <ws>]               retire a workspace via a SIGNED governance offer;
-                                                       quota freed; data retained; reads keep serving
-  githolon ws reclaim <name> [--parent <ws>]              lawful custody discard via a SIGNED governance offer
-                                                       (only a retired workspace; never root)
-  githolon deploy [<ws>] [--file <deploy.json>]           deploy build/*.deploy.json \u2014 DEFAULT replace-current:
-            [--keep-beside] [--retire-replaced]           new law becomes active; prior install is superseded
-                                                       per domain key (prints what moved). --keep-beside
-                                                       installs beside; --retire-replaced marks retired
-  githolon domains status <ws>                            per domain key: active law plus superseded/retired
-            [--explain-current-interface]                lineage (active = served now)
-  githolon domains retire <ws> <hashOrKey>                retire an install (marks it retired \u2014 replayable,
-            [--with <hashOrKey>]                          no longer served) via a signed installDomain offer
-  githolon dlq sweep <ws> [--depth <n>] [--full]          sweep a platform subtree's dead-letter queues
-                                                       (registry-enumerated; exit 2 when jams exist)
-  githolon secret set <ws> <push-password>                store a git push password (authenticated git sync)
-  githolon secret rotate <ws>                             RETIRED \u2014 host holds no ownership credential (410)
-
-Git lane (stock git as the sync transport \u2014 main is not push-writable; a workspace is born by its parent):
-  githolon git setup                                      install the credential helper for the cloud host
-  githolon git remote [<ws>] [<remoteName>]               wire this repo to a workspace (default name: nomos)
-                                                       then: git push nomos refs/heads/session/<id>
-
-The local-first lane (mint + assert a holon on YOUR machine, under YOUR identity):
-  githolon ledger init <dir>                              genesis + your compiled law, verified by the SAME
-                                                       wasm gate the cloud runs, written as a git repo
-  githolon ledger verify <dir>                            re-run the chain's self-verification from disk
+Operational and inspection commands remain available to maintain Nomos itself. Ask any command for its
+focused screen: githolon <command> --help (for example: status, replay, scene, deploy, domains, or gov).
 
 Options:
-  --cloud <url>    target cloud (default: $NOMOS_CLOUD or https://nomos.captainapp.co.uk)
-  --target <name>  pick among the project's named workspace targets (workspace: { dev: \u2026, prod: \u2026 })
-  --out <dir>      generate: target directory (default: ${DEFAULT_OUT})
-  --force          generate: overwrite an existing file
-  --dry-run        generate: print to stdout, write nothing
-  -h, --help       top level here; \`githolon <command> --help\` for that command's flags + examples
+  --cloud <url>    target cloud
+  --out <dir>      generate into a different directory (default: ${DEFAULT_OUT})
+  --force          overwrite generated source
+  --dry-run        print generated source without writing it
+  -h, --help       show this page; githolon <command> --help shows one focused command
 `;
 function cloudArgs(rest) {
   const pos = [];
@@ -9745,7 +9774,7 @@ async function runProof(args) {
   const tsxPkg = JSON.parse(readFileSync16(join17(tsxDir, "package.json"), "utf8"));
   const tsxBinRel = typeof tsxPkg.bin === "string" ? tsxPkg.bin : tsxPkg.bin?.["tsx"];
   const tsxCli = join17(tsxDir, tsxBinRel ?? "dist/cli.mjs");
-  console.log("githolon proof --live \u2014 the full cloud loop (throwaway workspace, retired on exit" + (keep ? "; --keep: kept" : "") + ")");
+  console.log("githolon proof --live \u2014 the generated business proof against Nomos Cloud" + (keep ? " (--keep preserves its temporary custody)" : ""));
   const { wsCreate: wsCreate2, wsRetire: wsRetire2 } = await Promise.resolve().then(() => (init_cloud(), cloud_exports));
   const { resolveGovernancePrincipal: resolveGovernancePrincipal2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
   const { login: login2, activePrincipal: activePrincipal2 } = await Promise.resolve().then(() => (init_cloud(), cloud_exports));
@@ -9765,11 +9794,7 @@ async function runProof(args) {
     const cr = await wsCreate2(ws, { via: "root", principal });
     if (cr !== 0) {
       return refuse(
-        `proof --live: registered create refused at root \u2014 principal ${principal} lacks creation authority, and the open birth lane would leak an unretirable workspace.
-  remedies:
-    \u2022 ask an operator: githolon grant creation ${principal}   (then rerun)
-    \u2022 or pre-create a REGISTERED workspace yourself and hand it over: NOMOS_WS=<ws> githolon proof --live
-    \u2022 or develop offline (no cloud workspace at all): githolon proof`
+        `proof --live: Nomos could not establish safe custody for birth as ${principal}. This is a framework failure: no manual grant, key, parent, or provisioning step is part of the application contract. The local business proof remains available with: githolon proof`
       );
     }
   }
@@ -10082,6 +10107,12 @@ ${commandHelp("status")}`);
     }
     return status(pos[0], opts);
   }
+  if (argv[0] === "ws" && argv[1] === "create") {
+    process.stderr.write(
+      "error: `githolon ws create` is not an application birth API. Declare birth(Aggregate, spec) and call the generated app.birth(businessFacts); Nomos owns custody beneath it.\n"
+    );
+    return 1;
+  }
   if (argv[0] === "ws" || argv[0] === "deploy" || argv[0] === "secret") {
     return runCloud(argv);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.98.3",
+  "version": "0.100.0",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -29,8 +29,8 @@
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/client": "^0.98.3",
-    "@githolon/dsl": "^0.98.3",
+    "@githolon/client": "^0.100.0",
+    "@githolon/dsl": "^0.100.0",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {