githolon 0.99.0 → 0.100.1

package/dist/cli.mjs

@@ -3098,6 +3098,8 @@ __export(governance_exports, {
   certifyEra: () => certifyEra,
   consentRebirth: () => consentRebirth,
   discoverSigningDomain: () => discoverSigningDomain,
+  ensureSovereignHome: () => ensureSovereignHome,
+  exchangeOnboardingToken: () => exchangeOnboardingToken,
   executeRepairRebirth: () => executeRepairRebirth,
   governanceOffer: () => governanceOffer,
   governanceRelay: () => governanceRelay,
@@ -3120,6 +3122,8 @@ __export(governance_exports, {
   resolveGovernancePrincipal: () => resolveGovernancePrincipal,
   signAndPostGovernance: () => signAndPostGovernance,
   signAndPostOffer: () => signAndPostOffer,
+  signAndPostWorkspaceBirth: () => signAndPostWorkspaceBirth,
+  signAndPostWorkspaceRetirement: () => signAndPostWorkspaceRetirement,
   validatePlanForApply: () => validatePlanForApply,
   verifyWorkspaceVerdict: () => verifyWorkspaceVerdict
 });
@@ -3195,28 +3199,239 @@ function canonicalPrincipal(principal) {
   return s.includes(":") ? s : `user:${s}`;
 }
 async function signAndPostOffer(ws, domain, directiveId, payload, opts) {
+  return signAndPostPreparedOffer(ws, domain, () => ({ directiveId, payload }), opts);
+}
+async function signAndPostPreparedOffer(ws, domain, prepare, opts, authorMode = "account", preferActor) {
   const cloud = cloudBase(opts.cloud);
   const principal = resolveGovernancePrincipal(opts);
   const holon = await connectGovernance(cloud, ws);
-  const resolvedDomain = domain ?? await discoverSigningDomain(holon, ws, directiveId, void 0);
   const device = await ensureDeviceKey(holon, principal);
+  const accountActor = canonicalPrincipal(principal);
+  const keyActor = `key:${device.keyHash}`;
+  let actor = accountActor;
+  if (preferActor !== void 0 && preferActor === keyActor) {
+    actor = keyActor;
+  } else if (preferActor !== void 0 && sameIdentity(preferActor, accountActor)) {
+    actor = accountActor;
+  } else if (authorMode === "self-if-unenrolled" && typeof holon.parentSignerEnrollment === "function") {
+    try {
+      const posture = await holon.parentSignerEnrollment({ parent: ws, principal: accountActor, keyHash: device.keyHash });
+      if (!posture.enrolled) actor = keyActor;
+    } catch {
+    }
+  }
+  const prepared = prepare(actor);
+  const resolvedDomain = domain ?? await discoverSigningDomain(holon, ws, prepared.directiveId, void 0);
   const sealed = await holon.signGovernanceOffer({
     domain: resolvedDomain,
-    directiveId,
-    payload,
+    directiveId: prepared.directiveId,
+    payload: prepared.payload,
     authorSecret: device.secret,
-    actor: canonicalPrincipal(principal)
+    actor
   });
   if (sealed.intentBytes.length > STAGE_THRESHOLD_CHARS) {
-    const staged = await relaySealedOfferViaStage(cloud, ws, directiveId, sealed.intentBytes, fetch);
+    const staged = await relaySealedOfferViaStage(cloud, ws, prepared.directiveId, sealed.intentBytes, fetch);
     if (staged !== null) {
       out2(`  staged ${staged.size} sealed bytes content-addressed (sha256 ${staged.sha256.slice(0, 16)}\u2026) \u2014 the signed offer names the hash`);
-      return { ...staged.verdict, principal };
+      return { ...staged.verdict, principal, actor, directiveId: prepared.directiveId };
     }
     err2(`this cloud has no /v2/stage content-addressed lane \u2014 relaying the ${sealed.intentBytes.length}-char sealed offer inline (a 413 here means the worker needs upgrading to accept law this large signed)`);
   }
-  const verdict = await holon.postGovernanceOffer({ directiveId, intentBytes: sealed.intentBytes, ws, domain: resolvedDomain });
-  return { ...verdict, principal };
+  const verdict = await holon.postGovernanceOffer({ directiveId: prepared.directiveId, intentBytes: sealed.intentBytes, ws, domain: resolvedDomain });
+  return { ...verdict, principal, actor, directiveId: prepared.directiveId };
+}
+async function signAndPostWorkspaceBirth(parent, name, opts) {
+  return signAndPostPreparedOffer(
+    parent,
+    "workspaces",
+    (actor) => {
+      const identity = lineageIdentity(actor);
+      return {
+        directiveId: "createWorkspace",
+        payload: {
+          name,
+          tier: "edge",
+          parent: parent === "root" ? "" : parent,
+          principal: identity,
+          requestedBy: identity,
+          requestedAt: Date.now()
+        }
+      };
+    },
+    opts,
+    "self-if-unenrolled"
+  );
+}
+async function exchangeOnboardingToken(session, keyHash, idp = process.env["NOMOS_ONBOARDING_IDP"] ?? DEFAULT_ONBOARDING_IDP, fetchImpl = fetch) {
+  const r = await fetchImpl(`${idp.replace(/\/+$/, "")}/token`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${session}`, "content-type": "application/json" },
+    body: JSON.stringify({ nonce: keyHash })
+  });
+  const body = await r.json().catch(() => null);
+  if (!r.ok || typeof body?.token !== "string" || typeof body.issuer !== "string" || typeof body.subject !== "string") {
+    throw new Error(
+      `Nomos could not establish the first device identity (${r.status}): ${String(body?.error ?? "invalid identity-provider response")}`
+    );
+  }
+  return { token: body.token, issuer: body.issuer, subject: body.subject };
+}
+async function ensureSovereignHome(opts = {}) {
+  const cloud = cloudBase(opts.cloud);
+  const uid = opts.principal ?? currentPrincipal();
+  if (!uid) throw new Error("a Nomos session is required \u2014 githolon login --agent");
+  const actor = canonicalPrincipal(uid);
+  if (!actor.startsWith("user:")) throw new Error("blank-session bootstrap requires an identity-provider principal");
+  const bare = actor.slice("user:".length);
+  const auth = await sessionToken();
+  if (!auth) throw new Error("blank-session bootstrap needs the live login session \u2014 githolon login --agent");
+  const client = await import("@githolon/client");
+  const home = await client.homeNameOf(actor);
+  const exists = await fetch(`${cloud}/v2/workspaces/${encodeURIComponent(home)}`).then((r) => r.ok).catch(() => false);
+  const root = await connectGovernance(cloud, "root");
+  const device = await ensureDeviceKey(root, bare);
+  let signerReady = false;
+  if (typeof root.parentSignerEnrollment === "function") {
+    signerReady = await root.parentSignerEnrollment({ parent: "root", principal: actor, keyHash: device.keyHash, authToken: auth }).then((p) => p.enrolled && p.revoked !== true).catch(() => false);
+  }
+  const delegationReady = await fetch(
+    `${cloud}/v2/workspaces/root/workspaces/signerDelegationByUser?user=${encodeURIComponent(actor)}`
+  ).then(async (r) => {
+    if (!r.ok) return false;
+    const d = await r.json();
+    return Array.isArray(d.rows) && d.rows.length > 0;
+  }).catch(() => false);
+  if (!signerReady || !delegationReady) {
+    if (typeof root.enrollFirstDevice !== "function") {
+      throw new Error("the installed @githolon/client predates automatic first-device enrollment");
+    }
+    const assertion = await exchangeOnboardingToken(auth, device.keyHash);
+    if (assertion.subject !== bare) {
+      throw new Error(`identity provider returned '${assertion.subject}' for logged-in principal '${bare}'`);
+    }
+    await root.enrollFirstDevice({
+      parent: "root",
+      domain: "workspaces",
+      principal: actor,
+      device,
+      idToken: assertion.token,
+      authToken: assertion.token,
+      verifiedVia: assertion.issuer
+    });
+  }
+  if (!exists) {
+    const domains = await fetch(`${cloud}/v2/workspaces/root/domains`).then(async (r) => {
+      if (!r.ok) throw new Error(`root law discovery failed (${r.status})`);
+      return await r.json();
+    });
+    const frameworkHash = domains.currentLaw?.["nomos"];
+    const lawHash = domains.currentLaw?.["workspaces"];
+    if (!frameworkHash || !lawHash) throw new Error("root does not report the framework and governance laws needed for birth");
+    const birthCert = await root.certSign({
+      child: home,
+      founder: actor,
+      verified: true,
+      parentKey: device.public,
+      parentId: "root",
+      epoch: 0,
+      secret: device.secret
+    });
+    const now = Date.now();
+    const birth = await fetch(`${cloud}/v2/workspaces/root/workspaces/birthChild`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        name: home,
+        parent: "",
+        principal: bare,
+        tier: "edge",
+        requestedBy: bare,
+        requestedAt: now,
+        foundingAdminHash: device.keyHash,
+        bornAt: new Date(now).toISOString(),
+        frameworkHash,
+        lawHash,
+        platformCert: JSON.stringify(birthCert),
+        actor,
+        authorSecret: device.secret
+      })
+    });
+    const body = await birth.json().catch(() => null);
+    const failed = body?.birthOutcomes?.find((o) => o.status !== "born");
+    if (!birth.ok || body?.ok === false || failed) {
+      throw new Error(
+        `Nomos could not birth the session home (${birth.status}): ${failed?.reason ?? String(body?.error ?? JSON.stringify(body))}`
+      );
+    }
+    const deadline = Date.now() + 3e4;
+    while (Date.now() < deadline) {
+      if (await fetch(`${cloud}/v2/workspaces/${encodeURIComponent(home)}`).then((r) => r.ok).catch(() => false)) break;
+      await new Promise((resolve6) => setTimeout(resolve6, 250));
+    }
+    if (!await fetch(`${cloud}/v2/workspaces/${encodeURIComponent(home)}`).then((r) => r.ok).catch(() => false)) {
+      throw new Error(`Nomos admitted the birth of '${home}' but its custody did not become readable`);
+    }
+    const admin = await signAndPostOffer(
+      home,
+      "workspaces",
+      "grantAdmin",
+      { principal: bare, label: "founding admin", grantedBy: bare, grantedAt: now },
+      { ...opts, principal: bare }
+    );
+    if (!admin.ok) throw new Error(`the born home refused its founding admin (${admin.status}): ${JSON.stringify(admin.body)}`);
+  }
+  const homeHolon = await connectGovernance(cloud, home);
+  const homeSigner = typeof homeHolon.parentSignerEnrollment === "function" ? await homeHolon.parentSignerEnrollment({ parent: home, principal: actor, keyHash: device.keyHash, authToken: auth }).catch(() => null) : null;
+  if (!homeSigner?.verifiedVia) {
+    if (typeof homeHolon.enrollFirstDevice !== "function") {
+      throw new Error("the installed @githolon/client predates verified session-home enrollment");
+    }
+    const assertion = await exchangeOnboardingToken(auth, device.keyHash);
+    if (assertion.subject !== bare) {
+      throw new Error(`identity provider returned '${assertion.subject}' for logged-in principal '${bare}'`);
+    }
+    const domain = await discoverSigningDomain(homeHolon, home, "enrollFirstDevice", "workspaces");
+    await homeHolon.enrollFirstDevice({
+      parent: home,
+      domain,
+      principal: actor,
+      device,
+      idToken: assertion.token,
+      authToken: assertion.token,
+      verifiedVia: assertion.issuer,
+      includeDelegation: false
+    });
+    const object = `identity:${actor}`;
+    const deadline = Date.now() + 3e4;
+    let visible = false;
+    while (Date.now() < deadline) {
+      visible = await fetch(
+        `${cloud}/v2/workspaces/${encodeURIComponent(home)}/workspaces/relationTuplesByObject?object=${encodeURIComponent(object)}`
+      ).then(async (r) => {
+        if (!r.ok) return false;
+        const body = await r.json();
+        const leaf = body.rows?.[0]?.data?.subjects?.[`key:${device.keyHash}`];
+        return typeof leaf?.verifiedVia === "string" && leaf.verifiedVia.length > 0;
+      }).catch(() => false);
+      if (visible) break;
+      await new Promise((resolve6) => setTimeout(resolve6, 250));
+    }
+    if (!visible) throw new Error(`the session home's verified device enrollment did not become readable`);
+  }
+  return { home, principal: actor, device, created: !exists };
+}
+async function signAndPostWorkspaceRetirement(parent, workspaceId, creator, opts) {
+  return signAndPostPreparedOffer(
+    parent,
+    "workspaces",
+    (actor) => ({
+      directiveId: creator !== "" && sameIdentity(creator, actor) ? "retireOwnWorkspace" : "retireWorkspace",
+      payload: { workspaceId, retiredBy: lineageIdentity(actor), retiredAt: Date.now() }
+    }),
+    opts,
+    "self-if-unenrolled",
+    creator
+  );
 }
 async function relaySealedOfferViaStage(cloud, ws, directiveId, intentBytesB64, fetchImpl) {
   const raw = Buffer.from(intentBytesB64, "base64");
@@ -4517,13 +4732,16 @@ function readSealedIntentBytes(eng, ws, intentOut) {
   if (f?.data === void 0) return void 0;
   return Buffer.from(f.data).toString("base64");
 }
-var out2, err2, STAGE_THRESHOLD_CHARS, HONEST_CEILING, ROOT_CUSTODIAN_SECRET, CLIENT_IMPACT;
+var out2, err2, lineageIdentity, sameIdentity, DEFAULT_ONBOARDING_IDP, STAGE_THRESHOLD_CHARS, HONEST_CEILING, ROOT_CUSTODIAN_SECRET, CLIENT_IMPACT;
 var init_governance = __esm({
   "src/governance.ts"() {
     "use strict";
     init_cloud();
     out2 = (s) => void process.stdout.write(s + "\n");
     err2 = (s) => void process.stderr.write("error: " + s + "\n");
+    lineageIdentity = (actor) => actor.startsWith("user:") ? actor.slice("user:".length) : actor;
+    sameIdentity = (a, b) => lineageIdentity(a) === lineageIdentity(b);
+    DEFAULT_ONBOARDING_IDP = "https://id.nomos.captainapp.co.uk";
     STAGE_THRESHOLD_CHARS = 4 * 1024 * 1024;
     HONEST_CEILING = `The operator controls root's law and could deploy law removing the consent check \u2014 but that act is itself a signed, ordered, permanent fact in root's chain, visible to every tenant running \`replay root\`, and grounds for exit-with-everything. Not "we can't" \u2014 "we can't secretly, and you can always leave."`;
     ROOT_CUSTODIAN_SECRET = "nomos-root-custodian-key";
@@ -5181,16 +5399,10 @@ async function logout() {
 async function wsCreate(name, opts) {
   const cloud = cloudBase(opts.cloud);
   if (opts.via !== void 0) {
-    const { signAndPostGovernance: signAndPostGovernance2, resolveGovernancePrincipal: resolveGovernancePrincipal2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
+    const { signAndPostWorkspaceBirth: signAndPostWorkspaceBirth2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
     let v;
     try {
-      const principal2 = resolveGovernancePrincipal2(opts);
-      v = await signAndPostGovernance2(
-        opts.via,
-        "createWorkspace",
-        { name, tier: "edge", parent: opts.via === "root" ? "" : opts.via, principal: principal2, requestedBy: principal2, requestedAt: Date.now() },
-        opts
-      );
+      v = await signAndPostWorkspaceBirth2(opts.via, name, opts);
     } catch (e) {
       err4(e.message);
       return 1;
@@ -5259,7 +5471,7 @@ async function wsStatus(name, opts) {
 }
 async function wsRetire(ws, opts) {
   const cloud = cloudBase(opts.cloud);
-  const { signAndPostGovernance: signAndPostGovernance2, resolveGovernancePrincipal: resolveGovernancePrincipal2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
+  const { signAndPostWorkspaceRetirement: signAndPostWorkspaceRetirement2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
   const parent = opts.parent ?? "root";
   let record;
   try {
@@ -5280,12 +5492,8 @@ async function wsRetire(ws, opts) {
   }
   let v;
   try {
-    const principal = resolveGovernancePrincipal2(opts);
-    const payload = { workspaceId: recordId, retiredBy: principal, retiredAt: Date.now() };
-    const bare = (s) => s.startsWith("user:") ? s.slice(5) : s;
     const creator = record?.data?.createdBy ?? record?.data?.principal ?? "";
-    const own = creator !== "" && bare(creator) === bare(principal);
-    v = await signAndPostGovernance2(parent, own ? "retireOwnWorkspace" : "retireWorkspace", payload, opts);
+    v = await signAndPostWorkspaceRetirement2(parent, recordId, creator, opts);
   } catch (e) {
     err4(e.message);
     return 1;
@@ -6083,7 +6291,11 @@ async function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
     const checks = downgraded.certChecks !== void 0 ? ` certChecks=${JSON.stringify(downgraded.certChecks)}` : "";
     lines.push(`\u26A0 child ${childWs} was born UNWARRANTED \u2014 ${String(downgraded.reason ?? "cert not seeded")}${checks}`);
   }
-  lines.push(`\u2713 child birth ${cb.parentDomain}/${cb.birthDirectiveId} \u2014 ${childWs} born (the offer-effect folded the child genesis through the child's OWN gate)`);
+  if (cb.businessAggregateId !== void 0) {
+    lines.push(`\u2713 birth(${cb.businessAggregateId}) \u2014 business facts became a durable holon`);
+  } else {
+    lines.push(`\u2713 child birth ${cb.parentDomain}/${cb.birthDirectiveId} \u2014 ${childWs} born (the offer-effect folded the child genesis through the child's OWN gate)`);
+  }
   const installed = (hash) => {
     try {
       return qById(eng, childWs, `domain-installation:${hash}`).length > 0;
@@ -6097,7 +6309,11 @@ async function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
   if (!installed(lawHash)) {
     return done(false, `the born child ${childWs} did not install the child law in-chain (domain-installation:${lawHash.slice(0, 12)}\u2026 absent) \u2014 the genesis nomos/installDomain did not fold (by-hash byte routing failed: does the parent fold this law?)`);
   }
-  lines.push(`\u2713 the born child installed the framework + child law IN-CHAIN (the genesis installDomain\xD72 folded)`);
+  if (cb.businessAggregateId !== void 0) {
+    lines.push(`\u2713 law travelled with ${cb.businessAggregateId} and admitted its first business fact`);
+  } else {
+    lines.push(`\u2713 the born child installed the framework + child law IN-CHAIN (the genesis installDomain\xD72 folded)`);
+  }
   let seedRows = [];
   if (cb.childSeedInstanceId !== void 0) {
     try {
@@ -6116,7 +6332,9 @@ async function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
   if ((cb.childSeedInstanceId !== void 0 || cb.childQuery !== void 0) && seedRows.length < 1) {
     return done(false, `the born child ${childWs} did not seed ${cb.childSeedAggregateId ?? "its genesis record"} (${cb.childSeedDirectiveId} produced no readable row) \u2014 the child genesis seed did not run`);
   }
-  lines.push(`\u2713 the born child's genesis seed ran \u2014 ${cb.childSeedDirectiveId} produced ${seedRows.length} readable ${cb.childSeedAggregateId ?? "row"}(s) in ${childWs}`);
+  if (cb.businessAggregateId === void 0) {
+    lines.push(`\u2713 the born child's genesis seed ran \u2014 ${cb.childSeedDirectiveId} produced ${seedRows.length} readable ${cb.childSeedAggregateId ?? "row"}(s) in ${childWs}`);
+  }
   let verdict;
   try {
     verdict = verifyChainLocal(eng, childWs);
@@ -6126,7 +6344,11 @@ async function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
   if (verdict.valid !== true) {
     return done(false, `the born child ${childWs} FAILED verify_chain at ${verdict.check ?? "?"}${verdict.atIndex !== void 0 ? ` (intent ${verdict.atIndex})` : ""}: ${verdict.error ?? "invalid"} \u2014 the child's own gate refused its genesis`);
   }
-  lines.push(`\u2713 verify_chain GREEN on the born child ${childWs} (${verdict.plansRerun ?? "?"} plans re-run \u2014 it self-validates from intent 0 through its OWN gate)`);
+  if (cb.businessAggregateId !== void 0) {
+    lines.push(`\u2713 full history replayed green locally (${verdict.plansRerun ?? "?"} plans re-run)`);
+  } else {
+    lines.push(`\u2713 verify_chain GREEN on the born child ${childWs} (${verdict.plansRerun ?? "?"} plans re-run \u2014 it self-validates from intent 0 through its OWN gate)`);
+  }
   const bornEntry = (res.born ?? []).find((b) => b?.workspace === childWs);
   const packed = packBornChildren(eng, bornEntry === void 0 ? [] : [bornEntry]);
   const childPack = packed.find((b) => b.workspace === childWs);
@@ -6148,7 +6370,11 @@ async function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
       return done(false, `the recovered child ${childWs} verified but its business root ${cb.childSeedInstanceId} was missing`);
     }
   }
-  lines.push(`\u2713 persistence + recovery \u2014 child custody packed, resident copy discarded, verify_chain GREEN and ${cb.childSeedInstanceId ?? cb.childSeedAggregateId ?? "the business root"} readable after reopen`);
+  if (cb.businessAggregateId !== void 0) {
+    lines.push(`\u2713 persistence + recovery \u2014 evicted, restored from durable custody, and ${cb.businessAggregateId} read back`);
+  } else {
+    lines.push(`\u2713 persistence + recovery \u2014 child custody packed, resident copy discarded, verify_chain GREEN and ${cb.childSeedInstanceId ?? cb.childSeedAggregateId ?? "the business root"} readable after reopen`);
+  }
   return done(true);
 }
 function seatRelationAuthority(eng, ws, lawHash, rb, actor, stamp, lines, authorSecret, subjectActor = actor) {
@@ -6388,7 +6614,7 @@ async function runOfflineProofStandalone(proofPath, cloud, domain) {
   }
   const deployBody = JSON.parse(readFileSync7(deployFile, "utf8"));
   const lawHash = await sha256hex(deployBody.packageUsda);
-  console.log(`githolon proof \u2014 OFFLINE legs on a local holon (the cloud loop: githolon proof --live)`);
+  console.log(`githolon proof \u2014 generated business proof in the real local engine`);
   const runtimeKind = legs.childBirth !== void 0 || (legs.childBirths?.length ?? 0) > 0 ? "test-mint" : "production";
   const { eng } = await holonEngine(cloud, deployBody, "githolon-proof", runtimeKind);
   const ws = "proof-offline";
@@ -6403,7 +6629,7 @@ async function runOfflineProofStandalone(proofPath, cloud, domain) {
   }
   console.log(`
 OFFLINE PROOF GREEN (${Math.round(v.ms)}ms) \u2014 the same legs rerun on every save in \`githolon dev\`.`);
-  console.log(`Deploy with confidence when ready: githolon ws create <ws> && githolon deploy <ws>   (or the full cloud proof: githolon proof --live)`);
+  console.log(`Run the same generated business proof against Nomos Cloud when ready: githolon proof --live`);
   return 0;
 }
 var keyHashOf, OFFLINE_PROOF_VERIFIER;
@@ -8822,9 +9048,9 @@ var HELP = {
     examples: ["githolon compile", "githolon compile nomos.package.mjs --layered"]
   },
   proof: {
-    usage: "githolon proof [build/<name>.proof.mts] [--domain <key>] [--live] [--keep]",
-    what: "Run the proof GENERATED from your law. DEFAULT: the OFFLINE legs on a LOCAL holon \u2014 the\nsame engine plane the cloud edge runs; no cloud workspace is touched (develop/play/understand\nhere, deploy with confidence after). --domain <key> proves a SPECIFIC domain of a multi-domain\npackage (offline; the default is the first). --live runs the full cloud loop (throwaway\nworkspace \u2192 deploy \u2192 offline write \u2192 admission \u2192 cloud reads \u2192 convergence). The throwaway is\ncreated REGISTERED (a signed createWorkspace at root \u2014 your principal needs creation authority\nthere) and RETIRED on every exit via the lawful retireOwnWorkspace; --keep keeps it. ALL GREEN or it names the jam. The offline\nlegs also rerun on every save in `githolon dev`.",
-    examples: ["githolon proof", "githolon proof --domain co2_platform", "githolon proof --live", "githolon proof --live --keep"]
+    usage: "githolon proof [build/<name>.proof.mts] [--domain <key>] [--live]",
+    what: "Run the proof GENERATED from your business law. By default it drives the real local engine:\nbirth, full-history verification, durable custody, eviction, restore, and read-back. --live runs the\nsame business proof against Nomos Cloud; identity, provisioning, persistence, and cleanup remain\ninside Nomos. --domain selects one domain in a multi-domain package. ALL GREEN or it names the jam.",
+    examples: ["githolon proof", "githolon proof --domain co2_platform", "githolon proof --live"]
   },
   dev: {
     usage: "githolon dev [--port <n>] [--cloud <url>] [--once]",
@@ -8911,7 +9137,7 @@ var HELP = {
   },
   login: {
     usage: "githolon login --agent | --token <refresh_token>",
-    what: "Establish the principal births ride. --agent self-onboards an anonymous VERIFIED identity\n(no human, no browser; linkable later); --token adopts an existing captain app session.\nSessions live in ~/.holon/credentials.json and auto-refresh.",
+    what: "Establish the identity Nomos uses beneath birth. --agent creates a verified development identity\n(no browser; linkable later); --token adopts an existing session. Credentials auto-refresh.",
     examples: ["githolon login --agent", "githolon login --token <refresh_token>"]
   },
   whoami: {
@@ -8932,16 +9158,14 @@ var HELP = {
     what: "Clear the session. Stored workspace secrets are KEPT."
   },
   ws: {
-    usage: "githolon ws <create|status|retire|reclaim> [<name>] [--principal <uid|token>] [--via <parent>] [--parent <ws>] [--cloud <url>] [--target <name>]",
-    what: "Workspace lifecycle on Nomos Cloud. `create` births one (NO host secret is issued \u2014\nownership is a ledger fact; deploy is open + kernel-gated) or, with --via <parent>, requests it\nas a SIGNED createWorkspace governance offer. `status` shows lineage/phase/verdicts. `retire`\nand `reclaim` are SIGNED governance offers to the parent (default root) \u2014 never host-author\nendpoints; retire withdraws the law (data retained), reclaim authorizes the bailiff to drop\ncustody (only a retired workspace; never root). `status` with no <name> resolves the project's\n`workspace` binding.",
+    usage: "githolon ws <status|retire|reclaim> [<name>] [--parent <ws>] [--cloud <url>] [--target <name>]",
+    what: "Operator inspection and disposal of existing cloud custody. Application creation is not here:\ndeclare birth(Aggregate, spec) and call the generated app.birth(businessFacts). `status` inspects\nlineage and verdicts; `retire` withdraws law while retaining data; `reclaim` discards custody only\nafter retirement.",
     flags: [
-      ["--principal <p>", "the birth's principal (uid or access token; remembered as the default)"],
-      ["--via <parent>", "ws create: sign a createWorkspace offer at <parent> instead of the raw birth"],
       ["--parent <ws>", "retire/reclaim: the governance workspace to sign against (default root)"],
       ["--cloud <url>", "target cloud (default: $NOMOS_CLOUD or the public cloud)"],
       ["--target <name>", "ws status: pick among the project's named workspace targets"]
     ],
-    examples: ["githolon ws create my-guestbook", "githolon ws create app1 --via co2", "githolon ws status", "githolon ws retire my-guestbook"]
+    examples: ["githolon ws status", "githolon ws retire my-guestbook"]
   },
   key: {
     usage: "githolon key <enroll|show|import|export> [--principal <uid>] [--secret <key>] [--sha256] [--format hex|base64] [--parent <ws>] [--yes]",
@@ -8977,9 +9201,8 @@ var HELP = {
     ],
     examples: [
       `githolon gov root grantCreation --payload '{"principal":"d205ca94-\u2026"}' --as 32c7100e-\u2026 --stamp`,
-      "githolon gov co2-platform birthHome --payload-file home.json --as d205ca94-\u2026",
-      "githolon gov root birthChild --payload-file co2.json --as 32c7100e-\u2026 --save co2.offer.json",
-      "githolon gov relay root co2.offer.json"
+      "githolon gov root setGovernancePosture --payload-file posture.json --as 32c7100e-\u2026 --save posture.offer.json",
+      "githolon gov relay root posture.offer.json"
     ]
   },
   rebirth: {
@@ -9050,12 +9273,12 @@ var HELP = {
   },
   git: {
     usage: "githolon git <setup | remote [<ws>] [<remoteName>]> [--cloud <url>] [--target <name>]",
-    what: "Stock git as the sync transport. `setup` installs the credential helper for the cloud host;\n`remote` wires this repo to a workspace (then push your session branch: git push nomos\nrefs/heads/session/<id>). `main` is not push-writable \u2014 a workspace is born by its PARENT\nauthoring its birth (birthHome/birthChild), never by a push. With no <ws>, the project's\n`workspace` binding resolves it.",
+    what: "Operator transport plumbing for existing holons. `setup` installs the credential helper;\n`remote` wires a local repo to existing cloud custody. Application code does not use git to\ncreate business things; it calls the generated birth(businessFacts).",
     examples: ["githolon git setup", "githolon git remote my-guestbook", "git push nomos refs/heads/session/dev"]
   },
   ledger: {
     usage: "githolon ledger <init|verify> <dir> [--file <deploy.json>] [--cloud <url>]",
-    what: "Mint + assert a holon ON YOUR MACHINE. `init` writes genesis + your compiled law as a normal\ngit repo, verified by the SAME wasm gate the cloud runs; `verify` re-runs the chain's\nself-verification from disk. Push the repo to an unborn workspace to birth it.",
+    what: "Low-level local custody and verification for framework development. `init` writes compiled\nlaw into a git-backed holon; `verify` replays its full history. Application packages use the\ngenerated birth(businessFacts) surface instead.",
     examples: ["githolon ledger init ./my-holon", "githolon ledger verify ./my-holon"]
   }
 };
@@ -9555,117 +9778,37 @@ async function status(wsArg, opts) {
 // src/cli.ts
 var KINDS = ["domain", "aggregate", "intent"];
 var DEFAULT_OUT = "domains";
-var USAGE = `githolon \u2014 the Nomos developer CLI
+var USAGE = `githolon \u2014 model a business; Nomos owns the compute science
 
-The inner loop:
-  githolon dev                                            watch \u2192 recompile \u2192 law LIVE in a local holon \u2192
-                                                       the generated proof's offline legs rerun \u2192 local
-                                                       reads served \u2014 sub-second, offline after warmup
-  githolon status [<ws>]                                  local law hash vs the DEPLOYED law, remedy named
-  githolon replay <ws|dir>                                the ledger as film: step the chain intent-by-
-                                                       intent; finale = the verify_chain verdict
-  githolon scene <ws|dir> [--out <dir>]                   the ledger as a PORTABLE USD scene: verify_chain-
-                                                       gated chain\u2192USD projection (.usda + .usdz, loads
-                                                       in three.js/usdview/QuickLook; timeCode = index)
-  githolon decrypt <ws> --as <p> --secret <b64>          clone + decrypt as a principal: unwrap their scope
-            --query <id> [--param k=v]                   keys from the chain, read private fields in cleartext
+Start here:
+  githolon compile                 compile aggregates, birth, directives, and reads into law + a typed client
+  githolon proof                   run the generated business proof in the real local engine
+  githolon dev                     watch, compile, and rerun that proof on every save
+  githolon check                   explain anything the law can already prove it would refuse
 
-Authoring:
-  githolon check    [config] [--json] [--against <p>]     run the author-time gate (static twins) on
-                                                       ./nomos.package.mjs \u2014 the unified report; exits
-                                                       non-zero on any REFUSE (compile runs it implicitly).
-                                                       --json emits the findings (with file:line) as an array
-  githolon compat  <ws-url|deploy.json|dir> [--json]      THE CI GATE: compare the current build's interface
-                                                       against a target's installed law, PER MEMBER (#72
-                                                       subtyping); exits non-zero on any incompatible member
-  githolon lsp                                            the author-time gate as a stdio Language Server:
-                                                       red squiggles while you write law (VS Code/Neovim/\u2026)
-  githolon mcp                                            the author-time gate as a stdio MCP server for AI
-                                                       agents (Codex/Claude): tools nomos_check +
-                                                       nomos_evolve_preview. Setup: codex mcp add nomos -- githolon mcp
-  githolon compile  [compiler args]                       compile the package by ./nomos.package.mjs
-  githolon init-editor                                     write .vscode/extensions.json recommending the
-                                                       Nomos Law extension \u2014 the check gate as red
-                                                       squiggles while you type (idempotent)
-  githolon proof    [build/<name>.proof.mts]              run the proof GENERATED from your law, live
-                                                       (every compile emits it; ALL GREEN or it names the jam)
-  githolon harness-install --deploy <deploy.json[,...]>  offline install for the headless TEST HARNESS:
-            --workspace <ws> --out <snapshot>            install tenant law IN-CHAIN (no cloud), write the
-                                                       restore snapshot, print { ok, snapshot, lawHashes }
-  githolon generate <domain|aggregate|intent> <name> [options]
-  githolon g        <domain|aggregate|intent> <name> [options]
+The application surface is one idea:
+  const thing = await app.birth(businessFacts)
 
-Identity (~/.holon/credentials.json \u2014 sessions auto-refresh):
-  githolon login --agent                                  anonymous sign-in: a verified self-onboarded identity
-  githolon login --token <refresh_token>                  adopt an existing captain app session
-  githolon whoami                                         show the principal births will ride + keys on file
-  githolon use [<uid>] [--clear]                          set/show/clear the ACTIVE signing principal: the one
-                                                       deploy/gov/grant/key author as (--as overrides per-cmd)
-  githolon logout                                         clear the session (workspace secrets kept)
-  githolon key enroll [--principal <uid>] [--parent <ws>] [--domain <d>] [--directive <id>] mint a signing device key + enroll it on-chain (the signing directive is DISCOVERED from the parent's installed law; the flags override)
-                                                       (secret stays local; warrants SIGNED governance)
-  githolon key import --principal <uid> --secret <key>    bring an EXISTING admin key into ~/.holon (accepts
-                                                       hex / base64 seed, or --sha256 <passphrase>)
-  githolon key show | export [--principal <uid>]          the device key's public identity (export --yes: secret)
+A born aggregate is a holon: its law, facts, and history travel together. Nomos owns durable identity,
+authorship, local execution, validation, persistence, synchronisation, provenance, and recovery beneath
+that call. Those mechanisms are not separate application workflows.
 
-Governance (SIGNED client-side, relayed as {intentBytes} \u2014 never a host-author endpoint):
-  githolon gov <ws> <directive> [--domain <d>]            author ANY governance directive (domain discovered
-            [--payload <json>]                            from installed law; --domain overrides) as a signed offer
-            [--as <uid>] [--stamp] [--save <file>]        to <ws> (--save signs without relaying; relay later)
-  githolon gov relay <ws> <offer-file>                    relay a saved offer (the only step that hits the cloud)
-  githolon gov rebirth <ws> --reason <text>               LAWFUL SUPERSESSION (recovery verb 3): supersede a
-            [--dry-run [--json]] [--yes]                   scarred chain; --dry-run = READ-ONLY impact report
-  githolon rebirth plan <ws> [--reason <text>] [--out D]  write a stable plan.json + impact.md (rebirths-as-code)
-  githolon rebirth apply --plan <plan.json>               drift-pinned apply of a reviewed plan \u2192 certificate.json
-            --gcp-secret nomos-root-custodian-key [--yes]  (apply needs the ROOT CUSTODIAN seed; --gcp-secret is blessed)
-  githolon replay <ws> --repair                            execute the repair matching a red verify (\u2192 certificate)
-  githolon grant <admin|creation> <principal> [--label L] grant authority at the parent (default root)
-  githolon grant quota <principal> --max <N>              grant a per-principal workspace allowance
-  githolon revoke <admin|creation> <principal>            revoke it (the revoked fact rides the chain)
-                                                       (all gated by the parent's law: only an admin's
-                                                       signature is admitted; --parent <p> targets a platform)
+Useful authoring commands:
+  githolon generate <domain|aggregate|intent> <name>
+  githolon compat <target>
+  githolon lsp
+  githolon mcp
+  githolon login --agent
 
-Nomos Cloud (a bare <ws> resolves from nomos.package.mjs's optional \`workspace\` binding;
-deploy is OPEN + kernel-gated \u2014 births return no host secret, ownership is a ledger fact):
-  githolon ws create <name> [--principal <uid|token>]     birth a workspace (no host secret is issued)
-                                                       (no identity on file? it self-onboards an agent login)
-  githolon ws create <name> --via <parent>                request it as a SIGNED createWorkspace governance
-                                                       offer at the parent
-  githolon ws status [<name>]                             workspace status (lineage, phase, verdicts)
-  githolon ws retire <name> [--parent <ws>]               retire a workspace via a SIGNED governance offer;
-                                                       quota freed; data retained; reads keep serving
-  githolon ws reclaim <name> [--parent <ws>]              lawful custody discard via a SIGNED governance offer
-                                                       (only a retired workspace; never root)
-  githolon deploy [<ws>] [--file <deploy.json>]           deploy build/*.deploy.json \u2014 DEFAULT replace-current:
-            [--keep-beside] [--retire-replaced]           new law becomes active; prior install is superseded
-                                                       per domain key (prints what moved). --keep-beside
-                                                       installs beside; --retire-replaced marks retired
-  githolon domains status <ws>                            per domain key: active law plus superseded/retired
-            [--explain-current-interface]                lineage (active = served now)
-  githolon domains retire <ws> <hashOrKey>                retire an install (marks it retired \u2014 replayable,
-            [--with <hashOrKey>]                          no longer served) via a signed installDomain offer
-  githolon dlq sweep <ws> [--depth <n>] [--full]          sweep a platform subtree's dead-letter queues
-                                                       (registry-enumerated; exit 2 when jams exist)
-  githolon secret set <ws> <push-password>                store a git push password (authenticated git sync)
-  githolon secret rotate <ws>                             RETIRED \u2014 host holds no ownership credential (410)
-
-Git lane (stock git as the sync transport \u2014 main is not push-writable; a workspace is born by its parent):
-  githolon git setup                                      install the credential helper for the cloud host
-  githolon git remote [<ws>] [<remoteName>]               wire this repo to a workspace (default name: nomos)
-                                                       then: git push nomos refs/heads/session/<id>
-
-The local-first lane (mint + assert a holon on YOUR machine, under YOUR identity):
-  githolon ledger init <dir>                              genesis + your compiled law, verified by the SAME
-                                                       wasm gate the cloud runs, written as a git repo
-  githolon ledger verify <dir>                            re-run the chain's self-verification from disk
+Operational and inspection commands remain available to maintain Nomos itself. Ask any command for its
+focused screen: githolon <command> --help (for example: status, replay, scene, deploy, domains, or gov).
 
 Options:
-  --cloud <url>    target cloud (default: $NOMOS_CLOUD or https://nomos.captainapp.co.uk)
-  --target <name>  pick among the project's named workspace targets (workspace: { dev: \u2026, prod: \u2026 })
-  --out <dir>      generate: target directory (default: ${DEFAULT_OUT})
-  --force          generate: overwrite an existing file
-  --dry-run        generate: print to stdout, write nothing
-  -h, --help       top level here; \`githolon <command> --help\` for that command's flags + examples
+  --cloud <url>    target cloud
+  --out <dir>      generate into a different directory (default: ${DEFAULT_OUT})
+  --force          overwrite generated source
+  --dry-run        print generated source without writing it
+  -h, --help       show this page; githolon <command> --help shows one focused command
 `;
 function cloudArgs(rest) {
   const pos = [];
@@ -9771,8 +9914,7 @@ async function runProof(args) {
     return 1;
   };
   const live = args.includes("--live");
-  const keep = args.includes("--keep");
-  if (keep && !live) return refuse("--keep only applies to --live (the offline proof creates no cloud workspace to keep)");
+  if (args.includes("--keep")) return refuse("--keep no longer applies: proof --live uses your durable signed Nomos home and creates only the requested business aggregate");
   let domain;
   let domainValueIdx = -1;
   const di = args.findIndex((a) => a === "--domain" || a.startsWith("--domain="));
@@ -9839,58 +9981,40 @@ async function runProof(args) {
   const tsxPkg = JSON.parse(readFileSync16(join17(tsxDir, "package.json"), "utf8"));
   const tsxBinRel = typeof tsxPkg.bin === "string" ? tsxPkg.bin : tsxPkg.bin?.["tsx"];
   const tsxCli = join17(tsxDir, tsxBinRel ?? "dist/cli.mjs");
-  console.log("githolon proof --live \u2014 the full cloud loop (throwaway workspace, retired on exit" + (keep ? "; --keep: kept" : "") + ")");
-  const { wsCreate: wsCreate2, wsRetire: wsRetire2 } = await Promise.resolve().then(() => (init_cloud(), cloud_exports));
-  const { resolveGovernancePrincipal: resolveGovernancePrincipal2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
-  const { login: login2, activePrincipal: activePrincipal2 } = await Promise.resolve().then(() => (init_cloud(), cloud_exports));
-  let principal = process.env.NOMOS_PRINCIPAL;
-  try {
-    principal ??= resolveGovernancePrincipal2({});
-  } catch {
-    const lr = await login2({ agent: true });
-    principal = lr === 0 ? activePrincipal2() : void 0;
+  console.log("githolon proof --live \u2014 one generated app.birth against Nomos Cloud");
+  const { ensureSovereignHome: ensureSovereignHome2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
+  if (currentPrincipal() === void 0) {
+    const lr = await login({ agent: true });
+    if (lr !== 0) {
+      return refuse("proof --live needs a login \u2014 githolon login --agent failed; try it directly");
+    }
   }
-  if (principal === void 0) {
+  if (currentPrincipal() === void 0) {
     return refuse("proof --live needs a principal \u2014 githolon login --agent (self-onboarding) failed; try it directly or pass NOMOS_PRINCIPAL");
   }
-  const proofSlug = proofPath.split("/").pop().replace(/\.proof\.mts$/, "").toLowerCase().replace(/[^a-z0-9-]+/g, "-");
-  const ws = process.env.NOMOS_WS ?? `${proofSlug}-proof-${Math.random().toString(36).slice(2, 8)}`;
-  if (process.env.NOMOS_WS === void 0) {
-    const cr = await wsCreate2(ws, { via: "root", principal });
-    if (cr !== 0) {
-      return refuse(
-        `proof --live: registered create refused at root \u2014 principal ${principal} lacks creation authority, and the open birth lane would leak an unretirable workspace.
-  remedies:
-    \u2022 ask an operator: githolon grant creation ${principal}   (then rerun)
-    \u2022 or pre-create a REGISTERED workspace yourself and hand it over: NOMOS_WS=<ws> githolon proof --live
-    \u2022 or develop offline (no cloud workspace at all): githolon proof`
-      );
-    }
+  let home;
+  try {
+    home = await ensureSovereignHome2();
+  } catch (e) {
+    return refuse(
+      `proof --live: Nomos could not establish the signed session home: ${e.message}. No certificate, signer, parent, or provisioning step is part of the application contract.`
+    );
   }
+  const barePrincipal = home.principal.startsWith("user:") ? home.principal.slice("user:".length) : home.principal;
+  const deployed = await deploy2(home.home, { principal: barePrincipal });
+  if (deployed !== 0) return refuse("proof --live: Nomos could not install the compiled business law into the signed session home");
   const r = spawnSync6(process.execPath, [tsxCli, proofPath], {
     stdio: "inherit",
     cwd: process.cwd(),
     env: {
       ...process.env,
-      NOMOS_WS: ws,
-      NOMOS_PRINCIPAL: principal,
-      NOMOS_PROOF_MANAGED: "1",
-      // the proof skips its own (dead) cleanup lane; the CLI retires below
-      ...keep ? { PROOF_KEEP: "1" } : {}
+      NOMOS_WS: home.home,
+      NOMOS_PRINCIPAL: home.principal,
+      NOMOS_AUTHOR_SECRET: home.device.secret,
+      NOMOS_PROOF_MANAGED: "1"
     }
   });
-  const proofStatus = r.status ?? 1;
-  if (keep) {
-    console.log(`workspace ${ws} KEPT (--keep) \u2014 retire it when done: githolon ws retire ${ws}`);
-    return proofStatus;
-  }
-  const rr = await wsRetire2(ws, { principal }).catch(() => 1);
-  if (rr !== 0) {
-    console.error(`\u26A0 THROWAWAY WORKSPACE NOT RETIRED: ${ws}`);
-    console.error(`\u26A0 retire it manually: githolon ws retire ${ws}`);
-    console.error(`\u26A0 (if it has no root registry row it was born unregistered and needs a custodian sweep)`);
-  }
-  return proofStatus;
+  return r.status ?? 1;
 }
 function parseArgs(argv) {
   const [command, ...rest] = argv;
@@ -10176,6 +10300,12 @@ ${commandHelp("status")}`);
     }
     return status(pos[0], opts);
   }
+  if (argv[0] === "ws" && argv[1] === "create") {
+    process.stderr.write(
+      "error: `githolon ws create` is not an application birth API. Declare birth(Aggregate, spec) and call the generated app.birth(businessFacts); Nomos owns custody beneath it.\n"
+    );
+    return 1;
+  }
   if (argv[0] === "ws" || argv[0] === "deploy" || argv[0] === "secret") {
     return runCloud(argv);
   }

package/dist/dev-server.mjs

@@ -1851,7 +1851,21 @@ function resolveGatewayOperation(spec, opName, method) {
   const exactPath = `/${String(opName).replace(/^\/+/, "")}`;
   const exact = spec.paths[exactPath]?.[normalizedMethod];
   if (exact) return { op: exact, path: exactPath, ambiguous: null };
-  if (String(opName).includes("/")) return { op: null };
+  const slash = String(opName).indexOf("/");
+  if (slash > 0) {
+    const requestedDomain = String(opName).slice(0, slash);
+    const requestedAlias = String(opName).slice(slash + 1);
+    const matches2 = [];
+    for (const [path2, methods] of Object.entries(spec.paths)) {
+      const op = methods?.[normalizedMethod];
+      const x = op?.["x-nomos"];
+      if (!op || !x || x.domain !== requestedDomain) continue;
+      if (aliasIdsFor(x, path2).has(requestedAlias)) matches2.push({ op, path: path2 });
+    }
+    if (matches2.length === 1) return { ...matches2[0], ambiguous: null };
+    if (matches2.length > 1) return { op: null, ambiguous: matches2.map((m) => m.path).sort() };
+    return { op: null, ambiguous: null };
+  }
   const matches = [];
   for (const [path2, methods] of Object.entries(spec.paths)) {
     const op = methods?.[normalizedMethod];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.99.0",
+  "version": "0.100.1",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -29,8 +29,8 @@
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/client": "^0.99.0",
-    "@githolon/dsl": "^0.99.0",
+    "@githolon/client": "^0.100.1",
+    "@githolon/dsl": "^0.100.1",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {