@githolon/dsl 0.100.5 → 0.101.0

package/dart/lib/src/test_harness.dart

@@ -24,7 +24,7 @@
 //      snapshot (`restoreFrom`). Every other URL is REFUSED — a stray fetch fails loudly, never reaches the net.
 //
 // PREREQUISITES (documented so a failure is legible): `node` on PATH; a resolvable
-// `@githolon/client/runner/node-entry.ts`; and a warm `~/.holon/runtime` cache (holon.wasm + packages.json —
+// `@githolon/client/runner/node-entry.ts`; and a warm `~/.holon/runtime` cache (holon-testmint.wasm + packages.json —
 // one `githolon` run fills it). All local; no network at test time.
 //
 // PACKAGING NOTE: `offline-install.ts` imports the adapter engine, which today lives beside the in-repo
@@ -173,8 +173,8 @@ class NomosTestHarness {
     return session(ws);
   }
 
-  NomosTestHarness._(this.bridge, this.workspace, this._transport, this._workdir,
-      this._onDiagnostic, List<String> sessionNames,
+  NomosTestHarness._(this.bridge, this.workspace, this._transport,
+      this._workdir, this._onDiagnostic, List<String> sessionNames,
       {Map<String, String> devicePublics = const {},
       Map<String, String> deviceSecrets = const {},
       this.frameworkHash,
@@ -184,7 +184,8 @@ class NomosTestHarness {
       Duration? phaseTimeout,
       this.testCloud,
       this.homeWorkspace})
-      : _sessionNames = List.of(sessionNames), // GROWABLE — restoreWorkspace may add a fresh session
+      : _sessionNames = List.of(
+            sessionNames), // GROWABLE — restoreWorkspace may add a fresh session
         _devicePublics = devicePublics,
         _deviceSecrets = deviceSecrets,
         _lawHashes = Map.of(lawHashes),
@@ -256,10 +257,11 @@ class NomosTestHarness {
   /// [deployJsonPaths] — the `build/<name>.deploy.json` files `nomos-compile` emits (installed in order;
   /// framework/platform law before a domain that depends on it).
   /// [workspace] — the local workspace name (default `test-ws`; law-only, never leaves the machine).
-  /// [runtimeDir] — the runtime cache (default `~/.holon/runtime`); must hold `holon.wasm` + `packages.json`.
+  /// [runtimeDir] — the runtime cache (default `~/.holon/runtime`); must hold `holon-testmint.wasm` +
+  /// `packages.json`. The harness owns a throwaway test root; app code never handles its key material.
   /// [nodeEntry] — path to `node-entry.ts`; when omitted it is resolved from [resolveFrom] via
   /// `require.resolve('@githolon/client/runner/node-entry.ts')`.
-  /// [installHelper] — the offline law-install lane. An EXISTING `.mjs` file is run as a node script (the
+  /// [installHelper] — the offline law-install lane. An EXISTING `.ts` or `.mjs` file is run as a node script (the
   /// in-repo `offline-install.ts`, the default when it exists beside [nodeEntry]); anything else is a
   /// githolon COMMAND LINE whose `harness-install` subcommand is driven (the default `npx githolon` when the
   /// in-repo helper is absent — a published tenant needs nothing but `githolon`). E.g. force the subcommand
@@ -291,16 +293,20 @@ class NomosTestHarness {
     final entry = nodeEntry ??
         await _resolveEntry(node, resolveFrom ?? Directory.current.path);
     // THE INSTALL LANE. [installHelper] is the one seam (PACKAGING NOTE above): either the in-repo
-    // `offline-install.ts` node script, OR the published `githolon harness-install` subcommand (the CLI
+    // `offline-install.mjs` node script, OR the published `githolon harness-install` subcommand (the CLI
     // bundles the engine + this exact install sequence, so a published tenant needs nothing but `githolon`).
-    //  • an EXISTING `.mjs` file  ⇒ run it as a node script (the in-repo default when present);
+    //  • an EXISTING `.ts`/`.mjs` file ⇒ run it as a node script (the in-repo default when present);
     //  • anything else            ⇒ treat it as a githolon COMMAND LINE and drive `harness-install`
     //    (default `npx githolon` when the in-repo helper is absent; the test forces this lane by passing
     //    e.g. `installHelper: 'node /abs/cli/dist/cli.mjs'`).
-    final resolvedHelper =
-        installHelper ?? '${File(entry).parent.path}/offline-install.ts';
+    final adjacentInstaller = '${File(entry).parent.path}/offline-install.mjs';
+    final resolvedHelper = installHelper ??
+        (File(adjacentInstaller).existsSync()
+            ? adjacentInstaller
+            : '${File(entry).parent.path}/offline-install.ts');
     final useInRepoScript =
-        resolvedHelper.endsWith('.mjs') && File(resolvedHelper).existsSync();
+        (resolvedHelper.endsWith('.ts') || resolvedHelper.endsWith('.mjs')) &&
+            File(resolvedHelper).existsSync();
     final githolonCmd = installHelper == null ? 'npx githolon' : resolvedHelper;
 
     // A FRESH temp dir per harness — the snapshot + any transient runner state live here and nowhere else,
@@ -308,13 +314,18 @@ class NomosTestHarness {
     final workdir = await Directory.systemTemp.createTemp('nomos-harness-');
     // Total-ordered teardown even on a mid-setup failure: build the transport lazily and clean up on throw.
     NodeRunnerTransport? transport;
-    final phase = (String m) { if (onDiagnostic != null) onDiagnostic('[nomos-test-harness] $m'); };
+    final phase = (String m) {
+      if (onDiagnostic != null) onDiagnostic('[nomos-test-harness] $m');
+    };
     try {
       final snapshot = '${workdir.path}/snapshot.bin';
       final info = await _phased(
-          phase: '1/4: offline law install (${deployJsonPaths.length} package(s))',
+          phase:
+              '1/4: offline law install (${deployJsonPaths.length} package(s))',
           workspace: workspace,
-          awaiting: useInRepoScript ? 'offline-install.ts' : 'githolon harness-install',
+          awaiting: useInRepoScript
+              ? 'offline-install.ts'
+              : 'githolon harness-install',
           timeout: phaseTimeout ?? _kInstallDeadline,
           onDiagnostic: onDiagnostic,
           likelyCauses: const [
@@ -344,6 +355,11 @@ class NomosTestHarness {
                 environment: {
                   'NOMOS_OFFLINE': '1',
                   'NOMOS_OFFLINE_RESTORE': snapshot,
+                  'NOMOS_OFFLINE_WASM': 'holon-testmint.wasm',
+                  if (info['devicePublic'] != null)
+                    'NOMOS_TEST_K_ROOT_PUBLIC': info['devicePublic'].toString(),
+                  if (info['deviceSecret'] != null)
+                    'NOMOS_TEST_ROOT_SECRET': info['deviceSecret'].toString(),
                   if (runtimeDir != null) 'NOMOS_OFFLINE_RUNTIME': runtimeDir,
                 },
                 onDiagnostic: onDiagnostic,
@@ -355,7 +371,7 @@ class NomosTestHarness {
           timeout: phaseTimeout ?? readyTimeout,
           onDiagnostic: onDiagnostic,
           likelyCauses: const [
-            'node is not on PATH, or ~/.holon/runtime is cold (holon.wasm + packages.json)',
+            'node is not on PATH, or ~/.holon/runtime is cold (holon-testmint.wasm + packages.json)',
             'the runner process failed to boot the engine — run with onDiagnostic to see its stderr',
           ],
           run: () => plane.ready);
@@ -370,7 +386,8 @@ class NomosTestHarness {
             'run with onDiagnostic to see where the runner blocked',
           ],
           run: () => plane.connect(
-                cloud: 'https://offline.invalid', // ignored: the offline runner serves everything locally
+                cloud:
+                    'https://offline.invalid', // ignored: the offline runner serves everything locally
                 workspace: workspace,
                 clientId: clientId,
                 allowUnborn: true,
@@ -379,7 +396,8 @@ class NomosTestHarness {
                 // with the SAME key, so offline `.births()` offers Just Work.
                 authorSecret: info['deviceSecret']?.toString(),
               ));
-      phase('ready — session "$workspace" connected (law ${(info['lawHashes'] as List?)?.isNotEmpty == true ? (info['lawHashes'] as List).first.toString().substring(0, 12) : "installed"})');
+      phase(
+          'ready — session "$workspace" connected (law ${(info['lawHashes'] as List?)?.isNotEmpty == true ? (info['lawHashes'] as List).first.toString().substring(0, 12) : "installed"})');
       // THE DECOY SESSION (multi-workspace by default in tests): sole-session inference is how
       // single-workspace assumptions ship — with one session connected, an op that forgot its session
       // silently works in tests and only refuses in production when the app connects its second
@@ -403,13 +421,15 @@ class NomosTestHarness {
                   restoreFrom: base64Encode(await File(snapshot).readAsBytes()),
                 ));
       }
-      final harness = NomosTestHarness._(
-          plane.session(workspace), workspace, transport, workdir, onDiagnostic, [workspace],
+      final harness = NomosTestHarness._(plane.session(workspace), workspace,
+          transport, workdir, onDiagnostic, [workspace],
           devicePublics: {
-            if (info['devicePublic'] != null) workspace: info['devicePublic'].toString(),
+            if (info['devicePublic'] != null)
+              workspace: info['devicePublic'].toString(),
           },
           deviceSecrets: {
-            if (info['deviceSecret'] != null) workspace: info['deviceSecret'].toString(),
+            if (info['deviceSecret'] != null)
+              workspace: info['deviceSecret'].toString(),
           },
           frameworkHash: info['frameworkHash']?.toString(),
           lawHashes: {
@@ -417,7 +437,9 @@ class NomosTestHarness {
                 .map((e) => e.toString())
                 .toList()
           },
-          snapshots: {workspace: base64Encode(await File(snapshot).readAsBytes())},
+          snapshots: {
+            workspace: base64Encode(await File(snapshot).readAsBytes())
+          },
           installLane: _InstallLane(
               node: node,
               useInRepoScript: useInRepoScript,
@@ -485,10 +507,14 @@ class NomosTestHarness {
     }
     final entry = nodeEntry ??
         await _resolveEntry(node, resolveFrom ?? Directory.current.path);
-    final resolvedHelper =
-        installHelper ?? '${File(entry).parent.path}/offline-install.ts';
+    final adjacentInstaller = '${File(entry).parent.path}/offline-install.mjs';
+    final resolvedHelper = installHelper ??
+        (File(adjacentInstaller).existsSync()
+            ? adjacentInstaller
+            : '${File(entry).parent.path}/offline-install.ts');
     final useInRepoScript =
-        resolvedHelper.endsWith('.mjs') && File(resolvedHelper).existsSync();
+        (resolvedHelper.endsWith('.ts') || resolvedHelper.endsWith('.mjs')) &&
+            File(resolvedHelper).existsSync();
     final githolonCmd = installHelper == null ? 'npx githolon' : resolvedHelper;
 
     final workdir = await Directory.systemTemp.createTemp('nomos-cluster-');
@@ -499,6 +525,8 @@ class NomosTestHarness {
       final lawHashesByWs = <String, List<String>>{};
       final installDevicePublics = <String, String>{};
       final installDeviceSecrets = <String, String>{};
+      String? planeTestRootPublic;
+      String? planeTestRootSecret;
       String? frameworkHash;
       var _i = 0;
       for (final e in workspaces.entries) {
@@ -506,7 +534,9 @@ class NomosTestHarness {
         final info = await _phased(
             phase: '1: offline law install ${++_i}/${workspaces.length}',
             workspace: e.key,
-            awaiting: useInRepoScript ? 'offline-install.ts' : 'githolon harness-install',
+            awaiting: useInRepoScript
+                ? 'offline-install.ts'
+                : 'githolon harness-install',
             timeout: phaseTimeout ?? _kInstallDeadline,
             onDiagnostic: onDiagnostic,
             likelyCauses: const [
@@ -530,12 +560,18 @@ class NomosTestHarness {
         frameworkHash ??= info['frameworkHash']?.toString();
         // THE HARNESS DEVICE (era-0): the install lane mints one device key per workspace — sessions sign
         // with it and the client completes the self-serve birth ceremony (enrol + cert) with the SAME key.
-        if (info['devicePublic'] != null) installDevicePublics[e.key] = info['devicePublic'].toString();
-        if (info['deviceSecret'] != null) installDeviceSecrets[e.key] = info['deviceSecret'].toString();
+        if (info['devicePublic'] != null)
+          installDevicePublics[e.key] = info['devicePublic'].toString();
+        if (info['deviceSecret'] != null)
+          installDeviceSecrets[e.key] = info['deviceSecret'].toString();
+        planeTestRootPublic ??= info['devicePublic']?.toString();
+        planeTestRootSecret ??= info['deviceSecret']?.toString();
       }
 
       // 2. ONE runner / ONE bridge for the whole plane — no env restore default; each connect brings its own.
-      final phase = (String m) { if (onDiagnostic != null) onDiagnostic('[nomos-test-harness] $m'); };
+      final phase = (String m) {
+        if (onDiagnostic != null) onDiagnostic('[nomos-test-harness] $m');
+      };
       transport = await _phased(
           phase: '2: spawn the node runner (${workspaces.length} workspace(s))',
           awaiting: 'Process.start($node)',
@@ -547,6 +583,11 @@ class NomosTestHarness {
                 node: node,
                 environment: {
                   'NOMOS_OFFLINE': '1',
+                  'NOMOS_OFFLINE_WASM': 'holon-testmint.wasm',
+                  if (planeTestRootPublic != null)
+                    'NOMOS_TEST_K_ROOT_PUBLIC': planeTestRootPublic,
+                  if (planeTestRootSecret != null)
+                    'NOMOS_TEST_ROOT_SECRET': planeTestRootSecret,
                   if (runtimeDir != null) 'NOMOS_OFFLINE_RUNTIME': runtimeDir,
                 },
                 onDiagnostic: onDiagnostic,
@@ -558,7 +599,7 @@ class NomosTestHarness {
           timeout: phaseTimeout ?? readyTimeout,
           onDiagnostic: onDiagnostic,
           likelyCauses: const [
-            'node is not on PATH, or ~/.holon/runtime is cold (holon.wasm + packages.json)',
+            'node is not on PATH, or ~/.holon/runtime is cold (holon-testmint.wasm + packages.json)',
             'the runner process failed to boot the engine — run with onDiagnostic to see its stderr',
           ],
           run: () => bridge.ready);
@@ -568,7 +609,8 @@ class NomosTestHarness {
       final snapshotB64 = <String, String>{};
       var _n = 0;
       for (final e in workspaces.entries) {
-        snapshotB64[e.key] = base64Encode(await File(snapshots[e.key]!).readAsBytes());
+        snapshotB64[e.key] =
+            base64Encode(await File(snapshots[e.key]!).readAsBytes());
         await _phased(
             phase: '3: connect session ${++_n}/${workspaces.length}',
             workspace: e.key,
@@ -633,7 +675,8 @@ class NomosTestHarness {
                 ));
       }
       if (deviceKeyed.isNotEmpty) {
-        phase('cluster: ${deviceKeyed.length} device-keyed session(s) re-opened');
+        phase(
+            'cluster: ${deviceKeyed.length} device-keyed session(s) re-opened');
       }
 
       final names = workspaces.keys.toList();
@@ -714,7 +757,8 @@ class NomosTestHarness {
     }
     final entry = nodeEntry ??
         await _resolveEntry(node, resolveFrom ?? Directory.current.path);
-    final bareUid = subject.startsWith('user:') ? subject.substring(5) : subject;
+    final bareUid =
+        subject.startsWith('user:') ? subject.substring(5) : subject;
     final http = HttpClient();
     Future<Map<String, Object?>> post(String path, Object? body,
         {Map<String, String> headers = const {}}) async {
@@ -723,7 +767,8 @@ class NomosTestHarness {
       req.headers.set('x-nomos-principal', bareUid);
       if (authToken != null) req.headers.set('x-nomos-auth', authToken);
       headers.forEach(req.headers.set);
-      if (body != null) req.add(utf8.encode(body is String ? body : jsonEncode(body)));
+      if (body != null)
+        req.add(utf8.encode(body is String ? body : jsonEncode(body)));
       final resp = await req.close();
       final text = await resp.transform(utf8.decoder).join();
       final decoded = (jsonDecode(text) as Map).cast<String, Object?>();
@@ -743,6 +788,8 @@ class NomosTestHarness {
       //       server's in-process operator lane). Booting a born workspace is idempotent; an unborn one
       //       refuses 409, surfaced here with the fix.
       String? frameworkHash;
+      final frameworkPostRoutes =
+          <({String domain, String directive, String path})>[];
       final lawHashes = <String>[];
       await _phased(
           phase: '1/6: boot the born platform + deploy law on the test cloud',
@@ -769,9 +816,32 @@ class NomosTestHarness {
             for (final p in deployJsonPaths) {
               final body = await File(p).readAsString();
               await post('/v2/workspaces/$platformWorkspace/domains', body);
-              final summary = ((jsonDecode(body) as Map)['summary'] as Map?);
+              final deploy = (jsonDecode(body) as Map);
+              final summary = (deploy['summary'] as Map?);
               final h = summary?['domainHash']?.toString();
               if (h != null && h.isNotEmpty) lawHashes.add(h);
+              final openapi = deploy['openapi'] as Map?;
+              final pathSets = <Map>[
+                (openapi?['paths'] as Map?) ?? const {},
+                (((openapi?['x-nomos-framework-routes'] as Map?)?['paths'])
+                        as Map?) ??
+                    const {},
+              ];
+              for (final paths in pathSets) {
+                for (final entry in paths.entries) {
+                  final post = (entry.value as Map?)?['post'] as Map?;
+                  final route = post?['x-nomos'] as Map?;
+                  final domain = route?['domain']?.toString() ?? '';
+                  final directive = route?['directiveId']?.toString() ?? '';
+                  if (domain.isNotEmpty && directive.isNotEmpty) {
+                    frameworkPostRoutes.add((
+                      domain: domain,
+                      directive: directive,
+                      path: entry.key.toString(),
+                    ));
+                  }
+                }
+              }
             }
           });
       if (frameworkHash == null || frameworkHash!.isEmpty) {
@@ -782,6 +852,27 @@ class NomosTestHarness {
         throw NomosTestHarnessException(
             'cloudBound: no deploy.json carried a summary.domainHash — cannot run the birth ceremony (lawHash unknown)');
       }
+      final birthRoutes = frameworkPostRoutes
+          .where((route) => route.directive == 'birthHome')
+          .toSet()
+          .toList();
+      if (birthRoutes.length != 1) {
+        throw NomosTestHarnessException(
+            'cloudBound: the deployed package must expose exactly one semantic birthHome route; found ${birthRoutes.length}');
+      }
+      final applicationHomeDomain = birthRoutes.single.domain;
+      final birthHomePath = birthRoutes.single.path;
+      final enrollmentRoutes = frameworkPostRoutes
+          .where((route) =>
+              route.directive == 'enrollFirstDevice' &&
+              route.domain == applicationHomeDomain)
+          .toSet()
+          .toList();
+      if (enrollmentRoutes.length != 1) {
+        throw NomosTestHarnessException(
+            "cloudBound: application/home domain '$applicationHomeDomain' must expose exactly one semantic enrollFirstDevice route; found ${enrollmentRoutes.length}");
+      }
+      final enrollFirstDevicePath = enrollmentRoutes.single.path;
       // 2/6 — the LOCAL engine plane, CLOUD-BOUND, spawned BEFORE the birth: the runner's local kernel is
       //       what mints the device key + signs the birth cert (era-0: a birth is ATTESTED or not at all).
       transport = await _phased(
@@ -790,7 +881,16 @@ class NomosTestHarness {
           timeout: phaseTimeout ?? _kSpawnDeadline,
           onDiagnostic: onDiagnostic,
           run: () => NodeRunnerTransport.start(
-              entry: entry, resolveFrom: resolveFrom, node: node, onDiagnostic: onDiagnostic));
+              entry: entry,
+              resolveFrom: resolveFrom,
+              node: node,
+              environment: cloud.testKRootPublic == null
+                  ? null
+                  : {
+                      ...Platform.environment,
+                      'NOMOS_TEST_K_ROOT_PUBLIC': cloud.testKRootPublic!,
+                    },
+              onDiagnostic: onDiagnostic));
       final plane = NomosBridge(transport!);
       await _phased(
           phase: '3/6: runner ready',
@@ -804,7 +904,8 @@ class NomosTestHarness {
       //       on-chain AuthProvider (enrollFirstDevice — no admin in the loop). The platform is WARRANTED, so
       //       plain unsigned enrolment refuses by design; this is the one first-device door.
       final device = await _phased(
-          phase: '4/6: device ceremony (keygen → dev-IdP token → enrollFirstDevice)',
+          phase:
+              '4/6: device ceremony (keygen → dev-IdP token → enrollFirstDevice)',
           workspace: platformWorkspace,
           awaiting: 'authorKeygen + /dev/mint-token + enrollFirstDevice',
           timeout: phaseTimeout ?? _kInstallDeadline,
@@ -826,14 +927,17 @@ class NomosTestHarness {
             final publicB64 = (kp['public'] ?? '').toString();
             final secret = (kp['secret'] ?? '').toString();
             if (publicB64.isEmpty || secret.isEmpty) {
-              throw NomosTestHarnessException('cloudBound: authorKeygen returned no device key');
+              throw NomosTestHarnessException(
+                  'cloudBound: authorKeygen returned no device key');
             }
             final keyHash = sha256.convert(base64Decode(publicB64)).toString();
-            final minted = await post('/dev/mint-token', {'sub': bareUid, 'nonce': keyHash});
+            final minted = await post(
+                '/dev/mint-token', {'sub': bareUid, 'nonce': keyHash});
             final idpToken = (minted['token'] ?? '').toString();
             final issuer = (minted['issuer'] ?? '').toString();
             if (idpToken.isEmpty || issuer.isEmpty) {
-              throw NomosTestHarnessException('cloudBound: /dev/mint-token returned no token — is the test cloud started with platform:/deployJsonPath: and a law composing setAuthProvider?');
+              throw NomosTestHarnessException(
+                  'cloudBound: /dev/mint-token returned no token — is the test cloud started with platform:/deployJsonPath: and a law composing setAuthProvider?');
             }
             // THE KEYLESS ENROLL-ONCE DELEGATION (links[1] of the home cert chain) — device-self-signed,
             // its authority the dev-IdP token. enrollFirstDevice SEEDS it as the user's SignerDelegation, so
@@ -851,7 +955,8 @@ class NomosTestHarness {
               'capturedClock': DateTime.now().toUtc().millisecondsSinceEpoch,
               'epoch': 0,
             }, secret);
-            await post('/v2/workspaces/$platformWorkspace/enrollFirstDevice', {
+            await post(
+                '/v2/workspaces/$platformWorkspace$enrollFirstDevicePath', {
               'keyHash': keyHash,
               'verifiedVia': issuer,
               'validFromEpoch': 0,
@@ -860,8 +965,16 @@ class NomosTestHarness {
               'actor': subject,
               'authorSecret': secret,
               'delegationCert': jsonEncode(delegationCert),
-            }, headers: {'x-nomos-auth': idpToken});
-            return (publicB64: publicB64, secret: secret, keyHash: keyHash, idpToken: idpToken);
+            },
+                headers: {
+                  'x-nomos-auth': idpToken
+                });
+            return (
+              publicB64: publicB64,
+              secret: secret,
+              keyHash: keyHash,
+              idpToken: idpToken
+            );
           });
       // 5/6 — THE HOME CEREMONY, remotely: the platform's own gateway offer births the home (the ONE
       //       control-plane contact; the app lane below never touches the platform again). The offer carries
@@ -871,7 +984,7 @@ class NomosTestHarness {
       await _phased(
           phase: '5/6: remote home-birth ceremony (attested)',
           workspace: platformWorkspace,
-          awaiting: 'POST /v2/workspaces/$platformWorkspace/birthHome',
+          awaiting: 'POST /v2/workspaces/$platformWorkspace$birthHomePath',
           timeout: phaseTimeout ?? _kInstallDeadline,
           onDiagnostic: onDiagnostic,
           run: () async {
@@ -886,7 +999,8 @@ class NomosTestHarness {
               'parentId': platformWorkspace,
               'epoch': 0,
             }, device.secret);
-            final out = await post('/v2/workspaces/$platformWorkspace/birthHome', {
+            final out =
+                await post('/v2/workspaces/$platformWorkspace$birthHomePath', {
               'owner': subject,
               'ownerKeyHash': device.keyHash,
               'frameworkHash': frameworkHash,
@@ -895,9 +1009,15 @@ class NomosTestHarness {
               'homeCert': jsonEncode(homeCert),
               'actor': subject,
               'authorSecret': device.secret,
-            }, headers: {'x-nomos-auth': device.idpToken});
+            }, headers: {
+              'x-nomos-auth': device.idpToken
+            });
             final born = (out['born'] as List?) ?? const [];
-            final bornNames = born.map((b) => (b as Map)['workspace']?.toString()).whereType<String>().where((w) => w.isNotEmpty).toList();
+            final bornNames = born
+                .map((b) => (b as Map)['workspace']?.toString())
+                .whereType<String>()
+                .where((w) => w.isNotEmpty)
+                .toList();
             home = bornNames.isEmpty ? null : bornNames.first;
             if (home == null) {
               final outcomes = jsonEncode(out['birthOutcomes'] ?? const []);
@@ -927,7 +1047,8 @@ class NomosTestHarness {
       // NO DECOY on a cloudBound harness: the app is genuinely multi-workspace (the home plus every
       // locally-born child), so the plane is never sole-session — the decoy the offline  harness
       // needs (to break single-session inference) would just be a spurious local-only workspace here.
-      final _ = decoySession; // (accepted for signature parity; a cloudBound plane needs no decoy)
+      final _ =
+          decoySession; // (accepted for signature parity; a cloudBound plane needs no decoy)
       final harness = NomosTestHarness._(
         plane.session(home!),
         home!,
@@ -951,8 +1072,12 @@ class NomosTestHarness {
       }
       return harness;
     } catch (e) {
-      try { transport?.dispose(); } catch (_) {}
-      try { await workdir.delete(recursive: true); } catch (_) {}
+      try {
+        transport?.dispose();
+      } catch (_) {}
+      try {
+        await workdir.delete(recursive: true);
+      } catch (_) {}
       rethrow;
     } finally {
       http.close(force: true);
@@ -970,11 +1095,13 @@ class NomosTestHarness {
   /// until every session reports neither `pushFailed` nor `stillAhead`, or [timeout] (then throws with the
   /// per-workspace last verdicts). Returns the final sync result per workspace.
   Future<Map<String, Map<String, Object?>>> converge(
-      {Duration timeout = const Duration(seconds: 120), List<String>? workspaces}) async {
+      {Duration timeout = const Duration(seconds: 120),
+      List<String>? workspaces}) async {
     // Every LIVE session on the plane (not the harness's construction-time list — a locally-born child
     // acquired after construction must converge too), PARENT-FIRST: the home syncs before its children, so
     // its birth offer-effect creates each child's remote custody BEFORE that child pushes its own writes.
-    final live = bridge.connectedSessions.where((w) => w != _decoyWorkspace).toList();
+    final live =
+        bridge.connectedSessions.where((w) => w != _decoyWorkspace).toList();
     final hw = homeWorkspace;
     if (hw != null && live.remove(hw)) live.insert(0, hw); // the parent leads
     final targets = workspaces ?? live;
@@ -984,9 +1111,11 @@ class NomosTestHarness {
     while (pending.isNotEmpty) {
       for (final ws in List.of(pending)) {
         try {
-          final r = (await bridge.session(ws).sync(admit: true)).cast<String, Object?>();
+          final r = (await bridge.session(ws).sync(admit: true))
+              .cast<String, Object?>();
           last[ws] = r;
-          if (r['pushFailed'] != true && r['stillAhead'] != true) pending.remove(ws);
+          if (r['pushFailed'] != true && r['stillAhead'] != true)
+            pending.remove(ws);
         } catch (e) {
           last[ws] = {'error': e.toString()};
         }
@@ -1056,7 +1185,9 @@ class NomosTestHarness {
     final info = await _phased(
         phase: 'seed: offline law install',
         workspace: workspace,
-        awaiting: lane.useInRepoScript ? 'offline-install.ts' : 'githolon harness-install',
+        awaiting: lane.useInRepoScript
+            ? 'offline-install.ts'
+            : 'githolon harness-install',
         timeout: _phaseTimeout ?? _kInstallDeadline,
         onDiagnostic: _onDiagnostic,
         run: () => _runInstall(
@@ -1119,7 +1250,8 @@ class NomosTestHarness {
   /// un-synced writes + the DLQ), with its head + law hashes + capture time. The bytes are the SAME
   /// base64 `connect(restoreFrom:)` consumes — [restoreWorkspace] round-trips it. O(1)-ish (a tree serialize).
   Future<WorkspaceSnapshot> snapshotWorkspace(String workspace) async {
-    final s = session(workspace); // throws NomosTestHarnessException if not a connected session
+    final s = session(
+        workspace); // throws NomosTestHarnessException if not a connected session
     return _phased(
       phase: 'snapshotWorkspace',
       workspace: workspace,
@@ -1147,13 +1279,15 @@ class NomosTestHarness {
     for (final ws in _sessionNames) {
       out[ws] = await snapshotWorkspace(ws);
     }
-    return PlaneSnapshot(workspaces: Map.unmodifiable(out), capturedAt: DateTime.now().toUtc());
+    return PlaneSnapshot(
+        workspaces: Map.unmodifiable(out), capturedAt: DateTime.now().toUtc());
   }
 
   /// Restore a workspace FROM a [WorkspaceSnapshot] — re-open its session on this plane from the snapshot's
   /// LOCAL CUSTODY (no network clone), replacing the resident holon. The workspace need not currently be a
   /// session (a fresh restore is allowed); its name is taken from [snapshot] unless [into] overrides it.
-  Future<NomosSession> restoreWorkspace(WorkspaceSnapshot snapshot, {String? into}) async {
+  Future<NomosSession> restoreWorkspace(WorkspaceSnapshot snapshot,
+      {String? into}) async {
     final ws = into ?? snapshot.workspace;
     await _phased(
       phase: 'restoreWorkspace',
@@ -1191,7 +1325,8 @@ class NomosTestHarness {
     if (_disposed) return;
     _disposed = true;
     final f = _onDiagnostic;
-    if (f != null) f('[nomos-test-harness] phase dispose (≤${(_phaseTimeout ?? _kOtherDeadline).inSeconds}s) …');
+    if (f != null)
+      f('[nomos-test-harness] phase dispose (≤${(_phaseTimeout ?? _kOtherDeadline).inSeconds}s) …');
     try {
       await _transport.dispose().timeout(_phaseTimeout ?? _kOtherDeadline,
           onTimeout: () => throw HarnessPhaseTimeout(
@@ -1200,7 +1335,8 @@ class NomosTestHarness {
               elapsed: _phaseTimeout ?? _kOtherDeadline,
               awaiting: 'NodeRunnerTransport.dispose'));
     } catch (e) {
-      _diag('[nomos-test-harness] transport dispose error (continuing to temp-dir cleanup): $e');
+      _diag(
+          '[nomos-test-harness] transport dispose error (continuing to temp-dir cleanup): $e');
     }
     try {
       if (await _workdir.exists()) await _workdir.delete(recursive: true);
@@ -1235,9 +1371,12 @@ class NomosTestHarness {
     // Both lanes take the SAME flags (--deploy/--workspace/--out/--runtime) and print the SAME one-line JSON
     // contract; only the leading command differs (node <script> vs `<githolon...> harness-install`).
     final common = <String>[
-      '--deploy', deployJsonPaths.join(','),
-      '--workspace', workspace,
-      '--out', snapshot,
+      '--deploy',
+      deployJsonPaths.join(','),
+      '--workspace',
+      workspace,
+      '--out',
+      snapshot,
       if (runtimeDir != null) ...['--runtime', runtimeDir],
     ];
     final String executable;
@@ -1247,8 +1386,11 @@ class NomosTestHarness {
       args = [inRepoScript, ...common];
     } else {
       // `githolonCmd` is a command line (e.g. `npx githolon` or `node /abs/cli.mjs`) — split into tokens.
-      final tokens =
-          githolonCmd.trim().split(RegExp(r'\s+')).where((t) => t.isNotEmpty).toList();
+      final tokens = githolonCmd
+          .trim()
+          .split(RegExp(r'\s+'))
+          .where((t) => t.isNotEmpty)
+          .toList();
       if (tokens.isEmpty) {
         throw NomosTestHarnessException(
             'no install helper resolved — pass installHelper: (an offline-install.ts path, or a githolon command)');
@@ -1335,12 +1477,15 @@ class WorkspaceSnapshot {
         'capturedAt': capturedAt.toUtc().toIso8601String(),
       };
 
-  factory WorkspaceSnapshot.fromJson(Map<String, Object?> j) => WorkspaceSnapshot(
+  factory WorkspaceSnapshot.fromJson(Map<String, Object?> j) =>
+      WorkspaceSnapshot(
         workspace: j['workspace'] as String,
         snapshotB64: j['snapshotB64'] as String,
         head: (j['head'] ?? '') as String,
-        lawHashes: ((j['lawHashes'] as List?) ?? const []).map((e) => '$e').toList(),
-        capturedAt: DateTime.parse((j['capturedAt'] ?? DateTime.now().toUtc().toIso8601String()) as String),
+        lawHashes:
+            ((j['lawHashes'] as List?) ?? const []).map((e) => '$e').toList(),
+        capturedAt: DateTime.parse((j['capturedAt'] ??
+            DateTime.now().toUtc().toIso8601String()) as String),
       );
 
   @override
@@ -1363,8 +1508,12 @@ class PlaneSnapshot {
       };
 
   factory PlaneSnapshot.fromJson(Map<String, Object?> j) => PlaneSnapshot(
-        workspaces: ((j['workspaces'] as Map?) ?? const {}).map(
-            (k, v) => MapEntry('$k', WorkspaceSnapshot.fromJson((v as Map).cast<String, Object?>()))),
-        capturedAt: DateTime.parse((j['capturedAt'] ?? DateTime.now().toUtc().toIso8601String()) as String),
+        workspaces: ((j['workspaces'] as Map?) ?? const {}).map((k, v) =>
+            MapEntry(
+                '$k',
+                WorkspaceSnapshot.fromJson(
+                    (v as Map).cast<String, Object?>()))),
+        capturedAt: DateTime.parse((j['capturedAt'] ??
+            DateTime.now().toUtc().toIso8601String()) as String),
       );
 }