@githolon/dsl 0.101.5 → 0.102.0

package/src/zod_introspection.ts

@@ -0,0 +1,84 @@
+import type { z } from "zod";
+
+/**
+ * The small Zod reflection boundary shared by code generators and compile-time
+ * law probes. Keep this module dependency-free: wire encoding sits below every
+ * generator and must not import a generator merely to inspect a payload schema.
+ */
+export type ZodInternalDef = {
+  type?: string | z.ZodTypeAny;
+  innerType?: z.ZodTypeAny;
+  element?: z.ZodTypeAny;
+  shape?: Record<string, z.ZodTypeAny> | (() => Record<string, z.ZodTypeAny>);
+  entries?: Record<string, string | number>;
+  options?: z.ZodTypeAny[];
+  value?: unknown;
+  values?: readonly unknown[];
+  valueType?: z.ZodTypeAny;
+  getter?: () => z.ZodTypeAny;
+  in?: z.ZodTypeAny;
+  out?: z.ZodTypeAny;
+};
+
+export function zodDef(zt: z.ZodTypeAny): ZodInternalDef {
+  const raw = zt as unknown as { _def?: ZodInternalDef; def?: ZodInternalDef };
+  return raw._def ?? raw.def ?? {};
+}
+
+export function zodKind(zt: z.ZodTypeAny): string {
+  const type = zodDef(zt).type;
+  return typeof type === "string" ? type : "unknown";
+}
+
+export function zodEnumValues(zt: z.ZodTypeAny): string[] {
+  const raw = zt as unknown as { options?: readonly unknown[] };
+  if (raw.options !== undefined) return raw.options.map(String);
+  const entries = zodDef(zt).entries;
+  if (entries !== undefined) return Object.values(entries).map(String);
+  throw new Error("zod introspection: enum has no values");
+}
+
+export function zodObjectShape(zt: z.ZodTypeAny): Record<string, z.ZodTypeAny> {
+  const shape = zodDef(zt).shape;
+  if (typeof shape === "function") return shape();
+  if (shape !== undefined) return shape;
+  const raw = zt as unknown as { shape?: Record<string, z.ZodTypeAny> };
+  if (raw.shape !== undefined) return raw.shape;
+  throw new Error("zod introspection: object has no shape");
+}
+
+export function zodArrayElement(zt: z.ZodTypeAny): z.ZodTypeAny {
+  const def = zodDef(zt);
+  if (def.element !== undefined) return def.element;
+  if (typeof def.type !== "string" && def.type !== undefined) return def.type;
+  throw new Error("zod introspection: array has no element type");
+}
+
+/** Shared lawful primitive samples for compile-time probes and generated examples. Keeping this below the
+ * generators prevents security discovery and proof generation from disagreeing on constrained payloads. */
+const SUBJECT_SAMPLES: readonly string[] = [
+  "user:00000000-0000-0000-0000-000000000000",
+  `key:${"0".repeat(64)}`,
+  "Type:00000000-0000-0000-0000-000000000000",
+  "0".repeat(64),
+];
+const STRING_SAMPLES: readonly string[] = [
+  "sample", "{}", "en", "en-GB", "AA", "A1", "a", "1", "2026-01-01",
+  "000001", "2026-01-01T00:00:00Z", "a@example.com", "https://example.com", "#000000",
+  "00000000-0000-0000-0000-000000000000", "example.com", "0".repeat(40), "0".repeat(64),
+  `nomos-invitation-${"0".repeat(64)}`,
+];
+const NUMBER_SAMPLES: readonly number[] = [1, 0, -1, 2, 10, 100, 0.5, -90, 90, 180, -180, 1000000];
+
+export function zodSampleString(zt: z.ZodTypeAny, hint: string): string {
+  const readable = `sample-${hint}`;
+  if (zt.safeParse(readable).success) return readable;
+  for (const candidate of SUBJECT_SAMPLES) if (zt.safeParse(candidate).success) return candidate;
+  for (const candidate of STRING_SAMPLES) if (zt.safeParse(candidate).success) return candidate;
+  throw new Error(`zod introspection: no lawful string sample for '${hint}'`);
+}
+
+export function zodSampleNumber(zt: z.ZodTypeAny): number {
+  for (const candidate of NUMBER_SAMPLES) if (zt.safeParse(candidate).success) return candidate;
+  throw new Error("zod introspection: no lawful number sample");
+}

package/dart/example/nomos_secure_key_store.dart

@@ -1,82 +0,0 @@
-// COPY THIS INTO YOUR FLUTTER APP. It is an EXAMPLE, not part of the `nomos_client` library: it depends on
-// `flutter_secure_storage`, which the pure-Dart `nomos_client` package deliberately does NOT depend on (so
-// the protocol logic stays Flutter-free and unit-testable). This is the ~40 lines of app-specific glue for
-// where your device secret lives — the E2E key CUSTODY policy is yours; the protocol plumbing is not.
-//
-// THE SEALING CLIENT (e2e_sealing_client.md): a generated `<Domain>Client(bridge, keyStore: ...)` seals
-// encrypted directive fields before dispatch + decrypts encrypted read fields automatically. The `keyStore`
-// is the ONE thing you supply. `WrappedKeyStore` (in `nomos_client`) is the default: it unwraps this
-// principal's on-chain WrappedKeys with a DEVICE SECRET. This example shows where that device secret lives —
-// the platform keychain / Keystore via `flutter_secure_storage` — so it survives app restarts, stays off the
-// chain, and never leaves the device.
-//
-// WIRING (once per signed-in principal):
-//   final store = await SecureDeviceKeyStore.open(bridge: bridge, principal: myUid);
-//   final app = NotesClient(bridge, actor: myUid, keyStore: store);   // reads decrypt, writes seal
-//   final rows = await app.notesByOwner(owner: myUid);                // `body` comes back plaintext
-//
-// The OWNER ceremony (grantAndWrap / revokeAndRotate / rotate) uses the SAME device pubkey this store
-// publishes — see `<Domain>Client(bridge, actor: owner).encryption`.
-
-import 'dart:convert';
-
-import 'package:flutter_secure_storage/flutter_secure_storage.dart';
-import 'package:nomos_client/nomos_client.dart';
-
-/// A [NomosKeyStore] whose device secret is held in the platform keychain (iOS Keychain / Android Keystore)
-/// via `flutter_secure_storage`. It delegates the scope-key unwrap to the framework's [WrappedKeyStore]; the
-/// only thing it adds is DURABLE, PLATFORM-PROTECTED custody of the X25519 device secret.
-class SecureDeviceKeyStore implements NomosKeyStore {
-  final WrappedKeyStore _inner;
-
-  /// This device's X25519 PUBLIC key — publish it (publishEncKey) / hand it to the owner as `publicKey` on
-  /// `grantAndWrap` so the scope key can be wrapped TO this device.
-  final String devicePublicKey;
-
-  SecureDeviceKeyStore._(this._inner, this.devicePublicKey);
-
-  /// Open (or first-time provision) the store for `principal`. On first run it MINTS an X25519 device keypair
-  /// in the kernel, persists the SECRET in secure storage, and returns the store; on later runs it reuses it.
-  static Future<SecureDeviceKeyStore> open({
-    required NomosBridge bridge,
-    required String principal,
-    FlutterSecureStorage storage = const FlutterSecureStorage(),
-  }) async {
-    final secretKey = 'nomos.enc.deviceSecret.$principal';
-    final publicKey = 'nomos.enc.devicePublic.$principal';
-    var secret = await storage.read(key: secretKey);
-    var public = await storage.read(key: publicKey);
-    if (secret == null || public == null) {
-      // FIRST RUN: mint the device keypair (secret stays client-side, never on chain) and persist it.
-      final kp = await bridge.cryptoKeygen();
-      secret = (kp['secret'] ?? '').toString();
-      public = (kp['public'] ?? '').toString();
-      await storage.write(key: secretKey, value: secret);
-      await storage.write(key: publicKey, value: public);
-    }
-    final inner = WrappedKeyStore(
-        bridge: bridge, principal: principal, deviceSecret: secret);
-    return SecureDeviceKeyStore._(inner, public);
-  }
-
-  @override
-  Future<NomosScopeKey?> scopeKey(String scope) => _inner.scopeKey(scope);
-
-  @override
-  Future<List<NomosScopeKey>> readKeys(List<String> scopes) =>
-      _inner.readKeys(scopes);
-
-  /// Convenience: the JSON a `publishEncKey` payload carries (bind the device pubkey to this principal on
-  /// chain so an owner's `grantAndWrap` can resolve it without you passing `publicKey` each time).
-  Map<String, Object?> publishPayload({required String publishedAt}) => {
-        'principal': _inner.principal,
-        'encPublicKey': devicePublicKey,
-        'publishedAt': publishedAt,
-      };
-
-  @override
-  String toString() => 'SecureDeviceKeyStore(${jsonEncode({
-        'principal': _inner.principal,
-        'devicePublicKey': devicePublicKey,
-      })})';
-}

package/dart/example/nomos_webview_transport.dart

@@ -1,63 +0,0 @@
-// COPY THIS INTO YOUR FLUTTER APP. It is an EXAMPLE, not part of the `nomos_client` library: it depends on
-// `webview_flutter`, which the pure-Dart `nomos_client` package deliberately does NOT depend on (so the bridge
-// protocol logic stays Flutter-free and unit-testable). This ~50-line transport is the only app-specific glue.
-//
-// It implements `BridgeTransport` (from `package:nomos_client/nomos_client.dart`) over a `webview_flutter`
-// WebViewController loading the published `nomos-runner` bundle:
-//   • host → runner: `controller.runJavaScript("window.__nomosSend(<json>)")`
-//   • runner → host: a `JavaScriptChannel("NomosHost")` whose onMessage feeds the bridge's message stream.
-//
-// WIRING (in your widget's initState):
-//   final controller = WebViewController()
-//     ..setJavaScriptMode(JavaScriptMode.unrestricted);
-//   final transport = WebViewTransport(controller);          // registers the NomosHost channel
-//   await controller.loadFlutterAsset('assets/nomos/nomos-runner.html');
-//   final bridge = NomosBridge(transport);
-//   await bridge.ready;                                       // resolves on the runner's {event:ready}
-//   await bridge.connect(cloud: 'https://nomos.captainapp.co.uk', workspace: myWs, clientId: deviceId);
-//   final app = GuestbookClient(bridge);
-//   final head = await app.signGuestbook(SignGuestbookPayload(author: 'ada', message: 'hi', mood: 'delighted'));
-//   final rows = await bridge.query('entriesByAuthor', {'author': 'ada'});
-//
-// (Put the runner bundle at `assets/nomos/nomos-runner.{html,js}` and declare it under `flutter: assets:`.)
-
-import 'dart:async';
-import 'dart:convert';
-
-import 'package:nomos_client/nomos_client.dart';
-import 'package:webview_flutter/webview_flutter.dart';
-
-/// A [BridgeTransport] over a `webview_flutter` controller hosting the `nomos-runner` bundle.
-class WebViewTransport implements BridgeTransport {
-  final WebViewController controller;
-  final _incoming = StreamController<Map<String, Object?>>.broadcast();
-
-  WebViewTransport(this.controller) {
-    // runner → host: the bundle posts JSON strings on the "NomosHost" channel.
-    controller.addJavaScriptChannel(
-      'NomosHost',
-      onMessageReceived: (JavaScriptMessage m) {
-        try {
-          final decoded = jsonDecode(m.message);
-          if (decoded is Map) _incoming.add(decoded.cast<String, Object?>());
-        } catch (_) {/* a non-JSON console line — ignore */}
-      },
-    );
-  }
-
-  @override
-  Stream<Map<String, Object?>> get messages => _incoming.stream;
-
-  @override
-  void send(Map<String, Object?> message) {
-    // host → runner: hand the JSON to the bundle. Double-encode so it survives as a JS string literal.
-    final json = jsonEncode(message);
-    controller.runJavaScript('window.__nomosSend(${jsonEncode(json)})');
-  }
-
-  /// Call once, right after the page finishes loading (e.g. from `NavigationDelegate.onPageFinished`), so the
-  /// runner flushes any message (the initial `{event:"ready"}`) it emitted before this channel was wired.
-  void flushReady() => controller.runJavaScript('window.__nomosReady && window.__nomosReady()');
-
-  void dispose() => _incoming.close();
-}

package/dart/lib/nomos_headless.dart

@@ -1,50 +0,0 @@
-/// The HEADLESS transport library — `dart:io` only, so it lives outside the main
-/// `package:nomos_client/nomos_client.dart` barrel (which stays web-safe).
-///
-/// MULTI-WORKSPACE BY DESIGN. A [NomosBridge] is a device's LOCAL HOLARCHY PLANE: one bridge / one
-/// transport / ONE shared engine plane, and MANY live workspaces mounted on it (the home, each estate, each
-/// catalogue, locally-born children) — N workspaces on one wasm engine, not N engines. Each workspace is a
-/// LOCAL githolon — cloud sync is an optional per-workspace posture, not a prerequisite.
-///
-/// LOCAL BIRTHS OPEN IN-PLACE. A `.births()` directive offered into one workspace writes the child's custody
-/// straight into this same plane; the child is resident the moment it is born, so `bridge.connect(session:
-/// child)` (no `restoreFrom`) mounts it IN-PLACE — no re-clone — and reads/writes flow into the born child at
-/// once. (Proof: dsl/dart/test/cluster_births_test.dart; JS twin: cloud/web-client/test/realm.e2e.mjs.)
-///
-/// Open workspaces and hold their [NomosSession] handles:
-///
-/// ```dart
-/// import 'package:nomos_client/nomos_client.dart';
-/// import 'package:nomos_client/nomos_headless.dart';
-///
-/// final transport = await NodeRunnerTransport.start(resolveFrom: 'path/to/app');
-/// final bridge = NomosBridge(transport);
-/// await bridge.ready;
-/// // open each workspace on the plane (local-only here — no `cloud` needed):
-/// await bridge.connect(workspace: 'home', session: 'home', restoreFrom: homeBytes);
-/// await bridge.connect(workspace: 'estate-42', session: 'estate-42', restoreFrom: estateBytes);
-/// // bind a generated client to a workspace via its session handle:
-/// final estate = EstateClient(bridge.session('estate-42'));
-/// final plane = await bridge.listWorkspaces(); // enumerate + sync posture
-/// ```
-///
-/// The single-workspace `bridge.connect(...)` / `bridge.query(...)` methods are sugar over an inferred
-/// default session (unchanged). For TESTS, [NomosTestHarness] is a thin wrapper: `.ephemeral(...)` installs
-/// one law + opens one session; `.cluster(...)` installs N laws + opens N sessions on ONE plane — it adds
-/// no session logic of its own, it just drives the same production [NomosBridge.session] surface.
-///
-/// The runner child process is the SAME `@githolon/client` every peer runs; the
-/// generated Dart clients drive it through [NomosBridge] exactly as in the app.
-library;
-
-export 'src/node_runner_transport.dart';
-export 'src/test_harness.dart';
-export 'src/dev_cloud.dart'; // NomosTestCloud (co2 #4 real-sync harness)
-// THE FULL SESSION SURFACE (task #86 gap 1): a headless test types everything the harness hands out —
-// [NomosSessionCredentials] (the `acquireSession` ifAbsentCredentials callback's return type),
-// [NomosBridge]/[NomosSession]/[NomosBbox]/[NomosCompat], the E2E sealing client
-// ([NomosKeyStore]/[WrappedKeyStore]/[NomosEncryption]), and the typed session-bound errors —
-// WITHOUT also importing the web barrel. Both files are web-safe (they are exported from
-// `nomos_client.dart` too); re-exporting them here just makes the headless import self-sufficient.
-export 'src/webview_bridge.dart';
-export 'src/session_bound.dart';

package/dart/lib/testing.dart

@@ -1,14 +0,0 @@
-// NOMOS — Nomos Sovereign: participants act · verify · remember LOCALLY; hosted
-// remotes are replaceable custody/transport, not truth.
-//
-/// The TEST-ONLY entrypoint (`package:nomos_client/testing.dart`) — the headless harness
-/// (NomosTestHarness drives the REAL githolon under `dart test`, no WebView) and the
-/// node-runner transport it rides. Depend on this ONLY from `dev_dependencies`-scoped
-/// packages: it pulls `dart:io` and process management, which never belong in app code.
-/// The layered-packages emit (`dart.packages.test`) re-exports this as the generated
-/// test package's harness surface.
-library;
-
-export 'src/node_runner_transport.dart';
-export 'src/test_harness.dart';
-export 'src/dev_cloud.dart'; // NomosTestCloud (co2 #4 real-sync harness)

package/dart/test/co2_product_gauntlet_test.dart

@@ -1,244 +0,0 @@
-// Product acceptance: application → home → Estate, then Site → Asset, through the generated Dart client.
-// The harness owns the test cloud and framework ceremony; the application section supplies business facts.
-import 'dart:convert';
-import 'dart:io';
-
-import 'package:nomos_client/nomos_headless.dart';
-import 'package:test/test.dart';
-
-import '../../../examples/co2-birth/build/dart/src/generated/co2.client.dart';
-
-String get _root => '${Directory.current.path}/../..';
-String get _runner =>
-    Platform.environment['NOMOS_NODE_ENTRY'] ??
-    '$_root/cloud/web-client/runner/node-entry.ts';
-String get _server => '$_root/cloud/dev-server/server.ts';
-String get _deploy =>
-    Platform.environment['NOMOS_CO2_DEPLOY'] ??
-    '$_root/examples/co2-birth/build/co2.deploy.json';
-const _subject = 'user:co2-product-owner';
-
-Future<T> _eventually<T>(
-  String description,
-  Future<T?> Function() probe, {
-  Duration timeout = const Duration(seconds: 90),
-}) async {
-  final deadline = DateTime.now().add(timeout);
-  Object? lastError;
-  while (DateTime.now().isBefore(deadline)) {
-    try {
-      final value = await probe();
-      if (value != null) return value;
-    } catch (error) {
-      lastError = error;
-    }
-    await Future<void>.delayed(const Duration(milliseconds: 250));
-  }
-  throw TestFailure(
-      '$description did not become true within ${timeout.inSeconds}s${lastError == null ? '' : ': $lastError'}');
-}
-
-void main() {
-  test(
-      'CO2 product journey: application → home → Estate → Site → Asset, offline then remotely durable',
-      () async {
-    final required = Platform.environment['NOMOS_GAUNTLET_REQUIRED'] == '1';
-    final missing = [_runner, _server, _deploy]
-        .where((path) => !File(path).existsSync())
-        .toList();
-    if (missing.isNotEmpty) {
-      if (required)
-        fail(
-            'CO2 product gauntlet prerequisites are missing: ${missing.join(', ')}');
-      markTestSkipped(
-          'CO2 product gauntlet prerequisites are missing: ${missing.join(', ')}');
-      return;
-    }
-
-    final diagnostic = Platform.environment['NOMOS_HARNESS_DIAG'] == '1'
-        ? (String line) => stderr.writeln(line)
-        : null;
-    final cloud = await NomosTestCloud.start(
-      serverEntry: _server,
-      platform: 'co2-product-platform',
-      deployJsonPath: _deploy,
-      onDiagnostic: diagnostic,
-    );
-    NomosTestHarness? harness;
-    try {
-      // Release coherence is part of sync correctness, not an optional diagnostic. If the cloud cannot
-      // identify the kernel that will receive these ledgers, a successful local write is not an adequate
-      // product proof: the client would be synchronising into an unknown fold implementation.
-      final capabilitiesHttp = HttpClient();
-      try {
-        final request = await capabilitiesHttp
-            .getUrl(Uri.parse('${cloud.origin}/v1/runtime/capabilities'));
-        final response = await request.close();
-        final text = await response.transform(utf8.decoder).join();
-        expect(response.statusCode, HttpStatus.ok,
-            reason:
-                'the cloud must advertise the kernel that will receive offline ledgers: $text');
-        final capabilities = (jsonDecode(text) as Map).cast<String, Object?>();
-        final production =
-            (capabilities['prod'] as Map?)?.cast<String, Object?>() ?? const {};
-        final features = ((production['features'] as List?) ?? const [])
-            .map((feature) => feature.toString())
-            .toSet();
-        expect(
-            features,
-            containsAll(<String>[
-              'conflictSnapshots',
-              'ownedAudience',
-            ]),
-            reason:
-                'the receiving kernel must support the law we are about to sync');
-      } finally {
-        capabilitiesHttp.close(force: true);
-      }
-
-      harness = await NomosTestHarness.cloudBound(
-        cloud: cloud,
-        deployJsonPaths: [_deploy],
-        platformWorkspace: 'co2-product-platform',
-        subject: _subject,
-        nodeEntry: _runner,
-        onDiagnostic: diagnostic,
-        phaseTimeout: const Duration(seconds: 180),
-      );
-      var home = harness.homeSession;
-      expect((await cloud.remoteHead(home.workspace)).initialized, isTrue,
-          reason:
-              'the application born the identity home before business code ran');
-      // The shipped Flutter scope starts this automatically. The headless acceptance test calls the same
-      // client-owned lifecycle explicitly because it has no widget scope; no later sync/converge call is
-      // permitted. The 60s fallback remains deliberately large: recovery must come from retry/reconnect,
-      // not a test-only tight poll.
-      await home.autoSync(fallbackMs: 60000);
-
-      cloud.setOnline(false);
-
-      // This is the whole tenant journey. Every argument is a business fact; Nomos owns the offline birth,
-      // child acquisition, authorship, persistence, routing, retry and eventual parent-first custody.
-      final homeClient = await Co2Client.bind(home, actor: _subject);
-      final estateRef = await homeClient.birth(NomosBirthEstatePayload(
-        reference: 'E-001',
-        name: 'Foundry',
-        country: 'GB',
-        baselineTonnesCo2e: 4200,
-      ));
-      var estate = await harness.bridge.follow(
-        estateRef,
-        authorSecret: harness.deviceSecret(home.workspace),
-      );
-      await estate.autoSync(fallbackMs: 60000);
-      final estateClient = await Co2Client.bind(estate, actor: _subject);
-      final site = await estateClient.addSite(
-        AddSitePayload(estateId: estateRef.id, name: 'Trafford Depot'),
-      );
-      final siteId = site.created.single.id;
-      await estateClient.addAsset(AddAssetPayload(
-        siteId: siteId,
-        name: 'Main electricity meter',
-        operationalStatus: 'commissioned',
-      ));
-      final localAssets = await estateClient.assetsBySite(siteId: siteId);
-      expect(localAssets.single.name, 'Main electricity meter');
-      expect(localAssets.single.operationalStatus?.valueOrNull, 'commissioned');
-
-      expect((await cloud.remoteHead(estateRef.workspace)).initialized, isFalse,
-          reason:
-              'the Estate remained fully usable without remote custody during the partition');
-
-      // Kill the device process while both parent and child still carry unsynchronised local custody.
-      // Restart is one framework verb: the product test supplies no snapshots, credentials, routes, retry
-      // loop or topology ordering. Generated business reads must work before connectivity returns.
-      await harness.restart();
-      home = harness.homeSession;
-      estate = harness.session(estateRef.workspace);
-      final restartedClient = await Co2Client.bind(estate, actor: _subject);
-      final restartedAssets =
-          await restartedClient.assetsBySite(siteId: siteId);
-      expect(restartedAssets.single.name, 'Main electricity meter');
-      expect(restartedAssets.single.operationalStatus?.valueOrNull,
-          'commissioned');
-      expect((await estate.verifyChain())['valid'], isTrue,
-          reason:
-              'the unsynchronised Estate must replay locally before any network recovery');
-
-      cloud.setOnline(true);
-      // No tenant sync(), no harness.converge(), no topology ordering. The two stateful client sessions must
-      // retain their local branches, retry after reconnect, establish the parent birth first as required by
-      // the law, and finish child custody themselves.
-      await _eventually('client-owned parent and child convergence', () async {
-        final homeRemote = await cloud.remoteHead(home.workspace);
-        final estateRemote = await cloud.remoteHead(estateRef.workspace);
-        final homeMetrics = await home.metrics();
-        final estateMetrics = await estate.metrics();
-        final homeAhead = (homeMetrics['ahead'] as num?)?.toInt() ?? -1;
-        final estateAhead = (estateMetrics['ahead'] as num?)?.toInt() ?? -1;
-        if (homeRemote.initialized &&
-            estateRemote.initialized &&
-            homeAhead == 0 &&
-            estateAhead == 0) {
-          return true;
-        }
-        return null;
-      }, timeout: const Duration(seconds: 180));
-
-      final http = HttpClient();
-      try {
-        final request = await http.getUrl(Uri.parse(
-          '${cloud.origin}/v2/workspaces/${estateRef.workspace}/assetsBySite?siteId=${Uri.encodeQueryComponent(siteId)}',
-        ));
-        final response = await request.close();
-        final body =
-            (jsonDecode(await response.transform(utf8.decoder).join()) as Map)
-                .cast<String, Object?>();
-        final rows = (body['rows'] as List?) ?? const [];
-        expect(rows, hasLength(1));
-        expect(((rows.single as Map)['data'] as Map)['name'],
-            'Main electricity meter');
-      } finally {
-        http.close(force: true);
-      }
-
-      final remoteEstate = await cloud.remoteHead(estateRef.workspace);
-      expect(remoteEstate.initialized, isTrue);
-      expect(remoteEstate.commits, greaterThan(0));
-
-      // The serving cloud is not the proof of replayability. Start a fresh runner with no resident custody,
-      // clone the Estate from remote custody, and re-fire the complete authority/law chain locally.
-      final coldTransport = await NodeRunnerTransport.start(
-        entry: _runner,
-        environment: cloud.testKRootPublic == null
-            ? null
-            : {
-                ...Platform.environment,
-                'NOMOS_TEST_K_ROOT_PUBLIC': cloud.testKRootPublic!,
-              },
-      );
-      final cold = NomosBridge(coldTransport);
-      try {
-        await cold.ready;
-        await cold.connect(
-          cloud: cloud.origin,
-          workspace: estateRef.workspace,
-          clientId: 'co2-product-cold-peer',
-        );
-        final coldSession = cold.session(estateRef.workspace);
-        final coldClient = await Co2Client.bind(coldSession, actor: _subject);
-        expect((await coldClient.assetsBySite(siteId: siteId)).single.name,
-            'Main electricity meter');
-        expect((await coldSession.verifyChain())['valid'], isTrue);
-      } finally {
-        await cold.dispose();
-        await coldTransport.dispose();
-      }
-    } finally {
-      try {
-        await harness?.dispose();
-      } catch (_) {}
-      await cloud.stop();
-    }
-  }, timeout: const Timeout(Duration(minutes: 7)));
-}