@githolon/dsl 0.105.0 → 0.105.2

package/dart/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 0.64.18
+
+- Restaged with the current kernel candidate: regenerated vendored assets (kernel release identity is baked into them). Published pub.dev archives are immutable, so regenerated bytes ride their own version.
+
 ## 0.64.17
 
 - Rebuild the bundled runner assets from @githolon/client 0.104.0 (the evolve-on-read release). Published pub.dev archives are immutable, so regenerated runtime bytes need their own version.

package/dart/lib/src/runner/node-entry.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // <define:__NOMOS_KERNEL_RELEASE__>
-var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "7d3fcc3501bef23849493026e10ce75b3ef3d1400f789181d03f4a3b0b5b1fdb", version: "kernel-7d3fcc35", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 }, testMint: { hash: "0ae2f9ba0fa5ec2eccb798fdcb99f46a82d76c03d851a9fc62eed47ffc25c394", version: "kernel-0ae2f9ba", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 } };
+var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "d42871a577eb20acd931873998ecb4348df4bfdd09b772f1fb4c20c59b6e85cd", version: "kernel-d42871a5", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 }, testMint: { hash: "a90ca104fdb9d9eb3d42f605f5f85e000e2e84bd782a2aac8bb1be2a49d45833", version: "kernel-a90ca104", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 } };
 
 // runner/node-entry.ts
 import { createInterface } from "node:readline";

package/dart/lib/src/runner/offline-install.mjs

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 };
 
 // <define:__NOMOS_KERNEL_RELEASE__>
-var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "7d3fcc3501bef23849493026e10ce75b3ef3d1400f789181d03f4a3b0b5b1fdb", version: "kernel-7d3fcc35", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 }, testMint: { hash: "0ae2f9ba0fa5ec2eccb798fdcb99f46a82d76c03d851a9fc62eed47ffc25c394", version: "kernel-0ae2f9ba", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 } };
+var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "d42871a577eb20acd931873998ecb4348df4bfdd09b772f1fb4c20c59b6e85cd", version: "kernel-d42871a5", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 }, testMint: { hash: "a90ca104fdb9d9eb3d42f605f5f85e000e2e84bd782a2aac8bb1be2a49d45833", version: "kernel-a90ca104", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 } };
 
 // runner/offline-install.ts
 import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync } from "node:fs";

package/dart/pubspec.yaml

@@ -7,7 +7,7 @@ repository: https://github.com/Captain-App/nomos2
 description: >-
   Nomos 2 Dart client — generated domain values, intent payloads and application
   lifecycle types over the typed Nomos kernel protocol and USDA custody model.
-version: 0.64.17
+version: 0.64.18
 
 environment:
   sdk: ^3.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.105.0",
+  "version": "0.105.2",
   "type": "module",
   "sideEffects": false,
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",

package/src/codegen_dart_client.ts

@@ -2518,7 +2518,7 @@ export function generateDartBridgeClient(
           `      );`,
           `    }`,
         ]),
-    `    for (var modelStep = 0; modelStep < 4; modelStep += 1) {`,
+    `    for (var modelStep = 0; modelStep < 12; modelStep += 1) {`,
     `      try {`,
     `        return await bind(session, actor: actor${
       manualEncryptionPresent ? ", keyStore: keyStore" : ""
@@ -2527,7 +2527,7 @@ export function generateDartBridgeClient(
     `        await session.nomosInternalHandleModelChange(change);`,
     `      }`,
     `    }`,
-    `    throw StateError('Generated model lifecycle did not settle after four governed steps.');`,
+    `    throw StateError('Generated model lifecycle did not settle after twelve governed steps.');`,
     `  }`,
     ``,
     `  /// The session workspace this client is bound to (from the [NomosSession] handle, when constructed with`,

package/src/compile_package_main.ts

@@ -1653,8 +1653,8 @@ const NOMOS_TYPES_DEP = "^0.8.5";
 // 0.48.x: session-bound clients (XClient.bind/NomosClientInterface/DomainClientSessionMismatch/
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
-const NOMOS_CLIENT_DEP = "^0.64.17";
-const NOMOS_FLUTTER_DEP = "^0.63.26";
+const NOMOS_CLIENT_DEP = "^0.64.18";
+const NOMOS_FLUTTER_DEP = "^0.63.29";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in dsl/dart/pubspec.yaml
 // and dsl/dart_types/pubspec.yaml — a Dart release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).

package/src/framework/home.ts

@@ -94,8 +94,14 @@ export const ReceivingGroup = aggregate("NomosInternalReceivingGroup7c1f5e", {
  * The framework-owned device lifecycle policy for one receiving group. This is deliberately data, not a
  * client-side branch: every peer replays the same rule. The first supported posture is intentionally small
  * and secure: a live, verified device may add or revoke another device; keyless IdP enrolment is only the
- * pre-group bootstrap lane; all-device-loss recovery requires guardians and remains fail-closed until that
- * proof ceremony is installed.
+ * pre-group bootstrap lane.
+ *
+ * ALL-DEVICE-LOSS RECOVERY — design done, NOT YET SHIPPED (`architecture/guardian_device_recovery.md`,
+ * 2026-08-06). DO NOT re-derive this from scratch under a live incident again — read that doc first. The
+ * primitives already exist (`enrollDelegation` + `birthReceivingGroup` + `revokeSigner`); what's missing is
+ * a kernel-side closure (birth-repeat currently accepts a SELF-signed delegation onto an already-founded
+ * group — a live gap, not a feature, until closed) plus client wiring. `guardianQuorum`/`recovery` below are
+ * the policy fields that design reads.
  */
 export const ReceivingGroupPolicy = aggregate("NomosInternalReceivingGroupPolicy7c1f5e", {
   additionalDevice: t.string().merge(Lww),
@@ -201,7 +207,15 @@ const receivingGroupPolicyRefs = readSet(
 );
 
 /** An IdP token may bootstrap the parent before the group exists; it may never bypass an existing group's
- * device policy. A new group device must be approved by a current device or, later, guardian evidence. */
+ * device policy. A new group device must be approved by a current device or, later, guardian evidence.
+ *
+ * KNOWN GAP (`architecture/guardian_device_recovery.md`): this invariant is declared `.on("enrollFirstDevice")`
+ * and only fires when that directive targets THIS home directly. It is NOT re-applied when the birth
+ * offer-effect (`run_birth_effect`, repeating `nomosInternalBirthReceivingGroup` against an ALREADY-founded
+ * home) folds a signer seat via the SAME underlying mechanism — a self-signed keyless delegation currently
+ * reseats a device there with no guardian, no approval, no delay. Verified live 2026-08-06. Fix belongs in
+ * the kernel's keyless `verify_to_root` branch (refuse a self-signed cert onto an already-warranted signer
+ * roster); do not paper over it in the DSL only. */
 export const receivingGroupRejectsKeylessAdditionalDevice = workspaceInvariant("ReceivingGroupRejectsKeylessAdditionalDevice")
   .on("enrollFirstDevice")
   .reads(receivingGroupPolicyRefs)