@githolon/dsl 0.105.1 → 0.105.3

package/dart/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 0.64.18
+
+- Restaged with the current kernel candidate: regenerated vendored assets (kernel release identity is baked into them). Published pub.dev archives are immutable, so regenerated bytes ride their own version.
+
 ## 0.64.17
 
 - Rebuild the bundled runner assets from @githolon/client 0.104.0 (the evolve-on-read release). Published pub.dev archives are immutable, so regenerated runtime bytes need their own version.

package/dart/lib/src/runner/node-entry.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // <define:__NOMOS_KERNEL_RELEASE__>
-var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "7d3fcc3501bef23849493026e10ce75b3ef3d1400f789181d03f4a3b0b5b1fdb", version: "kernel-7d3fcc35", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 }, testMint: { hash: "0ae2f9ba0fa5ec2eccb798fdcb99f46a82d76c03d851a9fc62eed47ffc25c394", version: "kernel-0ae2f9ba", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 } };
+var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "d42871a577eb20acd931873998ecb4348df4bfdd09b772f1fb4c20c59b6e85cd", version: "kernel-d42871a5", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 }, testMint: { hash: "a90ca104fdb9d9eb3d42f605f5f85e000e2e84bd782a2aac8bb1be2a49d45833", version: "kernel-a90ca104", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 } };
 
 // runner/node-entry.ts
 import { createInterface } from "node:readline";
@@ -8271,7 +8271,7 @@ function createGovernanceOffers(ctx) {
         if (declaring.length === 1) resolved = { domain: declaring[0], directiveId };
         else if (declaring.length > 1) throw new Error(`ensureParentSignerEnrollment: '${directiveId}' is declared by ${declaring.length} installed domains on ${parent} (${declaring.join(", ")}) \u2014 pass { domain } explicitly`);
       }
-      if (!resolved && parent !== workspace && keyless && directiveId === "enrollFirstDevice") {
+      if (!resolved && keyless && directiveId === "enrollFirstDevice") {
         const route = await resolveFrameworkRoute({
           parent,
           operationId: directiveId,

package/dart/lib/src/runner/offline-install.mjs

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 };
 
 // <define:__NOMOS_KERNEL_RELEASE__>
-var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "7d3fcc3501bef23849493026e10ce75b3ef3d1400f789181d03f4a3b0b5b1fdb", version: "kernel-7d3fcc35", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 }, testMint: { hash: "0ae2f9ba0fa5ec2eccb798fdcb99f46a82d76c03d851a9fc62eed47ffc25c394", version: "kernel-0ae2f9ba", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 } };
+var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "d42871a577eb20acd931873998ecb4348df4bfdd09b772f1fb4c20c59b6e85cd", version: "kernel-d42871a5", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 }, testMint: { hash: "a90ca104fdb9d9eb3d42f605f5f85e000e2e84bd782a2aac8bb1be2a49d45833", version: "kernel-a90ca104", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 } };
 
 // runner/offline-install.ts
 import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync } from "node:fs";

package/dart/pubspec.yaml

@@ -7,7 +7,7 @@ repository: https://github.com/Captain-App/nomos2
 description: >-
   Nomos 2 Dart client — generated domain values, intent payloads and application
   lifecycle types over the typed Nomos kernel protocol and USDA custody model.
-version: 0.64.17
+version: 0.64.18
 
 environment:
   sdk: ^3.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.105.1",
+  "version": "0.105.3",
   "type": "module",
   "sideEffects": false,
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",

package/runtime/generated-application-host.js

@@ -7322,7 +7322,7 @@ function createGovernanceOffers(ctx) {
         if (declaring.length === 1) resolved = { domain: declaring[0], directiveId };
         else if (declaring.length > 1) throw new Error(`ensureParentSignerEnrollment: '${directiveId}' is declared by ${declaring.length} installed domains on ${parent} (${declaring.join(", ")}) \u2014 pass { domain } explicitly`);
       }
-      if (!resolved && parent !== workspace && keyless && directiveId === "enrollFirstDevice") {
+      if (!resolved && keyless && directiveId === "enrollFirstDevice") {
         const route = await resolveFrameworkRoute({
           parent,
           operationId: directiveId,

package/src/compile_package_main.ts

@@ -1653,8 +1653,8 @@ const NOMOS_TYPES_DEP = "^0.8.5";
 // 0.48.x: session-bound clients (XClient.bind/NomosClientInterface/DomainClientSessionMismatch/
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
-const NOMOS_CLIENT_DEP = "^0.64.17";
-const NOMOS_FLUTTER_DEP = "^0.63.27";
+const NOMOS_CLIENT_DEP = "^0.64.18";
+const NOMOS_FLUTTER_DEP = "^0.63.30";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in dsl/dart/pubspec.yaml
 // and dsl/dart_types/pubspec.yaml — a Dart release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).

package/src/framework/home.ts

@@ -94,8 +94,14 @@ export const ReceivingGroup = aggregate("NomosInternalReceivingGroup7c1f5e", {
  * The framework-owned device lifecycle policy for one receiving group. This is deliberately data, not a
  * client-side branch: every peer replays the same rule. The first supported posture is intentionally small
  * and secure: a live, verified device may add or revoke another device; keyless IdP enrolment is only the
- * pre-group bootstrap lane; all-device-loss recovery requires guardians and remains fail-closed until that
- * proof ceremony is installed.
+ * pre-group bootstrap lane.
+ *
+ * ALL-DEVICE-LOSS RECOVERY — design done, NOT YET SHIPPED (`architecture/guardian_device_recovery.md`,
+ * 2026-08-06). DO NOT re-derive this from scratch under a live incident again — read that doc first. The
+ * primitives already exist (`enrollDelegation` + `birthReceivingGroup` + `revokeSigner`); what's missing is
+ * a kernel-side closure (birth-repeat currently accepts a SELF-signed delegation onto an already-founded
+ * group — a live gap, not a feature, until closed) plus client wiring. `guardianQuorum`/`recovery` below are
+ * the policy fields that design reads.
  */
 export const ReceivingGroupPolicy = aggregate("NomosInternalReceivingGroupPolicy7c1f5e", {
   additionalDevice: t.string().merge(Lww),
@@ -201,7 +207,15 @@ const receivingGroupPolicyRefs = readSet(
 );
 
 /** An IdP token may bootstrap the parent before the group exists; it may never bypass an existing group's
- * device policy. A new group device must be approved by a current device or, later, guardian evidence. */
+ * device policy. A new group device must be approved by a current device or, later, guardian evidence.
+ *
+ * KNOWN GAP (`architecture/guardian_device_recovery.md`): this invariant is declared `.on("enrollFirstDevice")`
+ * and only fires when that directive targets THIS home directly. It is NOT re-applied when the birth
+ * offer-effect (`run_birth_effect`, repeating `nomosInternalBirthReceivingGroup` against an ALREADY-founded
+ * home) folds a signer seat via the SAME underlying mechanism — a self-signed keyless delegation currently
+ * reseats a device there with no guardian, no approval, no delay. Verified live 2026-08-06. Fix belongs in
+ * the kernel's keyless `verify_to_root` branch (refuse a self-signed cert onto an already-warranted signer
+ * roster); do not paper over it in the DSL only. */
 export const receivingGroupRejectsKeylessAdditionalDevice = workspaceInvariant("ReceivingGroupRejectsKeylessAdditionalDevice")
   .on("enrollFirstDevice")
   .reads(receivingGroupPolicyRefs)