@githolon/dsl 0.107.4 → 0.108.0

package/dart/lib/src/test_harness.dart

@@ -41,13 +41,14 @@ import 'dart:convert';
 import 'dart:io';
 
 import 'package:crypto/crypto.dart' show sha256;
+import 'package:fixnum/fixnum.dart' show Int64;
+import 'package:nomos_types/nomos_kernel_protocol.dart' show BirthCertificate;
 import 'package:package_config/package_config.dart' show loadPackageConfigUri;
 
 import 'dev_cloud.dart';
 import 'node_runner_transport.dart';
 import 'session_bound.dart' show DomainNotInstalledForSession;
-import 'webview_bridge.dart'
-    show NomosBirthCertificateSpec, NomosBridge, NomosSession;
+import 'webview_bridge.dart' show NomosBridge, NomosSession;
 
 enum _KernelRuntimeArtifact {
   executable('holon.wasm'),
@@ -68,6 +69,30 @@ enum _CandidateKernelBinary {
   final String fileName;
 }
 
+/// Lower the generated protobuf certificate into the framework law's USDA-authored value shape. This is
+/// deliberately not a second certificate type: callers cannot construct it independently, and every field
+/// is read from the compiler-generated message.
+Map<String, Object?> _birthCertificateLawValue(BirthCertificate certificate) =>
+    <String, Object?>{
+      'child': certificate.child,
+      'founder': certificate.founder,
+      'verified': certificate.verified,
+      'parentKey': base64Encode(certificate.parentKey),
+      'parentId': certificate.parentId,
+      'epoch': certificate.epoch.toInt(),
+      'signature': base64Encode(certificate.signature),
+      if (certificate.hasVerifiedVia()) 'verifiedVia': certificate.verifiedVia,
+      if (certificate.hasIdpToken()) 'idpToken': certificate.idpToken,
+      if (certificate.hasCapturedClock())
+        'capturedClock': certificate.capturedClock.toInt(),
+      if (certificate.hasAuthProviderIssuer())
+        'authProviderIssuer': certificate.authProviderIssuer,
+      if (certificate.hasAuthProviderJwks())
+        'authProviderJwks': certificate.authProviderJwks,
+      if (certificate.hasAuthProviderAudience())
+        'authProviderAudience': certificate.authProviderAudience,
+    };
+
 /// A source checkout is itself a coordinated release candidate: compiler, framework packages and kernels
 /// move together. Generated scenarios must not combine those source-generated laws with a recently-written
 /// but older global runtime cache. Published packages have no release/ directory and keep the normal
@@ -104,18 +129,21 @@ Future<String?> _sourceCandidateRuntime(String nodeEntry) async {
     if (host == null) {
       throw NomosTestHarnessException('rustc did not report its host target');
     }
-    final result = await Process.run('cargo', [
-      'run',
-      '--quiet',
-      '--target',
-      host,
-      '--manifest-path',
-      '${sourceRoot.path}/tools/kernel-resource/Cargo.toml',
-      '--',
-      'read',
-      '${sourceRoot.path}/release/kernel-candidate.usda',
-      field,
-    ], workingDirectory: sourceRoot.path);
+    final result = await Process.run(
+        'cargo',
+        [
+          'run',
+          '--quiet',
+          '--target',
+          host,
+          '--manifest-path',
+          '${sourceRoot.path}/tools/kernel-resource/Cargo.toml',
+          '--',
+          'read',
+          '${sourceRoot.path}/release/kernel-candidate.usda',
+          field,
+        ],
+        workingDirectory: sourceRoot.path);
     if (result.exitCode != 0) {
       throw NomosTestHarnessException(
         'could not read typed kernel candidate: ${result.stderr}',
@@ -241,8 +269,8 @@ String? nmsPermanentConvergenceFailure(Map<String, Object?> result) {
   final converged = result['converged'];
   final replayDeadLetters =
       converged is Map && converged['deadLettered'] is List
-      ? converged['deadLettered'] as List
-      : const [];
+          ? converged['deadLettered'] as List
+          : const [];
   final pushError = result['pushError'];
   final refused = pushError is Map && pushError['refused'] == true;
   if (rejected.isEmpty &&
@@ -311,10 +339,10 @@ class HarnessPhaseTimeout extends NomosTestHarnessException {
     required this.awaiting,
     this.likelyCauses = const [],
   }) : super(
-         'phase "$phase"${workspace != null ? ' (workspace "$workspace")' : ''} '
-         'did not complete within ${elapsed.inSeconds}s while awaiting `$awaiting`'
-         '${likelyCauses.isEmpty ? '' : ' — likely causes: ${likelyCauses.map((c) => '\n  • $c').join()}'}',
-       );
+          'phase "$phase"${workspace != null ? ' (workspace "$workspace")' : ''} '
+          'did not complete within ${elapsed.inSeconds}s while awaiting `$awaiting`'
+          '${likelyCauses.isEmpty ? '' : ' — likely causes: ${likelyCauses.map((c) => '\n  • $c').join()}'}',
+        );
   @override
   String toString() => 'HarnessPhaseTimeout: $message';
 }
@@ -432,16 +460,16 @@ class NomosTestHarness {
     _CloudRestartLane? cloudRestartLane,
     this.testCloud,
     this.homeWorkspace,
-  }) : _sessionNames = List.of(
-         sessionNames,
-       ), // GROWABLE — restoreWorkspace may add a fresh session
-       _devicePublics = devicePublics,
-       _deviceSecrets = deviceSecrets,
-       _lawHashes = Map.of(lawHashes),
-       _snapshots = Map.of(snapshots),
-       _installLane = installLane,
-       _phaseTimeout = phaseTimeout,
-       _cloudRestartLane = cloudRestartLane;
+  })  : _sessionNames = List.of(
+          sessionNames,
+        ), // GROWABLE — restoreWorkspace may add a fresh session
+        _devicePublics = devicePublics,
+        _deviceSecrets = deviceSecrets,
+        _lawHashes = Map.of(lawHashes),
+        _snapshots = Map.of(snapshots),
+        _installLane = installLane,
+        _phaseTimeout = phaseTimeout,
+        _cloudRestartLane = cloudRestartLane;
 
   // ── THE "NO SILENT HANGS" MACHINERY — every lifecycle await runs as a named, deadlined PHASE ──
 
@@ -609,11 +637,9 @@ class NomosTestHarness {
         'no lawUsdzPaths — pass the build/<name>.law.usdz `npx githolon compile` emits',
       );
     }
-    final entry =
-        nodeEntry ??
+    final entry = nodeEntry ??
         await _resolveEntry(node, resolveFrom ?? Directory.current.path);
-    final effectiveRuntimeDir =
-        runtimeDir ??
+    final effectiveRuntimeDir = runtimeDir ??
         Platform.environment['NOMOS_CANDIDATE_RUNTIME'] ??
         Platform.environment['NOMOS_DART_RUNTIME'] ??
         Platform.environment['NOMOS_OFFLINE_RUNTIME'] ??
@@ -626,19 +652,17 @@ class NomosTestHarness {
     //    (default `npx githolon` when the in-repo helper is absent; the test forces this lane by passing
     //    e.g. `installHelper: 'node /abs/cli/dist/cli.mjs'`).
     final adjacentInstaller = '${File(entry).parent.path}/offline-install.mjs';
-    final resolvedHelper =
-        installHelper ??
+    final resolvedHelper = installHelper ??
         (File(adjacentInstaller).existsSync()
             ? adjacentInstaller
             : '${File(entry).parent.path}/offline-install.ts');
     final useInRepoScript =
         (resolvedHelper.endsWith('.ts') || resolvedHelper.endsWith('.mjs')) &&
-        File(resolvedHelper).existsSync();
+            File(resolvedHelper).existsSync();
     final githolonCmd = installHelper == null ? 'npx githolon' : resolvedHelper;
 
     final owner = ownerSubject?.trim();
-    final birthsApplicationHome =
-        owner != null &&
+    final birthsApplicationHome = owner != null &&
         owner.isNotEmpty &&
         workspace == _receivingGroupNameOf(owner);
     // A receiving-group address is not an arbitrary law-install target. It is valid only when a parent
@@ -662,9 +686,8 @@ class NomosTestHarness {
       final info = await _phased(
         phase: '1/4: offline law install (${lawUsdzPaths.length} package(s))',
         workspace: installWorkspace,
-        awaiting: useInRepoScript
-            ? 'offline-install.ts'
-            : 'githolon harness-install',
+        awaiting:
+            useInRepoScript ? 'offline-install.ts' : 'githolon harness-install',
         timeout: phaseTimeout ?? _kInstallDeadline,
         onDiagnostic: onDiagnostic,
         likelyCauses: const [
@@ -781,19 +804,17 @@ class NomosTestHarness {
           // scenario carries the value from the same package declaration that compiled the
           // receiving-group plan; the harness does not choose or default it. The ordinary
           // seed offer crosses the kernel author gate before the first birth is attempted.
-          run: () => plane
-              .session(installWorkspace)
-              .offerOutcome(
-                domain: '__nomos_application_home_v1',
-                directiveId: 'seedBirthPolicy',
-                actor: owner,
-                authorSecret: deviceSecret,
-                payload: <String, Object?>{
-                  'maxBirthsPerPrincipal': maxChildWorkspaces,
-                  'setBy': owner,
-                  'setAt': bornAt,
-                },
-              ),
+          run: () => plane.session(installWorkspace).offerOutcome(
+            domain: '__nomos_application_home_v1',
+            directiveId: 'seedBirthPolicy',
+            actor: owner,
+            authorSecret: deviceSecret,
+            payload: <String, Object?>{
+              'maxBirthsPerPrincipal': maxChildWorkspaces,
+              'setBy': owner,
+              'setAt': bornAt,
+            },
+          ),
         );
         final outcome = await _phased(
           phase: 'application: birth the signed-in application',
@@ -801,22 +822,20 @@ class NomosTestHarness {
           awaiting: 'attested receiving-group birth',
           timeout: phaseTimeout ?? _kOtherDeadline,
           onDiagnostic: onDiagnostic,
-          run: () => plane
-              .session(installWorkspace)
-              .offerOutcome(
-                domain: '__nomos_application_home_v1',
-                directiveId: 'nomosInternalBirthReceivingGroup7c1f5e',
-                actor: owner,
-                authorSecret: deviceSecret,
-                payload: <String, Object?>{
-                  'owner': owner,
-                  'frameworkHash': framework,
-                  // Ordered application deployment is reference packages first, deferred child payload last.
-                  // The parent serves the references; the receiving group is born with only its payload law.
-                  'lawHash': laws.last,
-                  'bornAt': bornAt,
-                },
-              ),
+          run: () => plane.session(installWorkspace).offerOutcome(
+            domain: '__nomos_application_home_v1',
+            directiveId: 'nomosInternalBirthReceivingGroup7c1f5e',
+            actor: owner,
+            authorSecret: deviceSecret,
+            payload: <String, Object?>{
+              'owner': owner,
+              'frameworkHash': framework,
+              // Ordered application deployment is reference packages first, deferred child payload last.
+              // The parent serves the references; the receiving group is born with only its payload law.
+              'lawHash': laws.last,
+              'bornAt': bornAt,
+            },
+          ),
         );
         String? bornStatus;
         for (final entry in outcome.birthOutcomes) {
@@ -870,28 +889,26 @@ class NomosTestHarness {
             // harness device through the installed framework law with the same verified provenance
             // that the private test root later attests. Production clients never manufacture this
             // marker; it exists only inside the offline test-mint ceremony.
-            run: () => plane
-                .session(workspace)
-                .offerOutcome(
-                  domain: '__nomos_application_home_v1',
-                  directiveId: 'enrollSigner',
-                  actor: owner,
-                  authorSecret: deviceSecret,
-                  payload: <String, Object?>{
-                    'keyHash': keyHash,
-                    'grantedBy': owner,
-                    'grantedAt': 1,
-                    'verifiedVia': 'nomos:test-mint',
-                  },
-                ),
+            run: () => plane.session(workspace).offerOutcome(
+              domain: '__nomos_application_home_v1',
+              directiveId: 'enrollSigner',
+              actor: owner,
+              authorSecret: deviceSecret,
+              payload: <String, Object?>{
+                'keyHash': keyHash,
+                'grantedBy': owner,
+                'grantedAt': 1,
+                'verifiedVia': 'nomos:test-mint',
+              },
+            ),
           );
         } catch (error) {
           // Pre-application-home packages neither expose nor enforce this
           // signer route. Preserve their old harness behaviour, while keeping
           // every refusal from a current package fatal.
           if (!error.toString().contains(
-            "no active installed law declares domain '__nomos_application_home_v1'",
-          )) {
+                "no active installed law declares domain '__nomos_application_home_v1'",
+              )) {
             rethrow;
           }
         }
@@ -904,36 +921,32 @@ class NomosTestHarness {
             timeout: phaseTimeout ?? _kOtherDeadline,
             onDiagnostic: onDiagnostic,
             run: () async {
-              await plane
-                  .session(workspace)
-                  .offerOutcome(
-                    domain: '__nomos_application_home_v1',
-                    directiveId: 'nomosInternalSeedReceivingGroupPolicy7c1f5e',
-                    actor: 'host-birth',
-                    payload: <String, Object?>{'setAt': bornAt},
-                  );
-              await plane
-                  .session(workspace)
-                  .offerOutcome(
-                    domain: '__nomos_application_home_v1',
-                    directiveId: 'nomosInternalSeedReceivingGroup7c1f5e',
-                    actor: 'host-birth',
-                    payload: <String, Object?>{
-                      'principal': owner,
-                      'workspaceName': _receivingGroupNameOf(owner),
-                      'bornAt': bornAt,
-                    },
-                  );
+              await plane.session(workspace).offerOutcome(
+                domain: '__nomos_application_home_v1',
+                directiveId: 'nomosInternalSeedReceivingGroupPolicy7c1f5e',
+                actor: 'host-birth',
+                payload: <String, Object?>{'setAt': bornAt},
+              );
+              await plane.session(workspace).offerOutcome(
+                domain: '__nomos_application_home_v1',
+                directiveId: 'nomosInternalSeedReceivingGroup7c1f5e',
+                actor: 'host-birth',
+                payload: <String, Object?>{
+                  'principal': owner,
+                  'workspaceName': _receivingGroupNameOf(owner),
+                  'bornAt': bornAt,
+                },
+              );
             },
           );
           final parentCert = await plane.signBirthCert(
-            NomosBirthCertificateSpec(
+            BirthCertificate(
               child: workspace,
               founder: owner,
               verified: true,
-              parentKey: devicePublic,
+              parentKey: base64Decode(devicePublic),
               parentId: 'root',
-              epoch: 0,
+              epoch: Int64.ZERO,
             ),
             deviceSecret,
           );
@@ -944,38 +957,36 @@ class NomosTestHarness {
             timeout: phaseTimeout ?? _kOtherDeadline,
             onDiagnostic: onDiagnostic,
             run: () async {
-              await plane
-                  .session(workspace)
-                  .offerOutcome(
-                    domain: '__nomos_application_home_v1',
-                    directiveId: 'seedBirthAttestation',
-                    actor: owner,
-                    authorSecret: deviceSecret,
-                    payload: <String, Object?>{
-                      'child': workspace,
-                      'founder': owner,
-                      'verified': 'true',
-                      'parentId': 'root',
-                      'parentKey': devicePublic,
-                      'epoch': 0,
-                      'certChain': jsonEncode(<String, Object?>{
-                        'links': <Object?>[parentCert.toWire()],
-                      }),
-                    },
-                  );
-              await plane
-                  .session(workspace)
-                  .offerOutcome(
-                    domain: '__nomos_application_home_v1',
-                    directiveId: 'seedGenesis',
-                    actor: owner,
-                    authorSecret: deviceSecret,
-                    payload: <String, Object?>{
-                      'principal': owner,
-                      'workspaceId': workspace,
-                      'bornAt': '2000-01-01T00:00:00.000Z',
-                    },
-                  );
+              await plane.session(workspace).offerOutcome(
+                domain: '__nomos_application_home_v1',
+                directiveId: 'seedBirthAttestation',
+                actor: owner,
+                authorSecret: deviceSecret,
+                payload: <String, Object?>{
+                  'child': workspace,
+                  'founder': owner,
+                  'verified': 'true',
+                  'parentId': 'root',
+                  'parentKey': devicePublic,
+                  'epoch': 0,
+                  'certChain': jsonEncode(<String, Object?>{
+                    'links': <Object?>[
+                      _birthCertificateLawValue(parentCert),
+                    ],
+                  }),
+                },
+              );
+              await plane.session(workspace).offerOutcome(
+                domain: '__nomos_application_home_v1',
+                directiveId: 'seedGenesis',
+                actor: owner,
+                authorSecret: deviceSecret,
+                payload: <String, Object?>{
+                  'principal': owner,
+                  'workspaceId': workspace,
+                  'bornAt': '2000-01-01T00:00:00.000Z',
+                },
+              );
             },
           );
         } on DomainNotInstalledForSession {
@@ -993,9 +1004,9 @@ class NomosTestHarness {
       final sessionLaw = installedHashes.isEmpty
           ? 'installed'
           : (birthsApplicationHome
-                    ? installedHashes.last
-                    : installedHashes.first)
-                .substring(0, 12);
+                  ? installedHashes.last
+                  : installedHashes.first)
+              .substring(0, 12);
       phase('ready — session "$workspace" connected (law $sessionLaw)');
       // THE DECOY SESSION (multi-workspace by default in tests): sole-session inference is how
       // single-workspace assumptions ship — with one session connected, an op that forgot its session
@@ -1125,24 +1136,21 @@ class NomosTestHarness {
         );
       }
     }
-    final entry =
-        nodeEntry ??
+    final entry = nodeEntry ??
         await _resolveEntry(node, resolveFrom ?? Directory.current.path);
-    final effectiveRuntimeDir =
-        runtimeDir ??
+    final effectiveRuntimeDir = runtimeDir ??
         Platform.environment['NOMOS_CANDIDATE_RUNTIME'] ??
         Platform.environment['NOMOS_DART_RUNTIME'] ??
         Platform.environment['NOMOS_OFFLINE_RUNTIME'] ??
         await _sourceCandidateRuntime(entry);
     final adjacentInstaller = '${File(entry).parent.path}/offline-install.mjs';
-    final resolvedHelper =
-        installHelper ??
+    final resolvedHelper = installHelper ??
         (File(adjacentInstaller).existsSync()
             ? adjacentInstaller
             : '${File(entry).parent.path}/offline-install.ts');
     final useInRepoScript =
         (resolvedHelper.endsWith('.ts') || resolvedHelper.endsWith('.mjs')) &&
-        File(resolvedHelper).existsSync();
+            File(resolvedHelper).existsSync();
     final githolonCmd = installHelper == null ? 'npx githolon' : resolvedHelper;
 
     final workdir = await Directory.systemTemp.createTemp('nomos-cluster-');
@@ -1402,12 +1410,10 @@ class NomosTestHarness {
         'no lawUsdzPaths — pass the build/<name>.law.usdz `npx githolon compile` emits',
       );
     }
-    final entry =
-        nodeEntry ??
+    final entry = nodeEntry ??
         await _resolveEntry(node, resolveFrom ?? Directory.current.path);
-    final bareUid = subject.startsWith('user:')
-        ? subject.substring(5)
-        : subject;
+    final bareUid =
+        subject.startsWith('user:') ? subject.substring(5) : subject;
     final http = HttpClient();
     Future<Map<String, Object?>> post(
       String path,
@@ -1481,8 +1487,8 @@ class NomosTestHarness {
             }
             rethrow;
           }
-          frameworkHash = ((created['controller'] as Map?)?['domainHash'])
-              ?.toString();
+          frameworkHash =
+              ((created['controller'] as Map?)?['domainHash'])?.toString();
           final existing = await get(
             '/v2/workspaces/$platformWorkspace/domains',
           );
@@ -1571,7 +1577,7 @@ class NomosTestHarness {
       );
       final currentLaw =
           (parentDomains['currentLaw'] as Map?)?.cast<String, Object?>() ??
-          const <String, Object?>{};
+              const <String, Object?>{};
       final controlHomeLawHash =
           currentLaw[applicationHomeDomain]?.toString() ?? '';
       if (controlHomeLawHash.isEmpty) {
@@ -1609,8 +1615,7 @@ class NomosTestHarness {
       // restart while offline must not fetch any member before it can replay the persisted ledger. Release CI
       // supplies the exact candidate bundle. An ordinary local test pins all three artifacts advertised by its
       // ephemeral cloud while still online; never combine a candidate kernel with stale framework law.
-      final candidateRuntimeDir =
-          Platform.environment['NOMOS_DART_RUNTIME'] ??
+      final candidateRuntimeDir = Platform.environment['NOMOS_DART_RUNTIME'] ??
           Platform.environment['NOMOS_OFFLINE_RUNTIME'];
       final localRuntime = await Directory(
         '${workdir.path}/client-runtime',
@@ -1630,8 +1635,8 @@ class NomosTestHarness {
               _KernelRuntimeArtifact.controllerLaw:
                   '$candidateRuntimeDir/${_KernelRuntimeArtifact.controllerLaw.fileName}',
             };
-      final hasCandidateBundle =
-          candidateArtifacts.length == _KernelRuntimeArtifact.values.length &&
+      final hasCandidateBundle = candidateArtifacts.length ==
+              _KernelRuntimeArtifact.values.length &&
           candidateArtifacts.values.every((path) => File(path).existsSync());
       if (hasCandidateBundle) {
         for (final artifact in candidateArtifacts.entries) {
@@ -1785,7 +1790,12 @@ class NomosTestHarness {
               'validFromEpoch': 0,
               'grantedAt': DateTime.now().toUtc().toIso8601String(),
               'idpToken': idpToken,
-              'delegationCert': jsonEncode(delegationCert),
+              // The framework law owns this USDA object shape. Keep the
+              // compiler-generated protobuf certificate structured while
+              // lowering it into that domain value; never resurrect the
+              // retired JSON string envelope (`delegationCert`).
+              'delegationCertificate':
+                  _birthCertificateLawValue(delegationCert),
             },
           );
           final enrollmentSync = await plane.sync(
@@ -1821,36 +1831,34 @@ class NomosTestHarness {
           // authenticated platform holon mounted. Bind this parent certificate operation to the
           // platform session explicitly; relying on the single-session convenience API becomes
           // ambiguous as soon as the ceremony correctly opens the target workspace in-kernel.
-          final homeCert = await plane
-              .session('$clientId-platform-author')
-              .signBirthCert(
-                NomosBirthCertificateSpec(
-                  child: homeName,
-                  founder: subject,
-                  // The cert's `verified` must MATCH the gate verdict (CAS-as-law): the offer carries
-                  // the dev-IdP token, so the gate resolves a VERIFIED founder.
-                  verified: true,
-                  parentKey: device.publicB64,
-                  parentId: platformWorkspace,
-                  epoch: 0,
-                ),
-                device.secret,
-              );
-          final localBirth = await plane
-              .session('$clientId-platform-author')
-              .offerOutcome(
-                domain: applicationHomeDomain,
-                directiveId: 'nomosInternalBirthReceivingGroup7c1f5e',
-                actor: subject,
-                authorSecret: device.secret,
-                payload: <String, Object?>{
-                  'owner': subject,
-                  'frameworkHash': frameworkHash,
-                  'lawHash': applicationHomeLawHash,
-                  'bornAt': DateTime.now().toUtc().toIso8601String(),
-                },
-                birthCertificate: homeCert,
-              );
+          final homeCert =
+              await plane.session('$clientId-platform-author').signBirthCert(
+                    BirthCertificate(
+                      child: homeName,
+                      founder: subject,
+                      // The cert's `verified` must MATCH the gate verdict (CAS-as-law): the offer carries
+                      // the dev-IdP token, so the gate resolves a VERIFIED founder.
+                      verified: true,
+                      parentKey: base64Decode(device.publicB64),
+                      parentId: platformWorkspace,
+                      epoch: Int64.ZERO,
+                    ),
+                    device.secret,
+                  );
+          final localBirth =
+              await plane.session('$clientId-platform-author').offerOutcome(
+                    domain: applicationHomeDomain,
+                    directiveId: 'nomosInternalBirthReceivingGroup7c1f5e',
+                    actor: subject,
+                    authorSecret: device.secret,
+                    payload: <String, Object?>{
+                      'owner': subject,
+                      'frameworkHash': frameworkHash,
+                      'lawHash': applicationHomeLawHash,
+                      'bornAt': DateTime.now().toUtc().toIso8601String(),
+                    },
+                    birthCertificate: homeCert,
+                  );
           if (!localBirth.born.contains(homeName)) {
             throw NomosTestHarnessException(
               'cloudBound: the local parent kernel admitted the receiving-group offer but did not birth '
@@ -2006,8 +2014,7 @@ class NomosTestHarness {
           if (r['pushFailed'] != true &&
               r['stillAhead'] != true &&
               r['offline'] != true &&
-              r['deferred'] != true)
-            pending.remove(ws);
+              r['deferred'] != true) pending.remove(ws);
         } on NomosTestHarnessException {
           rethrow;
         } catch (e) {
@@ -2418,14 +2425,14 @@ class NomosTestHarness {
       // transport first makes its incoming stream wait on consumers that can no longer receive their
       // unwatch/done messages—a deterministic teardown deadlock in reactive Flutter tests.
       await _plane.dispose().timeout(
-        _phaseTimeout ?? _kOtherDeadline,
-        onTimeout: () => throw HarnessPhaseTimeout(
-          phase: 'dispose: close bridge watches',
-          workspace: workspace,
-          elapsed: _phaseTimeout ?? _kOtherDeadline,
-          awaiting: 'NomosBridge.dispose',
-        ),
-      );
+            _phaseTimeout ?? _kOtherDeadline,
+            onTimeout: () => throw HarnessPhaseTimeout(
+              phase: 'dispose: close bridge watches',
+              workspace: workspace,
+              elapsed: _phaseTimeout ?? _kOtherDeadline,
+              awaiting: 'NomosBridge.dispose',
+            ),
+          );
     } catch (e) {
       _diag(
         '[nomos-test-harness] bridge dispose error (continuing to runner cleanup): $e',
@@ -2433,14 +2440,14 @@ class NomosTestHarness {
     }
     try {
       await _transport.dispose().timeout(
-        _phaseTimeout ?? _kOtherDeadline,
-        onTimeout: () => throw HarnessPhaseTimeout(
-          phase: 'dispose: stop the node runner',
-          workspace: workspace,
-          elapsed: _phaseTimeout ?? _kOtherDeadline,
-          awaiting: 'NodeRunnerTransport.dispose',
-        ),
-      );
+            _phaseTimeout ?? _kOtherDeadline,
+            onTimeout: () => throw HarnessPhaseTimeout(
+              phase: 'dispose: stop the node runner',
+              workspace: workspace,
+              elapsed: _phaseTimeout ?? _kOtherDeadline,
+              awaiting: 'NodeRunnerTransport.dispose',
+            ),
+          );
     } catch (e) {
       _diag(
         '[nomos-test-harness] transport dispose error (continuing to temp-dir cleanup): $e',
@@ -2574,10 +2581,13 @@ class NomosTestHarness {
       '@githolon/client/runner/node-entry.mjs',
       '@githolon/client/runner/node-entry.ts',
     ]) {
-      final r = await Process.run(node, [
-        '-p',
-        "require.resolve('$entry')",
-      ], workingDirectory: from);
+      final r = await Process.run(
+          node,
+          [
+            '-p',
+            "require.resolve('$entry')",
+          ],
+          workingDirectory: from);
       final out = (r.stdout as String).trim();
       if (r.exitCode == 0 && out.isNotEmpty) return out;
     }
@@ -2610,21 +2620,20 @@ class WorkspaceSnapshot {
 
   /// JSON round-trip so a staged snapshot persists to disk verbatim (the bytes + provenance).
   Map<String, Object?> toJson() => {
-    'workspace': workspace,
-    'snapshotB64': snapshotB64,
-    'head': head,
-    'lawHashes': lawHashes,
-    'capturedAt': capturedAt.toUtc().toIso8601String(),
-  };
+        'workspace': workspace,
+        'snapshotB64': snapshotB64,
+        'head': head,
+        'lawHashes': lawHashes,
+        'capturedAt': capturedAt.toUtc().toIso8601String(),
+      };
 
   factory WorkspaceSnapshot.fromJson(Map<String, Object?> j) =>
       WorkspaceSnapshot(
         workspace: j['workspace'] as String,
         snapshotB64: j['snapshotB64'] as String,
         head: (j['head'] ?? '') as String,
-        lawHashes: ((j['lawHashes'] as List?) ?? const [])
-            .map((e) => '$e')
-            .toList(),
+        lawHashes:
+            ((j['lawHashes'] as List?) ?? const []).map((e) => '$e').toList(),
         capturedAt: DateTime.parse(
           (j['capturedAt'] ?? DateTime.now().toUtc().toIso8601String())
               as String,
@@ -2646,19 +2655,20 @@ class PlaneSnapshot {
   const PlaneSnapshot({required this.workspaces, required this.capturedAt});
 
   Map<String, Object?> toJson() => {
-    'workspaces': workspaces.map((k, v) => MapEntry(k, v.toJson())),
-    'capturedAt': capturedAt.toUtc().toIso8601String(),
-  };
+        'workspaces': workspaces.map((k, v) => MapEntry(k, v.toJson())),
+        'capturedAt': capturedAt.toUtc().toIso8601String(),
+      };
 
   factory PlaneSnapshot.fromJson(Map<String, Object?> j) => PlaneSnapshot(
-    workspaces: ((j['workspaces'] as Map?) ?? const {}).map(
-      (k, v) => MapEntry(
-        '$k',
-        WorkspaceSnapshot.fromJson((v as Map).cast<String, Object?>()),
-      ),
-    ),
-    capturedAt: DateTime.parse(
-      (j['capturedAt'] ?? DateTime.now().toUtc().toIso8601String()) as String,
-    ),
-  );
+        workspaces: ((j['workspaces'] as Map?) ?? const {}).map(
+          (k, v) => MapEntry(
+            '$k',
+            WorkspaceSnapshot.fromJson((v as Map).cast<String, Object?>()),
+          ),
+        ),
+        capturedAt: DateTime.parse(
+          (j['capturedAt'] ?? DateTime.now().toUtc().toIso8601String())
+              as String,
+        ),
+      );
 }