@githolon/dsl 0.107.4 → 0.108.1

package/dart/test/webview_bridge_test.dart

@@ -6,15 +6,123 @@
 import 'dart:async';
 import 'dart:convert';
 import 'dart:io';
+import 'dart:typed_data';
 
 import 'package:nomos_client/src/nms_generated_runtime.dart';
+import 'package:nomos_types/nomos_kernel_protocol.dart' as protocol;
+import 'package:fixnum/fixnum.dart' as fixnum;
 import 'package:test/test.dart';
 
+protocol.RuntimeResponse _runtimeLifecycleResponse(
+  protocol.RuntimeRequest request,
+) {
+  final response = protocol.RuntimeResponse(
+    protocolVersion: 2,
+    requestId: request.requestId,
+  );
+  switch (request.whichCommand()) {
+    case protocol.RuntimeRequest_Command.listWorkspaces:
+      response.workspaceList = protocol.WorkspaceList();
+      break;
+    case protocol.RuntimeRequest_Command.prepareDomain:
+      response.domainPrepared = protocol.DomainPrepared(
+        domain: request.prepareDomain.domain,
+        packageSha256: request.prepareDomain.packageSha256,
+      );
+      break;
+    case protocol.RuntimeRequest_Command.resolveCustodyBreak:
+      response.custodyBreakResolved = protocol.CustodyBreakResolved(
+        session: request.resolveCustodyBreak.session,
+        decision: request.resolveCustodyBreak.decision,
+      );
+      break;
+    case protocol.RuntimeRequest_Command.startAutoSync:
+      response.autoSyncStarted =
+          protocol.AutoSyncStarted(session: request.startAutoSync.session);
+      break;
+    case protocol.RuntimeRequest_Command.stopAutoSync:
+      response.autoSyncStopped =
+          protocol.AutoSyncStopped(session: request.stopAutoSync.session);
+      break;
+    case protocol.RuntimeRequest_Command.syncWorkspace:
+      response.syncWorkspace = protocol.SyncWorkspaceResponse(
+        workspace: request.syncWorkspace.session,
+      );
+      break;
+    case protocol.RuntimeRequest_Command.unwatch:
+      response.watchStopped = protocol.WatchStopped();
+      break;
+    case protocol.RuntimeRequest_Command.closeRealm:
+      response.realmClosed = protocol.RealmClosed();
+      break;
+    case protocol.RuntimeRequest_Command.modelLifecycle:
+      final lifecycle = request.modelLifecycle;
+      switch (lifecycle.whichOperation()) {
+        case protocol.ModelLifecycleRequest_Operation.stage:
+          response.modelLifecycle = protocol.ModelLifecycleResponse(
+            stage: protocol.ModelLifecycleStage.MODEL_LIFECYCLE_STAGE_PENDING,
+            accepted: true,
+          );
+          break;
+        case protocol.ModelLifecycleRequest_Operation.adopt:
+          response.modelLifecycle = protocol.ModelLifecycleResponse(
+            stage: protocol
+                .ModelLifecycleStage.MODEL_LIFECYCLE_STAGE_ACCEPTANCE_REQUIRED,
+            accepted: false,
+            review: protocol.ModelReview(
+              checkedActions: fixnum.Int64(1),
+              candidateActions: fixnum.Int64(1),
+              sameOutcome: false,
+              differences: [
+                protocol.ModelDifference(
+                  kind: protocol
+                      .ModelDifferenceKind.MODEL_DIFFERENCE_KIND_OUTCOME,
+                  action: 'registerSite',
+                  summary: 'registerSite has a different outcome',
+                ),
+              ],
+            ),
+          );
+          break;
+        case protocol.ModelLifecycleRequest_Operation.restore:
+          response.modelLifecycle = protocol.ModelLifecycleResponse(
+            stage: protocol
+                .ModelLifecycleStage.MODEL_LIFECYCLE_STAGE_ACCEPTANCE_REQUIRED,
+            accepted: false,
+            review: protocol.ModelReview(
+              checkedActions: fixnum.Int64(1),
+              candidateActions: fixnum.Int64(1),
+              sameOutcome: false,
+              differences: [
+                protocol.ModelDifference(
+                  kind:
+                      protocol.ModelDifferenceKind.MODEL_DIFFERENCE_KIND_RULES,
+                  action: 'setMood',
+                  summary: 'setMood is governed by a different rule',
+                ),
+              ],
+            ),
+          );
+          break;
+        case protocol.ModelLifecycleRequest_Operation.notSet:
+          throw StateError('Model lifecycle operation is required');
+      }
+      break;
+    default:
+      throw StateError(
+        'Fake lifecycle transport does not implement '
+        '${request.whichCommand().name}',
+      );
+  }
+  return response;
+}
+
 /// A fake runner-over-a-transport: records sent requests, replies the way `webview-runner.mjs` does, and can
 /// push reactive `watch` events. Lets us drive [NomosBridge] without a real WebView.
 class FakeRunner implements BridgeTransport {
   final _incoming = StreamController<Map<String, Object?>>.broadcast();
   final List<Map<String, Object?>> sent = [];
+  final List<protocol.RuntimeRequest> runtimeRequests = [];
   String? lastWatchSubId;
   bool acknowledgeWatch = true;
   bool acknowledgeUnwatch = true;
@@ -31,6 +139,29 @@ class FakeRunner implements BridgeTransport {
   @override
   Stream<Map<String, Object?>> get messages => _incoming.stream;
 
+  @override
+  Future<protocol.RuntimeResponse> invokeRuntime(
+    protocol.RuntimeRequest request,
+  ) async {
+    runtimeRequests.add(request.deepCopy());
+    if (!acknowledgeUnwatch && request.hasUnwatch()) {
+      return Completer<protocol.RuntimeResponse>().future;
+    }
+    if (request.hasSyncWorkspace() && !request.syncWorkspace.admit) {
+      return protocol.RuntimeResponse(
+        protocolVersion: 2,
+        requestId: request.requestId,
+        failure: protocol.RuntimeFailure(
+          code: 'nomos.sync.refused',
+          message: 'typed sync failed',
+          component: 'test.runner',
+          workspace: request.syncWorkspace.session,
+        ),
+      );
+    }
+    return _runtimeLifecycleResponse(request);
+  }
+
   @override
   void send(Map<String, Object?> message) {
     sent.add(message);
@@ -193,15 +324,33 @@ class FakeRunner implements BridgeTransport {
                 }));
           break;
         case 'cryptoOwnedDeviceRequest':
-          _incoming.add(reply({'request': 'opaque-owned-device-request'}));
+          _incoming.add(reply({
+            'request': {
+              'v': 1,
+              'workspace': 'notes',
+              'principal': 'user:alice',
+              'scope': 'nomos_internal_owned_read_7c1f5e',
+              'signingPublic': 'AA==',
+              'wrappingPublic': 'AQ==',
+              'signature': 'Ag==',
+            },
+          }));
           break;
         case 'cryptoOwnedPrepareApproval':
           _incoming.add(reply({
             'newKeySubject': 'key:${'a' * 64}',
-            'ownedCustody': 'opaque-owned-custody',
+            'ownedCustody': {
+              'v': 1,
+              'request': args['request'],
+              'hpkeEpk': 'Aw==',
+              'ct': 'BA==',
+              'keyCommitment': '0' * 64,
+              'principalWrappingPublic': 'BQ==',
+            },
             'verifiedVia': 'nomos:test-root',
             'validFromEpoch': 0,
             'approvedAt': '2026-07-18T14:20:00.000Z',
+            '__nomos_owned_device_key_subject_7c1f5e': 'key:${'b' * 64}',
           }));
           break;
         case 'cryptoOwnedScopeKeys':
@@ -220,9 +369,11 @@ class FakeRunner implements BridgeTransport {
           break;
         case 'cryptoOwnedPrepareRecordAction':
           _incoming.add(reply({
+            '__nomos_owned_device_key_subject_7c1f5e': 'key:${'c' * 64}',
             'recordId': 'note-1',
             'peer': 'user:bob',
             'epoch': 2,
+            'sharedAt': '2026-07-18T14:25:00.000Z',
             'wraps': <Object?>[],
           }));
           break;
@@ -351,12 +502,160 @@ class FakeRunner implements BridgeTransport {
       });
 }
 
+/// Proves that generated application reads bypass the legacy operation bus.
+/// The ordinary bridge remains present for lifecycle setup, but a query can
+/// only succeed through the generated Runtime v2 kernel-call capability.
+class FakeTypedRunner extends FakeRunner
+    implements NomosKernelCallTransport, NomosRuntimeV2Transport {
+  protocol.CallRequest? lastKernelCall;
+  String? lastKernelSession;
+  @override
+  Future<protocol.CallResponse> callKernel({
+    required String session,
+    required protocol.CallRequest request,
+  }) async {
+    lastKernelSession = session;
+    lastKernelCall = request;
+    if (request.hasQuery() && request.query.hasOwnedDeviceRequest()) {
+      final value = OwnedDeviceRequest(
+        v: 1,
+        workspace: 'home',
+        principal: 'user:alice',
+        scope: request.query.ownedDeviceRequest.scope,
+        signingPublic: 'AA==',
+        wrappingPublic: 'AQ==',
+        signature: 'Ag==',
+      );
+      return protocol.CallResponse(
+        protocolVersion: 1,
+        requestId: request.requestId,
+        query: protocol.QueryResponse(
+          ownedDeviceRequest: protocol.OwnedDeviceRequestResponse(
+            requestUsda: value.encodeUsda(),
+          ),
+        ),
+      );
+    }
+    if (request.hasQuery() && request.query.hasOwnedPrepareApproval()) {
+      final device = OwnedDeviceRequest.decodeUsda(
+        Uint8List.fromList(
+          request.query.ownedPrepareApproval.requestUsda,
+        ),
+      );
+      final custody = OwnedCustody(
+        v: 1,
+        request: device,
+        hpkeEpk: 'Aw==',
+        ct: 'BA==',
+        keyCommitment: '0' * 64,
+        principalWrappingPublic: 'BQ==',
+      );
+      return protocol.CallResponse(
+        protocolVersion: 1,
+        requestId: request.requestId,
+        query: protocol.QueryResponse(
+          ownedPrepareApproval: protocol.OwnedPrepareApprovalResponse(
+            newKeySubject: 'key:${'a' * 64}',
+            ownedCustodyUsda: custody.encodeUsda(),
+            verifiedVia: 'nomos:test-root',
+            validFromEpoch: fixnum.Int64.ZERO,
+            approvedAtUnixMillis: fixnum.Int64(1787062800000),
+            ownedKeySubject: 'key:${'b' * 64}',
+          ),
+        ),
+      );
+    }
+    return protocol.CallResponse(
+      protocolVersion: 1,
+      requestId: request.requestId,
+      query: protocol.QueryResponse(
+        resultUsda: utf8.encode('''#usda 1.0
+(
+    defaultPrim = "Result"
+)
+def NomosReadResult "Result"
+{
+    def NomosListValue "Rows"
+    {
+    }
+}
+'''),
+      ),
+    );
+  }
+
+  @override
+  Future<protocol.RuntimeResponse> invokeRuntime(
+      protocol.RuntimeRequest request) async {
+    runtimeRequests.add(request.deepCopy());
+    final response = protocol.RuntimeResponse(
+      protocolVersion: 2,
+      requestId: request.requestId,
+    );
+    switch (request.whichCommand()) {
+      case protocol.RuntimeRequest_Command.listWorkspaces:
+        response.workspaceList = protocol.WorkspaceList(workspaces: [
+          protocol.WorkspaceSummary(
+            session: 'home',
+            workspace: 'home',
+            residency: protocol.WorkspaceResidency.WORKSPACE_RESIDENCY_MOUNTED,
+            syncPosture: protocol
+                .WorkspaceSyncPosture.WORKSPACE_SYNC_POSTURE_CLOUD_BOUND,
+          ),
+        ]);
+        break;
+      case protocol.RuntimeRequest_Command.prepareDomain:
+        response.domainPrepared = protocol.DomainPrepared(
+          domain: request.prepareDomain.domain,
+          packageSha256: request.prepareDomain.packageSha256,
+        );
+        break;
+      case protocol.RuntimeRequest_Command.resolveCustodyBreak:
+        response.custodyBreakResolved = protocol.CustodyBreakResolved(
+          session: request.resolveCustodyBreak.session,
+          decision: request.resolveCustodyBreak.decision,
+        );
+        break;
+      case protocol.RuntimeRequest_Command.startAutoSync:
+        response.autoSyncStarted =
+            protocol.AutoSyncStarted(session: request.startAutoSync.session);
+        break;
+      case protocol.RuntimeRequest_Command.stopAutoSync:
+        response.autoSyncStopped =
+            protocol.AutoSyncStopped(session: request.stopAutoSync.session);
+        break;
+      case protocol.RuntimeRequest_Command.syncWorkspace:
+        response.syncWorkspace = protocol.SyncWorkspaceResponse(
+          workspace: request.syncWorkspace.session,
+        );
+        break;
+      case protocol.RuntimeRequest_Command.closeRealm:
+        response.realmClosed = protocol.RealmClosed();
+        break;
+      case protocol.RuntimeRequest_Command.modelLifecycle:
+        response.modelLifecycle =
+            _runtimeLifecycleResponse(request).modelLifecycle;
+        break;
+      default:
+        throw StateError(
+            'FakeTypedRunner does not implement ${request.whichCommand().name}');
+    }
+    return response;
+  }
+}
+
 class ErrorRunner implements BridgeTransport {
   final _incoming = StreamController<Map<String, Object?>>.broadcast();
 
   @override
   Stream<Map<String, Object?>> get messages => _incoming.stream;
 
+  @override
+  Future<protocol.RuntimeResponse> invokeRuntime(
+    protocol.RuntimeRequest request,
+  ) async =>
+      _runtimeLifecycleResponse(request);
+
   @override
   void send(Map<String, Object?> message) {}
 
@@ -380,6 +679,11 @@ class ReplayTransport implements BridgeTransport {
   @override
   Stream<Map<String, Object?>> get messages => _incoming.stream;
   @override
+  Future<protocol.RuntimeResponse> invokeRuntime(
+    protocol.RuntimeRequest request,
+  ) async =>
+      _runtimeLifecycleResponse(request);
+  @override
   void send(Map<String, Object?> message) {
     lastRequest = message;
     final id = message['id'];
@@ -459,6 +763,7 @@ Object? _expectedTyped(String op, Map<String, Object?> result) {
     case 'sum':
       return result['sum'];
     case 'sync':
+      return isA<protocol.SyncWorkspaceResponse>();
     case 'lawStatus':
       return result;
     default:
@@ -492,6 +797,8 @@ void main() {
         () => expect(corpus['version'], kWebviewBridgeVersion));
     for (final c in cases) {
       final op = c['op'] as String;
+      if (op == 'sync')
+        continue; // Runtime v2 has its own protobuf conformance tests.
       final args = (c['args'] as Map).cast<String, Object?>();
       final result = (c['result'] as Map).cast<String, Object?>();
       test("'$op' request args + parsed result match the corpus", () async {
@@ -636,6 +943,93 @@ void main() {
     await bridge.ready.timeout(const Duration(seconds: 1));
   });
 
+  test('nominal queries use Runtime v2 protobuf and return USDA bytes',
+      () async {
+    final typedRunner = FakeTypedRunner();
+    final typedBridge = NomosBridge(typedRunner);
+    addTearDown(typedBridge.dispose);
+    await typedBridge.ready;
+    await typedBridge.connect(
+      cloud: 'https://c',
+      workspace: 'home',
+      session: 'home',
+    );
+    typedRunner.sent.clear();
+
+    final result = await typedBridge.nmsQueryUsda(
+      NmsInternalGeneratedQueries.create(
+        domain: 'entries',
+        query: 'entriesByOwner',
+        canonicalArgumentsUsda: Uint8List.fromList(utf8.encode('''#usda 1.0
+(
+    defaultPrim = "Arguments"
+)
+def NomosQueryArguments "Arguments"
+{
+    custom string nomos:owner = "user:ada"
+}
+''')),
+      ),
+      null,
+      'user:ada',
+      'home',
+    );
+
+    expect(result, isA<Uint8List>());
+    expect(utf8.decode(result), startsWith('#usda 1.0'));
+    expect(typedRunner.sent, isEmpty,
+        reason: 'the JSON-shaped BridgeTransport must not carry the query');
+    expect(typedRunner.lastKernelSession, 'home');
+    expect(typedRunner.lastKernelCall!.hasQuery(), isTrue);
+    expect(typedRunner.lastKernelCall!.query.rows.id, 'entriesByOwner');
+    expect(
+      typedRunner.lastKernelCall!.query.resultFormat,
+      protocol.QueryResultFormat.QUERY_RESULT_FORMAT_NOMINAL_USDA,
+    );
+  });
+
+  test('steady-state lifecycle uses generated Runtime v2 commands', () async {
+    final typedRunner = FakeTypedRunner();
+    final typedBridge = NomosBridge(typedRunner);
+    await typedBridge.ready;
+    await typedBridge.connect(
+      cloud: 'https://c',
+      workspace: 'home',
+      session: 'home',
+    );
+    typedRunner.sent.clear();
+
+    final workspaces = await typedBridge.listWorkspaces();
+    await typedBridge.session('home').prepareDomain(
+          domain: 'guestbook',
+          packageHash: 'a' * 64,
+        );
+    await typedBridge.session('home').autoSync(fallbackMs: 60000);
+    await typedBridge.session('home').stopAutoSync();
+    final custody = await typedBridge.session('home').resolveCustodyBreak(
+          protocol.CustodyBreakDecision.CUSTODY_BREAK_DECISION_ADOPT,
+        );
+
+    expect(workspaces.single.workspace, 'home');
+    expect(
+      custody.decision,
+      protocol.CustodyBreakDecision.CUSTODY_BREAK_DECISION_ADOPT,
+    );
+    expect(
+      typedRunner.runtimeRequests.map((request) => request.whichCommand()),
+      [
+        protocol.RuntimeRequest_Command.listWorkspaces,
+        protocol.RuntimeRequest_Command.prepareDomain,
+        protocol.RuntimeRequest_Command.startAutoSync,
+        protocol.RuntimeRequest_Command.stopAutoSync,
+        protocol.RuntimeRequest_Command.resolveCustodyBreak,
+      ],
+    );
+    expect(typedRunner.sent, isEmpty,
+        reason: 'no JSON command envelope carries steady-state lifecycle');
+    await typedBridge.dispose();
+  });
+
   test('a local durability span remains workspace/head specific', () async {
     await bridge.ready;
     bridge.noteLocalSpan(
@@ -750,28 +1144,35 @@ void main() {
     expect(bridge.principal, 'user:ada');
   });
 
-  test(
-      'generated model restoration crosses one framework-private bridge operation',
+  test('generated model restoration uses one exact Runtime v2 command',
       () async {
     await bridge.ready;
+    await bridge.connect(cloud: 'https://c', workspace: 'evo');
+    runner.runtimeRequests.clear();
     final verdict = await bridge.nomosFrameworkRestorePreviousGeneratedModel(
       domain: 'evo',
       currentHash: 'current-law-hash',
       because: 'the previous operating policy is required',
     );
 
-    expect(verdict['ok'], isFalse);
-    expect(verdict['stage'], 'acceptance');
-    expect(((verdict['report'] as Map)['divergences'] as List).single,
-        containsPair('directiveId', 'setMood'));
-    final request = runner.sent.firstWhere(
-      (message) => message['op'] == 'restorePreviousGeneratedModel',
+    expect(verdict.accepted, isFalse);
+    expect(
+      verdict.stage,
+      protocol.ModelLifecycleStage.MODEL_LIFECYCLE_STAGE_ACCEPTANCE_REQUIRED,
     );
-    expect((request['args'] as Map).cast<String, Object?>(), {
-      'domain': 'evo',
-      'currentHash': 'current-law-hash',
-      'because': 'the previous operating policy is required',
-    });
+    expect(verdict.review.differences.single.action, 'setMood');
+    final request = runner.runtimeRequests.singleWhere(
+      (request) =>
+          request.hasModelLifecycle() && request.modelLifecycle.hasRestore(),
+    );
+    expect(request.modelLifecycle.restore.domain, 'evo');
+    expect(request.modelLifecycle.restore.currentHash, 'current-law-hash');
+    expect(request.modelLifecycle.restore.acceptanceReason,
+        'the previous operating policy is required');
+    expect(
+        runner.sent.where(
+            (message) => message['op'] == 'restorePreviousGeneratedModel'),
+        isEmpty);
   });
 
   test(
@@ -788,7 +1189,7 @@ void main() {
     expect(page.done, isFalse);
     expect((await bridge.queryById('Entry_1')).first['id'], 'Entry_1');
     expect(await bridge.count('entries'), 7);
-    expect(await bridge.sync(), {'pushed': true});
+    expect((await bridge.sync()).workspace, 'ws');
     expect(
         await bridge.lawStatus('abc'), {'installed': true, 'drifted': false});
   });
@@ -868,50 +1269,53 @@ void main() {
     await readBridge.dispose();
   });
 
-  test('devices traffic one opaque request and one atomic framework approval',
+  test(
+      'devices retain nominal request and custody types through one atomic approval',
       () async {
-    await bridge.ready;
+    final typedRunner = FakeTypedRunner();
+    final typedBridge = NomosBridge(typedRunner);
+    addTearDown(typedBridge.dispose);
+    await typedBridge.ready;
+    await typedBridge.connect(
+      cloud: 'https://c',
+      workspace: 'home',
+      session: 'home',
+      authorSecret: base64Encode(List<int>.filled(32, 7)),
+      authToken: 'e30.eyJzdWIiOiJhbGljZSJ9.',
+    );
+    NomosOwnedDeviceApprovalPreparation? approved;
     final devices = NomosDevices(
-      bridge: bridge,
+      bridge: typedBridge.session('home'),
       domain: 'notes',
       domainHash: 'a' * 64,
       actor: 'user:alice',
       scope: 'nomos_internal_owned_read_7c1f5e',
+      approvePrepared: (preparation) async {
+        approved = preparation;
+        return const NomosOfferOutcome(
+          head: 'HEAD-owned-approval',
+          created: [],
+          workspace: 'notes',
+        );
+      },
     );
 
     final request = await devices.request();
-    expect(request, 'opaque-owned-device-request');
-    final requestCall = runner.sent.firstWhere(
-      (message) => message['op'] == 'cryptoOwnedDeviceRequest',
-    );
-    expect((requestCall['args'] as Map)['scope'],
-        'nomos_internal_owned_read_7c1f5e');
+    expect(request.workspace, 'home');
+    expect(request.principal, 'user:alice');
+    expect(request.scope, 'nomos_internal_owned_read_7c1f5e');
+    expect(typedRunner.lastKernelCall!.query.hasOwnedDeviceRequest(), isTrue);
 
     final outcome = await devices.approve(request);
     expect(outcome.head, 'HEAD-owned-approval');
-    final prepareCall = runner.sent.firstWhere(
-      (message) => message['op'] == 'cryptoOwnedPrepareApproval',
-    );
-    expect((prepareCall['args'] as Map).cast<String, Object?>(), {
-      'request': 'opaque-owned-device-request',
-      'scope': 'nomos_internal_owned_read_7c1f5e',
-    });
-    final offerCall = runner.sent.firstWhere(
-      (message) => message['op'] == 'offerDirective',
-    );
-    final offerArgs = (offerCall['args'] as Map).cast<String, Object?>();
-    expect(offerArgs['domain'], 'notes');
-    expect(
-        offerArgs['directiveId'], 'nomos_internal_approve_owned_device_7c1f5e');
-    expect(offerArgs['actor'], 'user:alice');
-    expect(offerArgs['domainHash'], 'a' * 64);
-    expect(offerArgs['payload'], {
-      'newKeySubject': 'key:${'a' * 64}',
-      'ownedCustody': 'opaque-owned-custody',
-      'verifiedVia': 'nomos:test-root',
-      'validFromEpoch': 0,
-      'approvedAt': '2026-07-18T14:20:00.000Z',
-    });
+    expect(typedRunner.lastKernelCall!.query.hasOwnedPrepareApproval(), isTrue);
+    expect(approved?.newKeySubject, 'key:${'a' * 64}');
+    expect(approved?.ownedCustody.request.workspace, 'home');
+    expect(approved?.ownedCustody.keyCommitment, '0' * 64);
+    expect(approved?.verifiedVia, 'nomos:test-root');
+    expect(approved?.validFromEpoch, 0);
+    expect(approved?.approvedAt, '2026-08-18T14:20:00.000Z');
+    expect(approved?.ownedKeySubject, 'key:${'b' * 64}');
   });
 
   test(
@@ -941,7 +1345,9 @@ void main() {
       ),
       peer: 'user:bob',
     );
-    expect(payload, containsPair('recordId', 'note-1'));
+    expect(payload, isA<NomosOwnedSharePreparation>());
+    expect((payload as NomosOwnedSharePreparation).recordId, 'note-1');
+    expect(payload.ownedKeySubject, 'key:${'c' * 64}');
 
     final keyCall = runner.sent.firstWhere(
       (message) => message['op'] == 'cryptoOwnedScopeKeys',
@@ -969,48 +1375,57 @@ void main() {
     });
   });
 
-  test(
-      'generated model adoption crosses one framework-private bridge operation',
-      () async {
+  test('generated model adoption uses one exact Runtime v2 command', () async {
     await bridge.ready;
+    await bridge.connect(cloud: 'https://c', workspace: 'evo');
+    runner.runtimeRequests.clear();
     final verdict = await bridge.nomosFrameworkAdoptGeneratedModel(
       domain: 'evo',
       candidateHash: 'candidate-law-hash',
       because: 'the renamed business action is intentional',
     );
 
-    expect(verdict['ok'], isFalse);
-    expect(verdict['stage'], 'acceptance');
-    expect(((verdict['report'] as Map)['divergences'] as List).single,
-        containsPair('directiveId', 'registerSite'));
-    final request = runner.sent.firstWhere(
-      (message) => message['op'] == 'adoptGeneratedModel',
+    expect(verdict.accepted, isFalse);
+    expect(
+      verdict.stage,
+      protocol.ModelLifecycleStage.MODEL_LIFECYCLE_STAGE_ACCEPTANCE_REQUIRED,
     );
-    expect((request['args'] as Map).cast<String, Object?>(), {
-      'domain': 'evo',
-      'candidateHash': 'candidate-law-hash',
-      'because': 'the renamed business action is intentional',
-    });
+    expect(verdict.review.differences.single.action, 'registerSite');
+    final request = runner.runtimeRequests.singleWhere(
+      (request) =>
+          request.hasModelLifecycle() && request.modelLifecycle.hasAdopt(),
+    );
+    expect(request.modelLifecycle.adopt.domain, 'evo');
+    expect(request.modelLifecycle.adopt.candidateHash, 'candidate-law-hash');
+    expect(request.modelLifecycle.adopt.acceptanceReason,
+        'the renamed business action is intentional');
+    expect(
+        runner.sent.where((message) => message['op'] == 'adoptGeneratedModel'),
+        isEmpty);
   });
 
   test(
-      'generated model staging carries opaque USDA through one framework-private operation',
+      'generated model staging carries USDA bytes in one exact Runtime v2 command',
       () async {
     await bridge.ready;
+    await bridge.connect(cloud: 'https://c', workspace: 'evo');
+    runner.runtimeRequests.clear();
     await bridge.nomosInternalStageGeneratedModel(
       domain: 'evo',
       candidateHash: 'candidate-law-hash',
       lawUsdz: const [1, 2, 3],
     );
 
-    final request = runner.sent.firstWhere(
-      (message) => message['op'] == 'stageGeneratedModel',
+    final request = runner.runtimeRequests.singleWhere(
+      (request) =>
+          request.hasModelLifecycle() && request.modelLifecycle.hasStage(),
     );
-    expect((request['args'] as Map).cast<String, Object?>(), {
-      'domain': 'evo',
-      'candidateHash': 'candidate-law-hash',
-      'lawUsdz': 'AQID',
-    });
+    expect(request.modelLifecycle.stage.domain, 'evo');
+    expect(request.modelLifecycle.stage.candidateHash, 'candidate-law-hash');
+    expect(request.modelLifecycle.stage.lawUsdz, [1, 2, 3]);
+    expect(
+        runner.sent.where((message) => message['op'] == 'stageGeneratedModel'),
+        isEmpty);
   });
 
   test(
@@ -1036,7 +1451,8 @@ void main() {
       ]
     ]);
     await sub.cancel();
-    expect(runner.sent.any((m) => m['op'] == 'unwatch'), isTrue);
+    expect(
+        runner.runtimeRequests.any((request) => request.hasUnwatch()), isTrue);
   });
 
   test('watch cancellation is local and never waits for the runner', () async {
@@ -1046,7 +1462,8 @@ void main() {
     await Future<void>.delayed(Duration.zero);
 
     await sub.cancel().timeout(const Duration(milliseconds: 100));
-    expect(runner.sent.any((message) => message['op'] == 'unwatch'), isTrue);
+    expect(
+        runner.runtimeRequests.any((request) => request.hasUnwatch()), isTrue);
   });
 
   test('signal events are forwarded on their own stream', () async {
@@ -1071,9 +1488,10 @@ void main() {
 
   test('autoSync forwards a scoped signal id', () async {
     await bridge.ready;
-    await bridge.autoSync(signalId: 'signal:ws:list:main');
-    final req = runner.sent.firstWhere((m) => m['op'] == 'autoSync');
-    expect((req['args'] as Map)['signalId'], 'signal:ws:list:main');
+    await bridge.session('ws').autoSync(signalId: 'signal:ws:list:main');
+    final request = runner.runtimeRequests
+        .firstWhere((request) => request.hasStartAutoSync());
+    expect(request.startAutoSync.signalId, 'signal:ws:list:main');
   });
 
   test(
@@ -1463,10 +1881,13 @@ void main() {
     expect(e.message, contains('shallow-insufficient'));
   });
 
-  test(
-      'legacy string-only runner errors still get operation and trace metadata',
-      () async {
+  test('Runtime v2 failures preserve their generated error identity', () async {
     await bridge.ready;
+    await bridge.connect(
+      cloud: 'https://c',
+      workspace: 'ws-1',
+      session: 'ws-1',
+    );
     Object? err;
     try {
       await bridge.sync(admit: false);
@@ -1475,10 +1896,10 @@ void main() {
     }
     expect(err, isA<NomosBridgeError>());
     final e = err as NomosBridgeError;
-    expect(e.message, 'legacy sync failed');
-    expect(e.info.code, 'nomos.bridge.error');
-    expect(e.info.operation, 'sync');
-    expect(e.info.trace.traceId, isNotEmpty);
+    expect(e.message, 'typed sync failed');
+    expect(e.info.code, 'nomos.sync.refused');
+    expect(e.info.component, 'test.runner');
+    expect(e.info.workspace, 'ws-1');
   });
 
   test('typed kernel progress preserves the measured verification fraction',