@githolon/dsl 0.108.0 → 0.108.1

package/dart_types/lib/src/proto/nomos/kernel/v1/kernel.pb.dart

@@ -34,6 +34,8 @@ enum CallRequest_Operation {
   prepareRemoteOffer,
   signOfferPreparation,
   signBirthCertificate,
+  initializeWorkspace,
+  applyWorkspaceEffect,
   notSet
 }
 
@@ -52,6 +54,8 @@ class CallRequest extends $pb.GeneratedMessage {
     PrepareRemoteOfferRequest? prepareRemoteOffer,
     SignOfferPreparationRequest? signOfferPreparation,
     SignBirthCertificateRequest? signBirthCertificate,
+    InitializeWorkspaceRequest? initializeWorkspace,
+    ApplyWorkspaceEffectRequest? applyWorkspaceEffect,
   }) {
     final result = create();
     if (protocolVersion != null) result.protocolVersion = protocolVersion;
@@ -70,6 +74,10 @@ class CallRequest extends $pb.GeneratedMessage {
       result.signOfferPreparation = signOfferPreparation;
     if (signBirthCertificate != null)
       result.signBirthCertificate = signBirthCertificate;
+    if (initializeWorkspace != null)
+      result.initializeWorkspace = initializeWorkspace;
+    if (applyWorkspaceEffect != null)
+      result.applyWorkspaceEffect = applyWorkspaceEffect;
     return result;
   }
 
@@ -95,6 +103,8 @@ class CallRequest extends $pb.GeneratedMessage {
     18: CallRequest_Operation.prepareRemoteOffer,
     19: CallRequest_Operation.signOfferPreparation,
     20: CallRequest_Operation.signBirthCertificate,
+    21: CallRequest_Operation.initializeWorkspace,
+    22: CallRequest_Operation.applyWorkspaceEffect,
     0: CallRequest_Operation.notSet
   };
   static final $pb.BuilderInfo _i = $pb.BuilderInfo(
@@ -102,7 +112,7 @@ class CallRequest extends $pb.GeneratedMessage {
       package:
           const $pb.PackageName(_omitMessageNames ? '' : 'nomos.kernel.v1'),
       createEmptyInstance: create)
-    ..oo(0, [10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20])
+    ..oo(0, [10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22])
     ..aI(1, _omitFieldNames ? '' : 'protocolVersion',
         fieldType: $pb.PbFieldType.OU3)
     ..aOS(2, _omitFieldNames ? '' : 'requestId')
@@ -132,6 +142,12 @@ class CallRequest extends $pb.GeneratedMessage {
     ..aOM<SignBirthCertificateRequest>(
         20, _omitFieldNames ? '' : 'signBirthCertificate',
         subBuilder: SignBirthCertificateRequest.create)
+    ..aOM<InitializeWorkspaceRequest>(
+        21, _omitFieldNames ? '' : 'initializeWorkspace',
+        subBuilder: InitializeWorkspaceRequest.create)
+    ..aOM<ApplyWorkspaceEffectRequest>(
+        22, _omitFieldNames ? '' : 'applyWorkspaceEffect',
+        subBuilder: ApplyWorkspaceEffectRequest.create)
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -164,6 +180,8 @@ class CallRequest extends $pb.GeneratedMessage {
   @$pb.TagNumber(18)
   @$pb.TagNumber(19)
   @$pb.TagNumber(20)
+  @$pb.TagNumber(21)
+  @$pb.TagNumber(22)
   CallRequest_Operation whichOperation() =>
       _CallRequest_OperationByTag[$_whichOneof(0)]!;
   @$pb.TagNumber(10)
@@ -177,6 +195,8 @@ class CallRequest extends $pb.GeneratedMessage {
   @$pb.TagNumber(18)
   @$pb.TagNumber(19)
   @$pb.TagNumber(20)
+  @$pb.TagNumber(21)
+  @$pb.TagNumber(22)
   void clearOperation() => $_clearField($_whichOneof(0));
 
   @$pb.TagNumber(1)
@@ -321,6 +341,30 @@ class CallRequest extends $pb.GeneratedMessage {
   void clearSignBirthCertificate() => $_clearField(20);
   @$pb.TagNumber(20)
   SignBirthCertificateRequest ensureSignBirthCertificate() => $_ensure(12);
+
+  @$pb.TagNumber(21)
+  InitializeWorkspaceRequest get initializeWorkspace => $_getN(13);
+  @$pb.TagNumber(21)
+  set initializeWorkspace(InitializeWorkspaceRequest value) =>
+      $_setField(21, value);
+  @$pb.TagNumber(21)
+  $core.bool hasInitializeWorkspace() => $_has(13);
+  @$pb.TagNumber(21)
+  void clearInitializeWorkspace() => $_clearField(21);
+  @$pb.TagNumber(21)
+  InitializeWorkspaceRequest ensureInitializeWorkspace() => $_ensure(13);
+
+  @$pb.TagNumber(22)
+  ApplyWorkspaceEffectRequest get applyWorkspaceEffect => $_getN(14);
+  @$pb.TagNumber(22)
+  set applyWorkspaceEffect(ApplyWorkspaceEffectRequest value) =>
+      $_setField(22, value);
+  @$pb.TagNumber(22)
+  $core.bool hasApplyWorkspaceEffect() => $_has(14);
+  @$pb.TagNumber(22)
+  void clearApplyWorkspaceEffect() => $_clearField(22);
+  @$pb.TagNumber(22)
+  ApplyWorkspaceEffectRequest ensureApplyWorkspaceEffect() => $_ensure(14);
 }
 
 enum CallResponse_Outcome {
@@ -336,6 +380,8 @@ enum CallResponse_Outcome {
   prepareRemoteOffer,
   signOfferPreparation,
   signBirthCertificate,
+  initializeWorkspace,
+  applyWorkspaceEffect,
   notSet
 }
 
@@ -355,6 +401,8 @@ class CallResponse extends $pb.GeneratedMessage {
     PrepareRemoteOfferResponse? prepareRemoteOffer,
     SignOfferPreparationResponse? signOfferPreparation,
     SignBirthCertificateResponse? signBirthCertificate,
+    InitializeWorkspaceResponse? initializeWorkspace,
+    ApplyWorkspaceEffectResponse? applyWorkspaceEffect,
   }) {
     final result = create();
     if (protocolVersion != null) result.protocolVersion = protocolVersion;
@@ -374,6 +422,10 @@ class CallResponse extends $pb.GeneratedMessage {
       result.signOfferPreparation = signOfferPreparation;
     if (signBirthCertificate != null)
       result.signBirthCertificate = signBirthCertificate;
+    if (initializeWorkspace != null)
+      result.initializeWorkspace = initializeWorkspace;
+    if (applyWorkspaceEffect != null)
+      result.applyWorkspaceEffect = applyWorkspaceEffect;
     return result;
   }
 
@@ -400,6 +452,8 @@ class CallResponse extends $pb.GeneratedMessage {
     19: CallResponse_Outcome.prepareRemoteOffer,
     20: CallResponse_Outcome.signOfferPreparation,
     21: CallResponse_Outcome.signBirthCertificate,
+    22: CallResponse_Outcome.initializeWorkspace,
+    23: CallResponse_Outcome.applyWorkspaceEffect,
     0: CallResponse_Outcome.notSet
   };
   static final $pb.BuilderInfo _i = $pb.BuilderInfo(
@@ -407,7 +461,7 @@ class CallResponse extends $pb.GeneratedMessage {
       package:
           const $pb.PackageName(_omitMessageNames ? '' : 'nomos.kernel.v1'),
       createEmptyInstance: create)
-    ..oo(0, [10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21])
+    ..oo(0, [10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23])
     ..aI(1, _omitFieldNames ? '' : 'protocolVersion',
         fieldType: $pb.PbFieldType.OU3)
     ..aOS(2, _omitFieldNames ? '' : 'requestId')
@@ -439,6 +493,12 @@ class CallResponse extends $pb.GeneratedMessage {
     ..aOM<SignBirthCertificateResponse>(
         21, _omitFieldNames ? '' : 'signBirthCertificate',
         subBuilder: SignBirthCertificateResponse.create)
+    ..aOM<InitializeWorkspaceResponse>(
+        22, _omitFieldNames ? '' : 'initializeWorkspace',
+        subBuilder: InitializeWorkspaceResponse.create)
+    ..aOM<ApplyWorkspaceEffectResponse>(
+        23, _omitFieldNames ? '' : 'applyWorkspaceEffect',
+        subBuilder: ApplyWorkspaceEffectResponse.create)
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -472,6 +532,8 @@ class CallResponse extends $pb.GeneratedMessage {
   @$pb.TagNumber(19)
   @$pb.TagNumber(20)
   @$pb.TagNumber(21)
+  @$pb.TagNumber(22)
+  @$pb.TagNumber(23)
   CallResponse_Outcome whichOutcome() =>
       _CallResponse_OutcomeByTag[$_whichOneof(0)]!;
   @$pb.TagNumber(10)
@@ -486,6 +548,8 @@ class CallResponse extends $pb.GeneratedMessage {
   @$pb.TagNumber(19)
   @$pb.TagNumber(20)
   @$pb.TagNumber(21)
+  @$pb.TagNumber(22)
+  @$pb.TagNumber(23)
   void clearOutcome() => $_clearField($_whichOneof(0));
 
   @$pb.TagNumber(1)
@@ -641,6 +705,30 @@ class CallResponse extends $pb.GeneratedMessage {
   void clearSignBirthCertificate() => $_clearField(21);
   @$pb.TagNumber(21)
   SignBirthCertificateResponse ensureSignBirthCertificate() => $_ensure(13);
+
+  @$pb.TagNumber(22)
+  InitializeWorkspaceResponse get initializeWorkspace => $_getN(14);
+  @$pb.TagNumber(22)
+  set initializeWorkspace(InitializeWorkspaceResponse value) =>
+      $_setField(22, value);
+  @$pb.TagNumber(22)
+  $core.bool hasInitializeWorkspace() => $_has(14);
+  @$pb.TagNumber(22)
+  void clearInitializeWorkspace() => $_clearField(22);
+  @$pb.TagNumber(22)
+  InitializeWorkspaceResponse ensureInitializeWorkspace() => $_ensure(14);
+
+  @$pb.TagNumber(23)
+  ApplyWorkspaceEffectResponse get applyWorkspaceEffect => $_getN(15);
+  @$pb.TagNumber(23)
+  set applyWorkspaceEffect(ApplyWorkspaceEffectResponse value) =>
+      $_setField(23, value);
+  @$pb.TagNumber(23)
+  $core.bool hasApplyWorkspaceEffect() => $_has(15);
+  @$pb.TagNumber(23)
+  void clearApplyWorkspaceEffect() => $_clearField(23);
+  @$pb.TagNumber(23)
+  ApplyWorkspaceEffectResponse ensureApplyWorkspaceEffect() => $_ensure(15);
 }
 
 class Failure extends $pb.GeneratedMessage {
@@ -2738,24 +2826,35 @@ class KernelRefusal extends $pb.GeneratedMessage {
 
 enum QueryResponse_Result {
   value,
+  resultUsda,
   authorizationCheck,
   authorizationExpand,
   osgiResource,
   frontierTransition,
+  ownedDeviceRequest,
+  ownedPrepareApproval,
+  integerValue,
+  authenticationPosture,
   notSet
 }
 
 class QueryResponse extends $pb.GeneratedMessage {
   factory QueryResponse({
     NomosValue? value,
+    $core.List<$core.int>? resultUsda,
     AuthorizationCheckResponse? authorizationCheck,
     AuthorizationExpandResponse? authorizationExpand,
     OsgiResourceResponse? osgiResource,
     FrontierTransitionResponse? frontierTransition,
+    OwnedDeviceRequestResponse? ownedDeviceRequest,
+    OwnedPrepareApprovalResponse? ownedPrepareApproval,
+    $fixnum.Int64? integerValue,
+    AuthenticationPostureResponse? authenticationPosture,
     VerifyChainDiagnostics? verifyChainDiagnostics,
   }) {
     final result = create();
     if (value != null) result.value = value;
+    if (resultUsda != null) result.resultUsda = resultUsda;
     if (authorizationCheck != null)
       result.authorizationCheck = authorizationCheck;
     if (authorizationExpand != null)
@@ -2763,6 +2862,13 @@ class QueryResponse extends $pb.GeneratedMessage {
     if (osgiResource != null) result.osgiResource = osgiResource;
     if (frontierTransition != null)
       result.frontierTransition = frontierTransition;
+    if (ownedDeviceRequest != null)
+      result.ownedDeviceRequest = ownedDeviceRequest;
+    if (ownedPrepareApproval != null)
+      result.ownedPrepareApproval = ownedPrepareApproval;
+    if (integerValue != null) result.integerValue = integerValue;
+    if (authenticationPosture != null)
+      result.authenticationPosture = authenticationPosture;
     if (verifyChainDiagnostics != null)
       result.verifyChainDiagnostics = verifyChainDiagnostics;
     return result;
@@ -2780,10 +2886,15 @@ class QueryResponse extends $pb.GeneratedMessage {
   static const $core.Map<$core.int, QueryResponse_Result>
       _QueryResponse_ResultByTag = {
     1: QueryResponse_Result.value,
+    2: QueryResponse_Result.resultUsda,
     10: QueryResponse_Result.authorizationCheck,
     11: QueryResponse_Result.authorizationExpand,
     12: QueryResponse_Result.osgiResource,
     13: QueryResponse_Result.frontierTransition,
+    14: QueryResponse_Result.ownedDeviceRequest,
+    15: QueryResponse_Result.ownedPrepareApproval,
+    16: QueryResponse_Result.integerValue,
+    17: QueryResponse_Result.authenticationPosture,
     0: QueryResponse_Result.notSet
   };
   static final $pb.BuilderInfo _i = $pb.BuilderInfo(
@@ -2791,9 +2902,11 @@ class QueryResponse extends $pb.GeneratedMessage {
       package:
           const $pb.PackageName(_omitMessageNames ? '' : 'nomos.kernel.v1'),
       createEmptyInstance: create)
-    ..oo(0, [1, 10, 11, 12, 13])
+    ..oo(0, [1, 2, 10, 11, 12, 13, 14, 15, 16, 17])
     ..aOM<NomosValue>(1, _omitFieldNames ? '' : 'value',
         subBuilder: NomosValue.create)
+    ..a<$core.List<$core.int>>(
+        2, _omitFieldNames ? '' : 'resultUsda', $pb.PbFieldType.OY)
     ..aOM<AuthorizationCheckResponse>(
         10, _omitFieldNames ? '' : 'authorizationCheck',
         subBuilder: AuthorizationCheckResponse.create)
@@ -2805,6 +2918,18 @@ class QueryResponse extends $pb.GeneratedMessage {
     ..aOM<FrontierTransitionResponse>(
         13, _omitFieldNames ? '' : 'frontierTransition',
         subBuilder: FrontierTransitionResponse.create)
+    ..aOM<OwnedDeviceRequestResponse>(
+        14, _omitFieldNames ? '' : 'ownedDeviceRequest',
+        subBuilder: OwnedDeviceRequestResponse.create)
+    ..aOM<OwnedPrepareApprovalResponse>(
+        15, _omitFieldNames ? '' : 'ownedPrepareApproval',
+        subBuilder: OwnedPrepareApprovalResponse.create)
+    ..a<$fixnum.Int64>(
+        16, _omitFieldNames ? '' : 'integerValue', $pb.PbFieldType.OS6,
+        defaultOrMaker: $fixnum.Int64.ZERO)
+    ..aOM<AuthenticationPostureResponse>(
+        17, _omitFieldNames ? '' : 'authenticationPosture',
+        subBuilder: AuthenticationPostureResponse.create)
     ..aOM<VerifyChainDiagnostics>(
         20, _omitFieldNames ? '' : 'verifyChainDiagnostics',
         subBuilder: VerifyChainDiagnostics.create)
@@ -2830,19 +2955,31 @@ class QueryResponse extends $pb.GeneratedMessage {
   static QueryResponse? _defaultInstance;
 
   @$pb.TagNumber(1)
+  @$pb.TagNumber(2)
   @$pb.TagNumber(10)
   @$pb.TagNumber(11)
   @$pb.TagNumber(12)
   @$pb.TagNumber(13)
+  @$pb.TagNumber(14)
+  @$pb.TagNumber(15)
+  @$pb.TagNumber(16)
+  @$pb.TagNumber(17)
   QueryResponse_Result whichResult() =>
       _QueryResponse_ResultByTag[$_whichOneof(0)]!;
   @$pb.TagNumber(1)
+  @$pb.TagNumber(2)
   @$pb.TagNumber(10)
   @$pb.TagNumber(11)
   @$pb.TagNumber(12)
   @$pb.TagNumber(13)
+  @$pb.TagNumber(14)
+  @$pb.TagNumber(15)
+  @$pb.TagNumber(16)
+  @$pb.TagNumber(17)
   void clearResult() => $_clearField($_whichOneof(0));
 
+  /// Cutover debt for fixed framework queries which have not yet gained a
+  /// dedicated generated response. Tenant rows must never use this arm.
   @$pb.TagNumber(1)
   NomosValue get value => $_getN(0);
   @$pb.TagNumber(1)
@@ -2854,69 +2991,125 @@ class QueryResponse extends $pb.GeneratedMessage {
   @$pb.TagNumber(1)
   NomosValue ensureValue() => $_ensure(0);
 
+  /// Canonical nominal OpenUSD for every tenant/domain-shaped result. Generated
+  /// clients decode this against the same law graph that generated the call.
+  @$pb.TagNumber(2)
+  $core.List<$core.int> get resultUsda => $_getN(1);
+  @$pb.TagNumber(2)
+  set resultUsda($core.List<$core.int> value) => $_setBytes(1, value);
+  @$pb.TagNumber(2)
+  $core.bool hasResultUsda() => $_has(1);
+  @$pb.TagNumber(2)
+  void clearResultUsda() => $_clearField(2);
+
   @$pb.TagNumber(10)
-  AuthorizationCheckResponse get authorizationCheck => $_getN(1);
+  AuthorizationCheckResponse get authorizationCheck => $_getN(2);
   @$pb.TagNumber(10)
   set authorizationCheck(AuthorizationCheckResponse value) =>
       $_setField(10, value);
   @$pb.TagNumber(10)
-  $core.bool hasAuthorizationCheck() => $_has(1);
+  $core.bool hasAuthorizationCheck() => $_has(2);
   @$pb.TagNumber(10)
   void clearAuthorizationCheck() => $_clearField(10);
   @$pb.TagNumber(10)
-  AuthorizationCheckResponse ensureAuthorizationCheck() => $_ensure(1);
+  AuthorizationCheckResponse ensureAuthorizationCheck() => $_ensure(2);
 
   @$pb.TagNumber(11)
-  AuthorizationExpandResponse get authorizationExpand => $_getN(2);
+  AuthorizationExpandResponse get authorizationExpand => $_getN(3);
   @$pb.TagNumber(11)
   set authorizationExpand(AuthorizationExpandResponse value) =>
       $_setField(11, value);
   @$pb.TagNumber(11)
-  $core.bool hasAuthorizationExpand() => $_has(2);
+  $core.bool hasAuthorizationExpand() => $_has(3);
   @$pb.TagNumber(11)
   void clearAuthorizationExpand() => $_clearField(11);
   @$pb.TagNumber(11)
-  AuthorizationExpandResponse ensureAuthorizationExpand() => $_ensure(2);
+  AuthorizationExpandResponse ensureAuthorizationExpand() => $_ensure(3);
 
   /// Kernel self-description uses the OSGi Resource/Capability/Requirement model. The canonical
   /// authored catalogue remains USDA; this generated response is its typed host ABI projection.
   @$pb.TagNumber(12)
-  OsgiResourceResponse get osgiResource => $_getN(3);
+  OsgiResourceResponse get osgiResource => $_getN(4);
   @$pb.TagNumber(12)
   set osgiResource(OsgiResourceResponse value) => $_setField(12, value);
   @$pb.TagNumber(12)
-  $core.bool hasOsgiResource() => $_has(3);
+  $core.bool hasOsgiResource() => $_has(4);
   @$pb.TagNumber(12)
   void clearOsgiResource() => $_clearField(12);
   @$pb.TagNumber(12)
-  OsgiResourceResponse ensureOsgiResource() => $_ensure(3);
+  OsgiResourceResponse ensureOsgiResource() => $_ensure(4);
 
   @$pb.TagNumber(13)
-  FrontierTransitionResponse get frontierTransition => $_getN(4);
+  FrontierTransitionResponse get frontierTransition => $_getN(5);
   @$pb.TagNumber(13)
   set frontierTransition(FrontierTransitionResponse value) =>
       $_setField(13, value);
   @$pb.TagNumber(13)
-  $core.bool hasFrontierTransition() => $_has(4);
+  $core.bool hasFrontierTransition() => $_has(5);
   @$pb.TagNumber(13)
   void clearFrontierTransition() => $_clearField(13);
   @$pb.TagNumber(13)
-  FrontierTransitionResponse ensureFrontierTransition() => $_ensure(4);
+  FrontierTransitionResponse ensureFrontierTransition() => $_ensure(5);
+
+  @$pb.TagNumber(14)
+  OwnedDeviceRequestResponse get ownedDeviceRequest => $_getN(6);
+  @$pb.TagNumber(14)
+  set ownedDeviceRequest(OwnedDeviceRequestResponse value) =>
+      $_setField(14, value);
+  @$pb.TagNumber(14)
+  $core.bool hasOwnedDeviceRequest() => $_has(6);
+  @$pb.TagNumber(14)
+  void clearOwnedDeviceRequest() => $_clearField(14);
+  @$pb.TagNumber(14)
+  OwnedDeviceRequestResponse ensureOwnedDeviceRequest() => $_ensure(6);
+
+  @$pb.TagNumber(15)
+  OwnedPrepareApprovalResponse get ownedPrepareApproval => $_getN(7);
+  @$pb.TagNumber(15)
+  set ownedPrepareApproval(OwnedPrepareApprovalResponse value) =>
+      $_setField(15, value);
+  @$pb.TagNumber(15)
+  $core.bool hasOwnedPrepareApproval() => $_has(7);
+  @$pb.TagNumber(15)
+  void clearOwnedPrepareApproval() => $_clearField(15);
+  @$pb.TagNumber(15)
+  OwnedPrepareApprovalResponse ensureOwnedPrepareApproval() => $_ensure(7);
+
+  @$pb.TagNumber(16)
+  $fixnum.Int64 get integerValue => $_getI64(8);
+  @$pb.TagNumber(16)
+  set integerValue($fixnum.Int64 value) => $_setInt64(8, value);
+  @$pb.TagNumber(16)
+  $core.bool hasIntegerValue() => $_has(8);
+  @$pb.TagNumber(16)
+  void clearIntegerValue() => $_clearField(16);
+
+  @$pb.TagNumber(17)
+  AuthenticationPostureResponse get authenticationPosture => $_getN(9);
+  @$pb.TagNumber(17)
+  set authenticationPosture(AuthenticationPostureResponse value) =>
+      $_setField(17, value);
+  @$pb.TagNumber(17)
+  $core.bool hasAuthenticationPosture() => $_has(9);
+  @$pb.TagNumber(17)
+  void clearAuthenticationPosture() => $_clearField(17);
+  @$pb.TagNumber(17)
+  AuthenticationPostureResponse ensureAuthenticationPosture() => $_ensure(9);
 
   /// Kernel-owned, opt-in observability for the exact chain replay. This is deliberately a
   /// typed sibling of the tenant result: diagnostics never become tenant data, authority, or
   /// another stringly serialization convention hidden inside an opaque byte field.
   @$pb.TagNumber(20)
-  VerifyChainDiagnostics get verifyChainDiagnostics => $_getN(5);
+  VerifyChainDiagnostics get verifyChainDiagnostics => $_getN(10);
   @$pb.TagNumber(20)
   set verifyChainDiagnostics(VerifyChainDiagnostics value) =>
       $_setField(20, value);
   @$pb.TagNumber(20)
-  $core.bool hasVerifyChainDiagnostics() => $_has(5);
+  $core.bool hasVerifyChainDiagnostics() => $_has(10);
   @$pb.TagNumber(20)
   void clearVerifyChainDiagnostics() => $_clearField(20);
   @$pb.TagNumber(20)
-  VerifyChainDiagnostics ensureVerifyChainDiagnostics() => $_ensure(5);
+  VerifyChainDiagnostics ensureVerifyChainDiagnostics() => $_ensure(10);
 }
 
 class OsgiAttribute extends $pb.GeneratedMessage {
@@ -4048,161 +4241,527 @@ class VerifyChainLawHydrationTiming extends $pb.GeneratedMessage {
   void clearTotalUs() => $_clearField(2);
 }
 
-/// A kernel-authored outbound offer. The host is allowed to inspect `destination` solely to route
-/// the opaque sealed bytes; every semantic field remains inside `sealed_offer`. `custody_path` and
-/// `delivery_ref` are opaque transport cursors chosen by the kernel, never reconstructed by a host.
-class OutboundOffer extends $pb.GeneratedMessage {
-  factory OutboundOffer({
-    $core.String? id,
-    $core.String? destination,
-    $core.List<$core.int>? sealedOffer,
-    $core.String? contentType,
-    $core.String? sourceWorkspace,
-    $core.String? custodyHead,
-    $core.String? causedByOffer,
-    $fixnum.Int64? scheduledAtMillis,
-    $fixnum.Int64? deadlineAtMillis,
-    $core.String? custodyPath,
-    $core.String? custodyOid,
-    $core.String? deliveryRef,
-    $core.String? obligationId,
+class HttpsOutboundRoute extends $pb.GeneratedMessage {
+  factory HttpsOutboundRoute({
+    $core.String? url,
   }) {
     final result = create();
-    if (id != null) result.id = id;
-    if (destination != null) result.destination = destination;
-    if (sealedOffer != null) result.sealedOffer = sealedOffer;
-    if (contentType != null) result.contentType = contentType;
-    if (sourceWorkspace != null) result.sourceWorkspace = sourceWorkspace;
-    if (custodyHead != null) result.custodyHead = custodyHead;
-    if (causedByOffer != null) result.causedByOffer = causedByOffer;
-    if (scheduledAtMillis != null) result.scheduledAtMillis = scheduledAtMillis;
-    if (deadlineAtMillis != null) result.deadlineAtMillis = deadlineAtMillis;
-    if (custodyPath != null) result.custodyPath = custodyPath;
-    if (custodyOid != null) result.custodyOid = custodyOid;
-    if (deliveryRef != null) result.deliveryRef = deliveryRef;
-    if (obligationId != null) result.obligationId = obligationId;
+    if (url != null) result.url = url;
     return result;
   }
 
-  OutboundOffer._();
+  HttpsOutboundRoute._();
 
-  factory OutboundOffer.fromBuffer($core.List<$core.int> data,
+  factory HttpsOutboundRoute.fromBuffer($core.List<$core.int> data,
           [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
       create()..mergeFromBuffer(data, registry);
-  factory OutboundOffer.fromJson($core.String json,
+  factory HttpsOutboundRoute.fromJson($core.String json,
           [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
       create()..mergeFromJson(json, registry);
 
   static final $pb.BuilderInfo _i = $pb.BuilderInfo(
-      _omitMessageNames ? '' : 'OutboundOffer',
+      _omitMessageNames ? '' : 'HttpsOutboundRoute',
       package:
           const $pb.PackageName(_omitMessageNames ? '' : 'nomos.kernel.v1'),
       createEmptyInstance: create)
-    ..aOS(1, _omitFieldNames ? '' : 'id')
-    ..aOS(2, _omitFieldNames ? '' : 'destination')
+    ..aOS(1, _omitFieldNames ? '' : 'url')
+    ..hasRequiredFields = false;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  HttpsOutboundRoute clone() => deepCopy();
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  HttpsOutboundRoute copyWith(void Function(HttpsOutboundRoute) updates) =>
+      super.copyWith((message) => updates(message as HttpsOutboundRoute))
+          as HttpsOutboundRoute;
+
+  @$core.override
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static HttpsOutboundRoute create() => HttpsOutboundRoute._();
+  @$core.override
+  HttpsOutboundRoute createEmptyInstance() => create();
+  @$core.pragma('dart2js:noInline')
+  static HttpsOutboundRoute getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<HttpsOutboundRoute>(create);
+  static HttpsOutboundRoute? _defaultInstance;
+
+  @$pb.TagNumber(1)
+  $core.String get url => $_getSZ(0);
+  @$pb.TagNumber(1)
+  set url($core.String value) => $_setString(0, value);
+  @$pb.TagNumber(1)
+  $core.bool hasUrl() => $_has(0);
+  @$pb.TagNumber(1)
+  void clearUrl() => $_clearField(1);
+}
+
+class WorkspaceOutboundRoute extends $pb.GeneratedMessage {
+  factory WorkspaceOutboundRoute({
+    $core.String? workspace,
+  }) {
+    final result = create();
+    if (workspace != null) result.workspace = workspace;
+    return result;
+  }
+
+  WorkspaceOutboundRoute._();
+
+  factory WorkspaceOutboundRoute.fromBuffer($core.List<$core.int> data,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromBuffer(data, registry);
+  factory WorkspaceOutboundRoute.fromJson($core.String json,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromJson(json, registry);
+
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
+      _omitMessageNames ? '' : 'WorkspaceOutboundRoute',
+      package:
+          const $pb.PackageName(_omitMessageNames ? '' : 'nomos.kernel.v1'),
+      createEmptyInstance: create)
+    ..aOS(1, _omitFieldNames ? '' : 'workspace')
+    ..hasRequiredFields = false;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  WorkspaceOutboundRoute clone() => deepCopy();
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  WorkspaceOutboundRoute copyWith(
+          void Function(WorkspaceOutboundRoute) updates) =>
+      super.copyWith((message) => updates(message as WorkspaceOutboundRoute))
+          as WorkspaceOutboundRoute;
+
+  @$core.override
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static WorkspaceOutboundRoute create() => WorkspaceOutboundRoute._();
+  @$core.override
+  WorkspaceOutboundRoute createEmptyInstance() => create();
+  @$core.pragma('dart2js:noInline')
+  static WorkspaceOutboundRoute getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<WorkspaceOutboundRoute>(create);
+  static WorkspaceOutboundRoute? _defaultInstance;
+
+  /// A Nomos workspace routing address. It is not the workspace actor identity; the receiver
+  /// derives that only from the carried source custody proof.
+  @$pb.TagNumber(1)
+  $core.String get workspace => $_getSZ(0);
+  @$pb.TagNumber(1)
+  set workspace($core.String value) => $_setString(0, value);
+  @$pb.TagNumber(1)
+  $core.bool hasWorkspace() => $_has(0);
+  @$pb.TagNumber(1)
+  void clearWorkspace() => $_clearField(1);
+}
+
+/// Transport names only two custody locations plus the exact source commit/path exposed by the
+/// source kernel. The receiving kernel re-hashes that proof, derives the source workspace actor,
+/// opens the sealed nominal target call and runs target law; no host operation or payload exists.
+class ApplyWorkspaceEffectRequest extends $pb.GeneratedMessage {
+  factory ApplyWorkspaceEffectRequest({
+    WorkspaceTarget? source,
+    $core.String? sourceCommit,
+    $core.String? sourceOfferPath,
+    WorkspaceTarget? target,
+    $core.List<$core.int>? sourceEvidencePack,
+    $core.List<$core.int>? admissionCheckpointSecret,
+  }) {
+    final result = create();
+    if (source != null) result.source = source;
+    if (sourceCommit != null) result.sourceCommit = sourceCommit;
+    if (sourceOfferPath != null) result.sourceOfferPath = sourceOfferPath;
+    if (target != null) result.target = target;
+    if (sourceEvidencePack != null)
+      result.sourceEvidencePack = sourceEvidencePack;
+    if (admissionCheckpointSecret != null)
+      result.admissionCheckpointSecret = admissionCheckpointSecret;
+    return result;
+  }
+
+  ApplyWorkspaceEffectRequest._();
+
+  factory ApplyWorkspaceEffectRequest.fromBuffer($core.List<$core.int> data,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromBuffer(data, registry);
+  factory ApplyWorkspaceEffectRequest.fromJson($core.String json,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromJson(json, registry);
+
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
+      _omitMessageNames ? '' : 'ApplyWorkspaceEffectRequest',
+      package:
+          const $pb.PackageName(_omitMessageNames ? '' : 'nomos.kernel.v1'),
+      createEmptyInstance: create)
+    ..aOM<WorkspaceTarget>(1, _omitFieldNames ? '' : 'source',
+        subBuilder: WorkspaceTarget.create)
+    ..aOS(2, _omitFieldNames ? '' : 'sourceCommit')
+    ..aOS(3, _omitFieldNames ? '' : 'sourceOfferPath')
+    ..aOM<WorkspaceTarget>(4, _omitFieldNames ? '' : 'target',
+        subBuilder: WorkspaceTarget.create)
     ..a<$core.List<$core.int>>(
-        3, _omitFieldNames ? '' : 'sealedOffer', $pb.PbFieldType.OY)
-    ..aOS(4, _omitFieldNames ? '' : 'contentType')
-    ..aOS(5, _omitFieldNames ? '' : 'sourceWorkspace')
-    ..aOS(6, _omitFieldNames ? '' : 'custodyHead')
-    ..aOS(7, _omitFieldNames ? '' : 'causedByOffer')
-    ..a<$fixnum.Int64>(
-        8, _omitFieldNames ? '' : 'scheduledAtMillis', $pb.PbFieldType.OU6,
-        defaultOrMaker: $fixnum.Int64.ZERO)
-    ..a<$fixnum.Int64>(
-        9, _omitFieldNames ? '' : 'deadlineAtMillis', $pb.PbFieldType.OU6,
-        defaultOrMaker: $fixnum.Int64.ZERO)
-    ..aOS(10, _omitFieldNames ? '' : 'custodyPath')
-    ..aOS(11, _omitFieldNames ? '' : 'custodyOid')
-    ..aOS(12, _omitFieldNames ? '' : 'deliveryRef')
-    ..aOS(13, _omitFieldNames ? '' : 'obligationId')
+        5, _omitFieldNames ? '' : 'sourceEvidencePack', $pb.PbFieldType.OY)
+    ..a<$core.List<$core.int>>(6,
+        _omitFieldNames ? '' : 'admissionCheckpointSecret', $pb.PbFieldType.OY)
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
-  OutboundOffer clone() => deepCopy();
+  ApplyWorkspaceEffectRequest clone() => deepCopy();
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
-  OutboundOffer copyWith(void Function(OutboundOffer) updates) =>
-      super.copyWith((message) => updates(message as OutboundOffer))
-          as OutboundOffer;
+  ApplyWorkspaceEffectRequest copyWith(
+          void Function(ApplyWorkspaceEffectRequest) updates) =>
+      super.copyWith(
+              (message) => updates(message as ApplyWorkspaceEffectRequest))
+          as ApplyWorkspaceEffectRequest;
 
   @$core.override
   $pb.BuilderInfo get info_ => _i;
 
   @$core.pragma('dart2js:noInline')
-  static OutboundOffer create() => OutboundOffer._();
+  static ApplyWorkspaceEffectRequest create() =>
+      ApplyWorkspaceEffectRequest._();
   @$core.override
-  OutboundOffer createEmptyInstance() => create();
+  ApplyWorkspaceEffectRequest createEmptyInstance() => create();
   @$core.pragma('dart2js:noInline')
-  static OutboundOffer getDefault() => _defaultInstance ??=
-      $pb.GeneratedMessage.$_defaultFor<OutboundOffer>(create);
-  static OutboundOffer? _defaultInstance;
+  static ApplyWorkspaceEffectRequest getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<ApplyWorkspaceEffectRequest>(create);
+  static ApplyWorkspaceEffectRequest? _defaultInstance;
 
   @$pb.TagNumber(1)
-  $core.String get id => $_getSZ(0);
+  WorkspaceTarget get source => $_getN(0);
   @$pb.TagNumber(1)
-  set id($core.String value) => $_setString(0, value);
+  set source(WorkspaceTarget value) => $_setField(1, value);
   @$pb.TagNumber(1)
-  $core.bool hasId() => $_has(0);
+  $core.bool hasSource() => $_has(0);
   @$pb.TagNumber(1)
-  void clearId() => $_clearField(1);
+  void clearSource() => $_clearField(1);
+  @$pb.TagNumber(1)
+  WorkspaceTarget ensureSource() => $_ensure(0);
 
   @$pb.TagNumber(2)
-  $core.String get destination => $_getSZ(1);
+  $core.String get sourceCommit => $_getSZ(1);
   @$pb.TagNumber(2)
-  set destination($core.String value) => $_setString(1, value);
+  set sourceCommit($core.String value) => $_setString(1, value);
   @$pb.TagNumber(2)
-  $core.bool hasDestination() => $_has(1);
+  $core.bool hasSourceCommit() => $_has(1);
   @$pb.TagNumber(2)
-  void clearDestination() => $_clearField(2);
+  void clearSourceCommit() => $_clearField(2);
 
   @$pb.TagNumber(3)
-  $core.List<$core.int> get sealedOffer => $_getN(2);
+  $core.String get sourceOfferPath => $_getSZ(2);
   @$pb.TagNumber(3)
-  set sealedOffer($core.List<$core.int> value) => $_setBytes(2, value);
+  set sourceOfferPath($core.String value) => $_setString(2, value);
   @$pb.TagNumber(3)
-  $core.bool hasSealedOffer() => $_has(2);
+  $core.bool hasSourceOfferPath() => $_has(2);
   @$pb.TagNumber(3)
-  void clearSealedOffer() => $_clearField(3);
+  void clearSourceOfferPath() => $_clearField(3);
 
   @$pb.TagNumber(4)
-  $core.String get contentType => $_getSZ(3);
+  WorkspaceTarget get target => $_getN(3);
   @$pb.TagNumber(4)
-  set contentType($core.String value) => $_setString(3, value);
+  set target(WorkspaceTarget value) => $_setField(4, value);
   @$pb.TagNumber(4)
-  $core.bool hasContentType() => $_has(3);
+  $core.bool hasTarget() => $_has(3);
   @$pb.TagNumber(4)
-  void clearContentType() => $_clearField(4);
+  void clearTarget() => $_clearField(4);
+  @$pb.TagNumber(4)
+  WorkspaceTarget ensureTarget() => $_ensure(3);
 
+  /// Self-contained Git object closure rooted at source_commit. A remote target imports these
+  /// opaque custody bytes into a kernel-chosen scratch ODB before verifying the bounded witness;
+  /// it never needs a source credential and the host cannot replace any semantic field.
   @$pb.TagNumber(5)
-  $core.String get sourceWorkspace => $_getSZ(4);
+  $core.List<$core.int> get sourceEvidencePack => $_getN(4);
   @$pb.TagNumber(5)
-  set sourceWorkspace($core.String value) => $_setString(4, value);
+  set sourceEvidencePack($core.List<$core.int> value) => $_setBytes(4, value);
   @$pb.TagNumber(5)
-  $core.bool hasSourceWorkspace() => $_has(4);
+  $core.bool hasSourceEvidencePack() => $_has(4);
   @$pb.TagNumber(5)
-  void clearSourceWorkspace() => $_clearField(5);
+  void clearSourceEvidencePack() => $_clearField(5);
 
-  /// Current frontier proving custody of this inherited outbox blob. The causal source is
-  /// `caused_by_offer`; this is intentionally not mislabelled as that offer's original commit.
+  /// Target-local credential for minting an external admission checkpoint. A receiving container
+  /// overwrites this from runtime secret custody; the kernel independently requires the derived key
+  /// to be actively enrolled by target law.
   @$pb.TagNumber(6)
-  $core.String get custodyHead => $_getSZ(5);
+  $core.List<$core.int> get admissionCheckpointSecret => $_getN(5);
   @$pb.TagNumber(6)
-  set custodyHead($core.String value) => $_setString(5, value);
+  set admissionCheckpointSecret($core.List<$core.int> value) =>
+      $_setBytes(5, value);
   @$pb.TagNumber(6)
-  $core.bool hasCustodyHead() => $_has(5);
+  $core.bool hasAdmissionCheckpointSecret() => $_has(5);
   @$pb.TagNumber(6)
-  void clearCustodyHead() => $_clearField(6);
+  void clearAdmissionCheckpointSecret() => $_clearField(6);
+}
 
-  @$pb.TagNumber(7)
-  $core.String get causedByOffer => $_getSZ(6);
-  @$pb.TagNumber(7)
-  set causedByOffer($core.String value) => $_setString(6, value);
-  @$pb.TagNumber(7)
-  $core.bool hasCausedByOffer() => $_has(6);
-  @$pb.TagNumber(7)
-  void clearCausedByOffer() => $_clearField(7);
+class ApplyWorkspaceEffectResponse extends $pb.GeneratedMessage {
+  factory ApplyWorkspaceEffectResponse({
+    OfferResponse? result,
+    $core.bool? alreadyApplied,
+  }) {
+    final result$ = create();
+    if (result != null) result$.result = result;
+    if (alreadyApplied != null) result$.alreadyApplied = alreadyApplied;
+    return result$;
+  }
 
-  @$pb.TagNumber(8)
+  ApplyWorkspaceEffectResponse._();
+
+  factory ApplyWorkspaceEffectResponse.fromBuffer($core.List<$core.int> data,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromBuffer(data, registry);
+  factory ApplyWorkspaceEffectResponse.fromJson($core.String json,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromJson(json, registry);
+
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
+      _omitMessageNames ? '' : 'ApplyWorkspaceEffectResponse',
+      package:
+          const $pb.PackageName(_omitMessageNames ? '' : 'nomos.kernel.v1'),
+      createEmptyInstance: create)
+    ..aOM<OfferResponse>(1, _omitFieldNames ? '' : 'result',
+        subBuilder: OfferResponse.create)
+    ..aOB(2, _omitFieldNames ? '' : 'alreadyApplied')
+    ..hasRequiredFields = false;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  ApplyWorkspaceEffectResponse clone() => deepCopy();
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  ApplyWorkspaceEffectResponse copyWith(
+          void Function(ApplyWorkspaceEffectResponse) updates) =>
+      super.copyWith(
+              (message) => updates(message as ApplyWorkspaceEffectResponse))
+          as ApplyWorkspaceEffectResponse;
+
+  @$core.override
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static ApplyWorkspaceEffectResponse create() =>
+      ApplyWorkspaceEffectResponse._();
+  @$core.override
+  ApplyWorkspaceEffectResponse createEmptyInstance() => create();
+  @$core.pragma('dart2js:noInline')
+  static ApplyWorkspaceEffectResponse getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<ApplyWorkspaceEffectResponse>(create);
+  static ApplyWorkspaceEffectResponse? _defaultInstance;
+
+  @$pb.TagNumber(1)
+  OfferResponse get result => $_getN(0);
+  @$pb.TagNumber(1)
+  set result(OfferResponse value) => $_setField(1, value);
+  @$pb.TagNumber(1)
+  $core.bool hasResult() => $_has(0);
+  @$pb.TagNumber(1)
+  void clearResult() => $_clearField(1);
+  @$pb.TagNumber(1)
+  OfferResponse ensureResult() => $_ensure(0);
+
+  @$pb.TagNumber(2)
+  $core.bool get alreadyApplied => $_getBF(1);
+  @$pb.TagNumber(2)
+  set alreadyApplied($core.bool value) => $_setBool(1, value);
+  @$pb.TagNumber(2)
+  $core.bool hasAlreadyApplied() => $_has(1);
+  @$pb.TagNumber(2)
+  void clearAlreadyApplied() => $_clearField(2);
+}
+
+enum OutboundOffer_Route { httpsRoute, workspaceRoute, notSet }
+
+/// A kernel-authored outbound offer. The host switches exhaustively on `route` solely to transport
+/// the opaque sealed bytes; every semantic field remains inside `sealed_offer`. `custody_path` and
+/// `delivery_ref` are opaque transport cursors chosen by the kernel, never reconstructed by a host.
+class OutboundOffer extends $pb.GeneratedMessage {
+  factory OutboundOffer({
+    $core.String? id,
+    @$core.Deprecated('This field is deprecated.') $core.String? destination,
+    $core.List<$core.int>? sealedOffer,
+    $core.String? contentType,
+    $core.String? sourceWorkspace,
+    $core.String? custodyHead,
+    $core.String? causedByOffer,
+    $fixnum.Int64? scheduledAtMillis,
+    $fixnum.Int64? deadlineAtMillis,
+    $core.String? custodyPath,
+    $core.String? custodyOid,
+    $core.String? deliveryRef,
+    $core.String? obligationId,
+    HttpsOutboundRoute? httpsRoute,
+    WorkspaceOutboundRoute? workspaceRoute,
+    $core.String? sourceCommit,
+    $core.List<$core.int>? sourceEvidencePack,
+    $core.String? sourceOfferPath,
+  }) {
+    final result = create();
+    if (id != null) result.id = id;
+    if (destination != null) result.destination = destination;
+    if (sealedOffer != null) result.sealedOffer = sealedOffer;
+    if (contentType != null) result.contentType = contentType;
+    if (sourceWorkspace != null) result.sourceWorkspace = sourceWorkspace;
+    if (custodyHead != null) result.custodyHead = custodyHead;
+    if (causedByOffer != null) result.causedByOffer = causedByOffer;
+    if (scheduledAtMillis != null) result.scheduledAtMillis = scheduledAtMillis;
+    if (deadlineAtMillis != null) result.deadlineAtMillis = deadlineAtMillis;
+    if (custodyPath != null) result.custodyPath = custodyPath;
+    if (custodyOid != null) result.custodyOid = custodyOid;
+    if (deliveryRef != null) result.deliveryRef = deliveryRef;
+    if (obligationId != null) result.obligationId = obligationId;
+    if (httpsRoute != null) result.httpsRoute = httpsRoute;
+    if (workspaceRoute != null) result.workspaceRoute = workspaceRoute;
+    if (sourceCommit != null) result.sourceCommit = sourceCommit;
+    if (sourceEvidencePack != null)
+      result.sourceEvidencePack = sourceEvidencePack;
+    if (sourceOfferPath != null) result.sourceOfferPath = sourceOfferPath;
+    return result;
+  }
+
+  OutboundOffer._();
+
+  factory OutboundOffer.fromBuffer($core.List<$core.int> data,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromBuffer(data, registry);
+  factory OutboundOffer.fromJson($core.String json,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromJson(json, registry);
+
+  static const $core.Map<$core.int, OutboundOffer_Route>
+      _OutboundOffer_RouteByTag = {
+    14: OutboundOffer_Route.httpsRoute,
+    15: OutboundOffer_Route.workspaceRoute,
+    0: OutboundOffer_Route.notSet
+  };
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
+      _omitMessageNames ? '' : 'OutboundOffer',
+      package:
+          const $pb.PackageName(_omitMessageNames ? '' : 'nomos.kernel.v1'),
+      createEmptyInstance: create)
+    ..oo(0, [14, 15])
+    ..aOS(1, _omitFieldNames ? '' : 'id')
+    ..aOS(2, _omitFieldNames ? '' : 'destination')
+    ..a<$core.List<$core.int>>(
+        3, _omitFieldNames ? '' : 'sealedOffer', $pb.PbFieldType.OY)
+    ..aOS(4, _omitFieldNames ? '' : 'contentType')
+    ..aOS(5, _omitFieldNames ? '' : 'sourceWorkspace')
+    ..aOS(6, _omitFieldNames ? '' : 'custodyHead')
+    ..aOS(7, _omitFieldNames ? '' : 'causedByOffer')
+    ..a<$fixnum.Int64>(
+        8, _omitFieldNames ? '' : 'scheduledAtMillis', $pb.PbFieldType.OU6,
+        defaultOrMaker: $fixnum.Int64.ZERO)
+    ..a<$fixnum.Int64>(
+        9, _omitFieldNames ? '' : 'deadlineAtMillis', $pb.PbFieldType.OU6,
+        defaultOrMaker: $fixnum.Int64.ZERO)
+    ..aOS(10, _omitFieldNames ? '' : 'custodyPath')
+    ..aOS(11, _omitFieldNames ? '' : 'custodyOid')
+    ..aOS(12, _omitFieldNames ? '' : 'deliveryRef')
+    ..aOS(13, _omitFieldNames ? '' : 'obligationId')
+    ..aOM<HttpsOutboundRoute>(14, _omitFieldNames ? '' : 'httpsRoute',
+        subBuilder: HttpsOutboundRoute.create)
+    ..aOM<WorkspaceOutboundRoute>(15, _omitFieldNames ? '' : 'workspaceRoute',
+        subBuilder: WorkspaceOutboundRoute.create)
+    ..aOS(16, _omitFieldNames ? '' : 'sourceCommit')
+    ..a<$core.List<$core.int>>(
+        17, _omitFieldNames ? '' : 'sourceEvidencePack', $pb.PbFieldType.OY)
+    ..aOS(18, _omitFieldNames ? '' : 'sourceOfferPath')
+    ..hasRequiredFields = false;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  OutboundOffer clone() => deepCopy();
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  OutboundOffer copyWith(void Function(OutboundOffer) updates) =>
+      super.copyWith((message) => updates(message as OutboundOffer))
+          as OutboundOffer;
+
+  @$core.override
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static OutboundOffer create() => OutboundOffer._();
+  @$core.override
+  OutboundOffer createEmptyInstance() => create();
+  @$core.pragma('dart2js:noInline')
+  static OutboundOffer getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<OutboundOffer>(create);
+  static OutboundOffer? _defaultInstance;
+
+  @$pb.TagNumber(14)
+  @$pb.TagNumber(15)
+  OutboundOffer_Route whichRoute() =>
+      _OutboundOffer_RouteByTag[$_whichOneof(0)]!;
+  @$pb.TagNumber(14)
+  @$pb.TagNumber(15)
+  void clearRoute() => $_clearField($_whichOneof(0));
+
+  @$pb.TagNumber(1)
+  $core.String get id => $_getSZ(0);
+  @$pb.TagNumber(1)
+  set id($core.String value) => $_setString(0, value);
+  @$pb.TagNumber(1)
+  $core.bool hasId() => $_has(0);
+  @$pb.TagNumber(1)
+  void clearId() => $_clearField(1);
+
+  /// Historical compatibility for hosts compiled before the nominal route sum. Current kernels
+  /// also populate `route`; current hosts must prefer it and may use this only for an old response.
+  @$core.Deprecated('This field is deprecated.')
+  @$pb.TagNumber(2)
+  $core.String get destination => $_getSZ(1);
+  @$core.Deprecated('This field is deprecated.')
+  @$pb.TagNumber(2)
+  set destination($core.String value) => $_setString(1, value);
+  @$core.Deprecated('This field is deprecated.')
+  @$pb.TagNumber(2)
+  $core.bool hasDestination() => $_has(1);
+  @$core.Deprecated('This field is deprecated.')
+  @$pb.TagNumber(2)
+  void clearDestination() => $_clearField(2);
+
+  @$pb.TagNumber(3)
+  $core.List<$core.int> get sealedOffer => $_getN(2);
+  @$pb.TagNumber(3)
+  set sealedOffer($core.List<$core.int> value) => $_setBytes(2, value);
+  @$pb.TagNumber(3)
+  $core.bool hasSealedOffer() => $_has(2);
+  @$pb.TagNumber(3)
+  void clearSealedOffer() => $_clearField(3);
+
+  @$pb.TagNumber(4)
+  $core.String get contentType => $_getSZ(3);
+  @$pb.TagNumber(4)
+  set contentType($core.String value) => $_setString(3, value);
+  @$pb.TagNumber(4)
+  $core.bool hasContentType() => $_has(3);
+  @$pb.TagNumber(4)
+  void clearContentType() => $_clearField(4);
+
+  @$pb.TagNumber(5)
+  $core.String get sourceWorkspace => $_getSZ(4);
+  @$pb.TagNumber(5)
+  set sourceWorkspace($core.String value) => $_setString(4, value);
+  @$pb.TagNumber(5)
+  $core.bool hasSourceWorkspace() => $_has(4);
+  @$pb.TagNumber(5)
+  void clearSourceWorkspace() => $_clearField(5);
+
+  /// Current frontier proving custody of this inherited outbox blob. The causal source is
+  /// `caused_by_offer`; this is intentionally not mislabelled as that offer's original commit.
+  @$pb.TagNumber(6)
+  $core.String get custodyHead => $_getSZ(5);
+  @$pb.TagNumber(6)
+  set custodyHead($core.String value) => $_setString(5, value);
+  @$pb.TagNumber(6)
+  $core.bool hasCustodyHead() => $_has(5);
+  @$pb.TagNumber(6)
+  void clearCustodyHead() => $_clearField(6);
+
+  @$pb.TagNumber(7)
+  $core.String get causedByOffer => $_getSZ(6);
+  @$pb.TagNumber(7)
+  set causedByOffer($core.String value) => $_setString(6, value);
+  @$pb.TagNumber(7)
+  $core.bool hasCausedByOffer() => $_has(6);
+  @$pb.TagNumber(7)
+  void clearCausedByOffer() => $_clearField(7);
+
+  @$pb.TagNumber(8)
   $fixnum.Int64 get scheduledAtMillis => $_getI64(7);
   @$pb.TagNumber(8)
   set scheduledAtMillis($fixnum.Int64 value) => $_setInt64(7, value);
@@ -4257,6 +4816,61 @@ class OutboundOffer extends $pb.GeneratedMessage {
   $core.bool hasObligationId() => $_has(12);
   @$pb.TagNumber(13)
   void clearObligationId() => $_clearField(13);
+
+  @$pb.TagNumber(14)
+  HttpsOutboundRoute get httpsRoute => $_getN(13);
+  @$pb.TagNumber(14)
+  set httpsRoute(HttpsOutboundRoute value) => $_setField(14, value);
+  @$pb.TagNumber(14)
+  $core.bool hasHttpsRoute() => $_has(13);
+  @$pb.TagNumber(14)
+  void clearHttpsRoute() => $_clearField(14);
+  @$pb.TagNumber(14)
+  HttpsOutboundRoute ensureHttpsRoute() => $_ensure(13);
+
+  @$pb.TagNumber(15)
+  WorkspaceOutboundRoute get workspaceRoute => $_getN(14);
+  @$pb.TagNumber(15)
+  set workspaceRoute(WorkspaceOutboundRoute value) => $_setField(15, value);
+  @$pb.TagNumber(15)
+  $core.bool hasWorkspaceRoute() => $_has(14);
+  @$pb.TagNumber(15)
+  void clearWorkspaceRoute() => $_clearField(15);
+  @$pb.TagNumber(15)
+  WorkspaceOutboundRoute ensureWorkspaceRoute() => $_ensure(14);
+
+  /// Exact source commit that first introduced this immutable outbox path. `custody_head` may be a
+  /// much later descendant and is never accepted as the causal proof root.
+  @$pb.TagNumber(16)
+  $core.String get sourceCommit => $_getSZ(15);
+  @$pb.TagNumber(16)
+  set sourceCommit($core.String value) => $_setString(15, value);
+  @$pb.TagNumber(16)
+  $core.bool hasSourceCommit() => $_has(15);
+  @$pb.TagNumber(16)
+  void clearSourceCommit() => $_clearField(16);
+
+  /// Standard Git pack containing only the bounded source objects needed to re-hash this exact
+  /// effect and its workspace-authority witness. No parent history or unrelated state is included.
+  @$pb.TagNumber(17)
+  $core.List<$core.int> get sourceEvidencePack => $_getN(16);
+  @$pb.TagNumber(17)
+  set sourceEvidencePack($core.List<$core.int> value) => $_setBytes(16, value);
+  @$pb.TagNumber(17)
+  $core.bool hasSourceEvidencePack() => $_has(16);
+  @$pb.TagNumber(17)
+  void clearSourceEvidencePack() => $_clearField(17);
+
+  /// Exact immutable blob path whose first introduction is source_commit. The host relays this
+  /// kernel-derived cursor verbatim and never reconstructs an outbox directory convention.
+  @$pb.TagNumber(18)
+  $core.String get sourceOfferPath => $_getSZ(17);
+  @$pb.TagNumber(18)
+  set sourceOfferPath($core.String value) => $_setString(17, value);
+  @$pb.TagNumber(18)
+  $core.bool hasSourceOfferPath() => $_has(17);
+  @$pb.TagNumber(18)
+  void clearSourceOfferPath() => $_clearField(18);
 }
 
 class OutboxResponse extends $pb.GeneratedMessage {
@@ -4533,58 +5147,236 @@ class OpenRequest extends $pb.GeneratedMessage {
   void clearSpans() => $_clearField(2);
 }
 
-class DirectiveCall extends $pb.GeneratedMessage {
-  factory DirectiveCall({
-    $core.String? domain,
-    $core.String? directive,
-    NomosStruct? payload,
+/// The only root-genesis door. A host may supply an opaque lifecycle-controller
+/// package and captured execution inputs, but it cannot name a domain,
+/// directive, payload field or resulting law identity. The kernel validates the
+/// USDZ closure, derives its content identity and constructs the one legal
+/// bootstrap/installDomain call as a private nominal value.
+class InitializeWorkspaceRequest extends $pb.GeneratedMessage {
+  factory InitializeWorkspaceRequest({
+    WorkspaceTarget? target,
+    $core.List<$core.int>? controllerLawUsdz,
+    AuthoringOptions? authoring,
   }) {
     final result = create();
-    if (domain != null) result.domain = domain;
-    if (directive != null) result.directive = directive;
-    if (payload != null) result.payload = payload;
+    if (target != null) result.target = target;
+    if (controllerLawUsdz != null) result.controllerLawUsdz = controllerLawUsdz;
+    if (authoring != null) result.authoring = authoring;
     return result;
   }
 
-  DirectiveCall._();
+  InitializeWorkspaceRequest._();
 
-  factory DirectiveCall.fromBuffer($core.List<$core.int> data,
+  factory InitializeWorkspaceRequest.fromBuffer($core.List<$core.int> data,
           [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
       create()..mergeFromBuffer(data, registry);
-  factory DirectiveCall.fromJson($core.String json,
+  factory InitializeWorkspaceRequest.fromJson($core.String json,
           [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
       create()..mergeFromJson(json, registry);
 
   static final $pb.BuilderInfo _i = $pb.BuilderInfo(
-      _omitMessageNames ? '' : 'DirectiveCall',
+      _omitMessageNames ? '' : 'InitializeWorkspaceRequest',
       package:
           const $pb.PackageName(_omitMessageNames ? '' : 'nomos.kernel.v1'),
       createEmptyInstance: create)
-    ..aOS(1, _omitFieldNames ? '' : 'domain')
-    ..aOS(2, _omitFieldNames ? '' : 'directive')
-    ..aOM<NomosStruct>(3, _omitFieldNames ? '' : 'payload',
-        subBuilder: NomosStruct.create)
+    ..aOM<WorkspaceTarget>(1, _omitFieldNames ? '' : 'target',
+        subBuilder: WorkspaceTarget.create)
+    ..a<$core.List<$core.int>>(
+        2, _omitFieldNames ? '' : 'controllerLawUsdz', $pb.PbFieldType.OY)
+    ..aOM<AuthoringOptions>(3, _omitFieldNames ? '' : 'authoring',
+        subBuilder: AuthoringOptions.create)
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
-  DirectiveCall clone() => deepCopy();
+  InitializeWorkspaceRequest clone() => deepCopy();
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
-  DirectiveCall copyWith(void Function(DirectiveCall) updates) =>
-      super.copyWith((message) => updates(message as DirectiveCall))
-          as DirectiveCall;
+  InitializeWorkspaceRequest copyWith(
+          void Function(InitializeWorkspaceRequest) updates) =>
+      super.copyWith(
+              (message) => updates(message as InitializeWorkspaceRequest))
+          as InitializeWorkspaceRequest;
 
   @$core.override
   $pb.BuilderInfo get info_ => _i;
 
   @$core.pragma('dart2js:noInline')
-  static DirectiveCall create() => DirectiveCall._();
+  static InitializeWorkspaceRequest create() => InitializeWorkspaceRequest._();
   @$core.override
-  DirectiveCall createEmptyInstance() => create();
+  InitializeWorkspaceRequest createEmptyInstance() => create();
   @$core.pragma('dart2js:noInline')
-  static DirectiveCall getDefault() => _defaultInstance ??=
+  static InitializeWorkspaceRequest getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<InitializeWorkspaceRequest>(create);
+  static InitializeWorkspaceRequest? _defaultInstance;
+
+  @$pb.TagNumber(1)
+  WorkspaceTarget get target => $_getN(0);
+  @$pb.TagNumber(1)
+  set target(WorkspaceTarget value) => $_setField(1, value);
+  @$pb.TagNumber(1)
+  $core.bool hasTarget() => $_has(0);
+  @$pb.TagNumber(1)
+  void clearTarget() => $_clearField(1);
+  @$pb.TagNumber(1)
+  WorkspaceTarget ensureTarget() => $_ensure(0);
+
+  @$pb.TagNumber(2)
+  $core.List<$core.int> get controllerLawUsdz => $_getN(1);
+  @$pb.TagNumber(2)
+  set controllerLawUsdz($core.List<$core.int> value) => $_setBytes(1, value);
+  @$pb.TagNumber(2)
+  $core.bool hasControllerLawUsdz() => $_has(1);
+  @$pb.TagNumber(2)
+  void clearControllerLawUsdz() => $_clearField(2);
+
+  @$pb.TagNumber(3)
+  AuthoringOptions get authoring => $_getN(2);
+  @$pb.TagNumber(3)
+  set authoring(AuthoringOptions value) => $_setField(3, value);
+  @$pb.TagNumber(3)
+  $core.bool hasAuthoring() => $_has(2);
+  @$pb.TagNumber(3)
+  void clearAuthoring() => $_clearField(3);
+  @$pb.TagNumber(3)
+  AuthoringOptions ensureAuthoring() => $_ensure(2);
+}
+
+class InitializeWorkspaceResponse extends $pb.GeneratedMessage {
+  factory InitializeWorkspaceResponse({
+    $core.String? head,
+    $core.String? controllerLawHash,
+  }) {
+    final result = create();
+    if (head != null) result.head = head;
+    if (controllerLawHash != null) result.controllerLawHash = controllerLawHash;
+    return result;
+  }
+
+  InitializeWorkspaceResponse._();
+
+  factory InitializeWorkspaceResponse.fromBuffer($core.List<$core.int> data,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromBuffer(data, registry);
+  factory InitializeWorkspaceResponse.fromJson($core.String json,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromJson(json, registry);
+
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
+      _omitMessageNames ? '' : 'InitializeWorkspaceResponse',
+      package:
+          const $pb.PackageName(_omitMessageNames ? '' : 'nomos.kernel.v1'),
+      createEmptyInstance: create)
+    ..aOS(1, _omitFieldNames ? '' : 'head')
+    ..aOS(2, _omitFieldNames ? '' : 'controllerLawHash')
+    ..hasRequiredFields = false;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  InitializeWorkspaceResponse clone() => deepCopy();
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  InitializeWorkspaceResponse copyWith(
+          void Function(InitializeWorkspaceResponse) updates) =>
+      super.copyWith(
+              (message) => updates(message as InitializeWorkspaceResponse))
+          as InitializeWorkspaceResponse;
+
+  @$core.override
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static InitializeWorkspaceResponse create() =>
+      InitializeWorkspaceResponse._();
+  @$core.override
+  InitializeWorkspaceResponse createEmptyInstance() => create();
+  @$core.pragma('dart2js:noInline')
+  static InitializeWorkspaceResponse getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<InitializeWorkspaceResponse>(create);
+  static InitializeWorkspaceResponse? _defaultInstance;
+
+  @$pb.TagNumber(1)
+  $core.String get head => $_getSZ(0);
+  @$pb.TagNumber(1)
+  set head($core.String value) => $_setString(0, value);
+  @$pb.TagNumber(1)
+  $core.bool hasHead() => $_has(0);
+  @$pb.TagNumber(1)
+  void clearHead() => $_clearField(1);
+
+  @$pb.TagNumber(2)
+  $core.String get controllerLawHash => $_getSZ(1);
+  @$pb.TagNumber(2)
+  set controllerLawHash($core.String value) => $_setString(1, value);
+  @$pb.TagNumber(2)
+  $core.bool hasControllerLawHash() => $_has(1);
+  @$pb.TagNumber(2)
+  void clearControllerLawHash() => $_clearField(2);
+}
+
+enum DirectiveCall_Body { callUsda, notSet }
+
+class DirectiveCall extends $pb.GeneratedMessage {
+  factory DirectiveCall({
+    $core.String? domain,
+    $core.String? directive,
+    $core.List<$core.int>? callUsda,
+  }) {
+    final result = create();
+    if (domain != null) result.domain = domain;
+    if (directive != null) result.directive = directive;
+    if (callUsda != null) result.callUsda = callUsda;
+    return result;
+  }
+
+  DirectiveCall._();
+
+  factory DirectiveCall.fromBuffer($core.List<$core.int> data,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromBuffer(data, registry);
+  factory DirectiveCall.fromJson($core.String json,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromJson(json, registry);
+
+  static const $core.Map<$core.int, DirectiveCall_Body>
+      _DirectiveCall_BodyByTag = {
+    3: DirectiveCall_Body.callUsda,
+    0: DirectiveCall_Body.notSet
+  };
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
+      _omitMessageNames ? '' : 'DirectiveCall',
+      package:
+          const $pb.PackageName(_omitMessageNames ? '' : 'nomos.kernel.v1'),
+      createEmptyInstance: create)
+    ..oo(0, [3])
+    ..aOS(1, _omitFieldNames ? '' : 'domain')
+    ..aOS(2, _omitFieldNames ? '' : 'directive')
+    ..a<$core.List<$core.int>>(
+        3, _omitFieldNames ? '' : 'callUsda', $pb.PbFieldType.OY)
+    ..hasRequiredFields = false;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  DirectiveCall clone() => deepCopy();
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  DirectiveCall copyWith(void Function(DirectiveCall) updates) =>
+      super.copyWith((message) => updates(message as DirectiveCall))
+          as DirectiveCall;
+
+  @$core.override
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static DirectiveCall create() => DirectiveCall._();
+  @$core.override
+  DirectiveCall createEmptyInstance() => create();
+  @$core.pragma('dart2js:noInline')
+  static DirectiveCall getDefault() => _defaultInstance ??=
       $pb.GeneratedMessage.$_defaultFor<DirectiveCall>(create);
   static DirectiveCall? _defaultInstance;
 
+  @$pb.TagNumber(3)
+  DirectiveCall_Body whichBody() => _DirectiveCall_BodyByTag[$_whichOneof(0)]!;
+  @$pb.TagNumber(3)
+  void clearBody() => $_clearField($_whichOneof(0));
+
+  /// Non-authoritative routing hints. They select the installed law to open; the kernel requires
+  /// them to resolve to the exact directive identity carried by call_usda before authoring.
   @$pb.TagNumber(1)
   $core.String get domain => $_getSZ(0);
   @$pb.TagNumber(1)
@@ -4603,16 +5395,17 @@ class DirectiveCall extends $pb.GeneratedMessage {
   @$pb.TagNumber(2)
   void clearDirective() => $_clearField(2);
 
+  /// Complete canonical NomosChange/NomosCall USDA emitted by a generated domain client.
+  /// Field 3 is its published wire identity and may never be renumbered. Old and
+  /// new kernels therefore decode the same canonical USDA bytes during rollout.
   @$pb.TagNumber(3)
-  NomosStruct get payload => $_getN(2);
+  $core.List<$core.int> get callUsda => $_getN(2);
   @$pb.TagNumber(3)
-  set payload(NomosStruct value) => $_setField(3, value);
+  set callUsda($core.List<$core.int> value) => $_setBytes(2, value);
   @$pb.TagNumber(3)
-  $core.bool hasPayload() => $_has(2);
+  $core.bool hasCallUsda() => $_has(2);
   @$pb.TagNumber(3)
-  void clearPayload() => $_clearField(3);
-  @$pb.TagNumber(3)
-  NomosStruct ensurePayload() => $_ensure(2);
+  void clearCallUsda() => $_clearField(3);
 }
 
 class AuthoringOptions extends $pb.GeneratedMessage {
@@ -5238,7 +6031,129 @@ class SignBirthCertificateResponse extends $pb.GeneratedMessage {
   BirthCertificate ensureCertificate() => $_ensure(0);
 }
 
-enum OfferRequest_Intent { call, sealedChangeUsda, notSet }
+class ModelLifecycleIntent extends $pb.GeneratedMessage {
+  factory ModelLifecycleIntent({
+    ModelLifecycleOperation? operation,
+    $core.String? installedBy,
+    $core.String? supersedes,
+    FrontierTransitionResponse? transition,
+    $core.String? replaces,
+    $core.String? acceptanceReason,
+  }) {
+    final result = create();
+    if (operation != null) result.operation = operation;
+    if (installedBy != null) result.installedBy = installedBy;
+    if (supersedes != null) result.supersedes = supersedes;
+    if (transition != null) result.transition = transition;
+    if (replaces != null) result.replaces = replaces;
+    if (acceptanceReason != null) result.acceptanceReason = acceptanceReason;
+    return result;
+  }
+
+  ModelLifecycleIntent._();
+
+  factory ModelLifecycleIntent.fromBuffer($core.List<$core.int> data,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromBuffer(data, registry);
+  factory ModelLifecycleIntent.fromJson($core.String json,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromJson(json, registry);
+
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
+      _omitMessageNames ? '' : 'ModelLifecycleIntent',
+      package:
+          const $pb.PackageName(_omitMessageNames ? '' : 'nomos.kernel.v1'),
+      createEmptyInstance: create)
+    ..aE<ModelLifecycleOperation>(1, _omitFieldNames ? '' : 'operation',
+        enumValues: ModelLifecycleOperation.values)
+    ..aOS(2, _omitFieldNames ? '' : 'installedBy')
+    ..aOS(3, _omitFieldNames ? '' : 'supersedes')
+    ..aOM<FrontierTransitionResponse>(4, _omitFieldNames ? '' : 'transition',
+        subBuilder: FrontierTransitionResponse.create)
+    ..aOS(5, _omitFieldNames ? '' : 'replaces')
+    ..aOS(6, _omitFieldNames ? '' : 'acceptanceReason')
+    ..hasRequiredFields = false;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  ModelLifecycleIntent clone() => deepCopy();
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  ModelLifecycleIntent copyWith(void Function(ModelLifecycleIntent) updates) =>
+      super.copyWith((message) => updates(message as ModelLifecycleIntent))
+          as ModelLifecycleIntent;
+
+  @$core.override
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static ModelLifecycleIntent create() => ModelLifecycleIntent._();
+  @$core.override
+  ModelLifecycleIntent createEmptyInstance() => create();
+  @$core.pragma('dart2js:noInline')
+  static ModelLifecycleIntent getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<ModelLifecycleIntent>(create);
+  static ModelLifecycleIntent? _defaultInstance;
+
+  @$pb.TagNumber(1)
+  ModelLifecycleOperation get operation => $_getN(0);
+  @$pb.TagNumber(1)
+  set operation(ModelLifecycleOperation value) => $_setField(1, value);
+  @$pb.TagNumber(1)
+  $core.bool hasOperation() => $_has(0);
+  @$pb.TagNumber(1)
+  void clearOperation() => $_clearField(1);
+
+  @$pb.TagNumber(2)
+  $core.String get installedBy => $_getSZ(1);
+  @$pb.TagNumber(2)
+  set installedBy($core.String value) => $_setString(1, value);
+  @$pb.TagNumber(2)
+  $core.bool hasInstalledBy() => $_has(1);
+  @$pb.TagNumber(2)
+  void clearInstalledBy() => $_clearField(2);
+
+  @$pb.TagNumber(3)
+  $core.String get supersedes => $_getSZ(2);
+  @$pb.TagNumber(3)
+  set supersedes($core.String value) => $_setString(2, value);
+  @$pb.TagNumber(3)
+  $core.bool hasSupersedes() => $_has(2);
+  @$pb.TagNumber(3)
+  void clearSupersedes() => $_clearField(3);
+
+  /// Promotion carries the kernel's own typed current-frontier verdict back into
+  /// the ordinary signed offer gate. The host cannot reinterpret it, and the
+  /// receiving kernel re-derives every field before admitting the transition.
+  @$pb.TagNumber(4)
+  FrontierTransitionResponse get transition => $_getN(3);
+  @$pb.TagNumber(4)
+  set transition(FrontierTransitionResponse value) => $_setField(4, value);
+  @$pb.TagNumber(4)
+  $core.bool hasTransition() => $_has(3);
+  @$pb.TagNumber(4)
+  void clearTransition() => $_clearField(4);
+  @$pb.TagNumber(4)
+  FrontierTransitionResponse ensureTransition() => $_ensure(3);
+
+  @$pb.TagNumber(5)
+  $core.String get replaces => $_getSZ(4);
+  @$pb.TagNumber(5)
+  set replaces($core.String value) => $_setString(4, value);
+  @$pb.TagNumber(5)
+  $core.bool hasReplaces() => $_has(4);
+  @$pb.TagNumber(5)
+  void clearReplaces() => $_clearField(5);
+
+  @$pb.TagNumber(6)
+  $core.String get acceptanceReason => $_getSZ(5);
+  @$pb.TagNumber(6)
+  set acceptanceReason($core.String value) => $_setString(5, value);
+  @$pb.TagNumber(6)
+  $core.bool hasAcceptanceReason() => $_has(5);
+  @$pb.TagNumber(6)
+  void clearAcceptanceReason() => $_clearField(6);
+}
+
+enum OfferRequest_Intent { call, sealedChangeUsda, modelLifecycle, notSet }
 
 class OfferRequest extends $pb.GeneratedMessage {
   factory OfferRequest({
@@ -5253,6 +6168,7 @@ class OfferRequest extends $pb.GeneratedMessage {
     $core.String? controllerLawHash,
     $core.String? candidateCommit,
     BirthCertificate? birthCertificate,
+    ModelLifecycleIntent? modelLifecycle,
   }) {
     final result = create();
     if (target != null) result.target = target;
@@ -5267,6 +6183,7 @@ class OfferRequest extends $pb.GeneratedMessage {
     if (controllerLawHash != null) result.controllerLawHash = controllerLawHash;
     if (candidateCommit != null) result.candidateCommit = candidateCommit;
     if (birthCertificate != null) result.birthCertificate = birthCertificate;
+    if (modelLifecycle != null) result.modelLifecycle = modelLifecycle;
     return result;
   }
 
@@ -5283,6 +6200,7 @@ class OfferRequest extends $pb.GeneratedMessage {
       _OfferRequest_IntentByTag = {
     2: OfferRequest_Intent.call,
     7: OfferRequest_Intent.sealedChangeUsda,
+    12: OfferRequest_Intent.modelLifecycle,
     0: OfferRequest_Intent.notSet
   };
   static final $pb.BuilderInfo _i = $pb.BuilderInfo(
@@ -5290,7 +6208,7 @@ class OfferRequest extends $pb.GeneratedMessage {
       package:
           const $pb.PackageName(_omitMessageNames ? '' : 'nomos.kernel.v1'),
       createEmptyInstance: create)
-    ..oo(0, [2, 7])
+    ..oo(0, [2, 7, 12])
     ..aOM<WorkspaceTarget>(1, _omitFieldNames ? '' : 'target',
         subBuilder: WorkspaceTarget.create)
     ..aOM<DirectiveCall>(2, _omitFieldNames ? '' : 'call',
@@ -5311,6 +6229,8 @@ class OfferRequest extends $pb.GeneratedMessage {
     ..aOS(10, _omitFieldNames ? '' : 'candidateCommit')
     ..aOM<BirthCertificate>(11, _omitFieldNames ? '' : 'birthCertificate',
         subBuilder: BirthCertificate.create)
+    ..aOM<ModelLifecycleIntent>(12, _omitFieldNames ? '' : 'modelLifecycle',
+        subBuilder: ModelLifecycleIntent.create)
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -5334,10 +6254,12 @@ class OfferRequest extends $pb.GeneratedMessage {
 
   @$pb.TagNumber(2)
   @$pb.TagNumber(7)
+  @$pb.TagNumber(12)
   OfferRequest_Intent whichIntent() =>
       _OfferRequest_IntentByTag[$_whichOneof(0)]!;
   @$pb.TagNumber(2)
   @$pb.TagNumber(7)
+  @$pb.TagNumber(12)
   void clearIntent() => $_clearField($_whichOneof(0));
 
   @$pb.TagNumber(1)
@@ -5442,6 +6364,19 @@ class OfferRequest extends $pb.GeneratedMessage {
   void clearBirthCertificate() => $_clearField(11);
   @$pb.TagNumber(11)
   BirthCertificate ensureBirthCertificate() => $_ensure(10);
+
+  /// Kernel-owned lifecycle command. It lowers into canonical USDA using the CURRENT installed
+  /// controller, then passes through the ordinary identity, device and relation gates.
+  @$pb.TagNumber(12)
+  ModelLifecycleIntent get modelLifecycle => $_getN(11);
+  @$pb.TagNumber(12)
+  set modelLifecycle(ModelLifecycleIntent value) => $_setField(12, value);
+  @$pb.TagNumber(12)
+  $core.bool hasModelLifecycle() => $_has(11);
+  @$pb.TagNumber(12)
+  void clearModelLifecycle() => $_clearField(12);
+  @$pb.TagNumber(12)
+  ModelLifecycleIntent ensureModelLifecycle() => $_ensure(11);
 }
 
 class AttestedRead extends $pb.GeneratedMessage {
@@ -5658,6 +6593,12 @@ enum QueryRequest_Query {
   authorizationCheck,
   authorizationExpand,
   frontierTransition,
+  byType,
+  ownedDeviceRequest,
+  ownedPrepareApproval,
+  pendingConflicts,
+  pendingConflictSummary,
+  authenticationPosture,
   notSet
 }
 
@@ -5666,6 +6607,7 @@ class QueryRequest extends $pb.GeneratedMessage {
     WorkspaceTarget? target,
     QueryAuthority? authority,
     $core.bool? spans,
+    QueryResultFormat? resultFormat,
     RowsQuery? rows,
     PageQuery? page,
     ByIdQuery? byId,
@@ -5678,11 +6620,18 @@ class QueryRequest extends $pb.GeneratedMessage {
     AuthorizationCheckRequest? authorizationCheck,
     AuthorizationExpandRequest? authorizationExpand,
     FrontierTransitionRequest? frontierTransition,
+    ByTypeQuery? byType,
+    OwnedDeviceRequestQuery? ownedDeviceRequest,
+    OwnedPrepareApprovalQuery? ownedPrepareApproval,
+    PendingConflictsQuery? pendingConflicts,
+    PendingConflictSummaryQuery? pendingConflictSummary,
+    AuthenticationPostureQuery? authenticationPosture,
   }) {
     final result = create();
     if (target != null) result.target = target;
     if (authority != null) result.authority = authority;
     if (spans != null) result.spans = spans;
+    if (resultFormat != null) result.resultFormat = resultFormat;
     if (rows != null) result.rows = rows;
     if (page != null) result.page = page;
     if (byId != null) result.byId = byId;
@@ -5698,6 +6647,16 @@ class QueryRequest extends $pb.GeneratedMessage {
       result.authorizationExpand = authorizationExpand;
     if (frontierTransition != null)
       result.frontierTransition = frontierTransition;
+    if (byType != null) result.byType = byType;
+    if (ownedDeviceRequest != null)
+      result.ownedDeviceRequest = ownedDeviceRequest;
+    if (ownedPrepareApproval != null)
+      result.ownedPrepareApproval = ownedPrepareApproval;
+    if (pendingConflicts != null) result.pendingConflicts = pendingConflicts;
+    if (pendingConflictSummary != null)
+      result.pendingConflictSummary = pendingConflictSummary;
+    if (authenticationPosture != null)
+      result.authenticationPosture = authenticationPosture;
     return result;
   }
 
@@ -5724,6 +6683,12 @@ class QueryRequest extends $pb.GeneratedMessage {
     19: QueryRequest_Query.authorizationCheck,
     20: QueryRequest_Query.authorizationExpand,
     21: QueryRequest_Query.frontierTransition,
+    22: QueryRequest_Query.byType,
+    23: QueryRequest_Query.ownedDeviceRequest,
+    24: QueryRequest_Query.ownedPrepareApproval,
+    25: QueryRequest_Query.pendingConflicts,
+    26: QueryRequest_Query.pendingConflictSummary,
+    27: QueryRequest_Query.authenticationPosture,
     0: QueryRequest_Query.notSet
   };
   static final $pb.BuilderInfo _i = $pb.BuilderInfo(
@@ -5731,12 +6696,33 @@ class QueryRequest extends $pb.GeneratedMessage {
       package:
           const $pb.PackageName(_omitMessageNames ? '' : 'nomos.kernel.v1'),
       createEmptyInstance: create)
-    ..oo(0, [10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21])
+    ..oo(0, [
+      10,
+      11,
+      12,
+      13,
+      14,
+      15,
+      16,
+      17,
+      18,
+      19,
+      20,
+      21,
+      22,
+      23,
+      24,
+      25,
+      26,
+      27
+    ])
     ..aOM<WorkspaceTarget>(1, _omitFieldNames ? '' : 'target',
         subBuilder: WorkspaceTarget.create)
     ..aOM<QueryAuthority>(2, _omitFieldNames ? '' : 'authority',
         subBuilder: QueryAuthority.create)
     ..aOB(3, _omitFieldNames ? '' : 'spans')
+    ..aE<QueryResultFormat>(4, _omitFieldNames ? '' : 'resultFormat',
+        enumValues: QueryResultFormat.values)
     ..aOM<RowsQuery>(10, _omitFieldNames ? '' : 'rows',
         subBuilder: RowsQuery.create)
     ..aOM<PageQuery>(11, _omitFieldNames ? '' : 'page',
@@ -5765,6 +6751,22 @@ class QueryRequest extends $pb.GeneratedMessage {
     ..aOM<FrontierTransitionRequest>(
         21, _omitFieldNames ? '' : 'frontierTransition',
         subBuilder: FrontierTransitionRequest.create)
+    ..aOM<ByTypeQuery>(22, _omitFieldNames ? '' : 'byType',
+        subBuilder: ByTypeQuery.create)
+    ..aOM<OwnedDeviceRequestQuery>(
+        23, _omitFieldNames ? '' : 'ownedDeviceRequest',
+        subBuilder: OwnedDeviceRequestQuery.create)
+    ..aOM<OwnedPrepareApprovalQuery>(
+        24, _omitFieldNames ? '' : 'ownedPrepareApproval',
+        subBuilder: OwnedPrepareApprovalQuery.create)
+    ..aOM<PendingConflictsQuery>(25, _omitFieldNames ? '' : 'pendingConflicts',
+        subBuilder: PendingConflictsQuery.create)
+    ..aOM<PendingConflictSummaryQuery>(
+        26, _omitFieldNames ? '' : 'pendingConflictSummary',
+        subBuilder: PendingConflictSummaryQuery.create)
+    ..aOM<AuthenticationPostureQuery>(
+        27, _omitFieldNames ? '' : 'authenticationPosture',
+        subBuilder: AuthenticationPostureQuery.create)
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -5798,6 +6800,12 @@ class QueryRequest extends $pb.GeneratedMessage {
   @$pb.TagNumber(19)
   @$pb.TagNumber(20)
   @$pb.TagNumber(21)
+  @$pb.TagNumber(22)
+  @$pb.TagNumber(23)
+  @$pb.TagNumber(24)
+  @$pb.TagNumber(25)
+  @$pb.TagNumber(26)
+  @$pb.TagNumber(27)
   QueryRequest_Query whichQuery() => _QueryRequest_QueryByTag[$_whichOneof(0)]!;
   @$pb.TagNumber(10)
   @$pb.TagNumber(11)
@@ -5811,6 +6819,12 @@ class QueryRequest extends $pb.GeneratedMessage {
   @$pb.TagNumber(19)
   @$pb.TagNumber(20)
   @$pb.TagNumber(21)
+  @$pb.TagNumber(22)
+  @$pb.TagNumber(23)
+  @$pb.TagNumber(24)
+  @$pb.TagNumber(25)
+  @$pb.TagNumber(26)
+  @$pb.TagNumber(27)
   void clearQuery() => $_clearField($_whichOneof(0));
 
   @$pb.TagNumber(1)
@@ -5844,140 +6858,657 @@ class QueryRequest extends $pb.GeneratedMessage {
   @$pb.TagNumber(3)
   void clearSpans() => $_clearField(3);
 
+  @$pb.TagNumber(4)
+  QueryResultFormat get resultFormat => $_getN(3);
+  @$pb.TagNumber(4)
+  set resultFormat(QueryResultFormat value) => $_setField(4, value);
+  @$pb.TagNumber(4)
+  $core.bool hasResultFormat() => $_has(3);
+  @$pb.TagNumber(4)
+  void clearResultFormat() => $_clearField(4);
+
   @$pb.TagNumber(10)
-  RowsQuery get rows => $_getN(3);
+  RowsQuery get rows => $_getN(4);
   @$pb.TagNumber(10)
   set rows(RowsQuery value) => $_setField(10, value);
   @$pb.TagNumber(10)
-  $core.bool hasRows() => $_has(3);
+  $core.bool hasRows() => $_has(4);
   @$pb.TagNumber(10)
   void clearRows() => $_clearField(10);
   @$pb.TagNumber(10)
-  RowsQuery ensureRows() => $_ensure(3);
+  RowsQuery ensureRows() => $_ensure(4);
 
   @$pb.TagNumber(11)
-  PageQuery get page => $_getN(4);
+  PageQuery get page => $_getN(5);
   @$pb.TagNumber(11)
   set page(PageQuery value) => $_setField(11, value);
   @$pb.TagNumber(11)
-  $core.bool hasPage() => $_has(4);
+  $core.bool hasPage() => $_has(5);
   @$pb.TagNumber(11)
   void clearPage() => $_clearField(11);
   @$pb.TagNumber(11)
-  PageQuery ensurePage() => $_ensure(4);
+  PageQuery ensurePage() => $_ensure(5);
 
   @$pb.TagNumber(12)
-  ByIdQuery get byId => $_getN(5);
+  ByIdQuery get byId => $_getN(6);
   @$pb.TagNumber(12)
   set byId(ByIdQuery value) => $_setField(12, value);
   @$pb.TagNumber(12)
-  $core.bool hasById() => $_has(5);
+  $core.bool hasById() => $_has(6);
   @$pb.TagNumber(12)
   void clearById() => $_clearField(12);
   @$pb.TagNumber(12)
-  ByIdQuery ensureById() => $_ensure(5);
+  ByIdQuery ensureById() => $_ensure(6);
 
   @$pb.TagNumber(13)
-  ResolveRefsQuery get resolveRefs => $_getN(6);
+  ResolveRefsQuery get resolveRefs => $_getN(7);
   @$pb.TagNumber(13)
   set resolveRefs(ResolveRefsQuery value) => $_setField(13, value);
   @$pb.TagNumber(13)
-  $core.bool hasResolveRefs() => $_has(6);
+  $core.bool hasResolveRefs() => $_has(7);
   @$pb.TagNumber(13)
   void clearResolveRefs() => $_clearField(13);
   @$pb.TagNumber(13)
-  ResolveRefsQuery ensureResolveRefs() => $_ensure(6);
+  ResolveRefsQuery ensureResolveRefs() => $_ensure(7);
 
   @$pb.TagNumber(14)
-  ReferenceVersionsQuery get referenceVersions => $_getN(7);
+  ReferenceVersionsQuery get referenceVersions => $_getN(8);
   @$pb.TagNumber(14)
   set referenceVersions(ReferenceVersionsQuery value) => $_setField(14, value);
   @$pb.TagNumber(14)
-  $core.bool hasReferenceVersions() => $_has(7);
+  $core.bool hasReferenceVersions() => $_has(8);
   @$pb.TagNumber(14)
   void clearReferenceVersions() => $_clearField(14);
   @$pb.TagNumber(14)
-  ReferenceVersionsQuery ensureReferenceVersions() => $_ensure(7);
+  ReferenceVersionsQuery ensureReferenceVersions() => $_ensure(8);
 
   @$pb.TagNumber(15)
-  TallyQuery get count => $_getN(8);
+  TallyQuery get count => $_getN(9);
   @$pb.TagNumber(15)
   set count(TallyQuery value) => $_setField(15, value);
   @$pb.TagNumber(15)
-  $core.bool hasCount() => $_has(8);
+  $core.bool hasCount() => $_has(9);
   @$pb.TagNumber(15)
   void clearCount() => $_clearField(15);
   @$pb.TagNumber(15)
-  TallyQuery ensureCount() => $_ensure(8);
+  TallyQuery ensureCount() => $_ensure(9);
 
   @$pb.TagNumber(16)
-  TallyQuery get sum => $_getN(9);
+  TallyQuery get sum => $_getN(10);
   @$pb.TagNumber(16)
   set sum(TallyQuery value) => $_setField(16, value);
   @$pb.TagNumber(16)
-  $core.bool hasSum() => $_has(9);
+  $core.bool hasSum() => $_has(10);
   @$pb.TagNumber(16)
   void clearSum() => $_clearField(16);
   @$pb.TagNumber(16)
-  TallyQuery ensureSum() => $_ensure(9);
+  TallyQuery ensureSum() => $_ensure(10);
 
   @$pb.TagNumber(17)
-  SpatialQuery get spatial => $_getN(10);
+  SpatialQuery get spatial => $_getN(11);
   @$pb.TagNumber(17)
   set spatial(SpatialQuery value) => $_setField(17, value);
   @$pb.TagNumber(17)
-  $core.bool hasSpatial() => $_has(10);
+  $core.bool hasSpatial() => $_has(11);
   @$pb.TagNumber(17)
   void clearSpatial() => $_clearField(17);
   @$pb.TagNumber(17)
-  SpatialQuery ensureSpatial() => $_ensure(10);
+  SpatialQuery ensureSpatial() => $_ensure(11);
 
   @$pb.TagNumber(18)
-  NamedQuery get named => $_getN(11);
+  NamedQuery get named => $_getN(12);
   @$pb.TagNumber(18)
   set named(NamedQuery value) => $_setField(18, value);
   @$pb.TagNumber(18)
-  $core.bool hasNamed() => $_has(11);
+  $core.bool hasNamed() => $_has(12);
   @$pb.TagNumber(18)
   void clearNamed() => $_clearField(18);
   @$pb.TagNumber(18)
-  NamedQuery ensureNamed() => $_ensure(11);
+  NamedQuery ensureNamed() => $_ensure(12);
 
   @$pb.TagNumber(19)
-  AuthorizationCheckRequest get authorizationCheck => $_getN(12);
+  AuthorizationCheckRequest get authorizationCheck => $_getN(13);
   @$pb.TagNumber(19)
   set authorizationCheck(AuthorizationCheckRequest value) =>
       $_setField(19, value);
   @$pb.TagNumber(19)
-  $core.bool hasAuthorizationCheck() => $_has(12);
+  $core.bool hasAuthorizationCheck() => $_has(13);
   @$pb.TagNumber(19)
   void clearAuthorizationCheck() => $_clearField(19);
   @$pb.TagNumber(19)
-  AuthorizationCheckRequest ensureAuthorizationCheck() => $_ensure(12);
+  AuthorizationCheckRequest ensureAuthorizationCheck() => $_ensure(13);
+
+  @$pb.TagNumber(20)
+  AuthorizationExpandRequest get authorizationExpand => $_getN(14);
+  @$pb.TagNumber(20)
+  set authorizationExpand(AuthorizationExpandRequest value) =>
+      $_setField(20, value);
+  @$pb.TagNumber(20)
+  $core.bool hasAuthorizationExpand() => $_has(14);
+  @$pb.TagNumber(20)
+  void clearAuthorizationExpand() => $_clearField(20);
+  @$pb.TagNumber(20)
+  AuthorizationExpandRequest ensureAuthorizationExpand() => $_ensure(14);
+
+  @$pb.TagNumber(21)
+  FrontierTransitionRequest get frontierTransition => $_getN(15);
+  @$pb.TagNumber(21)
+  set frontierTransition(FrontierTransitionRequest value) =>
+      $_setField(21, value);
+  @$pb.TagNumber(21)
+  $core.bool hasFrontierTransition() => $_has(15);
+  @$pb.TagNumber(21)
+  void clearFrontierTransition() => $_clearField(21);
+  @$pb.TagNumber(21)
+  FrontierTransitionRequest ensureFrontierTransition() => $_ensure(15);
+
+  @$pb.TagNumber(22)
+  ByTypeQuery get byType => $_getN(16);
+  @$pb.TagNumber(22)
+  set byType(ByTypeQuery value) => $_setField(22, value);
+  @$pb.TagNumber(22)
+  $core.bool hasByType() => $_has(16);
+  @$pb.TagNumber(22)
+  void clearByType() => $_clearField(22);
+  @$pb.TagNumber(22)
+  ByTypeQuery ensureByType() => $_ensure(16);
+
+  @$pb.TagNumber(23)
+  OwnedDeviceRequestQuery get ownedDeviceRequest => $_getN(17);
+  @$pb.TagNumber(23)
+  set ownedDeviceRequest(OwnedDeviceRequestQuery value) =>
+      $_setField(23, value);
+  @$pb.TagNumber(23)
+  $core.bool hasOwnedDeviceRequest() => $_has(17);
+  @$pb.TagNumber(23)
+  void clearOwnedDeviceRequest() => $_clearField(23);
+  @$pb.TagNumber(23)
+  OwnedDeviceRequestQuery ensureOwnedDeviceRequest() => $_ensure(17);
+
+  @$pb.TagNumber(24)
+  OwnedPrepareApprovalQuery get ownedPrepareApproval => $_getN(18);
+  @$pb.TagNumber(24)
+  set ownedPrepareApproval(OwnedPrepareApprovalQuery value) =>
+      $_setField(24, value);
+  @$pb.TagNumber(24)
+  $core.bool hasOwnedPrepareApproval() => $_has(18);
+  @$pb.TagNumber(24)
+  void clearOwnedPrepareApproval() => $_clearField(24);
+  @$pb.TagNumber(24)
+  OwnedPrepareApprovalQuery ensureOwnedPrepareApproval() => $_ensure(18);
+
+  @$pb.TagNumber(25)
+  PendingConflictsQuery get pendingConflicts => $_getN(19);
+  @$pb.TagNumber(25)
+  set pendingConflicts(PendingConflictsQuery value) => $_setField(25, value);
+  @$pb.TagNumber(25)
+  $core.bool hasPendingConflicts() => $_has(19);
+  @$pb.TagNumber(25)
+  void clearPendingConflicts() => $_clearField(25);
+  @$pb.TagNumber(25)
+  PendingConflictsQuery ensurePendingConflicts() => $_ensure(19);
+
+  @$pb.TagNumber(26)
+  PendingConflictSummaryQuery get pendingConflictSummary => $_getN(20);
+  @$pb.TagNumber(26)
+  set pendingConflictSummary(PendingConflictSummaryQuery value) =>
+      $_setField(26, value);
+  @$pb.TagNumber(26)
+  $core.bool hasPendingConflictSummary() => $_has(20);
+  @$pb.TagNumber(26)
+  void clearPendingConflictSummary() => $_clearField(26);
+  @$pb.TagNumber(26)
+  PendingConflictSummaryQuery ensurePendingConflictSummary() => $_ensure(20);
+
+  @$pb.TagNumber(27)
+  AuthenticationPostureQuery get authenticationPosture => $_getN(21);
+  @$pb.TagNumber(27)
+  set authenticationPosture(AuthenticationPostureQuery value) =>
+      $_setField(27, value);
+  @$pb.TagNumber(27)
+  $core.bool hasAuthenticationPosture() => $_has(21);
+  @$pb.TagNumber(27)
+  void clearAuthenticationPosture() => $_clearField(27);
+  @$pb.TagNumber(27)
+  AuthenticationPostureQuery ensureAuthenticationPosture() => $_ensure(21);
+}
+
+/// Read-only postcondition for a bounded auth-recovery retry. The kernel checks the current local
+/// AuthProvider and signer relation; hosts and clients neither parse tokens nor infer readiness from time.
+class AuthenticationPostureQuery extends $pb.GeneratedMessage {
+  factory AuthenticationPostureQuery() => create();
+
+  AuthenticationPostureQuery._();
+
+  factory AuthenticationPostureQuery.fromBuffer($core.List<$core.int> data,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromBuffer(data, registry);
+  factory AuthenticationPostureQuery.fromJson($core.String json,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromJson(json, registry);
+
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
+      _omitMessageNames ? '' : 'AuthenticationPostureQuery',
+      package:
+          const $pb.PackageName(_omitMessageNames ? '' : 'nomos.kernel.v1'),
+      createEmptyInstance: create)
+    ..hasRequiredFields = false;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  AuthenticationPostureQuery clone() => deepCopy();
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  AuthenticationPostureQuery copyWith(
+          void Function(AuthenticationPostureQuery) updates) =>
+      super.copyWith(
+              (message) => updates(message as AuthenticationPostureQuery))
+          as AuthenticationPostureQuery;
+
+  @$core.override
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static AuthenticationPostureQuery create() => AuthenticationPostureQuery._();
+  @$core.override
+  AuthenticationPostureQuery createEmptyInstance() => create();
+  @$core.pragma('dart2js:noInline')
+  static AuthenticationPostureQuery getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<AuthenticationPostureQuery>(create);
+  static AuthenticationPostureQuery? _defaultInstance;
+}
+
+class AuthenticationPostureResponse extends $pb.GeneratedMessage {
+  factory AuthenticationPostureResponse({
+    ProviderTokenVerificationStatus? providerToken,
+    $core.bool? enrolledDevice,
+    $core.String? resolvedPrincipal,
+  }) {
+    final result = create();
+    if (providerToken != null) result.providerToken = providerToken;
+    if (enrolledDevice != null) result.enrolledDevice = enrolledDevice;
+    if (resolvedPrincipal != null) result.resolvedPrincipal = resolvedPrincipal;
+    return result;
+  }
+
+  AuthenticationPostureResponse._();
+
+  factory AuthenticationPostureResponse.fromBuffer($core.List<$core.int> data,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromBuffer(data, registry);
+  factory AuthenticationPostureResponse.fromJson($core.String json,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromJson(json, registry);
+
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
+      _omitMessageNames ? '' : 'AuthenticationPostureResponse',
+      package:
+          const $pb.PackageName(_omitMessageNames ? '' : 'nomos.kernel.v1'),
+      createEmptyInstance: create)
+    ..aE<ProviderTokenVerificationStatus>(
+        1, _omitFieldNames ? '' : 'providerToken',
+        enumValues: ProviderTokenVerificationStatus.values)
+    ..aOB(2, _omitFieldNames ? '' : 'enrolledDevice')
+    ..aOS(3, _omitFieldNames ? '' : 'resolvedPrincipal')
+    ..hasRequiredFields = false;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  AuthenticationPostureResponse clone() => deepCopy();
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  AuthenticationPostureResponse copyWith(
+          void Function(AuthenticationPostureResponse) updates) =>
+      super.copyWith(
+              (message) => updates(message as AuthenticationPostureResponse))
+          as AuthenticationPostureResponse;
+
+  @$core.override
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static AuthenticationPostureResponse create() =>
+      AuthenticationPostureResponse._();
+  @$core.override
+  AuthenticationPostureResponse createEmptyInstance() => create();
+  @$core.pragma('dart2js:noInline')
+  static AuthenticationPostureResponse getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<AuthenticationPostureResponse>(create);
+  static AuthenticationPostureResponse? _defaultInstance;
+
+  @$pb.TagNumber(1)
+  ProviderTokenVerificationStatus get providerToken => $_getN(0);
+  @$pb.TagNumber(1)
+  set providerToken(ProviderTokenVerificationStatus value) =>
+      $_setField(1, value);
+  @$pb.TagNumber(1)
+  $core.bool hasProviderToken() => $_has(0);
+  @$pb.TagNumber(1)
+  void clearProviderToken() => $_clearField(1);
+
+  @$pb.TagNumber(2)
+  $core.bool get enrolledDevice => $_getBF(1);
+  @$pb.TagNumber(2)
+  set enrolledDevice($core.bool value) => $_setBool(1, value);
+  @$pb.TagNumber(2)
+  $core.bool hasEnrolledDevice() => $_has(1);
+  @$pb.TagNumber(2)
+  void clearEnrolledDevice() => $_clearField(2);
+
+  @$pb.TagNumber(3)
+  $core.String get resolvedPrincipal => $_getSZ(2);
+  @$pb.TagNumber(3)
+  set resolvedPrincipal($core.String value) => $_setString(2, value);
+  @$pb.TagNumber(3)
+  $core.bool hasResolvedPrincipal() => $_has(2);
+  @$pb.TagNumber(3)
+  void clearResolvedPrincipal() => $_clearField(3);
+}
+
+/// Fixed framework crypto has an exact generated ABI. The signed request and encrypted custody
+/// values remain canonical USDA documents; Protobuf identifies the operation and frames those
+/// semantic values without rebuilding their schema as a generic struct.
+class OwnedDeviceRequestQuery extends $pb.GeneratedMessage {
+  factory OwnedDeviceRequestQuery({
+    $core.String? scope,
+  }) {
+    final result = create();
+    if (scope != null) result.scope = scope;
+    return result;
+  }
+
+  OwnedDeviceRequestQuery._();
+
+  factory OwnedDeviceRequestQuery.fromBuffer($core.List<$core.int> data,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromBuffer(data, registry);
+  factory OwnedDeviceRequestQuery.fromJson($core.String json,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromJson(json, registry);
+
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
+      _omitMessageNames ? '' : 'OwnedDeviceRequestQuery',
+      package:
+          const $pb.PackageName(_omitMessageNames ? '' : 'nomos.kernel.v1'),
+      createEmptyInstance: create)
+    ..aOS(1, _omitFieldNames ? '' : 'scope')
+    ..hasRequiredFields = false;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  OwnedDeviceRequestQuery clone() => deepCopy();
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  OwnedDeviceRequestQuery copyWith(
+          void Function(OwnedDeviceRequestQuery) updates) =>
+      super.copyWith((message) => updates(message as OwnedDeviceRequestQuery))
+          as OwnedDeviceRequestQuery;
+
+  @$core.override
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static OwnedDeviceRequestQuery create() => OwnedDeviceRequestQuery._();
+  @$core.override
+  OwnedDeviceRequestQuery createEmptyInstance() => create();
+  @$core.pragma('dart2js:noInline')
+  static OwnedDeviceRequestQuery getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<OwnedDeviceRequestQuery>(create);
+  static OwnedDeviceRequestQuery? _defaultInstance;
+
+  @$pb.TagNumber(1)
+  $core.String get scope => $_getSZ(0);
+  @$pb.TagNumber(1)
+  set scope($core.String value) => $_setString(0, value);
+  @$pb.TagNumber(1)
+  $core.bool hasScope() => $_has(0);
+  @$pb.TagNumber(1)
+  void clearScope() => $_clearField(1);
+}
+
+class OwnedDeviceRequestResponse extends $pb.GeneratedMessage {
+  factory OwnedDeviceRequestResponse({
+    $core.List<$core.int>? requestUsda,
+  }) {
+    final result = create();
+    if (requestUsda != null) result.requestUsda = requestUsda;
+    return result;
+  }
+
+  OwnedDeviceRequestResponse._();
+
+  factory OwnedDeviceRequestResponse.fromBuffer($core.List<$core.int> data,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromBuffer(data, registry);
+  factory OwnedDeviceRequestResponse.fromJson($core.String json,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromJson(json, registry);
+
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
+      _omitMessageNames ? '' : 'OwnedDeviceRequestResponse',
+      package:
+          const $pb.PackageName(_omitMessageNames ? '' : 'nomos.kernel.v1'),
+      createEmptyInstance: create)
+    ..a<$core.List<$core.int>>(
+        1, _omitFieldNames ? '' : 'requestUsda', $pb.PbFieldType.OY)
+    ..hasRequiredFields = false;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  OwnedDeviceRequestResponse clone() => deepCopy();
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  OwnedDeviceRequestResponse copyWith(
+          void Function(OwnedDeviceRequestResponse) updates) =>
+      super.copyWith(
+              (message) => updates(message as OwnedDeviceRequestResponse))
+          as OwnedDeviceRequestResponse;
+
+  @$core.override
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static OwnedDeviceRequestResponse create() => OwnedDeviceRequestResponse._();
+  @$core.override
+  OwnedDeviceRequestResponse createEmptyInstance() => create();
+  @$core.pragma('dart2js:noInline')
+  static OwnedDeviceRequestResponse getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<OwnedDeviceRequestResponse>(create);
+  static OwnedDeviceRequestResponse? _defaultInstance;
+
+  @$pb.TagNumber(1)
+  $core.List<$core.int> get requestUsda => $_getN(0);
+  @$pb.TagNumber(1)
+  set requestUsda($core.List<$core.int> value) => $_setBytes(0, value);
+  @$pb.TagNumber(1)
+  $core.bool hasRequestUsda() => $_has(0);
+  @$pb.TagNumber(1)
+  void clearRequestUsda() => $_clearField(1);
+}
+
+class OwnedPrepareApprovalQuery extends $pb.GeneratedMessage {
+  factory OwnedPrepareApprovalQuery({
+    $core.String? scope,
+    $core.List<$core.int>? requestUsda,
+  }) {
+    final result = create();
+    if (scope != null) result.scope = scope;
+    if (requestUsda != null) result.requestUsda = requestUsda;
+    return result;
+  }
+
+  OwnedPrepareApprovalQuery._();
+
+  factory OwnedPrepareApprovalQuery.fromBuffer($core.List<$core.int> data,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromBuffer(data, registry);
+  factory OwnedPrepareApprovalQuery.fromJson($core.String json,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromJson(json, registry);
+
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
+      _omitMessageNames ? '' : 'OwnedPrepareApprovalQuery',
+      package:
+          const $pb.PackageName(_omitMessageNames ? '' : 'nomos.kernel.v1'),
+      createEmptyInstance: create)
+    ..aOS(1, _omitFieldNames ? '' : 'scope')
+    ..a<$core.List<$core.int>>(
+        2, _omitFieldNames ? '' : 'requestUsda', $pb.PbFieldType.OY)
+    ..hasRequiredFields = false;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  OwnedPrepareApprovalQuery clone() => deepCopy();
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  OwnedPrepareApprovalQuery copyWith(
+          void Function(OwnedPrepareApprovalQuery) updates) =>
+      super.copyWith((message) => updates(message as OwnedPrepareApprovalQuery))
+          as OwnedPrepareApprovalQuery;
+
+  @$core.override
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static OwnedPrepareApprovalQuery create() => OwnedPrepareApprovalQuery._();
+  @$core.override
+  OwnedPrepareApprovalQuery createEmptyInstance() => create();
+  @$core.pragma('dart2js:noInline')
+  static OwnedPrepareApprovalQuery getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<OwnedPrepareApprovalQuery>(create);
+  static OwnedPrepareApprovalQuery? _defaultInstance;
+
+  @$pb.TagNumber(1)
+  $core.String get scope => $_getSZ(0);
+  @$pb.TagNumber(1)
+  set scope($core.String value) => $_setString(0, value);
+  @$pb.TagNumber(1)
+  $core.bool hasScope() => $_has(0);
+  @$pb.TagNumber(1)
+  void clearScope() => $_clearField(1);
+
+  @$pb.TagNumber(2)
+  $core.List<$core.int> get requestUsda => $_getN(1);
+  @$pb.TagNumber(2)
+  set requestUsda($core.List<$core.int> value) => $_setBytes(1, value);
+  @$pb.TagNumber(2)
+  $core.bool hasRequestUsda() => $_has(1);
+  @$pb.TagNumber(2)
+  void clearRequestUsda() => $_clearField(2);
+}
+
+class OwnedPrepareApprovalResponse extends $pb.GeneratedMessage {
+  factory OwnedPrepareApprovalResponse({
+    $core.String? newKeySubject,
+    $core.List<$core.int>? ownedCustodyUsda,
+    $core.String? verifiedVia,
+    $fixnum.Int64? validFromEpoch,
+    $fixnum.Int64? approvedAtUnixMillis,
+    $core.String? ownedKeySubject,
+  }) {
+    final result = create();
+    if (newKeySubject != null) result.newKeySubject = newKeySubject;
+    if (ownedCustodyUsda != null) result.ownedCustodyUsda = ownedCustodyUsda;
+    if (verifiedVia != null) result.verifiedVia = verifiedVia;
+    if (validFromEpoch != null) result.validFromEpoch = validFromEpoch;
+    if (approvedAtUnixMillis != null)
+      result.approvedAtUnixMillis = approvedAtUnixMillis;
+    if (ownedKeySubject != null) result.ownedKeySubject = ownedKeySubject;
+    return result;
+  }
+
+  OwnedPrepareApprovalResponse._();
+
+  factory OwnedPrepareApprovalResponse.fromBuffer($core.List<$core.int> data,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromBuffer(data, registry);
+  factory OwnedPrepareApprovalResponse.fromJson($core.String json,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromJson(json, registry);
+
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
+      _omitMessageNames ? '' : 'OwnedPrepareApprovalResponse',
+      package:
+          const $pb.PackageName(_omitMessageNames ? '' : 'nomos.kernel.v1'),
+      createEmptyInstance: create)
+    ..aOS(1, _omitFieldNames ? '' : 'newKeySubject')
+    ..a<$core.List<$core.int>>(
+        2, _omitFieldNames ? '' : 'ownedCustodyUsda', $pb.PbFieldType.OY)
+    ..aOS(3, _omitFieldNames ? '' : 'verifiedVia')
+    ..a<$fixnum.Int64>(
+        4, _omitFieldNames ? '' : 'validFromEpoch', $pb.PbFieldType.OU6,
+        defaultOrMaker: $fixnum.Int64.ZERO)
+    ..a<$fixnum.Int64>(
+        5, _omitFieldNames ? '' : 'approvedAtUnixMillis', $pb.PbFieldType.OU6,
+        defaultOrMaker: $fixnum.Int64.ZERO)
+    ..aOS(6, _omitFieldNames ? '' : 'ownedKeySubject')
+    ..hasRequiredFields = false;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  OwnedPrepareApprovalResponse clone() => deepCopy();
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  OwnedPrepareApprovalResponse copyWith(
+          void Function(OwnedPrepareApprovalResponse) updates) =>
+      super.copyWith(
+              (message) => updates(message as OwnedPrepareApprovalResponse))
+          as OwnedPrepareApprovalResponse;
+
+  @$core.override
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static OwnedPrepareApprovalResponse create() =>
+      OwnedPrepareApprovalResponse._();
+  @$core.override
+  OwnedPrepareApprovalResponse createEmptyInstance() => create();
+  @$core.pragma('dart2js:noInline')
+  static OwnedPrepareApprovalResponse getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<OwnedPrepareApprovalResponse>(create);
+  static OwnedPrepareApprovalResponse? _defaultInstance;
+
+  @$pb.TagNumber(1)
+  $core.String get newKeySubject => $_getSZ(0);
+  @$pb.TagNumber(1)
+  set newKeySubject($core.String value) => $_setString(0, value);
+  @$pb.TagNumber(1)
+  $core.bool hasNewKeySubject() => $_has(0);
+  @$pb.TagNumber(1)
+  void clearNewKeySubject() => $_clearField(1);
+
+  @$pb.TagNumber(2)
+  $core.List<$core.int> get ownedCustodyUsda => $_getN(1);
+  @$pb.TagNumber(2)
+  set ownedCustodyUsda($core.List<$core.int> value) => $_setBytes(1, value);
+  @$pb.TagNumber(2)
+  $core.bool hasOwnedCustodyUsda() => $_has(1);
+  @$pb.TagNumber(2)
+  void clearOwnedCustodyUsda() => $_clearField(2);
+
+  @$pb.TagNumber(3)
+  $core.String get verifiedVia => $_getSZ(2);
+  @$pb.TagNumber(3)
+  set verifiedVia($core.String value) => $_setString(2, value);
+  @$pb.TagNumber(3)
+  $core.bool hasVerifiedVia() => $_has(2);
+  @$pb.TagNumber(3)
+  void clearVerifiedVia() => $_clearField(3);
 
-  @$pb.TagNumber(20)
-  AuthorizationExpandRequest get authorizationExpand => $_getN(13);
-  @$pb.TagNumber(20)
-  set authorizationExpand(AuthorizationExpandRequest value) =>
-      $_setField(20, value);
-  @$pb.TagNumber(20)
-  $core.bool hasAuthorizationExpand() => $_has(13);
-  @$pb.TagNumber(20)
-  void clearAuthorizationExpand() => $_clearField(20);
-  @$pb.TagNumber(20)
-  AuthorizationExpandRequest ensureAuthorizationExpand() => $_ensure(13);
+  @$pb.TagNumber(4)
+  $fixnum.Int64 get validFromEpoch => $_getI64(3);
+  @$pb.TagNumber(4)
+  set validFromEpoch($fixnum.Int64 value) => $_setInt64(3, value);
+  @$pb.TagNumber(4)
+  $core.bool hasValidFromEpoch() => $_has(3);
+  @$pb.TagNumber(4)
+  void clearValidFromEpoch() => $_clearField(4);
 
-  @$pb.TagNumber(21)
-  FrontierTransitionRequest get frontierTransition => $_getN(14);
-  @$pb.TagNumber(21)
-  set frontierTransition(FrontierTransitionRequest value) =>
-      $_setField(21, value);
-  @$pb.TagNumber(21)
-  $core.bool hasFrontierTransition() => $_has(14);
-  @$pb.TagNumber(21)
-  void clearFrontierTransition() => $_clearField(21);
-  @$pb.TagNumber(21)
-  FrontierTransitionRequest ensureFrontierTransition() => $_ensure(14);
+  @$pb.TagNumber(5)
+  $fixnum.Int64 get approvedAtUnixMillis => $_getI64(4);
+  @$pb.TagNumber(5)
+  set approvedAtUnixMillis($fixnum.Int64 value) => $_setInt64(4, value);
+  @$pb.TagNumber(5)
+  $core.bool hasApprovedAtUnixMillis() => $_has(4);
+  @$pb.TagNumber(5)
+  void clearApprovedAtUnixMillis() => $_clearField(5);
+
+  @$pb.TagNumber(6)
+  $core.String get ownedKeySubject => $_getSZ(5);
+  @$pb.TagNumber(6)
+  set ownedKeySubject($core.String value) => $_setString(5, value);
+  @$pb.TagNumber(6)
+  $core.bool hasOwnedKeySubject() => $_has(5);
+  @$pb.TagNumber(6)
+  void clearOwnedKeySubject() => $_clearField(6);
 }
 
 /// Claims and opaque proofs supplied to a read. The kernel alone resolves them against active law;
@@ -6169,11 +7700,13 @@ class RowsQuery extends $pb.GeneratedMessage {
     $core.String? id,
     NomosStruct? arguments,
     $core.String? principal,
+    $core.List<$core.int>? argumentsUsda,
   }) {
     final result = create();
     if (id != null) result.id = id;
     if (arguments != null) result.arguments = arguments;
     if (principal != null) result.principal = principal;
+    if (argumentsUsda != null) result.argumentsUsda = argumentsUsda;
     return result;
   }
 
@@ -6195,6 +7728,8 @@ class RowsQuery extends $pb.GeneratedMessage {
     ..aOM<NomosStruct>(2, _omitFieldNames ? '' : 'arguments',
         subBuilder: NomosStruct.create)
     ..aOS(3, _omitFieldNames ? '' : 'principal')
+    ..a<$core.List<$core.int>>(
+        4, _omitFieldNames ? '' : 'argumentsUsda', $pb.PbFieldType.OY)
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -6224,6 +7759,9 @@ class RowsQuery extends $pb.GeneratedMessage {
   @$pb.TagNumber(1)
   void clearId() => $_clearField(1);
 
+  /// Retained only while fixed framework callers move to dedicated query arms. Generated
+  /// application clients author nominal query USDA in `arguments_usda`; a generic struct is not
+  /// an application type system.
   @$pb.TagNumber(2)
   NomosStruct get arguments => $_getN(1);
   @$pb.TagNumber(2)
@@ -6243,6 +7781,15 @@ class RowsQuery extends $pb.GeneratedMessage {
   $core.bool hasPrincipal() => $_has(2);
   @$pb.TagNumber(3)
   void clearPrincipal() => $_clearField(3);
+
+  @$pb.TagNumber(4)
+  $core.List<$core.int> get argumentsUsda => $_getN(3);
+  @$pb.TagNumber(4)
+  set argumentsUsda($core.List<$core.int> value) => $_setBytes(3, value);
+  @$pb.TagNumber(4)
+  $core.bool hasArgumentsUsda() => $_has(3);
+  @$pb.TagNumber(4)
+  void clearArgumentsUsda() => $_clearField(4);
 }
 
 class PageQuery extends $pb.GeneratedMessage {
@@ -6252,6 +7799,7 @@ class PageQuery extends $pb.GeneratedMessage {
     $core.int? limit,
     $core.String? after,
     $core.String? principal,
+    $core.List<$core.int>? argumentsUsda,
   }) {
     final result = create();
     if (id != null) result.id = id;
@@ -6259,6 +7807,7 @@ class PageQuery extends $pb.GeneratedMessage {
     if (limit != null) result.limit = limit;
     if (after != null) result.after = after;
     if (principal != null) result.principal = principal;
+    if (argumentsUsda != null) result.argumentsUsda = argumentsUsda;
     return result;
   }
 
@@ -6282,6 +7831,8 @@ class PageQuery extends $pb.GeneratedMessage {
     ..aI(3, _omitFieldNames ? '' : 'limit', fieldType: $pb.PbFieldType.OU3)
     ..aOS(4, _omitFieldNames ? '' : 'after')
     ..aOS(5, _omitFieldNames ? '' : 'principal')
+    ..a<$core.List<$core.int>>(
+        6, _omitFieldNames ? '' : 'argumentsUsda', $pb.PbFieldType.OY)
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -6311,6 +7862,7 @@ class PageQuery extends $pb.GeneratedMessage {
   @$pb.TagNumber(1)
   void clearId() => $_clearField(1);
 
+  /// See RowsQuery.arguments. Page mechanics stay protobuf; domain arguments stay USDA.
   @$pb.TagNumber(2)
   NomosStruct get arguments => $_getN(1);
   @$pb.TagNumber(2)
@@ -6348,6 +7900,15 @@ class PageQuery extends $pb.GeneratedMessage {
   $core.bool hasPrincipal() => $_has(4);
   @$pb.TagNumber(5)
   void clearPrincipal() => $_clearField(5);
+
+  @$pb.TagNumber(6)
+  $core.List<$core.int> get argumentsUsda => $_getN(5);
+  @$pb.TagNumber(6)
+  set argumentsUsda($core.List<$core.int> value) => $_setBytes(5, value);
+  @$pb.TagNumber(6)
+  $core.bool hasArgumentsUsda() => $_has(5);
+  @$pb.TagNumber(6)
+  void clearArgumentsUsda() => $_clearField(6);
 }
 
 class ByIdQuery extends $pb.GeneratedMessage {
@@ -6428,6 +7989,73 @@ class ByIdQuery extends $pb.GeneratedMessage {
   void clearPrincipal() => $_clearField(3);
 }
 
+class ByTypeQuery extends $pb.GeneratedMessage {
+  factory ByTypeQuery({
+    $core.String? aggregateType,
+    $core.String? principal,
+  }) {
+    final result = create();
+    if (aggregateType != null) result.aggregateType = aggregateType;
+    if (principal != null) result.principal = principal;
+    return result;
+  }
+
+  ByTypeQuery._();
+
+  factory ByTypeQuery.fromBuffer($core.List<$core.int> data,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromBuffer(data, registry);
+  factory ByTypeQuery.fromJson($core.String json,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromJson(json, registry);
+
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
+      _omitMessageNames ? '' : 'ByTypeQuery',
+      package:
+          const $pb.PackageName(_omitMessageNames ? '' : 'nomos.kernel.v1'),
+      createEmptyInstance: create)
+    ..aOS(1, _omitFieldNames ? '' : 'aggregateType')
+    ..aOS(2, _omitFieldNames ? '' : 'principal')
+    ..hasRequiredFields = false;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  ByTypeQuery clone() => deepCopy();
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  ByTypeQuery copyWith(void Function(ByTypeQuery) updates) =>
+      super.copyWith((message) => updates(message as ByTypeQuery))
+          as ByTypeQuery;
+
+  @$core.override
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static ByTypeQuery create() => ByTypeQuery._();
+  @$core.override
+  ByTypeQuery createEmptyInstance() => create();
+  @$core.pragma('dart2js:noInline')
+  static ByTypeQuery getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<ByTypeQuery>(create);
+  static ByTypeQuery? _defaultInstance;
+
+  @$pb.TagNumber(1)
+  $core.String get aggregateType => $_getSZ(0);
+  @$pb.TagNumber(1)
+  set aggregateType($core.String value) => $_setString(0, value);
+  @$pb.TagNumber(1)
+  $core.bool hasAggregateType() => $_has(0);
+  @$pb.TagNumber(1)
+  void clearAggregateType() => $_clearField(1);
+
+  @$pb.TagNumber(2)
+  $core.String get principal => $_getSZ(1);
+  @$pb.TagNumber(2)
+  set principal($core.String value) => $_setString(1, value);
+  @$pb.TagNumber(2)
+  $core.bool hasPrincipal() => $_has(1);
+  @$pb.TagNumber(2)
+  void clearPrincipal() => $_clearField(2);
+}
+
 class NomosRef extends $pb.GeneratedMessage {
   factory NomosRef({
     $core.String? workspace,
@@ -6720,13 +8348,13 @@ class ReferenceVersionCheck extends $pb.GeneratedMessage {
 class TallyQuery extends $pb.GeneratedMessage {
   factory TallyQuery({
     $core.String? id,
-    NomosStruct? arguments,
     $core.String? principal,
+    $core.String? groupKey,
   }) {
     final result = create();
     if (id != null) result.id = id;
-    if (arguments != null) result.arguments = arguments;
     if (principal != null) result.principal = principal;
+    if (groupKey != null) result.groupKey = groupKey;
     return result;
   }
 
@@ -6745,9 +8373,8 @@ class TallyQuery extends $pb.GeneratedMessage {
           const $pb.PackageName(_omitMessageNames ? '' : 'nomos.kernel.v1'),
       createEmptyInstance: create)
     ..aOS(1, _omitFieldNames ? '' : 'id')
-    ..aOM<NomosStruct>(2, _omitFieldNames ? '' : 'arguments',
-        subBuilder: NomosStruct.create)
     ..aOS(3, _omitFieldNames ? '' : 'principal')
+    ..aOS(4, _omitFieldNames ? '' : 'groupKey')
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -6777,37 +8404,41 @@ class TallyQuery extends $pb.GeneratedMessage {
   @$pb.TagNumber(1)
   void clearId() => $_clearField(1);
 
-  @$pb.TagNumber(2)
-  NomosStruct get arguments => $_getN(1);
-  @$pb.TagNumber(2)
-  set arguments(NomosStruct value) => $_setField(2, value);
-  @$pb.TagNumber(2)
-  $core.bool hasArguments() => $_has(1);
-  @$pb.TagNumber(2)
-  void clearArguments() => $_clearField(2);
-  @$pb.TagNumber(2)
-  NomosStruct ensureArguments() => $_ensure(1);
-
   @$pb.TagNumber(3)
-  $core.String get principal => $_getSZ(2);
+  $core.String get principal => $_getSZ(1);
   @$pb.TagNumber(3)
-  set principal($core.String value) => $_setString(2, value);
+  set principal($core.String value) => $_setString(1, value);
   @$pb.TagNumber(3)
-  $core.bool hasPrincipal() => $_has(2);
+  $core.bool hasPrincipal() => $_has(1);
   @$pb.TagNumber(3)
   void clearPrincipal() => $_clearField(3);
+
+  @$pb.TagNumber(4)
+  $core.String get groupKey => $_getSZ(2);
+  @$pb.TagNumber(4)
+  set groupKey($core.String value) => $_setString(2, value);
+  @$pb.TagNumber(4)
+  $core.bool hasGroupKey() => $_has(2);
+  @$pb.TagNumber(4)
+  void clearGroupKey() => $_clearField(4);
 }
 
 class SpatialQuery extends $pb.GeneratedMessage {
   factory SpatialQuery({
     $core.String? id,
-    NomosStruct? arguments,
     $core.String? principal,
+    $core.double? minX,
+    $core.double? minY,
+    $core.double? maxX,
+    $core.double? maxY,
   }) {
     final result = create();
     if (id != null) result.id = id;
-    if (arguments != null) result.arguments = arguments;
     if (principal != null) result.principal = principal;
+    if (minX != null) result.minX = minX;
+    if (minY != null) result.minY = minY;
+    if (maxX != null) result.maxX = maxX;
+    if (maxY != null) result.maxY = maxY;
     return result;
   }
 
@@ -6826,9 +8457,11 @@ class SpatialQuery extends $pb.GeneratedMessage {
           const $pb.PackageName(_omitMessageNames ? '' : 'nomos.kernel.v1'),
       createEmptyInstance: create)
     ..aOS(1, _omitFieldNames ? '' : 'id')
-    ..aOM<NomosStruct>(2, _omitFieldNames ? '' : 'arguments',
-        subBuilder: NomosStruct.create)
     ..aOS(3, _omitFieldNames ? '' : 'principal')
+    ..aD(4, _omitFieldNames ? '' : 'minX')
+    ..aD(5, _omitFieldNames ? '' : 'minY')
+    ..aD(6, _omitFieldNames ? '' : 'maxX')
+    ..aD(7, _omitFieldNames ? '' : 'maxY')
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -6859,25 +8492,179 @@ class SpatialQuery extends $pb.GeneratedMessage {
   @$pb.TagNumber(1)
   void clearId() => $_clearField(1);
 
-  @$pb.TagNumber(2)
-  NomosStruct get arguments => $_getN(1);
-  @$pb.TagNumber(2)
-  set arguments(NomosStruct value) => $_setField(2, value);
-  @$pb.TagNumber(2)
-  $core.bool hasArguments() => $_has(1);
-  @$pb.TagNumber(2)
-  void clearArguments() => $_clearField(2);
-  @$pb.TagNumber(2)
-  NomosStruct ensureArguments() => $_ensure(1);
-
   @$pb.TagNumber(3)
-  $core.String get principal => $_getSZ(2);
+  $core.String get principal => $_getSZ(1);
   @$pb.TagNumber(3)
-  set principal($core.String value) => $_setString(2, value);
+  set principal($core.String value) => $_setString(1, value);
   @$pb.TagNumber(3)
-  $core.bool hasPrincipal() => $_has(2);
+  $core.bool hasPrincipal() => $_has(1);
   @$pb.TagNumber(3)
   void clearPrincipal() => $_clearField(3);
+
+  @$pb.TagNumber(4)
+  $core.double get minX => $_getN(2);
+  @$pb.TagNumber(4)
+  set minX($core.double value) => $_setDouble(2, value);
+  @$pb.TagNumber(4)
+  $core.bool hasMinX() => $_has(2);
+  @$pb.TagNumber(4)
+  void clearMinX() => $_clearField(4);
+
+  @$pb.TagNumber(5)
+  $core.double get minY => $_getN(3);
+  @$pb.TagNumber(5)
+  set minY($core.double value) => $_setDouble(3, value);
+  @$pb.TagNumber(5)
+  $core.bool hasMinY() => $_has(3);
+  @$pb.TagNumber(5)
+  void clearMinY() => $_clearField(5);
+
+  @$pb.TagNumber(6)
+  $core.double get maxX => $_getN(4);
+  @$pb.TagNumber(6)
+  set maxX($core.double value) => $_setDouble(4, value);
+  @$pb.TagNumber(6)
+  $core.bool hasMaxX() => $_has(4);
+  @$pb.TagNumber(6)
+  void clearMaxX() => $_clearField(6);
+
+  @$pb.TagNumber(7)
+  $core.double get maxY => $_getN(5);
+  @$pb.TagNumber(7)
+  set maxY($core.double value) => $_setDouble(5, value);
+  @$pb.TagNumber(7)
+  $core.bool hasMaxY() => $_has(5);
+  @$pb.TagNumber(7)
+  void clearMaxY() => $_clearField(7);
+}
+
+/// The maintained conflict index is framework-owned, while each competing
+/// value remains typed by the application's composed law. Both operations
+/// therefore have exact request fields and return canonical USDA.
+class PendingConflictsQuery extends $pb.GeneratedMessage {
+  factory PendingConflictsQuery({
+    $core.String? aggregateType,
+    $core.String? principal,
+  }) {
+    final result = create();
+    if (aggregateType != null) result.aggregateType = aggregateType;
+    if (principal != null) result.principal = principal;
+    return result;
+  }
+
+  PendingConflictsQuery._();
+
+  factory PendingConflictsQuery.fromBuffer($core.List<$core.int> data,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromBuffer(data, registry);
+  factory PendingConflictsQuery.fromJson($core.String json,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromJson(json, registry);
+
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
+      _omitMessageNames ? '' : 'PendingConflictsQuery',
+      package:
+          const $pb.PackageName(_omitMessageNames ? '' : 'nomos.kernel.v1'),
+      createEmptyInstance: create)
+    ..aOS(1, _omitFieldNames ? '' : 'aggregateType')
+    ..aOS(2, _omitFieldNames ? '' : 'principal')
+    ..hasRequiredFields = false;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  PendingConflictsQuery clone() => deepCopy();
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  PendingConflictsQuery copyWith(
+          void Function(PendingConflictsQuery) updates) =>
+      super.copyWith((message) => updates(message as PendingConflictsQuery))
+          as PendingConflictsQuery;
+
+  @$core.override
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static PendingConflictsQuery create() => PendingConflictsQuery._();
+  @$core.override
+  PendingConflictsQuery createEmptyInstance() => create();
+  @$core.pragma('dart2js:noInline')
+  static PendingConflictsQuery getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<PendingConflictsQuery>(create);
+  static PendingConflictsQuery? _defaultInstance;
+
+  @$pb.TagNumber(1)
+  $core.String get aggregateType => $_getSZ(0);
+  @$pb.TagNumber(1)
+  set aggregateType($core.String value) => $_setString(0, value);
+  @$pb.TagNumber(1)
+  $core.bool hasAggregateType() => $_has(0);
+  @$pb.TagNumber(1)
+  void clearAggregateType() => $_clearField(1);
+
+  @$pb.TagNumber(2)
+  $core.String get principal => $_getSZ(1);
+  @$pb.TagNumber(2)
+  set principal($core.String value) => $_setString(1, value);
+  @$pb.TagNumber(2)
+  $core.bool hasPrincipal() => $_has(1);
+  @$pb.TagNumber(2)
+  void clearPrincipal() => $_clearField(2);
+}
+
+class PendingConflictSummaryQuery extends $pb.GeneratedMessage {
+  factory PendingConflictSummaryQuery({
+    $core.String? principal,
+  }) {
+    final result = create();
+    if (principal != null) result.principal = principal;
+    return result;
+  }
+
+  PendingConflictSummaryQuery._();
+
+  factory PendingConflictSummaryQuery.fromBuffer($core.List<$core.int> data,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromBuffer(data, registry);
+  factory PendingConflictSummaryQuery.fromJson($core.String json,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromJson(json, registry);
+
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
+      _omitMessageNames ? '' : 'PendingConflictSummaryQuery',
+      package:
+          const $pb.PackageName(_omitMessageNames ? '' : 'nomos.kernel.v1'),
+      createEmptyInstance: create)
+    ..aOS(1, _omitFieldNames ? '' : 'principal')
+    ..hasRequiredFields = false;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  PendingConflictSummaryQuery clone() => deepCopy();
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  PendingConflictSummaryQuery copyWith(
+          void Function(PendingConflictSummaryQuery) updates) =>
+      super.copyWith(
+              (message) => updates(message as PendingConflictSummaryQuery))
+          as PendingConflictSummaryQuery;
+
+  @$core.override
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static PendingConflictSummaryQuery create() =>
+      PendingConflictSummaryQuery._();
+  @$core.override
+  PendingConflictSummaryQuery createEmptyInstance() => create();
+  @$core.pragma('dart2js:noInline')
+  static PendingConflictSummaryQuery getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<PendingConflictSummaryQuery>(create);
+  static PendingConflictSummaryQuery? _defaultInstance;
+
+  @$pb.TagNumber(1)
+  $core.String get principal => $_getSZ(0);
+  @$pb.TagNumber(1)
+  set principal($core.String value) => $_setString(0, value);
+  @$pb.TagNumber(1)
+  $core.bool hasPrincipal() => $_has(0);
+  @$pb.TagNumber(1)
+  void clearPrincipal() => $_clearField(1);
 }
 
 /// Framework/introspection reads have fixed names in generated clients. `arguments` carries only