@githolon/dsl 0.108.3 → 0.108.6

package/dart/lib/src/runner/offline-install.mjs

@@ -4390,6 +4390,8 @@ __export(engine_exports, {
   author: () => author,
   authorEphemeral: () => authorEphemeral,
   authorKeygen: () => authorKeygen,
+  authorModelLifecyclePromotion: () => authorModelLifecyclePromotion,
+  authorModelLifecycleStage: () => authorModelLifecycleStage,
   authorOn: () => authorOn,
   authorOperatorCall: () => authorOperatorCall,
   backupHead: () => backupHead,
@@ -4462,6 +4464,7 @@ __export(engine_exports, {
   lawParity: () => lawParity,
   ledgerStats: () => ledgerStats,
   listRefusedRefs: () => listRefusedRefs,
+  localCustodySnapshot: () => localCustodySnapshot,
   materializeRefused: () => materializeRefused,
   memoryDropProbe: () => memoryDropProbe,
   migrateHomes: () => migrateHomes,
@@ -6274,6 +6277,16 @@ function prepareManagedPromotion(report, candidateHash, domain, opts = {}) {
       error: `the package-wide report does not cover the generated business area '${domain}'`
     };
   }
+  const dispositions = report.dispositions;
+  const changesStableIdentity = dispositions !== void 0 && (dispositions.retired.length > 0 || Object.keys(dispositions.retyped).length > 0 || Object.keys(dispositions.rebinds).length > 0);
+  if (changesStableIdentity && !acceptanceReason) {
+    return {
+      ok: false,
+      stage: "acceptance",
+      report,
+      error: "the current-frontier transition changes stable business identities and needs an attributed acceptance reason"
+    };
+  }
   const preflight = {
     candidateHash,
     // A package may be reached through any one of its generated domain clients. The
@@ -10898,6 +10911,7 @@ var AuthoringOptionsSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_ke
 var CapturedClockSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 49);
 var BirthCertificateSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 50);
 var SignBirthCertificateRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 51);
+var ModelLifecycleIntentSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 53);
 var OfferRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 54);
 var QueryRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 57);
 var QueryAuthoritySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 64);
@@ -10912,6 +10926,10 @@ var PendingConflictsQuerySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_
 var PendingConflictSummaryQuerySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 77);
 var NamedQuerySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 78);
 var FrontierTransitionRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 79);
+var FrontierTransitionDispositionMapEntrySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 80);
+var FrontierTransitionDispositionsSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 81);
+var FrontierTransitionViolationSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 82);
+var FrontierTransitionResponseSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 83);
 var AuthorizationObjectSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 84);
 var AuthorizationSubjectSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 85);
 var AuthorizationConsistencySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 87);
@@ -10950,6 +10968,8 @@ var NomosValueSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel,
 var NomosStructSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 166);
 var BirthOutcomeStatusSchema = /* @__PURE__ */ enumDesc(file_nomos_kernel_v1_kernel, 0);
 var BirthOutcomeStatus = /* @__PURE__ */ tsEnum(BirthOutcomeStatusSchema);
+var ModelLifecycleOperationSchema = /* @__PURE__ */ enumDesc(file_nomos_kernel_v1_kernel, 3);
+var ModelLifecycleOperation = /* @__PURE__ */ tsEnum(ModelLifecycleOperationSchema);
 var QueryResultFormatSchema = /* @__PURE__ */ enumDesc(file_nomos_kernel_v1_kernel, 5);
 var QueryResultFormat = /* @__PURE__ */ tsEnum(QueryResultFormatSchema);
 var QueryOperationSchema = /* @__PURE__ */ enumDesc(file_nomos_kernel_v1_kernel, 6);
@@ -11036,6 +11056,10 @@ function presentOfferAdmitted(admitted) {
   };
 }
 
+// src/_adapter/proto/nomos/custody/v1/snapshot_pb.js
+var file_nomos_custody_v1_snapshot = /* @__PURE__ */ fileDesc("Ch9ub21vcy9jdXN0b2R5L3YxL3NuYXBzaG90LnByb3RvEhBub21vcy5jdXN0b2R5LnYxIqACChRMb2NhbEN1c3RvZHlTbmFwc2hvdBIWCg5mb3JtYXRfdmVyc2lvbhgBIAEoDRIWCgl3b3Jrc3BhY2UYAiABKAlIAIgBARIMCgR0cmVlGAMgASgMEhcKCmNoZWNrcG9pbnQYBCABKAxIAYgBARIVCghmcm9udGllchgFIAEoDEgCiAEBEhMKBmN1cnNvchgGIAEoCUgDiAEBEhcKCnN0YXRlX3Jvb3QYByABKAlIBIgBARIYCgtzeW5jZWRfYmFzZRgIIAEoCUgFiAEBQgwKCl93b3Jrc3BhY2VCDQoLX2NoZWNrcG9pbnRCCwoJX2Zyb250aWVyQgkKB19jdXJzb3JCDQoLX3N0YXRlX3Jvb3RCDgoMX3N5bmNlZF9iYXNlYgZwcm90bzM");
+var LocalCustodySnapshotSchema = /* @__PURE__ */ messageDesc(file_nomos_custody_v1_snapshot, 0);
+
 // src/_adapter/engine.ts
 var enc3 = new TextEncoder();
 var dec3 = new TextDecoder();
@@ -11586,6 +11610,100 @@ var closureInstallPayload = (hash, installedBy, options = {}) => ({
 function authorOperatorCall(eng2, ws, call, controllerHash, opts = {}) {
   return author(eng2, ws, call.domain, call.directive, call.canonicalUsda, controllerHash, opts);
 }
+function authorModelLifecycleStage(eng2, ws, lawUsdz, installedBy, supersedes, opts = {}) {
+  const sequence = eng2.seq++;
+  const captured = {
+    physical: Date.now(),
+    logical: 0,
+    replica: eng2.replica
+  };
+  const response = offerRequestResponse(eng2, create(OfferRequestSchema, {
+    target: protoTarget(ws),
+    intent: {
+      case: "modelLifecycle",
+      value: create(ModelLifecycleIntentSchema, {
+        operation: ModelLifecycleOperation.STAGE,
+        installedBy,
+        supersedes
+      })
+    },
+    authoring: create(AuthoringOptionsSchema, {
+      actor: opts.actor ?? "",
+      authToken: opts.authToken ? enc3.encode(opts.authToken) : new Uint8Array(),
+      authorSecret: opts.authorSecret ? bytesFromB64(opts.authorSecret) : new Uint8Array(),
+      validFromEpoch: opts.validFromEpoch === void 0 ? void 0 : BigInt(opts.validFromEpoch),
+      rng: osEntropyBuffer(opts.rngDraws ?? 64),
+      deferProjection: opts.deferProjection !== false,
+      spans: opts.spans ?? false,
+      sequence: BigInt(sequence),
+      clock: create(CapturedClockSchema, {
+        physicalMillis: BigInt(captured.physical),
+        logical: captured.logical,
+        replica: BigInt(captured.replica)
+      })
+    }),
+    lawUsdz
+  }));
+  return offerResult(response);
+}
+function authorModelLifecyclePromotion(eng2, ws, transition, replaces, acceptanceReason, opts = {}) {
+  const sequence = eng2.seq++;
+  const captured = {
+    physical: Date.now(),
+    logical: 0,
+    replica: eng2.replica
+  };
+  const dispositions = transition.dispositions === void 0 ? void 0 : create(FrontierTransitionDispositionsSchema, {
+    retired: [...transition.dispositions.retired],
+    retyped: Object.entries(transition.dispositions.retyped).map(
+      ([sourceStableId, acknowledgement]) => create(FrontierTransitionDispositionMapEntrySchema, { sourceStableId, acknowledgement })
+    ),
+    rebinds: Object.entries(transition.dispositions.rebinds).map(
+      ([sourceStableId, acknowledgement]) => create(FrontierTransitionDispositionMapEntrySchema, { sourceStableId, acknowledgement })
+    ),
+    acknowledgedBy: transition.dispositions.ackBy
+  });
+  const response = offerRequestResponse(eng2, create(OfferRequestSchema, {
+    target: protoTarget(ws),
+    intent: {
+      case: "modelLifecycle",
+      value: create(ModelLifecycleIntentSchema, {
+        operation: ModelLifecycleOperation.PROMOTE,
+        replaces,
+        acceptanceReason,
+        transition: create(FrontierTransitionResponseSchema, {
+          atHash: transition.atHash,
+          currentHash: transition.currentHash,
+          atStateRoot: transition.atStateRoot ?? "",
+          candidateHash: transition.candidateHash,
+          domain: transition.domain,
+          domains: [...transition.domains ?? []],
+          ready: transition.ready,
+          violations: transition.evolve.violations.map(
+            ({ domain, detail }) => create(FrontierTransitionViolationSchema, { domain, detail })
+          ),
+          dispositions
+        })
+      })
+    },
+    authoring: create(AuthoringOptionsSchema, {
+      actor: opts.actor ?? "",
+      authToken: opts.authToken ? enc3.encode(opts.authToken) : new Uint8Array(),
+      authorSecret: opts.authorSecret ? bytesFromB64(opts.authorSecret) : new Uint8Array(),
+      validFromEpoch: opts.validFromEpoch === void 0 ? void 0 : BigInt(opts.validFromEpoch),
+      rng: osEntropyBuffer(opts.rngDraws ?? 64),
+      deferProjection: opts.deferProjection !== false,
+      spans: opts.spans ?? false,
+      sequence: BigInt(sequence),
+      clock: create(CapturedClockSchema, {
+        physicalMillis: BigInt(captured.physical),
+        logical: captured.logical,
+        replica: BigInt(captured.replica)
+      })
+    })
+  }));
+  return offerResult(response);
+}
 function initializeWorkspace(eng2, ws, installedBy = eng2.installedBy) {
   const sequence = eng2.seq++;
   const captured = {
@@ -12704,8 +12822,11 @@ async function reconcileRequiredCustodyHead(eng2, ws, ledger, requiredCustodyHea
   if (!/^[0-9a-f]{40}$/.test(requiredCustodyHead)) {
     throw new Error("required custody head must be a lowercase 40-hex git object id");
   }
-  const current = eng2.mounted.has(ws) ? kgit.resolveRef(eng2, gitdirOf(ws), BRANCH) : "";
-  if (current === requiredCustodyHead) return eng2.mounted.get(ws);
+  const resident = eng2.mounted.get(ws);
+  const current = resident ? kgit.resolveRef(eng2, gitdirOf(ws), BRANCH) : "";
+  if (current === requiredCustodyHead && resident?.remoteMain === requiredCustodyHead && !resident.restoreError) {
+    return resident;
+  }
   if (current && isDirty(eng2, ws)) {
     throw new Error(
       `workspace '${ws}' has verified but unsealed resident work; refusing to discard it while reconciling custody`
@@ -12718,6 +12839,12 @@ async function reconcileRequiredCustodyHead(eng2, ws, ledger, requiredCustodyHea
       `workspace '${ws}' could not reconcile required custody ${requiredCustodyHead}: ${mounted.restoreError || "custody has no verified main"}`
     );
   }
+  const reconciled = kgit.resolveRef(eng2, gitdirOf(ws), BRANCH);
+  if (reconciled !== requiredCustodyHead || mounted.remoteMain !== requiredCustodyHead) {
+    throw new Error(
+      `workspace '${ws}' restored custody ${mounted.remoteMain || reconciled || "none"}, not required custody ${requiredCustodyHead}`
+    );
+  }
   return mounted;
 }
 function assertAuthored(res, what) {
@@ -12855,7 +12982,10 @@ async function applyWorkspaceEffect(eng2, ws, ledger, requestBytes, admissionChe
   const result = response.outcome.value.result;
   if (!result || result.outcome.case !== "admitted") {
     const outcome = result?.outcome.case || "empty";
-    throw new Error(`target kernel ${outcome} the workspace effect`);
+    const detail = result?.outcome.case === "refused" ? result.outcome.value.refusal?.message : void 0;
+    throw new Error(
+      `target kernel ${outcome} the workspace effect${detail ? `: ${detail}` : ""}`
+    );
   }
   await custodyPush(eng2, ws, ledger, { remoteRef: "refs/heads/main", ffOnly: true });
   return toBinary(ApplyWorkspaceEffectResponseSchema, response.outcome.value);
@@ -12966,8 +13096,8 @@ function prepareRemoteOffer(eng2, ws, requestBytes) {
   if (authoring.authorSecret.byteLength !== 0) {
     throw new Error("remote offer preparation refuses client signing secrets");
   }
-  if (request.intent.case !== "call") {
-    throw new Error("remote offer preparation requires a typed directive call");
+  if (request.intent.case !== "call" && request.intent.case !== "modelLifecycle") {
+    throw new Error("remote offer preparation requires a typed directive or model-lifecycle call");
   }
   const response = callProto(eng2.ex, {
     case: "prepareRemoteOffer",
@@ -13774,7 +13904,13 @@ function packDelta(eng2, ws, base, head) {
       case: "packDelta",
       value: create(PackDeltaRequestSchema, { repo: repoArgOf(ws), base: base || void 0, head })
     }, "packDelta").pack;
-  } catch {
+  } catch (error) {
+    console.error("[nomos-custody-pack] packDelta refused", {
+      workspace: ws,
+      base: base || "<full>",
+      head,
+      error: String(error)
+    });
     return null;
   }
 }
@@ -14457,11 +14593,12 @@ function promotePreflighted(eng2, ws, domain, candidateHash, opts = {}) {
     acceptanceReason: _acceptance,
     ...authorOpts
   } = opts;
-  const result = authorOperatorCall(
+  const result = authorModelLifecyclePromotion(
     eng2,
     ws,
-    promoteDomainCall(ws, prepared.payload),
-    requireCurrentControllerLawHash(eng2, ws),
+    report,
+    prepared.payload.replaces,
+    prepared.payload.preflight.acceptanceReason,
     {
       ...authorOpts,
       ...actingPrincipal ? { actor: actingPrincipal } : {}
@@ -14952,7 +15089,10 @@ async function emitOutbox(eng2, ws, ledger, workspaceEffectBase = "", admissionC
           const targetResult = response.result;
           if (!targetResult || targetResult.outcome.case !== "admitted") {
             const outcome = targetResult?.outcome.case || "empty";
-            throw new Error(`target kernel ${outcome} the workspace effect`);
+            const detail = targetResult?.outcome.case === "refused" ? targetResult.outcome.value.refusal?.message : void 0;
+            throw new Error(
+              `target kernel ${outcome} the workspace effect${detail ? `: ${detail}` : ""}`
+            );
           }
           break;
         }
@@ -14984,7 +15124,7 @@ async function emitOutbox(eng2, ws, ledger, workspaceEffectBase = "", admissionC
     } catch (e) {
       errors++;
       const destination = offer.route.case === "httpsRoute" ? offer.route.value.url : offer.route.case === "workspaceRoute" ? offer.route.value.workspace : offer.destination;
-      log("outbox-deliver-failed", { ws, offerId: offer.id, destination, error: String(e).slice(0, 200) });
+      log("outbox-deliver-failed", { ws, offerId: offer.id, destination, error: String(e).slice(0, 2e3) });
     }
   }
   if (delivered.length || errors) log("outbox", { ws, delivered: delivered.length, errors });
@@ -15017,6 +15157,26 @@ function snapshot(eng2, ws) {
   const wsDir = dirOf(eng2.preopen.dir.contents.get("ws")).contents.get(ws);
   return serializeTree(wsDir);
 }
+function localCustodySnapshot(eng2, ws) {
+  const checkpoint2 = exportCheckpoint(eng2, ws);
+  const tree = snapshot(eng2, ws);
+  const head = headOf(eng2, ws);
+  const body = toBinary(LocalCustodySnapshotSchema, create(LocalCustodySnapshotSchema, {
+    formatVersion: 3,
+    workspace: ws,
+    tree,
+    checkpoint: checkpoint2.blob ? bytesFromB64(checkpoint2.blob) : void 0,
+    frontier: checkpoint2.frontier ? bytesFromB64(checkpoint2.frontier) : void 0,
+    cursor: checkpoint2.cursor === void 0 ? void 0 : String(checkpoint2.cursor),
+    stateRoot: checkpoint2.stateRoot,
+    syncedBase: head || void 0
+  }));
+  const prefix = enc3.encode("NOMOS-CUSTODY-PB3\n");
+  const framed = new Uint8Array(prefix.byteLength + body.byteLength);
+  framed.set(prefix);
+  framed.set(body, prefix.byteLength);
+  return framed;
+}
 function stats(eng2) {
   return {
     mounted: eng2.mounted.size,

package/dart/lib/src/session_bound.dart

@@ -284,6 +284,10 @@ Future<T> nmsInternalConvergeGeneratedModel<T>({
     try {
       return await attempt();
     } on DomainClientModelAdoptionRequired catch (change) {
+      // A lifecycle response with no lawful next action is a terminal refusal,
+      // not a convergence step. Preserve the kernel's exact diagnostic instead
+      // of retrying until a generic stall obscures it.
+      if (!change.canStage && !change.canAccept) throw change;
       final step = '${change.expectedDomainKey}\u0000'
           '${change.expectedDomainHash}\u0000'
           '${change.status}\u0000'
@@ -300,10 +304,11 @@ Future<T> nmsInternalConvergeGeneratedModel<T>({
       }
       try {
         await handle(change);
-      } on DomainClientModelAdoptionRequired {
+      } on DomainClientModelAdoptionRequired catch (nextChange) {
         // A transient preflight/acceptance race re-enters the same typed step.
         // The per-step budget above prevents a genuine loop without limiting
         // how many distinct historical generations may converge.
+        if (!nextChange.canStage && !nextChange.canAccept) throw nextChange;
       }
     }
   }
@@ -379,35 +384,56 @@ class DomainNotInstalledForSession implements Exception {
 /// cause classified; returns normally when the session serves the client's law compatibly.
 extension NomosSessionCompat on NomosSession {
   Future<void> assertCompatible(NomosClientInterface iface) async {
-    // 1. REACHABILITY — the session's workspace must answer a read at all.
+    // The exact generated package identity is stronger than a structural comparison. The kernel's
+    // point-readable `law/current.usda` answers this bounded happy path without materialising the
+    // complete interface offer. Structural discovery is reserved for genuine version skew.
     List<String> activeKeys = const [];
+    List<String> activeHashes = const [];
     try {
-      final offer = await interfaceOffer();
-      if (offer != null) activeKeys = offer.keys.toList()..sort();
+      final law = await lawStatus(iface.expectedDomainHash);
+      activeHashes = ((law['current'] as List?) ?? const [])
+          .map((value) => value.toString())
+          .toList(growable: false);
+      if (activeHashes.contains(iface.expectedDomainHash)) return;
+      activeKeys = ((law['currentDomains'] as List?) ?? const [])
+          .map((value) => value.toString())
+          .toList(growable: false);
+      // Compatibility is member-scoped, not one enormous application-wide ceremony. Once the
+      // authenticated current-law index proves this domain is served, generated reads decode their
+      // exact USDA result types and generated offers are judged by the current kernel route. A new
+      // member therefore fails closed when used without blocking every older compatible feature.
+      if (activeKeys.contains(iface.domain)) return;
+    } catch (_) {
+      // Preserve the structural fallback for older kernels which do not expose the typed current
+      // frontier. Its error classification below remains the authoritative diagnostic path.
+    }
+
+    // 1. THE SHAPE AXIS (#72) — the one compatibility notion. The kernel compares the
+    // compact generated requirement directly with its authenticated current-law index. Do not
+    // export/materialise the complete interface merely to prove the successful path.
+    final requirement = iface.requirement;
+    if (requirement == null) return;
+    Map<String, Object?> verdict;
+    try {
+      final raw = await checkCompatibility(requirement);
+      verdict = (raw['verdict'] is Map)
+          ? (raw['verdict'] as Map).cast<String, Object?>()
+          : raw;
     } catch (e) {
-      // co2 blocker #2: a PROJECTION READ FAILURE (an unmountable/failing query shape — the runner surfaces
-      // `nomos.projection.read_failed` carrying the failed query) is NOT "not reachable" and MUST NOT be
-      // reclassified as trulyNotDeployed downstream — surface it as its own cause with the real fault text.
-      final isProjectionFault =
-          e.toString().contains('nomos.projection.read_failed') ||
-              e.toString().contains('projection read failed');
       throw DomainClientSessionMismatch(
         expectedDomainKey: iface.domain,
         expectedDomainHash: iface.expectedDomainHash,
         expectedInterfaceHash: iface.expectedInterfaceHash,
         sessionId: workspace,
         sessionWorkspace: workspace,
-        cause: isProjectionFault
-            ? SessionMismatchCause.projectionReadFailed
-            : null,
-        hint: isProjectionFault
-            ? 'the workspace law could NOT be READ — a projection/mount failure (NOT undeployed law): $e'
-            : 'the session workspace is not reachable/mounted on this plane: $e',
+        activeDomainKeys: activeKeys,
+        activeDomainHashes: activeHashes,
+        hint: 'the shape-compatibility check itself failed: $e',
       );
     }
+    if (verdict['ok'] == true) return;
 
-    // 2. HASH AXIS (diagnosis) — the installed law hashes, via the baked compat manifest when present.
-    List<String> activeHashes = const [];
+    // 2. HASH DIAGNOSIS — only a failed verdict needs retained installation inventory.
     if (iface.compatJson != null && iface.compatJson!.isNotEmpty) {
       try {
         final c = await checkCompat(
@@ -415,32 +441,34 @@ extension NomosSessionCompat on NomosSession {
             iface.requirement);
         if (c != null) activeHashes = c.workspaceRuns;
       } catch (_) {
-        /* diagnosis only — never fail the preflight on the hash axis */
+        /* diagnosis only — never replace the shape verdict */
       }
     }
 
-    // 3. THE SHAPE AXIS (#72) — the one compatibility notion. No baked interface ⇒ nothing more to check.
-    final requirement = iface.requirement;
-    if (requirement == null) return;
-    Map<String, Object?> verdict;
+    // 3. DIAGNOSTIC OFFER — only a failed verdict needs the complete active-domain names to
+    // distinguish a newer client from the wrong package or a genuinely absent deployment.
     try {
-      final raw = await checkCompatibility(requirement);
-      verdict = (raw['verdict'] is Map)
-          ? (raw['verdict'] as Map).cast<String, Object?>()
-          : raw;
+      final offer = await interfaceOffer();
+      if (offer != null) activeKeys = offer.keys.toList()..sort();
     } catch (e) {
+      final isProjectionFault =
+          e.toString().contains('nomos.projection.read_failed') ||
+              e.toString().contains('projection read failed');
       throw DomainClientSessionMismatch(
         expectedDomainKey: iface.domain,
         expectedDomainHash: iface.expectedDomainHash,
         expectedInterfaceHash: iface.expectedInterfaceHash,
         sessionId: workspace,
         sessionWorkspace: workspace,
-        activeDomainKeys: activeKeys,
         activeDomainHashes: activeHashes,
-        hint: 'the shape-compatibility check itself failed: $e',
+        cause: isProjectionFault
+            ? SessionMismatchCause.projectionReadFailed
+            : null,
+        hint: isProjectionFault
+            ? 'the workspace law could NOT be READ — a projection/mount failure (NOT undeployed law): $e'
+            : 'the session workspace is not reachable/mounted on this plane: $e',
       );
     }
-    if (verdict['ok'] == true) return;
 
     final missing =
         ((verdict['missing'] as List?) ?? const []).map((e) => '$e').toList();

package/dart/lib/src/test_harness.dart

@@ -43,7 +43,7 @@ import 'dart:io';
 import 'package:crypto/crypto.dart' show sha256;
 import 'package:fixnum/fixnum.dart' show Int64;
 import 'package:nomos_types/nomos_kernel_protocol.dart'
-    show BirthCertificate, BirthOutcomeStatus, SyncWorkspaceResponse;
+    show BirthCertificate, SyncWorkspaceResponse;
 import 'package:nomos_types/nomos_types.dart' show Sha256Digest;
 import 'package:package_config/package_config.dart' show loadPackageConfigUri;
 
@@ -494,6 +494,14 @@ class NomosTestHarness {
   /// `sha256(base64decode(...))` is the attestor keyHash a reader enrols to trust this source's signed reads.
   String? devicePublicKey(String workspace) => _devicePublics[workspace];
 
+  /// The enrolled device identity used by provider nonce binding. Tests which
+  /// rotate an external IdP can mint the next proof without handling key bytes.
+  String? deviceKeyHash(String workspace) {
+    final publicKey = _devicePublics[workspace];
+    if (publicKey == null || publicKey.isEmpty) return null;
+    return sha256.convert(base64Decode(publicKey)).toString();
+  }
+
   /// The base64 device SECRET a session was opened with (TEST HARNESS ONLY — the harness IS the device;
   /// a real app keeps this in secure storage). Sign writes to locally-born children with it, e.g.
   /// `bridge.acquireSession(childWs, authorSecret: harness.deviceSecret(home))`.
@@ -1480,6 +1488,7 @@ class NomosTestHarness {
   static Future<NomosTestHarness> cloudBound({
     required NomosTestCloud cloud,
     required List<String> lawUsdzPaths,
+    NmsApplicationFrameworkCalls? applicationFrameworkCalls,
     String platformWorkspace = 'test-platform',
     required String subject,
     String? authToken,
@@ -1500,6 +1509,13 @@ class NomosTestHarness {
         'no lawUsdzPaths — pass the build/<name>.law.usdz `npx githolon compile` emits',
       );
     }
+    final frameworkCalls = applicationFrameworkCalls;
+    if (frameworkCalls == null) {
+      throw NomosTestHarnessException(
+        'cloudBound requires this application\'s compiler-generated '
+        'NmsApplicationFrameworkCalls; raw framework directive transport is not supported',
+      );
+    }
     final entry = nodeEntry ??
         await _resolveEntry(node, resolveFrom ?? Directory.current.path);
     final bareUid =
@@ -1853,56 +1869,18 @@ class NomosTestHarness {
             'capturedClock': DateTime.now().toUtc().millisecondsSinceEpoch,
             'epoch': 0,
           }, secret);
-          // Mount the target workspace in the SAME kernel plane and author through its own
-          // installed law. The HTTP host is neither given raw business fields nor a signing key;
-          // sync carries the already-sealed offer and the receiving kernel replays the one gate.
-          // The enroll route was still resolved above to prove the generated public surface
-          // names this semantic route exactly once, but route strings grant no authority here.
-          final platformAuthorSession = '$clientId-platform-author';
-          await plane.connect(
-            cloud: cloud.origin,
-            workspace: platformWorkspace,
-            session: platformAuthorSession,
-            clientId: '$clientId-platform-author',
-            authToken: idpToken,
-            authorSecret: secret,
-          );
-          await plane.offerDirective(
-            domain: applicationHomeDomain,
-            directiveId: 'enrollFirstDevice',
-            domainHash: controlHomeLawHash,
-            actor: subject,
-            authorSecret: secret,
-            session: platformAuthorSession,
-            payload: {
-              'keyHash': keyHash,
-              'verifiedVia': issuer,
-              'validFromEpoch': 0,
-              'grantedAt': DateTime.now().toUtc().toIso8601String(),
-              'idpToken': idpToken,
-              // The framework law owns this USDA object shape. Keep the
-              // compiler-generated protobuf certificate structured while
-              // lowering it into that domain value; never resurrect the
-              // retired JSON string envelope (`delegationCert`).
-              'delegationCertificate':
-                  _birthCertificateLawValue(delegationCert),
-            },
-          );
-          await plane.sync(
-            session: platformAuthorSession,
-          );
           return (
             publicB64: publicB64,
             secret: secret,
             keyHash: keyHash,
             idpToken: idpToken,
+            issuer: issuer,
+            delegationCert: delegationCert,
           );
         },
       );
-      // 5/6 — THE HOME CEREMONY. Author the birth in the already-mounted PARENT kernel, then sync its sealed
-      //       intent to the remote parent where the same offer gate replays it. The HTTP host never receives
-      //       business fields or a signing secret and has no birth-authoring lane. The offer carries the
-      //       typed device-signed certificate. The kernel derives and enrolls the founding signer from it.
+      // 5/6 — THE PRODUCTION HOME CEREMONY. Platform remains remote: Runtime v2 prepares both generated
+      //       calls against its live frontier, signs with this device, and opens the resulting Home custody.
       String? home;
       await _phased(
         phase: '5/6: remote home-birth ceremony (attested)',
@@ -1912,65 +1890,49 @@ class NomosTestHarness {
         onDiagnostic: onDiagnostic,
         run: () async {
           final homeName = _receivingGroupNameOf(subject);
-          // The plane deliberately still has both the empty onboarding scratch holon and the
-          // authenticated platform holon mounted. Bind this parent certificate operation to the
-          // platform session explicitly; relying on the single-session convenience API becomes
-          // ambiguous as soon as the ceremony correctly opens the target workspace in-kernel.
-          final homeCert =
-              await plane.session('$clientId-platform-author').signBirthCert(
-                    BirthCertificate(
-                      child: homeName,
-                      founder: subject,
-                      // The cert's `verified` must MATCH the gate verdict (CAS-as-law): the offer carries
-                      // the dev-IdP token, so the gate resolves a VERIFIED founder.
-                      verified: true,
-                      parentKey: base64Decode(device.publicB64),
-                      parentId: platformWorkspace,
-                      epoch: Int64.ZERO,
-                    ),
-                    device.secret,
-                  );
-          final localBirth =
-              await plane.session('$clientId-platform-author').offerOutcome(
-                    domain: applicationHomeDomain,
-                    directiveId: 'nomosInternalBirthReceivingGroup7c1f5e',
-                    actor: subject,
-                    authorSecret: device.secret,
-                    payload: <String, Object?>{
-                      'owner': subject,
-                      'frameworkHash': frameworkHash,
-                      'lawHash': applicationHomeLawHash,
-                      'bornAt': DateTime.now().toUtc().toIso8601String(),
-                    },
-                    birthCertificate: homeCert,
-                  );
-          if (!localBirth.born.contains(homeName)) {
-            throw NomosTestHarnessException(
-              'cloudBound: the local parent kernel admitted the receiving-group offer but did not birth '
-              '"$homeName" (born=${localBirth.born}, birthOutcomes=${localBirth.birthOutcomes})',
-            );
-          }
-          final birthSync = await plane.sync(
-            session: '$clientId-platform-author',
-          );
-          if (birthSync.pushFailed ||
-              birthSync.diverged ||
-              birthSync.stillAhead) {
+          final bornAt = DateTime.now().toUtc().toIso8601String();
+          final result = await plane
+              .session('$clientId-onboard-scratch')
+              .nomosInternalBirthReceivingGroup(
+                parent: platformWorkspace,
+                principal: bareUid,
+                subject: subject,
+                device: {
+                  'public': device.publicB64,
+                  'secret': device.secret,
+                },
+                authToken: device.idpToken,
+                idToken: device.idpToken,
+                verifiedVia: device.issuer,
+                bornAt: bornAt,
+                enrollFirstDeviceCall: frameworkCalls.enrollFirstDevice(
+                  domain: applicationHomeDomain,
+                  workspace: platformWorkspace,
+                  keyHash: device.keyHash,
+                  verifiedVia: device.issuer,
+                  validFromEpoch: 0,
+                  grantedAt: bornAt,
+                  idpToken: device.idpToken,
+                  delegationCertificate: device.delegationCert,
+                ),
+                birthReceivingGroupCall: frameworkCalls.birthReceivingGroup(
+                  domain: applicationHomeDomain,
+                  workspace: platformWorkspace,
+                  owner: subject,
+                  frameworkHash: Sha256Digest(frameworkHash!),
+                  lawHash: Sha256Digest(applicationHomeLawHash),
+                  bornAt: bornAt,
+                ),
+                confirm: true,
+              );
+          if (result.home != homeName) {
             throw NomosTestHarnessException(
-              'cloudBound: the sealed receiving-group offer did not converge: $birthSync',
+              'cloudBound: production custody ceremony returned ${result.home} instead of "$homeName"',
             );
           }
-          final remoteOutcomes = birthSync.birthOutcomes;
-          final failedRemoteBirth = remoteOutcomes.where(
-            (entry) =>
-                entry.hasWorkspace() &&
-                entry.workspace == homeName &&
-                entry.status != BirthOutcomeStatus.BIRTH_OUTCOME_STATUS_BORN,
-          );
-          if (failedRemoteBirth.isNotEmpty) {
+          if (!result.verified) {
             throw NomosTestHarnessException(
-              'cloudBound: the remote parent replay refused the receiving-group birth: '
-              '${failedRemoteBirth.toList()}',
+              'cloudBound: born Home failed kernel verification: ${result.verificationError}',
             );
           }
           home = homeName;