@githolon/dsl 0.108.6 → 0.110.0

package/dart/lib/src/console_enrolment.dart

@@ -0,0 +1,271 @@
+/// Console enrolment, device side — the Dart twin of
+/// `peer-office/src/runtime/console_enrolment.ts` (identity_target_model.md
+/// D22/D23).
+///
+/// The person signs in with the tenant's provider (a Firebase ID token for
+/// CO2). The device proves it holds its Ed25519 key by signing
+/// [consoleEnrolRequestBytes], then POSTs the token, its public key, the proof
+/// and the workspaces it wants to the console's enroller. The console verifies
+/// the token once, off the ledger, and submits `enrollDevice { principal:
+/// <scope>:<subject>, keyHash }` into each workspace; from then on the device
+/// authors with its own key and no provider token ever reaches an intent.
+///
+/// The platform shell performs this as the Peer Office's console-enrolment
+/// effect: it holds both the device secret (its identity store) and the
+/// provider. Both byte formats are pinned by the golden vector
+/// `peer-office/test/fixtures/console_enrol_request_vector.json`.
+library;
+
+import 'dart:convert';
+import 'dart:typed_data';
+
+import 'package:crypto/crypto.dart' show sha256;
+import 'package:ed25519_edwards/ed25519_edwards.dart' as ed25519;
+import 'package:nomos_types/nomos_kernel_protocol.dart' as nomos_protocol;
+
+/// Where an enrolled principal's device key is enrolled: the application's
+/// console enroller, its tenant and the enrolled provider scope declared in
+/// law. Application configuration, never authority.
+final class NomosConsoleEnrolment {
+  const NomosConsoleEnrolment({
+    required this.console,
+    required this.tenant,
+    required this.scope,
+  });
+
+  /// The console's origin, e.g. `http://127.0.0.1:8797`.
+  final String console;
+
+  /// The console tenant, e.g. `co2-platform`.
+  final String tenant;
+
+  /// The enrolled provider scope, e.g. `co2`; principals are `<scope>:<subject>`.
+  final String scope;
+
+  nomos_protocol.ConsoleEnrolmentRoute toRoute() =>
+      nomos_protocol.ConsoleEnrolmentRoute(
+          console: console, tenant: tenant, scope: scope);
+
+  @override
+  bool operator ==(Object other) =>
+      other is NomosConsoleEnrolment &&
+      other.console == console &&
+      other.tenant == tenant &&
+      other.scope == scope;
+
+  @override
+  int get hashCode => Object.hash(console, tenant, scope);
+}
+
+/// `nomos-console-enrol-v1` followed by a NUL byte.
+final String consoleEnrolRequestTag =
+    'nomos-console-enrol-v1${String.fromCharCode(0)}';
+final String _nul = String.fromCharCode(0);
+
+/// The key hash the ledger names a device by: sha256 hex of its raw Ed25519 public key.
+String consoleDeviceKeyHash(List<int> publicKey) =>
+    sha256.convert(publicKey).toString();
+
+/// The bytes a device signs to ask for enrolment: tag, tenant, scope, its key
+/// hash, the requested workspaces (sorted, newline-separated) and the provider
+/// token's sha256, NUL-separated. Byte-identical to the console's
+/// `enrolRequestBytes`.
+Uint8List consoleEnrolRequestBytes({
+  required String tenant,
+  required String scope,
+  required String keyHash,
+  required Iterable<String> workspaces,
+  required String providerToken,
+}) {
+  final sorted = [...workspaces]..sort();
+  final head = utf8.encode('$consoleEnrolRequestTag$tenant$_nul$scope$_nul'
+      '$keyHash$_nul${sorted.join('\n')}$_nul');
+  final digest = sha256.convert(utf8.encode(providerToken)).bytes;
+  return Uint8List.fromList([...head, ...digest]);
+}
+
+/// Unpadded base64url, the console's wire form for keys and signatures.
+String consoleBase64Url(List<int> bytes) =>
+    base64Url.encode(bytes).replaceAll('=', '');
+
+/// An Ed25519 device key held by the shell. The secret never leaves [sign].
+final class NomosConsoleEnrolmentDevice {
+  NomosConsoleEnrolmentDevice._(this._key);
+
+  /// The 32-byte RFC 8032 seed the kernel mints and the identity store keeps.
+  factory NomosConsoleEnrolmentDevice.fromSeed(List<int> seed) {
+    if (seed.length != ed25519.SeedSize) {
+      throw ArgumentError('a device secret is a 32-byte Ed25519 seed');
+    }
+    return NomosConsoleEnrolmentDevice._(
+        ed25519.newKeyFromSeed(Uint8List.fromList(seed)));
+  }
+
+  final ed25519.PrivateKey _key;
+
+  Uint8List get publicKey => Uint8List.fromList(ed25519.public(_key).bytes);
+
+  Uint8List sign(List<int> message) =>
+      ed25519.sign(_key, Uint8List.fromList(message));
+}
+
+/// The path and JSON body of one enrolment request, carrying the device's possession proof.
+final class NomosConsoleEnrolmentRequest {
+  const NomosConsoleEnrolmentRequest({required this.path, required this.body});
+
+  final String path;
+  final Map<String, Object> body;
+}
+
+NomosConsoleEnrolmentRequest consoleEnrolmentRequest({
+  required String tenant,
+  required String scope,
+  required String providerToken,
+  required NomosConsoleEnrolmentDevice device,
+  required Iterable<String> workspaces,
+}) {
+  final publicKey = device.publicKey;
+  if (publicKey.length != 32) {
+    throw ArgumentError('the device public key must be a 32-byte Ed25519 key');
+  }
+  if (providerToken.isEmpty) {
+    throw ArgumentError('a provider token is required to enrol a device');
+  }
+  final unique = <String>{...workspaces}.toList();
+  if (unique.isEmpty) throw ArgumentError('enrol into at least one workspace');
+  final keyHash = consoleDeviceKeyHash(publicKey);
+  final signature = device.sign(consoleEnrolRequestBytes(
+    tenant: tenant,
+    scope: scope,
+    keyHash: keyHash,
+    workspaces: unique,
+    providerToken: providerToken,
+  ));
+  return NomosConsoleEnrolmentRequest(
+    path: '/v1/tenants/${Uri.encodeComponent(tenant)}'
+        '/providers/${Uri.encodeComponent(scope)}/enrolments',
+    body: {
+      'providerToken': providerToken,
+      'devicePublicKey': consoleBase64Url(publicKey),
+      'deviceSignature': consoleBase64Url(signature),
+      'workspaces': unique,
+    },
+  );
+}
+
+/// The console's record of an enrolled device (console.ts `DeviceRecord`).
+final class NomosConsoleEnrolledDevice {
+  const NomosConsoleEnrolledDevice({
+    required this.keyHash,
+    required this.principal,
+    required this.workspaces,
+    this.refused = const {},
+  });
+
+  final String keyHash;
+  final String principal;
+
+  /// Workspace → the head its `enrollDevice` was admitted at. Includes the
+  /// console's fan-out: every workspace the person belongs to (their Home and
+  /// everything born below it), not only those requested.
+  final Map<String, String> workspaces;
+
+  /// Workspace → why the console's fan-out into it was refused.
+  final Map<String, String> refused;
+}
+
+/// The console answered, but not with an enrolment.
+final class NomosConsoleEnrolmentRefused implements Exception {
+  const NomosConsoleEnrolmentRefused(this.status, this.message,
+      {this.code = '', this.retryable});
+
+  final int status;
+  final String message;
+
+  /// The console's stable refusal code (empty from an older console).
+  final String code;
+
+  /// The console's own retry verdict; null when it gave none.
+  final bool? retryable;
+
+  @override
+  String toString() => 'console enrolment refused (HTTP $status): $message';
+}
+
+/// One console exchange: status and raw body.
+final class NomosConsoleResponse {
+  const NomosConsoleResponse({required this.status, required this.body});
+
+  final int status;
+  final String body;
+}
+
+/// Minimal POST shape, so a shell can inject its own transport.
+typedef NomosConsolePost = Future<NomosConsoleResponse> Function(
+    Uri url, String body);
+
+/// Enrol [device] for the person [providerToken] names into [workspaces],
+/// through the console at [console].
+Future<NomosConsoleEnrolledDevice> enrolWithConsole({
+  required String console,
+  required String tenant,
+  required String scope,
+  required String providerToken,
+  required NomosConsoleEnrolmentDevice device,
+  required Iterable<String> workspaces,
+  required NomosConsolePost post,
+}) async {
+  final request = consoleEnrolmentRequest(
+    tenant: tenant,
+    scope: scope,
+    providerToken: providerToken,
+    device: device,
+    workspaces: workspaces,
+  );
+  final base = console.replaceFirst(RegExp(r'/+$'), '');
+  final response =
+      await post(Uri.parse('$base${request.path}'), jsonEncode(request.body));
+  Object? answer;
+  try {
+    answer = jsonDecode(response.body);
+  } catch (_) {
+    answer = null;
+  }
+  final record =
+      answer is Map<String, Object?> ? answer : const <String, Object?>{};
+  if (response.status != 201) {
+    final error = record['error'];
+    final code = record['code'];
+    final retryable = record['retryable'];
+    throw NomosConsoleEnrolmentRefused(
+        response.status,
+        error is String
+            ? error
+            : 'the console answered HTTP ${response.status}',
+        code: code is String ? code : '',
+        retryable: retryable is bool ? retryable : null);
+  }
+  final keyHash = record['keyHash'];
+  final principal = record['principal'];
+  final heads = record['workspaces'];
+  if (keyHash is! String || principal is! String || heads is! Map) {
+    throw NomosConsoleEnrolmentRefused(
+        response.status, 'the console answered 201 without a device record');
+  }
+  final refused = record['refused'];
+  return NomosConsoleEnrolledDevice(
+    keyHash: keyHash,
+    principal: principal,
+    workspaces: {
+      for (final entry in heads.entries)
+        if (entry.key is String && entry.value is String)
+          entry.key as String: entry.value as String,
+    },
+    refused: {
+      if (refused is Map)
+        for (final entry in refused.entries)
+          if (entry.key is String && entry.value is String)
+            entry.key as String: entry.value as String,
+    },
+  );
+}

package/dart/lib/src/console_http_io.dart

@@ -0,0 +1,26 @@
+import 'dart:convert';
+import 'dart:io';
+
+import 'console_enrolment.dart' show NomosConsoleResponse;
+
+/// The native shells' console transport: one JSON POST, the answer's status
+/// and body. No retry and no interpretation: Peer Office owns both.
+Future<NomosConsoleResponse> nomosDefaultConsolePost(
+    Uri url, String body) async {
+  final client = HttpClient()..connectionTimeout = const Duration(seconds: 30);
+  try {
+    final request = await client.postUrl(url);
+    request.headers
+      ..contentType = ContentType.json
+      ..set(HttpHeaders.acceptHeader, 'application/json');
+    request.add(utf8.encode(body));
+    final response = await request.close().timeout(const Duration(seconds: 60));
+    final text = await response
+        .transform(utf8.decoder)
+        .join()
+        .timeout(const Duration(seconds: 60));
+    return NomosConsoleResponse(status: response.statusCode, body: text);
+  } finally {
+    client.close(force: true);
+  }
+}

package/dart/lib/src/console_http_stub.dart

@@ -0,0 +1,7 @@
+import 'console_enrolment.dart' show NomosConsoleResponse;
+
+/// A platform without `dart:io` has no default console transport; its shell
+/// registers one (`registerConsolePost`) or the enrolment effect is refused.
+Future<NomosConsoleResponse> nomosDefaultConsolePost(Uri url, String body) =>
+    Future.error(UnsupportedError(
+        'this platform has no default console transport; register one'));

package/dart/lib/src/dev_cloud.dart

@@ -1,16 +1,16 @@
-// NOMOS TEST CLOUD (co2 #4) — a headless, real-sync test cloud for AppSim: start/stop a local
-// `githolon cloud dev` (the SAME engine plane production runs), front it with a PARTITION PROXY so a test can
+// NOMOS TEST CLOUD (co2 #4) — an unattended, real-sync test cloud for AppSim: start/stop a local
+// `githolon cloud dev` (the SAME kernel host production runs), front it with a PARTITION PROXY so a test can
 // go online/offline deterministically, and inspect the remote head/sequence — all sharing the production
-// bridge/session clients (the sessions connect to [origin] exactly like they connect to the real cloud).
+// Reception/session clients (the sessions connect to [origin] exactly like they connect to the real cloud).
 //
 // ```dart
 // final cloud = await NomosTestCloud.start(serverEntry: devServerPath);   // spawns the dev cloud + proxy
 // final harness = await NomosTestHarness.cloudBound(cloud: cloud, lawUsdzPaths: [...], platformWorkspace: 'co2-platform', subject: 'user:test');
 // // ... author offline ...
 // cloud.setOnline(false);              // PARTITION — the up leg can't reach custody
-// await harness.session('estate').sync(admit: true);   // stays local; nothing lands remotely
+// await harness.converge(workspaces: ['estate']);      // stays local; nothing lands remotely
 // cloud.setOnline(true);               // heal the partition
-// await harness.session('estate').sync(admit: true);   // converges; the write lands on remote main
+// await harness.converge(workspaces: ['estate']);      // converges; the write lands on remote main
 // final remote = await cloud.remoteHead('estate');      // inspect remote head + commit count
 // await cloud.stop();
 // ```
@@ -68,7 +68,14 @@ class NomosTestCloud {
   final Uri _upstream; // the real dev-cloud origin the proxy forwards to
   final HttpClient _client;
   final void Function(String line)? _onDiagnostic;
-  final String? testKRootPublic;
+
+  /// Base64 of this universe's pinned ed25519 trust root, when the shell has one.
+  /// Every peer in this ephemeral trust universe pins the same anchor before it
+  /// replays or births anything; production bakes its own into the kernel.
+  final String? trustRootPublicKey;
+
+  /// The retired name for [trustRootPublicKey]; kept for one release.
+  String? get testKRootPublic => trustRootPublicKey;
   bool _online = true;
   bool _stopped = false;
 
@@ -78,10 +85,11 @@ class NomosTestCloud {
     this._upstream,
     this._client,
     this._onDiagnostic,
-    this.testKRootPublic,
+    this.trustRootPublicKey,
   );
 
-  /// The base URL a cloud-BOUND session connects to (`connect(cloud: cloud.origin)`). Points at the PARTITION
+  /// The base URL of this development cloud. Placement, not an interaction
+  /// session, determines whether a workspace follows it.
   /// PROXY, so [setOnline] deterministically severs/heals the whole plane's link to custody.
   String get origin => 'http://${_proxy.address.host}:${_proxy.port}';
 
@@ -151,11 +159,12 @@ class NomosTestCloud {
       );
     }
     final decoded = jsonDecode(text);
-    if (decoded case {
-      'token': final String token,
-      'issuer': final String issuer,
-      'audience': final String audience,
-    } when token.isNotEmpty && issuer.isNotEmpty && audience.isNotEmpty) {
+    if (decoded
+        case {
+          'token': final String token,
+          'issuer': final String issuer,
+          'audience': final String audience,
+        } when token.isNotEmpty && issuer.isNotEmpty && audience.isNotEmpty) {
       return DevIdentityToken(
         token: token,
         issuer: issuer,
@@ -169,7 +178,7 @@ class NomosTestCloud {
 
   /// Start the test cloud: spawn `node <serverEntry> --port <n> [--ephemeral] [--data <dir>]`, wait until its
   /// `/health` answers, then bring up the partition proxy in front of it. [serverEntry] is the dev-server
-  /// entry (`cloud/dev-server/server.ts` in-repo, or `dist/dev-server.mjs` from a published `githolon`) — the
+  /// entry (`platform-shells/node/local-development/server.ts` in-repo, or `dist/dev-server.mjs` from a published `githolon`) — the
   /// caller resolves it (the same seam the offline harness uses for its install helper). [node] defaults to
   /// `node` on PATH.
   static Future<NomosTestCloud> start({
@@ -194,16 +203,50 @@ class NomosTestCloud {
     /// not made current on the parent merely to make it available to a child.
     List<String> lawUsdzPaths = const [],
     int? applicationMaxChildWorkspacesPerUser,
-    Duration readyTimeout = const Duration(seconds: 30),
+
+    /// The runtime bundle the shell runs (`holon.wasm`, `kernel.repository.xml`,
+    /// `bootstrap.law.usdz`, `nomos.law.usdz`). Defaults to the candidate/offline
+    /// runtime this process was pointed at.
+    String? runtimeDirectory,
+
+    /// Mint this universe's ed25519 trust root at boot and pin its public half.
+    /// A platform can only be born under a root warranted to a trust root.
+    bool? mintTrustRoot,
+
+    /// Serve this universe's ES256 identity provider (JWKS + the operator mint
+    /// door the warranted first-device enrolment onboards through).
+    bool? testIdentityProvider,
+    Duration readyTimeout = const Duration(seconds: 90),
     void Function(String line)? onDiagnostic,
   }) async {
     final chosenPort = port == 0 ? await _freePort() : port;
+    // A platform birth needs this universe's trust root SECRET to sign root's warrant and the
+    // platform's birth certificate, and onboarding needs an identity provider: when a platform is
+    // requested the shell mints both unless told otherwise.
+    final mintsTrustRoot = mintTrustRoot ?? (platform != null);
+    final servesIdentityProvider = testIdentityProvider ?? (platform != null);
+    final runtime = runtimeDirectory ??
+        Platform.environment['NOMOS_CANDIDATE_RUNTIME'] ??
+        Platform.environment['NOMOS_OFFLINE_RUNTIME'];
+    // The partition proxy is the cloud's public origin: the peer is booted with it as its provider, so
+    // the cloud must advertise it (discovery, placement, leases) exactly as production advertises the
+    // origin a request arrives at. A peer never talks to an origin it was not booted with.
+    final proxy = await HttpServer.bind(InternetAddress.loopbackIPv4, 0);
     final args = <String>[
       serverEntry,
       '--port',
       '$chosenPort',
-      if (ephemeral) '--ephemeral',
-      if (dataDir != null) ...['--data', dataDir],
+      '--public-origin',
+      'http://${proxy.address.host}:${proxy.port}',
+      // NOMOS_TEST_CLOUD_DATA keeps the custodian's Git custody on disk after the run (inspection with
+      // git of what the custodian admitted and birthed), instead of the deleted temporary directory.
+      if (ephemeral && Platform.environment['NOMOS_TEST_CLOUD_DATA'] == null)
+        '--ephemeral',
+      if (dataDir ?? Platform.environment['NOMOS_TEST_CLOUD_DATA']
+          case final data?) ...['--data', data],
+      if (runtime != null) ...['--runtime', runtime],
+      if (mintsTrustRoot) '--mint-trust-root',
+      if (servesIdentityProvider) '--test-identity-provider',
       if (platform != null) ...['--platform', platform],
       if (applicationMaxChildWorkspacesPerUser != null) ...[
         '--application-max-child-workspaces-per-user',
@@ -224,6 +267,7 @@ class NomosTestCloud {
       if (serverTail.length > 24) serverTail.removeAt(0);
       log('$stream: $line');
     }
+
     proc.stdout
         .transform(utf8.decoder)
         .transform(const LineSplitter())
@@ -242,7 +286,7 @@ class NomosTestCloud {
     // half-born platform's typed refusals.
     final deadline = DateTime.now().add(readyTimeout);
     var ready = false;
-    String? testKRootPublic;
+    String? trustRootPublicKey;
     while (DateTime.now().isBefore(deadline)) {
       if (prematureExitCode != null) break;
       try {
@@ -253,7 +297,9 @@ class NomosTestCloud {
           final health = jsonDecode(body) as Map<String, dynamic>;
           final platformReady = health['platformReady'];
           if (platform == null || platformReady == true) {
-            testKRootPublic = health['testKRootPublic']?.toString();
+            trustRootPublicKey =
+                (health['trustRootPublicKey'] ?? health['testKRootPublic'])
+                    ?.toString();
             ready = true;
             break;
           }
@@ -265,8 +311,10 @@ class NomosTestCloud {
     }
     if (!ready) {
       if (prematureExitCode == null) proc.kill(ProcessSignal.sigkill);
+      await proxy.close(force: true);
       final exited = prematureExitCode;
-      final tail = serverTail.isEmpty ? '' : '\nserver tail:\n${serverTail.join('\n')}';
+      final tail =
+          serverTail.isEmpty ? '' : '\nserver tail:\n${serverTail.join('\n')}';
       throw NomosTestCloudException(
         exited == null
             ? 'the dev cloud did not answer /health${platform != null ? ' with platformReady:true' : ''} within ${readyTimeout.inSeconds}s (serverEntry: $serverEntry)$tail'
@@ -278,14 +326,13 @@ class NomosTestCloud {
     );
 
     // The partition proxy — forwards to the dev cloud when ONLINE, fails fast when OFFLINE.
-    final proxy = await HttpServer.bind(InternetAddress.loopbackIPv4, 0);
     final cloud = NomosTestCloud._(
       proc,
       proxy,
       upstream,
       client,
       onDiagnostic,
-      testKRootPublic,
+      trustRootPublicKey,
     );
     proxy.listen(cloud._handleProxy);
     log('partition proxy at ${cloud.origin} → $upstream');

package/dart/lib/src/generated_call.dart

@@ -5,27 +5,40 @@ import 'package:meta/meta.dart' show internal;
 /// One compiler-authored, nominal domain call.
 ///
 /// Generated applications construct this directly from their typed input. The
-/// host may carry it but cannot reinterpret its value; the kernel reopens the
-/// canonical USDA and verifies that [domain] and [directive] resolve to the
-/// exact identities embedded in [canonicalUsda].
+/// host may carry it but cannot reinterpret its value; the kernel derives the
+/// exact Protobuf descriptor from installed law and authors canonical USDA.
 @internal
 abstract interface class NmsGeneratedCall {
   String get domain;
   String get directive;
-  Uint8List get canonicalUsda;
+  String get protobufType;
+  Uint8List get protobufPayload;
 }
 
 /// One compiler-authored nominal application query.
 ///
 /// The public application method retains its generated Dart parameter types. This value is the
-/// cross-language continuation of those types: canonical USDA relates the query and every
-/// argument to the exact composed-law identities. Protobuf carries these bytes but does not
-/// replace the application's type system with a generic object.
+/// cross-language continuation of those types. Its operation-specific Protobuf
+/// message is generated from the same law graph as the public Dart method and
+/// the kernel's installed descriptor.
 @internal
 abstract interface class NmsGeneratedQuery {
   String get domain;
   String get query;
-  Uint8List get canonicalArgumentsUsda;
+  String get protobufType;
+  Uint8List get protobufPayload;
+}
+
+/// One compiler-authored nominal application result.
+///
+/// The peer office transports the kernel's query-specific Protobuf `Any`
+/// without interpreting it. Generated application code checks [protobufType]
+/// and decodes [protobufPayload] with the operation bindings emitted from the
+/// same composed law graph as its public Dart API.
+@internal
+abstract interface class NmsGeneratedResult {
+  String get protobufType;
+  Uint8List get protobufPayload;
 }
 
 /// Constructor namespace reserved for generated application code.
@@ -33,21 +46,24 @@ abstract interface class NmsGeneratedQuery {
 /// Keeping the three transport facts in one immutable value prevents generated
 /// code from accidentally pairing bytes from one directive with routing hints
 /// from another. Untrusted callers gain no authority by constructing one: the
-/// kernel independently validates the USDA against admitted law.
+/// kernel independently validates the operation Protobuf against admitted law.
 @internal
 abstract final class NmsInternalGeneratedCalls {
   static NmsGeneratedCall create({
     required String domain,
     required String directive,
-    required Uint8List canonicalUsda,
+    required String protobufType,
+    required Uint8List protobufPayload,
   }) {
     if (domain.isEmpty || directive.isEmpty) {
-      throw ArgumentError('A generated Nomos call needs nominal routing identity.');
+      throw ArgumentError(
+          'A generated Nomos call needs nominal routing identity.');
     }
-    if (canonicalUsda.isEmpty) {
-      throw ArgumentError('A generated Nomos call needs canonical USDA.');
+    if (!protobufType.startsWith('type.nomos.dev/')) {
+      throw ArgumentError(
+          'A generated Nomos call needs one exact typed Protobuf payload.');
     }
-    return _GeneratedCall(domain, directive, canonicalUsda);
+    return _GeneratedCall(domain, directive, protobufType, protobufPayload);
   }
 }
 
@@ -57,20 +73,47 @@ abstract final class NmsInternalGeneratedQueries {
   static NmsGeneratedQuery create({
     required String domain,
     required String query,
-    required Uint8List canonicalArgumentsUsda,
+    required String protobufType,
+    required Uint8List protobufPayload,
   }) {
     if (domain.isEmpty || query.isEmpty) {
-      throw ArgumentError('A generated Nomos query needs nominal routing identity.');
+      throw ArgumentError(
+          'A generated Nomos query needs nominal routing identity.');
+    }
+    // No-argument reads (first/take) canonically encode as zero bytes. The
+    // nominal type identifies the message; installed law validates its fields.
+    // Payload length cannot distinguish a valid empty message from missing input.
+    if (!protobufType.startsWith('type.nomos.dev/')) {
+      throw ArgumentError(
+          'A generated Nomos query needs one exact typed Protobuf payload.');
     }
-    if (canonicalArgumentsUsda.isEmpty) {
-      throw ArgumentError('A generated Nomos query needs canonical USDA arguments.');
+    return _GeneratedQuery(domain, query, protobufType, protobufPayload);
+  }
+}
+
+/// Constructor namespace reserved for the shared peer office.
+@internal
+abstract final class NmsInternalGeneratedResults {
+  static NmsGeneratedResult create({
+    required String protobufType,
+    required Uint8List protobufPayload,
+  }) {
+    // A valid Protobuf message containing only default values has the canonical
+    // wire representation of zero bytes.  In particular, a generated query
+    // whose repeated result is empty must still cross this boundary as its
+    // exact nominal result type.  The type URL supplies that identity; payload
+    // length is not a type or validity signal.
+    if (!protobufType.startsWith('type.nomos.dev/')) {
+      throw ArgumentError(
+          'A generated Nomos result needs one exact typed Protobuf payload.');
     }
-    return _GeneratedQuery(domain, query, canonicalArgumentsUsda);
+    return _GeneratedResult(protobufType, protobufPayload);
   }
 }
 
 final class _GeneratedCall implements NmsGeneratedCall {
-  const _GeneratedCall(this.domain, this.directive, this.canonicalUsda);
+  const _GeneratedCall(
+      this.domain, this.directive, this.protobufType, this.protobufPayload);
 
   @override
   final String domain;
@@ -79,11 +122,15 @@ final class _GeneratedCall implements NmsGeneratedCall {
   final String directive;
 
   @override
-  final Uint8List canonicalUsda;
+  final String protobufType;
+
+  @override
+  final Uint8List protobufPayload;
 }
 
 final class _GeneratedQuery implements NmsGeneratedQuery {
-  const _GeneratedQuery(this.domain, this.query, this.canonicalArgumentsUsda);
+  const _GeneratedQuery(
+      this.domain, this.query, this.protobufType, this.protobufPayload);
 
   @override
   final String domain;
@@ -92,5 +139,18 @@ final class _GeneratedQuery implements NmsGeneratedQuery {
   final String query;
 
   @override
-  final Uint8List canonicalArgumentsUsda;
+  final String protobufType;
+
+  @override
+  final Uint8List protobufPayload;
+}
+
+final class _GeneratedResult implements NmsGeneratedResult {
+  const _GeneratedResult(this.protobufType, this.protobufPayload);
+
+  @override
+  final String protobufType;
+
+  @override
+  final Uint8List protobufPayload;
 }