@githolon/dsl 0.108.7 → 0.110.0

package/dart/test/kernel_author_after_read_test.dart

@@ -0,0 +1,242 @@
+// Kernel Office seam test — the author lane must resolve a directive that the
+// workspace's ACTIVE law declares, even when the kernel first met that law
+// through a cold read.
+//
+// Production failure (2026-09-03): after a cold read of `co2-platform`, the
+// container kernel refused `co2_platform/enrollPlatformFirstDevice` with
+// "directive 'enrollPlatformFirstDevice' is absent from authenticated law"
+// although the active law package in custody declares it. A cold read leaves a
+// population-masked read stage in the package cache; the author lane's
+// classifiers resolved the label against that stage.
+//
+// This test drives the REAL kernel through the physical testing shell over the
+// golden `co2-platform` custody: open it cold, read its law surface, then author
+// the enrolment directive. The offer is expected to be refused (there is no
+// authenticated principal here) but never with the false negative above.
+//
+// Inputs (environment): NOMOS_CANDIDATE_RUNTIME, NOMOS_FENCE_CUSTODY — see
+// git-holon/fence/run.sh. Skipped when the golden custody is not present.
+import 'dart:io';
+import 'dart:isolate';
+import 'dart:math';
+
+import 'package:fixnum/fixnum.dart';
+
+import 'package:nomos_client/src/testing/test_peer.dart';
+import 'package:nomos_types/nomos_kernel_protocol.dart' as nomos_protocol;
+import 'package:nomos_types/src/proto/google/protobuf/any.pb.dart'
+    as google_protobuf;
+import 'package:test/test.dart';
+
+const _workspace = 'co2-platform';
+// The application Home that shares the production kernel with the platform and
+// runs an OLDER CO2 law package than the platform's active one.
+const _home = 'nomos-rg-2f87efc35eb3c549a50ef80afe46902cdda4e364';
+const _domain = 'co2_platform';
+const _directive = 'enrollPlatformFirstDevice';
+const _falseNegative = 'is absent from authenticated law';
+
+Future<String> _testEntry() async {
+  final resolved = await Isolate.resolvePackageUri(
+    Uri.parse('package:nomos_client/src/runner/node-entry.mjs'),
+  );
+  if (resolved == null || resolved.scheme != 'file') {
+    throw StateError('cannot resolve the node testing shell entry');
+  }
+  return resolved.toFilePath();
+}
+
+void main() {
+  final custodyRoot = Platform.environment['NOMOS_FENCE_CUSTODY'];
+  final runtime = Platform.environment['NOMOS_CANDIDATE_RUNTIME'];
+
+  test(
+    'author resolves an active-law directive after a cold read of the same workspace',
+    () async {
+      if (custodyRoot == null ||
+          !Directory('$custodyRoot/holon-$_workspace.git').existsSync()) {
+        markTestSkipped('golden custody not present (NOMOS_FENCE_CUSTODY)');
+        return;
+      }
+      if (runtime == null || !File('$runtime/holon.wasm').existsSync()) {
+        fail('NOMOS_CANDIDATE_RUNTIME must point at a staged runtime');
+      }
+      final peer = await NmsTestPeer.start(
+        entry: await _testEntry(),
+        runtimeDirectory: runtime,
+        resolveFrom: Directory.current.path,
+        onDiagnostic: (line) => stderr.writeln('[shell] $line'),
+      );
+      addTearDown(peer.dispose);
+
+      final custodyDir = Directory('${peer.custody.directory.path}/custody');
+      await custodyDir.create(recursive: true);
+      for (final ws in [_workspace, _home]) {
+        if (!Directory('$custodyRoot/holon-$ws.git').existsSync()) {
+          markTestSkipped('golden custody for $ws not present');
+          return;
+        }
+        final copy = await Process.run('cp', [
+          '-R',
+          '$custodyRoot/holon-$ws.git',
+          '${custodyDir.path}/holon-$ws.git',
+        ]);
+        if (copy.exitCode != 0) fail('copy custody: ${copy.stderr}');
+      }
+
+      // 1. Cold open.
+      await peer.reception.bindSession(
+        workspace: _workspace,
+        session: _workspace,
+      );
+
+      var sequence = 0;
+      Future<nomos_protocol.CallResponse> describe(String session) =>
+          peer.transport.callKernel(
+            session: session,
+            request: nomos_protocol.CallRequest(
+              protocolVersion: 1,
+              requestId: '$session:seam:${++sequence}',
+              query: nomos_protocol.QueryRequest(
+                authority: nomos_protocol.QueryAuthority(
+                  principalClaim: 'user:kernel-seam',
+                  nowUnix: Int64(DateTime.now().millisecondsSinceEpoch ~/ 1000),
+                ),
+                named: nomos_protocol.NamedQuery(
+                  operation:
+                      nomos_protocol.QueryOperation.QUERY_OPERATION_DESCRIBE,
+                ),
+              ),
+            ),
+            credentialUse: nomos_protocol.CredentialUse.CREDENTIAL_USE_NONE,
+          );
+      final random = Random.secure();
+      Future<String> authorCall(String session, String domain, String directive,
+          String typeUrl) async {
+        final nomos_protocol.CallResponse offered;
+        try {
+          offered = await peer.transport.callKernel(
+            session: session,
+            request: nomos_protocol.CallRequest(
+              protocolVersion: 1,
+              requestId: '$_workspace:seam:${++sequence}',
+              offer: nomos_protocol.OfferRequest(
+                call: nomos_protocol.DirectiveCall(
+                  domain: domain,
+                  directive: directive,
+                  operation: google_protobuf.Any(
+                    typeUrl: typeUrl,
+                    value: const <int>[],
+                  ),
+                ),
+                authoring: nomos_protocol.AuthoringOptions(
+                  actor: 'user:kernel-seam',
+                  rng: List<double>.generate(64, (_) => random.nextDouble()),
+                  deferProjection: true,
+                  spans: true,
+                  sequence: Int64(sequence),
+                  clock: nomos_protocol.CapturedClock(
+                    physicalMillis:
+                        Int64(DateTime.now().toUtc().millisecondsSinceEpoch),
+                    logical: 0,
+                    replica: Int64(7),
+                  ),
+                ),
+              ),
+            ),
+            credentialUse: nomos_protocol.CredentialUse.CREDENTIAL_USE_NONE,
+          );
+        } on StateError catch (error) {
+          // The transport surfaces kernel refusals as StateError; the refusal text is the outcome.
+          return 'refused: ${error.message}';
+        }
+        return offered.hasFailure()
+            ? 'failure ${offered.failure.code}: ${offered.failure.message}'
+            : offered.hasOffer() && offered.offer.hasRefused()
+                ? 'refused: ${offered.offer.refused}'
+                : 'outcome: ${offered.whichOutcome().name}';
+      }
+
+      // 2. A read first: the law surface, exactly what a describe/OpenAPI call asks for.
+      final described = await describe(_workspace);
+      expect(described.hasFailure(), isFalse,
+          reason: 'describe failed: ${described.failure.message}');
+
+      // 3. Author the enrolment directive on the cold-read platform. No principal is
+      //    proven here, so the offer is refused downstream; the classifiers must still
+      //    have found the directive in the ACTIVE law.
+      final first = await authorCall(_workspace, _domain, _directive,
+          'type.nomos.dev/nomos.operation.v1.Payload_350c19c4a90e0210');
+      stdout.writeln('seam: author after cold read → $first');
+      expect(first, isNot(contains(_falseNegative)));
+
+      // 4. The Home workspace (older CO2 law package) shares the kernel: open it and
+      //    read it, as its sync does in production between platform offers.
+      await peer.reception.bindSession(
+        workspace: _home,
+        session: _home,
+      );
+      final homeDescribed = await describe(_home);
+      expect(homeDescribed.hasFailure(), isFalse,
+          reason: 'home describe failed: ${homeDescribed.failure.message}');
+      // Home's sync also verifies its chain, which replays under Home's own law.
+      final homeVerdict = await peer.reception.session(_home).verifyChain();
+      stdout.writeln('seam: home verify → valid=${homeVerdict.valid}');
+      // Home authors too (its own domain, under its own older law package).
+      final homeAuthored = await authorCall(_home, 'home', 'enrollFirstDevice',
+          'type.nomos.dev/nomos.operation.v1.Payload_cbec744b661de8bc');
+      stdout.writeln('seam: home author → $homeAuthored');
+
+      // 5. Author on the platform again. The route was prepared in step 3; the Home
+      //    work in step 4 must not turn the platform's active law into negative evidence.
+      final second = await authorCall(_workspace, _domain, _directive,
+          'type.nomos.dev/nomos.operation.v1.Payload_350c19c4a90e0210');
+      stdout.writeln('seam: author after Home interleaving → $second');
+      expect(
+        second,
+        isNot(contains(_falseNegative)),
+        reason:
+            'the active law declares $_domain/$_directive; work on another workspace must not make it vanish',
+      );
+
+      // 6. The kernel process restarts on the same custody (a rolled container) and
+      //    restores its law view from the persisted parsed caches before the first
+      //    read; then the platform is read and authored again.
+      final founder = await peer.mintFoundingDevice();
+      await peer.reboot(trustRootPublicKey: founder.publicKey);
+      // Home first, as in production: its sync reads and authors under its own
+      // older law package before the platform is touched at all.
+      await peer.reception.bindSession(
+        workspace: _home,
+        session: _home,
+      );
+      final homeDescribedAfterRestart = await describe(_home);
+      expect(homeDescribedAfterRestart.hasFailure(), isFalse);
+      final homeAuthoredAfterRestart = await authorCall(
+          _home,
+          'home',
+          'enrollFirstDevice',
+          'type.nomos.dev/nomos.operation.v1.Payload_cbec744b661de8bc');
+      stdout.writeln(
+          'seam: home author after restart → $homeAuthoredAfterRestart');
+      await peer.reception.bindSession(
+        workspace: _workspace,
+        session: _workspace,
+      );
+      final restoredDescribe = await describe(_workspace);
+      expect(restoredDescribe.hasFailure(), isFalse,
+          reason:
+              'describe after restart failed: ${restoredDescribe.failure.message}');
+      final third = await authorCall(_workspace, _domain, _directive,
+          'type.nomos.dev/nomos.operation.v1.Payload_350c19c4a90e0210');
+      stdout.writeln('seam: author after restart + cold read → $third');
+      expect(
+        third,
+        isNot(contains(_falseNegative)),
+        reason:
+            'a restart restores the law view from cache; the author lane must still see the active law',
+      );
+    },
+    timeout: const Timeout(Duration(minutes: 10)),
+  );
+}

package/dart/test/kernel_fence_test.dart

@@ -0,0 +1,137 @@
+// Kernel Office fence — golden custody replayed by the CURRENT kernel through
+// the physical testing shell.
+//
+// The fence proves that a kernel rebuilt from moved code still answers the
+// same paper with the same verdicts over real custody. It records nothing the
+// kernel does not already prove: the branch head it mounted, the verify-chain
+// verdict, and how many plans replay required.
+//
+// Inputs (environment):
+//   NOMOS_CANDIDATE_RUNTIME  runtime directory staged by git-holon/fence/stage_runtime.sh
+//   NOMOS_FENCE_CUSTODY      directory holding bare repos named holon-<workspace>.git
+//   NOMOS_FENCE_WORKSPACES   comma-separated workspace names to mount
+//   NOMOS_FENCE_LOCK         path of the golden lock file (JSON)
+//   NOMOS_FENCE_RECORD=1     rewrite the lock file from this run instead of comparing
+//
+// Without NOMOS_FENCE_CUSTODY the test is skipped; the fence is an operator
+// lane, not a unit test.
+import 'dart:convert';
+import 'dart:io';
+import 'dart:isolate';
+
+import 'package:nomos_client/src/testing/test_peer.dart';
+import 'package:test/test.dart';
+
+Future<String> _testEntry() async {
+  final resolved = await Isolate.resolvePackageUri(
+    Uri.parse('package:nomos_client/src/runner/node-entry.mjs'),
+  );
+  if (resolved == null || resolved.scheme != 'file') {
+    throw StateError('cannot resolve the node testing shell entry');
+  }
+  final path = resolved.toFilePath();
+  if (!File(path).existsSync()) {
+    throw StateError('testing shell entry is not built: $path');
+  }
+  return path;
+}
+
+void main() {
+  final custodyRoot = Platform.environment['NOMOS_FENCE_CUSTODY'];
+  final workspaces = (Platform.environment['NOMOS_FENCE_WORKSPACES'] ?? '')
+      .split(',')
+      .map((w) => w.trim())
+      .where((w) => w.isNotEmpty)
+      .toList();
+  final lockPath = Platform.environment['NOMOS_FENCE_LOCK'];
+  final record = Platform.environment['NOMOS_FENCE_RECORD'] == '1';
+  final runtime = Platform.environment['NOMOS_CANDIDATE_RUNTIME'];
+
+  test(
+    'golden custody: the current kernel mounts, verifies and folds recorded custody identically',
+    () async {
+      if (custodyRoot == null || workspaces.isEmpty || lockPath == null) {
+        markTestSkipped(
+          'set NOMOS_FENCE_CUSTODY, NOMOS_FENCE_WORKSPACES and NOMOS_FENCE_LOCK to run the fence',
+        );
+        return;
+      }
+      if (runtime == null || !File('$runtime/holon.wasm').existsSync()) {
+        fail(
+            'NOMOS_CANDIDATE_RUNTIME must point at a staged runtime (see git-holon/fence/stage_runtime.sh)');
+      }
+      final kernelSha =
+          (await Process.run('shasum', ['-a', '256', '$runtime/holon.wasm']))
+              .stdout
+              .toString()
+              .split(' ')
+              .first;
+
+      final peer = await NmsTestPeer.start(
+        entry: await _testEntry(),
+        runtimeDirectory: runtime,
+        resolveFrom: Directory.current.path,
+        onDiagnostic: (line) => stderr.writeln('[shell] $line'),
+      );
+      addTearDown(peer.dispose);
+
+      final custodyDir = Directory('${peer.custody.directory.path}/custody');
+      await custodyDir.create(recursive: true);
+      final answers = <String, Object?>{};
+      for (final workspace in workspaces) {
+        final source = Directory('$custodyRoot/holon-$workspace.git');
+        if (!source.existsSync()) {
+          fail('golden custody missing: ${source.path}');
+        }
+        final copy = await Process.run(
+          'cp',
+          ['-R', source.path, '${custodyDir.path}/holon-$workspace.git'],
+        );
+        if (copy.exitCode != 0) fail('copy custody: ${copy.stderr}');
+
+        await peer.reception.bindSession(
+          workspace: workspace,
+          session: workspace,
+        );
+        final head = await peer.reception.head();
+        final verdict = await peer.reception.verifyChain();
+        answers[workspace] = <String, Object?>{
+          'head': head,
+          'valid': verdict.valid,
+          'error': verdict.hasError() ? verdict.error : null,
+          'plansRerun':
+              verdict.hasPlansRerun() ? verdict.plansRerun.toInt() : null,
+        };
+      }
+
+      final observed = <String, Object?>{
+        'kernel': kernelSha,
+        'workspaces': answers,
+      };
+      final lock = File(lockPath);
+      if (record || !lock.existsSync()) {
+        await lock.writeAsString(
+          const JsonEncoder.withIndent('  ').convert(observed) + '\n',
+        );
+        stdout.writeln('fence: recorded ${lock.path}');
+        return;
+      }
+      final golden =
+          jsonDecode(await lock.readAsString()) as Map<String, Object?>;
+      final goldenAnswers = golden['workspaces'] as Map<String, Object?>;
+      for (final workspace in workspaces) {
+        expect(
+          answers[workspace],
+          equals(goldenAnswers[workspace]),
+          reason:
+              'workspace $workspace answered differently under kernel ${kernelSha.substring(0, 12)} '
+              '(golden recorded under ${(golden['kernel'] as String).substring(0, 12)})',
+        );
+      }
+      stdout.writeln(
+        'fence: ${workspaces.length} workspace(s) answered identically under kernel ${kernelSha.substring(0, 12)}',
+      );
+    },
+    timeout: const Timeout(Duration(minutes: 15)),
+  );
+}

package/dart/test/local_copies_test.dart

@@ -0,0 +1,222 @@
+import 'package:fixnum/fixnum.dart';
+import 'package:nomos_client/src/reception/event_desk.dart';
+import 'package:nomos_client/src/reception/local_copies.dart';
+import 'package:nomos_client/src/sync_status_projection.dart';
+import 'package:nomos_client/src/sync_status_reducer.dart';
+import 'package:nomos_types/nomos_kernel_protocol.dart' as protocol;
+import 'package:test/test.dart';
+
+void main() {
+  final rebirth = protocol.WorkspaceRebirth(
+    localGenesis: 'a' * 40,
+    remoteGenesis: 'b' * 40,
+    localHead: '1' * 40,
+    remoteHead: '3' * 40,
+    detail: 'The provider now serves this workspace from a different genesis.',
+  );
+
+  ({ReceptionLocalCopies copies, List<protocol.RuntimeRequest> sent})
+      localCopies(
+          protocol.RuntimeResponse Function(protocol.RuntimeRequest) answer) {
+    final sent = <protocol.RuntimeRequest>[];
+    return (
+      copies: ReceptionLocalCopies(
+        invoke: (request) async {
+          sent.add(request);
+          return answer(request);
+        },
+        changes: const Stream.empty(),
+      ),
+      sent: sent,
+    );
+  }
+
+  test('lists every local copy with its reborn state and pending drop',
+      () async {
+    final (:copies, :sent) = localCopies((_) => protocol.RuntimeResponse(
+          workspaceList: protocol.WorkspaceList(workspaces: [
+            protocol.WorkspaceSummary(
+                workspace: 'home', followed: true, rebornRemotely: rebirth),
+            protocol.WorkspaceSummary(
+                workspace: 'estate',
+                followed: true,
+                localCopyDropPending: true),
+          ]),
+        ));
+    final listed = await copies.list();
+    expect(sent.single.hasListWorkspaces(), isTrue);
+    expect(listed.first.workspace, 'home');
+    expect(listed.first.rebornRemotely,
+        NomosWorkspaceRebirth.fromRuntime(rebirth));
+    expect(listed.first.dropPending, isFalse);
+    expect(listed.last.rebornRemotely, isNull);
+    expect(listed.last.dropPending, isTrue);
+  });
+
+  test(
+      'a preview counts what the drop loses, and the drop names the previewed head',
+      () async {
+    final (:copies, :sent) =
+        localCopies((request) => request.hasPreviewLocalCopyDrop()
+            ? protocol.RuntimeResponse(
+                localCopyDropPreview: protocol.LocalCopyDropPreview(
+                  workspace: 'home',
+                  localHead: '1' * 40,
+                  syncedHead: '2' * 40,
+                  unsyncedLocalChanges: Int64(3),
+                  parkedLocalChanges: Int64(2),
+                  undeliveredLetters: Int64(1),
+                  lettersCounted: true,
+                  changesCounted: true,
+                  followed: true,
+                  rebornRemotely: rebirth,
+                ),
+              )
+            : protocol.RuntimeResponse(
+                localCopyDropScheduled: protocol.LocalCopyDropScheduled(
+                    workspace: 'home', droppedHead: '1' * 40),
+              ));
+    final preview = await copies.preview('home');
+    expect(sent.single.previewLocalCopyDrop.workspace, 'home');
+    expect(preview.changesLost, 6);
+    expect(preview.losesWork, isTrue);
+    expect(preview.canDrop, isTrue);
+    expect(preview.rebornRemotely?.remoteGenesis, 'b' * 40);
+
+    await copies.drop(preview);
+    expect(sent.last.dropLocalCopy.workspace, 'home');
+    expect(sent.last.dropLocalCopy.expectedLocalHead, '1' * 40);
+  });
+
+  test(
+      'a clean copy loses nothing; without a provider the drop is refused locally',
+      () async {
+    final (:copies, :sent) = localCopies((_) => protocol.RuntimeResponse(
+          localCopyDropPreview: protocol.LocalCopyDropPreview(
+            workspace: 'catalogue',
+            localHead: '4' * 40,
+            lettersCounted: true,
+            changesCounted: true,
+            followed: false,
+          ),
+        ));
+    final preview = await copies.preview('catalogue');
+    expect(preview.changesLost, 0);
+    expect(preview.losesWork, isFalse);
+    expect(preview.canDrop, isFalse);
+    await expectLater(copies.drop(preview), throwsStateError);
+    expect(sent, hasLength(1),
+        reason: 'the refused drop never reached the peer');
+  });
+
+  test('a reborn sync result needs attention and says so in plain words', () {
+    final status = reduceSyncCompletion(
+      const SyncStatus(),
+      protocol.SyncCompleted(
+        result: protocol.SyncWorkspaceResponse(
+          currentHead: '1' * 40,
+          reconnectRequired: true,
+          custodyDisagreement: protocol.CustodyDisagreement(
+              localHead: '1' * 40, candidateHead: '3' * 40, reason: 'x'),
+          rebornRemotely: rebirth,
+        ),
+      ),
+      DateTime.utc(2026, 9, 22),
+    );
+    expect(status.phase, SyncPhase.error);
+    expect(status.lastError, rebirth.detail);
+  });
+
+  test(
+      'an unreadable copy is listed with its reason; unknown unsynced work is never "none"',
+      () async {
+    final (
+      :copies,
+      sent: _
+    ) = localCopies((request) => request.hasListWorkspaces()
+        ? protocol.RuntimeResponse(
+            workspaceList: protocol.WorkspaceList(workspaces: [
+              protocol.WorkspaceSummary(
+                  workspace: 'estate',
+                  followed: true,
+                  localCopyUnreadable:
+                      'local copy is from an older storage format'),
+            ]),
+          )
+        : protocol.RuntimeResponse(
+            localCopyDropPreview: protocol.LocalCopyDropPreview(
+              workspace: 'estate',
+              localHead: '5' * 40,
+              lettersCounted: false,
+              changesCounted: false,
+              followed: true,
+              localCopyUnreadable: 'local copy is from an older storage format',
+            ),
+          ));
+    final listed = await copies.list();
+    expect(listed.single.unreadableReason,
+        'local copy is from an older storage format');
+    final preview = await copies.preview('estate');
+    expect(preview.changesCounted, isFalse);
+    expect(preview.changesLost, 0);
+    expect(preview.losesWork, isTrue,
+        reason: 'an undeterminable count is not reported as nothing lost');
+    expect(preview.unreadableReason, isNotNull);
+  });
+
+  test('a preserved copy stays listed with its loss after the refetch',
+      () async {
+    final (:copies, sent: _) = localCopies((_) => protocol.RuntimeResponse(
+          workspaceList: protocol.WorkspaceList(workspaces: [
+            protocol.WorkspaceSummary(
+              workspace: 'home',
+              followed: true,
+              preservedCopies: [
+                protocol.PreservedLocalCopy(
+                  workspace: 'home',
+                  preservedHead: '1' * 40,
+                  preservedRef: 'refs/heads/custody-preserved/${'1' * 40}',
+                  reason: 'local copy is from an older storage format',
+                  unsyncedLocalChanges: Int64(3),
+                  changesCounted: true,
+                  automatic: true,
+                  preservedAtUnixMillis: Int64(1758500000000),
+                ),
+              ],
+            ),
+          ]),
+        ));
+    final preserved = (await copies.list()).single.preservedCopies.single;
+    expect(preserved.unsyncedLocalChanges, 3);
+    expect(preserved.changesCounted, isTrue);
+    expect(preserved.automatic, isTrue);
+    expect(preserved.reason, 'local copy is from an older storage format');
+    expect(preserved.preservedAt, isNotNull);
+  });
+
+  test('the diagnostics log surfaces each preservation as a typed event',
+      () async {
+    final desk = ReceptionEventDesk();
+    final copies = ReceptionLocalCopies(
+      invoke: (_) async => throw StateError('unused'),
+      changes: const Stream.empty(),
+      preservations: desk.localCopiesPreserved,
+      recentPreservations: () => desk.recentLocalCopiesPreserved,
+    );
+    final seen = copies.preservations.first;
+    final copy = NomosPreservedLocalCopy.fromRuntime(
+      protocol.PreservedLocalCopy(
+        workspace: 'home',
+        preservedHead: '1' * 40,
+        reason: 'local copy is from an older storage format',
+        changesCounted: false,
+        automatic: true,
+      ),
+    );
+    desk.publishLocalCopyPreserved(copy);
+    expect(await seen, copy);
+    expect(copies.recentPreservations, [copy]);
+    expect(copies.recentPreservations.single.changesCounted, isFalse);
+    await desk.close();
+  });
+}