@githolon/dsl 0.108.7 → 0.110.0

package/dart/test/offer_authentication_proof_test.dart

@@ -7,58 +7,103 @@ import 'package:nomos_types/nomos_kernel_protocol.dart' as protocol;
 import 'package:test/test.dart';
 
 final class _ProofTransport
-    implements BridgeTransport, NomosKernelCallTransport {
-  final _messages = StreamController<Map<String, Object?>>.broadcast();
+    with NmsPlatformCredentialProviderHost
+    implements
+        PeerOfficeConnection,
+        NomosKernelCallTransport,
+        NomosRuntimeV2EventTransport {
+  final _runtimeEvents = StreamController<protocol.RuntimeEvent>.broadcast();
   protocol.CallRequest? lastCall;
+  protocol.CredentialUse? lastCredentialUse;
   var providerToken = protocol.ProviderTokenVerificationStatus
       .PROVIDER_TOKEN_VERIFICATION_STATUS_NO_MATCHING_KEY;
   var enrolledDevice = true;
   var resolvedPrincipal = 'user:jack';
   var syncCalls = 0;
+  final syncSessions = <String>[];
+  var offerCalls = 0;
+  var expireNextSessionOffer = false;
+  final refreshedTokens = <String>[];
+  final authenticationRequests = <protocol.AwaitAuthenticationRequest>[];
+  protocol.AuthenticationReadiness? authenticationResult;
 
   _ProofTransport() {
     scheduleMicrotask(
-      () => _messages.add({
-        'v': kWebviewBridgeVersion,
-        'event': 'ready',
-        'bundleVersion': 'unbundled-dev',
-      }),
+      () => _runtimeEvents.add(
+        protocol.RuntimeEvent(
+          ready: protocol.RuntimeReady(runtimeVersion: 'unbundled-dev'),
+        ),
+      ),
     );
   }
 
   @override
-  Stream<Map<String, Object?>> get messages => _messages.stream;
+  Stream<protocol.RuntimeEvent> get runtimeEvents => _runtimeEvents.stream;
 
+  void pushRuntime(protocol.RuntimeEvent event) => _runtimeEvents.add(event);
+
+  int _requests = 0;
   @override
-  void send(Map<String, Object?> message) {
-    if (message['op'] != 'connect') {
-      throw UnsupportedError('unexpected legacy operation ${message['op']}');
-    }
-    final id = message['id']! as int;
-    final args = (message['args']! as Map).cast<String, Object?>();
-    scheduleMicrotask(
-      () => _messages.add({
-        'v': kWebviewBridgeVersion,
-        'id': id,
-        'ok': true,
-        'result': {'workspace': args['workspace']},
-      }),
-    );
-  }
+  int nextRuntimeRequestId() => ++_requests;
 
   @override
   Future<protocol.RuntimeResponse> invokeRuntime(
     protocol.RuntimeRequest request,
   ) async {
+    if (request.hasAwaitAuthentication()) {
+      authenticationRequests.add(request.awaitAuthentication.deepCopy());
+      return protocol.RuntimeResponse(
+        protocolVersion: 2,
+        requestId: request.requestId,
+        authenticationReadiness: authenticationResult ??
+            protocol.AuthenticationReadiness(
+              outcome: protocol.AuthenticationReadinessOutcome
+                  .AUTHENTICATION_READINESS_OUTCOME_READY,
+              posture: protocol.AuthenticationPostureResponse(
+                providerToken: protocol.ProviderTokenVerificationStatus
+                    .PROVIDER_TOKEN_VERIFICATION_STATUS_VALID,
+                enrolledDevice: true,
+                resolvedPrincipal: 'user:jack',
+              ),
+            ),
+      );
+    }
+    if (request.hasBindSession()) {
+      return protocol.RuntimeResponse(
+        protocolVersion: 2,
+        requestId: request.requestId,
+        sessionBound: protocol.SessionBound(
+          workspace: request.bindSession.workspace,
+          session: request.bindSession.hasSession()
+              ? request.bindSession.session
+              : request.bindSession.workspace,
+          credentialCapability: request.bindSession.hasSession()
+              ? request.bindSession.session
+              : request.bindSession.workspace,
+        ),
+      );
+    }
     if (request.hasSyncWorkspace()) {
       syncCalls += 1;
+      syncSessions.add(request.syncWorkspace.workspace);
       providerToken = protocol.ProviderTokenVerificationStatus
           .PROVIDER_TOKEN_VERIFICATION_STATUS_VALID;
       return protocol.RuntimeResponse(
         protocolVersion: 2,
         requestId: request.requestId,
         syncWorkspace: protocol.SyncWorkspaceResponse(
-          workspace: request.syncWorkspace.session,
+          workspace: request.syncWorkspace.workspace,
+        ),
+      );
+    }
+    if (request.hasRefreshCredentials()) {
+      refreshedTokens.add(utf8.decode(request.refreshCredentials.authToken));
+      return protocol.RuntimeResponse(
+        protocolVersion: 2,
+        requestId: request.requestId,
+        credentialsRefreshed: protocol.CredentialsRefreshed(
+          session: request.refreshCredentials.session,
+          hasAuthToken: request.refreshCredentials.authToken.isNotEmpty,
         ),
       );
     }
@@ -73,8 +118,11 @@ final class _ProofTransport
   Future<protocol.CallResponse> callKernel({
     required String session,
     required protocol.CallRequest request,
+    protocol.CredentialUse credentialUse =
+        protocol.CredentialUse.CREDENTIAL_USE_UNSPECIFIED,
   }) async {
     lastCall = request.deepCopy();
+    lastCredentialUse = credentialUse;
     if (request.hasQuery() && request.query.hasAuthenticationPosture()) {
       return protocol.CallResponse(
         protocolVersion: 1,
@@ -88,6 +136,21 @@ final class _ProofTransport
         ),
       );
     }
+    if (request.hasOffer()) {
+      offerCalls += 1;
+      if (expireNextSessionOffer &&
+          credentialUse == protocol.CredentialUse.CREDENTIAL_USE_SESSION) {
+        expireNextSessionOffer = false;
+        return protocol.CallResponse(
+          protocolVersion: 1,
+          requestId: request.requestId,
+          failure: protocol.Failure(
+            code: 'nomos.auth.token_expired',
+            message: 'auth: token verification failed (Expired)',
+          ),
+        );
+      }
+    }
     return protocol.CallResponse(
       protocolVersion: 1,
       requestId: request.requestId,
@@ -102,80 +165,231 @@ final class _ProofTransport
 }
 
 void main() {
+  test('Reception surfaces a terminal expiry without owning refresh or replay',
+      () async {
+    final transport = _ProofTransport()..expireNextSessionOffer = true;
+    final bridge = DartReception(transport);
+    addTearDown(bridge.dispose);
+    await bridge.ready;
+    final interaction = await bridge.bindSession(
+      workspace: 'home',
+      session: 'home',
+    );
+    await bridge.session('home').refreshCredentials(
+          authToken: 'expired-token',
+        );
+    var refreshes = 0;
+    bridge.nomosInternalRegisterCredentialProvider(
+      interaction: interaction,
+      cloud: 'https://nomos.example',
+      signIn: ({deviceChallenge}) async {
+        refreshes += 1;
+        return 'fresh-token';
+      },
+    );
+
+    await expectLater(
+        bridge.session('home').offerGeneratedCallOutcome(
+              call: NmsInternalGeneratedCalls.create(
+                domain: 'estate',
+                directive: 'seedComplianceDisciplines',
+                protobufType:
+                    'type.nomos.dev/nomos.operation.v1.Payload_seed_compliance_test',
+                protobufPayload: Uint8List.fromList([1]),
+              ),
+            ),
+        throwsA(
+          isA<AuthError>()
+              .having((error) => error.code, 'code', 'nomos.auth.token_expired')
+              .having((error) => error.workspace, 'workspace', 'home')
+              .having(
+                (error) => error.operation,
+                'operation',
+                'seedComplianceDisciplines',
+              ),
+        ));
+
+    // The real shared-runtime retry is exercised through its binary frame
+    // driver in credential_recovery_runtime.test.ts. A terminal refusal here
+    // must never start a second, language-specific retry procedure.
+    expect(transport.offerCalls, 1);
+    expect(refreshes, 0);
+    // The one token installation above belongs to test arrangement. The
+    // terminal refusal must not cause Reception to refresh or replay it.
+    expect(transport.refreshedTokens, ['expired-token']);
+  });
+
+  test('diagnostics are an observation-only view of bound sessions', () async {
+    final transport = _ProofTransport();
+    final reception = DartReception(transport);
+    addTearDown(reception.dispose);
+    await reception.ready;
+    await reception.bindSession(
+        workspace: 'workspace-home', session: 'session-home');
+    await reception.bindSession(
+        workspace: 'workspace-estate', session: 'session-estate');
+    final diagnostics = reception.syncDiagnostics;
+    expect(diagnostics.read().map((row) => row.workspace),
+        ['workspace-home', 'workspace-estate']);
+    expect(transport.syncCalls, 0);
+    final changed = diagnostics.changes.first;
+    transport.pushRuntime(protocol.RuntimeEvent(
+      session: 'session-estate',
+      syncCompleted: protocol.SyncCompleted(
+          result: protocol.SyncWorkspaceResponse(
+        remoteRefusal: protocol.SyncRefusal(reason: 'Exact refusal'),
+      )),
+    ));
+    await changed;
+    expect(diagnostics.read().last.status.lastError, 'Exact refusal');
+    expect(
+        identical(diagnostics.read().last.status,
+            reception.session('session-estate').currentStatus),
+        isTrue);
+  });
+
+  test('a successful typed sync clears locally tracked write debt', () async {
+    final transport = _ProofTransport();
+    final bridge = DartReception(transport);
+    addTearDown(bridge.dispose);
+    await bridge.ready;
+    await bridge.bindSession(workspace: 'home', session: 'home');
+
+    final outcome = await bridge.session('home').offerGeneratedCallOutcome(
+          call: NmsInternalGeneratedCalls.create(
+            domain: 'notes',
+            directive: 'writeNote',
+            protobufType:
+                'type.nomos.dev/nomos.operation.v1.Payload_write_note_test',
+            protobufPayload: Uint8List.fromList([0x0a, 0x01, 0x01]),
+          ),
+        );
+    expect(bridge.session('home').currentStatus.phase, SyncPhase.syncing);
+    expect(bridge.session('home').currentStatus.ahead, isNull);
+
+    transport.pushRuntime(
+      protocol.RuntimeEvent(
+        session: 'home',
+        syncCompleted: protocol.SyncCompleted(
+          reason: 'write',
+          result: protocol.SyncWorkspaceResponse(
+            admittedIntentIds: [outcome.intentId],
+            convergedIntentIds: [outcome.intentId],
+            currentHead: 'confirmed-head',
+            stillAhead: false,
+          ),
+        ),
+      ),
+    );
+    await outcome.receipt.converged.timeout(const Duration(seconds: 1));
+    await Future<void>.delayed(Duration.zero);
+
+    expect(bridge.session('home').currentStatus.phase, SyncPhase.idle);
+    expect(bridge.session('home').currentStatus.ahead, 0);
+  });
+
   test('law-selected enrolled-device proof withholds the provider token',
       () async {
     final transport = _ProofTransport();
-    final bridge = NomosBridge(transport);
+    final bridge = DartReception(transport);
     addTearDown(bridge.dispose);
     final secret = base64Encode(List<int>.filled(32, 7));
     await bridge.ready;
-    await bridge.connect(
+    await bridge.bindSession(
       workspace: 'home',
       session: 'home',
-      authorSecret: secret,
-      authToken: 'stale.provider.token',
     );
+    await bridge.session('home').refreshCredentials(
+          authorSecret: secret,
+          authToken: 'stale.provider.token',
+        );
     final call = NmsInternalGeneratedCalls.create(
       domain: 'identity',
       directive: 'recoverProvider',
-      canonicalUsda: Uint8List.fromList([1]),
+      protobufType:
+          'type.nomos.dev/nomos.operation.v1.Payload_recover_provider_test',
+      protobufPayload: Uint8List.fromList([1]),
     );
 
-    await bridge.session('home').offerCallUsdaOutcome(call: call);
-    expect(transport.lastCall!.offer.authoring.authToken, isNotEmpty);
-    expect(transport.lastCall!.offer.authoring.authorSecret, isNotEmpty);
+    await bridge.session('home').offerGeneratedCallOutcome(call: call);
+    expect(
+      transport.lastCredentialUse,
+      protocol.CredentialUse.CREDENTIAL_USE_SESSION,
+    );
+    expect(transport.lastCall!.offer.authoring.authToken, isEmpty);
+    expect(transport.lastCall!.offer.authoring.authorSecret, isEmpty);
 
-    await bridge.session('home').offerCallUsdaOutcome(
+    await bridge.session('home').offerGeneratedCallOutcome(
           call: call,
           authenticationProof: NomosOfferAuthenticationProof.enrolledDevice,
         );
+    expect(
+      transport.lastCredentialUse,
+      protocol.CredentialUse.CREDENTIAL_USE_ENROLLED_DEVICE,
+    );
     expect(transport.lastCall!.offer.authoring.authToken, isEmpty);
-    expect(transport.lastCall!.offer.authoring.authorSecret, isNotEmpty);
+    expect(transport.lastCall!.offer.authoring.authorSecret, isEmpty);
   });
 
-  test('enrolled-device proof fails before transport without a device key',
+  test('enrolled-device proof is selected without copying its key through Dart',
       () async {
     final transport = _ProofTransport();
-    final bridge = NomosBridge(transport);
+    final bridge = DartReception(transport);
     addTearDown(bridge.dispose);
     await bridge.ready;
-    await bridge.connect(
+    await bridge.bindSession(
       workspace: 'home',
       session: 'home',
-      authToken: 'stale.provider.token',
     );
+    await bridge.session('home').refreshCredentials(
+          authToken: 'stale.provider.token',
+        );
     final call = NmsInternalGeneratedCalls.create(
       domain: 'identity',
       directive: 'recoverProvider',
-      canonicalUsda: Uint8List.fromList([1]),
+      protobufType:
+          'type.nomos.dev/nomos.operation.v1.Payload_recover_provider_test',
+      protobufPayload: Uint8List.fromList([1]),
     );
 
-    await expectLater(
-      bridge.session('home').offerCallUsdaOutcome(
-            call: call,
-            authenticationProof: NomosOfferAuthenticationProof.enrolledDevice,
-          ),
-      throwsA(isA<StateError>()),
+    await bridge.session('home').offerGeneratedCallOutcome(
+          call: call,
+          authenticationProof: NomosOfferAuthenticationProof.enrolledDevice,
+        );
+    expect(
+      transport.lastCredentialUse,
+      protocol.CredentialUse.CREDENTIAL_USE_ENROLLED_DEVICE,
     );
-    expect(transport.lastCall, isNull);
+    expect(transport.lastCall!.offer.authoring.authorSecret, isEmpty);
   });
 
   test('authentication recovery waits for the exact typed kernel postcondition',
       () async {
     final transport = _ProofTransport();
-    final bridge = NomosBridge(transport);
+    final bridge = DartReception(transport);
     addTearDown(bridge.dispose);
     final secret = base64Encode(List<int>.filled(32, 7));
     await bridge.ready;
-    await bridge.connect(
+    await bridge.bindSession(
       workspace: 'home',
       session: 'home',
-      authorSecret: secret,
-      authToken: 'stale.provider.token',
     );
+    await bridge.session('home').refreshCredentials(
+          authorSecret: secret,
+          authToken: 'stale.provider.token',
+        );
     final home = bridge.session('home');
 
-    final before = await home.nmsAuthenticationPosture(principal: 'user:jack');
+    final before = await home.nmsAuthenticationPosture(
+      principal: 'user:jack',
+      authorSecret: secret,
+    );
+    expect(
+      transport.lastCredentialUse,
+      protocol.CredentialUse.CREDENTIAL_USE_SESSION,
+      reason:
+          'an explicit device proof must not suppress the live provider credential',
+    );
     expect(
       before.providerToken,
       NomosProviderTokenVerification.noMatchingKey,
@@ -184,10 +398,96 @@ void main() {
 
     final after = await home.nmsAwaitAuthenticationReady(
       principal: 'user:jack',
+      initialBackoff: const Duration(milliseconds: 10),
     );
     expect(after.providerToken, NomosProviderTokenVerification.valid);
     expect(after.enrolledDevice, isTrue);
     expect(after.resolvedPrincipal, 'user:jack');
-    expect(transport.syncCalls, 1);
+    expect(transport.authenticationRequests, hasLength(1));
+    final requirement = transport.authenticationRequests.single;
+    expect(requirement.session, 'home');
+    expect(requirement.principal, 'user:jack');
+    expect(requirement.initialBackoffMillis, 10);
+    expect(requirement.patienceMillis, 60000);
+    expect(requirement.maximumBackoffMillis, 8000);
+    expect(transport.syncCalls, 0,
+        reason: 'the client drives no sync rounds of its own');
+  });
+
+  test('Reception preserves the runtime last posture when patience expires',
+      () async {
+    final transport = _ProofTransport();
+    final bridge = DartReception(transport, allowStaleRunnerBundle: true);
+    addTearDown(bridge.dispose);
+    await bridge.ready;
+    await bridge.bindSession(workspace: 'home', session: 'home');
+    transport.authenticationResult = protocol.AuthenticationReadiness(
+      outcome: protocol.AuthenticationReadinessOutcome
+          .AUTHENTICATION_READINESS_OUTCOME_PATIENCE_EXHAUSTED,
+      posture: protocol.AuthenticationPostureResponse(
+        providerToken: protocol.ProviderTokenVerificationStatus
+            .PROVIDER_TOKEN_VERIFICATION_STATUS_NO_MATCHING_KEY,
+        enrolledDevice: false,
+        resolvedPrincipal: '',
+      ),
+    );
+    final posture = await bridge
+        .session('home')
+        .nmsAwaitAuthenticationReady(principal: 'user:jack');
+    expect(posture.providerToken, NomosProviderTokenVerification.noMatchingKey);
+    expect(posture.enrolledDevice, isFalse);
+    expect(transport.authenticationRequests, hasLength(1));
+    expect(transport.syncCalls, 0);
+  });
+
+  test(
+      'birth readiness crosses the runtime boundary without a client sync loop',
+      () async {
+    final transport = _ProofTransport();
+    final bridge = DartReception(transport);
+    addTearDown(bridge.dispose);
+    await bridge.ready;
+    await bridge.bindSession(workspace: 'home', session: 'home');
+    final home = bridge.session('home');
+
+    final unspecified = await home.nmsAuthenticationPosture(
+      principal: 'user:jack',
+      includeBirthEvidence: true,
+    );
+    expect(transport.lastCall!.query.authenticationPosture.includeBirthEvidence,
+        isTrue);
+    expect(unspecified.isReadyToBirthFor('user:jack'), isFalse,
+        reason:
+            'an older kernel omitting the field cannot prove birth readiness');
+
+    transport.authenticationResult = protocol.AuthenticationReadiness(
+      outcome: protocol.AuthenticationReadinessOutcome
+          .AUTHENTICATION_READINESS_OUTCOME_PATIENCE_EXHAUSTED,
+      posture: protocol.AuthenticationPostureResponse(
+        providerToken: protocol.ProviderTokenVerificationStatus
+            .PROVIDER_TOKEN_VERIFICATION_STATUS_VALID,
+        enrolledDevice: true,
+        resolvedPrincipal: 'user:jack',
+        birthEvidence: protocol.BirthEvidenceReadiness(
+          status: protocol
+              .BirthEvidenceStatus.BIRTH_EVIDENCE_STATUS_DELEGATION_REQUIRED,
+          detail: 'the current device has no retained delegation',
+        ),
+      ),
+    );
+    final posture = await home.nmsAwaitAuthenticationReady(
+      principal: 'user:jack',
+      requireBirthEvidence: true,
+    );
+    expect(posture.isReadyFor('user:jack'), isTrue);
+    expect(posture.isReadyToBirthFor('user:jack'), isFalse);
+    expect(posture.needsBirthDelegation, isTrue);
+    expect(posture.birthEvidenceDetail,
+        'the current device has no retained delegation');
+    expect(
+        transport.authenticationRequests.single.criterion,
+        protocol.AuthenticationReadinessCriterion
+            .AUTHENTICATION_READINESS_CRITERION_BIRTH_EVIDENCE);
+    expect(transport.syncCalls, 0);
   });
 }

package/dart/test/operation_compatibility_test.dart

@@ -0,0 +1,151 @@
+import 'dart:async';
+import 'dart:typed_data';
+
+import 'package:nomos_client/src/nms_generated_runtime.dart';
+import 'package:nomos_types/nomos_kernel_protocol.dart' as p;
+import 'package:test/test.dart';
+
+final class _Office implements PeerOfficeConnection {
+  final events = StreamController<p.RuntimeEvent>.broadcast(sync: true);
+  final calls = <p.RuntimeRequest>[];
+  int sequence = 0;
+
+  @override
+  Stream<p.RuntimeEvent> get runtimeEvents => events.stream;
+
+  @override
+  int nextRuntimeRequestId() => ++sequence;
+
+  @override
+  Future<p.RuntimeResponse> invokeRuntime(p.RuntimeRequest request) async {
+    calls.add(request.deepCopy());
+    if (!request.hasFramework() ||
+        !request.framework.hasCheckInterfaceCompatibility()) {
+      throw StateError(
+          'unexpected runtime call ${request.whichCommand().name}');
+    }
+    return p.RuntimeResponse(
+      protocolVersion: 2,
+      requestId: request.requestId,
+      framework: p.FrameworkResponse(
+        interfaceCompatibilityVerdict: p.InterfaceCompatibilityVerdict(
+          localLawCurrency: p.LocalLawCurrency.LOCAL_LAW_CURRENCY_CURRENT,
+          examined: p.InterfaceCompatibilityResponse(
+            compatible: false,
+            workspaceFrontier: 'head-${calls.length}',
+            members: [
+              p.InterfaceMemberVerdict(
+                domain: 'estate',
+                kind: p.InterfaceMemberKind.INTERFACE_MEMBER_KIND_AGGREGATE,
+                member: 'Asset',
+                status: p.InterfaceCompatibilityStatus
+                    .INTERFACE_COMPATIBILITY_STATUS_EXACT,
+              ),
+              p.InterfaceMemberVerdict(
+                domain: 'estate',
+                kind: p.InterfaceMemberKind.INTERFACE_MEMBER_KIND_FIELD,
+                member: 'createCatalogueAssetGrid',
+                field_4: 'fieldRequirements',
+                status: p.InterfaceCompatibilityStatus
+                    .INTERFACE_COMPATIBILITY_STATUS_INCOMPATIBLE,
+                reason: p.InterfaceCompatibilityReason
+                    .INTERFACE_COMPATIBILITY_REASON_WIRE_CONTRACT_CHANGED,
+                diagnostic:
+                    'application wire 146915208 is not accepted by this law',
+              ),
+              p.InterfaceMemberVerdict(
+                domain: 'estate',
+                kind: p.InterfaceMemberKind.INTERFACE_MEMBER_KIND_DIRECTIVE,
+                member: 'createCatalogueAssetGrid',
+                status: p.InterfaceCompatibilityStatus
+                    .INTERFACE_COMPATIBILITY_STATUS_INCOMPATIBLE,
+              ),
+            ],
+          ),
+        ),
+      ),
+    );
+  }
+}
+
+void main() {
+  late _Office office;
+  late DartReception reception;
+  late NomosSession session;
+  final matrix = Uint8List.fromList([1, 2, 3]);
+
+  setUp(() {
+    office = _Office();
+    reception = DartReception(office);
+    session = reception.session('estate');
+  });
+
+  tearDown(() async {
+    await reception.dispose();
+    await office.events.close();
+  });
+
+  test('the exact unsafe write is typed while unrelated members stay usable',
+      () async {
+    final unsafe = await session.operationCompatibility(
+      matrix,
+      domain: 'estate',
+      directive: 'createCatalogueAssetGrid',
+    );
+    expect(
+      unsafe,
+      isA<NomosOperationUnavailable>()
+          .having(
+            (value) => value.guidance,
+            'guidance',
+            NomosCompatibilityGuidance.controlPlaneDecisionRequired,
+          )
+          .having(
+            (value) =>
+                value.differences.map((difference) => difference.field_4),
+            'differences',
+            contains('fieldRequirements'),
+          ),
+    );
+    await expectLater(
+      session.assertOperationCompatible(
+        matrix,
+        domain: 'estate',
+        directive: 'createCatalogueAssetGrid',
+      ),
+      throwsA(isA<NomosOperationUnavailable>()),
+    );
+    expect(
+      await session.operationCompatibility(
+        matrix,
+        domain: 'estate',
+        directive: 'renameAsset',
+      ),
+      isA<NomosOperationAvailable>(),
+      reason: 'a partial application is not a global failure',
+    );
+    expect(office.calls, hasLength(1),
+        reason: 'all three checks share one immutable matrix examination');
+  });
+
+  test('a law-change observation invalidates the session cache', () async {
+    await session.operationCompatibility(
+      matrix,
+      domain: 'estate',
+      directive: 'createCatalogueAssetGrid',
+    );
+    office.events.add(p.RuntimeEvent(
+      session: 'estate',
+      lawChanged: p.LawChanged(
+        domain: 'estate',
+        packageSha256: 'next-law',
+      ),
+    ));
+    await session.operationCompatibility(
+      matrix,
+      domain: 'estate',
+      directive: 'createCatalogueAssetGrid',
+    );
+    expect(office.calls, hasLength(2));
+  });
+}