@githolon/dsl 0.108.7 → 0.110.1

package/dart/test/cloud_bound_local_shell_test.dart

@@ -0,0 +1,119 @@
+// THE CONNECTED LANE, END TO END, against the node local-development platform
+// shell — the local ADMITTING PEER.
+//
+// `NomosTestCloud` spawns `platform-shells/node/local-development/server.ts`,
+// which mints this universe's trust root, stands `root` up against it, births
+// `proof-platform` under root with a trust-root-signed birth certificate, and
+// installs the compiled co2 application law onto it. `NomosTestHarness
+// .cloudBound` then runs the REAL warranted onboarding: mint a device key in
+// the local kernel, take a device-bound proof from the shell's identity
+// provider, enrol the first device on the platform, birth the owner's receiving
+// group there, and mount it as an ordinary cloud-bound session.
+//
+// Nothing here creates a workspace host-side, and nothing reaches past
+// dispatch: every step is an ordinary typed offer through the platform's own law.
+@TestOn('vm')
+library;
+
+import 'dart:io';
+
+import 'package:nomos_client/src/nms_conformance_runtime.dart';
+import 'package:test/test.dart';
+
+// The compiled application's own pre-bound framework calls. The harness accepts
+// no other transport for a framework directive.
+import '../../../examples/co2-birth/build/application/co2_application/lib/src/generated/application.framework_calls.dart'
+    show nomosInternalApplicationFrameworkCalls;
+
+String get _repoRoot => Directory.current.parent.parent.path;
+String get _serverEntry =>
+    '$_repoRoot/platform-shells/node/local-development/server.ts';
+String get _co2LawUsdz => '$_repoRoot/examples/co2-birth/build/co2.law.usdz';
+String get _governanceCalls =>
+    '$_repoRoot/cloud/governance/build/governance.framework.mjs';
+String get _runtimeDir =>
+    Platform.environment['NOMOS_CANDIDATE_RUNTIME'] ??
+    Platform.environment['NOMOS_DART_RUNTIME'] ??
+    Platform.environment['NOMOS_OFFLINE_RUNTIME'] ??
+    '${Platform.environment['HOME'] ?? ''}/.holon/runtime';
+
+/// The prerequisites this test cannot build for itself.
+String? _missingPrereq() {
+  if (!File(_serverEntry).existsSync()) {
+    return 'the local development shell is not in this checkout ($_serverEntry)';
+  }
+  if (!File(_co2LawUsdz).existsSync()) {
+    return 'compile the fixture first: cd examples/co2-birth && npx nomos-compile';
+  }
+  if (!File(_governanceCalls).existsSync()) {
+    return 'compile the governance package first: cd cloud/governance && npm run compile';
+  }
+  for (final artifact in const [
+    'holon.wasm',
+    'kernel.repository.xml',
+    'bootstrap.law.usdz',
+    'nomos.law.usdz',
+  ]) {
+    if (!File('$_runtimeDir/$artifact').existsSync()) {
+      return 'point NOMOS_CANDIDATE_RUNTIME at a complete runtime bundle (missing $artifact)';
+    }
+  }
+  return null;
+}
+
+void main() {
+  test(
+    'CONNECTED: root births the platform, and a home is born and mounted on it',
+    () async {
+      final skip = _missingPrereq();
+      if (skip != null) {
+        markTestSkipped(skip);
+        return;
+      }
+      final diagnostics = <String>[];
+      void log(String line) {
+        diagnostics.add(line);
+        printOnFailure(line);
+      }
+
+      final cloud = await NomosTestCloud.start(
+        serverEntry: _serverEntry,
+        platform: 'proof-platform',
+        lawUsdzPaths: [_co2LawUsdz],
+        applicationMaxChildWorkspacesPerUser: 5,
+        runtimeDirectory: _runtimeDir,
+        mintTrustRoot: true,
+        testIdentityProvider: true,
+        readyTimeout: const Duration(minutes: 4),
+        onDiagnostic: log,
+      );
+      addTearDown(cloud.stop);
+
+      // The universe is pinned to a trust root every peer in it must agree on.
+      expect(cloud.trustRootPublicKey, isNotNull);
+      expect(cloud.testKRootPublic, equals(cloud.trustRootPublicKey));
+
+      final harness = await NomosTestHarness.cloudBound(
+        cloud: cloud,
+        lawUsdzPaths: [_co2LawUsdz],
+        platformWorkspace: 'proof-platform',
+        subject: 'user:proof-owner',
+        applicationFrameworkCalls: nomosInternalApplicationFrameworkCalls,
+        registerTearDown: addTearDown,
+        phaseTimeout: const Duration(minutes: 4),
+        onDiagnostic: log,
+      );
+
+      // Phase 6 mounted the born home: it is a real, verified, cloud-bound session.
+      final home = harness.homeWorkspace;
+      expect(home, isNotNull);
+      expect(home, isNot(equals('proof-platform')));
+      expect(harness.workspace, equals(home));
+
+      final remote = await cloud.remoteHead(home!);
+      expect(remote.initialized, isTrue);
+      expect(remote.head, hasLength(40));
+    },
+    timeout: const Timeout(Duration(minutes: 10)),
+  );
+}

package/dart/test/console_enrolment_refusal_test.dart

@@ -0,0 +1,52 @@
+import 'dart:convert';
+
+import 'package:nomos_client/src/console_enrolment.dart';
+import 'package:test/test.dart';
+
+void main() {
+  final device = NomosConsoleEnrolmentDevice.fromSeed(List.filled(32, 7));
+
+  Future<Object?> refusal(int status, Map<String, Object?> body) async {
+    try {
+      await enrolWithConsole(
+        console: 'http://console.test',
+        tenant: 'co2-platform',
+        scope: 'user',
+        providerToken: 'token',
+        device: device,
+        workspaces: const ['co2-platform'],
+        post: (_, __) async =>
+            NomosConsoleResponse(status: status, body: jsonEncode(body)),
+      );
+    } catch (error) {
+      return error;
+    }
+    return null;
+  }
+
+  test('a console refusal carries its stable code and retry verdict', () async {
+    final error = await refusal(403, {
+      'error': 'home is not a workspace of tenant co2-platform',
+      'code': 'workspace_not_in_tenant',
+      'retryable': false,
+    });
+    expect(
+      error,
+      isA<NomosConsoleEnrolmentRefused>()
+          .having((e) => e.status, 'status', 403)
+          .having((e) => e.code, 'code', 'workspace_not_in_tenant')
+          .having((e) => e.retryable, 'retryable', isFalse)
+          .having((e) => e.message, 'message', contains('not a workspace')),
+    );
+  });
+
+  test('an older console without a verdict leaves it to the status', () async {
+    final error = await refusal(503, {'error': 'busy'});
+    expect(
+      error,
+      isA<NomosConsoleEnrolmentRefused>()
+          .having((e) => e.code, 'code', isEmpty)
+          .having((e) => e.retryable, 'retryable', isNull),
+    );
+  });
+}

package/dart/test/console_enrolment_test.dart

@@ -0,0 +1,227 @@
+import 'dart:convert';
+import 'dart:io';
+import 'dart:typed_data';
+
+import 'package:fixnum/fixnum.dart';
+import 'package:nomos_client/src/console_enrolment.dart';
+import 'package:nomos_client/src/runtime_v2_transport.dart';
+import 'package:nomos_peer_host/nomos_peer_host.dart'
+    show NomosDeviceIdentityStore, NomosProviderCredentialStore;
+import 'package:nomos_types/nomos_kernel_protocol.dart' as p;
+import 'package:test/test.dart';
+
+/// The golden vector every device-side client reproduces byte for byte
+/// (`peer-office/test/fixtures/console_enrol_request_vector.json`).
+final Map<String,
+    Object?> vector = jsonDecode(File.fromUri(Directory.current.uri.resolve(
+        '../../peer-office/test/fixtures/console_enrol_request_vector.json'))
+    .readAsStringSync()) as Map<String, Object?>;
+
+Uint8List _hex(String hex) => Uint8List.fromList([
+      for (var i = 0; i < hex.length; i += 2)
+        int.parse(hex.substring(i, i + 2), radix: 16),
+    ]);
+String _toHex(List<int> bytes) =>
+    bytes.map((b) => b.toRadixString(16).padLeft(2, '0')).join();
+
+class _Platform
+    with NmsPlatformCredentialProviderHost
+    implements NomosRuntimeV2Transport {
+  final frames = <p.RuntimeRequest>[];
+  final List<p.RuntimeResponse> answers;
+  _Platform(this.answers);
+  int sequence = 0;
+  @override
+  int nextRuntimeRequestId() => ++sequence;
+  @override
+  Future<p.RuntimeResponse> invokeRuntime(p.RuntimeRequest request) async {
+    frames.add(request);
+    return answers.removeAt(0);
+  }
+}
+
+class _Store implements NomosDeviceIdentityStore {
+  _Store(this.saved);
+  final Map<String, Uint8List> saved;
+  @override
+  Future<Uint8List?> load(String identity) async => saved[identity];
+  @override
+  Future<void> save(String identity, Uint8List secret) async =>
+      saved[identity] = secret;
+}
+
+class _Cache implements NomosProviderCredentialStore {
+  @override
+  Future<List<String>> loadCandidates(String entry) async => ['cached-token'];
+  @override
+  Future<void> retainCandidate(String entry, String authToken) async {}
+}
+
+void main() {
+  final seed = _hex(vector['seedHex'] as String);
+  final workspaces = (vector['workspaces'] as List).cast<String>();
+  final body = vector['body'] as Map<String, Object?>;
+
+  test(
+      'reproduces the golden enrolment vector byte for byte, signature included',
+      () {
+    final device = NomosConsoleEnrolmentDevice.fromSeed(seed);
+    expect(consoleBase64Url(device.publicKey), vector['devicePublicKey']);
+    expect(consoleDeviceKeyHash(device.publicKey), vector['keyHash']);
+    final bytes = consoleEnrolRequestBytes(
+      tenant: vector['tenant'] as String,
+      scope: vector['scope'] as String,
+      keyHash: vector['keyHash'] as String,
+      workspaces: workspaces,
+      providerToken: vector['providerToken'] as String,
+    );
+    expect(_toHex(bytes), vector['enrolRequestBytesHex']);
+    final request = consoleEnrolmentRequest(
+      tenant: vector['tenant'] as String,
+      scope: vector['scope'] as String,
+      providerToken: vector['providerToken'] as String,
+      device: device,
+      workspaces: workspaces,
+    );
+    expect(request.path, vector['path']);
+    expect(request.body, body);
+    // The wire JSON is the TS client's JSON.stringify, key order included.
+    expect(jsonEncode(request.body), jsonEncode(body));
+  });
+
+  test(
+      'the shell performs the enrolment effect: fresh token, device signature, typed receipt',
+      () async {
+    const identity = 'co2-platform|co2:pYn3MMqQ';
+    final signIns = <String?>[];
+    final posts = <(Uri, Map<String, Object?>)>[];
+    var status = 201;
+    final platform = _Platform([
+      p.RuntimeResponse(
+          protocolVersion: 2,
+          requestId: Int64(7),
+          receivingGroupOpened:
+              p.ReceivingGroupOpened(workspace: 'nomos-rg-a')),
+    ])
+      ..registerDeviceIdentityStore(_Store({identity: seed}))
+      ..registerProviderCredentialStore(_Cache())
+      ..registerCredentialProvider(
+        capability: 'home',
+        cloud: 'http://127.0.0.1:8788',
+        signIn: ({String? deviceChallenge}) async {
+          signIns.add(deviceChallenge);
+          return vector['providerToken'] as String;
+        },
+      )
+      ..registerConsolePost((url, text) async {
+        final sent = jsonDecode(text) as Map<String, Object?>;
+        posts.add((url, sent));
+        return NomosConsoleResponse(
+          status: status,
+          body: status == 201
+              ? jsonEncode({
+                  'keyHash': vector['keyHash'],
+                  'principal': 'co2:pYn3MMqQ',
+                  'workspaces': {for (final w in workspaces) w: '$w-head'},
+                  'revoked': false,
+                })
+              : jsonEncode({
+                  'error':
+                      'this provider token has already been used; sign in again'
+                }),
+        );
+      });
+    final effect = p.PeerConsoleEnrolmentEffect(
+      effectId: 'open-1:console:enrol-1',
+      deviceIdentity: identity,
+      capability: 'home',
+      console: 'http://127.0.0.1:8797/',
+      tenant: vector['tenant'] as String,
+      scope: vector['scope'] as String,
+      workspaces: workspaces,
+    );
+
+    final receipt = await platform.performConsoleEnrolment(effect);
+    expect(receipt.effectId, effect.effectId);
+    expect(receipt.hasConsoleEnrolled(), isTrue, reason: '$receipt');
+    expect(receipt.consoleEnrolled.principal, 'co2:pYn3MMqQ');
+    expect(receipt.consoleEnrolled.keyHash, vector['keyHash']);
+    expect(receipt.consoleEnrolled.heads['nomos-rg-a'], 'nomos-rg-a-head');
+    expect(signIns, [null],
+        reason: 'a plain ID token: never signIn(deviceChallenge: <hash>)');
+    expect(posts.single.$1.toString(),
+        'http://127.0.0.1:8797/v1/tenants/co2-platform/providers/co2/enrolments');
+    expect(posts.single.$2, body,
+        reason: 'the golden request, signature included');
+    expect(receipt.writeToBuffer().length, greaterThan(0));
+    expect(utf8.decode(receipt.writeToBuffer(), allowMalformed: true),
+        isNot(contains(vector['providerToken'])),
+        reason: 'the token never returns to the runtime');
+
+    status = 409;
+    final spent = await platform.performConsoleEnrolment(effect);
+    expect(spent.hasConsoleEnrolmentRefused(), isTrue);
+    expect(spent.consoleEnrolmentRefused.status, 409);
+    expect(
+        spent.consoleEnrolmentRefused.message, contains('already been used'));
+    expect(signIns, [null, null],
+        reason: 'every attempt asks the provider afresh, bypassing the cache');
+
+    // The effect rides the ordinary credential-effect driver.
+    final driven = _Platform([
+      p.RuntimeResponse(
+          protocolVersion: 2,
+          requestId: Int64(9),
+          receivingGroupOpened:
+              p.ReceivingGroupOpened(workspace: 'nomos-rg-a')),
+    ])
+      ..registerDeviceIdentityStore(_Store({identity: seed}))
+      ..registerCredentialProvider(
+          capability: 'home',
+          cloud: 'x',
+          signIn: ({String? deviceChallenge}) async => 'token')
+      ..registerConsolePost((url, text) async =>
+          const NomosConsoleResponse(status: 403, body: '{"error":"no"}'));
+    var calls = 0;
+    final result = await driven.driveCredentialEffects(
+      p.RuntimeRequest(protocolVersion: 2, requestId: Int64(9)),
+      (frame) async {
+        calls += 1;
+        if (calls == 1) {
+          return p.RuntimeResponse(
+            protocolVersion: 2,
+            requestId: Int64(9),
+            correspondencePending: p.CorrespondencePending(
+                workId: 'open-1', consoleEnrolment: effect),
+          );
+        }
+        expect(
+            frame.continueCorrespondence.receipt.consoleEnrolmentRefused.status,
+            403);
+        return p.RuntimeResponse(
+            protocolVersion: 2,
+            requestId: Int64(9),
+            receivingGroupOpened:
+                p.ReceivingGroupOpened(workspace: 'nomos-rg-a'));
+      },
+    );
+    expect(result.hasReceivingGroupOpened(), isTrue);
+  });
+
+  test(
+      'a shell without the identity or a provider answers typed, never guesses',
+      () async {
+    final effect = p.PeerConsoleEnrolmentEffect(
+        effectId: 'e', deviceIdentity: 'missing', capability: 'home');
+    final bare = _Platform([]);
+    expect((await bare.performConsoleEnrolment(effect)).hasFailure(), isTrue);
+    final noKey = _Platform([])
+      ..registerDeviceIdentityStore(_Store({}))
+      ..registerCredentialProvider(
+          capability: 'home',
+          cloud: 'x',
+          signIn: ({String? deviceChallenge}) async => 't');
+    final receipt = await noKey.performConsoleEnrolment(effect);
+    expect(receipt.failure.message, contains('no usable identity'));
+  });
+}

package/dart/test/errors_test.dart

@@ -1,6 +1,6 @@
 // NOMOS — TYPED ERROR MINTING (§7 structured runtime error DX). `nomosErrorFromInfo` routes a structured
 // `NomosErrorInfo` to the MOST SPECIFIC typed class by stable code prefix, so an app's `errorBuilder` branches
-// on `is` and reads structured fields (not scraped prose). Every typed error still extends `NomosBridgeError`.
+// on `is` and reads structured fields (not scraped prose). Every typed error still extends `NomosRuntimeError`.
 import 'package:nomos_client/src/nms_generated_runtime.dart';
 import 'package:test/test.dart';
 
@@ -52,7 +52,7 @@ void main() {
         'nomos.law.incompatibleMember': 'mood',
       },
     ));
-    expect(e, isA<NomosBridgeError>()); // still catchable generically
+    expect(e, isA<NomosRuntimeError>()); // still catchable generically
     expect(e, isA<LawMismatchError>());
     final m = e as LawMismatchError;
     expect(m.code, 'nomos.law.mismatch');
@@ -127,7 +127,7 @@ void main() {
         'nomos.authz.directiveId': 'birthEstateWorkspace',
       },
     ));
-    expect(e, isA<NomosBridgeError>());
+    expect(e, isA<NomosRuntimeError>());
     expect(e, isA<AuthzRefusedError>());
     expect(e, isA<ParentSignerEnrollmentMissing>());
     final p = e as ParentSignerEnrollmentMissing;
@@ -181,8 +181,8 @@ void main() {
       () {
     expect(nomosErrorFromInfo(info('nomos.custody.missing_object')),
         isA<CustodyError>());
-    final g = nomosErrorFromInfo(info('nomos.bridge.error'));
-    expect(g, isA<NomosBridgeError>());
+    final g = nomosErrorFromInfo(info('nomos.reception.error'));
+    expect(g, isA<NomosRuntimeError>());
     expect(g, isNot(isA<LawMismatchError>()));
   });
 }