@githolon/dsl 0.14.0 → 0.16.0

package/dart/example/nomos_webview_transport.dart

@@ -15,8 +15,8 @@
 //   final bridge = NomosBridge(transport);
 //   await bridge.ready;                                       // resolves on the runner's {event:ready}
 //   await bridge.connect(cloud: 'https://nomos.captainapp.co.uk', workspace: myWs, clientId: deviceId);
-//   final head = await bridge.dispatch(domain: 'guestbook', directiveId: 'signGuestbook',
-//       payload: {'author': 'ada', 'message': 'hi', 'mood': 'delighted'}, domainHash: GUESTBOOK_DOMAIN_HASH);
+//   final app = GuestbookClient(bridge);
+//   final head = await app.signGuestbook(SignGuestbookPayload(author: 'ada', message: 'hi', mood: 'delighted'));
 //   final rows = await bridge.query('entriesByAuthor', {'author': 'ada'});
 //
 // (Put the runner bundle at `assets/nomos/nomos-runner.{html,js}` and declare it under `flutter: assets:`.)

package/dart/lib/nomos_dsl.dart

@@ -10,7 +10,7 @@
 ///  - The hand-written kernel WIRE types (`Value`, `Field`/`WireField`, `Hlc`,
 ///    `Op`, `FieldOp`, `Event`, `Schema`/`WireDriver`) — byte-compatible with
 ///    serde_json. See `src/wire.dart`, `src/driver.dart`.
-///  - The ONE write verb `dispatch(intent)` (`src/dispatch.dart`) + the typed
+///  - The ONE effectful write verb `offer(intent)` (`src/offer.dart`) + the typed
 ///    reactive read engine `NomosReads` (`src/subscriptions.dart`).
 ///  - The framework PRIMITIVES ONLY. The CODE-GENERATED per-domain types
 ///    (aggregates + public intent payloads + enums + `watch…` read accessors) NO LONGER
@@ -18,14 +18,14 @@
 ///    `co2_nomos_domains` (`ts_packages/co2-nomos-domains/dart/`), emitted there by
 ///    `ts_packages/co2-nomos-domains/src/emit_dart.ts`. Tenant domains squatting in
 ///    the framework package was the wrong topology; this barrel now exports ONLY the
-///    hand-written framework wire/dispatch/read/provider primitives. App code that
+///    hand-written framework wire/offer/read/provider primitives. App code that
 ///    wants the typed domain surface imports `package:co2_nomos_domains/co2_nomos_domains.dart`,
 ///    which re-exports this framework barrel PLUS every generated domain.
 library;
 
 export 'src/wire.dart';
 export 'src/driver.dart';
-export 'src/dispatch.dart';
+export 'src/offer.dart';
 export 'src/subscriptions.dart';
 export 'src/schema_validation.dart';
 // THE WEBVIEW BRIDGE (app-binding boundary) — the async Dart runtime that drives the REAL githolon running
@@ -33,7 +33,7 @@ export 'src/schema_validation.dart';
 export 'src/webview_bridge.dart';
 // The PROVIDER boundary (server-side capability-provider SDK runtime: TaskOutcome /
 // TaskSuccess / TaskFailure / TaskResult / TaskProvider / HostClock). The symmetric twin
-// of `dispatch.dart`; the generated per-task provider classes build on it.
+// of `offer.dart`; the generated per-task provider classes build on it.
 export 'src/provider.dart';
 
 // ── NO generated domains here ──────────────────────────────────────────────

package/dart/lib/src/{dispatch.dart → offer.dart}

@@ -5,19 +5,19 @@
 // wasm = determinism.  No native, no wasmtime, no 2nd artifact, no domain-JS on bare V8.
 // If a file isn't this / hosting this / authoring for this / proving this — it's gone.
 
-/// The ONE write verb: `dispatch(intent)`.
+/// The ONE effectful write verb: `offer(intent)`.
 ///
-/// END-STATE (the "dispatch(intent) purge", Jack 2026-06-01): app code's only
-/// write verb is `dispatch(intent)`. The frontend constructs ONLY a typed
+/// END-STATE (the "offer(intent) purge", Jack 2026-06-18): app code's only
+/// effectful write verb is `offer(intent)`. The frontend constructs ONLY a typed
 /// generated intent DTO (a [NomosIntent]) — it never hand-types an engine rule
-/// id, never builds an `Event`, never holds an `Hlc`. `dispatch` ships the
+/// id, never builds an `Event`, never holds an `Hlc`. `offer` ships the
 /// intent payload as DATA to the kernel's FRB `author(domain, directiveId, payloadJson,
 /// actor)`; the sealed engine runs the REAL `.plan()` and is the SOLE lowering
 /// authority (HLC + intent id are kernel-allocated host-side).
 ///
 /// This file is HAND-WRITTEN and domain-AGNOSTIC (declared ONCE, here): the
 /// generated per-domain intent classes `implements NomosIntent`, so a single
-/// generic `dispatch` covers every public intent of every domain — replacing the
+/// generic `offer` covers every public intent of every domain — replacing the
 /// ~63-method write façade.
 library;
 
@@ -39,7 +39,7 @@ abstract interface class NomosIntent {
 }
 
 /// The kernel write seam: the FRB `NomosClient.author` signature, as a function
-/// type. `dispatch` takes this (rather than importing the FRB client) so the
+/// type. `offer` takes this (rather than importing the FRB client) so the
 /// generated `nomos_dsl` package stays free of a `flutter_rust_bridge` dependency
 /// — the app threads `client.author` in. Returns the new HEAD commit oid (hex).
 typedef Authorer = String Function({
@@ -54,7 +54,7 @@ typedef Authorer = String Function({
 /// intent object — nothing is hand-typed. Builds NO `Event` and NO `Hlc`: the
 /// engine lowers. [actor] is the authenticated actor the caller threads from auth.
 /// Returns the new HEAD commit oid (hex).
-String dispatch(NomosIntent intent,
+String offer(NomosIntent intent,
         {required Authorer author, required String actor}) =>
     author(
       domain: intent.domain,

package/dart/lib/src/provider.dart

@@ -7,22 +7,22 @@
 
 /// The PROVIDER boundary: the typed server-side capability-provider SDK runtime.
 ///
-/// This is the SYMMETRIC TWIN of `dispatch.dart` (the peer write boundary). Where
-/// the peer authors an Order (`createTranscribeVoiceNote(...)` -> `dispatch`), a
+/// This is the SYMMETRIC TWIN of `offer.dart` (the peer write boundary). Where
+/// the peer authors an Obligation (`createTranscribeVoiceNote(...)` -> `offer`), a
 /// PROVIDER (Whisper, a renderer, a multi-target PR transporter) is the
-/// other end of the framework `impureCapability` Order→Receipt pair: it WATCHES `requested`
+/// other end of the framework `impureCapability` Obligation→Receipt pair: it WATCHES `requested`
 /// task rows, performs the impure side-effect OUTSIDE the fold, and authors the RECEIPT
 /// (`complete…`/`fail…`/`block…`/`deadLetter…`) back through the SAME write path. The receipt is an ordinary
 /// intent — the provider is a Nomos author, NOT a bypass (ONE-WRITE-PATH).
-/// Order and Receipt are intent roles, not provider-owned jobs or privileged server
+/// Obligation and Receipt are intent roles, not provider-owned jobs or privileged server
 /// mutation channels.
 ///
 /// PRINCIPLE (Jack 2026-06-04): code is ~free; INTEGRATION POINTS are expensive +
 /// fuckup-guaranteed. So the generated provider SDK is fully TYPED to the boundary —
-/// the dev writes a typed `handler(Order) -> Result | Failure | Blocked | DeadLetter`; the generated
-/// dispatcher DECODES the incoming Order JSON into the typed Order and ENCODES the typed
+/// the dev writes a typed `handler(Obligation) -> Result | Failure | Blocked | DeadLetter`; the generated
+/// dispatcher DECODES the incoming Obligation JSON into the typed Obligation and ENCODES the typed
 /// outcome into the ordinary Receipt intent. NO dynamic / `Map<String, dynamic>` / raw-JSON leaks
-/// into the dev-facing API; the types stop ONLY at the actual JSON serde (`handleOrder`).
+/// into the dev-facing API; the types stop ONLY at the actual JSON serde (`handleObligation`).
 ///
 /// This file is HAND-WRITTEN and domain-AGNOSTIC (declared ONCE, here): the generated
 /// per-task provider classes build on these interfaces, so the round-trip mechanism is
@@ -31,9 +31,9 @@ library;
 
 import 'dart:convert';
 
-import 'dispatch.dart' show NomosIntent;
+import 'offer.dart' show NomosIntent;
 
-/// The typed OUTCOME a provider handler returns for one Order: success, failure, blocked,
+/// The typed OUTCOME a provider handler returns for one Obligation: success, failure, blocked,
 /// or dead-lettered.
 /// SEALED so a generated dispatcher's `switch` is EXHAUSTIVE — a new outcome variant is
 /// a compile error at every dispatcher, never a silent fall-through. The mirror of the
@@ -44,7 +44,7 @@ sealed class TaskOutcome<R> {
 
 /// The SUCCESS outcome: the typed [result] the handler produced. The generated
 /// dispatcher maps this → the `complete…` Receipt directive (status:completed +
-/// resultRef + closesOrder).
+/// resultRef + closesObligation).
 final class TaskSuccess<R> extends TaskOutcome<R> {
   /// The typed result the handler produced (e.g. a transcription's `resultRef`).
   final R result;
@@ -53,7 +53,7 @@ final class TaskSuccess<R> extends TaskOutcome<R> {
 
 /// The FAILURE outcome: the [failureReason] the handler recorded. The generated
 /// dispatcher maps this → the `fail…` Receipt directive (status:failed + failureReason +
-/// closesOrder). A recorded failure is the terminal state — NOT a retry storm
+/// closesObligation). A recorded failure is the terminal state — NOT a retry storm
 /// (conformance X1's "declined is recorded" discipline at the task scale).
 final class TaskFailure<R> extends TaskOutcome<R> {
   /// Why the side-effect failed (recorded onto the task, never re-thrown into the fold).
@@ -63,13 +63,13 @@ final class TaskFailure<R> extends TaskOutcome<R> {
 
 /// The BLOCKED outcome: the provider cannot proceed until an external condition changes.
 /// The generated dispatcher maps this -> the `block...` Receipt directive
-/// (status:blocked + blockedReason + nextAction + closesOrder). This is terminal for this
-/// order; recovery is a fresh explicit Order after the next action is satisfied.
+/// (status:blocked + blockedReason + nextAction + closesObligation). This is terminal for this
+/// obligation; recovery is a fresh explicit Obligation after the next action is satisfied.
 final class TaskBlocked<R> extends TaskOutcome<R> {
   /// Why the provider cannot proceed.
   final String blockedReason;
 
-  /// What the host/human must do before a fresh order can proceed.
+  /// What the host/human must do before a fresh obligation can proceed.
   final String nextAction;
 
   const TaskBlocked({
@@ -78,11 +78,11 @@ final class TaskBlocked<R> extends TaskOutcome<R> {
   });
 }
 
-/// The DEAD-LETTER outcome: stop retrying this order and park it in the DLQ. The generated
+/// The DEAD-LETTER outcome: stop retrying this obligation and park it in the DLQ. The generated
 /// dispatcher maps this -> the `deadLetter...` Receipt directive
-/// (status:deadLettered + deadLetterReason + closesOrder).
+/// (status:deadLettered + deadLetterReason + closesObligation).
 final class TaskDeadLetter<R> extends TaskOutcome<R> {
-  /// Why this order was moved to the DLQ.
+  /// Why this obligation was moved to the DLQ.
   final String deadLetterReason;
   const TaskDeadLetter(this.deadLetterReason);
 }
@@ -106,34 +106,34 @@ abstract interface class TaskResult {
 typedef HostClock = int Function();
 
 /// The minimal contract a generated per-task provider exposes. Generic in the typed
-/// Order/Result; the generated subtype binds them. `handleOrder` is the ONE seam a host
+/// Obligation/Result; the generated subtype binds them. `handleObligation` is the ONE seam a host
 /// loop calls per `requested` row.
 abstract interface class TaskProvider<O, R> {
   /// The framework `impureCapability` ids this provider is bound to (provenance — the host
   /// can assert it is draining the right capability). Carried as DATA, never hand-typed.
-  String get orderDirectiveId;
+  String get obligationDirectiveId;
   String get completeDirectiveId;
   String get failDirectiveId;
   String get blockDirectiveId;
   String get deadLetterDirectiveId;
 
-  /// DECODE an incoming Order intent's payload JSON into the typed [O], run the
+  /// DECODE an incoming Obligation intent's payload JSON into the typed [O], run the
   /// registered typed handler, and ENCODE the outcome into the ordinary Receipt intent — a
-  /// [NomosIntent] ready for the ONE write path (`dispatch`). `now` stamps the
+  /// [NomosIntent] ready for the ONE write path (`offer`). `now` stamps the
   /// terminal time. Decoding raw JSON happens HERE and only here; the handler the dev
   /// writes sees ONLY the typed [O] and returns ONLY a typed [TaskOutcome].
-  NomosIntent handleOrder(String orderPayloadJson, {required HostClock now});
+  NomosIntent handleObligation(String obligationPayloadJson, {required HostClock now});
 
-  /// Convenience: decode an Order payload from an already-parsed map (the host may have
-  /// the row's `data` map in hand from a read). Same path as [handleOrder].
-  NomosIntent handleOrderMap(
-    Map<String, Object?> orderPayload, {
+  /// Convenience: decode an Obligation payload from an already-parsed map (the host may have
+  /// the row's `data` map in hand from a read). Same path as [handleObligation].
+  NomosIntent handleObligationMap(
+    Map<String, Object?> obligationPayload, {
     required HostClock now,
   });
 }
 
-/// Decode an Order payload JSON string to a map for a generated `…Order.fromJson`.
-/// Shared so every generated provider decodes Orders identically (the symmetry of the
+/// Decode an Obligation payload JSON string to a map for a generated `…Obligation.fromJson`.
+/// Shared so every generated provider decodes Obligations identically (the symmetry of the
 /// client's `jsonEncode(toPayloadJson())`).
-Map<String, Object?> decodeOrderPayload(String orderPayloadJson) =>
-    (jsonDecode(orderPayloadJson) as Map<String, Object?>);
+Map<String, Object?> decodeObligationPayload(String obligationPayloadJson) =>
+    (jsonDecode(obligationPayloadJson) as Map<String, Object?>);

package/dart/lib/src/subscriptions.dart

@@ -7,8 +7,8 @@
 
 /// The READ half of the client boundary: typed, reactive subscriptions.
 ///
-/// END-STATE (the "dispatch(intent) purge", Jack 2026-06-01): the app's ONLY
-/// Nomos surface is `dispatch(intent)` (write — see `dispatch.dart`) + TYPED
+/// END-STATE (the "offer(intent) purge", Jack 2026-06-18): the app's ONLY
+/// Nomos surface is `offer(intent)` (write — see `offer.dart`) + TYPED
 /// PUB/SUB SUBSCRIPTIONS (read — here + the generated per-domain accessors). The
 /// app reads ONLY through generated typed accessors (`watchSites()`,
 /// `watchSite(id)`, indexed-field queries → typed results); it never hand-writes a
@@ -75,7 +75,7 @@ typedef Summer = int Function(String sumId, String groupKey);
 /// A "projection changed" tick: fires (any value) whenever a write may have
 /// advanced the projection, so the subscription re-runs its indexed read. The
 /// `query()`/`query_by_id()` closures are SYNCHRONOUS point-in-time reads; this tick is what
-/// makes a typed accessor REACTIVE. The app threads its existing post-`dispatch`
+/// makes a typed accessor REACTIVE. The app threads its existing post-`offer`
 /// invalidation signal in here (today the runtime's ~750ms projection poll / the
 /// write-completion broadcast). A read with no live tick is a one-shot current read.
 typedef ReadTick = Stream<void>;

package/dart/lib/src/webview_bridge.dart

@@ -8,7 +8,7 @@
 /// stable message protocol, so the generated typed Dart client drives the real kernel — never a
 /// `MemoryPersistence` pretending to be a GitHolon.
 ///
-/// A WebView round-trip is ASYNC, so the bridge is async (unlike the sync FRB `Authorer` in `dispatch.dart`).
+/// A WebView round-trip is ASYNC, so the bridge is async (unlike the sync FRB `Authorer` in `offer.dart`).
 /// The generated per-domain Dart client wraps a [NomosBridge]; the bridge owns request/reply correlation +
 /// reactive `watch` streams. The platform TRANSPORT ([BridgeTransport]) is injected — `dart:js_util` on web,
 /// a WebView JS-channel on mobile — so this protocol logic is pure Dart + fully unit-testable.
@@ -41,6 +41,8 @@ class NomosBridge {
   final BridgeTransport _transport;
   final Map<int, Completer<Object?>> _pending = {};
   final Map<String, StreamController<List<dynamic>>> _watches = {};
+  // SHAPE COMPATIBILITY (#72): compat bindings emit a verdict MAP, not a row list.
+  final Map<String, StreamController<Map<String, Object?>>> _compatWatches = {};
   final StreamController<Map<String, Object?>> _syncEvents =
       StreamController<Map<String, Object?>>.broadcast();
   final StreamController<Map<String, Object?>> _signalEvents =
@@ -79,6 +81,17 @@ class NomosBridge {
         } else {
           ctrl.add((m['rows'] as List?) ?? const []);
         }
+        return;
+      }
+      // SHAPE COMPATIBILITY (#72): the compat binding emits a verdict OBJECT, not a row list.
+      final cctrl = _compatWatches[m['subId']];
+      if (cctrl != null && !cctrl.isClosed) {
+        if (m['ok'] == false) {
+          cctrl.addError(NomosBridgeError(
+              (m['error'] ?? 'the compat watch failed').toString()));
+        } else {
+          cctrl.add(((m['rows'] as Map?)?.cast<String, Object?>()) ?? const {});
+        }
       }
       return;
     }
@@ -153,26 +166,9 @@ class NomosBridge {
     });
   }
 
-  /// LOCAL-FIRST write: author `directiveId` under `domainHash`. Returns the new local head; durable on [sync].
-  Future<String> dispatch(
-      {required String domain,
-      required String directiveId,
-      required Map<String, Object?> payload,
-      required String domainHash}) async {
-    final r = _asMap(await _call('dispatch', {
-      'domain': domain,
-      'directiveId': directiveId,
-      'payload': payload,
-      'domainHash': domainHash
-    }));
-    return r['head'].toString();
-  }
-
-  /// §5 cross-custody delivery: a `recordShare` carrying a pre-signed §3 quote into a home holon.
-  Future<String> deliverShare(
-      {required Map<String, Object?> quote, required String domainHash}) async {
-    final r = _asMap(await _call(
-        'deliverShare', {'quote': quote, 'domainHash': domainHash}));
+  /// LOCAL-FIRST offer: carry opaque intent bytes into the GitHolon. Returns the new local head; durable on [sync].
+  Future<String> offer({required String intentBytes}) async {
+    final r = _asMap(await _call('offer', {'intentBytes': intentBytes}));
     return r['head'].toString();
   }
 
@@ -261,6 +257,41 @@ class NomosBridge {
   Stream<List<dynamic>> watchById(String id) =>
       _watchStream(kind: 'byId', id: id);
 
+  /// SHAPE COMPATIBILITY (#72): one-shot verdict for this client's structural [requirement]
+  /// (its baked `…InterfaceJson`, decoded) against the workspace's ON-LEDGER offer (auto-sourced).
+  /// `{ ok, missing[], incompatible[] }` — names the exact directive/aggregate/field, not a hash.
+  Future<Map<String, Object?>> checkCompatibility(
+          Map<String, Object?> requirement,
+          [Map<String, Object?>? offer]) async =>
+      _asMap(await _call('checkCompatibility', {
+        'requirement': requirement,
+        if (offer != null) 'offer': offer,
+      }));
+
+  /// SHAPE COMPATIBILITY as a LIVE BINDING (#72): a stream of verdicts that re-emits whenever the
+  /// workspace's installed law changes (another peer installs/upgrades/retires a domain and it
+  /// syncs in). The verdict carries `offerKnown`. The app degrades/prompts on `ok:false`.
+  Stream<Map<String, Object?>> watchCompatibility(
+      Map<String, Object?> requirement) {
+    final subId = 'c${++_seq}';
+    late final StreamController<Map<String, Object?>> ctrl;
+    ctrl = StreamController<Map<String, Object?>>(
+      onListen: () => _call('watch', {
+        'subId': subId,
+        'kind': 'compat',
+        'requirement': requirement,
+      }),
+      onCancel: () async {
+        _compatWatches.remove(subId);
+        try {
+          await _call('unwatch', {'subId': subId});
+        } catch (_) {}
+      },
+    );
+    _compatWatches[subId] = ctrl;
+    return ctrl.stream;
+  }
+
   Stream<List<dynamic>> _watchStream(
       {required String kind,
       String? queryId,
@@ -298,6 +329,10 @@ class NomosBridge {
       if (!w.isClosed) await w.close();
     }
     _watches.clear();
+    for (final w in _compatWatches.values) {
+      if (!w.isClosed) await w.close();
+    }
+    _compatWatches.clear();
     if (!_syncEvents.isClosed) await _syncEvents.close();
     if (!_signalEvents.isClosed) await _signalEvents.close();
     if (!_flameEvents.isClosed) await _flameEvents.close();

package/dart/test/webview_bridge_test.dart

@@ -40,9 +40,11 @@ class FakeRunner implements BridgeTransport {
         case 'connect':
           _incoming.add(reply({'workspace': args['workspace']}));
           break;
-        case 'dispatch':
+        case 'offer':
           // a directive the law refuses answers ok:false (the runner frames the gate's verdict).
-          if (args['directiveId'] == 'refuseMe') {
+          final intentJson =
+              utf8.decode(base64Decode(args['intentBytes'] as String));
+          if (intentJson.contains('"directiveId":"refuseMe"')) {
             _incoming.add({
               'v': kWebviewBridgeVersion,
               'id': id,
@@ -50,12 +52,9 @@ class FakeRunner implements BridgeTransport {
               'error': 'the law refused this intent'
             });
           } else {
-            _incoming.add(reply({'head': 'HEAD-${args['directiveId']}'}));
+            _incoming.add(reply({'head': 'HEAD-offer'}));
           }
           break;
-        case 'deliverShare':
-          _incoming.add(reply({'head': 'HEAD-share'}));
-          break;
         case 'query':
           _incoming.add(reply({
             'rows': [
@@ -176,16 +175,8 @@ Future<Object?> _invoke(
           workspace: a['workspace'] as String,
           clientId: a['clientId'] as String?);
       return null;
-    case 'dispatch':
-      return b.dispatch(
-          domain: a['domain'] as String,
-          directiveId: a['directiveId'] as String,
-          payload: (a['payload'] as Map).cast<String, Object?>(),
-          domainHash: a['domainHash'] as String);
-    case 'deliverShare':
-      return b.deliverShare(
-          quote: (a['quote'] as Map).cast<String, Object?>(),
-          domainHash: a['domainHash'] as String);
+    case 'offer':
+      return b.offer(intentBytes: a['intentBytes'] as String);
     case 'query':
       return b.query(
           a['queryId'] as String, (a['params'] as Map).cast<String, Object?>());
@@ -207,8 +198,9 @@ Future<Object?> _invoke(
 /// What the corpus says the typed (unwrapped) return value should be, given the reply's `result`.
 Object? _expectedTyped(String op, Map<String, Object?> result) {
   switch (op) {
-    case 'dispatch':
-    case 'deliverShare':
+    case 'offer':
+      return result['head'];
+    case 'offer':
       return result['head'];
     case 'query':
     case 'queryById':
@@ -267,28 +259,29 @@ void main() {
     await bridge.ready.timeout(const Duration(seconds: 1));
   });
 
-  test('dispatch round-trips a typed head; args reach the runner verbatim',
+  test('offer round-trips a typed head; args reach the runner verbatim',
       () async {
     await bridge.ready;
-    final head = await bridge.dispatch(
-        domain: 'guestbook',
-        directiveId: 'signGuestbook',
-        payload: {'author': 'ada'},
-        domainHash: 'abc');
-    expect(head, 'HEAD-signGuestbook');
-    final req = runner.sent.firstWhere((m) => m['op'] == 'dispatch');
-    expect((req['args'] as Map)['payload'], {'author': 'ada'});
-    expect((req['args'] as Map)['domainHash'], 'abc');
+    final intentBytes = base64Encode(utf8.encode(jsonEncode({
+      'v': 2,
+      'intent': {
+        'domain': 'guestbook',
+        'directiveId': 'signGuestbook',
+        'payload': {'author': 'ada'},
+        'domainHash': 'abc'
+      }
+    })));
+    final head = await bridge.offer(intentBytes: intentBytes);
+    expect(head, 'HEAD-offer');
+    final req = runner.sent.firstWhere((m) => m['op'] == 'offer');
+    expect((req['args'] as Map)['intentBytes'], intentBytes);
   });
 
   test(
-      'connect / deliverShare / query / queryById / count / sync / lawStatus all wrap the runner',
+      'connect / query / queryById / count / sync / lawStatus all wrap the runner',
       () async {
     await bridge.ready;
     await bridge.connect(cloud: 'https://c', workspace: 'ws', clientId: 'c1');
-    expect(
-        await bridge.deliverShare(quote: {'publicKey': 'k'}, domainHash: 'h'),
-        'HEAD-share');
     expect((await bridge.query('byAuthor', {'author': 'ada'})).first['data'],
         {'q': 'byAuthor'});
     expect((await bridge.queryById('Entry_1')).first['id'], 'Entry_1');
@@ -356,8 +349,16 @@ void main() {
     await bridge.ready;
     Object? err;
     try {
-      await bridge.dispatch(
-          domain: 'x', directiveId: 'refuseMe', payload: {}, domainHash: 'h');
+      await bridge.offer(
+          intentBytes: base64Encode(utf8.encode(jsonEncode({
+        'v': 2,
+        'intent': {
+          'domain': 'x',
+          'directiveId': 'refuseMe',
+          'payload': {},
+          'domainHash': 'h'
+        }
+      }))));
     } on NomosBridgeError catch (e) {
       err = e;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.14.0",
+  "version": "0.16.0",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -11,8 +11,8 @@
   },
   "main": "src/index.ts",
   "bin": {
-    "nomos-compile": "./compile_package.mjs",
-    "holon-compile": "./compile_package.mjs"
+    "nomos-compile": "compile_package.mjs",
+    "holon-compile": "compile_package.mjs"
   },
   "exports": {
     ".": "./src/index.ts",
@@ -44,6 +44,8 @@
     "src",
     "!src/**/*.test.ts",
     "dart",
+    "!dart/.dart_tool",
+    "!dart/build",
     "compile_package.mjs"
   ],
   "publishConfig": {

package/src/aggregate.ts

@@ -144,6 +144,13 @@ export interface AggregateHandle<
   readonly hasInvariant?: true;
   /** The executable body — ships in the engine bundle, NOT the manifest. */
   readonly invariant?: AggregateInvariantFn;
+  /**
+   * THE DECLASSIFY WAIVER (nomosFlowGate rule 4): present iff the author acknowledged that this
+   * private aggregate's invariant refusal MAY correlate with a plaintext secret field. Rides the
+   * `nomosFlowGate` era key (replay-verified audit surface). Absent on a private+invariant
+   * aggregate ⇒ the flow gate refuses to compile (a secret-correlated refusal).
+   */
+  readonly invariantDeclassify?: string;
   /**
    * The LAW-DECLARED instance CAP (Jack's ruling: instance limits are DOMAIN POLICY,
    * never a fabric id-shape special case). `cap: 1` = at most one instance per
@@ -197,7 +204,7 @@ export interface AudienceMethods<Id extends string, F extends Record<string, Fie
 export function aggregate<const Id extends string, F extends Record<string, Field>>(
   id: Id,
   fields: F,
-  opts?: { invariant?: AggregateInvariantFn; cap?: number; visibility?: ReadVisibility },
+  opts?: { invariant?: AggregateInvariantFn; invariantDeclassify?: string; cap?: number; visibility?: ReadVisibility },
 ): AggregateHandle<Id, F> & AudienceMethods<Id, F> {
   const { stored, hasMany } = partitionFields(fields);
   if (opts?.cap !== undefined && (!Number.isInteger(opts.cap) || opts.cap < 1)) {
@@ -244,6 +251,7 @@ export function aggregate<const Id extends string, F extends Record<string, Fiel
     ...(opts?.invariant !== undefined
       ? { hasInvariant: true as const, invariant: opts.invariant }
       : {}),
+    ...(opts?.invariantDeclassify !== undefined ? { invariantDeclassify: opts.invariantDeclassify } : {}),
     ...(opts?.cap !== undefined ? { cap: opts.cap } : {}),
     ...(encryptedFields.length > 0 ? { encryptedFields } : {}),
     ...(metaFields.length > 0 ? { metaFields } : {}),

package/src/authoring.ts

@@ -26,6 +26,7 @@
 import type { AggregateHandle } from "./aggregate.js";
 import type { Field } from "./fields.js";
 import type { FieldOp, PlannedOp, PlannedEventMarker } from "./ops.js";
+import { endorsementOf } from "./principal_evidence.js";
 
 // ── the per-dispatch authoring sink — library state the engine never sees (NOT a side channel out of
 //    the sandbox; it is internal to the directive runtime, drained synchronously by `executeDirectiveToIntent`). ──
@@ -76,7 +77,15 @@ class Ref implements AggregateRef {
   }
   /** Emit a field op TARGETING THIS aggregate, stamped with this ref's marker (if any). */
   private emit(field: string, kind: FieldOp["kind"], extra: Partial<FieldOp>): void {
-    const op: FieldOp = { aggregateId: this.__id, aggregateType: this.__type, field, kind, ...extra };
+    // MATERIALISE PrincipalEvidence on the fluent surface too (the endorse model — security_model.md):
+    // `.set("owner", ctx.principal().asAttribution())` stores the RAW principal + records the endorsement
+    // so the discovery harvest + runtime witness see the flow, exactly as the typed `set()` does. A plain
+    // value passes through untouched.
+    const endorsement = "value" in extra ? endorsementOf(extra.value) : null;
+    const resolved: Partial<FieldOp> = endorsement
+      ? { ...extra, value: endorsement.principal, endorsement: { facet: endorsement.facet, reason: endorsement.reason } }
+      : extra;
+    const op: FieldOp = { aggregateId: this.__id, aggregateType: this.__type, field, kind, ...resolved };
     sink.push(this.marker ? { ...op, marker: this.marker } : op);
   }
   set(field: string, value: unknown): this {

package/src/build_package.ts

@@ -157,7 +157,7 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   const aggregates = [...byId.values()];
   const directiveIds = new Set(directives.map((d) => d.id));
   for (const task of spec.impureCapabilities ?? []) {
-    for (const directive of [task.order, task.complete, task.fail, task.block, task.deadLetter]) {
+    for (const directive of [task.obligation, task.complete, task.fail, task.block, task.deadLetter]) {
       if (!directiveIds.has(directive.id)) {
         throw new Error(
           `domain '${spec.domain ?? spec.name}' declares impureCapability '${task.aggregate.id}' ` +

package/src/capability_exports.ts

@@ -16,7 +16,7 @@
  * properties — invisible to those walks. This helper, applied at each plane's
  * merge point (the engine lump's `mergeModules`, the package composer's merge,
  * the compile CLI's merge), ADDS the bundle's pieces to the exports bag under
- * synthetic names (`<export>$aggregate`, `<export>$order`, …) so every
+ * synthetic names (`<export>$aggregate`, `<export>$obligation`, …) so every
  * existing shape-walk discovers them with ZERO new walk semantics. The
  * original bundle export stays (config-named lanes still resolve it); the
  * walks ignore its unmatched shape exactly as before.
@@ -34,7 +34,7 @@ export function isCapabilityDecl(v: unknown): v is Record<string, unknown> {
   );
 }
 
-const PIECES = ["aggregate", "order", "complete", "fail", "block", "deadLetter", "tasks"] as const;
+const PIECES = ["aggregate", "obligation", "complete", "fail", "block", "deadLetter", "tasks"] as const;
 
 /**
  * Expand every `capability()` bundle in an exports bag into discoverable