@githolon/dsl 0.78.0 → 0.79.0

package/dart/CHANGELOG.md

@@ -1,3 +1,13 @@
+## 0.54.1
+
+- **Fix: principal normalization mismatch in signer recovery** — enrollment wrote
+  `identity:user:<uid>#signer` (the kernel-canonical captured principal) while the posture/preflight
+  reads stripped `user:` and reported false `missing-signer-enrollment` immediately after a
+  successful repair. One canonical normalizer now routes every surface; co2's five-step acceptance
+  (repair → immediate enrolled:true → canAuthor ok → birth admits) is the regression test, with
+  `user:`-shaped principals, proven failing-then-passing. Typed authz diagnosis now also rides the
+  `createWorkspace` relay (no more generic 422).
+
 ## 0.54.0
 
 - **Parent-signer recovery** (the reborn-parent scar): `ensureParentSignerEnrollment(...)` —

package/dart/lib/src/webview_bridge.dart

@@ -48,7 +48,7 @@ const int kWebviewBridgeVersion = 1;
 /// pre-stamp bundle, which reports nothing) is a stale baked asset and fails loudly at boot.
 /// MUST move with the paired @githolon/client release — a release-hygiene test pairs it with the
 /// runner stamp (the pubspec-pins pattern).
-const String kExpectedRunnerBundleVersion = '0.78.0';
+const String kExpectedRunnerBundleVersion = '0.78.1';
 
 /// A STALE BAKED RUNNER BUNDLE: the app's built assets carry an older nomos-runner.js than this
 /// nomos_client release ships — Flutter's build cache kept it across a pub upgrade. Thrown from
@@ -1564,7 +1564,20 @@ class NomosBridge {
       throw await _wrapDomainNotInstalled(e,
           domain: domain, domainHash: domainHash, requestedWorkspace: parent);
     }
-    return (r['verdict'] as Map?)?.cast<String, Object?>() ?? r;
+    final verdict = (r['verdict'] as Map?)?.cast<String, Object?>() ?? r;
+    // STRUCTURED AUTHZ REFUSAL (co2 DX): a refused relay used to surface only the generic 422 body.
+    // The JS relay now classifies the kernel refusal into `nomos.authz.*` errorInfo — mint the SAME
+    // typed error the offerDirective lane throws ([ParentSignerEnrollmentMissing]/[AuthzRefusedError])
+    // so the app sees the diagnosis (actor/keyHash/object/relation/cause), not prose. Non-authz
+    // refusals keep the verdict-return contract unchanged.
+    if (verdict['ok'] == false) {
+      final info = verdict['errorInfo'];
+      final code = info is Map ? (info['code'] ?? '').toString() : '';
+      if (code.startsWith('nomos.authz.')) {
+        throw nomosErrorFromInfo(NomosErrorInfo.fromJson(info));
+      }
+    }
+    return verdict;
   }
 
   /// SHARE a workspace/record with a user — the one-call cross-custody grant that lands in their home's

package/dart/pubspec.lock

@@ -191,7 +191,7 @@ packages:
       path: "../dart_types"
       relative: true
     source: path
-    version: "0.4.0"
+    version: "0.4.1"
   package_config:
     dependency: transitive
     description:

package/dart/pubspec.yaml

@@ -11,7 +11,7 @@ description: >-
   Nomos 2 Dart frontend types — the hand-written kernel wire types plus the
   code-generated per-domain aggregate + directive-payload types. (De)serializes
   the EXACT serde JSON the Rust kernel + projection produce/consume.
-version: 0.54.0
+version: 0.54.1
 
 environment:
   sdk: ^3.5.0
@@ -20,7 +20,7 @@ dependencies:
   # The pure-data core (wire types, offer codec, NomosReads, schema validation, error
   # info). nomos_client depends on and re-exports it, so existing imports are unchanged.
   # For local monorepo dev, pubspec_overrides.yaml points this at ../dart_types.
-  nomos_types: ^0.4.0
+  nomos_types: ^0.4.1
   json_schema: ^5.2.2
   crypto: ^3.0.0
 

package/dart/test/parent_signer_recovery_test.dart

@@ -29,6 +29,11 @@ String get _runtimeDir => '${Platform.environment['HOME'] ?? ''}/.holon/runtime'
 
 const _ws = 'estate-birth-signed';
 const _uid = 'sample-owner';
+// THE co2 REGRESSION SHAPE: the principal arrives ALREADY `user:`-qualified (the captured-actor wire
+// form — exactly what NomosScope/co2 pass). KERNEL TRUTH: the gate checks
+// `identity:<captured principal VERBATIM>`, so every read/repair below must resolve the object to
+// `identity:user:<uid>` — a stripped `identity:<uid>` is the normalization bug this test pins.
+const _principal = 'user:$_uid';
 
 String? _missingPrereq() {
   if (!File(_repoEntry).existsSync()) return 'in-repo runner not found at $_repoEntry';
@@ -68,15 +73,16 @@ void main() {
 
       // 1. THE PREFLIGHT, broken state: the verdict names the failing premise BEFORE any authoring.
       final v0 = await session.canAuthor('birthEstateWorkspace',
-          ws: _ws, principal: _uid, publicKey: pub);
+          ws: _ws, principal: _principal, publicKey: pub);
       expect(v0['ok'], isNot(true));
       expect(v0['cause'], 'missing-signer-enrollment');
-      expect(v0['actor'], 'user:$_uid');
+      expect(v0['actor'], _principal,
+          reason: 'the canonical actor is the principal VERBATIM — never stripped, never double-prefixed');
       expect((v0['keyHash'] ?? '').toString(), hasLength(64));
 
       // ...and the TYPED variant throws the ONE error with the ONE remedy.
       await expectLater(
-        session.canAuthorTyped('birthEstateWorkspace', ws: _ws, principal: _uid, publicKey: pub),
+        session.canAuthorTyped('birthEstateWorkspace', ws: _ws, principal: _principal, publicKey: pub),
         throwsA(isA<ParentSignerEnrollmentMissing>()
             .having((e) => e.recommendedAction, 'recommendedAction',
                 NomosRecommendedAction.ensureParentSignerEnrollment)
@@ -85,15 +91,17 @@ void main() {
 
       // 2. THE POSTURE READ agrees (diagnostic; nothing authored).
       final posture0 = await session.parentSignerEnrollment(
-          parent: _ws, principal: _uid, publicKey: pub);
+          parent: _ws, principal: _principal, publicKey: pub);
       expect(posture0['enrolled'], false);
-      expect(posture0['object'], 'identity:$_uid');
+      // KERNEL TRUTH (executor::signer_object): the object is identity:<captured principal VERBATIM>
+      // — `identity:user:<uid>`, NOT a stripped `identity:<uid>` (the co2 normalization bug).
+      expect(posture0['object'], 'identity:$_principal');
       expect(posture0['relation'], 'signer');
 
       // 3. THE REPAIR — idempotent; the signing directive is DISCOVERED from the installed law
       //    (this fixture composes it under domain "home", NOT the framework "workspaces").
       final r1 = await session.ensureParentSignerEnrollment(
-          parent: _ws, principal: _uid, publicKey: pub, authorSecret: secret);
+          parent: _ws, principal: _principal, publicKey: pub, authorSecret: secret);
       expect(r1['enrolled'], true);
       expect(r1['repaired'], true);
       expect(r1['domain'], 'home',
@@ -101,15 +109,24 @@ void main() {
 
       // 4. Re-run = pure no-op (the idempotence contract).
       final r2 = await session.ensureParentSignerEnrollment(
-          parent: _ws, principal: _uid, publicKey: pub, authorSecret: secret);
+          parent: _ws, principal: _principal, publicKey: pub, authorSecret: secret);
       expect(r2['enrolled'], true);
       expect(r2['repaired'], false);
 
       // 5. The preflight flips OK…
       final v1 = await session.canAuthor('birthEstateWorkspace',
-          ws: _ws, principal: _uid, publicKey: pub);
+          ws: _ws, principal: _principal, publicKey: pub);
       expect(v1['ok'], true, reason: 'causes: ${v1['causes']}');
 
+      // 5b. co2's step-5 regression VERBATIM: immediately after repaired:true, the POSTURE read (with
+      // the SAME user:-qualified principal) reports enrolled:true against the canonical object.
+      final posture1 = await session.parentSignerEnrollment(
+          parent: _ws, principal: _principal, publicKey: pub);
+      expect(posture1['enrolled'], true,
+          reason: 'the repair wrote identity:$_principal — a second normalizer that strips user: '
+              'would read identity:$_uid and wrongly report missing-signer-enrollment');
+      expect(posture1['object'], 'identity:$_principal');
+
       // 6. …and the SIGNED sibling birth ADMITS (per-offer signing key — the repaired device).
       final lawHash = harness.lawHashes(_ws).first;
       final outcome = await session.offerCreates(

package/dart_types/CHANGELOG.md

@@ -1,3 +1,8 @@
+## 0.4.1
+
+- `canonicalPrincipal` / `signerObjectOf` — THE one principal normalizer (kernel truth:
+  `identity:<actor-verbatim>`, never stripped). All signer-recovery surfaces route through it.
+
 ## 0.4.0
 
 - Typed authorization diagnosis errors: `AuthzRefusedError` ({workspace, actor, keyHash, object,

package/dart_types/lib/src/principal.dart

@@ -54,3 +54,26 @@ class NomosDeviceSecret {
   @override
   String toString() => 'NomosDeviceSecret(***)';
 }
+
+/// THE ONE PRINCIPAL NORMALIZER (Dart surface — mirrors `@githolon/client` `canonicalPrincipal`).
+///
+/// KERNEL TRUTH (`executor/src/lib.rs::signer_object` + `verify_author_and_derive`): the
+/// authorization gate checks `identity:<captured principal VERBATIM>` where the captured principal
+/// is the actor string the offer presented (`user:<uid>` on every SDK lane). The kernel never strips
+/// or qualifies; neither may we. NEVER strip `user:`; qualify a bare auth-provider uid to
+/// `user:<uid>` exactly once, HERE. Every producer and consumer of `identity:*#signer` objects
+/// routes through this — a second normalizer is the bug (the co2 principal-normalization mismatch).
+///
+/// - `user:abc` → `user:abc` (verbatim)
+/// - `abc`      → `user:abc` (bare uid, qualified once)
+/// - any other namespaced subject (`key:<hash>`, …) rides verbatim
+/// - empty/whitespace → `''`
+String canonicalPrincipal(String? principal) {
+  final s = (principal ?? '').trim();
+  if (s.isEmpty) return '';
+  return s.contains(':') ? s : 'user:$s';
+}
+
+/// The Zanzibar OBJECT for a principal's signer relation — `identity:<canonical principal>`
+/// (mirrors `executor::signer_object` over the captured principal).
+String signerObjectOf(String? principal) => 'identity:${canonicalPrincipal(principal)}';

package/dart_types/pubspec.yaml

@@ -11,7 +11,7 @@ description: >-
   Pure kernel wire/data types for Nomos Dart frontends — no transport, no bridge,
   no runtime. The hand-written serde-JSON-compatible types plus the offer codec,
   reactive read engine, schema validation, and data-only error/trace types.
-version: 0.4.0
+version: 0.4.1
 
 environment:
   sdk: ^3.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.78.0",
+  "version": "0.79.0",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/build_package.ts

@@ -74,7 +74,7 @@ import { domainHash, emitManifestBytes } from "./manifest.js";
 import { collectValueObjectDescriptors } from "./value_object.js";
 import { emitUsd } from "./usd.js";
 import { expandCapabilityExports } from "./capability_exports.js";
-import { RelationTuple } from "./framework/relations.js";
+import { RelationTuple, relationTuplesByObject } from "./framework/relations.js";
 import { parentAttestedBirthMarker } from "./births.js";
 import { discoverUnsanctionedEnsures, sanctioningEnsureDirective } from "./secondary_ensure.js";
 import { assertIdOfLint } from "./idof_lint.js";
@@ -277,6 +277,21 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
     }
   }
   const relationTypes = [...(spec.relationTypes ?? [])];
+  // RELATION-USING LAW AUTO-COMPOSES ITS AUDIT READ (co2 recovery DX — same idiom as the meter
+  // queries above): a domain that declares relation law (a relation schema, a `.requires(...)` gated
+  // directive, or relate-family/signer directives ensuring RelationTuple) gets the framework's
+  // `relationTuplesByObject` query appended (dedup by id) so the signer-recovery lanes
+  // (parentSignerEnrollment / ensureParentSignerEnrollment / canAuthor) can read the tuples on any
+  // workspace running the law — no tenant re-export to forget. ERA/OMIT RULE: a relation-free domain
+  // appends nothing (byte-identical module/package); a relation-using one gains the query on its NEXT
+  // recompile (a named, additive hash move the #58 evolve gate admits silently).
+  const usesRelations =
+    relationTypes.length > 0 ||
+    directives.some((d) => (d as { requiresRelationGate?: unknown }).requiresRelationGate !== undefined) ||
+    directives.some((d) => d.aggregateId === RelationTuple.id);
+  if (usesRelations && !queries.some((q) => q.id === relationTuplesByObject.id)) {
+    queries.push(relationTuplesByObject);
+  }
   // FIRST-CLASS VALUE OBJECTS (value_object.ts): the deduped, sorted descriptors of every
   // named VO the domain's aggregates carry (transitive nested VOs included) — the input to
   // the additive `nomosValueObjects` USD key. Omit-when-empty (era rule): a VO-free domain's

package/src/compile_package_main.ts

@@ -70,6 +70,7 @@ import {
   isFrameworkDirective,
   isFrameworkQuery,
 } from "./framework/framework_aggregates.js";
+import { RelationTuple, relationTuplesByObject } from "./framework/relations.js";
 import { finishCount, type AnyCount } from "./count.js";
 import type { QueryDecl } from "./query.js";
 import type { SpatialDecl } from "./spatial.js";
@@ -924,11 +925,11 @@ const DART_TYPES_IMPORT = `import 'package:nomos_types/nomos_types.dart';`;
  *  just the floor generated code needs — a lagging pin forces tenants into dependency_overrides. */
 // 0.3.0: SurfacedValue<T>/SurfacedObservation/PendingConflictRow — generated Surfaced-field typing +
 //        the pendingConflicts read rows.
-const NOMOS_TYPES_DEP = "^0.4.0";
+const NOMOS_TYPES_DEP = "^0.4.1";
 // 0.48.x: session-bound clients (XClient.bind/NomosClientInterface/DomainClientSessionMismatch/
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
-const NOMOS_CLIENT_DEP = "^0.54.0";
+const NOMOS_CLIENT_DEP = "^0.54.1";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in dsl/dart/pubspec.yaml
 // and dsl/dart_types/pubspec.yaml — a Dart release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).
@@ -1588,6 +1589,26 @@ async function main(): Promise<void> {
         if (!haveQuery.has(q.id)) queries.push(q);
       }
     }
+    // RELATION-USING LAW AUTO-COMPOSES ITS AUDIT READ (co2 recovery DX, same idiom as the birth-meter
+    // queries above): any domain that declares relation law — a relation schema, a `.requires(...)`
+    // gated directive, or the signer/grant primitives (directives ensuring `RelationTuple`) — gets the
+    // framework's `relationTuplesByObject` query appended (dedup by id), so the recovery lanes
+    // (parentSignerEnrollment / ensureParentSignerEnrollment / canAuthor) can read the signer tuples
+    // on ANY workspace running that law without the tenant remembering the re-export. ERA/OMIT RULE:
+    // a domain with no relation law emits NOTHING new (byte-identical package); a relation-using
+    // domain's package/openapi gain one query on its NEXT recompile — a named, expected hash move
+    // (the stable-ids doctrine: recompiles move identity/package hashes; already-deployed artifacts
+    // are untouched, and a query add is additive so the #58 evolve gate admits it silently).
+    {
+      const dirsAll = directivesOf(merged);
+      const usesRelations =
+        dirsAll.some((dir) => (dir as { requiresRelationGate?: unknown }).requiresRelationGate !== undefined) ||
+        dirsAll.some((dir) => (dir as { aggregateId?: string }).aggregateId === RelationTuple.id) ||
+        discover<RelationTypeDecl>(merged, isRelationTypeDecl).length > 0;
+      if (usesRelations && !queries.some((q) => q.id === relationTuplesByObject.id)) {
+        queries.push(relationTuplesByObject);
+      }
+    }
     const counts = [
       ...discover<AnyCount>(merged, isCountDecl),
       ...resolveNamed<AnyCount>(merged, d.counts, "counts"),