@githolon/dsl 0.79.0 → 0.80.0

package/dart/CHANGELOG.md

@@ -1,3 +1,17 @@
+## 0.55.0
+
+- **Security: enrollSigner self-binds** (device can only enroll itself; cross-principal forgery closed
+  by construction, offline-secure). **Client lifecycle fixes** from the adversarial sweep: watches
+  survive LRU park/remount (realm-owned rebind registry — no more silent watch death), DLQ recovery
+  never drops salvage on offline/unborn planes, a failed connect leaves no phantom session, evicted
+  handles throw typed `nomos.session.disposed`, and `query()`/`queryById()` throw on a read-forbidden
+  verdict. Per-offer `authorSecret` threads to the signing path. Requires bundle >= 0.80.0.
+
+## 0.54.2
+
+- Runner-bundle floor -> 0.79.0 (the fixed-group npm lift; 0.54.1 was published mid-release with the
+  0.78.1 floor — runtime-equivalent, this aligns the published package with the paired bundle exactly).
+
 ## 0.54.1
 
 - **Fix: principal normalization mismatch in signer recovery** — enrollment wrote

package/dart/lib/src/webview_bridge.dart

@@ -48,7 +48,7 @@ const int kWebviewBridgeVersion = 1;
 /// pre-stamp bundle, which reports nothing) is a stale baked asset and fails loudly at boot.
 /// MUST move with the paired @githolon/client release — a release-hygiene test pairs it with the
 /// runner stamp (the pubspec-pins pattern).
-const String kExpectedRunnerBundleVersion = '0.78.1';
+const String kExpectedRunnerBundleVersion = '0.80.0';
 
 /// A STALE BAKED RUNNER BUNDLE: the app's built assets carry an older nomos-runner.js than this
 /// nomos_client release ships — Flutter's build cache kept it across a pub upgrade. Thrown from
@@ -1050,7 +1050,10 @@ class NomosBridge {
       String? session,
       int? maxMounted}) async {
     final ws = session ?? workspace;
-    _eventPlane._sessionNames.add(ws);
+    // Record the session name ONLY on a SUCCESSFUL open. Adding it before the await left a PHANTOM session
+    // behind on a failed connect (a corrupt restoreFrom, an unreachable cloud): acquireSession/follow fast-path
+    // on `_sessionNames.contains` and would hand back a dead handle whose every op refuses "session not
+    // connected", and ifAbsentCredentials would never fire. The `_call` throwing skips the add below.
     final r = _asMap(await _call('connect', {
       // [cloud] is OPTIONAL — omit it to open a LOCAL-ONLY workspace (a local githolon with no cloud
       // counterpart; the runner uses a `local://` sentinel and sync is a no-op). Pass it to make the
@@ -1077,6 +1080,7 @@ class NomosBridge {
       // fail closed (the break surfaces as an error on the sync/pull that hit it; the holon stays local).
       if (onCustodyBreak != null) 'onCustodyBreak': onCustodyBreak.wire,
     }));
+    _eventPlane._sessionNames.add(ws); // the open succeeded — the session is real now
     _eventPlane._lastRecovery = (r['recovery'] as Map?)?.cast<String, Object?>();
   }
 
@@ -1199,6 +1203,9 @@ class NomosBridge {
     List<Map<String, Object?>>? attestations,
     bool? force,
     String? session,
+    // Per-offer signing key (base64 device secret): sign THIS offer with a specific device key instead of
+    // the connect-time one (the runner maps it onto `opts.signWith`). Same contract as [offerOutcome].
+    String? authorSecret,
   }) async {
     final r = _asMap(await _call('offerDirective', {
       'domain': domain,
@@ -1209,6 +1216,7 @@ class NomosBridge {
       if (attestations != null) 'attestations': attestations,
       if (force != null) 'force': force,
       if (session != null) 'session': session,
+      if (authorSecret != null) 'authorSecret': authorSecret,
     }));
     return r['head'].toString();
   }

package/dart/pubspec.yaml

@@ -11,7 +11,7 @@ description: >-
   Nomos 2 Dart frontend types — the hand-written kernel wire types plus the
   code-generated per-domain aggregate + directive-payload types. (De)serializes
   the EXACT serde JSON the Rust kernel + projection produce/consume.
-version: 0.54.1
+version: 0.55.0
 
 environment:
   sdk: ^3.5.0

package/dart/test/adv_realm_interference_test.dart

@@ -0,0 +1,469 @@
+// ADVERSARIAL FINDER — MULTI-WORKSPACE REALM INTERFERENCE (one engine, many sessions).
+// Hammers the cross-session seams of the local holarchy plane (co2's production shape: a
+// dozen+ live workspaces, mixed laws) through the REAL runner + REAL kernel, fully offline:
+//   1. concurrent offers to different sessions (no cross-chain bleed, independent heads)
+//   2. watches on A while B floods (no tick bleed / starvation, per-subscription ordering)
+//   3. acquireSession racing a FAILED connect (the phantom-session window)
+//   4. pendingConflicts/activityLog isolation across same-named queries / sibling floods
+//   5. session re-connect (atomic replace) during in-flight offers — nothing hangs, typed only
+//   6. born child resident-then-session — one consistent view
+//   7. error isolation — one session's refusal never poisons siblings
+//   8. runner-level LRU (maxMounted) — watch survival + state preservation across park/remount
+//
+// A FAILING expectation here is a FINDING (evidence of a seam bug), not necessarily a
+// regression gate. Timing assertions use generous CI margins.
+@TestOn('vm')
+@Timeout(Duration(minutes: 12))
+library;
+
+import 'dart:async';
+import 'dart:convert';
+import 'dart:io';
+
+import 'package:nomos_client/nomos_headless.dart';
+import 'package:nomos_types/nomos_types.dart' show NomosRef;
+import 'package:test/test.dart';
+
+String get _root => '${Directory.current.path}/../..';
+String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.mjs';
+String get _installer => '$_root/cloud/web-client/runner/offline-install.mjs';
+String get _guestbook => '$_root/examples/guestbook/build/guestbook.deploy.json';
+String get _surfaced => '$_root/bench/scale/fixtures/surfaced/build/surfaced.deploy.json';
+String get _attributed => '$_root/bench/scale/fixtures/attributed/build/attributed.deploy.json';
+String get _estateBirth => '$_root/bench/scale/fixtures/estate-birth/build/estate-birth.deploy.json';
+String get _runtimeDir => '${Platform.environment['HOME'] ?? ''}/.holon/runtime';
+
+String? _missingPrereq() {
+  for (final p in [_repoEntry, _installer, _guestbook, _surfaced, _attributed, _estateBirth]) {
+    if (!File(p).existsSync()) return 'missing $p (compile the fixture / example first)';
+  }
+  if (!File('$_runtimeDir/holon.wasm').existsSync() ||
+      !File('$_runtimeDir/packages.json').existsSync()) {
+    return 'warm ~/.holon/runtime first (run any `githolon` command once)';
+  }
+  return null;
+}
+
+String _nowIso() => DateTime.now().toUtc().toIso8601String();
+
+Future<String> _sign(NomosSession s, String author, String message) =>
+    s.offerDirective(
+        domain: 'guestbook',
+        directiveId: 'signGuestbook',
+        payload: {'author': author, 'message': message, 'mood': 'delighted', 'signedAt': _nowIso()},
+        actor: author);
+
+void main() {
+  final skip = _missingPrereq();
+
+  group('shared cluster (6 workspaces, mixed laws)', () {
+    late NomosTestHarness harness;
+    late NomosBridge plane;
+
+    setUpAll(() async {
+      if (skip != null) return;
+      harness = await NomosTestHarness.cluster(
+        workspaces: {
+          'home-birth': [_estateBirth],
+          'surf': [_surfaced],
+          'attr': [_attributed],
+          'gb-1': [_guestbook],
+          'gb-2': [_guestbook],
+          'gb-3': [_guestbook],
+        },
+        nodeEntry: _repoEntry,
+        runtimeDir: _runtimeDir,
+      );
+      plane = harness.bridge;
+    });
+
+    tearDownAll(() async {
+      if (skip != null) return;
+      await harness.dispose();
+    });
+
+    test('1. concurrent offers to different sessions: no cross-chain bleed, independent heads',
+        () async {
+      if (skip != null) return markTestSkipped(skip);
+      const gbs = ['gb-1', 'gb-2', 'gb-3'];
+      final sw = Stopwatch()..start();
+      final futs = <Future<Object?>>[
+        for (final ws in gbs)
+          for (var i = 0; i < 4; i++) _sign(harness.session(ws), 'author-$ws', 'm$i'),
+        for (var i = 0; i < 4; i++)
+          harness.session('surf').offerDirective(
+              domain: 'docs',
+              directiveId: 'createDoc',
+              payload: {'owner': 'owner-surf', 'title': 'doc-$i'},
+              actor: 'owner-surf'),
+        for (var i = 0; i < 4; i++)
+          harness.session('attr').offerDirective(
+              domain: 'sites',
+              directiveId: 'createSite',
+              payload: {'owner': 'owner-attr', 'name': 'site-$i'},
+              actor: 'owner-attr'),
+      ];
+      final heads = await Future.wait(futs); // 20 concurrent offers across 5 sessions
+      sw.stop();
+      expect(heads, everyElement(isNotNull));
+      // ack latency stays sane under concurrency (generous CI margin)
+      expect(sw.elapsed, lessThan(const Duration(seconds: 90)),
+          reason: '20 concurrent offers should settle well under 90s');
+
+      // each chain holds ONLY its own writes
+      for (final ws in gbs) {
+        final mine = await harness.session(ws).query('entriesByAuthor', {'author': 'author-$ws'});
+        expect(mine, hasLength(4), reason: '$ws holds its own 4 writes');
+        for (final other in gbs.where((o) => o != ws)) {
+          final theirs =
+              await harness.session(ws).query('entriesByAuthor', {'author': 'author-$other'});
+          expect(theirs, isEmpty, reason: "$ws must not hold $other's writes (cross-session bleed)");
+        }
+      }
+      expect(await harness.session('surf').query('docsByOwner', {'owner': 'owner-surf'}),
+          hasLength(4));
+      expect(await harness.session('attr').query('sitesByOwner', {'owner': 'owner-attr'}),
+          hasLength(4));
+
+      // heads are independent per session
+      final tips = <String>{};
+      for (final ws in [...gbs, 'surf', 'attr']) {
+        tips.add(await harness.session(ws).head());
+      }
+      expect(tips, hasLength(5), reason: 'every session has its own ledger tip');
+    });
+
+    test('2. a watch on session A fires while session B floods (no starvation, no bleed, ordered)',
+        () async {
+      if (skip != null) return markTestSkipped(skip);
+      final a = harness.session('gb-1');
+      final b = harness.session('gb-2');
+      final idle = harness.session('attr');
+
+      final emissionsA = <int>[];
+      final emissionsIdle = <int>[];
+      final subA = a.watch('entriesByAuthor', {'author': 'watched'}).listen(
+          (rows) => emissionsA.add(rows.length));
+      final subIdle = idle.watch('sitesByOwner', {'owner': 'nobody-here'}).listen(
+          (rows) => emissionsIdle.add(rows.length));
+      await Future<void>.delayed(const Duration(milliseconds: 600)); // initial emissions
+      final idleBase = emissionsIdle.length;
+
+      // B floods 25 writes while A takes 3 interleaved writes
+      final flood = () async {
+        for (var i = 0; i < 25; i++) {
+          await _sign(b, 'flooder', 'f$i');
+        }
+      }();
+      final aWrites = () async {
+        for (var i = 0; i < 3; i++) {
+          await Future<void>.delayed(const Duration(milliseconds: 60));
+          await _sign(a, 'watched', 'w$i');
+        }
+      }();
+      await Future.wait([flood, aWrites]);
+
+      // A's watch must reach 3 rows promptly despite the sibling flood (generous margin)
+      final deadline = DateTime.now().add(const Duration(seconds: 15));
+      while (DateTime.now().isBefore(deadline) &&
+          (emissionsA.isEmpty || emissionsA.last < 3)) {
+        await Future<void>.delayed(const Duration(milliseconds: 150));
+      }
+      await subA.cancel();
+      await subIdle.cancel();
+      expect(emissionsA.isNotEmpty && emissionsA.last == 3, isTrue,
+          reason: "A's watch starved or missed rows under B's flood: $emissionsA");
+      for (var i = 1; i < emissionsA.length; i++) {
+        expect(emissionsA[i], greaterThanOrEqualTo(emissionsA[i - 1]),
+            reason: 'per-subscription ordering must be monotonic: $emissionsA');
+      }
+      expect(emissionsIdle.length, idleBase,
+          reason: "the idle sibling watch got spurious emissions from B's flood: $emissionsIdle");
+    });
+
+    test('3a. follow(ref) + racing acquireSession during a sibling offer flood', () async {
+      if (skip != null) return markTestSkipped(skip);
+      final flood = () async {
+        for (var i = 0; i < 10; i++) {
+          await _sign(harness.session('gb-3'), 'race-flood', 'f$i');
+        }
+      }();
+      // follow an already-open sibling mid-flood → same handle, functional
+      final followed = await plane
+          .follow(NomosRef(workspace: 'gb-1', type: 'nomos.Workspace', id: 'gb-1'));
+      expect(followed.workspace, 'gb-1');
+      expect(await followed.query('entriesByAuthor', {'author': 'nobody'}), isEmpty);
+
+      // concurrent acquireSession single-flights to the SAME handle
+      final pair = await Future.wait([
+        plane.acquireSession('gb-2'),
+        plane.acquireSession('gb-2'),
+      ]);
+      expect(identical(pair[0], pair[1]), isTrue,
+          reason: 'two concurrent acquireSession calls must yield the same session');
+      await flood;
+    });
+
+    test('3b. FINDER: a FAILED connect must not leave a phantom session acquireSession trusts',
+        () async {
+      if (skip != null) return markTestSkipped(skip);
+      // a garbage restoreFrom makes the runner's connect throw AFTER the Dart bridge has
+      // (prematurely?) registered the session name on the plane.
+      Object? err;
+      try {
+        await plane.connect(
+            workspace: 'phantom-ws', session: 'phantom-ws', restoreFrom: '%%%not-base64%%%');
+      } catch (e) {
+        err = e;
+      }
+      expect(err, isNotNull, reason: 'the corrupt-restore connect must throw');
+
+      // CORRECT behavior: acquireSession must either ask for credentials, throw a named
+      // StateError, or return a session whose ops actually work. Returning a handle whose
+      // every op refuses "session not connected" is the phantom-session bug.
+      var credentialsAsked = false;
+      Object? acquireOutcome;
+      try {
+        final s = await plane.acquireSession('phantom-ws', ifAbsentCredentials: () async {
+          credentialsAsked = true;
+          throw StateError('credentials path taken (correct) — stop here');
+        });
+        // it returned a session: its ops must work, else it's a dead phantom handle
+        await s.query('entriesByAuthor', {'author': 'x'});
+        acquireOutcome = 'live session';
+      } catch (e) {
+        acquireOutcome = e;
+      }
+      final phantom = !credentialsAsked &&
+          acquireOutcome is! StateError &&
+          acquireOutcome != 'live session';
+      expect(phantom, isFalse,
+          reason: 'PHANTOM SESSION: after a failed connect, acquireSession("phantom-ws") '
+              'returned a dead handle (ops refuse) without asking for credentials — '
+              'observed: $acquireOutcome');
+    });
+
+    test('4. pendingConflicts/activityLog on A are unaffected by B (same-named queries isolated)',
+        () async {
+      if (skip != null) return markTestSkipped(skip);
+      final surf = harness.session('surf');
+      final before = await surf.pendingConflicts();
+
+      // sibling activity: a guestbook flood + surfaced-relevant field writes on ANOTHER session's law
+      for (var i = 0; i < 10; i++) {
+        await _sign(harness.session('gb-1'), 'iso-flood', 'f$i');
+      }
+      final after = await surf.pendingConflicts();
+      expect(after, equals(before),
+          reason: "surf's pendingConflicts moved on a sibling's writes (cache/key bleed)");
+
+      // activityLog rows belong to the session's OWN chain only
+      final actGb2 = await harness.session('gb-2').activityLog(limit: 100);
+      final foreign = actGb2.where((r) =>
+          r['directiveId'] == 'createSite' ||
+          r['directiveId'] == 'createDoc' ||
+          (r['payload'] is Map && (r['payload'] as Map)['author'] == 'iso-flood'));
+      expect(foreign, isEmpty,
+          reason: "gb-2's activityLog carries sibling-session intents: ${foreign.toList()}");
+
+      // the SAME query id with the SAME params on two sessions answers per-session
+      final q1 = await harness.session('gb-1').query('entriesByAuthor', {'author': 'iso-flood'});
+      final q2 = await harness.session('gb-2').query('entriesByAuthor', {'author': 'iso-flood'});
+      expect(q1, hasLength(10));
+      expect(q2, isEmpty,
+          reason: 'same-named query with same params leaked rows across sessions (cache keying)');
+    });
+
+    test('5. re-connect (atomic replace) during in-flight offers: everything settles typed',
+        () async {
+      if (skip != null) return markTestSkipped(skip);
+      final s = harness.session('gb-3');
+      // fire 10 offers WITHOUT awaiting, then immediately replace the session (new clientId
+      // → identity change → dispose-then-connect under the hood)
+      final futs = [
+        for (var i = 0; i < 10; i++)
+          _sign(s, 'replace-race', 'r$i').then<Object?>((h) => 'ok:$h', onError: (Object e) => e)
+      ];
+      await plane.connect(workspace: 'gb-3', session: 'gb-3', clientId: 'replacer-1');
+
+      final settled = await Future.wait(futs).timeout(const Duration(seconds: 60),
+          onTimeout: () =>
+              throw StateError('offers in flight across an atomic replace HUNG (never settled)'));
+      // every outcome is either an admitted head or a TYPED error — never a hang, never null
+      for (final r in settled) {
+        expect(r, isNotNull);
+        if (r is! String) {
+          expect(r, isA<Exception>(), reason: 'a race loser must fail typed, got: $r');
+        }
+      }
+
+      // the replaced session is consistent: chain verifies, reads serve, writes admit
+      final v = await harness.session('gb-3').verifyChain();
+      expect(v['valid'], isTrue,
+          reason: 'in-flight offers interleaved with the atomic replace corrupted the chain: $v');
+      final admitted = settled.whereType<String>().length;
+      final rows =
+          await harness.session('gb-3').query('entriesByAuthor', {'author': 'replace-race'});
+      expect(rows.length, admitted,
+          reason: '$admitted offers acked ok but ${rows.length} rows visible after the replace '
+              '(an acked write was lost or duplicated across the replace window)');
+      await _sign(harness.session('gb-3'), 'post-replace', 'alive');
+      expect(await harness.session('gb-3').query('entriesByAuthor', {'author': 'post-replace'}),
+          hasLength(1));
+      // siblings untouched by gb-3's replace
+      expect(await harness.session('gb-1').query('entriesByAuthor', {'author': 'nobody'}), isEmpty);
+    });
+
+    test('6. born child resident-then-session: one consistent view, replace-safe', () async {
+      if (skip != null) return markTestSkipped(skip);
+      final fw = harness.frameworkHash;
+      final law = harness.lawHashes('home-birth').first;
+      final outcome = await harness.session('home-birth').offerCreates(
+        domain: 'home',
+        directiveId: 'birthEstateWorkspace',
+        payload: {
+          'owner': 'adv-owner',
+          'frameworkHash': fw,
+          'lawHash': law,
+          'bornAt': _nowIso(),
+        },
+        actor: 'adv-owner',
+      );
+      expect(outcome.born, hasLength(1));
+      expect(outcome.birthOutcomes.first['status'], 'born');
+      final child = outcome.born.single;
+
+      // the child is resident BEFORE any session opens it — listWorkspaces sees it
+      final listedPre = await plane.listWorkspaces();
+      expect(listedPre.map((w) => w['workspace']), contains(child),
+          reason: 'a born child is resident on the plane before it is connected');
+
+      // open it as a session (mount in place) and read the genesis seed
+      await plane.connect(workspace: child, session: child);
+      final rows1 = await plane.session(child).query('estatesByOwner', {'owner': 'adv-owner'});
+      expect(rows1, hasLength(1));
+
+      // write into the child, then RE-open it with a new clientId (identity replace on a
+      // born-resident workspace) — the write must survive (one holon's truth, not two)
+      await plane.session(child).offerDirective(
+          domain: 'estate',
+          directiveId: 'renameEstate',
+          payload: {'estateName': child, 'newName': 'renamed'},
+          actor: 'adv-owner').catchError((Object _) => ''); // directive may not exist — best-effort
+      await _noThrow(() => plane.connect(workspace: child, session: child, clientId: 'child-re'));
+      final rows2 = await plane.session(child).query('estatesByOwner', {'owner': 'adv-owner'});
+      expect(rows2, hasLength(1),
+          reason: 're-opening a born-resident child must present the SAME holon truth');
+
+      // the parent is unaffected
+      expect(
+          await plane.session('home-birth').verifyChain().then((v) => v['valid']), isTrue);
+    });
+
+    test('7. error isolation: a refusal on one session never poisons siblings', () async {
+      if (skip != null) return markTestSkipped(skip);
+      // unknown directive → typed refusal
+      await expectLater(
+          harness.session('gb-1').offerDirective(
+              domain: 'guestbook', directiveId: 'noSuchDirective', payload: {'x': 1}),
+          throwsA(anything));
+      // schema-violating payload → typed refusal
+      await expectLater(
+          harness.session('attr').offerDirective(
+              domain: 'sites', directiveId: 'createSite', payload: {'owner': '', 'name': ''}),
+          throwsA(anything));
+      // unknown query → typed refusal, not a hang
+      await expectLater(
+          harness.session('surf').query('noSuchQuery', {'k': 'v'}), throwsA(anything));
+
+      // every sibling still serves reads AND admits writes
+      for (final ws in ['gb-1', 'gb-2', 'gb-3', 'surf', 'attr', 'home-birth']) {
+        final h = await harness.session(ws).head();
+        expect(h, isNotEmpty, reason: '$ws must still answer after a sibling refusal');
+      }
+      await _sign(harness.session('gb-2'), 'healthy', 'still-alive');
+      expect(await harness.session('gb-2').query('entriesByAuthor', {'author': 'healthy'}),
+          hasLength(1));
+    });
+  });
+
+  group('runner-level LRU (maxMounted: 2)', () {
+    test('8. FINDER: watches + session state across LRU park/remount', () async {
+      if (skip != null) return markTestSkipped(skip);
+      final workdir = await Directory.systemTemp.createTemp('adv-lru-');
+      NodeRunnerTransport? transport;
+      try {
+        // build 3 guestbook snapshots via the proven offline install lane
+        final snaps = <String, String>{};
+        for (final ws in ['lru-1', 'lru-2', 'lru-3']) {
+          final out = '${workdir.path}/$ws.bin';
+          final r = await Process.run('node', [
+            _installer, '--deploy', _guestbook, '--workspace', ws, '--out', out,
+            '--runtime', _runtimeDir,
+          ]);
+          expect(r.exitCode, 0, reason: 'offline install of $ws failed: ${r.stderr}');
+          snaps[ws] = base64Encode(await File(out).readAsBytes());
+        }
+        transport = await NodeRunnerTransport.start(
+            entry: _repoEntry, node: 'node', environment: {'NOMOS_OFFLINE': '1'});
+        final bridge = NomosBridge(transport);
+        await bridge.ready.timeout(const Duration(seconds: 30));
+
+        // FIRST connect fixes the realm budget: maxMounted 2
+        await bridge.connect(
+            workspace: 'lru-1', session: 'lru-1', restoreFrom: snaps['lru-1'],
+            allowUnborn: true, maxMounted: 2);
+        final s1 = bridge.session('lru-1');
+        await _sign(s1, 'survivor', 'before-eviction'); // un-synced local write
+
+        final emissions = <int>[];
+        Object? watchError;
+        final sub = s1.watch('entriesByAuthor', {'author': 'survivor'}).listen(
+            (rows) => emissions.add(rows.length),
+            onError: (Object e) => watchError = e);
+        await Future<void>.delayed(const Duration(milliseconds: 800));
+        expect(emissions.isNotEmpty && emissions.last == 1, isTrue,
+            reason: 'precondition: the watch saw the pre-eviction row: $emissions');
+
+        // mount two more workspaces → lru-1 is LRU-evicted (parked)
+        await bridge.connect(
+            workspace: 'lru-2', session: 'lru-2', restoreFrom: snaps['lru-2'], allowUnborn: true);
+        await bridge.connect(
+            workspace: 'lru-3', session: 'lru-3', restoreFrom: snaps['lru-3'], allowUnborn: true);
+        final listed = await bridge.listWorkspaces();
+        final l1 = listed.firstWhere((w) => w['workspace'] == 'lru-1');
+        expect(l1['parked'], isTrue, reason: 'lru-1 should be LRU-parked: $listed');
+
+        // (a) session ops transparently remount from the parked snapshot, state intact
+        final rows = await s1.query('entriesByAuthor', {'author': 'survivor'});
+        expect(rows, hasLength(1),
+            reason: 'the un-synced local write must survive the park/remount cycle');
+
+        // (b) the watch must SURVIVE the eviction+remount (or at least error TYPED —
+        //     a silently-dead stream is the bug)
+        await _sign(s1, 'survivor', 'after-remount');
+        final deadline = DateTime.now().add(const Duration(seconds: 10));
+        while (DateTime.now().isBefore(deadline) &&
+            (emissions.isEmpty || emissions.last < 2) &&
+            watchError == null) {
+          await Future<void>.delayed(const Duration(milliseconds: 200));
+        }
+        await sub.cancel();
+        final died = (emissions.isEmpty || emissions.last < 2) && watchError == null;
+        expect(died, isFalse,
+            reason: 'SILENT WATCH DEATH: the lru-1 watch stopped emitting after an LRU '
+                'eviction+remount, with NO error event — emissions=$emissions '
+                '(a Flutter app bound to this stream shows stale data forever)');
+      } finally {
+        try { await transport?.dispose(); } catch (_) {}
+        try { await workdir.delete(recursive: true); } catch (_) {}
+      }
+    });
+  });
+}
+
+Future<void> _noThrow(Future<void> Function() fn) async {
+  try {
+    await fn();
+  } catch (_) {}
+}

package/dart/test/webview_bridge_test.dart

@@ -349,6 +349,52 @@ void main() {
     });
   });
 
+  // ── #9 — a per-offer authorSecret reaches the runner op (so the runner maps it onto opts.signWith → the
+  // author path signs THIS offer with the intended enrolled key, not the connect-time one). Both offer lanes. ──
+  group('per-offer authorSecret threads to the runner op (#9)', () {
+    test('offerOutcome carries authorSecret to the runner op args', () async {
+      final transport =
+          ReplayTransport({'head': 'H1', 'created': <Object?>[], 'workspace': 'ws'});
+      final bridge = NomosBridge(transport);
+      await bridge.ready;
+      await bridge.offerOutcome(
+          domain: 'home',
+          directiveId: 'writeNote',
+          payload: {'author': 'ada'},
+          authorSecret: 'ENROLLED-KEY-B64');
+      final args = (transport.lastRequest!['args'] as Map).cast<String, Object?>();
+      expect(transport.lastRequest!['op'], 'offerDirective');
+      expect(args['authorSecret'], 'ENROLLED-KEY-B64',
+          reason: 'the per-offer signing key must reach the runner op (→ opts.signWith)');
+      await bridge.dispose();
+    });
+
+    test('offerDirective carries authorSecret to the runner op args', () async {
+      final transport = ReplayTransport({'head': 'H1'});
+      final bridge = NomosBridge(transport);
+      await bridge.ready;
+      await bridge.offerDirective(
+          domain: 'home',
+          directiveId: 'writeNote',
+          payload: {'author': 'ada'},
+          authorSecret: 'ENROLLED-KEY-B64');
+      final args = (transport.lastRequest!['args'] as Map).cast<String, Object?>();
+      expect(args['authorSecret'], 'ENROLLED-KEY-B64');
+      await bridge.dispose();
+    });
+
+    test('no authorSecret ⇒ the op omits it (byte-identical to the pre-#9 contract)', () async {
+      final transport = ReplayTransport({'head': 'H1', 'created': <Object?>[], 'workspace': 'ws'});
+      final bridge = NomosBridge(transport);
+      await bridge.ready;
+      await bridge.offerOutcome(
+          domain: 'home', directiveId: 'writeNote', payload: {'author': 'ada'});
+      final args = (transport.lastRequest!['args'] as Map).cast<String, Object?>();
+      expect(args.containsKey('authorSecret'), isFalse);
+      await bridge.dispose();
+    });
+  });
+
   late FakeRunner runner;
   late NomosBridge bridge;
   setUp(() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.79.0",
+  "version": "0.80.0",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/build_package.ts

@@ -411,6 +411,10 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   // narrow scope. Compile-time only, no manifest/wire/hash effect.
   assertIdOfLint(directives, spec.domain ?? spec.name);
 
+  // (NO signer-placement guard — `enrollSigner` now SELF-BINDS to `ctx.principal()`, so composing it into a
+  // tenant domain cannot forge a signer for another principal; the cross-principal-forge surface the guard
+  // closed is dissolved by construction. See `dsl/src/framework/signing_identity.ts::enrollSigner`.)
+
   // THE SURFACED-RESOLVER LINT (surfaced_lint.ts — the fail-closed teeth): every
   // `.merge(Surfaced(...))` field must have EXACTLY ONE `.resolves()` directive, whose plan
   // provably set()s the field from a payload field. Returns the resolver bindings the typed

package/src/codegen_dart.ts

@@ -264,6 +264,34 @@ export function introspectPayload(
   return out;
 }
 
+/**
+ * The aggregate ids a directive set references via `idOf(Agg)` in its TOP-LEVEL payload fields
+ * (dart_codegen_parity.md P2). A cross-domain `idOf` types the field as the sibling domain's typed
+ * id class (`ListingId`) — which lives in the OWNING domain's generated file, so the referencing
+ * domain's file must import it (flat: a relative `<domain>.dart`; layered: the sibling TYPES file).
+ * Returns EVERY idOf target (same- and cross-domain); the caller filters to the cross-domain ones it
+ * must import (a same-domain target's id class is declared locally). Nullable/optional-wrapped
+ * idOf fields are unwrapped by `idOfMetaOf`.
+ */
+export function collectPayloadIdOfTargets(directives: readonly { payloadSchema?: z.ZodTypeAny }[]): Set<string> {
+  const out = new Set<string>();
+  for (const d of directives) {
+    const schema = d.payloadSchema;
+    if (schema === undefined || zodTypeName(schema) !== "ZodObject") continue;
+    let shape: Record<string, z.ZodTypeAny>;
+    try {
+      shape = zodObjectShape(schema);
+    } catch {
+      continue;
+    }
+    for (const zt of Object.values(shape)) {
+      const target = idOfMetaOf(zt as z.ZodTypeAny);
+      if (target !== undefined) out.add(target);
+    }
+  }
+  return out;
+}
+
 /** Introspect ONE (already-unwrapped) Zod field into its Dart spec. Handles the
  * four shapes a tenant domain uses: scalar (string/int/bool), enum, string[], and a
  * NESTED object (e.g. attach/detach's `target:{targetType,targetId}`) — the engine

package/src/codegen_dart_client.ts

@@ -153,6 +153,15 @@ export interface DartBridgeClientOptions {
    * whose refs are all same-domain / foreign is byte-identical to before this existed.
    */
   readonly packageAggregateDomains?: Readonly<Record<string, { domain: string; name: string }>>;
+  /**
+   * LAYERED-PACKAGES `barrelExports: 'explicit'` MODE: the full package URIs of the per-domain TYPES
+   * files this client references (e.g. `package:advl_types/src/generated/estate.dart`). Under 'explicit'
+   * the types-package barrel ({@link typesImportUri}) does NOT flat-export per-domain aggregate/read-model/
+   * payload classes, so the client's references (read models, payloads, ref extensions, typed ids, birth
+   * payloads) would be undefined through the barrel alone — it must import the defining domain files
+   * directly. Empty/omitted ⇒ the barrel carries everything (the 'all' / flat path, byte-identical).
+   */
+  readonly explicitTypeImports?: readonly string[];
 }
 
 /** Generate the `<name>.client.dart` async bridge client for one domain module. */
@@ -732,6 +741,10 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
     // Layered-packages mode: the sibling types live in their OWN package — one barrel import
     // replaces both the relative types import and the relative framework import.
     ...(opts.typesImportUri !== undefined ? [`import '${opts.typesImportUri}';`] : [`import '${mod.name}.dart';`]),
+    // EXPLICIT-BARREL layered mode: the types barrel withholds per-domain classes, so import the defining
+    // per-domain TYPES files directly (this domain's own + any sibling whose classes this client names).
+    // The client header already `ignore_for_file: unused_import`, so an over-broad set is harmless.
+    ...(opts.explicitTypeImports ?? []).map((uri) => `import '${uri}';`),
     // ACTIVITY FEED (flat mode): the shared pure `renderActivity` lives in the sibling `activity_registry.dart`
     // (in layered mode it resolves through the types-package barrel above). Only when the package opts in.
     ...(opts.emitActivity === true && opts.activityImportUri !== undefined ? [`import '${opts.activityImportUri}';`] : []),

package/src/compile_package_main.ts

@@ -58,6 +58,7 @@ import {
   generateDartContracts,
   generateDartActivityRegistry,
   collectActivityDescriptors,
+  collectPayloadIdOfTargets,
   type DartImport,
   type DartRefImport,
   type DomainModule,
@@ -693,6 +694,7 @@ function emitDart(
   names?: Readonly<Record<string, string>>,
 ): string[] {
   const domainSources: string[] = []; // for flat-mode alias validation (dart.names)
+  const sourceByFile = new Map<string, string>(); // fileBase → src, for precise alias-import selection
   const genDir = path.join(dartOut, DART_GENERATED_SUBDIR);
   removeLegacyFlatDartLayout(dartOut, modules.map((m) => m.name));
   rmSync(genDir, { recursive: true, force: true });
@@ -776,6 +778,7 @@ function emitDart(
       "utf8",
     );
     domainSources.push(src);
+    sourceByFile.set(fileBase, src);
     written.push(p);
     return p;
   };
@@ -848,6 +851,13 @@ function emitDart(
         if (targetFile !== undefined && targetFile !== modForDart.name) foreignRefImportUris.add(`${targetFile}.dart`);
       }
     }
+    // AUTO cross-domain `idOf(Agg)` imports (dart_codegen_parity.md P2): a payload field typed with a
+    // SIBLING domain's typed id class (`ListingId`) needs that domain's generated file, exactly as a
+    // foreignRef target does. Same-domain idOf targets declare their id class locally — skip them.
+    for (const target of collectPayloadIdOfTargets(modForDart.directives)) {
+      const targetFile = aggIdToDartFile.get(target);
+      if (targetFile !== undefined && targetFile !== modForDart.name) foreignRefImportUris.add(`${targetFile}.dart`);
+    }
     const mergedDartImports = [
       ...(modForDart.dartImports ?? []),
       ...[...foreignRefImportUris]
@@ -887,10 +897,21 @@ function emitDart(
     "// Regenerated on every compile; generated implementation lives under src/generated/.",
     "library;",
     "",
-    ...aliasImportLines(names, [
-      ...(hasFrameworkSymbols ? [`${genRel}/${FRAMEWORK_FILE}.dart`] : []),
-      ...modules.map((m) => `${genRel}/${m.name}.dart`),
-    ]),
+    // Only import files that actually DECLARE an alias target — a `typedef A = B` needs B in scope, but a
+    // file no alias references would be an `unused_import` warning (it is already re-exported below). This
+    // mirrors the layered barrel's `aliasImportUris` precision.
+    ...aliasImportLines(
+      names,
+      (() => {
+        const aliasTargets = new Set(Object.keys(names ?? {}));
+        return [
+          ...(hasFrameworkSymbols ? [FRAMEWORK_FILE] : []),
+          ...modules.map((m) => m.name),
+        ]
+          .filter((f) => [...declaredDartTypeNames(sourceByFile.get(f) ?? "")].some((n) => aliasTargets.has(n)))
+          .map((f) => `${genRel}/${f}.dart`);
+      })(),
+    ),
     supportImport === "vendored"
       ? `export '${genRel}/nomos_client.dart';`
       : `export 'package:nomos_client/nomos_client.dart';`,
@@ -929,7 +950,7 @@ const NOMOS_TYPES_DEP = "^0.4.1";
 // 0.48.x: session-bound clients (XClient.bind/NomosClientInterface/DomainClientSessionMismatch/
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
-const NOMOS_CLIENT_DEP = "^0.54.1";
+const NOMOS_CLIENT_DEP = "^0.55.0";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in dsl/dart/pubspec.yaml
 // and dsl/dart_types/pubspec.yaml — a Dart release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).
@@ -1064,13 +1085,18 @@ function emitDartPackages(
       const m = /^import\s+'([^']+)'/.exec(line.trim());
       if (
         m !== null &&
+        // `dart:*` is a pure SDK library (dart:convert for jsonEncode of a json field, dart:math, …) — it
+        // carries NO cross-PACKAGE coupling, which is the only thing this gate exists to prevent. The
+        // purpose is keeping nomos_client (the runtime/bridge surface) out of the pure types layer, not
+        // banning the Dart SDK. Allow every dart:* import; keep the cross-package allowlist otherwise.
+        !m[1]!.startsWith("dart:") &&
         m[1] !== "package:nomos_types/nomos_types.dart" &&
         m[1] !== `${FRAMEWORK_FILE}.dart` &&
         !siblingTypeFiles.has(m[1]!)
       ) {
         fail(
           `types-package purity: generated '${fileBase}.dart' imports '${m[1]}' — a types file may only ` +
-            `import the nomos_types core, the framework file, or a sibling generated domain file`,
+            `import the nomos_types core, the framework file, a sibling generated domain file, or a dart:* SDK library`,
         );
       }
     }
@@ -1113,6 +1139,12 @@ function emitDartPackages(
         if (tf !== undefined && tf !== dd.modForDart.name) frImports.add(`${tf}.dart`);
       }
     }
+    // AUTO cross-domain `idOf(Agg)` imports (dart_codegen_parity.md P2): a payload field typed with a
+    // SIBLING domain's typed id class needs that domain's TYPES file (a permitted sibling import).
+    for (const target of collectPayloadIdOfTargets(dd.modForDart.directives)) {
+      const tf = aggIdToTypeFile.get(target);
+      if (tf !== undefined && tf !== dd.modForDart.name) frImports.add(`${tf}.dart`);
+    }
     const merged = [
       ...(dd.modForDart.dartImports ?? []),
       ...[...frImports].filter((uri) => !(dd.modForDart.dartImports ?? []).some((i) => i.uri === uri)).sort().map((uri) => ({ uri })),
@@ -1207,6 +1239,12 @@ function emitDartPackages(
       typesImportUri,
       ...(packageActivity.length > 0 ? { emitActivity: true } : {}),
       packageAggregateDomains: buildPackageAggregateDomains(modules),
+      // Under 'explicit' the types barrel withholds per-domain classes — import every domain's TYPES
+      // file directly so the client's read-model/payload/ref/typed-id references resolve. (The no-dup-
+      // symbol guarantee across domain files means an over-broad set never introduces ambiguity.)
+      ...(explicitBarrel
+        ? { explicitTypeImports: modules.map((m) => `package:${packages.types}/${genRel}/${m.name}.dart`) }
+        : {}),
     });
     const cp = path.join(clientGen, `${mod.name}.client.dart`);
     writeFileSync(cp, clientSrc, "utf8");
@@ -1289,6 +1327,15 @@ function emitDartPackages(
     }
     const compatGen = freshGenDir(compatName);
     const typesImportForCompat = `package:${packages.types}/${packages.types}.dart`;
+    // Under `barrelExports: 'explicit'` the types barrel does NOT flat-export per-domain aggregate/
+    // read-model classes, so a `typedef Legacy = CatTagReadModel;` cannot resolve its target through the
+    // barrel alone — it must import the DEFINING per-domain types file directly (exactly as the no-compat
+    // explicit types barrel does to back its own typedefs). Under 'all' the barrel exports everything, so
+    // no extra import is needed (byte-identical to before). Only the files that actually declare an alias
+    // target are imported (mirroring `aliasImportUris`), keeping the shim minimal.
+    const compatTargetImports = explicitBarrel
+      ? aliasImportUris.map((rel) => `package:${packages.types}/${rel}`)
+      : [];
     const compatFile = [
       "// GENERATED by nomos-compile — MIGRATION-ONLY compat aliases. DO NOT EDIT.",
       `//`,
@@ -1296,9 +1343,11 @@ function emitDartPackages(
       `// names in \`${packages.types}\`. Every symbol below is a plain \`typedef\` over the real generated`,
       `// type; it exists solely to keep pre-rename imports compiling during a migration. It adds NO`,
       `// behaviour and SHOULD NOT accrete new entries — new code imports \`${packages.types}\` directly.`,
+      "// ignore_for_file: unused_import",
       "library;",
       "",
       `import '${typesImportForCompat}';`,
+      ...compatTargetImports.map((uri) => `import '${uri}';`),
       ...dartAliasLines(names, declared),
       "",
     ];

package/src/framework/signing_identity.ts

@@ -185,37 +185,50 @@ export const revokeSignerEpochStrictlyIncreases = workspaceInvariant("RevokeSign
  *  - **NO `.requires`** — DELIBERATE. At genesis the founding signer enrolls on a still-WARRANT-FREE
  *    prefix (it precedes `seedGenesis`), so `verify_captured_principal` is in its legacy fast path and
  *    admits it UNSIGNED; there is no admin/signer yet to gate it, so a `.requires` would re-create the
- *    bootstrap chicken-and-egg. The forge surface a bare `relateSubject` would open is closed by
- *    DOMAIN PLACEMENT: this directive is composed into the CONTROL-PLANE governance law (domain
- *    `workspaces`/`nomos`), which the open session lane structurally refuses
- *    (`adapter/engine.mjs` — only the birth door + the secret-gated `/author` + admin
- *    lanes author it), so no tenant can forge a signer for another principal.
+ *    bootstrap chicken-and-egg.
+ *
+ * SELF-BINDING (2026-07 — the cross-principal-forge close). The enrolled object is the CAPTURED authoring
+ * principal `ctx.principal()`, NEVER a payload field — so a device can ONLY ever enrol a key for ITS OWN
+ * identity; a cross-principal forge (fill-in-any-name) is structurally impossible, on EVERY lane, with no
+ * placement guard and no IdP token (it works OFFLINE: a valid session vouches for its own new key; replay
+ * re-verifies the signature chain). The FOUNDING case is empirically covered: even pre-warrant/unsigned the
+ * intent captures its authoring principal (the birth/founder actor `user:<uid>`; `derive_signed_principal`
+ * on a warrant-free prefix keeps the captured value verbatim; `engine_entry::portsFromHost` seeds
+ * `ctx.principal()` from it), so the founder self-binds their OWN key at genesis — no carve-out needed.
+ * UNLIKE {@link enrollSignerSelf}, this founding lane carries NO verified-principal requirement (a virgin
+ * pre-warrant chain has no `verifiedVia` provenance yet to derive `principal_verified` from); it is the
+ * unsigned bootstrap enrol. Additional devices on a WARRANTED chain use {@link enrollSignerSelf}
+ * (verified) or {@link enrollFirstDevice} (keyless verified).
  *
  * THE ORDER IS THE CONTRACT (verified, zero gate change): `enrollSigner` (E, unsigned/pre-warrant) →
  * `seedGenesis` (W, unsigned/pre-warrant, the warrant lands in its output) → `grantAdmin` (A, the FIRST
  * SIGNED intent — its prefix now carries the warrant, the E-tuple proves the key, the virgin `#admin` is
- * admitted by the genesis clause). NB: a GENERAL tenant-callable enrolment (additional devices) needs a
- * self-binding (captured principal == payload principal) or admin-gating — see {@link enrollSignerSelf}.
+ * admitted by the genesis clause).
  */
 export const enrollSigner = directive("enrollSigner")
   .ensures(RelationTuple)
   .payload(
     z.object({
-      principal: z.string().min(1), // the auth-provider uid the key may author as
       keyHash: sha256Hex, // sha256hex of the ed25519 device PUBLIC key
       grantedBy: z.string().min(1),
       grantedAt: z.number().int().nonnegative(), // epoch ms, caller-stamped (determinism)
     }),
   )
-  .plan((p) =>
-    writeTuple({
-      object: signerObject(p.principal),
+  .plan((p, ctx) => {
+    // SELF-BIND: the object is the CAPTURED authoring principal's identity (read the raw principal from the
+    // endorsed evidence — the framework may; an author cannot smuggle a free-form principal). A device can
+    // only ever bind a key to itself, so there is no cross-principal forge surface (the reason the old
+    // placement guard existed is dissolved).
+    const me = ctx.principal().asAuthoritySubject<string>("enrol a founding device signer key for my own identity");
+    const rawPrincipal = endorsementOf(me)?.principal ?? "";
+    return writeTuple({
+      object: signerObject(rawPrincipal),
       relation: SIGNER_RELATION,
       subject: "key:" + p.keyHash,
       grantedBy: p.grantedBy,
       grantedAt: String(p.grantedAt),
-    }),
-  );
+    });
+  });
 
 /**
  * THE SELF-BIND ENROLL (VA-1 / B2). A device enrolls a key for ITS OWN verified identity — the bound