@githolon/dsl 0.94.0 → 0.95.0

package/dart/lib/src/webview_bridge.dart

@@ -48,7 +48,7 @@ const int kWebviewBridgeVersion = 1;
 /// pre-stamp bundle, which reports nothing) is a stale baked asset and fails loudly at boot.
 /// MUST move with the paired @githolon/client release — a release-hygiene test pairs it with the
 /// runner stamp (the pubspec-pins pattern).
-const String kExpectedRunnerBundleVersion = '0.93.0';
+const String kExpectedRunnerBundleVersion = '0.94.0';
 
 /// A STALE BAKED RUNNER BUNDLE: the app's built assets carry an older nomos-runner.js than this
 /// nomos_client release ships — Flutter's build cache kept it across a pub upgrade. Thrown from
@@ -721,6 +721,12 @@ class NomosOfferOutcome {
     this.gatewayVerdict,
   });
 
+  /// TRUE when the offer COMMITTED — it advanced the ledger to a new head (a write landed and/or a child
+  /// was born). A REFUSED offer never yields an outcome (it throws / surfaces its typed law error), so a
+  /// present outcome with a head is a success. Sugar so app code writes `if (outcome.ok)` instead of
+  /// hand-checking `head`/`created`/`born` (the co2 friction: "there's no `.ok`").
+  bool get ok => head.isNotEmpty;
+
   /// The born child workspace(s) as followable [NomosRef]s — hand one to [NomosBridge.follow]
   /// (`final estate = await engine.follow(outcome.bornRefs.single);`) so app code never carries a
   /// loose workspace string. The ref's type is the reserved `nomos.Workspace` locator tag.

package/dart/pubspec.yaml

@@ -11,7 +11,7 @@ description: >-
   Nomos 2 Dart frontend types — the hand-written kernel wire types plus the
   code-generated per-domain aggregate + directive-payload types. (De)serializes
   the EXACT serde JSON the Rust kernel + projection produce/consume.
-version: 0.58.0
+version: 0.59.0
 
 environment:
   sdk: ^3.5.0
@@ -20,7 +20,7 @@ dependencies:
   # The pure-data core (wire types, offer codec, NomosReads, schema validation, error
   # info). nomos_client depends on and re-exports it, so existing imports are unchanged.
   # For local monorepo dev, pubspec_overrides.yaml points this at ../dart_types.
-  nomos_types: ^0.5.0
+  nomos_types: ^0.6.0
   json_schema: ^5.2.2
   crypto: ^3.0.0
 

package/dart/test/four_layer_nested_topology_test.dart

@@ -0,0 +1,286 @@
+// THE FOUR-LAYER NESTED TOPOLOGY TEST — a real-app shape end-to-end:
+//
+//   Layer 1: the remote PLATFORM (tenant root)
+//   Layer 2: the HOME born under the platform (the per-user holon)
+//   Layer 3: a SPACE app-workspace born offline under the home
+//   Layer 4: a PROJECT app-workspace born offline under the home, with cross-workspace reference to Space
+//   Plus: MULTI-USER offline-first — two devices/users write concurrently and CONVERGE
+//
+// Sequence:
+// 1. the remote platform births the home (the ONE control-plane contact)
+// 2. the app mounts the home locally (a normal cloud-bound NomosSession; platform is never cloned)
+// 3. the network PARTITIONS
+// 4. the home births the SPACE workspace LOCALLY
+// 5. the home births the PROJECT workspace LOCALLY (which can reference the Space)
+// 6. both space and project open as sibling sessions and ACCEPT LOCAL WRITES while offline
+// 7. UI-facing queries return those writes immediately (local projection; no sync awaited)
+// 8. the network HEALS
+// 9. `harness.converge()` establishes remote custody PARENT-FIRST (home's synced chain folds the
+//    birth offer-effects remotely, creating the space/project remote custody; then they converge)
+// 10. a FRESH observer (the dev cloud's own remote projection) sees both space and project writes
+// 11. a SECOND USER writes to both workspaces offline, then converges (multi-user convergence)
+// 12. the FIRST USER sees the second user's writes in fresh queries (cross-user view)
+//
+import 'dart:convert';
+import 'dart:io';
+
+import 'package:nomos_client/nomos_headless.dart';
+import 'package:test/test.dart';
+
+String get _root => '${Directory.current.path}/../..';
+String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.ts';
+String get _devServer => '$_root/cloud/dev-server/server.ts';
+String get _deploy =>
+    '$_root/bench/scale/fixtures/four-layer-nested-topology/build/four-layer-nested-topology.deploy.json';
+const _subject1 = 'user:four-layer-test-user1';
+const _subject2 = 'user:four-layer-test-user2';
+
+String? _missingPrereq() {
+  if (!File(_repoEntry).existsSync()) return 'in-repo runner not found at $_repoEntry';
+  if (!File(_devServer).existsSync()) return 'in-repo dev server not found at $_devServer';
+  if (!File(_deploy).existsSync()) {
+    return 'compile the fixture: cd bench/scale/fixtures/four-layer-nested-topology && node ../../../../dsl/compile_package.mjs — missing $_deploy';
+  }
+  return null;
+}
+
+void main() {
+  test('the four-layer topology: platform → home → space + project (with cross-ref) offline + multi-user converge',
+      () async {
+    final skip = _missingPrereq();
+    if (skip != null) {
+      markTestSkipped(skip);
+      return;
+    }
+    final diag = Platform.environment['NOMOS_HARNESS_DIAG'] == '1'
+        ? (String l) => stderr.writeln(l)
+        : null;
+    final cloud = await NomosTestCloud.start(serverEntry: _devServer, onDiagnostic: diag);
+    NomosTestHarness? harness1;
+    NomosTestHarness? harness2;
+    try {
+      // LAYER 1+2: the remote ceremony + the local mount (user 1)
+      harness1 = await NomosTestHarness.cloudBound(
+        cloud: cloud,
+        deployJsonPaths: [_deploy],
+        platformWorkspace: 'four-layer-platform',
+        subject: _subject1,
+        nodeEntry: _repoEntry,
+        onDiagnostic: diag,
+      );
+      final home1 = harness1.homeSession;
+      expect(home1.workspace, startsWith('home-'),
+          reason: 'the remote ceremony born the deterministic home slot for user1');
+      final remoteHome1 = await cloud.remoteHead(home1.workspace);
+      expect(remoteHome1.initialized, isTrue,
+          reason: 'the home was born REMOTELY (custody exists before the app mounted it)');
+
+      // PARTITION
+      cloud.setOnline(false);
+
+      // LAYER 3: birth a SPACE workspace LOCALLY (under home1)
+      final spaceOutcome = await harness1.bridge.session(home1.workspace).offerCreates(
+        domain: 'home',
+        directiveId: 'birthSpaceWorkspace',
+        payload: {
+          'owner': _subject1,
+          'frameworkHash': harness1.frameworkHash,
+          'lawHash': harness1.lawHashes(home1.workspace).first,
+          'bornAt': '2026-07-15T00:00:00Z',
+        },
+        actor: _subject1,
+      );
+      expect(spaceOutcome.born, isNotEmpty, reason: 'the local .births() offer spawned the space');
+      final spaceWs = spaceOutcome.born.single;
+      expect(spaceWs, startsWith('space-'));
+
+      // LAYER 4: birth a PROJECT workspace LOCALLY (under home1, will reference space)
+      final projectOutcome = await harness1.bridge.session(home1.workspace).offerCreates(
+        domain: 'home',
+        directiveId: 'birthProjectWorkspace',
+        payload: {
+          'owner': _subject1,
+          'frameworkHash': harness1.frameworkHash,
+          'lawHash': harness1.lawHashes(home1.workspace).first,
+          'bornAt': '2026-07-15T00:00:01Z',
+        },
+        actor: _subject1,
+      );
+      expect(projectOutcome.born, isNotEmpty, reason: 'the local .births() offer spawned the project');
+      final projectWs = projectOutcome.born.single;
+      expect(projectWs, startsWith('project-'));
+
+      // LAYER 3+4: Open both space and project as sibling sessions + make WRITES while offline
+      final space = await harness1.bridge.acquireSession(spaceWs);
+      final project = await harness1.bridge.acquireSession(projectWs);
+
+      // Write to space
+      await space.offerCreates(
+        domain: 'space',
+        directiveId: 'writeSpaceItem',
+        payload: {
+          'author': _subject1,
+          'title': 'Space Item 1 (offline)',
+          'createdAt': '2026-07-15T00:00:02Z',
+        },
+        actor: _subject1,
+      );
+
+      // Write to project (with cross-workspace reference to space)
+      await project.offerCreates(
+        domain: 'project',
+        directiveId: 'createTask',
+        payload: {
+          'author': _subject1,
+          'title': 'Task 1: belongs to Space (offline)',
+          'spaceWorkspace': spaceWs,  // CROSS-WORKSPACE REFERENCE
+          'createdAt': '2026-07-15T00:00:03Z',
+        },
+        actor: _subject1,
+      );
+
+      // LAYER 3+4: UI-facing queries return the writes IMMEDIATELY (local projection; nothing awaited sync)
+      final spaceRows = await space.query('spaceItemsByAuthor', {'author': _subject1});
+      expect(spaceRows, hasLength(1));
+      expect((spaceRows.single['data'] as Map)['title'], 'Space Item 1 (offline)');
+
+      final projectRows = await project.query('tasksByAuthor', {'author': _subject1});
+      expect(projectRows, hasLength(1));
+      expect((projectRows.single['data'] as Map)['title'], 'Task 1: belongs to Space (offline)');
+      expect((projectRows.single['data'] as Map)['spaceWorkspace'], spaceWs);
+
+      // Verify NO remote custody yet (the partition is real)
+      final remoteSpaceOffline = await cloud.remoteHead(spaceWs);
+      final remoteProjectOffline = await cloud.remoteHead(projectWs);
+      expect(remoteSpaceOffline.initialized, isFalse,
+          reason: 'while partitioned, the locally-born space has NO remote custody');
+      expect(remoteProjectOffline.initialized, isFalse,
+          reason: 'while partitioned, the locally-born project has NO remote custody');
+
+      // HEAL the network BEFORE creating harness2 (user2 needs network to be created)
+      cloud.setOnline(true);
+
+      // === MULTI-USER SCENARIO: USER 2 ===
+      // Create harness2 for user 2 (same platform, different home)
+      harness2 = await NomosTestHarness.cloudBound(
+        cloud: cloud,
+        deployJsonPaths: [_deploy],
+        platformWorkspace: 'four-layer-platform',
+        subject: _subject2,
+        nodeEntry: _repoEntry,
+        onDiagnostic: diag,
+      );
+      final home2 = harness2.homeSession;
+      expect(home2.workspace, startsWith('home-'),
+          reason: 'user2 gets its own deterministic home slot');
+
+      // PARTITION again for user2's offline writes
+      cloud.setOnline(false);
+
+      // User2 births its own space locally (while partitioned)
+      final space2Outcome = await harness2.bridge.session(home2.workspace).offerCreates(
+        domain: 'home',
+        directiveId: 'birthSpaceWorkspace',
+        payload: {
+          'owner': _subject2,
+          'frameworkHash': harness2.frameworkHash,
+          'lawHash': harness2.lawHashes(home2.workspace).first,
+          'bornAt': '2026-07-15T00:00:04Z',
+        },
+        actor: _subject2,
+      );
+      final space2Ws = space2Outcome.born.single;
+      final space2 = await harness2.bridge.acquireSession(space2Ws);
+
+      // User2 writes to its own space while partitioned
+      await space2.offerCreates(
+        domain: 'space',
+        directiveId: 'writeSpaceItem',
+        payload: {
+          'author': _subject2,
+          'title': 'Space Item from User2 (offline)',
+          'createdAt': '2026-07-15T00:00:05Z',
+        },
+        actor: _subject2,
+      );
+
+      // HEAL the network again for final convergence
+      cloud.setOnline(true);
+
+      // CONVERGE (parent-first: home's synced chain folds the birth offer-effects remotely,
+      // creating the space/project remote custody; then they converge)
+      await harness1.converge(timeout: const Duration(seconds: 180));
+      await harness2.converge(timeout: const Duration(seconds: 180));
+
+      // Verify FRESH observer (the dev cloud's own remote projection) sees the offline-written data
+      final http = HttpClient();
+      try {
+        // Check space1 (user1's space)
+        final req1 = await http.getUrl(Uri.parse(
+            '${cloud.origin}/v2/workspaces/$spaceWs/spaceItemsByAuthor?author=${Uri.encodeQueryComponent(_subject1)}'));
+        final resp1 = await req1.close();
+        final body1 = jsonDecode(await resp1.transform(utf8.decoder).join());
+        final rows1 = ((body1 as Map)['rows'] as List?) ?? const [];
+        expect(rows1, hasLength(1),
+            reason: 'the remote projection serves user1\'s offline-written space item after converge');
+        expect(((rows1.single as Map)['data'] as Map)['title'], 'Space Item 1 (offline)');
+
+        // Check project1 (user1's project with cross-reference)
+        final req2 = await http.getUrl(Uri.parse(
+            '${cloud.origin}/v2/workspaces/$projectWs/tasksByAuthor?author=${Uri.encodeQueryComponent(_subject1)}'));
+        final resp2 = await req2.close();
+        final body2 = jsonDecode(await resp2.transform(utf8.decoder).join());
+        final rows2 = ((body2 as Map)['rows'] as List?) ?? const [];
+        expect(rows2, hasLength(1),
+            reason: 'the remote projection serves user1\'s offline-written project task after converge');
+        final task = ((rows2.single as Map)['data'] as Map);
+        expect(task['title'], 'Task 1: belongs to Space (offline)');
+        expect(task['spaceWorkspace'], spaceWs, reason: 'cross-workspace reference is persisted');
+
+        // Check space2 (user2's space)
+        final req3 = await http.getUrl(Uri.parse(
+            '${cloud.origin}/v2/workspaces/$space2Ws/spaceItemsByAuthor?author=${Uri.encodeQueryComponent(_subject2)}'));
+        final resp3 = await req3.close();
+        final body3 = jsonDecode(await resp3.transform(utf8.decoder).join());
+        final rows3 = ((body3 as Map)['rows'] as List?) ?? const [];
+        expect(rows3, hasLength(1),
+            reason: 'the remote projection serves user2\'s offline-written space item after converge');
+        expect(((rows3.single as Map)['data'] as Map)['title'], 'Space Item from User2 (offline)');
+      } finally {
+        http.close(force: true);
+      }
+
+      // Verify custody is REAL on all layers
+      final remoteHome12 = await cloud.remoteHead(home1.workspace);
+      final remoteSpace12 = await cloud.remoteHead(spaceWs);
+      final remoteProject12 = await cloud.remoteHead(projectWs);
+      final remoteHome22 = await cloud.remoteHead(home2.workspace);
+      final remoteSpace22 = await cloud.remoteHead(space2Ws);
+
+      expect(remoteHome12.initialized, isTrue);
+      expect(remoteHome12.commits, greaterThan(0));
+      expect(remoteSpace12.initialized, isTrue,
+          reason: 'converge established space\'s remote custody (home birth folded remotely)');
+      expect(remoteSpace12.commits, greaterThan(0));
+      expect(remoteProject12.initialized, isTrue,
+          reason: 'converge established project\'s remote custody (home birth folded remotely)');
+      expect(remoteProject12.commits, greaterThan(0));
+      expect(remoteHome22.initialized, isTrue);
+      expect(remoteHome22.commits, greaterThan(0));
+      expect(remoteSpace22.initialized, isTrue);
+      expect(remoteSpace22.commits, greaterThan(0));
+
+      // Cross-user view: User1 queries its space and project, should still see its own writes
+      final space1ViewFromUser1 = await space.query('spaceItemsByAuthor', {'author': _subject1});
+      expect(space1ViewFromUser1, hasLength(1));
+      expect(((space1ViewFromUser1.single['data'] as Map)['title']), 'Space Item 1 (offline)');
+
+      // (Note: user2 doesn't have read access to user1's space by design, but both write to different workspaces,
+      // so each user sees their own data in their own workspace)
+    } finally {
+      try { await harness1?.dispose(); } catch (_) {}
+      try { await harness2?.dispose(); } catch (_) {}
+      await cloud.stop();
+    }
+  }, timeout: const Timeout(Duration(minutes: 8)));
+}

package/dart_types/pubspec.yaml

@@ -11,7 +11,7 @@ description: >-
   Pure kernel wire/data types for Nomos Dart frontends — no transport, no bridge,
   no runtime. The hand-written serde-JSON-compatible types plus the offer codec,
   reactive read engine, schema validation, and data-only error/trace types.
-version: 0.5.0
+version: 0.6.0
 
 environment:
   sdk: ^3.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.94.0",
+  "version": "0.95.0",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/framework/signing_identity.ts

@@ -322,6 +322,15 @@ export const enrollFirstDevice = directive("enrollFirstDevice")
       /** THE CAPTURED PREMISE: the IdP's signed identity assertion (JWT), re-verified on every lane against
        *  the on-chain AuthProvider keys. */
       idpToken: z.string().min(1),
+      /** THE KEYLESS DELEGATION CERT (JSON `executor::birth_cert::BirthCert`) — the self-serve sibling of
+       *  `enrollDelegation.certJson`. Built CLIENT-SIDE via the `cert_sign` op: DEVICE-self-signed by this
+       *  same device key `P_U` (parent_key == P_U), founder == `user:<uid>`, carrying `verifiedVia` +
+       *  `idpToken` + `capturedClock`. There is NO tenant `S_P` in the loop — the kernel's home-birth chain
+       *  walk (`verify_to_root`, keyless branch) RE-VERIFIES the token against the platform-attested
+       *  AuthProvider (bound to K_root by the terminal platform_cert), so a forged/swapped cert fails the
+       *  child's own gate. Writing it as the user's `SignerDelegation` is what lets `birthHome`'s offer-effect
+       *  assemble a WARRANTED travelling chain (closes co2's `birth-cert-not-seeded` / empty signerDelegation). */
+      delegationCert: z.string().min(1),
     }),
   )
   .plan((p, ctx) => {
@@ -329,7 +338,8 @@ export const enrollFirstDevice = directive("enrollFirstDevice")
     // evidence — the framework may; an author cannot). The kernel arm proves the principal is the IdP subject.
     const me = ctx.principal().asAuthoritySubject<string>("bootstrap my first device signer key from a verified IdP token");
     const rawPrincipal = endorsementOf(me)?.principal ?? "";
-    return writeTuple({
+    // (1) seat the signer leaf (the RelationTuple — this directive's primary `.ensures`).
+    const tupleOps = writeTuple({
       object: signerObject(rawPrincipal),
       relation: SIGNER_RELATION,
       subject: "key:" + p.keyHash,
@@ -338,6 +348,20 @@ export const enrollFirstDevice = directive("enrollFirstDevice")
       verifiedVia: p.verifiedVia,
       validFromEpoch: p.validFromEpoch,
     });
+    // (2) fold the KEYLESS delegation cert as the user's `SignerDelegation` singleton (a SECONDARY ensures,
+    // per-op marked — the id is deterministic-by-user, an upsert). This is the seed `birthHome` reads to
+    // assemble the warranted chain; without it the home is born headless (co2's block).
+    // The delegation is keyed by the AUTHENTICATED principal — EXACTLY the `founder` the kernel's birth
+    // offer-effect reads it back by (`read_signer_delegation(state, &founder)`, founder == captured principal
+    // == this `rawPrincipal`, already in `user:<uid>` form). Do NOT re-prefix.
+    const d = instance(SignerDelegation, signerDelegationInstanceId(rawPrincipal));
+    const delegationOps: PlannedOp[] = [
+      withMarker(set(d, "user", rawPrincipal), "ensures"),
+      withMarker(set(d, "deviceKey", "key:" + p.keyHash), "ensures"),
+      withMarker(set(d, "certJson", p.delegationCert), "ensures"),
+      withMarker(set(d, "enrolledAt", p.grantedAt), "ensures"),
+    ];
+    return [...tupleOps, ...delegationOps];
   })
   // THE KEYLESS GATE DECLARATION: the carried device-bound `idpToken` IS this directive's authorization
   // (re-verified against the workspace AuthProvider on every lane), not a pre-enrolled signer. This lowers