@githolon/dsl 0.95.2 → 0.97.0

package/dart/CHANGELOG.md

@@ -1,3 +1,20 @@
+## 0.61.0
+
+- **ERA-0 cloud-bound harness** — `NomosTestHarness.cloudBound` now runs the full WARRANTED onboarding
+  ceremony against the test cloud: the platform is BORN warranted+attested at cloud boot
+  (`NomosTestCloud.start(platform:, deployJsonPath:)`), the owner's device enrols through the REAL
+  first-device lane (`/dev/mint-token` → `enrollFirstDevice`), and `birthHome` is device-signed +
+  attested with `ownerKeyHash` (the born home is SIGNER-READY — it births estates/catalogues offline
+  from intent 0). Six named phases, all deadlined.
+- **`NomosTestCloud.start(platform:, deployJsonPath:)`** — the dev cloud stands the platform up at boot
+  (era-0: the host does not create workspaces; the harness's old POST-create refuses 409 by design).
+  `/health` gates on `platformReady: true` so clients never race the ceremony.
+- **`acquireSession(…, authorSecret:)`** — sign a locally-born (warranted) child session's writes with
+  its owner's device key; `deviceSecret(workspace)`/`devicePublicKey(workspace)` expose the harness
+  device (the harness IS the device) for `.births()` payload `ownerKeyHash` derivation.
+- Requires `githolon`/`@githolon/client` ≥ the era-0 release (the client auto-signs self-serve birth
+  certs on the kernel's typed `birth-unattestable` refusal — apps never hand-roll certs).
+
 ## 0.56.0
 
 - **NomosTestCloud (co2 #4)** — a headless, cloud-BOUND real-sync test harness: start/stop a local

package/dart/lib/src/dev_cloud.dart

@@ -93,6 +93,16 @@ class NomosTestCloud {
     bool ephemeral = true,
     String? dataDir,
     String node = 'node',
+
+    /// ERA-0: a workspace is BORN, never host-created — so a platform the harness will offer births to must
+    /// be stood up BY THE CLOUD ITSELF at boot (the dev server's in-process operator lane, `--platform`).
+    /// A [NomosTestHarness.cloudBound] against this cloud REQUIRES this to name its `platformWorkspace`
+    /// (the old lane — the harness POST-creating the platform — refuses 409 `unborn` by design).
+    String? platform,
+
+    /// Optional platform law to deploy at boot (`--deploy build/<name>.deploy.json`) — the dev server
+    /// installs it on [platform] before serving. The harness may also deploy law itself post-boot.
+    String? deployJsonPath,
     Duration readyTimeout = const Duration(seconds: 30),
     void Function(String line)? onDiagnostic,
   }) async {
@@ -102,6 +112,8 @@ class NomosTestCloud {
       '--port', '$chosenPort',
       if (ephemeral) '--ephemeral',
       if (dataDir != null) ...['--data', dataDir],
+      if (platform != null) ...['--platform', platform],
+      if (deployJsonPath != null) ...['--deploy', deployJsonPath],
     ];
     void log(String m) => onDiagnostic?.call('[nomos-test-cloud] $m');
     log('spawning: $node ${args.join(' ')}');
@@ -111,23 +123,30 @@ class NomosTestCloud {
 
     final upstream = Uri.parse('http://127.0.0.1:$chosenPort');
     final client = HttpClient();
-    // Wait for /health.
+    // Wait for /health — and, when a platform was requested, for `platformReady: true` (the boot-time
+    // platform ceremony: genesis → law deploy → K_root ceremony → warrant). Racing it would hit the
+    // half-born platform's typed refusals.
     final deadline = DateTime.now().add(readyTimeout);
     var ready = false;
     while (DateTime.now().isBefore(deadline)) {
       try {
         final req = await client.getUrl(upstream.replace(path: '/health'));
         final resp = await req.close();
-        if (resp.statusCode == 200) { ready = true; await resp.drain<void>(); break; }
-        await resp.drain<void>();
+        final body = await resp.transform(utf8.decoder).join();
+        if (resp.statusCode == 200) {
+          final health = jsonDecode(body) as Map<String, dynamic>;
+          final platformReady = health['platformReady'];
+          if (platform == null || platformReady == true) { ready = true; break; }
+        }
       } catch (_) {/* not up yet */}
       await Future<void>.delayed(const Duration(milliseconds: 200));
     }
     if (!ready) {
       proc.kill(ProcessSignal.sigkill);
-      throw NomosTestCloudException('the dev cloud did not answer /health within ${readyTimeout.inSeconds}s (serverEntry: $serverEntry)');
+      throw NomosTestCloudException(
+          'the dev cloud did not answer /health${platform != null ? ' with platformReady:true' : ''} within ${readyTimeout.inSeconds}s (serverEntry: $serverEntry)');
     }
-    log('dev cloud healthy at $upstream');
+    log('dev cloud healthy at $upstream${platform != null ? ' (platform ceremony complete)' : ''}');
 
     // The partition proxy — forwards to the dev cloud when ONLINE, fails fast when OFFLINE.
     final proxy = await HttpServer.bind(InternetAddress.loopbackIPv4, 0);

package/dart/lib/src/test_harness.dart

@@ -129,6 +129,10 @@ class NomosTestHarness {
   /// workspace → the base64 device PUBLIC key it was opened with (only for [cluster]'s `deviceKeyed` set).
   final Map<String, String> _devicePublics;
 
+  /// workspace → the base64 device SECRET it was opened with (TEST HARNESS ONLY — the harness models the
+  /// device, so the test app may sign with the owner's key, e.g. to acquire a locally-born child session).
+  final Map<String, String> _deviceSecrets;
+
   /// The nomos framework controller's content hash from the offline install — the `frameworkHash` a
   /// `.births()` genesis installs (not derivable client-side). Same for every workspace on the plane.
   final String? frameworkHash;
@@ -172,6 +176,7 @@ class NomosTestHarness {
   NomosTestHarness._(this.bridge, this.workspace, this._transport, this._workdir,
       this._onDiagnostic, List<String> sessionNames,
       {Map<String, String> devicePublics = const {},
+      Map<String, String> deviceSecrets = const {},
       this.frameworkHash,
       Map<String, List<String>> lawHashes = const {},
       Map<String, String> snapshots = const {},
@@ -181,6 +186,7 @@ class NomosTestHarness {
       this.homeWorkspace})
       : _sessionNames = List.of(sessionNames), // GROWABLE — restoreWorkspace may add a fresh session
         _devicePublics = devicePublics,
+        _deviceSecrets = deviceSecrets,
         _lawHashes = Map.of(lawHashes),
         _snapshots = Map.of(snapshots),
         _installLane = installLane,
@@ -226,6 +232,11 @@ class NomosTestHarness {
   /// `sha256(base64decode(...))` is the attestor keyHash a reader enrols to trust this source's signed reads.
   String? devicePublicKey(String workspace) => _devicePublics[workspace];
 
+  /// The base64 device SECRET a session was opened with (TEST HARNESS ONLY — the harness IS the device;
+  /// a real app keeps this in secure storage). Sign writes to locally-born children with it, e.g.
+  /// `bridge.acquireSession(childWs, authorSecret: harness.deviceSecret(home))`.
+  String? deviceSecret(String workspace) => _deviceSecrets[workspace];
+
   /// The workspace names on this device's local plane (one for [ephemeral], N for [cluster]).
   List<String> get sessions => List.unmodifiable(_sessionNames);
 
@@ -363,6 +374,10 @@ class NomosTestHarness {
                 workspace: workspace,
                 clientId: clientId,
                 allowUnborn: true,
+                // THE HARNESS DEVICE (era-0): the install lane mints one device key per plane — sessions
+                // sign with it, and the client completes the self-serve birth ceremony (enrol + cert)
+                // with the SAME key, so offline `.births()` offers Just Work.
+                authorSecret: info['deviceSecret']?.toString(),
               ));
       phase('ready — session "$workspace" connected (law ${(info['lawHashes'] as List?)?.isNotEmpty == true ? (info['lawHashes'] as List).first.toString().substring(0, 12) : "installed"})');
       // THE DECOY SESSION (multi-workspace by default in tests): sole-session inference is how
@@ -390,6 +405,12 @@ class NomosTestHarness {
       }
       final harness = NomosTestHarness._(
           plane.session(workspace), workspace, transport, workdir, onDiagnostic, [workspace],
+          devicePublics: {
+            if (info['devicePublic'] != null) workspace: info['devicePublic'].toString(),
+          },
+          deviceSecrets: {
+            if (info['deviceSecret'] != null) workspace: info['deviceSecret'].toString(),
+          },
           frameworkHash: info['frameworkHash']?.toString(),
           lawHashes: {
             workspace: ((info['lawHashes'] as List?) ?? const [])
@@ -476,6 +497,8 @@ class NomosTestHarness {
       // 1. install each workspace's law offline → one snapshot per workspace (colocated, still separate law).
       final snapshots = <String, String>{};
       final lawHashesByWs = <String, List<String>>{};
+      final installDevicePublics = <String, String>{};
+      final installDeviceSecrets = <String, String>{};
       String? frameworkHash;
       var _i = 0;
       for (final e in workspaces.entries) {
@@ -505,6 +528,10 @@ class NomosTestHarness {
             .map((x) => x.toString())
             .toList();
         frameworkHash ??= info['frameworkHash']?.toString();
+        // THE HARNESS DEVICE (era-0): the install lane mints one device key per workspace — sessions sign
+        // with it and the client completes the self-serve birth ceremony (enrol + cert) with the SAME key.
+        if (info['devicePublic'] != null) installDevicePublics[e.key] = info['devicePublic'].toString();
+        if (info['deviceSecret'] != null) installDeviceSecrets[e.key] = info['deviceSecret'].toString();
       }
 
       // 2. ONE runner / ONE bridge for the whole plane — no env restore default; each connect brings its own.
@@ -558,6 +585,8 @@ class NomosTestHarness {
                   clientId: '$clientId-${e.key}',
                   restoreFrom: snapshotB64[e.key],
                   allowUnborn: true,
+                  // signed with the install-lane harness device (era-0 self-serve birth ceremony key)
+                  authorSecret: installDeviceSecrets[e.key],
                 ));
       }
       phase('cluster: ${workspaces.length} session(s) connected');
@@ -567,6 +596,7 @@ class NomosTestHarness {
       //     The re-open is the runner's ATOMIC session replace (dispose-then-connect under the hood); each
       //     leg runs as a named, deadlined phase so a wedge is a typed HarnessPhaseTimeout, never a hang.
       final devicePublics = <String, String>{};
+      final deviceSecretsKeyed = <String, String>{};
       for (final ws in deviceKeyed) {
         if (!workspaces.containsKey(ws)) {
           throw NomosTestHarnessException(
@@ -581,6 +611,7 @@ class NomosTestHarness {
             onDiagnostic: onDiagnostic,
             run: () => bridge.session(ws).authorKeygen());
         devicePublics[ws] = (kp['public'] ?? '').toString();
+        deviceSecretsKeyed[ws] = (kp['secret'] ?? '').toString();
         await _phased(
             phase: "3b: keyed reconnect of '$ws'",
             workspace: ws,
@@ -608,7 +639,9 @@ class NomosTestHarness {
       final names = workspaces.keys.toList();
       final harness = NomosTestHarness._(
           bridge, names.first, transport, workdir, onDiagnostic, names,
-          devicePublics: devicePublics,
+          // install-lane harness devices under; explicit deviceKeyed re-opens override for their ws
+          devicePublics: {...installDevicePublics, ...devicePublics},
+          deviceSecrets: {...installDeviceSecrets, ...deviceSecretsKeyed},
           frameworkHash: frameworkHash,
           lawHashes: lawHashesByWs,
           snapshots: snapshotB64,
@@ -704,18 +737,33 @@ class NomosTestHarness {
     final workdir = await Directory.systemTemp.createTemp('nomos-harness-');
     NodeRunnerTransport? transport;
     try {
-      // 1/5 — the remote control plane: create the platform workspace + deploy the law under the test
-      //       cloud's own trust universe (its K_root; nothing here touches production).
+      // 1/6 — the remote control plane: BOOT the BORN platform + deploy the law under the test cloud's own
+      //       trust universe. ERA-0: the host does not create workspaces — the platform must have been stood
+      //       up BY THE CLOUD at boot (`NomosTestCloud.start(platform: '$platformWorkspace')`, the dev
+      //       server's in-process operator lane). Booting a born workspace is idempotent; an unborn one
+      //       refuses 409, surfaced here with the fix.
       String? frameworkHash;
       final lawHashes = <String>[];
       await _phased(
-          phase: '1/5: create platform + deploy law on the test cloud',
+          phase: '1/6: boot the born platform + deploy law on the test cloud',
           workspace: platformWorkspace,
           awaiting: 'POST /v2/workspaces + /domains',
           timeout: phaseTimeout ?? _kInstallDeadline,
           onDiagnostic: onDiagnostic,
           run: () async {
-            final created = await post('/v2/workspaces/$platformWorkspace', null);
+            Map<String, Object?> created;
+            try {
+              created = await post('/v2/workspaces/$platformWorkspace', null);
+            } on NomosTestHarnessException catch (e) {
+              if (e.message.contains('unborn')) {
+                throw NomosTestHarnessException(
+                    "cloudBound: platform '$platformWorkspace' is UNBORN on the test cloud — era-0 has no "
+                    "host-side create. Start the cloud with it: "
+                    "NomosTestCloud.start(serverEntry: …, platform: '$platformWorkspace') "
+                    '(the dev server births it at boot via its operator lane).');
+              }
+              rethrow;
+            }
             frameworkHash =
                 ((created['controller'] as Map?)?['domainHash'])?.toString();
             for (final p in deployJsonPaths) {
@@ -734,46 +782,111 @@ class NomosTestHarness {
         throw NomosTestHarnessException(
             'cloudBound: no deploy.json carried a summary.domainHash — cannot run the birth ceremony (lawHash unknown)');
       }
-      // 2/5 — THE HOME CEREMONY, remotely: the platform's own gateway offer births the home (the ONE
-      //       control-plane contact; the app lane below never touches the platform again).
+      // 2/6 — the LOCAL engine plane, CLOUD-BOUND, spawned BEFORE the birth: the runner's local kernel is
+      //       what mints the device key + signs the birth cert (era-0: a birth is ATTESTED or not at all).
+      transport = await _phased(
+          phase: '2/6: spawn the node runner (cloud-bound)',
+          awaiting: 'Process.start($node)',
+          timeout: phaseTimeout ?? _kSpawnDeadline,
+          onDiagnostic: onDiagnostic,
+          run: () => NodeRunnerTransport.start(
+              entry: entry, resolveFrom: resolveFrom, node: node, onDiagnostic: onDiagnostic));
+      final plane = NomosBridge(transport!);
+      await _phased(
+          phase: '3/6: runner ready',
+          awaiting: "event:'ready'",
+          timeout: phaseTimeout ?? readyTimeout,
+          onDiagnostic: onDiagnostic,
+          run: () => plane.ready);
+      // 4/6 — THE ERA-0 DEVICE CEREMONY (the WARRANTED onboarding lane, exactly production's shape): mint the
+      //       owner's device key in the LOCAL kernel, get an IdP token from the dev cloud's test IdP
+      //       (device-bound: nonce == the device keyHash), and enrol the FIRST DEVICE against the platform's
+      //       on-chain AuthProvider (enrollFirstDevice — no admin in the loop). The platform is WARRANTED, so
+      //       plain unsigned enrolment refuses by design; this is the one first-device door.
+      final device = await _phased(
+          phase: '4/6: device ceremony (keygen → dev-IdP token → enrollFirstDevice)',
+          workspace: platformWorkspace,
+          awaiting: 'authorKeygen + /dev/mint-token + enrollFirstDevice',
+          timeout: phaseTimeout ?? _kInstallDeadline,
+          onDiagnostic: onDiagnostic,
+          run: () async {
+            // The runner's crypto ops (authorKeygen/signBirthCert) run on a CONNECTED holon — open an
+            // onboarding session against the PLATFORM first (reads are open; this is the enrol surface).
+            await plane.connect(
+              cloud: cloud.origin,
+              workspace: platformWorkspace,
+              clientId: '$clientId-onboard',
+              authToken: authToken,
+            );
+            final kp = await plane.authorKeygen();
+            final publicB64 = (kp['public'] ?? '').toString();
+            final secret = (kp['secret'] ?? '').toString();
+            if (publicB64.isEmpty || secret.isEmpty) {
+              throw NomosTestHarnessException('cloudBound: authorKeygen returned no device key');
+            }
+            final keyHash = sha256.convert(base64Decode(publicB64)).toString();
+            final minted = await post('/dev/mint-token', {'sub': bareUid, 'nonce': keyHash});
+            final idpToken = (minted['token'] ?? '').toString();
+            final issuer = (minted['issuer'] ?? '').toString();
+            if (idpToken.isEmpty || issuer.isEmpty) {
+              throw NomosTestHarnessException('cloudBound: /dev/mint-token returned no token — is the test cloud started with platform:/deployJsonPath: and a law composing setAuthProvider?');
+            }
+            await post('/v2/workspaces/$platformWorkspace/enrollFirstDevice', {
+              'keyHash': keyHash,
+              'verifiedVia': issuer,
+              'validFromEpoch': 0,
+              'grantedAt': DateTime.now().toUtc().toIso8601String(),
+              'idpToken': idpToken,
+              'actor': subject,
+              'authorSecret': secret,
+            }, headers: {'x-nomos-auth': idpToken});
+            return (publicB64: publicB64, secret: secret, keyHash: keyHash, idpToken: idpToken);
+          });
+      // 5/6 — THE HOME CEREMONY, remotely: the platform's own gateway offer births the home (the ONE
+      //       control-plane contact; the app lane below never touches the platform again). The offer carries
+      //       the device-signed homeCert + the owner's device keyHash (the home's genesis ENROLS it, so the
+      //       born home is SIGNER-READY — it can birth its own estates/catalogues from intent 0).
       String? home;
       await _phased(
-          phase: '2/5: remote home-birth ceremony',
+          phase: '5/6: remote home-birth ceremony (attested)',
           workspace: platformWorkspace,
           awaiting: 'POST /v2/workspaces/$platformWorkspace/birthHome',
           timeout: phaseTimeout ?? _kInstallDeadline,
           onDiagnostic: onDiagnostic,
           run: () async {
+            final homeName = _homeNameOf(subject);
+            final homeCert = await plane.signBirthCert({
+              'child': homeName,
+              'founder': subject,
+              // The cert's `verified` must MATCH the gate verdict (CAS-as-law): the offer carries the
+              // dev-IdP token, so the gate resolves a VERIFIED founder.
+              'verified': true,
+              'parentKey': device.publicB64,
+              'parentId': platformWorkspace,
+              'epoch': 0,
+            }, device.secret);
             final out = await post('/v2/workspaces/$platformWorkspace/birthHome', {
               'owner': subject,
+              'ownerKeyHash': device.keyHash,
               'frameworkHash': frameworkHash,
               'lawHash': lawHashes.first,
               'bornAt': DateTime.now().toUtc().toIso8601String(),
-            });
+              'homeCert': jsonEncode(homeCert),
+              'actor': subject,
+              'authorSecret': device.secret,
+            }, headers: {'x-nomos-auth': device.idpToken});
             final born = (out['born'] as List?) ?? const [];
             final bornNames = born.map((b) => (b as Map)['workspace']?.toString()).whereType<String>().where((w) => w.isNotEmpty).toList();
             home = bornNames.isEmpty ? null : bornNames.first;
-            home ??= _homeNameOf(subject); // deterministic fallback (home-<sha256(subject)[..40]>)
+            if (home == null) {
+              final outcomes = jsonEncode(out['birthOutcomes'] ?? const []);
+              throw NomosTestHarnessException(
+                  'cloudBound: birthHome admitted but spawned no home (birthOutcomes=$outcomes)');
+            }
           });
-      // 3/5 — the LOCAL engine plane, CLOUD-BOUND (no offline env: the runner pulls the runtime + the
-      //       home's custody from the test cloud like a real device).
-      transport = await _phased(
-          phase: '3/5: spawn the node runner (cloud-bound)',
-          awaiting: 'Process.start($node)',
-          timeout: phaseTimeout ?? _kSpawnDeadline,
-          onDiagnostic: onDiagnostic,
-          run: () => NodeRunnerTransport.start(
-              entry: entry, resolveFrom: resolveFrom, node: node, onDiagnostic: onDiagnostic));
-      final plane = NomosBridge(transport!);
-      await _phased(
-          phase: '4/5: runner ready',
-          awaiting: "event:'ready'",
-          timeout: phaseTimeout ?? readyTimeout,
-          onDiagnostic: onDiagnostic,
-          run: () => plane.ready);
-      // 5/5 — mount the born home as a normal cloud-bound session (clone from the test cloud).
+      // 6/6 — mount the born home as a normal cloud-bound session (clone from the test cloud).
       await _phased(
-          phase: '5/5: mount the born home',
+          phase: '6/6: mount the born home',
           workspace: home,
           awaiting: 'connect(cloud:, workspace: $home)',
           timeout: phaseTimeout ?? connectTimeout,
@@ -783,6 +896,10 @@ class NomosTestHarness {
                 workspace: home!,
                 clientId: clientId,
                 authToken: authToken,
+                // The home was born WARRANTED with THIS device enrolled in its genesis (ownerKeyHash) —
+                // connect with the same key so every write is signed and the home's own `.births()` offers
+                // (estates/catalogues) are device-attested (the client signs the birth cert automatically).
+                authorSecret: device.secret,
               ));
       // NO DECOY on a cloudBound harness: the app is genuinely multi-workspace (the home plus every
       // locally-born child), so the plane is never sole-session — the decoy the offline  harness
@@ -795,6 +912,11 @@ class NomosTestHarness {
         workdir,
         onDiagnostic,
         [home!],
+        // The owner's device (enrolled in the home's genesis via ownerKeyHash) — the app derives the
+        // keyHash for its own `.births()` payloads from [devicePublicKey] and signs locally-born-child
+        // sessions with [deviceSecret].
+        devicePublics: {home!: device.publicB64},
+        deviceSecrets: {home!: device.secret},
         frameworkHash: frameworkHash,
         lawHashes: {home!: lawHashes},
         phaseTimeout: phaseTimeout,

package/dart/lib/src/webview_bridge.dart

@@ -48,7 +48,7 @@ const int kWebviewBridgeVersion = 1;
 /// pre-stamp bundle, which reports nothing) is a stale baked asset and fails loudly at boot.
 /// MUST move with the paired @githolon/client release — a release-hygiene test pairs it with the
 /// runner stamp (the pubspec-pins pattern).
-const String kExpectedRunnerBundleVersion = '0.94.0';
+const String kExpectedRunnerBundleVersion = '0.96.0';
 
 /// A STALE BAKED RUNNER BUNDLE: the app's built assets carry an older nomos-runner.js than this
 /// nomos_client release ships — Flutter's build cache kept it across a pub upgrade. Thrown from
@@ -1028,6 +1028,18 @@ class NomosBridge {
     if (m['ok'] == true) {
       completer.complete(m['result']);
     } else {
+      // TYPED BIRTH FAILURE: the JS holon fails FAST on a birth whose child did not come up, and the
+      // runner forwards the per-child outcome entries on errorInfo.failedBirths — rehydrate the typed
+      // [BirthIncomplete] here (apps switch on the type + entries, never scrape the prose).
+      final failedBirths = ((m['errorInfo'] as Map?)?['failedBirths'] as List?)
+          ?.whereType<Map>()
+          .map((e) => e.cast<String, Object?>())
+          .toList();
+      if (failedBirths != null && failedBirths.isNotEmpty) {
+        completer.completeError(BirthIncomplete(failedBirths,
+            head: ((m['errorInfo'] as Map?)?['head'] ?? '').toString()));
+        return;
+      }
       final info = NomosErrorInfo.fromBridgeMessage(m,
           fallbackOperation: op,
           fallbackTrace: trace,
@@ -1474,8 +1486,10 @@ class NomosBridge {
   /// `final estate = await engine.follow(outcome.bornRefs.single); final app = await EstateClient.bind(estate);`
   /// No loose `{workspaceId, aggregateId}` string pairs in app code. [cloud] binds the mount to a
   /// cloud (omit for the local plane — a locally-born child mounts in place, no re-clone).
+  /// [authorSecret] — the device signing key for the followed session's writes (era-0: an attested-born
+  /// child is WARRANTED; write access needs its owner's enrolled device key).
   Future<NomosSession> follow(NomosRef ref,
-      {String? cloud, String? clientId, String? authToken, bool allowUnborn = false}) async {
+      {String? cloud, String? clientId, String? authToken, bool allowUnborn = false, String? authorSecret}) async {
     final ws = ref.workspace;
     if (ws.isEmpty) {
       throw ArgumentError.value(ref, 'ref',
@@ -1488,7 +1502,8 @@ class NomosBridge {
           session: ws,
           clientId: clientId,
           authToken: authToken,
-          allowUnborn: allowUnborn);
+          allowUnborn: allowUnborn,
+          authorSecret: authorSecret);
     }
     return session(ws);
   }
@@ -1503,8 +1518,13 @@ class NomosBridge {
   ///     [ifAbsentCredentials] invoked — exactly once — and the connect made with what it returns.
   /// Omitting [ifAbsentCredentials] makes a genuinely-absent workspace a named [StateError] instead of a
   /// silent cloudless mount.
+  /// [authorSecret] — the device signing key for THIS session's writes (era-0: a WARRANTED workspace —
+  /// which every attested-born child is — refuses unsigned writes, so a locally-born child the app will
+  /// WRITE to must be acquired with its owner's device key). Applies to the resident (local) open;
+  /// the credentials path takes its own `NomosSessionCredentials.authorSecret` (falling back to this).
   Future<NomosSession> acquireSession(String workspace,
-      {Future<NomosSessionCredentials> Function()? ifAbsentCredentials}) {
+      {Future<NomosSessionCredentials> Function()? ifAbsentCredentials,
+      String? authorSecret}) {
     // Fast path: a live session needs no runner round-trip (and never asks for credentials).
     final plane = _eventPlane;
     if (plane._sessionNames.contains(workspace)) {
@@ -1524,7 +1544,7 @@ class NomosBridge {
           // a pre-connect plane has no registry yet — fall through to the credentials decision below.
         }
         if (resident) {
-          await connect(workspace: workspace, session: workspace, allowUnborn: true);
+          await connect(workspace: workspace, session: workspace, allowUnborn: true, authorSecret: authorSecret);
           return session(workspace);
         }
         if (ifAbsentCredentials == null) {
@@ -1539,7 +1559,7 @@ class NomosBridge {
           session: workspace,
           clientId: c.clientId,
           authToken: c.authToken,
-          authorSecret: c.authorSecret,
+          authorSecret: c.authorSecret ?? authorSecret,
           allowUnborn: c.allowUnborn,
         );
         return session(workspace);
@@ -2495,15 +2515,16 @@ class NomosSession extends NomosBridge {
   /// single-flight registry; a session never owns mounts).
   @override
   Future<NomosSession> acquireSession(String workspace,
-          {Future<NomosSessionCredentials> Function()? ifAbsentCredentials}) =>
-      parent.acquireSession(workspace, ifAbsentCredentials: ifAbsentCredentials);
+          {Future<NomosSessionCredentials> Function()? ifAbsentCredentials,
+          String? authorSecret}) =>
+      parent.acquireSession(workspace, ifAbsentCredentials: ifAbsentCredentials, authorSecret: authorSecret);
 
   /// A followed ref mounts on the SHARED plane — delegate to the parent (a session never owns mounts).
   @override
   Future<NomosSession> follow(NomosRef ref,
-          {String? cloud, String? clientId, String? authToken, bool allowUnborn = false}) =>
+          {String? cloud, String? clientId, String? authToken, bool allowUnborn = false, String? authorSecret}) =>
       parent.follow(ref,
-          cloud: cloud, clientId: clientId, authToken: authToken, allowUnborn: allowUnborn);
+          cloud: cloud, clientId: clientId, authToken: authToken, allowUnborn: allowUnborn, authorSecret: authorSecret);
 
   @override
   Future<Object?> _call(String op, [Map<String, Object?> args = const {}]) =>

package/dart/pubspec.yaml

@@ -11,7 +11,7 @@ description: >-
   Nomos 2 Dart frontend types — the hand-written kernel wire types plus the
   code-generated per-domain aggregate + directive-payload types. (De)serializes
   the EXACT serde JSON the Rust kernel + projection produce/consume.
-version: 0.60.0
+version: 0.61.0
 
 environment:
   sdk: ^3.5.0

package/dart/test/cloud_bound_topology_test.dart

@@ -17,6 +17,7 @@
 import 'dart:convert';
 import 'dart:io';
 
+import 'package:crypto/crypto.dart' show sha256;
 import 'package:nomos_client/nomos_headless.dart';
 import 'package:test/test.dart';
 
@@ -47,7 +48,7 @@ void main() {
     final diag = Platform.environment['NOMOS_HARNESS_DIAG'] == '1'
         ? (String l) => stderr.writeln(l)
         : null;
-    final cloud = await NomosTestCloud.start(serverEntry: _devServer, onDiagnostic: diag);
+    final cloud = await NomosTestCloud.start(serverEntry: _devServer, platform: 'topology-platform', deployJsonPath: _deploy, onDiagnostic: diag);
     NomosTestHarness? harness;
     try {
       // 1+2 — the remote ceremony + the local mount, in one constructor (the app's boot path).
@@ -70,6 +71,11 @@ void main() {
       cloud.setOnline(false);
 
       // 4 — the home births the estate LOCALLY (the app lane never needs the network).
+      // ownerKeyHash: the owner's device (enrolled in the home's genesis) — the estate enrols the SAME
+      // key at birth so it accepts the owner's signed writes from intent 0 (era-0 signer-ready births).
+      final ownerKeyHash = sha256
+          .convert(base64Decode(harness.devicePublicKey(home.workspace)!))
+          .toString();
       final outcome = await harness.bridge.session(home.workspace).offerCreates(
         domain: 'home',
         directiveId: 'birthEstateWorkspace',
@@ -78,6 +84,7 @@ void main() {
           'frameworkHash': harness.frameworkHash,
           'lawHash': harness.lawHashes(home.workspace).first,
           'bornAt': '2026-07-14T00:00:00Z',
+          'ownerKeyHash': ownerKeyHash,
         },
         actor: _subject,
       );
@@ -86,7 +93,7 @@ void main() {
       expect(estateWs, startsWith('estate-'));
 
       // 5 — the estate opens as a sibling session and accepts a LOCAL WRITE while offline.
-      final estate = await harness.bridge.acquireSession(estateWs);
+      final estate = await harness.bridge.acquireSession(estateWs, authorSecret: harness.deviceSecret(home.workspace));
       await estate.offerCreates(
         domain: 'estate',
         directiveId: 'writeEstateNote',

package/dart/test/cluster_births_test.dart

@@ -49,13 +49,15 @@ const _owner = 'sample-owner';
 /// Set up a single-session plane over the estate-birth law + OFFER `birthEstateWorkspace` on it. Returns the
 /// harness (for teardown) + the offer outcome (born / birthOutcomes surfaced). [frameworkHash] overrides the
 /// real framework hash (pass a bogus one to force a genesis failure).
-Future<(NomosTestHarness, NomosOfferOutcome)> _birth({String? frameworkHash}) async {
+Future<(NomosTestHarness, NomosOfferOutcome)> _birth(
+    {String? frameworkHash, void Function(NomosTestHarness)? onHarness}) async {
   final harness = await NomosTestHarness.ephemeral(
     deployJsonPaths: [_birthDeploy],
     nodeEntry: _repoEntry,
     runtimeDir: _runtimeDir,
     workspace: 'estate-birth',
   );
+  onHarness?.call(harness);
   // The genesis recipe installs the framework + child law BY HASH — the harness surfaces both (frameworkHash
   // is not derivable client-side; lawHash is this package's own domainHash).
   final fw = frameworkHash ?? harness.frameworkHash;
@@ -171,18 +173,23 @@ void main() {
     }
     // A well-formed but WRONG framework hash the parent does not fold → the child's step-0 install can't be
     // satisfied → the genesis fold refuses. The offer still admits on the parent (the birth ORDER is valid);
-    // the child's fate comes back as a TYPED failure outcome, not a thrown error or a silent drop.
+    // the child's fate FAILS FAST as the TYPED [BirthIncomplete] (both the JS holon and the bridge throw it
+    // by design — a silent partial birth would strand the app polling head:null), carrying the per-child
+    // typed outcome entries (workspace, status, code, reason) — never a stringly error or a silent drop.
     final badHash = 'deadbeef' * 8; // 64 hex chars, not a package the parent holds
-    final (harness, outcome) = await _birth(frameworkHash: badHash);
+    NomosTestHarness? harness;
     try {
-      expect(outcome.birthOutcomes, isNotEmpty,
-          reason: 'a failed birth still reports its typed verdict to Dart');
-      expect(outcome.birthOutcomes.first['status'], isNot('born'),
+      await _birth(frameworkHash: badHash, onHarness: (h) => harness = h);
+      fail('an unresolvable framework hash must fail the birth (BirthIncomplete expected)');
+    } on BirthIncomplete catch (e) {
+      expect(e.failedBirths, isNotEmpty,
+          reason: 'a failed birth still reports its typed per-child verdicts');
+      expect(e.failedBirths.first['status'], isNot('born'),
           reason: 'an unresolvable framework hash cannot yield a born child');
-      expect((outcome.birthOutcomes.first['reason'] ?? '').toString(), isNotEmpty,
+      expect((e.failedBirths.first['reason'] ?? '').toString(), isNotEmpty,
           reason: 'the failure carries a human-legible reason (never a silent drop)');
     } finally {
-      await harness.dispose();
+      await harness?.dispose();
     }
   }, timeout: const Timeout(Duration(minutes: 3)));
 }

package/dart/test/first_app_gauntlet_test.dart

@@ -14,8 +14,11 @@
 @TestOn('vm')
 library;
 
+import 'dart:convert';
 import 'dart:io';
 
+import 'package:crypto/crypto.dart' show sha256;
+
 import 'package:nomos_client/nomos_headless.dart';
 import 'package:test/test.dart';
 
@@ -139,6 +142,8 @@ void main() {
             frameworkHash: harness.frameworkHash!,
             lawHash: harness.lawHashes(home.workspace).first,
             bornAt: DateTime.now().toUtc().toIso8601String(),
+            // era-0: the estate enrols the owner's device at birth (signer-ready) — the harness device.
+            ownerKeyHash: sha256.convert(base64Decode(harness.devicePublicKey(home.workspace)!)).toString(),
           ),
         );
         expect(birth.workspace, home.workspace,
@@ -146,7 +151,7 @@ void main() {
         expect(birth.born, hasLength(1));
         expect(birth.birthOutcomes.first['status'], 'born');
 
-        final estateSession = await harness.bridge.follow(birth.bornRefs.single);
+        final estateSession = await harness.bridge.follow(birth.bornRefs.single, authorSecret: harness.deviceSecret(home.workspace));
         expect(estateSession.workspace, birth.born.single);
 
         final estateClient = await EstateClient.bind(estateSession, actor: _owner);