@githolon/dsl 0.97.2 → 0.97.3

package/dart/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 0.61.2
+
+- cloudBound works against PRIVATE platforms/homes (declared read caps — the co2 shape): the device
+  ceremony uses a LOCAL scratch session (never clones the platform), and the born home mounts with the
+  dev-IdP token when the caller passes none (a private ledger serves only a VERIFIED principal).
+
 ## 0.61.1
 
 - Runner entry resolution prefers the BUILT `@githolon/client/runner/node-entry.mjs` (published consumers:

package/dart/lib/src/test_harness.dart

@@ -810,13 +810,17 @@ class NomosTestHarness {
           timeout: phaseTimeout ?? _kInstallDeadline,
           onDiagnostic: onDiagnostic,
           run: () async {
-            // The runner's crypto ops (authorKeygen/signBirthCert) run on a CONNECTED holon — open an
-            // onboarding session against the PLATFORM first (reads are open; this is the enrol surface).
+            // The runner's crypto ops (authorKeygen/signBirthCert) run on a CONNECTED holon — open a
+            // SCRATCH session on an unborn name (allowUnborn ⇒ an empty local holon; the pull-miss is
+            // tolerated): a PRIVATE platform (declared read caps — co2's shape) refuses an
+            // unauthenticated ledger clone, and the ceremony never needs the platform's ledger anyway
+            // (its writes go over the HTTP gateway below).
             await plane.connect(
               cloud: cloud.origin,
-              workspace: platformWorkspace,
+              workspace: '$clientId-onboard-scratch',
+              session: '$clientId-onboard-scratch',
               clientId: '$clientId-onboard',
-              authToken: authToken,
+              allowUnborn: true,
             );
             final kp = await plane.authorKeygen();
             final publicB64 = (kp['public'] ?? '').toString();
@@ -895,7 +899,9 @@ class NomosTestHarness {
                 cloud: cloud.origin,
                 workspace: home!,
                 clientId: clientId,
-                authToken: authToken,
+                // A PRIVATE home (declared read caps — co2's shape) serves its ledger only to a VERIFIED
+                // principal: ride the caller's token when given, else the dev-IdP token the ceremony minted.
+                authToken: authToken ?? device.idpToken,
                 // The home was born WARRANTED with THIS device enrolled in its genesis (ownerKeyHash) —
                 // connect with the same key so every write is signed and the home's own `.births()` offers
                 // (estates/catalogues) are device-attested (the client signs the birth cert automatically).

package/dart/pubspec.yaml

@@ -11,7 +11,7 @@ description: >-
   Nomos 2 Dart frontend types — the hand-written kernel wire types plus the
   code-generated per-domain aggregate + directive-payload types. (De)serializes
   the EXACT serde JSON the Rust kernel + projection produce/consume.
-version: 0.61.1
+version: 0.61.2
 
 environment:
   sdk: ^3.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.97.2",
+  "version": "0.97.3",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",