githolon 0.102.0 → 0.102.2

package/dist/cli.mjs

@@ -372,7 +372,7 @@ function makeGitFs(preopen, mount, { File: File4, Directory: Directory4 }) {
     const rel = p.slice(mount.length + 1).replace(/\/+$/, "");
     return rel === "" ? [] : rel.split("/");
   }
-  function resolve7(ps) {
+  function resolve8(ps) {
     let cur = root;
     for (const part of ps) {
       if (!isDir(cur)) return null;
@@ -382,11 +382,11 @@ function makeGitFs(preopen, mount, { File: File4, Directory: Directory4 }) {
     }
     return cur;
   }
-  const parent = (ps) => resolve7(ps.slice(0, -1));
+  const parent = (ps) => resolve8(ps.slice(0, -1));
   const leaf = (ps) => ps[ps.length - 1];
   const promises = {
     async readFile(p, opts) {
-      const n = resolve7(parts(p));
+      const n = resolve8(parts(p));
       if (n === null) throw fsErr("ENOENT", p);
       if (isDir(n)) throw fsErr("EISDIR", p);
       const data = n.data ?? new Uint8Array(0);
@@ -405,7 +405,7 @@ function makeGitFs(preopen, mount, { File: File4, Directory: Directory4 }) {
       if (!isDir(par) || !par.contents.delete(leaf(ps))) throw fsErr("ENOENT", p);
     },
     async readdir(p) {
-      const n = resolve7(parts(p));
+      const n = resolve8(parts(p));
       if (n === null) throw fsErr("ENOENT", p);
       if (!isDir(n)) throw fsErr("ENOTDIR", p);
       return [...n.contents.keys()];
@@ -425,7 +425,7 @@ function makeGitFs(preopen, mount, { File: File4, Directory: Directory4 }) {
       return promises.lstat(p);
     },
     async lstat(p) {
-      const n = resolve7(parts(p));
+      const n = resolve8(parts(p));
       if (n === null) throw fsErr("ENOENT", p);
       const dir = isDir(n);
       return {
@@ -621,7 +621,7 @@ function wasmModuleFor(base, fetchImpl) {
 function parseSnapshot(bytes) {
   try {
     const o = JSON.parse(dec2.decode(bytes));
-    if (o && o.v === 2 && typeof o.tree === "string") return { treeBytes: snapUnb64(o.tree), ckpt: o.ckpt ?? null, frontier: o.frontier ?? null, syncedBase: o.syncedBase ?? null };
+    if (o && o.v === 2 && typeof o.tree === "string") return { treeBytes: nmsInternalSnapshotFromBase64(o.tree), ckpt: o.ckpt ?? null, frontier: o.frontier ?? null, syncedBase: o.syncedBase ?? null };
   } catch {
   }
   return { treeBytes: bytes, ckpt: null, frontier: null, syncedBase: null };
@@ -630,7 +630,7 @@ function buildSnapshot(treeBytes, ckpt, syncedBase) {
   if ((!ckpt || !ckpt.blob && !ckpt.frontier) && !syncedBase) return treeBytes;
   return enc2.encode(JSON.stringify({
     v: 2,
-    tree: snapB64(treeBytes),
+    tree: nmsInternalSnapshotToBase64(treeBytes),
     ckpt: ckpt && ckpt.blob ? ckpt.blob : null,
     frontier: ckpt ? ckpt.frontier ?? null : null,
     cursor: ckpt ? ckpt.cursor ?? null : null,
@@ -870,7 +870,7 @@ function createWasmEnginePlane({ span } = {}) {
           }
           const buf = new Uint8Array(await r.arrayBuffer());
           if (!buf.length) return { applied: false };
-          view.applyPack(snapB64(buf));
+          view.applyPack(nmsInternalSnapshotToBase64(buf));
           return { applied: true };
         } finally {
           if (end) end();
@@ -920,7 +920,7 @@ function createWasmEnginePlane({ span } = {}) {
 function createWasmKernelProvider({ span } = {}) {
   return createWasmEnginePlane({ span }).providerFor();
 }
-var enc2, dec2, snapB64, snapUnb64, unpack, wasmModuleCache;
+var enc2, dec2, nmsInternalSnapshotToBase64, nmsInternalSnapshotFromBase64, unpack, wasmModuleCache;
 var init_kernel_provider_wasm = __esm({
   "../cloud/web-client/src/kernel_provider_wasm.ts"() {
     "use strict";
@@ -930,12 +930,20 @@ var init_kernel_provider_wasm = __esm({
     init_pack_auth_contract();
     enc2 = new TextEncoder();
     dec2 = new TextDecoder();
-    snapB64 = (bytes) => {
+    nmsInternalSnapshotToBase64 = (bytes) => {
+      if (typeof Buffer !== "undefined") {
+        return Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength).toString("base64");
+      }
       let s = "";
-      for (let i = 0; i < bytes.length; i += 32768) s += String.fromCharCode.apply(null, bytes.subarray(i, i + 32768));
+      for (let i = 0; i < bytes.length; i += 32768) {
+        s += String.fromCharCode.apply(null, bytes.subarray(i, i + 32768));
+      }
       return btoa(s);
     };
-    snapUnb64 = (s) => Uint8Array.from(atob(s), (c) => c.charCodeAt(0));
+    nmsInternalSnapshotFromBase64 = (s) => {
+      if (typeof Buffer !== "undefined") return Buffer.from(s, "base64");
+      return Uint8Array.from(atob(s), (c) => c.charCodeAt(0));
+    };
     unpack = (p) => {
       const v = typeof p === "bigint" ? p : BigInt(p);
       return { ptr: Number(v >> 32n), len: Number(v & 0xffffffffn) };
@@ -7430,7 +7438,7 @@ var init_src = __esm({
     };
     ownedRecoveryScope = (principal2) => `${ownedKeyObject(principal2)}#${OWNED_RECOVERY_RELATION}`;
     ownedRecoveryPolicyId = (principal2) => `nomos-owned-recovery-policy:${ownedKeyObject(principal2).slice("nomos-owned-principal:".length)}`;
-    sleep = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
+    sleep = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms));
     OFFER_TIMEOUT_MS = 2e4;
     DIRECT_OFFER_PENDING_MS = 45e3;
     OID40_RE = /^[0-9a-f]{40}$/i;
@@ -7494,7 +7502,7 @@ function makeGitFs2(preopen, mount, { File: File4, Directory: Directory4 }) {
     const rel = p.slice(mount.length + 1).replace(/\/+$/, "");
     return rel === "" ? [] : rel.split("/");
   }
-  function resolve7(ps) {
+  function resolve8(ps) {
     let cur = root;
     for (const part of ps) {
       if (!isDir(cur)) return null;
@@ -7504,11 +7512,11 @@ function makeGitFs2(preopen, mount, { File: File4, Directory: Directory4 }) {
     }
     return cur;
   }
-  const parent = (ps) => resolve7(ps.slice(0, -1));
+  const parent = (ps) => resolve8(ps.slice(0, -1));
   const leaf = (ps) => ps[ps.length - 1];
   const promises = {
     async readFile(p, opts) {
-      const n = resolve7(parts(p));
+      const n = resolve8(parts(p));
       if (n === null) throw fsErr2("ENOENT", p);
       if (isDir(n)) throw fsErr2("EISDIR", p);
       const data = n.data ?? new Uint8Array(0);
@@ -7527,7 +7535,7 @@ function makeGitFs2(preopen, mount, { File: File4, Directory: Directory4 }) {
       if (!isDir(par) || !par.contents.delete(leaf(ps))) throw fsErr2("ENOENT", p);
     },
     async readdir(p) {
-      const n = resolve7(parts(p));
+      const n = resolve8(parts(p));
       if (n === null) throw fsErr2("ENOENT", p);
       if (!isDir(n)) throw fsErr2("ENOTDIR", p);
       return [...n.contents.keys()];
@@ -7547,7 +7555,7 @@ function makeGitFs2(preopen, mount, { File: File4, Directory: Directory4 }) {
       return promises.lstat(p);
     },
     async lstat(p) {
-      const n = resolve7(parts(p));
+      const n = resolve8(parts(p));
       if (n === null) throw fsErr2("ENOENT", p);
       const dir = isDir(n);
       return {
@@ -7739,11 +7747,16 @@ async function pushPack(remote, headers = {}, { updates = [], pack = null } = {}
   });
   cmds.push(FLUSH);
   const body = concatBytes([...cmds, pack && pack.length ? pack : EMPTY_PACK]);
-  const r = await fetch(`${remote}/git-receive-pack`, {
-    method: "POST",
-    headers: { "content-type": "application/x-git-receive-pack-request", ...headers },
-    body
-  });
+  let r;
+  try {
+    r = await fetch(`${remote}/git-receive-pack`, {
+      method: "POST",
+      headers: { "content-type": "application/x-git-receive-pack-request", ...headers },
+      body
+    });
+  } catch (error) {
+    throw new Error(`receive-pack transport failed (${body.byteLength} bytes): ${String(error)}`, { cause: error });
+  }
   const txt = dec5.decode(new Uint8Array(await r.arrayBuffer()));
   const unpacked = /unpack ok/.test(txt);
   const everyRefOk = updates.every((u) => new RegExp(`ok ${u.ref.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}`).test(txt));
@@ -9301,7 +9314,12 @@ async function custodyFetch(eng, ws, ledger, { remoteRef = "refs/heads/main", lo
 async function custodyPush(eng, ws, ledger, { localRef = null, remoteRef, del = false, pointer = false, newOid = null }) {
   const headers = ledger.headers || {};
   const remoteRefFull = fullRef(remoteRef);
-  const remote = await lsRefs(ledger.remote, headers, { service: "git-receive-pack", prefix: remoteRefFull });
+  let remote;
+  try {
+    remote = await lsRefs(ledger.remote, headers, { service: "git-receive-pack", prefix: remoteRefFull });
+  } catch (error) {
+    throw new Error(`custody receive-pack advertisement failed for ${remoteRefFull}: ${String(error)}`, { cause: error });
+  }
   const oldOid = remote[remoteRefFull] || ZERO_OID;
   if (del) {
     if (oldOid === ZERO_OID) return;
@@ -9315,14 +9333,21 @@ async function custodyPush(eng, ws, ledger, { localRef = null, remoteRef, del =
     pack = oldOid !== ZERO_OID ? packDelta(eng, ws, oldOid, tgt) : null;
     if (!pack) pack = packDelta(eng, ws, "", tgt);
   }
-  return pushVia(ledger, () => pushPack(ledger.remote, headers, { updates: [{ ref: remoteRefFull, oldOid, newOid: tgt }], pack }));
+  const packBytes = pack?.byteLength ?? 0;
+  try {
+    return await pushVia(ledger, () => pushPack(ledger.remote, headers, { updates: [{ ref: remoteRefFull, oldOid, newOid: tgt }], pack }));
+  } catch (error) {
+    throw new Error(`custody receive-pack push failed for ${remoteRefFull} (${packBytes} pack bytes): ${String(error)}`, { cause: error });
+  }
 }
 async function commitAndPush(eng, ws, ledger) {
   try {
     await custodyPush(eng, ws, ledger, { remoteRef: "refs/heads/main" });
   } catch (e) {
     unmount(eng, ws);
-    throw new Error(`ledger push failed \u2014 write NOT durable, rolled back to ledger: ${e}`);
+    const cause = e instanceof Error ? e.cause : void 0;
+    const detail = cause === void 0 ? String(e) : `${e}; cause: ${String(cause)}`;
+    throw new Error(`ledger push failed \u2014 write NOT durable, rolled back to ledger: ${detail}`, { cause: e });
   }
 }
 async function pushShape(eng, ws, ledger) {
@@ -11216,7 +11241,7 @@ async function waitForWorkspaceMain(cloud, workspace, timeoutMs = 3e4) {
   while (Date.now() < deadline) {
     const head = await workspaceMainHead(cloud, workspace);
     if (head !== void 0) return head;
-    await new Promise((resolve7) => setTimeout(resolve7, 250));
+    await new Promise((resolve8) => setTimeout(resolve8, 250));
   }
   return void 0;
 }
@@ -11310,7 +11335,7 @@ async function ensureSovereignHome(opts = {}) {
     const deadline = Date.now() + 3e4;
     while (Date.now() < deadline) {
       if (await fetch(`${cloud}/v2/workspaces/${encodeURIComponent(home)}`).then((r) => r.ok).catch(() => false)) break;
-      await new Promise((resolve7) => setTimeout(resolve7, 250));
+      await new Promise((resolve8) => setTimeout(resolve8, 250));
     }
     if (!await fetch(`${cloud}/v2/workspaces/${encodeURIComponent(home)}`).then((r) => r.ok).catch(() => false)) {
       throw new Error(`Nomos admitted the birth of '${home}' but its custody did not become readable`);
@@ -11358,7 +11383,7 @@ async function ensureSovereignHome(opts = {}) {
         return typeof leaf?.verifiedVia === "string" && leaf.verifiedVia.length > 0;
       }).catch(() => false);
       if (visible) break;
-      await new Promise((resolve7) => setTimeout(resolve7, 250));
+      await new Promise((resolve8) => setTimeout(resolve8, 250));
     }
     if (!visible) throw new Error(`the session home's verified device enrollment did not become readable`);
   }
@@ -13414,7 +13439,13 @@ function discoverDeployJson(cwd, explicit) {
   if (!existsSync4(buildDir)) {
     throw new Error("no build/ directory \u2014 run `githolon compile` first (or pass --file <path>)");
   }
-  const bodies = readdirSync3(buildDir).filter((f) => f.endsWith(".deploy.json"));
+  const files = readdirSync3(buildDir);
+  const applications = files.filter((f) => f.endsWith(".application.usda"));
+  if (applications.length === 1) return join5(buildDir, applications[0]);
+  if (applications.length > 1) {
+    throw new Error(`multiple application stages in build/ (${applications.join(", ")}) \u2014 pass --file <path>`);
+  }
+  const bodies = files.filter((f) => f.endsWith(".deploy.json"));
   if (bodies.length === 0) {
     throw new Error("no build/*.deploy.json \u2014 run `githolon compile` first (or pass --file <path>)");
   }
@@ -13668,12 +13699,11 @@ async function waitForDurableMainAdvance(cloud, ws, previousHead, opts = {}) {
   while (Date.now() < deadline) {
     const head = await durableMainHead(cloud, ws, fetchImpl);
     if (head !== void 0 && head !== previousHead) return head;
-    await new Promise((resolve7) => setTimeout(resolve7, pollMs));
+    await new Promise((resolve8) => setTimeout(resolve8, pollMs));
   }
   return void 0;
 }
 async function deploy2(ws, opts) {
-  const cloud = cloudBase(opts.cloud);
   let file;
   try {
     file = discoverDeployJson(process.cwd(), opts.file);
@@ -13681,6 +13711,31 @@ async function deploy2(ws, opts) {
     err4(e.message);
     return 1;
   }
+  if (file.endsWith(".application.usda")) {
+    let application;
+    try {
+      const { applicationDeploymentPlan } = await import("@githolon/dsl/application-composition");
+      application = applicationDeploymentPlan(file);
+    } catch (error) {
+      err4(`application deployment refused: ${error.message}`);
+      return 1;
+    }
+    out4(`deploying ${application.application} from ${file.split("/").pop()} \u2014 topology comes from OpenUSD`);
+    for (const pkg of application.packages) {
+      out4(`  ${pkg.placement === "payload" ? "payload" : "reference"} ${pkg.packageName}`);
+      const code = await deployPackage(ws, opts, pkg.deployPath, pkg.placement);
+      if (code !== 0) {
+        err4(`application '${application.application}' stopped at ${pkg.packageName}; later packages were not attempted`);
+        return code;
+      }
+    }
+    out4(`\u2713 application ${application.application} deployed from its OpenUSD composition`);
+    return 0;
+  }
+  return deployPackage(ws, opts, file, "auto");
+}
+async function deployPackage(ws, opts, file, placement) {
+  const cloud = cloudBase(opts.cloud);
   const fileName = file.split("/").pop();
   try {
     const { ensureApplicationWorkspace: ensureApplicationWorkspace2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
@@ -13742,9 +13797,16 @@ async function deploy2(ws, opts) {
     );
     return 1;
   }
-  let expectsPending = plan !== void 0 && plan.predecessorCandidates.length === 1 && !plan.idempotent;
+  let expectsPending = placement === "payload" || plan !== void 0 && plan.predecessorCandidates.length === 1 && !plan.idempotent;
   const principal2 = opts.principal ?? activePrincipal();
   const signed = opts.principal !== void 0 || principal2 !== void 0 && getDeviceKey(principal2) !== void 0;
+  if (placement === "payload" && !signed) {
+    err4(
+      `application payload '${fileName}' must be staged by a signed principal; the unsigned package lane cannot promise that child law stays inactive on the platform workspace`
+    );
+    err4(`  run githolon login --agent and enroll/import that principal's device key, then deploy again`);
+    return 1;
+  }
   let phaseSuffix = "";
   let deployedHash;
   if (signed) {
@@ -17366,7 +17428,11 @@ var init_home = __esm({
       workspaceName: t.string().merge(Lww),
       /** ISO-8601, caller-stamped (determinism — no clock in the plan). */
       bornAt: t.string().merge(Lww)
-    }, { cap: 1 }).public();
+      // The group's genesis seats its controller in OWNED_READ_RELATION below. Declaring that same capability
+      // here makes the law's coarse pack gate recognise the seat, so a newly enrolled device can clone its own
+      // receiving group before any tenant records or tenant-authored grants exist. This remains ordinary,
+      // replayable Zanzibar state: revocation removes the seat; there is no kernel-level founder bypass.
+    }, { cap: 1 }).readableBy(OWNED_READ_RELATION2);
     ReceivingGroupPolicy = aggregate("NomosInternalReceivingGroupPolicy7c1f5e", {
       additionalDevice: t.string().merge(Lww),
       revocation: t.string().merge(Lww),
@@ -17386,7 +17452,7 @@ var init_home = __esm({
       allow: [user()]
     });
     seedReceivingGroup = directive("nomosInternalSeedReceivingGroup7c1f5e").ensures(ReceivingGroup).payload(z9.object({ principal: z9.string().min(1), workspaceName: z9.string().min(1), bornAt: z9.string().min(1) })).plan((p) => writeReceivingGroup(p));
-    receivingGroupNameBindsPrincipal = workspaceInvariant("ReceivingGroupNameBindsPrincipal").on("nomosInternalSeedReceivingGroup7c1f5e").reads(() => [refAs("group", "NomosInternalReceivingGroup7c1f5e", RECEIVING_GROUP_ID)]).assert(({ group: group2 }) => {
+    receivingGroupNameBindsPrincipal = workspaceInvariant("ReceivingGroupNameBindsPrincipal").on("nomosInternalSeedReceivingGroup7c1f5e").reads(() => [refAs("group", "NomosInternalReceivingGroup7c1f5e", RECEIVING_GROUP_ID)]).declassify("the receiving-group address is a public hash of its stable principal; refusing a mismatch reveals no private field").assert(({ group: group2 }) => {
       const g = group2 ?? {};
       const expected = RECEIVING_GROUP_NAME_PREFIX + nomos.sha256(String(g.principal ?? "")).slice(0, RECEIVING_GROUP_NAME_HASH_LEN);
       return g.workspaceName === expected ? { accept: true } : { reject: "a receiving group's workspace name must hash its stable principal" };
@@ -17395,7 +17461,7 @@ var init_home = __esm({
       refAs("group", "NomosInternalReceivingGroup7c1f5e", RECEIVING_GROUP_ID),
       refAs("policy", "NomosInternalReceivingGroupPolicy7c1f5e", RECEIVING_GROUP_POLICY_ID)
     ];
-    receivingGroupRejectsKeylessAdditionalDevice = workspaceInvariant("ReceivingGroupRejectsKeylessAdditionalDevice").on("enrollFirstDevice").reads(receivingGroupPolicyRefs).assert(({ group: group2 }) => typeof group2?.principal !== "string" || group2.principal.length === 0 ? { accept: true } : { reject: "receiving-group-additional-device-requires-current-device-or-guardian" });
+    receivingGroupRejectsKeylessAdditionalDevice = workspaceInvariant("ReceivingGroupRejectsKeylessAdditionalDevice").on("enrollFirstDevice").reads(receivingGroupPolicyRefs).declassify("device enrollment deliberately reveals that this receiving group has already completed first-device bootstrap").assert(({ group: group2 }) => typeof group2?.principal !== "string" || group2.principal.length === 0 ? { accept: true } : { reject: "receiving-group-additional-device-requires-current-device-or-guardian" });
     receivingGroupAdditionalDeviceFollowsPolicy = workspaceInvariant("ReceivingGroupAdditionalDeviceFollowsPolicy").on("enrollSignerSelf").reads(receivingGroupPolicyRefs).declassify("device lifecycle policy intentionally branches on principal_verified").assert(({ group: group2, policy }, ctx) => {
       if (typeof group2?.principal !== "string" || group2.principal.length === 0) return { accept: true };
       const p = policy;
@@ -18918,6 +18984,74 @@ var init_mcp = __esm({
   }
 });
 
+// src/test.ts
+var test_exports = {};
+__export(test_exports, {
+  resolveTestCloudEntry: () => resolveTestCloudEntry,
+  runDartTests: () => runDartTests
+});
+import { spawnSync as spawnSync6 } from "node:child_process";
+import { existsSync as existsSync12 } from "node:fs";
+import { dirname as dirname8, resolve as resolve5 } from "node:path";
+import { fileURLToPath } from "node:url";
+function resolveTestCloudEntry(options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  const environment = options.environment ?? process.env;
+  const explicit = environment.NOMOS_TEST_CLOUD_ENTRY;
+  if (explicit !== void 0) {
+    const candidate = resolve5(cwd, explicit);
+    if (!existsSync12(candidate)) {
+      throw new Error(`NOMOS_TEST_CLOUD_ENTRY does not exist: ${candidate}`);
+    }
+    return candidate;
+  }
+  const here = dirname8(fileURLToPath(options.moduleUrl ?? import.meta.url));
+  const candidates = [
+    resolve5(here, "dev-server.mjs"),
+    resolve5(here, "../dist/dev-server.mjs"),
+    resolve5(here, "../../cloud/dev-server/server.ts"),
+    resolve5(cwd, "cloud/dev-server/server.ts")
+  ];
+  const server = candidates.find((candidate) => existsSync12(candidate));
+  if (server === void 0) {
+    throw new Error("the bundled local Nomos cloud is missing \u2014 rebuild or reinstall githolon");
+  }
+  return server;
+}
+function runDartTests(args) {
+  const diagnostics = args.includes("--diagnostics");
+  const forwarded = args.filter((arg) => arg !== "--diagnostics");
+  let serverEntry;
+  try {
+    serverEntry = resolveTestCloudEntry();
+  } catch (error) {
+    process.stderr.write(`error: ${error instanceof Error ? error.message : error}
+`);
+    return 1;
+  }
+  process.stdout.write("githolon test \u2014 generated application scenarios with real local custody\n");
+  const result = spawnSync6("flutter", ["test", ...forwarded], {
+    cwd: process.cwd(),
+    stdio: "inherit",
+    env: {
+      ...process.env,
+      NOMOS_TEST_CLOUD_ENTRY: serverEntry,
+      ...diagnostics ? { NOMOS_TEST_DIAGNOSTICS: "1" } : {}
+    }
+  });
+  if (result.error !== void 0) {
+    process.stderr.write(`error: could not run Flutter tests: ${result.error.message}
+`);
+    return 1;
+  }
+  return result.status ?? 1;
+}
+var init_test = __esm({
+  "src/test.ts"() {
+    "use strict";
+  }
+});
+
 // src/harness.ts
 var harness_exports = {};
 __export(harness_exports, {
@@ -18925,7 +19059,7 @@ __export(harness_exports, {
   harnessInstall: () => harnessInstall,
   looksLikeStaleRuntime: () => looksLikeStaleRuntime
 });
-import { existsSync as existsSync12, readFileSync as readFileSync13, writeFileSync as writeFileSync8 } from "node:fs";
+import { existsSync as existsSync13, readFileSync as readFileSync13, writeFileSync as writeFileSync8 } from "node:fs";
 import { join as join14 } from "node:path";
 import { randomBytes as randomBytes3 } from "node:crypto";
 function looksLikeStaleRuntime(msg) {
@@ -18942,7 +19076,7 @@ async function harnessInstall(opts) {
 `);
   const wasmFile = join14(runtimeDir, "holon-testmint.wasm");
   const pkgsFile = join14(runtimeDir, "packages.json");
-  if (!existsSync12(wasmFile) || !existsSync12(pkgsFile)) {
+  if (!existsSync13(wasmFile) || !existsSync13(pkgsFile)) {
     die(
       `test runtime cache missing at ${runtimeDir} (holon-testmint.wasm + packages.json). Warm it once with a \`githolon\` run (it fetches + caches the runtime), then re-run offline.`
     );
@@ -18979,7 +19113,7 @@ async function harnessInstall(opts) {
   const lawHashes = [];
   const expectedDomainLaw = /* @__PURE__ */ new Map();
   for (const p of deployPaths) {
-    if (!existsSync12(p)) die(`deploy JSON not found: ${p} \u2014 run \`npx githolon compile\` first`);
+    if (!existsSync13(p)) die(`deploy JSON not found: ${p} \u2014 run \`npx githolon compile\` first`);
     const deploy3 = JSON.parse(readFileSync13(p, "utf8"));
     const usda = deploy3.packageUsda;
     if (typeof usda !== "string" || !usda.startsWith("#usda")) die(`${p} has no #usda packageUsda`);
@@ -19043,11 +19177,11 @@ var doctor_exports = {};
 __export(doctor_exports, {
   doctor: () => doctor
 });
-import { existsSync as existsSync13, readFileSync as readFileSync14 } from "node:fs";
+import { existsSync as existsSync14, readFileSync as readFileSync14 } from "node:fs";
 function readLocalCompat(cwd, file) {
   try {
     const path2 = discoverDeployJson(cwd, file);
-    if (!existsSync13(path2)) return void 0;
+    if (!existsSync14(path2)) return void 0;
     const body = JSON.parse(readFileSync14(path2, "utf8"));
     return body.nomosCompat;
   } catch {
@@ -22328,8 +22462,8 @@ var scene_exports = {};
 __export(scene_exports, {
   scene: () => scene
 });
-import { existsSync as existsSync14, mkdirSync as mkdirSync6, writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join15, resolve as resolve5 } from "node:path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync6, writeFileSync as writeFileSync9 } from "node:fs";
+import { join as join15, resolve as resolve6 } from "node:path";
 import { createHash as createHash6 } from "node:crypto";
 import git3 from "isomorphic-git";
 async function walkChain2(eng, ws) {
@@ -22350,8 +22484,8 @@ async function projectOnce(cloud, target, isDir, name) {
   const { eng } = await holonEngine(cloud, void 0, "githolon-scene");
   const SOURCE3 = "source";
   if (isDir) {
-    const gitDir = existsSync14(join15(target, ".git")) ? join15(target, ".git") : target;
-    if (!existsSync14(join15(gitDir, "HEAD"))) throw new Error(`${target} is not a git repo (no HEAD)`);
+    const gitDir = existsSync15(join15(target, ".git")) ? join15(target, ".git") : target;
+    if (!existsSync15(join15(gitDir, "HEAD"))) throw new Error(`${target} is not a git repo (no HEAD)`);
     await mountFresh(eng, SOURCE3);
     eng.preopen.dir.contents.get("ws").contents.get(SOURCE3).contents.set("nomos.git", readTreeFromDisk(gitDir));
   } else {
@@ -22410,9 +22544,9 @@ async function projectOnce(cloud, target, isDir, name) {
 }
 async function scene(target, opts) {
   const cloud = cloudBase(opts.cloud);
-  const isDir = existsSync14(target) || target.includes("/") || target.startsWith(".");
-  const name = isDir ? (resolve5(target).split("/").filter(Boolean).pop() ?? "scene").replace(/\.git$/, "") : target;
-  out11(`scene \u2014 ${name} (${isDir ? resolve5(target) : `${cloud} :: ${target}`})`);
+  const isDir = existsSync15(target) || target.includes("/") || target.startsWith(".");
+  const name = isDir ? (resolve6(target).split("/").filter(Boolean).pop() ?? "scene").replace(/\.git$/, "") : target;
+  out11(`scene \u2014 ${name} (${isDir ? resolve6(target) : `${cloud} :: ${target}`})`);
   let first2, second;
   try {
     first2 = await projectOnce(cloud, target, isDir, name);
@@ -22430,7 +22564,7 @@ async function scene(target, opts) {
     err11(`the emitted stage violates the portable profile: ${violations.join("; ")}`);
     return 1;
   }
-  const outDir = resolve5(opts.out ?? join15("scene", name));
+  const outDir = resolve6(opts.out ?? join15("scene", name));
   mkdirSync6(outDir, { recursive: true });
   const usdaPath = join15(outDir, `${name}.usda`);
   const usdzPath = join15(outDir, `${name}.usdz`);
@@ -22521,12 +22655,12 @@ var init_dlq = __esm({
 });
 
 // src/cli.ts
-import { existsSync as existsSync15, readdirSync as readdirSync6, readFileSync as readFileSync15 } from "node:fs";
-import { spawn as spawn2, spawnSync as spawnSync6 } from "node:child_process";
+import { existsSync as existsSync16, readdirSync as readdirSync6, readFileSync as readFileSync15 } from "node:fs";
+import { spawn as spawn2, spawnSync as spawnSync7 } from "node:child_process";
 import { createHash as createHash7 } from "node:crypto";
 import { createRequire as createRequire3 } from "node:module";
-import { dirname as dirname8, join as join16, resolve as resolve6 } from "node:path";
-import { pathToFileURL as pathToFileURL5, fileURLToPath } from "node:url";
+import { dirname as dirname9, join as join16, resolve as resolve7 } from "node:path";
+import { pathToFileURL as pathToFileURL5, fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/generate.ts
 import { mkdirSync, existsSync, writeFileSync } from "node:fs";
@@ -25383,7 +25517,8 @@ var HELP = {
       ["[config]", "package or application authoring input (default: nomos.package.mjs)"],
       ["--require-usdcat", "refuse unless stock OpenUSD flattens to the same canonical law"],
       ["--compact", "emit the compact executable package envelope"],
-      ["--analyze", "run dart analyze on generated Dart packages"]
+      ["--analyze", "run dart analyze on generated Dart packages"],
+      ["--no-mount-check", "emit without the CLI runtime mountability gate (framework/CI escape hatch)"]
     ],
     examples: ["githolon compile", "githolon compile nomos.application.mjs --require-usdcat"]
   },
@@ -25392,6 +25527,15 @@ var HELP = {
     what: "Run the application-wide proof GENERATED from your business law. By default it opens a blank\nlocal application through the same generated API tenant code uses, executes its business journey,\nsynchronizes, reopens, and reads the saved records back. --live runs that same business proof against\nNomos Cloud; identity, provisioning, persistence, and cleanup remain inside Nomos. ALL GREEN or it names the jam.",
     examples: ["githolon proof", "githolon proof build/co2.proof.mts", "githolon proof --live"]
   },
+  test: {
+    usage: "githolon test [test-file-or-flutter-test-flags] [--diagnostics]",
+    what: "Run generated Dart application scenarios through Flutter with the real local Nomos custody plane.\nThe server rides inside githolon; connected scenarios, partitions, restarts and fresh reinstalls need no\nserver path, environment variables, certificates, workspace setup or separate application state.",
+    flags: [
+      ["[test file/flags]", "forwarded to flutter test"],
+      ["--diagnostics", "show framework/cloud diagnostics when investigating a failing scenario"]
+    ],
+    examples: ["githolon test", "githolon test test/catalogue_birth_test.dart", "githolon test --diagnostics"]
+  },
   dev: {
     usage: "githolon dev [--port <n>] [--cloud <url>] [--once]",
     what: "THE INNER LOOP: watch domains/ + nomos.package.mjs, recompile on save, install the law into\na LOCAL holon (the same engine plane the cloud edge runs \u2014 your data SURVIVES law edits),\nrerun the generated local business checks, and serve the generated application on localhost.\nFully offline after the first runtime fetch (~/.holon/runtime).",
@@ -25583,11 +25727,11 @@ var HELP = {
     examples: ["githolon revoke creation 32c7100e-\u2026", "githolon revoke admin 32c7100e-\u2026"]
   },
   deploy: {
-    usage: "githolon deploy [<ws>] [--as <uid>] [--file <deploy.json>] [--cloud <url>] [--target <name>]",
-    what: "Put the compiled model in the workspace's verified custody. There is one lifecycle: the first\nmodel becomes active so a blank application can start; every successor stays Pending while the current\nmodel keeps serving. The candidate generated client then runs the exact-history proof through\n`model.adopt()` and either adopts immediately or returns a business-readable decision requiring\n`decision.accept(reason)`. Deployment cannot choose a replacement mode or bypass that proof.\nRe-deploying the same content hash is idempotent. With no <ws>, the project's workspace binding resolves it.",
+    usage: "githolon deploy [<ws>] [--as <uid>] [--file <application.usda|deploy.json>] [--cloud <url>] [--target <name>]",
+    what: "Deploy the compiled application from its OpenUSD composition. Reference-only packages serve on\nthe application workspace; payload packages are staged for child birth and never made current there.\nFor a one-package project, the package deploy body remains the shorthand. There is one model lifecycle:\nthe first serving model becomes active; a successor stays Pending while the current model keeps serving,\nand the generated candidate client owns exact-history adoption. Re-deploying the same content hash is\nidempotent. With no <ws>, the project's workspace binding resolves it.",
     flags: [
       ["--as <uid>", "attribute the deployment to this principal (needs its enrolled signing key)"],
-      ["--file <path>", "an explicit deploy body (default: the one build/*.deploy.json)"],
+      ["--file <path>", "an application USDA or package deploy body (default: build/*.application.usda, else the one deploy body)"],
       ["--target <name>", "pick among named targets (workspace: { dev: \u2026, prod: \u2026 })"],
       ["--cloud <url>", "target cloud"]
     ],
@@ -26121,6 +26265,7 @@ var USAGE = `githolon \u2014 model a business; Nomos owns the compute science
 Start here:
   githolon compile                 compile aggregates, birth, directives, and reads into law + a typed client
   githolon proof                   run the generated business proof in the real local engine
+  githolon test                    run generated Dart scenarios with real local custody
   githolon dev                     watch, compile, and rerun that proof on every save
   githolon check                   explain anything the law can already prove it would refuse
 
@@ -26246,17 +26391,17 @@ function isKind(s) {
 function resolvedTsxCli() {
   const resolvePkgDir = (name, fromDir) => {
     try {
-      return dirname8(createRequire3(pathToFileURL5(join16(fromDir, "noop.js"))).resolve(`${name}/package.json`));
+      return dirname9(createRequire3(pathToFileURL5(join16(fromDir, "noop.js"))).resolve(`${name}/package.json`));
     } catch {
       return void 0;
     }
   };
   const dslDir = (() => {
     try {
-      return dirname8(createRequire3(pathToFileURL5(join16(process.cwd(), "noop.js"))).resolve("@githolon/dsl/package.json"));
+      return dirname9(createRequire3(pathToFileURL5(join16(process.cwd(), "noop.js"))).resolve("@githolon/dsl/package.json"));
     } catch {
       try {
-        return dirname8(createRequire3(import.meta.url).resolve("@githolon/dsl/package.json"));
+        return dirname9(createRequire3(import.meta.url).resolve("@githolon/dsl/package.json"));
       } catch {
         return void 0;
       }
@@ -26270,24 +26415,24 @@ function resolvedTsxCli() {
 }
 async function runGeneratedApplicationProofLocally(proofPath) {
   const deployPath = proofPath.replace(/\.proof\.mts$/, ".deploy.json");
-  if (deployPath === proofPath || !existsSync15(deployPath)) {
+  if (deployPath === proofPath || !existsSync16(deployPath)) {
     throw new Error(`generated application proof needs its sibling deploy artifact: ${deployPath}`);
   }
-  const here = dirname8(fileURLToPath(import.meta.url));
+  const here = dirname9(fileURLToPath2(import.meta.url));
   const serverCandidates = [
-    resolve6(here, "dev-server.mjs"),
-    resolve6(here, "../dist/dev-server.mjs"),
-    resolve6(here, "../../cloud/dev-server/server.ts"),
-    resolve6(process.cwd(), "cloud/dev-server/server.ts")
+    resolve7(here, "dev-server.mjs"),
+    resolve7(here, "../dist/dev-server.mjs"),
+    resolve7(here, "../../cloud/dev-server/server.ts"),
+    resolve7(process.cwd(), "cloud/dev-server/server.ts")
   ];
-  const serverPath = serverCandidates.find((candidate) => existsSync15(candidate));
+  const serverPath = serverCandidates.find((candidate) => existsSync16(candidate));
   if (serverPath === void 0) {
     throw new Error("the bundled local Nomos cloud is missing \u2014 rebuild or reinstall githolon");
   }
   const candidateRuntime = process.env.NOMOS_CANDIDATE_RUNTIME ?? process.env.NOMOS_OFFLINE_RUNTIME;
   const candidateTestMint = candidateRuntime === void 0 ? void 0 : join16(candidateRuntime, "holon-testmint.wasm");
   const priorLocalWasm = process.env.NOMOS_LOCAL_WASM;
-  if (candidateTestMint !== void 0 && existsSync15(candidateTestMint)) process.env.NOMOS_LOCAL_WASM = candidateTestMint;
+  if (candidateTestMint !== void 0 && existsSync16(candidateTestMint)) process.env.NOMOS_LOCAL_WASM = candidateTestMint;
   const module = await import(pathToFileURL5(serverPath).href);
   if (typeof module.startGeneratedApplicationProofCloud !== "function") {
     throw new Error("the bundled local Nomos cloud predates generated application execution \u2014 rebuild githolon");
@@ -26351,11 +26496,11 @@ async function runProof(args) {
   const explicit = args.find((a, i) => !a.startsWith("--") && i !== domainValueIdx);
   let proofPath;
   if (explicit !== void 0) {
-    proofPath = resolve6(process.cwd(), explicit);
-    if (!existsSync15(proofPath)) return refuse(`proof not found: ${proofPath} \u2014 run \`githolon compile\` to (re)generate it`);
+    proofPath = resolve7(process.cwd(), explicit);
+    if (!existsSync16(proofPath)) return refuse(`proof not found: ${proofPath} \u2014 run \`githolon compile\` to (re)generate it`);
   } else {
     const buildDir = join16(process.cwd(), "build");
-    if (!existsSync15(buildDir)) {
+    if (!existsSync16(buildDir)) {
       return refuse("no build/ directory here \u2014 run `githolon compile` first (every compile generates build/<name>.proof.mts from your law)");
     }
     const proofs = readdirSync6(buildDir).filter((f) => f.endsWith(".proof.mts"));
@@ -26407,7 +26552,7 @@ async function runProof(args) {
   const proofWorkspace = `nomos-proof-${proofIdentity}`;
   const deployed = await deploy2(proofWorkspace, { principal: barePrincipal });
   if (deployed !== 0) return refuse("proof --live: Nomos could not install the compiled business law into its isolated acceptance application");
-  const r = spawnSync6(process.execPath, [tsxCli, proofPath], {
+  const r = spawnSync7(process.execPath, [tsxCli, proofPath], {
     stdio: "inherit",
     cwd: process.cwd(),
     env: {
@@ -26473,9 +26618,10 @@ async function main(argv) {
     return 0;
   }
   if (argv[0] === "compile") {
-    const status2 = runCompile(argv.slice(1));
+    const skipMountCheck = argv.includes("--no-mount-check");
+    const status2 = runCompile(argv.slice(1).filter((arg) => arg !== "--no-mount-check"));
     if (status2 !== 0) return status2;
-    if (argv.includes("--no-mount-check")) return status2;
+    if (skipMountCheck) return status2;
     try {
       const { assertCompiledMountable: assertCompiledMountable2 } = await Promise.resolve().then(() => (init_mountability(), mountability_exports));
       const { cloudBase: cloudBase2 } = await Promise.resolve().then(() => (init_cloud(), cloud_exports));
@@ -26516,6 +26662,10 @@ async function main(argv) {
   if (argv[0] === "proof") {
     return runProof(argv.slice(1));
   }
+  if (argv[0] === "test") {
+    const { runDartTests: runDartTests2 } = await Promise.resolve().then(() => (init_test(), test_exports));
+    return runDartTests2(argv.slice(1));
+  }
   if (argv[0] === "harness-install") {
     const rest = argv.slice(1);
     const pull = (flag) => {
@@ -26591,22 +26741,22 @@ usage: githolon cloud dev [--port <n>] [--data <dir>] [--ephemeral]
 `);
       return 1;
     }
-    const { spawnSync: spawnSync7 } = await import("node:child_process");
-    const here = dirname8(fileURLToPath(import.meta.url));
+    const { spawnSync: spawnSync8 } = await import("node:child_process");
+    const here = dirname9(fileURLToPath2(import.meta.url));
     const candidates = [
-      resolve6(here, "dev-server.mjs"),
+      resolve7(here, "dev-server.mjs"),
       // published: dist/dev-server.mjs
-      resolve6(here, "../../cloud/dev-server/server.mjs"),
+      resolve7(here, "../../cloud/dev-server/server.mjs"),
       // in-repo (tsx / unbuilt) fallbacks
-      resolve6(here, "../../../cloud/dev-server/server.mjs"),
-      resolve6(process.cwd(), "cloud/dev-server/server.mjs")
+      resolve7(here, "../../../cloud/dev-server/server.mjs"),
+      resolve7(process.cwd(), "cloud/dev-server/server.mjs")
     ];
-    const serverPath = candidates.find((p) => existsSync15(p));
+    const serverPath = candidates.find((p) => existsSync16(p));
     if (!serverPath) {
       process.stderr.write("error: dev-server not found \u2014 reinstall `githolon` or run `npm run build` in the cli package\n");
       return 1;
     }
-    const r = spawnSync7(process.execPath, [serverPath, ...argv.slice(2)], { stdio: "inherit" });
+    const r = spawnSync8(process.execPath, [serverPath, ...argv.slice(2)], { stdio: "inherit" });
     return r.status ?? 0;
   }
   if (argv[0] === "replay") {

package/dist/dev-server.mjs

@@ -268,11 +268,16 @@ async function pushPack(remote, headers = {}, { updates = [], pack = null } = {}
   });
   cmds.push(FLUSH);
   const body = concatBytes([...cmds, pack && pack.length ? pack : EMPTY_PACK]);
-  const r = await fetch(`${remote}/git-receive-pack`, {
-    method: "POST",
-    headers: { "content-type": "application/x-git-receive-pack-request", ...headers },
-    body
-  });
+  let r;
+  try {
+    r = await fetch(`${remote}/git-receive-pack`, {
+      method: "POST",
+      headers: { "content-type": "application/x-git-receive-pack-request", ...headers },
+      body
+    });
+  } catch (error) {
+    throw new Error(`receive-pack transport failed (${body.byteLength} bytes): ${String(error)}`, { cause: error });
+  }
   const txt = dec2.decode(new Uint8Array(await r.arrayBuffer()));
   const unpacked = /unpack ok/.test(txt);
   const everyRefOk = updates.every((u) => new RegExp(`ok ${u.ref.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}`).test(txt));
@@ -878,7 +883,12 @@ async function custodyFetch(eng, ws, ledger, { remoteRef = "refs/heads/main", lo
 async function custodyPush(eng, ws, ledger, { localRef = null, remoteRef, del = false, pointer = false, newOid = null }) {
   const headers = ledger.headers || {};
   const remoteRefFull = fullRef(remoteRef);
-  const remote = await lsRefs(ledger.remote, headers, { service: "git-receive-pack", prefix: remoteRefFull });
+  let remote;
+  try {
+    remote = await lsRefs(ledger.remote, headers, { service: "git-receive-pack", prefix: remoteRefFull });
+  } catch (error) {
+    throw new Error(`custody receive-pack advertisement failed for ${remoteRefFull}: ${String(error)}`, { cause: error });
+  }
   const oldOid = remote[remoteRefFull] || ZERO_OID;
   if (del) {
     if (oldOid === ZERO_OID) return;
@@ -892,14 +902,21 @@ async function custodyPush(eng, ws, ledger, { localRef = null, remoteRef, del =
     pack = oldOid !== ZERO_OID ? packDelta(eng, ws, oldOid, tgt) : null;
     if (!pack) pack = packDelta(eng, ws, "", tgt);
   }
-  return pushVia(ledger, () => pushPack(ledger.remote, headers, { updates: [{ ref: remoteRefFull, oldOid, newOid: tgt }], pack }));
+  const packBytes = pack?.byteLength ?? 0;
+  try {
+    return await pushVia(ledger, () => pushPack(ledger.remote, headers, { updates: [{ ref: remoteRefFull, oldOid, newOid: tgt }], pack }));
+  } catch (error) {
+    throw new Error(`custody receive-pack push failed for ${remoteRefFull} (${packBytes} pack bytes): ${String(error)}`, { cause: error });
+  }
 }
 async function commitAndPush(eng, ws, ledger) {
   try {
     await custodyPush(eng, ws, ledger, { remoteRef: "refs/heads/main" });
   } catch (e) {
     unmount(eng, ws);
-    throw new Error(`ledger push failed \u2014 write NOT durable, rolled back to ledger: ${e}`);
+    const cause = e instanceof Error ? e.cause : void 0;
+    const detail = cause === void 0 ? String(e) : `${e}; cause: ${String(cause)}`;
+    throw new Error(`ledger push failed \u2014 write NOT durable, rolled back to ledger: ${detail}`, { cause: e });
   }
 }
 function describe(eng, ws) {
@@ -1711,9 +1728,11 @@ function completeDevAuthProviderPayload(deployBody, homeDomain, initial, nowMill
   return payload;
 }
 function homeDomainOf(opts) {
-  if (!opts || !opts.deploy) return null;
+  if (!opts) return null;
+  const deploy2 = homeDeployPathOf(opts);
+  if (!deploy2) return null;
   try {
-    const body = JSON.parse(readFileSync(opts.deploy, "utf8"));
+    const body = JSON.parse(readFileSync(deploy2, "utf8"));
     const frameworkPaths = body.openapi?.["x-nomos-framework-routes"]?.paths ?? {};
     for (const pathItem of Object.values(frameworkPaths)) {
       const route = pathItem.post?.["x-nomos"];
@@ -1802,7 +1821,8 @@ async function bootstrapPlatform(dev, opts) {
       {
         let apPayload = { issuer: idpIssuer, keys: idpJwks, audience: idpAudience, principalClaim: "sub", deviceBindingClaim: "nonce" };
         try {
-          const deployBody = opts.deploy ? JSON.parse(readFileSync(opts.deploy, "utf8")) : null;
+          const homeDeploy = homeDeployPathOf(opts);
+          const deployBody = homeDeploy ? JSON.parse(readFileSync(homeDeploy, "utf8")) : null;
           apPayload = completeDevAuthProviderPayload(deployBody, homeDomain, apPayload, Date.now(), OPERATOR);
         } catch (e) {
           log2(`dev test IdP: BYO-shape fill failed (${errMsg(e).slice(0, 200)}) \u2014 the canonical payload stands`);
@@ -1869,28 +1889,33 @@ async function bootstrapPlatform(dev, opts) {
       dev.homeDomain = homeDomain;
     }
   }
-  if (opts.deploy) {
-    const body = JSON.parse(readFileSync(opts.deploy, "utf8"));
-    const usda = body.packageUsda || body.usda;
-    if (!usda) throw new Error(`--deploy ${opts.deploy} has no packageUsda (nothing to install)`);
+  const deployPaths = deployPathsOf(opts);
+  if (deployPaths.length > 0) {
     const founderDevice = dev.operatorDevice;
     if (!founderDevice) throw new Error("platform law deploy needs the warranted founder device established by bootstrap");
-    const deployErr = await serialize(async () => {
-      const ledger = ledgerFor(platform);
-      const domainHash = await sha256hex(usda);
-      try {
-        const out = await deploy(eng, platform, ledger, usda, domainHash, body.dispositions || null, {
-          actor: "user:dev-operator",
-          authorSecret: founderDevice.secret
-        });
-        if (out && out.ok === false) return String(out.error || "the law refused the platform package");
-        log2(`platform law deployed: ${domainHash.slice(0, 12)} (head ${String(out.head).slice(0, 12)})`);
-        return null;
-      } catch (e) {
-        return errMsg(e);
-      }
-    });
-    if (deployErr) throw new Error(`platform law deploy REFUSED: ${deployErr.slice(0, 400)}`);
+    for (const deployPath of deployPaths) {
+      const body = JSON.parse(readFileSync(deployPath, "utf8"));
+      const usda = body.packageUsda || body.usda;
+      if (!usda) throw new Error(`--deploy ${deployPath} has no packageUsda (nothing to install)`);
+      const deployErr = await serialize(async () => {
+        const ledger = ledgerFor(platform);
+        const domainHash = await sha256hex(usda);
+        try {
+          const out = await deploy(eng, platform, ledger, usda, domainHash, body.dispositions || null, {
+            actor: "user:dev-operator",
+            authorSecret: founderDevice.secret
+          });
+          if (out && out.ok === false) return String(out.error || "the law refused the platform package");
+          log2(
+            out.staged === true ? `application payload staged for child birth: ${domainHash.slice(0, 12)} (head ${String(out.head).slice(0, 12)})` : `platform law deployed: ${domainHash.slice(0, 12)} (head ${String(out.head).slice(0, 12)})`
+          );
+          return null;
+        } catch (e) {
+          return errStack(e);
+        }
+      });
+      if (deployErr) throw new Error(`platform law deploy REFUSED (${deployPath}): ${deployErr.slice(0, 400)}`);
+    }
   } else {
     log2("no --deploy given; platform runs framework law only (deploy your platform package to enable births)");
   }
@@ -1902,7 +1927,7 @@ async function bootstrapPlatform(dev, opts) {
   log2(attested ? "bootstrap complete \u2014 platform law deployed + ROOT-ATTESTED (BirthAttestation certChain seeded; birthHome assembles a valid travelling cert)." : "bootstrap complete (platform law deployed; attested-birth legs gated as noted above \u2014 need the test-mint wasm).");
   return { platform, testMint, attested };
 }
-var log2, FRAMEWORK_HOME_DOMAIN;
+var log2, FRAMEWORK_HOME_DOMAIN, deployPathsOf, homeDeployPathOf;
 var init_bootstrap = __esm({
   "../cloud/dev-server/bootstrap.ts"() {
     "use strict";
@@ -1910,6 +1935,8 @@ var init_bootstrap = __esm({
     init_types();
     log2 = (m) => console.log(`[bootstrap] ${m}`);
     FRAMEWORK_HOME_DOMAIN = "__nomos_application_home_v1";
+    deployPathsOf = (opts) => opts.deploys && opts.deploys.length > 0 ? [...opts.deploys] : opts.deploy ? [opts.deploy] : [];
+    homeDeployPathOf = (opts) => deployPathsOf(opts).at(-1);
   }
 });
 
@@ -2123,17 +2150,24 @@ function runGitHttpBackend(projectRoot, { method, pathInfo, query: query2, conte
       CONTENT_TYPE: contentType || "",
       CONTENT_LENGTH: String(body ? body.length : 0),
       REMOTE_ADDR: "127.0.0.1",
-      REMOTE_USER: "nomos-dev",
-      GIT_HTTP_MAX_REQUEST_BUFFER: String(64 * 1024 * 1024)
+      REMOTE_USER: "nomos-dev"
     };
     const cgi = spawn(GIT_HTTP_BACKEND, [], { env });
     const chunks = [];
+    const stderrChunks = [];
     cgi.stdout.on("data", (d) => chunks.push(d));
-    cgi.stderr.on("data", () => {
-    });
+    cgi.stderr.on("data", (d) => stderrChunks.push(d));
     cgi.on("error", reject);
-    cgi.on("close", () => {
+    cgi.stdin.on("error", reject);
+    cgi.on("close", (code, signal) => {
       const out = Buffer.concat(chunks);
+      const stderr = Buffer.concat(stderrChunks).toString("utf8").trim();
+      if (code !== 0 && out.length === 0) {
+        reject(new Error(
+          `git-http-backend exited ${signal ? `on ${signal}` : `with ${code}`}${stderr ? `: ${stderr}` : ""}`
+        ));
+        return;
+      }
       let sep = out.indexOf("\r\n\r\n");
       let sepLen = 4;
       if (sep < 0) {
@@ -2157,8 +2191,7 @@ function runGitHttpBackend(projectRoot, { method, pathInfo, query: query2, conte
       }
       resolve({ status, headers, body: payload });
     });
-    if (body && body.length) cgi.stdin.write(body);
-    cgi.stdin.end();
+    cgi.stdin.end(body && body.length ? body : void 0);
   });
 }
 function receivePackCommands(raw) {
@@ -2227,6 +2260,18 @@ var unb64 = (s) => new Uint8Array(Buffer.from(s, "base64"));
 function configDir() {
   return process.env.HOLON_CONFIG_DIR || path.join(os.homedir(), ".holon");
 }
+function explicitRuntimeDir() {
+  if (process.env.NOMOS_CANDIDATE_RUNTIME) {
+    return { dir: process.env.NOMOS_CANDIDATE_RUNTIME, candidate: true };
+  }
+  if (process.env.NOMOS_OFFLINE_RUNTIME) {
+    return { dir: process.env.NOMOS_OFFLINE_RUNTIME, candidate: false };
+  }
+  return null;
+}
+function selectedRuntimeDir() {
+  return explicitRuntimeDir()?.dir ?? path.join(configDir(), "runtime");
+}
 function firstExisting(...paths) {
   for (const p of paths) {
     if (p && existsSync2(p)) return p;
@@ -2272,21 +2317,39 @@ function capabilitiesForKernelHash(hash) {
 }
 var DEFAULT_KERNEL_SOURCE = "https://nomos.captainapp.co.uk";
 async function resolveTestMintWasm(kernelSource) {
-  const runtimeCache = path.join(configDir(), "runtime");
+  const explicitRuntime = explicitRuntimeDir();
+  const runtimeCache = selectedRuntimeDir();
   const cachePath = path.join(runtimeCache, "holon-testmint.wasm");
+  if (explicitRuntime) {
+    if (existsSync2(cachePath)) {
+      const bytes = readFileSync2(cachePath);
+      if (isTestMintBytes(bytes)) {
+        return { wasmPath: cachePath, wasmBytes: bytes, kernelKind: "test-mint", kernelSource: "explicit-runtime" };
+      }
+    }
+    if (explicitRuntime.candidate || String(process.env.NOMOS_RUNTIME_REFRESH || "auto").toLowerCase() === "never") {
+      throw new Error(
+        `explicit runtime is missing a valid test-mint kernel at ${cachePath}; hydrate that exact runtime bundle before running the generated proof`
+      );
+    }
+  }
   const local = process.env.NOMOS_LOCAL_WASM;
-  if (local && existsSync2(local)) {
+  if (!explicitRuntime && local && existsSync2(local)) {
     const bytes = readFileSync2(local);
     if (isTestMintBytes(bytes)) return { wasmPath: local, wasmBytes: bytes, kernelKind: "test-mint", kernelSource: "NOMOS_LOCAL_WASM" };
   }
   const bundled = path.join(DIR, "kernel-testmint.wasm");
-  if (existsSync2(bundled)) {
+  if (!explicitRuntime && existsSync2(bundled)) {
     const bytes = readFileSync2(bundled);
     if (isTestMintBytes(bytes)) return { wasmPath: bundled, wasmBytes: bytes, kernelKind: "test-mint", kernelSource: "bundled" };
   }
-  if (existsSync2(cachePath)) {
+  if (!explicitRuntime && existsSync2(cachePath)) {
     const bytes = readFileSync2(cachePath);
-    if (isTestMintBytes(bytes)) return { wasmPath: cachePath, wasmBytes: bytes, kernelKind: "test-mint", kernelSource: "cache" };
+    const sha = createHash2("sha256").update(bytes).digest("hex");
+    const currentTestMint = DEPLOYED_KERNELS.find((entry) => /test-mint/i.test(entry.note));
+    if (isTestMintBytes(bytes) && currentTestMint?.hash === sha) {
+      return { wasmPath: cachePath, wasmBytes: bytes, kernelKind: "test-mint", kernelSource: "cache" };
+    }
   }
   const src = String(kernelSource || process.env.NOMOS_KERNEL_SOURCE || DEFAULT_KERNEL_SOURCE).replace(/\/+$/, "");
   const url = `${src}/v1/runtime/holon-testmint.wasm`;
@@ -2307,7 +2370,8 @@ async function resolveTestMintWasm(kernelSource) {
   );
 }
 async function loadRuntime(opts = {}) {
-  const runtimeCache = path.join(configDir(), "runtime");
+  const explicitRuntime = explicitRuntimeDir();
+  const runtimeCache = selectedRuntimeDir();
   const repoDomainsDir = path.join(REPO_ROOT, "cloud/cloudflare-shell/container/domains");
   const vendoredFrameworkDir = path.join(DIR, "framework");
   let wasmPath, wasmBytes, kernelKind, kernelSource;
@@ -2315,9 +2379,10 @@ async function loadRuntime(opts = {}) {
     ({ wasmPath, wasmBytes, kernelKind, kernelSource } = await resolveTestMintWasm(opts.kernelSource));
   } else {
     wasmPath = firstExisting(
-      process.env.NOMOS_LOCAL_WASM,
-      path.join(REPO_ROOT, "cloud/cloudflare-shell/container/vendor/wasm_git_holon.wasm"),
-      path.join(runtimeCache, "holon.wasm")
+      explicitRuntime ? path.join(runtimeCache, "holon.wasm") : null,
+      explicitRuntime ? null : process.env.NOMOS_LOCAL_WASM,
+      explicitRuntime ? null : path.join(REPO_ROOT, "cloud/cloudflare-shell/container/vendor/wasm_git_holon.wasm"),
+      explicitRuntime ? null : path.join(runtimeCache, "holon.wasm")
     );
     if (!wasmPath) {
       throw new Error(
@@ -2331,7 +2396,16 @@ async function loadRuntime(opts = {}) {
   const repoBootstrap = firstExisting(path.join(repoDomainsDir, "domain_bootstrap.package.usda"));
   const repoNomos = firstExisting(path.join(repoDomainsDir, "domain_nomos.package.usda"));
   let bootstrapPkg, nomosPkg;
-  if (repoBootstrap && repoNomos) {
+  const explicitPackages = explicitRuntime ? path.join(runtimeCache, "packages.json") : null;
+  if (explicitPackages && existsSync2(explicitPackages)) {
+    const pkgs = JSON.parse(readFileSync2(explicitPackages, "utf8"));
+    bootstrapPkg = pkgs.bootstrap;
+    nomosPkg = pkgs.nomos;
+  } else if (explicitRuntime) {
+    throw new Error(
+      `explicit runtime is missing framework packages at ${explicitPackages}; hydrate that exact runtime bundle before starting the local Nomos cloud`
+    );
+  } else if (repoBootstrap && repoNomos) {
     bootstrapPkg = readFileSync2(repoBootstrap, "utf8");
     nomosPkg = readFileSync2(repoNomos, "utf8");
   } else if (existsSync2(path.join(vendoredFrameworkDir, "domain_bootstrap.package.usda"))) {
@@ -2452,6 +2526,9 @@ async function startDevCloud(opts = {}) {
     } catch {
       return false;
     }
+    if (process.env.NOMOS_TEST_DIAGNOSTICS === "1") {
+      console.error(`[dev-cloud] read-posture ${ws} ${kind} ${JSON.stringify(posture)}`);
+    }
     if (posture && posture.private && !posture.allowedAny) {
       sendJson(res, bulkReadForbidden(ws, kind, posture), 403);
       return true;
@@ -2925,6 +3002,9 @@ async function startDevCloud(opts = {}) {
   });
   async function gitBackend(req, res, repoPathInfo, ws) {
     const body = await readBody(req);
+    if (process.env.NOMOS_TEST_DIAGNOSTICS === "1") {
+      console.error(`[dev-cloud] git-http ${req.method || ""} /${repoPathInfo} body=${body.byteLength}`);
+    }
     let sessionPush = false;
     if (ws && req.method === "POST" && /git-receive-pack/.test(repoPathInfo)) {
       try {
@@ -2945,7 +3025,10 @@ async function startDevCloud(opts = {}) {
       contentType: req.headers["content-type"],
       body
     });
-    res.writeHead(out.status, { ...out.headers, ...CORS });
+    if (process.env.NOMOS_TEST_DIAGNOSTICS === "1") {
+      console.error(`[dev-cloud] git-http ${req.method || ""} /${repoPathInfo} -> ${out.status} body=${out.body.byteLength}`);
+    }
+    res.writeHead(out.status, { ...out.headers, ...CORS, connection: "close" });
     res.end(out.body);
     if (sessionPush && ws) scheduleAdmit(ws);
   }
@@ -3061,8 +3144,11 @@ function parseArgs(argv) {
     else if (a === "--data") o.data = argv[++i];
     else if (a === "--firebase-project") o.firebaseProject = argv[++i];
     else if (a === "--platform") o.platform = argv[++i];
-    else if (a === "--deploy") o.deploy = argv[++i];
-    else if (a === "--auth-provider") o.authProvider = argv[++i];
+    else if (a === "--deploy") {
+      const deploy2 = argv[++i];
+      o.deploy = deploy2;
+      (o.deploys ??= []).push(deploy2);
+    } else if (a === "--auth-provider") o.authProvider = argv[++i];
     else if (a === "--bootstrap") o.bootstrap = true;
     else if (a === "--attested") o.attested = true;
     else if (a === "--kernel-source") o.kernelSource = argv[++i];
@@ -3107,6 +3193,7 @@ if (import.meta.url === `file://${process.argv[1]}`) {
   });
 }
 export {
+  resolveTestMintWasm,
   startDevCloud,
   startGeneratedApplicationProofCloud
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.102.0",
+  "version": "0.102.2",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -29,7 +29,7 @@
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/dsl": "^0.102.0",
+    "@githolon/dsl": "^0.102.2",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {