githolon 0.102.4 → 0.103.0

package/dist/dev-server.mjs

@@ -113,13 +113,14 @@ var init_git_fs = __esm({
 
 // ../adapter/tree.ts
 function flatten(dir, prefix, out) {
-  for (const [name, inode] of dir.contents ?? /* @__PURE__ */ new Map()) {
-    const path2 = prefix ? prefix + "/" + name : name;
+  const children = [...(dir.contents ?? /* @__PURE__ */ new Map()).entries()].sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0);
+  for (const [name, inode] of children) {
+    const path3 = prefix ? prefix + "/" + name : name;
     if (inode.contents instanceof Map) {
-      out.push({ path: path2, dir: true });
-      flatten(inode, path2, out);
+      out.push({ path: path3, dir: true });
+      flatten(inode, path3, out);
     } else {
-      out.push({ path: path2, dir: false, bytes: inode.data ?? new Uint8Array(0) });
+      out.push({ path: path3, dir: false, bytes: inode.data ?? new Uint8Array(0) });
     }
   }
 }
@@ -192,8 +193,8 @@ function readPktLines(buf, off = 0) {
   }
   return { lines, rest: off };
 }
-async function lsRefs(remote, headers = {}, { service = "git-upload-pack", prefix = null } = {}) {
-  const r = await fetch(`${remote}/info/refs?service=${service}`, { headers });
+async function lsRefs(remote, headers = {}, { service = "git-upload-pack", prefix = null } = {}, fetchImpl = fetch) {
+  const r = await fetchImpl(`${remote}/info/refs?service=${service}`, { headers });
   if (!r.ok) {
     if (r.status === 404) return {};
     throw new Error(`info/refs ${r.status}: ${(await r.text()).slice(0, 180)}`);
@@ -219,7 +220,7 @@ async function lsRefs(remote, headers = {}, { service = "git-upload-pack", prefi
 async function fetchPack(remote, headers = {}, { wants = [], haves = [] } = {}) {
   wants = wants.filter((w) => /^[0-9a-f]{40}$/.test(w) && w !== ZERO_OID);
   if (!wants.length) return null;
-  const caps = "thin-pack ofs-delta agent=nomos-cloud";
+  const caps = "ofs-delta agent=nomos-cloud";
   const parts = [];
   wants.forEach((w, i) => parts.push(pkt(`want ${w}${i === 0 ? " " + caps : ""}
 `)));
@@ -256,7 +257,7 @@ async function fetchPack(remote, headers = {}, { wants = [], haves = [] } = {})
   }
   return pack;
 }
-async function pushPack(remote, headers = {}, { updates = [], pack = null } = {}) {
+async function pushPack(remote, headers = {}, { updates = [], pack = null } = {}, fetchImpl = fetch) {
   if (!updates.length) return { ok: true, noop: true };
   const cmds = [];
   updates.forEach((u, i) => {
@@ -270,7 +271,7 @@ async function pushPack(remote, headers = {}, { updates = [], pack = null } = {}
   const body = concatBytes([...cmds, pack && pack.length ? pack : EMPTY_PACK]);
   let r;
   try {
-    r = await fetch(`${remote}/git-receive-pack`, {
+    r = await fetchImpl(`${remote}/git-receive-pack`, {
       method: "POST",
       headers: { "content-type": "application/x-git-receive-pack-request", ...headers },
       body
@@ -340,8 +341,56 @@ var init_managed_promotion = __esm({
   }
 });
 
+// ../adapter/proto/nomos/kernel/v1/kernel_pb.js
+import { enumDesc, fileDesc, messageDesc, serviceDesc, tsEnum } from "@bufbuild/protobuf/codegenv2";
+var file_nomos_kernel_v1_kernel, CallRequestSchema, CallResponseSchema, WorkspaceTargetSchema, DirectiveCallSchema, AuthoringOptionsSchema, CapturedClockSchema, OfferRequestSchema, QueryRequestSchema, QueryAuthoritySchema, InjectedKeySchema, RowsQuerySchema, ByIdQuerySchema, TallyQuerySchema, SpatialQuerySchema, NamedQuerySchema, TestRequestSchema, SetTestRootRequestSchema, CustodyRequestSchema, PackDeltaRequestSchema, ApplyPackRequestSchema, RepoStatsRequestSchema, IntentsAboveRequestSchema, InspectChangeRequestSchema, EncodeDocumentRequestSchema, InspectDocumentRequestSchema, ReadBlobRequestSchema, ResolveRefRequestSchema, ListRefsRequestSchema, WriteRefRequestSchema, DeleteRefRequestSchema, WriteMetaCommitRequestSchema, LawClosureInfoRequestSchema, RestoreMainRequestSchema, NomosValueSchema, NomosStructSchema, QueryOperationSchema, QueryOperation;
+var init_kernel_pb = __esm({
+  "../adapter/proto/nomos/kernel/v1/kernel_pb.js"() {
+    "use strict";
+    file_nomos_kernel_v1_kernel = /* @__PURE__ */ fileDesc("Chxub21vcy9rZXJuZWwvdjEva2VybmVsLnByb3RvEg9ub21vcy5rZXJuZWwudjEimAMKC0NhbGxSZXF1ZXN0EhgKEHByb3RvY29sX3ZlcnNpb24YASABKA0SEgoKcmVxdWVzdF9pZBgCIAEoCRIsCgRvcGVuGAogASgLMhwubm9tb3Mua2VybmVsLnYxLk9wZW5SZXF1ZXN0SAASLgoFb2ZmZXIYCyABKAsyHS5ub21vcy5rZXJuZWwudjEuT2ZmZXJSZXF1ZXN0SAASLgoFcXVlcnkYDCABKAsyHS5ub21vcy5rZXJuZWwudjEuUXVlcnlSZXF1ZXN0SAASMAoGb3V0Ym94GA0gASgLMh4ubm9tb3Mua2VybmVsLnYxLk91dGJveFJlcXVlc3RIABIsCgRzeW5jGA4gASgLMhwubm9tb3Mua2VybmVsLnYxLlN5bmNSZXF1ZXN0SAASMgoHY3VzdG9keRgPIAEoCzIfLm5vbW9zLmtlcm5lbC52MS5DdXN0b2R5UmVxdWVzdEgAEiwKBHRlc3QYECABKAsyHC5ub21vcy5rZXJuZWwudjEuVGVzdFJlcXVlc3RIAEILCglvcGVyYXRpb24iywMKDENhbGxSZXNwb25zZRIYChBwcm90b2NvbF92ZXJzaW9uGAEgASgNEhIKCnJlcXVlc3RfaWQYAiABKAkSKwoHZmFpbHVyZRgKIAEoCzIYLm5vbW9zLmtlcm5lbC52MS5GYWlsdXJlSAASLQoEb3BlbhgLIAEoCzIdLm5vbW9zLmtlcm5lbC52MS5PcGVuUmVzcG9uc2VIABIvCgVvZmZlchgMIAEoCzIeLm5vbW9zLmtlcm5lbC52MS5PZmZlclJlc3BvbnNlSAASLwoFcXVlcnkYDSABKAsyHi5ub21vcy5rZXJuZWwudjEuUXVlcnlSZXNwb25zZUgAEjEKBm91dGJveBgOIAEoCzIfLm5vbW9zLmtlcm5lbC52MS5PdXRib3hSZXNwb25zZUgAEi0KBHN5bmMYDyABKAsyHS5ub21vcy5rZXJuZWwudjEuU3luY1Jlc3BvbnNlSAASMwoHY3VzdG9keRgQIAEoCzIgLm5vbW9zLmtlcm5lbC52MS5DdXN0b2R5UmVzcG9uc2VIABItCgR0ZXN0GBEgASgLMh0ubm9tb3Mua2VybmVsLnYxLlRlc3RSZXNwb25zZUgAQgkKB291dGNvbWUiVwoHRmFpbHVyZRIMCgRjb2RlGAEgASgJEg8KB21lc3NhZ2UYAiABKAkSLQoHZGV0YWlscxgDIAEoCzIcLm5vbW9zLmtlcm5lbC52MS5Ob21vc1N0cnVjdCI8CgxPcGVuUmVzcG9uc2USLAoGcmVzdWx0GAEgASgLMhwubm9tb3Mua2VybmVsLnYxLk5vbW9zU3RydWN0IsMCCg1PZmZlclJlc3BvbnNlEjIKCGFkbWl0dGVkGAEgASgLMh4ubm9tb3Mua2VybmVsLnYxLk9mZmVyQWRtaXR0ZWRIABIwCgdyZWZ1c2VkGAIgASgLMh0ubm9tb3Mua2VybmVsLnYxLk9mZmVyUmVmdXNlZEgAEjsKDWRlYWRfbGV0dGVyZWQYAyABKAsyIi5ub21vcy5rZXJuZWwudjEuT2ZmZXJEZWFkTGV0dGVyZWRIABI4CgtxdWFyYW50aW5lZBgEIAEoCzIhLm5vbW9zLmtlcm5lbC52MS5PZmZlclF1YXJhbnRpbmVkSAASSgoVYmxvY2tlZF9vbl9kZXBlbmRlbmN5GAUgASgLMikubm9tb3Mua2VybmVsLnYxLk9mZmVyQmxvY2tlZE9uRGVwZW5kZW5jeUgAQgkKB291dGNvbWUiPQoNT2ZmZXJBZG1pdHRlZBIsCgZyZXN1bHQYASABKAsyHC5ub21vcy5rZXJuZWwudjEuTm9tb3NTdHJ1Y3QilgEKDE9mZmVyUmVmdXNlZBIVCghvZmZlcl9pZBgBIAEoCUgAiAEBEi8KB3JlZnVzYWwYAiABKAsyHi5ub21vcy5rZXJuZWwudjEuS2VybmVsUmVmdXNhbBIxCgtkaWFnbm9zdGljcxgDIAEoCzIcLm5vbW9zLmtlcm5lbC52MS5Ob21vc1N0cnVjdEILCglfb2ZmZXJfaWQiegoRT2ZmZXJEZWFkTGV0dGVyZWQSFQoIb2ZmZXJfaWQYASABKAlIAIgBARIOCgZyZWFzb24YAiABKAkSMQoLZGlhZ25vc3RpY3MYAyABKAsyHC5ub21vcy5rZXJuZWwudjEuTm9tb3NTdHJ1Y3RCCwoJX29mZmVyX2lkIq4BChBPZmZlclF1YXJhbnRpbmVkEhUKCG9mZmVyX2lkGAEgASgJSACIAQESGQoRYXV0aG9yZWRfbGF3X2hhc2gYAiABKAkSGAoQY3VycmVudF9sYXdfaGFzaBgDIAEoCRIOCgZyZWFzb24YBCABKAkSMQoLZGlhZ25vc3RpY3MYBSABKAsyHC5ub21vcy5rZXJuZWwudjEuTm9tb3NTdHJ1Y3RCCwoJX29mZmVyX2lkIoEBChhPZmZlckJsb2NrZWRPbkRlcGVuZGVuY3kSFQoIb2ZmZXJfaWQYASABKAlIAIgBARIOCgZkZXRhaWwYAiABKAkSMQoLZGlhZ25vc3RpY3MYAyABKAsyHC5ub21vcy5rZXJuZWwudjEuTm9tb3NTdHJ1Y3RCCwoJX29mZmVyX2lkIoEBCg1LZXJuZWxSZWZ1c2FsEjAKBGNvZGUYASABKA4yIi5ub21vcy5rZXJuZWwudjEuS2VybmVsUmVmdXNhbENvZGUSDwoHbWVzc2FnZRgCIAEoCRItCgdkZXRhaWxzGAMgASgLMhwubm9tb3Mua2VybmVsLnYxLk5vbW9zU3RydWN0IqQCCg1RdWVyeVJlc3BvbnNlEiwKBXZhbHVlGAEgASgLMhsubm9tb3Mua2VybmVsLnYxLk5vbW9zVmFsdWVIABJBChBhcHBsaWNhdGlvbl9qc29uGAIgASgLMiUubm9tb3Mua2VybmVsLnYxLkFwcGxpY2F0aW9uSnNvblZhbHVlSAASSgoTYXV0aG9yaXphdGlvbl9jaGVjaxgKIAEoCzIrLm5vbW9zLmtlcm5lbC52MS5BdXRob3JpemF0aW9uQ2hlY2tSZXNwb25zZUgAEkwKFGF1dGhvcml6YXRpb25fZXhwYW5kGAsgASgLMiwubm9tb3Mua2VybmVsLnYxLkF1dGhvcml6YXRpb25FeHBhbmRSZXNwb25zZUgAQggKBnJlc3VsdCIkChRBcHBsaWNhdGlvbkpzb25WYWx1ZRIMCgR1dGY4GAEgASgMIj4KDk91dGJveFJlc3BvbnNlEiwKBnJlc3VsdBgBIAEoCzIcLm5vbW9zLmtlcm5lbC52MS5Ob21vc1N0cnVjdCI8CgxTeW5jUmVzcG9uc2USLAoGcmVzdWx0GAEgASgLMhwubm9tb3Mua2VybmVsLnYxLk5vbW9zU3RydWN0IkIKD1dvcmtzcGFjZVRhcmdldBIMCgRyZXBvGAEgASgJEhEKCXdvcmtzcGFjZRgCIAEoCRIOCgZicmFuY2gYAyABKAkiTgoLT3BlblJlcXVlc3QSMAoGdGFyZ2V0GAEgASgLMiAubm9tb3Mua2VybmVsLnYxLldvcmtzcGFjZVRhcmdldBINCgVzcGFucxgCIAEoCCJhCg1EaXJlY3RpdmVDYWxsEg4KBmRvbWFpbhgBIAEoCRIRCglkaXJlY3RpdmUYAiABKAkSLQoHcGF5bG9hZBgDIAEoCzIcLm5vbW9zLmtlcm5lbC52MS5Ob21vc1N0cnVjdCLAAgoQQXV0aG9yaW5nT3B0aW9ucxINCgVhY3RvchgBIAEoCRISCgphdXRoX3Rva2VuGAIgASgMEhUKDWF1dGhvcl9zZWNyZXQYAyABKAwSHQoQdmFsaWRfZnJvbV9lcG9jaBgEIAEoBEgAiAEBEh8KEnByaW5jaXBhbF92ZXJpZmllZBgFIAEoCEgBiAEBEgsKA3JuZxgGIAMoARIYChBkZWZlcl9wcm9qZWN0aW9uGAcgASgIEg0KBXNwYW5zGAggASgIEg8KB2RyeV9ydW4YCSABKAgSEAoIc2VxdWVuY2UYCiABKAQSLQoFY2xvY2sYCyABKAsyHi5ub21vcy5rZXJuZWwudjEuQ2FwdHVyZWRDbG9ja0ITChFfdmFsaWRfZnJvbV9lcG9jaEIVChNfcHJpbmNpcGFsX3ZlcmlmaWVkIkoKDUNhcHR1cmVkQ2xvY2sSFwoPcGh5c2ljYWxfbWlsbGlzGAEgASgEEg8KB2xvZ2ljYWwYAiABKA0SDwoHcmVwbGljYRgDIAEoBCLeAwoMT2ZmZXJSZXF1ZXN0EjAKBnRhcmdldBgBIAEoCzIgLm5vbW9zLmtlcm5lbC52MS5Xb3Jrc3BhY2VUYXJnZXQSLgoEY2FsbBgCIAEoCzIeLm5vbW9zLmtlcm5lbC52MS5EaXJlY3RpdmVDYWxsSAASHAoSc2VhbGVkX2NoYW5nZV91c2RhGAcgASgMSAASNAoJYXV0aG9yaW5nGAMgASgLMiEubm9tb3Mua2VybmVsLnYxLkF1dGhvcmluZ09wdGlvbnMSEAoIbGF3X3VzZHoYBCABKAwSMwoMYXR0ZXN0YXRpb25zGAUgAygLMh0ubm9tb3Mua2VybmVsLnYxLkF0dGVzdGVkUmVhZBI9ChJjb25mbGljdF9zbmFwc2hvdHMYBiADKAsyIS5ub21vcy5rZXJuZWwudjEuQ29uZmxpY3RTbmFwc2hvdBIaChJleGVjdXRpb25fbGF3X3VzZHoYCCABKAwSIAoTY29udHJvbGxlcl9sYXdfaGFzaBgJIAEoCUgBiAEBEh0KEGNhbmRpZGF0ZV9jb21taXQYCiABKAlIAogBAUIICgZpbnRlbnRCFgoUX2NvbnRyb2xsZXJfbGF3X2hhc2hCEwoRX2NhbmRpZGF0ZV9jb21taXQikwEKDEF0dGVzdGVkUmVhZBIQCghxdWVyeV9pZBgBIAEoCRIvCglhcmd1bWVudHMYAiABKAsyHC5ub21vcy5rZXJuZWwudjEuTm9tb3NTdHJ1Y3QSKwoGcmVzdWx0GAMgASgLMhsubm9tb3Mua2VybmVsLnYxLk5vbW9zVmFsdWUSEwoLYXR0ZXN0YXRpb24YBCABKAwidQoQQ29uZmxpY3RTbmFwc2hvdBIWCg5hZ2dyZWdhdGVfdHlwZRgBIAEoCRIUCgxhZ2dyZWdhdGVfaWQYAiABKAkSDQoFZmllbGQYAyABKAkSFQoNdGFyZ2V0X3NjaGVtYRgEIAEoCRINCgV0b2tlbhgFIAEoCSLbBQoMUXVlcnlSZXF1ZXN0EjAKBnRhcmdldBgBIAEoCzIgLm5vbW9zLmtlcm5lbC52MS5Xb3Jrc3BhY2VUYXJnZXQSMgoJYXV0aG9yaXR5GAIgASgLMh8ubm9tb3Mua2VybmVsLnYxLlF1ZXJ5QXV0aG9yaXR5Eg0KBXNwYW5zGAMgASgIEioKBHJvd3MYCiABKAsyGi5ub21vcy5rZXJuZWwudjEuUm93c1F1ZXJ5SAASKgoEcGFnZRgLIAEoCzIaLm5vbW9zLmtlcm5lbC52MS5QYWdlUXVlcnlIABIrCgVieV9pZBgMIAEoCzIaLm5vbW9zLmtlcm5lbC52MS5CeUlkUXVlcnlIABI5CgxyZXNvbHZlX3JlZnMYDSABKAsyIS5ub21vcy5rZXJuZWwudjEuUmVzb2x2ZVJlZnNRdWVyeUgAEjsKDXJlZl9mcmVzaG5lc3MYDiABKAsyIi5ub21vcy5rZXJuZWwudjEuUmVmRnJlc2huZXNzUXVlcnlIABIsCgVjb3VudBgPIAEoCzIbLm5vbW9zLmtlcm5lbC52MS5UYWxseVF1ZXJ5SAASKgoDc3VtGBAgASgLMhsubm9tb3Mua2VybmVsLnYxLlRhbGx5UXVlcnlIABIwCgdzcGF0aWFsGBEgASgLMh0ubm9tb3Mua2VybmVsLnYxLlNwYXRpYWxRdWVyeUgAEiwKBW5hbWVkGBIgASgLMhsubm9tb3Mua2VybmVsLnYxLk5hbWVkUXVlcnlIABJJChNhdXRob3JpemF0aW9uX2NoZWNrGBMgASgLMioubm9tb3Mua2VybmVsLnYxLkF1dGhvcml6YXRpb25DaGVja1JlcXVlc3RIABJLChRhdXRob3JpemF0aW9uX2V4cGFuZBgUIAEoCzIrLm5vbW9zLmtlcm5lbC52MS5BdXRob3JpemF0aW9uRXhwYW5kUmVxdWVzdEgAQgcKBXF1ZXJ5IpIBCg5RdWVyeUF1dGhvcml0eRIXCg9wcmluY2lwYWxfY2xhaW0YASABKAkSEgoKYXV0aF90b2tlbhgCIAEoDBIQCghub3dfdW5peBgDIAEoBBIVCg1hdXRob3Jfc2VjcmV0GAQgASgMEioKBGtleXMYBSADKAsyHC5ub21vcy5rZXJuZWwudjEuSW5qZWN0ZWRLZXkiOAoLSW5qZWN0ZWRLZXkSDQoFc2NvcGUYASABKAkSDQoFZXBvY2gYAiABKAQSCwoDa2V5GAMgASgMIlsKCVJvd3NRdWVyeRIKCgJpZBgBIAEoCRIvCglhcmd1bWVudHMYAiABKAsyHC5ub21vcy5rZXJuZWwudjEuTm9tb3NTdHJ1Y3QSEQoJcHJpbmNpcGFsGAMgASgJInkKCVBhZ2VRdWVyeRIKCgJpZBgBIAEoCRIvCglhcmd1bWVudHMYAiABKAsyHC5ub21vcy5rZXJuZWwudjEuTm9tb3NTdHJ1Y3QSDQoFbGltaXQYAyABKA0SDQoFYWZ0ZXIYBCABKAkSEQoJcHJpbmNpcGFsGAUgASgJIkwKCUJ5SWRRdWVyeRIWCg5hZ2dyZWdhdGVfdHlwZRgBIAEoCRIUCgxhZ2dyZWdhdGVfaWQYAiABKAkSEQoJcHJpbmNpcGFsGAMgASgJIlwKCE5vbW9zUmVmEhEKCXdvcmtzcGFjZRgBIAEoCRIWCg5hZ2dyZWdhdGVfdHlwZRgCIAEoCRIUCgxhZ2dyZWdhdGVfaWQYAyABKAkSDwoHdmVyc2lvbhgEIAEoCSJOChBSZXNvbHZlUmVmc1F1ZXJ5EicKBHJlZnMYASADKAsyGS5ub21vcy5rZXJuZWwudjEuTm9tb3NSZWYSEQoJcHJpbmNpcGFsGAIgASgJIkUKEVJlZkZyZXNobmVzc1F1ZXJ5EjAKBHJlZnMYASADKAsyIi5ub21vcy5rZXJuZWwudjEuUmVmRnJlc2huZXNzQ2hlY2sigAEKEVJlZkZyZXNobmVzc0NoZWNrEikKBnBpbm5lZBgBIAEoCzIZLm5vbW9zLmtlcm5lbC52MS5Ob21vc1JlZhIpCgZzZXJpZXMYAiABKAsyGS5ub21vcy5rZXJuZWwudjEuTm9tb3NSZWYSFQoNY3VycmVudF9maWVsZBgDIAEoCSJcCgpUYWxseVF1ZXJ5EgoKAmlkGAEgASgJEi8KCWFyZ3VtZW50cxgCIAEoCzIcLm5vbW9zLmtlcm5lbC52MS5Ob21vc1N0cnVjdBIRCglwcmluY2lwYWwYAyABKAkiXgoMU3BhdGlhbFF1ZXJ5EgoKAmlkGAEgASgJEi8KCWFyZ3VtZW50cxgCIAEoCzIcLm5vbW9zLmtlcm5lbC52MS5Ob21vc1N0cnVjdBIRCglwcmluY2lwYWwYAyABKAkicQoKTmFtZWRRdWVyeRIyCglvcGVyYXRpb24YASABKA4yHy5ub21vcy5rZXJuZWwudjEuUXVlcnlPcGVyYXRpb24SLwoJYXJndW1lbnRzGAIgASgLMhwubm9tb3Mua2VybmVsLnYxLk5vbW9zU3RydWN0Ii8KE0F1dGhvcml6YXRpb25PYmplY3QSDAoEdHlwZRgBIAEoCRIKCgJpZBgCIAEoCSJUChRBdXRob3JpemF0aW9uU3ViamVjdBIMCgR0eXBlGAEgASgJEgoKAmlkGAIgASgJEhUKCHJlbGF0aW9uGAMgASgJSACIAQFCCwoJX3JlbGF0aW9uIpwBChhSZWxhdGlvbnNoaXBUdXBsZUFkZHJlc3MSNgoIcmVzb3VyY2UYASABKAsyJC5ub21vcy5rZXJuZWwudjEuQXV0aG9yaXphdGlvbk9iamVjdBIQCghyZWxhdGlvbhgCIAEoCRI2CgdzdWJqZWN0GAMgASgLMiUubm9tb3Mua2VybmVsLnYxLkF1dGhvcml6YXRpb25TdWJqZWN0IoEBChhBdXRob3JpemF0aW9uQ29uc2lzdGVuY3kSIwoZY3VycmVudF92ZXJpZmllZF9mcm9udGllchgBIAEoCEgAEhkKD2F0X2xlYXN0X2NvbW1pdBgCIAEoCUgAEhYKDGV4YWN0X2NvbW1pdBgDIAEoCUgAQg0KC3JlcXVpcmVtZW50ImYKHUF1dGhvcml6YXRpb25Db25kaXRpb25Db250ZXh0EhQKDGNvbmRpdGlvbl9pZBgBIAEoCRIvCglhcmd1bWVudHMYAiABKAsyHC5ub21vcy5rZXJuZWwudjEuTm9tb3NTdHJ1Y3Qi9wIKGUF1dGhvcml6YXRpb25DaGVja1JlcXVlc3QSNgoIcmVzb3VyY2UYASABKAsyJC5ub21vcy5rZXJuZWwudjEuQXV0aG9yaXphdGlvbk9iamVjdBISCgpwZXJtaXNzaW9uGAIgASgJEjYKB3N1YmplY3QYAyABKAsyJS5ub21vcy5rZXJuZWwudjEuQXV0aG9yaXphdGlvblN1YmplY3QSPgoLY29uc2lzdGVuY3kYBCABKAsyKS5ub21vcy5rZXJuZWwudjEuQXV0aG9yaXphdGlvbkNvbnNpc3RlbmN5Ej8KB2NvbnRleHQYBSADKAsyLi5ub21vcy5rZXJuZWwudjEuQXV0aG9yaXphdGlvbkNvbmRpdGlvbkNvbnRleHQSIAoTZXhwZWN0ZWRfbW9kZWxfaGFzaBgGIAEoCUgAiAEBEhsKE2luY2x1ZGVfZXhwbGFuYXRpb24YByABKAhCFgoUX2V4cGVjdGVkX21vZGVsX2hhc2gi7QIKGkF1dGhvcml6YXRpb25FeHBhbmRSZXF1ZXN0EjYKCHJlc291cmNlGAEgASgLMiQubm9tb3Mua2VybmVsLnYxLkF1dGhvcml6YXRpb25PYmplY3QSEgoKcGVybWlzc2lvbhgCIAEoCRI+Cgtjb25zaXN0ZW5jeRgDIAEoCzIpLm5vbW9zLmtlcm5lbC52MS5BdXRob3JpemF0aW9uQ29uc2lzdGVuY3kSPwoHY29udGV4dBgEIAMoCzIuLm5vbW9zLmtlcm5lbC52MS5BdXRob3JpemF0aW9uQ29uZGl0aW9uQ29udGV4dBIgChNleHBlY3RlZF9tb2RlbF9oYXNoGAUgASgJSACIAQESDQoFbGltaXQYBiABKA0SEgoFYWZ0ZXIYByABKAlIAYgBARIbChNpbmNsdWRlX2V4cGxhbmF0aW9uGAggASgIQhYKFF9leHBlY3RlZF9tb2RlbF9oYXNoQggKBl9hZnRlciK9AQoZUmVsYXRpb25zaGlwVHVwbGVFdmlkZW5jZRI4CgV0dXBsZRgBIAEoCzIpLm5vbW9zLmtlcm5lbC52MS5SZWxhdGlvbnNoaXBUdXBsZUFkZHJlc3MSEAoIdHVwbGVfaWQYAiABKAkSGgoSYXNzZXJ0aW9uX2V2ZW50X2lkGAMgASgJEiAKE3Jldm9jYXRpb25fZXZlbnRfaWQYBCABKAlIAIgBAUIWChRfcmV2b2NhdGlvbl9ldmVudF9pZCLhAwoYQXV0aG9yaXphdGlvbkV4cGxhbmF0aW9uEkYKCW9wZXJhdGlvbhgBIAEoDjIzLm5vbW9zLmtlcm5lbC52MS5BdXRob3JpemF0aW9uRXhwbGFuYXRpb24uT3BlcmF0aW9uEhAKCHJlbGF0aW9uGAIgASgJEg4KBnJlc3VsdBgDIAEoCBI8CghldmlkZW5jZRgEIAMoCzIqLm5vbW9zLmtlcm5lbC52MS5SZWxhdGlvbnNoaXBUdXBsZUV2aWRlbmNlEjsKCGNoaWxkcmVuGAUgAygLMikubm9tb3Mua2VybmVsLnYxLkF1dGhvcml6YXRpb25FeHBsYW5hdGlvbiLfAQoJT3BlcmF0aW9uEhkKFU9QRVJBVElPTl9VTlNQRUNJRklFRBAAEhQKEE9QRVJBVElPTl9ESVJFQ1QQARIeChpPUEVSQVRJT05fQ09NUFVURURfVVNFUlNFVBACEh4KGk9QRVJBVElPTl9UVVBMRV9UT19VU0VSU0VUEAMSEwoPT1BFUkFUSU9OX1VOSU9OEAQSGgoWT1BFUkFUSU9OX0lOVEVSU0VDVElPThAFEhcKE09QRVJBVElPTl9FWENMVVNJT04QBhIXChNPUEVSQVRJT05fQ09ORElUSU9OEAcidwoaQXV0aG9yaXphdGlvbkRlY2lzaW9uQmFzaXMSIAoYYXV0aG9yaXphdGlvbl9tb2RlbF9oYXNoGAEgASgJEiEKGXJlbGF0aW9uc2hpcF9zdGF0ZV9jb21taXQYAiABKAkSFAoMY29udGV4dF9oYXNoGAMgASgMIr4BChpBdXRob3JpemF0aW9uQ2hlY2tSZXNwb25zZRIPCgdhbGxvd2VkGAEgASgIEjoKBWJhc2lzGAIgASgLMisubm9tb3Mua2VybmVsLnYxLkF1dGhvcml6YXRpb25EZWNpc2lvbkJhc2lzEkMKC2V4cGxhbmF0aW9uGAMgASgLMikubm9tb3Mua2VybmVsLnYxLkF1dGhvcml6YXRpb25FeHBsYW5hdGlvbkgAiAEBQg4KDF9leHBsYW5hdGlvbiKDAgobQXV0aG9yaXphdGlvbkV4cGFuZFJlc3BvbnNlEjcKCHN1YmplY3RzGAEgAygLMiUubm9tb3Mua2VybmVsLnYxLkF1dGhvcml6YXRpb25TdWJqZWN0EjoKBWJhc2lzGAIgASgLMisubm9tb3Mua2VybmVsLnYxLkF1dGhvcml6YXRpb25EZWNpc2lvbkJhc2lzEhEKBG5leHQYAyABKAlIAIgBARJDCgtleHBsYW5hdGlvbhgEIAEoCzIpLm5vbW9zLmtlcm5lbC52MS5BdXRob3JpemF0aW9uRXhwbGFuYXRpb25IAYgBAUIHCgVfbmV4dEIOCgxfZXhwbGFuYXRpb24iQQoNT3V0Ym94UmVxdWVzdBIwCgZ0YXJnZXQYASABKAsyIC5ub21vcy5rZXJuZWwudjEuV29ya3NwYWNlVGFyZ2V0ImMKC1N5bmNSZXF1ZXN0EjAKBnRhcmdldBgBIAEoCzIgLm5vbW9zLmtlcm5lbC52MS5Xb3Jrc3BhY2VUYXJnZXQSEQoJZnJvbV9iYXNlGAIgASgJEg8KB3RvX2hlYWQYAyABKAkiUwoLVGVzdFJlcXVlc3QSNwoIc2V0X3Jvb3QYASABKAsyIy5ub21vcy5rZXJuZWwudjEuU2V0VGVzdFJvb3RSZXF1ZXN0SABCCwoJb3BlcmF0aW9uIigKElNldFRlc3RSb290UmVxdWVzdBISCgpwdWJsaWNfa2V5GAEgASgMIj0KDFRlc3RSZXNwb25zZRItCgZyZXN1bHQYASABKAsyHS5ub21vcy5rZXJuZWwudjEuQWNrbm93bGVkZ2VkIoMJCg5DdXN0b2R5UmVxdWVzdBI3CgpwYWNrX2RlbHRhGAogASgLMiEubm9tb3Mua2VybmVsLnYxLlBhY2tEZWx0YVJlcXVlc3RIABI3CgphcHBseV9wYWNrGAsgASgLMiEubm9tb3Mua2VybmVsLnYxLkFwcGx5UGFja1JlcXVlc3RIABI3CgpyZXBvX3N0YXRzGAwgASgLMiEubm9tb3Mua2VybmVsLnYxLlJlcG9TdGF0c1JlcXVlc3RIABI9Cg1pbnRlbnRzX2Fib3ZlGA0gASgLMiQubm9tb3Mua2VybmVsLnYxLkludGVudHNBYm92ZVJlcXVlc3RIABI/Cg5pbnNwZWN0X2NoYW5nZRgOIAEoCzIlLm5vbW9zLmtlcm5lbC52MS5JbnNwZWN0Q2hhbmdlUmVxdWVzdEgAEkEKD2VuY29kZV9kb2N1bWVudBgPIAEoCzImLm5vbW9zLmtlcm5lbC52MS5FbmNvZGVEb2N1bWVudFJlcXVlc3RIABJDChBpbnNwZWN0X2RvY3VtZW50GBAgASgLMicubm9tb3Mua2VybmVsLnYxLkluc3BlY3REb2N1bWVudFJlcXVlc3RIABI1CglyZWFkX2Jsb2IYESABKAsyIC5ub21vcy5rZXJuZWwudjEuUmVhZEJsb2JSZXF1ZXN0SAASOQoLcmVzb2x2ZV9yZWYYEiABKAsyIi5ub21vcy5rZXJuZWwudjEuUmVzb2x2ZVJlZlJlcXVlc3RIABI1CglsaXN0X3JlZnMYEyABKAsyIC5ub21vcy5rZXJuZWwudjEuTGlzdFJlZnNSZXF1ZXN0SAASNQoJd3JpdGVfcmVmGBQgASgLMiAubm9tb3Mua2VybmVsLnYxLldyaXRlUmVmUmVxdWVzdEgAEjcKCmRlbGV0ZV9yZWYYFSABKAsyIS5ub21vcy5rZXJuZWwudjEuRGVsZXRlUmVmUmVxdWVzdEgAEkQKEXdyaXRlX21ldGFfY29tbWl0GBYgASgLMicubm9tb3Mua2VybmVsLnYxLldyaXRlTWV0YUNvbW1pdFJlcXVlc3RIABJCChBsYXdfY2xvc3VyZV9pbmZvGBcgASgLMiYubm9tb3Mua2VybmVsLnYxLkxhd0Nsb3N1cmVJbmZvUmVxdWVzdEgAEkUKEWNoZWNrcG9pbnRfZXhwb3J0GBggASgLMigubm9tb3Mua2VybmVsLnYxLkNoZWNrcG9pbnRFeHBvcnRSZXF1ZXN0SAASRQoRY2hlY2twb2ludF9pbXBvcnQYGSABKAsyKC5ub21vcy5rZXJuZWwudjEuQ2hlY2twb2ludEltcG9ydFJlcXVlc3RIABJDChBjYXBhY2l0eV9yZXNlcnZlGBogASgLMicubm9tb3Mua2VybmVsLnYxLkNhcGFjaXR5UmVzZXJ2ZVJlcXVlc3RIABI7CgxyZXN0b3JlX21haW4YGyABKAsyIy5ub21vcy5rZXJuZWwudjEuUmVzdG9yZU1haW5SZXF1ZXN0SABCCwoJb3BlcmF0aW9uImgKEFBhY2tEZWx0YVJlcXVlc3QSDAoEcmVwbxgBIAEoCRIRCgRoZWFkGAIgASgJSACIAQESEQoEYmFzZRgDIAEoCUgBiAEBEg4KBmJyYW5jaBgEIAEoCUIHCgVfaGVhZEIHCgVfYmFzZSJyChBBcHBseVBhY2tSZXF1ZXN0EgwKBHJlcG8YASABKAkSDgoEcGFjaxgCIAEoDEgAEhoKEHN0YWdlZF9wYWNrX2ZpbGUYBCABKAlIABIRCgRoZWFkGAMgASgJSAGIAQFCCAoGc291cmNlQgcKBV9oZWFkIiAKEFJlcG9TdGF0c1JlcXVlc3QSDAoEcmVwbxgBIAEoCSKsAQoTSW50ZW50c0Fib3ZlUmVxdWVzdBIMCgRyZXBvGAEgASgJEhEKBGhlYWQYAiABKAlIAIgBARIRCgRiYXNlGAMgASgJSAGIAQESDgoGYnJhbmNoGAQgASgJEg0KBWxpbWl0GAUgASgEEhgKEGNvbXBsZXRlX2xvZ2ljYWwYBiABKAgSFgoOY29tcGFjdF9zdG9yZWQYByABKAhCBwoFX2hlYWRCBwoFX2Jhc2UiKwoUSW5zcGVjdENoYW5nZVJlcXVlc3QSEwoLY2hhbmdlX3VzZGEYASABKAwiRgoVRW5jb2RlRG9jdW1lbnRSZXF1ZXN0Ei0KCGRvY3VtZW50GAEgASgLMhsubm9tb3Mua2VybmVsLnYxLk5vbW9zVmFsdWUiLwoWSW5zcGVjdERvY3VtZW50UmVxdWVzdBIVCg1kb2N1bWVudF91c2RhGAEgASgMIjoKD1JlYWRCbG9iUmVxdWVzdBIMCgRyZXBvGAEgASgJEgsKA29pZBgCIAEoCRIMCgRwYXRoGAMgASgJIjQKEVJlc29sdmVSZWZSZXF1ZXN0EgwKBHJlcG8YASABKAkSEQoJcmVmZXJlbmNlGAIgASgJIi8KD0xpc3RSZWZzUmVxdWVzdBIMCgRyZXBvGAEgASgJEg4KBnByZWZpeBgCIAEoCSJCCg9Xcml0ZVJlZlJlcXVlc3QSDAoEcmVwbxgBIAEoCRIRCglyZWZlcmVuY2UYAiABKAkSDgoGdGFyZ2V0GAMgASgJIjMKEERlbGV0ZVJlZlJlcXVlc3QSDAoEcmVwbxgBIAEoCRIRCglyZWZlcmVuY2UYAiABKAkiKQoITWV0YUZpbGUSDAoEcGF0aBgBIAEoCRIPCgdjb250ZW50GAIgASgMIq4BChZXcml0ZU1ldGFDb21taXRSZXF1ZXN0EgwKBHJlcG8YASABKAkSDwoHcGFyZW50cxgCIAMoCRIoCgVmaWxlcxgDIAMoCzIZLm5vbW9zLmtlcm5lbC52MS5NZXRhRmlsZRIPCgdtZXNzYWdlGAQgASgJEhQKDHRpbWVfc2Vjb25kcxgFIAEoEhIWCglyZWZlcmVuY2UYBiABKAlIAIgBAUIMCgpfcmVmZXJlbmNlIi0KFUxhd0Nsb3N1cmVJbmZvUmVxdWVzdBIUCgxjbG9zdXJlX2ZpbGUYASABKAkihwEKF0NoZWNrcG9pbnRFeHBvcnRSZXF1ZXN0EjAKBnRhcmdldBgBIAEoCzIgLm5vbW9zLmtlcm5lbC52MS5Xb3Jrc3BhY2VUYXJnZXQSIQoUc3RhZ2VkX2Zyb250aWVyX2ZpbGUYAiABKAlIAIgBAUIXChVfc3RhZ2VkX2Zyb250aWVyX2ZpbGUi6QEKF0NoZWNrcG9pbnRJbXBvcnRSZXF1ZXN0EjAKBnRhcmdldBgBIAEoCzIgLm5vbW9zLmtlcm5lbC52MS5Xb3Jrc3BhY2VUYXJnZXQSEgoIZnJvbnRpZXIYAiABKAxIABIeChRzdGFnZWRfZnJvbnRpZXJfZmlsZRgGIAEoCUgAEhMKBmN1cnNvchgDIAEoCUgBiAEBEhcKCnN0YXRlX3Jvb3QYBCABKAlIAogBARINCgVzcGFucxgFIAEoCEIRCg9mcm9udGllcl9zb3VyY2VCCQoHX2N1cnNvckINCgtfc3RhdGVfcm9vdCIxChZDYXBhY2l0eVJlc2VydmVSZXF1ZXN0EhcKD2FnZ3JlZ2F0ZV9jb3VudBgBIAEoBCJUChJSZXN0b3JlTWFpblJlcXVlc3QSMAoGdGFyZ2V0GAEgASgLMiAubm9tb3Mua2VybmVsLnYxLldvcmtzcGFjZVRhcmdldBIMCgRoZWFkGAIgASgJIo0JCg9DdXN0b2R5UmVzcG9uc2USOAoKcGFja19kZWx0YRgKIAEoCzIiLm5vbW9zLmtlcm5lbC52MS5QYWNrRGVsdGFSZXNwb25zZUgAEjgKCmFwcGx5X3BhY2sYCyABKAsyIi5ub21vcy5rZXJuZWwudjEuQXBwbHlQYWNrUmVzcG9uc2VIABI4CgpyZXBvX3N0YXRzGAwgASgLMiIubm9tb3Mua2VybmVsLnYxLlJlcG9TdGF0c1Jlc3BvbnNlSAASPgoNaW50ZW50c19hYm92ZRgNIAEoCzIlLm5vbW9zLmtlcm5lbC52MS5JbnRlbnRzQWJvdmVSZXNwb25zZUgAEkAKDmluc3BlY3RfY2hhbmdlGA4gASgLMiYubm9tb3Mua2VybmVsLnYxLkluc3BlY3RDaGFuZ2VSZXNwb25zZUgAEkIKD2VuY29kZV9kb2N1bWVudBgPIAEoCzInLm5vbW9zLmtlcm5lbC52MS5FbmNvZGVEb2N1bWVudFJlc3BvbnNlSAASRAoQaW5zcGVjdF9kb2N1bWVudBgQIAEoCzIoLm5vbW9zLmtlcm5lbC52MS5JbnNwZWN0RG9jdW1lbnRSZXNwb25zZUgAEjYKCXJlYWRfYmxvYhgRIAEoCzIhLm5vbW9zLmtlcm5lbC52MS5SZWFkQmxvYlJlc3BvbnNlSAASOgoLcmVzb2x2ZV9yZWYYEiABKAsyIy5ub21vcy5rZXJuZWwudjEuUmVzb2x2ZVJlZlJlc3BvbnNlSAASNgoJbGlzdF9yZWZzGBMgASgLMiEubm9tb3Mua2VybmVsLnYxLkxpc3RSZWZzUmVzcG9uc2VIABIyCgl3cml0ZV9yZWYYFCABKAsyHS5ub21vcy5rZXJuZWwudjEuQWNrbm93bGVkZ2VkSAASMwoKZGVsZXRlX3JlZhgVIAEoCzIdLm5vbW9zLmtlcm5lbC52MS5BY2tub3dsZWRnZWRIABJFChF3cml0ZV9tZXRhX2NvbW1pdBgWIAEoCzIoLm5vbW9zLmtlcm5lbC52MS5Xcml0ZU1ldGFDb21taXRSZXNwb25zZUgAEkMKEGxhd19jbG9zdXJlX2luZm8YFyABKAsyJy5ub21vcy5rZXJuZWwudjEuTGF3Q2xvc3VyZUluZm9SZXNwb25zZUgAEkYKEWNoZWNrcG9pbnRfZXhwb3J0GBggASgLMikubm9tb3Mua2VybmVsLnYxLkNoZWNrcG9pbnRFeHBvcnRSZXNwb25zZUgAEkYKEWNoZWNrcG9pbnRfaW1wb3J0GBkgASgLMikubm9tb3Mua2VybmVsLnYxLkNoZWNrcG9pbnRJbXBvcnRSZXNwb25zZUgAEkQKEGNhcGFjaXR5X3Jlc2VydmUYGiABKAsyKC5ub21vcy5rZXJuZWwudjEuQ2FwYWNpdHlSZXNlcnZlUmVzcG9uc2VIABI8CgxyZXN0b3JlX21haW4YGyABKAsyJC5ub21vcy5rZXJuZWwudjEuUmVzdG9yZU1haW5SZXNwb25zZUgAQgsKCW9wZXJhdGlvbiIhChFQYWNrRGVsdGFSZXNwb25zZRIMCgRwYWNrGAEgASgMIjwKEUFwcGx5UGFja1Jlc3BvbnNlEhQKDG9iamVjdF9jb3VudBgBIAEoBBIRCglwYWNrX2hhc2gYAiABKAkipwEKEVJlcG9TdGF0c1Jlc3BvbnNlEhMKC3RvdGFsX2J5dGVzGAEgASgEEhQKDG9iamVjdF9ieXRlcxgCIAEoBBIVCg1sb29zZV9vYmplY3RzGAMgASgEEhMKC2xvb3NlX2J5dGVzGAQgASgEEhIKCnBhY2tfZmlsZXMYBSABKAQSEgoKcGFja19ieXRlcxgGIAEoBBITCgtpbmRleF9ieXRlcxgHIAEoBCKWAQoMSW50ZW50UmVjb3JkEgsKA29pZBgBIAEoCRIRCglpbnRlbnRfaWQYAiABKAkSDgoGZG9tYWluGAMgASgJEhEKCWRpcmVjdGl2ZRgEIAEoCRITCgtjaGFuZ2VfdXNkYRgFIAEoDBIuCghzZW1hbnRpYxgGIAEoCzIcLm5vbW9zLmtlcm5lbC52MS5Ob21vc1N0cnVjdCJGChRJbnRlbnRzQWJvdmVSZXNwb25zZRIuCgdpbnRlbnRzGAEgAygLMh0ubm9tb3Mua2VybmVsLnYxLkludGVudFJlY29yZCJHChVJbnNwZWN0Q2hhbmdlUmVzcG9uc2USLgoIc2VtYW50aWMYASABKAsyHC5ub21vcy5rZXJuZWwudjEuTm9tb3NTdHJ1Y3QiLwoWRW5jb2RlRG9jdW1lbnRSZXNwb25zZRIVCg1kb2N1bWVudF91c2RhGAEgASgMIkgKF0luc3BlY3REb2N1bWVudFJlc3BvbnNlEi0KCGRvY3VtZW50GAEgASgLMhsubm9tb3Mua2VybmVsLnYxLk5vbW9zVmFsdWUiLwoQUmVhZEJsb2JSZXNwb25zZRINCgVmb3VuZBgBIAEoCBIMCgRibG9iGAIgASgMIi4KElJlc29sdmVSZWZSZXNwb25zZRIQCgNvaWQYASABKAlIAIgBAUIGCgRfb2lkIisKCVJlZlJlY29yZBIRCglyZWZlcmVuY2UYASABKAkSCwoDb2lkGAIgASgJIjwKEExpc3RSZWZzUmVzcG9uc2USKAoEcmVmcxgBIAMoCzIaLm5vbW9zLmtlcm5lbC52MS5SZWZSZWNvcmQiDgoMQWNrbm93bGVkZ2VkIiYKF1dyaXRlTWV0YUNvbW1pdFJlc3BvbnNlEgsKA29pZBgBIAEoCSKDAQoWTGF3Q2xvc3VyZUluZm9SZXNwb25zZRIQCghpZGVudGl0eRgBIAEoCRIZChFyb290X2xvZ2ljYWxfcGF0aBgCIAEoCRITCgthc3NldF9jb3VudBgDIAEoBBISCgpwcmltX2NvdW50GAQgASgEEhMKC2RvbWFpbl9rZXlzGAUgAygJIu8CChhDaGVja3BvaW50RXhwb3J0UmVzcG9uc2USDQoFZW1wdHkYASABKAgSEwoGY3Vyc29yGAIgASgJSACIAQESEAoIZnJvbnRpZXIYAyABKAwSFwoKc3RhdGVfcm9vdBgEIAEoCUgBiAEBEhIKCnN0YXRlX3RyZWUYBSABKAgSDgoGcGlubmVkGAYgASgIEhsKE3JlYWRfaW5kZXhfc25hcHNob3QYByABKAgSIwobcmVhZF9pbmRleF9zbmFwc2hvdF9wZW5kaW5nGAggASgIEiQKF3JlYWRfaW5kZXhfc3FsaXRlX2J5dGVzGAkgASgESAKIAQESJQoYcmVhZF9pbmRleF9jdXN0b2R5X2J5dGVzGAogASgESAOIAQFCCQoHX2N1cnNvckINCgtfc3RhdGVfcm9vdEIaChhfcmVhZF9pbmRleF9zcWxpdGVfYnl0ZXNCGwoZX3JlYWRfaW5kZXhfY3VzdG9keV9ieXRlcyKeAgoYQ2hlY2twb2ludEltcG9ydFJlc3BvbnNlEhAKCHJlc3RvcmVkGAEgASgIEhMKBnJlYXNvbhgCIAEoCUgAiAEBEhcKD2Zyb250aWVyX3NlZWRlZBgDIAEoCBIlCh1mcm9udGllcl92ZXJpZmljYXRpb25fcGVuZGluZxgEIAEoCBIXCg9hZ2dyZWdhdGVfY291bnQYBSABKAQSKwoFc3BhbnMYBiABKAsyHC5ub21vcy5rZXJuZWwudjEuTm9tb3NTdHJ1Y3QSEwoGY3Vyc29yGAcgASgJSAGIAQESEQoJcmVhZF9vbmx5GAggASgIEhcKD2xhenlfcmVhZF9pbmRleBgJIAEoCEIJCgdfcmVhc29uQgkKB19jdXJzb3IiSgoXQ2FwYWNpdHlSZXNlcnZlUmVzcG9uc2USFwoPYWdncmVnYXRlX2NvdW50GAEgASgEEhYKDnJlc2VydmVkX2J5dGVzGAIgASgEIkMKE1Jlc3RvcmVNYWluUmVzcG9uc2USDAoEaGVhZBgBIAEoCRIQCgh2ZXJpZmllZBgCIAEoCBIMCgR3YWxrGAMgASgJIpsCCgpOb21vc1ZhbHVlEiUKBG51bGwYASABKAsyFS5ub21vcy5rZXJuZWwudjEuTnVsbEgAEhEKB2Jvb2xlYW4YAiABKAhIABIYCg5zaWduZWRfaW50ZWdlchgDIAEoEkgAEhoKEHVuc2lnbmVkX2ludGVnZXIYBCABKARIABIYCg5mbG9hdGluZ19wb2ludBgFIAEoAUgAEg4KBHRleHQYBiABKAlIABIPCgVieXRlcxgHIAEoDEgAEioKBGxpc3QYCCABKAsyGi5ub21vcy5rZXJuZWwudjEuTm9tb3NMaXN0SAASLgoGb2JqZWN0GAkgASgLMhwubm9tb3Mua2VybmVsLnYxLk5vbW9zU3RydWN0SABCBgoEa2luZCIGCgROdWxsIjgKCU5vbW9zTGlzdBIrCgZ2YWx1ZXMYASADKAsyGy5ub21vcy5rZXJuZWwudjEuTm9tb3NWYWx1ZSKTAQoLTm9tb3NTdHJ1Y3QSOAoGZmllbGRzGAEgAygLMigubm9tb3Mua2VybmVsLnYxLk5vbW9zU3RydWN0LkZpZWxkc0VudHJ5GkoKC0ZpZWxkc0VudHJ5EgsKA2tleRgBIAEoCRIqCgV2YWx1ZRgCIAEoCzIbLm5vbW9zLmtlcm5lbC52MS5Ob21vc1ZhbHVlOgI4ASrpEgoRS2VybmVsUmVmdXNhbENvZGUSIwofS0VSTkVMX1JFRlVTQUxfQ09ERV9VTlNQRUNJRklFRBAAEiUKIUtFUk5FTF9SRUZVU0FMX0NPREVfQkFEX1NJR05BVFVSRRABEiQKIEtFUk5FTF9SRUZVU0FMX0NPREVfVU5BVVRIT1JJWkVEEAISJwojS0VSTkVMX1JFRlVTQUxfQ09ERV9QT0xJQ1lfRElTQUJMRUQQAxIqCiZLRVJORUxfUkVGVVNBTF9DT0RFX1VOQ0VSVElGSUVEX1BPTElDWRAEEiMKH0tFUk5FTF9SRUZVU0FMX0NPREVfUkVGRVJFTlRJQUwQBRIvCitLRVJORUxfUkVGVVNBTF9DT0RFX1BPSU5UX1NUQVRFX1VOQVZBSUxBQkxFEAYSJAogS0VSTkVMX1JFRlVTQUxfQ09ERV9DQVBfRVhDRUVERUQQBxItCilLRVJORUxfUkVGVVNBTF9DT0RFX0NBUF9DT1VOVF9VTkFWQUlMQUJMRRAIEikKJUtFUk5FTF9SRUZVU0FMX0NPREVfRVZJREVOQ0VfVU5CQUNLRUQQCRImCiJLRVJORUxfUkVGVVNBTF9DT0RFX09SUEhBTl9SRUNFSVBUEAoSNgoyS0VSTkVMX1JFRlVTQUxfQ09ERV9SRUNFSVBUX09OX1RFUk1JTkFMX09CTElHQVRJT04QCxIiCh5LRVJORUxfUkVGVVNBTF9DT0RFX05PVF9NSU5URUQQDBIoCiRLRVJORUxfUkVGVVNBTF9DT0RFX0RPTUFJTl9MSUZFQ1lDTEUQDRIpCiVLRVJORUxfUkVGVVNBTF9DT0RFX1RZUEVfVEFHX01JU01BVENIEA4SLAooS0VSTkVMX1JFRlVTQUxfQ09ERV9SRVRJUkVEX1JFQURfU1VSRkFDRRAPEjAKLEtFUk5FTF9SRUZVU0FMX0NPREVfQ1JPU1NfV09SS1NQQUNFX0RFQ0xJTkVEEBASKwonS0VSTkVMX1JFRlVTQUxfQ09ERV9BR0dSRUdBVEVfSU5WQVJJQU5UEBESKwonS0VSTkVMX1JFRlVTQUxfQ09ERV9XT1JLU1BBQ0VfSU5WQVJJQU5UEBISLgoqS0VSTkVMX1JFRlVTQUxfQ09ERV9DQVBUVVJFRF9SRUFEX0NPTkZMSUNUEBMSMgouS0VSTkVMX1JFRlVTQUxfQ09ERV9DT05GTElDVF9TTkFQU0hPVF9SRVFVSVJFRBAUEjQKMEtFUk5FTF9SRUZVU0FMX0NPREVfQ09ORkxJQ1RfU05BUFNIT1RfVU5ERUNMQVJFRBAVEjEKLUtFUk5FTF9SRUZVU0FMX0NPREVfQ09ORkxJQ1RfU05BUFNIT1RfSU5WQUxJRBAWEi8KK0tFUk5FTF9SRUZVU0FMX0NPREVfQ09ORkxJQ1RfU05BUFNIT1RfU1RBTEUQFxIwCixLRVJORUxfUkVGVVNBTF9DT0RFX0NBUFRVUkVEX1JFQURfVU5ERUNMQVJFRBAYEi0KKUtFUk5FTF9SRUZVU0FMX0NPREVfQ0FQVFVSRURfUkVBRF9QUklWQVRFEBkSMAosS0VSTkVMX1JFRlVTQUxfQ09ERV9BVFRFU1RFRF9SRUFEX1VOREVDTEFSRUQQGhIzCi9LRVJORUxfUkVGVVNBTF9DT0RFX0FUVEVTVEVEX1JFQURfVU5UUlVTVEVEX0tFWRAbEjYKMktFUk5FTF9SRUZVU0FMX0NPREVfQVRURVNURURfUkVBRF9VTlRSVVNURURfU09VUkNFEBwSLAooS0VSTkVMX1JFRlVTQUxfQ09ERV9BVFRFU1RFRF9SRUFEX0ZPUkdFRBAdEisKJ0tFUk5FTF9SRUZVU0FMX0NPREVfQVRURVNURURfUkVBRF9TVEFMRRAeEi4KKktFUk5FTF9SRUZVU0FMX0NPREVfQVRURVNURURfUkVBRF9PVkVSU0laRRAfEjcKM0tFUk5FTF9SRUZVU0FMX0NPREVfQVRURVNURURfUkVBRF9ESVNIT05PUkVEX1NPVVJDRRAgEjUKMUtFUk5FTF9SRUZVU0FMX0NPREVfRVFVSVZPQ0FUSU9OX0VWSURFTkNFX0lOVkFMSUQQIRIzCi9LRVJORUxfUkVGVVNBTF9DT0RFX0FUVEVTVEFUSU9OX1JFQ0VJUFRfSU5WQUxJRBAiEisKJ0tFUk5FTF9SRUZVU0FMX0NPREVfS0VZX1JPU1RFUl9NSVNNQVRDSBAjEi8KK0tFUk5FTF9SRUZVU0FMX0NPREVfS0VZX0VQT0NIX05PVF9NT05PVE9OSUMQJBIpCiVLRVJORUxfUkVGVVNBTF9DT0RFX1dSSVRFX0VQT0NIX1NUQUxFECUSLQopS0VSTkVMX1JFRlVTQUxfQ09ERV9FTlZFTE9QRV9TSURfTUlTTUFUQ0gQJhIyCi5LRVJORUxfUkVGVVNBTF9DT0RFX1JFVk9LRURfTUVNQkVSX1JFU1VSUkVDVEVEECcSKAokS0VSTkVMX1JFRlVTQUxfQ09ERV9GT1JHRURfUFJJTkNJUEFMECgSKAokS0VSTkVMX1JFRlVTQUxfQ09ERV9PV05FRF9LRVlfQU5DSE9SECkSJgoiS0VSTkVMX1JFRlVTQUxfQ09ERV9PV05FRF9SRUNPVkVSWRAqEiwKKEtFUk5FTF9SRUZVU0FMX0NPREVfU1VSRkFDRURfQkFTSVNfQUhFQUQQKxIyCi5LRVJORUxfUkVGVVNBTF9DT0RFX1NJR05FUl9FUE9DSF9PVVRfT0ZfV0lORE9XECwSJgoiS0VSTkVMX1JFRlVTQUxfQ09ERV9FVk9MVkVfUkVGVVNFRBAtEisKJ0tFUk5FTF9SRUZVU0FMX0NPREVfQVRURVNUQVRJT05fSU5WQUxJRBAuEi0KKUtFUk5FTF9SRUZVU0FMX0NPREVfUEFSRU5UX0RJRF9OT1RfQVRURVNUEC8SKQolS0VSTkVMX1JFRlVTQUxfQ09ERV9DRVJUX0NIQUlOX0JST0tFThAwEioKJktFUk5FTF9SRUZVU0FMX0NPREVfTk9UX1JPT1RFRF9BVF9ST09UEDESKgomS0VSTkVMX1JFRlVTQUxfQ09ERV9ERUxFR0FUSU9OX0lOVkFMSUQQMhIlCiFLRVJORUxfUkVGVVNBTF9DT0RFX1BMQU5fUkVKRUNURUQQMyqFDAoOUXVlcnlPcGVyYXRpb24SHwobUVVFUllfT1BFUkFUSU9OX1VOU1BFQ0lGSUVEEAASHAoYUVVFUllfT1BFUkFUSU9OX0VYVFJFTVVNEAESJQohUVVFUllfT1BFUkFUSU9OX1BFTkRJTkdfQ09ORkxJQ1RTEAISLAooUVVFUllfT1BFUkFUSU9OX1BFTkRJTkdfQ09ORkxJQ1RfU1VNTUFSWRADEiAKHFFVRVJZX09QRVJBVElPTl9SRUFEX1BPU1RVUkUQBBIfChtRVUVSWV9PUEVSQVRJT05fQ1VSUkVOVF9MQVcQBRIjCh9RVUVSWV9PUEVSQVRJT05fSU5URVJGQUNFX09GRkVSEAYSJwojUVVFUllfT1BFUkFUSU9OX1JFTEFUSU9OX0dBVEVfT0ZGRVIQBxIdChlRVUVSWV9PUEVSQVRJT05fU0NFTkVfTEFXEAgSIQodUVVFUllfT1BFUkFUSU9OX0lOU1RBTExFRF9MQVcQCRIcChhRVUVSWV9PUEVSQVRJT05fREVTQ1JJQkUQChIgChxRVUVSWV9PUEVSQVRJT05fS0VSTkVMX1NUQU1QEAsSIwofUVVFUllfT1BFUkFUSU9OX0RFVkVMT1BFUl9TUEFOUxAMEikKJVFVRVJZX09QRVJBVElPTl9ERUNMQVJFRF9DQVBBQklMSVRJRVMQDRIdChlRVUVSWV9PUEVSQVRJT05fUkVBRElORVNTEA4SJAogUVVFUllfT1BFUkFUSU9OX1BST0pFQ1RJT05fU1RBVFMQDxIlCiFRVUVSWV9PUEVSQVRJT05fTUVNT1JZX0RST1BfUFJPQkUQEBIYChRRVUVSWV9PUEVSQVRJT05fV0FSTRAREhsKF1FVRVJZX09QRVJBVElPTl9SRUZSRVNIEBISIAocUVVFUllfT1BFUkFUSU9OX1ZFUklGWV9DSEFJThATEiUKIVFVRVJZX09QRVJBVElPTl9ISVNUT1JZX1BSRUZMSUdIVBAUEhkKFVFVRVJZX09QRVJBVElPTl9ST1VURRAVEhgKFFFVRVJZX09QRVJBVElPTl9NSU5UEBYSIQodUVVFUllfT1BFUkFUSU9OX0NSWVBUT19LRVlHRU4QFxIlCiFRVUVSWV9PUEVSQVRJT05fQ1JZUFRPX1NFQUxfRklFTEQQGBIsCihRVUVSWV9PUEVSQVRJT05fQ1JZUFRPX0JMSU5EX0lOREVYX1RPS0VOEBkSKgomUVVFUllfT1BFUkFUSU9OX0NSWVBUT19PV05FRF9TQ09QRV9LRVkQGhIvCitRVUVSWV9PUEVSQVRJT05fQ1JZUFRPX09XTkVEX0RFVklDRV9SRVFVRVNUEBsSMQotUVVFUllfT1BFUkFUSU9OX0NSWVBUT19PV05FRF9QUkVQQVJFX0FQUFJPVkFMEBwSMQotUVVFUllfT1BFUkFUSU9OX0NSWVBUT19PV05FRF9QUkVQQVJFX1JFQ09WRVJZEB0SIwofUVVFUllfT1BFUkFUSU9OX0NSWVBUT19XUkFQX0tFWRAeEiUKIVFVRVJZX09QRVJBVElPTl9DUllQVE9fVU5XUkFQX0tFWRAfEiEKHVFVRVJZX09QRVJBVElPTl9BVVRIT1JfS0VZR0VOECASJAogUVVFUllfT1BFUkFUSU9OX0FUVEVTVEFUSU9OX1NJR04QIRIgChxRVUVSWV9PUEVSQVRJT05fUkVDRUlQVF9QQVRIECISHQoZUVVFUllfT1BFUkFUSU9OX0NFUlRfU0lHThAjEiUKIVFVRVJZX09QRVJBVElPTl9CSVJUSF9UUlVTVF9TVEFURRAkEiEKHVFVRVJZX09QRVJBVElPTl9FUkFfQ0VSVF9TSUdOECUSKAokUVVFUllfT1BFUkFUSU9OX0RFTEVHQVRJT05fQ0VSVF9TSUdOECYSKQolUVVFUllfT1BFUkFUSU9OX0NBTk9OSUNBTElaRV9GUk9OVElFUhAnEisKJ1FVRVJZX09QRVJBVElPTl9DQU5PTklDQUxJWkVfUFJPSkVDVElPThAoMlkKEk5vbW9zS2VybmVsU2VydmljZRJDCgRDYWxsEhwubm9tb3Mua2VybmVsLnYxLkNhbGxSZXF1ZXN0Gh0ubm9tb3Mua2VybmVsLnYxLkNhbGxSZXNwb25zZWIGcHJvdG8z");
+    CallRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 0);
+    CallResponseSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 1);
+    WorkspaceTargetSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 15);
+    DirectiveCallSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 17);
+    AuthoringOptionsSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 18);
+    CapturedClockSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 19);
+    OfferRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 20);
+    QueryRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 23);
+    QueryAuthoritySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 24);
+    InjectedKeySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 25);
+    RowsQuerySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 26);
+    ByIdQuerySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 28);
+    TallyQuerySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 33);
+    SpatialQuerySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 34);
+    NamedQuerySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 35);
+    TestRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 50);
+    SetTestRootRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 51);
+    CustodyRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 53);
+    PackDeltaRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 54);
+    ApplyPackRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 55);
+    RepoStatsRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 56);
+    IntentsAboveRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 57);
+    InspectChangeRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 58);
+    EncodeDocumentRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 59);
+    InspectDocumentRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 60);
+    ReadBlobRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 61);
+    ResolveRefRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 62);
+    ListRefsRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 63);
+    WriteRefRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 64);
+    DeleteRefRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 65);
+    WriteMetaCommitRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 67);
+    LawClosureInfoRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 68);
+    RestoreMainRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 72);
+    NomosValueSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 93);
+    NomosStructSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 96);
+    QueryOperationSchema = /* @__PURE__ */ enumDesc(file_nomos_kernel_v1_kernel, 1);
+    QueryOperation = /* @__PURE__ */ tsEnum(QueryOperationSchema);
+  }
+});
+
 // ../adapter/engine.ts
 import { WASI, File, Directory, OpenFile, ConsoleStdout, PreopenDirectory } from "@bjorn3/browser_wasi_shim";
+import { create, fromBinary, toBinary } from "@bufbuild/protobuf";
 function b64Bytes(bytes) {
   let s = "";
   for (let i = 0; i < bytes.length; i += 32768) {
@@ -349,9 +398,6 @@ function b64Bytes(bytes) {
   }
   return btoa(s);
 }
-function b64Json(o) {
-  return b64Bytes(enc3.encode(JSON.stringify(o)));
-}
 async function sha256hex(t) {
   const b = await crypto.subtle.digest("SHA-256", enc3.encode(t));
   return [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, "0")).join("");
@@ -367,61 +413,297 @@ function osEntropyBuffer(n) {
   }
   return out;
 }
-function stringifyBig(o) {
-  return JSON.stringify(o, (_k, v) => typeof v === "bigint" ? `@@B:${v}@@` : v).replace(/"@@B:(\d+)@@"/g, "$1");
-}
-function call(ex, mode, fields, STDERR) {
-  const req = enc3.encode(JSON.stringify({ mode, ...fields }));
-  const reqPtr = ex.git_holon_alloc(req.length);
+function callProto(ex, operation, STDERR) {
+  const requestId = `adapter-${++protoRequestSequence}`;
+  const request = create(CallRequestSchema, {
+    protocolVersion: PROTO_ABI_VERSION,
+    requestId,
+    operation
+  });
+  const bytes = toBinary(CallRequestSchema, request);
+  const requestPtr = ex.git_holon_alloc(bytes.length) >>> 0;
   try {
-    new Uint8Array(ex.memory.buffer, reqPtr, req.length).set(req);
+    new Uint8Array(ex.memory.buffer, requestPtr, bytes.length).set(bytes);
     let packed;
     try {
-      packed = ex.git_holon_call(reqPtr, req.length);
-    } catch (e) {
+      packed = ex.git_holon_call_proto(requestPtr, bytes.length);
+    } catch (error) {
       const tail = STDERR.length ? ` | stderr: ${STDERR.slice(-8).join(" / ")}` : "";
-      throw new Error(`${String(e?.stack || e)}${tail}`);
+      throw new Error(`${String(error?.stack || error)}${tail}`);
     }
     const { ptr, len } = unpack(packed);
     try {
-      const e = JSON.parse(dec3.decode(new Uint8Array(ex.memory.buffer, ptr, len).slice()));
-      if (!e.ok) throw new Error((e.error || "holon error") + (STDERR.length ? ` | ${STDERR.slice(-4).join(" / ")}` : ""));
-      return e.result;
+      const responseBytes = new Uint8Array(ex.memory.buffer, ptr, len).slice();
+      const response = fromBinary(CallResponseSchema, responseBytes);
+      if (response.protocolVersion !== PROTO_ABI_VERSION) {
+        throw new Error(`kernel protobuf ABI ${response.protocolVersion}; expected ${PROTO_ABI_VERSION}`);
+      }
+      if (response.requestId !== requestId) {
+        throw new Error(`kernel protobuf response id ${response.requestId || "<empty>"}; expected ${requestId}`);
+      }
+      if (response.outcome.case === "failure") {
+        throw new Error(`${response.outcome.value.code}: ${response.outcome.value.message}`);
+      }
+      return response;
     } finally {
       ex.git_holon_dealloc(ptr, len);
     }
   } finally {
-    ex.git_holon_dealloc(reqPtr, req.length);
+    ex.git_holon_dealloc(requestPtr, bytes.length);
   }
 }
-async function createEngine({ wasmModule, bootstrapPkg, nomosPkg, replica, installedBy = "nomos-cloud" }) {
-  const hashes = { bootstrap: await sha256hex(bootstrapPkg), nomos: await sha256hex(nomosPkg) };
+function protoValue(value) {
+  if (value === null || value === void 0) {
+    return create(NomosValueSchema, { kind: { case: "null", value: {} } });
+  }
+  if (typeof value === "boolean") {
+    return create(NomosValueSchema, { kind: { case: "boolean", value } });
+  }
+  if (typeof value === "bigint") {
+    return value < 0n ? create(NomosValueSchema, { kind: { case: "signedInteger", value } }) : create(NomosValueSchema, { kind: { case: "unsignedInteger", value } });
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new Error("NomosValue numbers must be finite");
+    if (Number.isSafeInteger(value)) {
+      return value < 0 ? create(NomosValueSchema, { kind: { case: "signedInteger", value: BigInt(value) } }) : create(NomosValueSchema, { kind: { case: "unsignedInteger", value: BigInt(value) } });
+    }
+    return create(NomosValueSchema, { kind: { case: "floatingPoint", value } });
+  }
+  if (typeof value === "string") {
+    return create(NomosValueSchema, { kind: { case: "text", value } });
+  }
+  if (value instanceof Uint8Array) {
+    return create(NomosValueSchema, { kind: { case: "bytes", value } });
+  }
+  if (Array.isArray(value)) {
+    return create(NomosValueSchema, {
+      kind: { case: "list", value: { values: value.map(protoValue) } }
+    });
+  }
+  if (typeof value === "object") {
+    return create(NomosValueSchema, {
+      kind: { case: "object", value: protoStruct(value) }
+    });
+  }
+  throw new Error(`unsupported NomosValue type: ${typeof value}`);
+}
+function protoStruct(value) {
+  return create(NomosStructSchema, {
+    fields: Object.fromEntries(Object.entries(value).map(([key, field]) => [key, protoValue(field)]))
+  });
+}
+function jsValue(value) {
+  if (!value) return void 0;
+  switch (value.kind.case) {
+    case "null":
+      return null;
+    case "boolean":
+    case "floatingPoint":
+    case "text":
+    case "bytes":
+      return value.kind.value;
+    case "signedInteger":
+    case "unsignedInteger": {
+      const integer = value.kind.value;
+      return integer >= BigInt(Number.MIN_SAFE_INTEGER) && integer <= BigInt(Number.MAX_SAFE_INTEGER) ? Number(integer) : integer;
+    }
+    case "list":
+      return value.kind.value.values.map(jsValue);
+    case "object":
+      return jsStruct(value.kind.value);
+    default:
+      return void 0;
+  }
+}
+function jsStruct(value) {
+  if (!value) return {};
+  return Object.fromEntries(Object.entries(value.fields).map(([key, field]) => [key, jsValue(field)]));
+}
+function unreachableOfferOutcome(value) {
+  throw new Error(`kernel returned an unsupported offer outcome: ${String(value)}`);
+}
+function offerResult(response) {
+  const outcome = response.outcome;
+  switch (outcome.case) {
+    case "admitted": {
+      const value = jsStruct(outcome.value.result);
+      return {
+        ok: true,
+        outcome: "admitted",
+        ...typeof value.head === "string" ? { head: value.head } : {},
+        ...value.intentOut !== void 0 ? { intentOut: value.intentOut } : {},
+        created: Array.isArray(value.created) ? value.created : [],
+        affected: Array.isArray(value.affected) ? value.affected : [],
+        born: Array.isArray(value.born) ? value.born : [],
+        birthOutcomes: Array.isArray(value.birthOutcomes) ? value.birthOutcomes : [],
+        ...value.kernelSpans !== void 0 ? { kernelSpans: value.kernelSpans } : {},
+        ...value.dryRun === true ? { dryRun: true } : {}
+      };
+    }
+    case "refused": {
+      const refusal = outcome.value.refusal;
+      if (!refusal) throw new Error("kernel returned an offer refusal without its typed refusal");
+      const diagnostics = jsStruct(outcome.value.diagnostics);
+      return {
+        ok: false,
+        outcome: "refused",
+        ...outcome.value.offerId !== void 0 ? { offerId: outcome.value.offerId } : {},
+        refusal: {
+          code: refusal.code,
+          message: refusal.message,
+          details: jsStruct(refusal.details)
+        },
+        error: refusal.message,
+        ...diagnostics.kernelSpans !== void 0 ? { kernelSpans: diagnostics.kernelSpans } : {}
+      };
+    }
+    case "deadLettered": {
+      const diagnostics = jsStruct(outcome.value.diagnostics);
+      return {
+        ok: false,
+        outcome: "deadLettered",
+        ...outcome.value.offerId !== void 0 ? { offerId: outcome.value.offerId } : {},
+        reason: outcome.value.reason,
+        error: outcome.value.reason,
+        ...diagnostics.kernelSpans !== void 0 ? { kernelSpans: diagnostics.kernelSpans } : {}
+      };
+    }
+    case "quarantined": {
+      const diagnostics = jsStruct(outcome.value.diagnostics);
+      return {
+        ok: false,
+        outcome: "quarantined",
+        ...outcome.value.offerId !== void 0 ? { offerId: outcome.value.offerId } : {},
+        authoredLawHash: outcome.value.authoredLawHash,
+        currentLawHash: outcome.value.currentLawHash,
+        reason: outcome.value.reason,
+        error: outcome.value.reason,
+        ...diagnostics.kernelSpans !== void 0 ? { kernelSpans: diagnostics.kernelSpans } : {}
+      };
+    }
+    case "blockedOnDependency": {
+      const diagnostics = jsStruct(outcome.value.diagnostics);
+      return {
+        ok: false,
+        outcome: "blockedOnDependency",
+        ...outcome.value.offerId !== void 0 ? { offerId: outcome.value.offerId } : {},
+        detail: outcome.value.detail,
+        error: outcome.value.detail,
+        ...diagnostics.kernelSpans !== void 0 ? { kernelSpans: diagnostics.kernelSpans } : {}
+      };
+    }
+    case void 0:
+      throw new Error("kernel returned an empty offer outcome");
+    default:
+      return unreachableOfferOutcome(outcome);
+  }
+}
+function applicationQueryProto(eng, ws, query2, options = {}) {
+  const response = callProto(eng.ex, {
+    case: "query",
+    value: create(QueryRequestSchema, {
+      target: protoTarget(ws, options.branch ?? BRANCH),
+      authority: protoAuthority(
+        options.principal,
+        options.keys,
+        options.authToken,
+        options.nowUnix,
+        options.authorSecret
+      ),
+      spans: options.spans ?? false,
+      query: query2
+    })
+  }, eng.STDERR);
+  if (response.outcome.case !== "query") {
+    throw new Error(`kernel returned ${response.outcome.case || "empty"} for application query`);
+  }
+  const result = response.outcome.value.result;
+  if (result.case === "applicationJson") {
+    return JSON.parse(dec3.decode(result.value.utf8));
+  }
+  if (result.case === "value") return jsValue(result.value);
+  throw new Error(`kernel returned ${result.case || "empty"} for application query`);
+}
+function namedQueryProto(eng, ws, operation, arguments_ = {}, options = {}) {
+  return applicationQueryProto(eng, ws, {
+    case: "named",
+    value: create(NamedQuerySchema, { operation, arguments: protoStruct(arguments_) })
+  }, options);
+}
+function custodyProto(eng, operation) {
+  return custodyProtoWith(eng.ex, operation, eng.STDERR);
+}
+function custodyProtoWith(ex, operation, STDERR) {
+  const response = callProto(ex, {
+    case: "custody",
+    value: create(CustodyRequestSchema, { operation })
+  }, STDERR);
+  if (response.outcome.case !== "custody" || !response.outcome.value.operation.case) {
+    throw new Error(`kernel returned ${response.outcome.case || "empty"} for custody request`);
+  }
+  return response.outcome.value.operation;
+}
+function custodyProtoCase(eng, operation, expected) {
+  const result = custodyProto(eng, operation);
+  if (result.case !== expected) {
+    throw new Error(`kernel returned custody.${result.case || "empty"}; expected custody.${expected}`);
+  }
+  return result.value;
+}
+async function createEngine({ wasmModule, bootstrapLawUsdz, nomosLawUsdz, replica, installedBy = "nomos-cloud" }) {
+  const assertUsdz = (name, bytes) => {
+    if (!(bytes instanceof Uint8Array) || bytes.length < 4 || bytes[0] !== 80 || bytes[1] !== 75 || bytes[2] !== 3 || bytes[3] !== 4) {
+      throw new Error(`${name} must be opaque USDZ bytes`);
+    }
+  };
+  assertUsdz("bootstrapLawUsdz", bootstrapLawUsdz);
+  assertUsdz("nomosLawUsdz", nomosLawUsdz);
   const root = /* @__PURE__ */ new Map();
-  root.set("domain.package.usda", new File(enc3.encode(bootstrapPkg)));
+  root.set("bootstrap.law.usdz", new File(bootstrapLawUsdz));
+  root.set("nomos.law.usdz", new File(nomosLawUsdz));
   root.set("ws", new Directory(/* @__PURE__ */ new Map()));
   const preopen = new PreopenDirectory("/work", root);
   const STDERR = [];
+  const streamKernelStderr = globalThis.process?.env?.NOMOS_WASM_STDERR === "1";
   const pushStderr = (l) => {
     if (STDERR.length >= 500) STDERR.splice(0, STDERR.length - 499);
     STDERR.push(l);
+    if (streamKernelStderr) console.error(`[nomos-kernel-stderr] ${l}`);
   };
   const fds = [new OpenFile(new File([])), ConsoleStdout.lineBuffered(() => {
   }), ConsoleStdout.lineBuffered(pushStderr), preopen];
   const wasi = new WASI(["wasm_git_holon", "reactor"], [], fds, { debug: false });
-  const inst = await WebAssembly.instantiate(wasmModule, { wasi_snapshot_preview1: wasi.wasiImport });
+  const wasiImports = unsignedWasiPointers(wasi.wasiImport);
+  const inst = await WebAssembly.instantiate(wasmModule, { wasi_snapshot_preview1: wasiImports });
   const code = wasi.start(inst);
   if (code !== 0) throw new Error(`reactor init exited ${code}; stderr=${STDERR.join("\n")}`);
   const instExports = inst.exports;
-  for (const n of ["memory", "git_holon_alloc", "git_holon_dealloc", "git_holon_call"]) if (!instExports[n]) throw new Error(`missing export ${n}`);
+  for (const n of ["memory", "git_holon_alloc", "git_holon_dealloc", "git_holon_call_proto"]) if (!instExports[n]) throw new Error(`missing export ${n}`);
+  const ex = instExports;
+  const closureInfo = (closureFile) => {
+    const response = custodyProtoWith(ex, {
+      case: "lawClosureInfo",
+      value: create(LawClosureInfoRequestSchema, { closureFile })
+    }, STDERR);
+    if (response.case !== "lawClosureInfo") {
+      throw new Error(`kernel returned custody.${response.case || "empty"}; expected custody.lawClosureInfo`);
+    }
+    return response.value;
+  };
+  const bootstrapInfo = closureInfo("/work/bootstrap.law.usdz");
+  const nomosInfo = closureInfo("/work/nomos.law.usdz");
+  if (!bootstrapInfo.identity) throw new Error("bootstrap USDA closure refused: missing identity");
+  if (!nomosInfo.identity) throw new Error("Nomos USDA closure refused: missing identity");
+  const hashes = { bootstrap: bootstrapInfo.identity, nomos: nomosInfo.identity };
   const eng = {
-    ex: instExports,
+    ex,
     preopen,
     STDERR,
     seq: 0,
     replica,
     hashes,
-    bootstrapPkg,
-    nomosPkg,
+    bootstrapLawUsdz,
+    nomosLawUsdz,
     installedBy,
     fs: makeGitFs(preopen, "/work", { File, Directory }),
     mounted: /* @__PURE__ */ new Map(),
@@ -491,14 +773,9 @@ function scopedReads(eng) {
 function globalAggregates(eng) {
   return /* @__PURE__ */ new Set();
 }
-function parseIntentEvents(blob) {
-  let doc;
-  try {
-    doc = JSON.parse(dec3.decode(blob));
-  } catch {
-    return [];
-  }
-  const events = Array.isArray(doc && doc.events) ? doc.events : [];
+function parseIntentEvents(doc) {
+  const rawEvents = doc?.events;
+  const events = Array.isArray(rawEvents) ? rawEvents : [];
   return events.map((ev) => {
     const sets = /* @__PURE__ */ new Map();
     for (const op of ev.ops || []) {
@@ -510,8 +787,8 @@ function parseIntentEvents(blob) {
     return { aggregate: String(ev.aggregate || ""), sets };
   });
 }
-function beginSummaryCapture(eng, ws, ctx, blob) {
-  const events = parseIntentEvents(blob);
+function beginSummaryCapture(eng, ws, ctx, doc) {
+  const events = parseIntentEvents(doc);
   if (events.length === 0) return null;
   const pre = /* @__PURE__ */ new Map();
   const candidates = /* @__PURE__ */ new Set();
@@ -646,17 +923,13 @@ async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null,
     const done = span(`intent offer ${cid.slice(0, 14)}`, "cadmit", 1, { client: cid });
     let blob = offer?.blob instanceof Uint8Array ? offer.blob : null;
     try {
-      if (!blob && typeof offer?.intentB64 === "string") blob = Uint8Array.from(atob(offer.intentB64), (c) => c.charCodeAt(0));
+      if (!blob && typeof offer?.changeB64 === "string") blob = Uint8Array.from(atob(offer.changeB64), (c) => c.charCodeAt(0));
       const maxOfferBytes = offer?.staged ? 64 * 1024 * 1024 : 32 * 1024 * 1024;
       if (!blob || blob.byteLength === 0 || blob.byteLength > maxOfferBytes) {
-        rec.rejected.push({ oid: String(offer?.oid || "").slice(0, 10), error: `intent offer must carry intentB64 <= ${maxOfferBytes / (1024 * 1024)} MiB` });
+        rec.rejected.push({ oid: String(offer?.oid || "").slice(0, 10), error: `intent offer must carry changeB64 <= ${maxOfferBytes / (1024 * 1024)} MiB` });
         continue;
       }
-      let doc = null;
-      try {
-        doc = JSON.parse(dec3.decode(blob));
-      } catch {
-      }
+      const doc = offer?.intent ?? kgit.inspectChange(eng, blob);
       const intentId = typeof doc?.id === "string" ? doc.id : null;
       const dom = typeof doc?.payload?.domain === "string" ? doc.payload.domain : null;
       const dirId = typeof doc?.payload?.directiveId === "string" ? doc.payload.directiveId : null;
@@ -675,7 +948,7 @@ async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null,
         rec.skipped.push({ oid, intent: intentId.slice(0, 12), alreadyOnMain: true });
         continue;
       }
-      const cap = summaryCtx ? beginSummaryCapture(eng, ws, summaryCtx, blob) : null;
+      const cap = summaryCtx ? beginSummaryCapture(eng, ws, summaryCtx, doc) : null;
       const _tOffer = Date.now();
       const res = offerAdmit(eng, ws, blob, { defer: false });
       log("offer-admit-ms", { ws, ms: Date.now() - _tOffer, deferred: false, ok: res.ok });
@@ -687,13 +960,30 @@ async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null,
         admittedTotal += 1;
         if (Array.isArray(res.born) && res.born.length) born.push(...res.born);
         if (Array.isArray(res.birthOutcomes) && res.birthOutcomes.length) birthOutcomes.push(...res.birthOutcomes);
+        if (typeof process !== "undefined" && process.env?.NOMOS_TEST_DIAGNOSTICS === "1" && Array.isArray(res.birthOutcomes) && res.birthOutcomes.length) {
+          log("offer-birth-outcomes", { ws, outcomes: res.birthOutcomes });
+        }
         if (cap) finishSummaryCapture(eng, ws, summaryCtx, cap, res.head ?? "", intentId);
       } else {
+        if (typeof process !== "undefined" && process.env?.NOMOS_TEST_DIAGNOSTICS === "1") {
+          log("offer-admit-refused", {
+            ws,
+            domain: dom,
+            directiveId: dirId,
+            error: String(res.error || "").slice(0, 2e3)
+          });
+        }
         const error = `${String(res.error || "").slice(0, 300)} \u2014 dead-lettered; fix the law (or the payload), then POST /v1/workspaces/${ws}/dead-letters/retry`;
         rec.rejected.push({ oid, error, deadLettered: true });
         deadLetters.push({ intentId, oid, session: cid, error, blob, domain: dom, directiveId: dirId });
       }
     } catch (e) {
+      if (typeof process !== "undefined" && process.env?.NOMOS_TEST_DIAGNOSTICS === "1") {
+        log("offer-admit-threw", {
+          ws,
+          error: String(e).slice(0, 2e3)
+        });
+      }
       rec.rejected.push({ oid: String(offer?.oid || "").slice(0, 10), error: String(e).slice(0, 200) });
     } finally {
       done();
@@ -715,7 +1005,7 @@ async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null,
   }
   const gitdir = gitdirOf(ws);
   const head = kgit.resolveRef(eng, gitdir, BRANCH) ?? main.head;
-  const summary = summaryCtx ? summaryOfCapture(summaryCtx, headBefore, head) : null;
+  const summary = summaryCtx ? summaryOfCapture(summaryCtx, headBefore ?? "", head ?? "") : null;
   let resultPackB64 = null;
   if (admittedTotal && head && /^[0-9a-f]{40}$/i.test(clientBase || "") && clientBase !== head) {
     try {
@@ -752,9 +1042,12 @@ async function mountWorkspace(eng, ws, ledger) {
   let restored = false, remoteMain = null, restoreError = null;
   try {
     await custodySkeleton(eng, gitdir);
-    remoteMain = await custodyFetch(eng, ws, ledger, { remoteRef: "refs/heads/main" });
+    remoteMain = await custodyFetch(eng, ws, ledger, { remoteRef: "refs/heads/main", writeRef: false });
     if (remoteMain) {
-      kgit.writeRef(eng, gitdir, "HEAD", "ref: refs/heads/main");
+      const mounted = kgit.restoreMain(eng, ws, remoteMain);
+      if (!mounted.verified || mounted.head !== remoteMain) {
+        throw new Error(`kernel refused restored main ${remoteMain}: ${JSON.stringify(mounted)}`);
+      }
       restored = true;
     }
   } catch (e) {
@@ -773,81 +1066,99 @@ function unmount(eng, ws) {
 function writeWork(eng, name, bytes) {
   eng.preopen.dir.contents.set(name, new File(bytes));
 }
+function stageLawClosure(eng, lawUsdz, label = "candidate-law") {
+  const name = `${label.replace(/[^A-Za-z0-9._-]/g, "_")}.law.usdz`;
+  writeWork(eng, name, lawUsdz);
+  return custodyProtoCase(eng, {
+    case: "lawClosureInfo",
+    value: create(LawClosureInfoRequestSchema, { closureFile: `/work/${name}` })
+  }, "lawClosureInfo");
+}
 function currentLaw(eng, ws) {
-  const out = JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "currentLaw" }), branch: BRANCH }, eng.STDERR));
+  const out = namedQueryProto(eng, ws, QueryOperation.CURRENT_LAW);
   return out.keyMap || {};
 }
 function installedLaw(eng, ws) {
-  return JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "installedLaw" }), branch: BRANCH }, eng.STDERR));
+  return namedQueryProto(eng, ws, QueryOperation.INSTALLED_LAW);
 }
 function kernelStamp(eng, ws) {
-  return JSON.parse(call(eng.ex, "query", {
-    repoArg: repoArgOf(ws),
-    workspace: ws,
-    queryBytes: b64Json({ op: "kernelStamp" }),
-    branch: BRANCH
-  }, eng.STDERR));
-}
-function domainPackage(eng, ws, hash) {
-  return JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "domainPackage", hash }), branch: BRANCH }, eng.STDERR));
-}
-function evolveDryRun(eng, ws, usda, domainHash, dispositions = null) {
-  const r = author(eng, ws, "nomos", "installDomain", installPayload(domainHash, usda, eng.installedBy, dispositions), eng.hashes.nomos, { dryRun: true, deferProjection: false });
-  return r.ok ? { admits: true } : { admits: false, detail: r.error };
+  return namedQueryProto(eng, ws, QueryOperation.KERNEL_STAMP);
 }
 function author(eng, ws, domain, directiveId, payload, controllerHash, opts = {}) {
   const seq = eng.seq++;
   const capPorts = { clock: { physical: Date.now(), logical: 0, replica: eng.replica }, rng: osEntropyBuffer(opts.rngDraws ?? 64) };
-  if (opts.__nomosConflictSnapshots !== void 0 && opts.__nomosConflictSnapshots.length > 0) {
-    capPorts.conflict_snapshots = opts.__nomosConflictSnapshots;
-  }
-  if (opts.validFromEpoch !== void 0) capPorts.valid_from_epoch = opts.validFromEpoch;
-  if (opts.principalVerified !== void 0) {
-    capPorts.principal = opts.actor ?? "";
-    capPorts.principal_verified = !!opts.principalVerified;
-  }
-  const envelope = { payload: { domain, directiveId, payload }, captured_ports: capPorts, policy_version: 1, policy_domain: "Nomos", policy_gas: 0, policy_memory: 0 };
-  if (opts.attestations !== void 0) envelope.attestations = opts.attestations;
-  writeWork(eng, `payload-${seq}.json`, enc3.encode(JSON.stringify(payload)));
-  writeWork(eng, `envelope-${seq}.json`, enc3.encode(stringifyBig(envelope)));
   const genesis = !controllerHash;
-  const attestorSecretFor = (from) => {
-    const s = opts.attestorSecrets;
-    if (!s) return null;
-    if (typeof s === "string") return s;
-    return typeof s[from] === "string" ? s[from] : null;
-  };
-  const defer = opts.deferProjection !== false;
-  const offerOnce = () => JSON.parse(call(eng.ex, "offer", { repoArg: repoArgOf(ws), workspace: ws, domain, directiveId, payloadFile: `/work/payload-${seq}.json`, envelopeFile: `/work/envelope-${seq}.json`, seq, actor: opts.actor ?? "", ...opts.authToken ? { authToken: opts.authToken } : {}, domainFile: genesis ? "/work/domain.package.usda" : "", domainHash: genesis ? "" : controllerHash, branch: BRANCH, ...opts.authorSecret ? { authorSecret: opts.authorSecret } : {}, ...opts.spans ? { spans: true } : {}, ...opts.dryRun ? { dryRun: true } : defer ? { deferProjection: true } : {} }, eng.STDERR));
-  let v = offerOnce();
-  for (let pass = 0; pass < 8 && v.outcome === "refused"; pass++) {
-    const need = parseAttestedReadNeed(v.verdict?.reason ?? v.error);
-    if (!need || !eng.mounted.has(need.from)) break;
-    const secret = attestorSecretFor(need.from);
-    if (!secret) break;
-    const served = attestedRead(eng, need.from, {
-      queryId: need.queryId,
-      paramsJson: JSON.stringify(need.args),
-      attestorSecret: secret,
-      nowMs: opts.attestNowMs ?? Date.now(),
-      // K3 (§1.5.3): colocated custody is in-memory — always ask for the carried enrollment
-      // proof; the kernel produces-or-omits under its own bounds (the adapter decides nothing).
-      includeRosterProof: true
-    });
-    if (!served || served.ok !== true) break;
-    envelope.attestations = [...envelope.attestations ?? [], { queryId: need.queryId, result: served.rows, attestation: served.attestation }];
-    writeWork(eng, `envelope-${seq}.json`, enc3.encode(stringifyBig(envelope)));
-    v = offerOnce();
+  if (payload === null || typeof payload !== "object" || Array.isArray(payload)) {
+    throw new Error(`directive ${domain}/${directiveId} payload must be an object`);
   }
-  const res = v.outcome === "admitted" ? { ok: true, head: v.head, intentOut: v.intentOut, born: v.born ?? [], birthOutcomes: v.birthOutcomes ?? [], ...v.kernelSpans ? { kernelSpans: v.kernelSpans } : {} } : v.outcome === "refused" ? { ok: false, error: v.verdict?.reason ?? v.error } : v;
+  const defer = opts.deferProjection !== false;
+  const offerOnce = () => {
+    const response = callProto(eng.ex, {
+      case: "offer",
+      value: create(OfferRequestSchema, {
+        target: protoTarget(ws),
+        intent: {
+          case: "call",
+          value: create(DirectiveCallSchema, {
+            domain,
+            directive: directiveId,
+            payload: protoStruct(payload)
+          })
+        },
+        authoring: create(AuthoringOptionsSchema, {
+          actor: opts.actor ?? "",
+          authToken: opts.authToken ? enc3.encode(opts.authToken) : new Uint8Array(),
+          authorSecret: opts.authorSecret ? bytesFromB64(opts.authorSecret) : new Uint8Array(),
+          validFromEpoch: opts.validFromEpoch === void 0 ? void 0 : BigInt(opts.validFromEpoch),
+          rng: capPorts.rng,
+          deferProjection: !opts.dryRun && defer,
+          spans: opts.spans ?? false,
+          dryRun: opts.dryRun ?? false,
+          sequence: BigInt(seq),
+          clock: create(CapturedClockSchema, {
+            physicalMillis: BigInt(capPorts.clock.physical),
+            logical: capPorts.clock.logical,
+            replica: BigInt(capPorts.clock.replica)
+          })
+        }),
+        lawUsdz: opts.lawUsdz ?? new Uint8Array(),
+        executionLawUsdz: genesis && domain === "bootstrap" && directiveId === "installDomain" ? eng.bootstrapLawUsdz : new Uint8Array(),
+        controllerLawHash: genesis ? "" : controllerHash,
+        conflictSnapshots: (opts.__nomosConflictSnapshots ?? []).map((snapshot2) => ({
+          aggregateType: snapshot2.aggregateType,
+          aggregateId: snapshot2.aggregateId,
+          field: snapshot2.field,
+          targetSchema: snapshot2.targetSchema,
+          token: snapshot2.token
+        }))
+      })
+    }, eng.STDERR);
+    if (response.outcome.case !== "offer") {
+      throw new Error(`kernel returned ${response.outcome.case || "empty"} for offer request`);
+    }
+    return offerResult(response.outcome.value);
+  };
+  const res = offerOnce();
   if (defer && res.ok) (eng.pendingProjection ??= /* @__PURE__ */ new Set()).add(ws);
   return res;
 }
 function setTestKRoot(eng, kRootPublicB64) {
-  return JSON.parse(call(eng.ex, "set_test_k_root", { kRootPublicB64 }, eng.STDERR));
+  const response = callProto(eng.ex, {
+    case: "test",
+    value: create(TestRequestSchema, {
+      operation: {
+        case: "setRoot",
+        value: create(SetTestRootRequestSchema, { publicKey: bytesFromB64(kRootPublicB64) })
+      }
+    })
+  }, eng.STDERR);
+  if (response.outcome.case !== "test") {
+    throw new Error(`kernel returned ${response.outcome.case || "empty"} for test control`);
+  }
+  return { ok: true };
 }
 function refreshProjection(eng, ws) {
-  return JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "refresh" }), branch: BRANCH }, eng.STDERR));
+  return namedQueryProto(eng, ws, QueryOperation.REFRESH, {}, { spans: true });
 }
 async function custodySkeleton(eng, gitdir) {
   const p = eng.fs.promises;
@@ -868,16 +1179,16 @@ async function custodySkeleton(eng, gitdir) {
   } catch {
   }
 }
-async function custodyFetch(eng, ws, ledger, { remoteRef = "refs/heads/main", localRef = null, have = null } = {}) {
+async function custodyFetch(eng, ws, ledger, { remoteRef = "refs/heads/main", localRef = null, have = null, writeRef = true } = {}) {
   const remoteRefFull = fullRef(remoteRef);
   const refs = await custodyLsRefs(ledger, remoteRefFull);
   const tip = refs[remoteRefFull] || null;
   if (!tip) return null;
   if (tip !== have) {
     const pk = await fetchPack(ledger.remote, ledger.headers || {}, { wants: [tip], haves: have ? [have] : [] });
-    if (pk) applyPackInto(eng, ws, pk);
+    if (pk) applyPackInto(eng, ws, pk, tip);
   }
-  kgit.writeRef(eng, gitdirOf(ws), fullRef(localRef || remoteRef), tip);
+  if (writeRef) kgit.writeRef(eng, gitdirOf(ws), fullRef(localRef || remoteRef), tip);
   return tip;
 }
 async function custodyPush(eng, ws, ledger, { localRef = null, remoteRef, del = false, pointer = false, newOid = null }) {
@@ -920,26 +1231,14 @@ async function commitAndPush(eng, ws, ledger) {
   }
 }
 function describe(eng, ws) {
-  return JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "describe", workspace: ws }), branch: BRANCH }, eng.STDERR));
-}
-function parseAttestedReadNeed(error) {
-  const m = /attested-read-unreachable: read\('([^']+)', \{from: '([^']+)'\}\) args=(.*?) has no injected attestation/.exec(String(error || ""));
-  if (!m) return null;
-  let blob = m[3];
-  for (let i = 0; i < 4; i++) {
-    try {
-      return { queryId: m[1], from: m[2], args: JSON.parse(blob) };
-    } catch {
-      blob = blob.replace(/\\(["\\])/g, "$1");
-    }
-  }
-  return null;
+  return namedQueryProto(eng, ws, QueryOperation.DESCRIBE, { workspace: ws });
 }
 function packDelta(eng, ws, base, head) {
   try {
-    const r = JSON.parse(call(eng.ex, "pack_delta", { repoArg: repoArgOf(ws), base, head }, eng.STDERR));
-    if (!r || r.ok !== true || typeof r.packB64 !== "string") return null;
-    return Uint8Array.from(atob(r.packB64), (c) => c.charCodeAt(0));
+    return custodyProtoCase(eng, {
+      case: "packDelta",
+      value: create(PackDeltaRequestSchema, { repo: repoArgOf(ws), base: base || void 0, head })
+    }, "packDelta").pack;
   } catch {
     return null;
   }
@@ -952,13 +1251,21 @@ function servePack(eng, ws, base = "") {
   }
   let r;
   try {
-    r = JSON.parse(call(eng.ex, "pack_delta", { repoArg: repoArgOf(ws), workspace: ws, base, branch: BRANCH }, eng.STDERR));
+    const pack = custodyProtoCase(eng, {
+      case: "packDelta",
+      value: create(PackDeltaRequestSchema, { repo: repoArgOf(ws), base: base || void 0, branch: BRANCH })
+    }, "packDelta").pack;
+    r = { ok: true, packB64: b64Bytes(pack), bytes: pack.length };
   } catch (e) {
     const msg = String(e);
     if (/nothing to pack|head == base/.test(msg)) return { packB64: "", bytes: 0, upToDate: true, ...head ? { head } : {} };
-    if (base && /reached root|before base|not found|unknown|no (?:merge )?base|missing|invalid/i.test(msg)) {
+    if (base && /reached root|before base|not an ancestor|request a full pack|not found|unknown|no (?:merge )?base|missing|invalid/i.test(msg)) {
       try {
-        const full = JSON.parse(call(eng.ex, "pack_delta", { repoArg: repoArgOf(ws), workspace: ws, base: "", branch: BRANCH }, eng.STDERR));
+        const pack = custodyProtoCase(eng, {
+          case: "packDelta",
+          value: create(PackDeltaRequestSchema, { repo: repoArgOf(ws), branch: BRANCH })
+        }, "packDelta").pack;
+        const full = { ok: true, packB64: b64Bytes(pack), bytes: pack.length };
         if (full && full.ok === true && typeof full.packB64 === "string") {
           return { packB64: full.packB64, bytes: full.bytes, divergent: true, ...head ? { head } : {} };
         }
@@ -993,15 +1300,29 @@ function packBornChildren(eng, born) {
   });
 }
 function offerIntent(eng, ws, bytes, opts = {}) {
-  const name = `offer-in-${eng.seq++}.json`;
-  writeWork(eng, name, bytes);
+  const seq = eng.seq++;
   const deferProjection = !!(opts && opts.defer);
   const branch = opts && opts.branch || BRANCH;
-  return JSON.parse(call(eng.ex, "offer", { repoArg: repoArgOf(ws), workspace: ws, intentFile: `/work/${name}`, branch, deferProjection }, eng.STDERR));
+  const response = callProto(eng.ex, {
+    case: "offer",
+    value: create(OfferRequestSchema, {
+      target: protoTarget(ws, String(branch)),
+      intent: { case: "sealedChangeUsda", value: bytes },
+      authoring: create(AuthoringOptionsSchema, {
+        sequence: BigInt(seq),
+        deferProjection,
+        spans: !!opts?.spans
+      }),
+      candidateCommit: typeof opts?.candidateCommit === "string" ? opts.candidateCommit : void 0
+    })
+  }, eng.STDERR);
+  if (response.outcome.case !== "offer") {
+    throw new Error(`kernel returned ${response.outcome.case || "empty"} for sealed offer request`);
+  }
+  return offerResult(response.outcome.value);
 }
 function offerAdmit(eng, ws, bytes, opts = {}) {
-  const v = offerIntent(eng, ws, bytes, opts);
-  return v.outcome === "admitted" ? { ok: true, head: v.head, ...v.born ? { born: v.born } : {} } : { ok: false, error: v.verdict?.reason ?? v.error ?? "the offer was refused" };
+  return offerIntent(eng, ws, bytes, opts);
 }
 async function mainIntentIds(eng, ws) {
   const gitdir = gitdirOf(ws);
@@ -1013,7 +1334,7 @@ async function mainIntentIds(eng, ws) {
   for (const c of kgit.intentsAbove(eng, gitdir, head, "", 500)) {
     oids.add(c.oid);
     try {
-      const id = JSON.parse(dec3.decode(bytesFromB64(c.intentB64))).id;
+      const id = c.id;
       if (typeof id === "string" && id) ids.add(id);
     } catch {
     }
@@ -1098,15 +1419,11 @@ async function admitAll(eng, ws, ledger, { receiptFence = null, shardRouting = n
       for (const c of chain) {
         const oid = c.oid;
         try {
-          const blob = bytesFromB64(c.intentB64);
-          let dom = null, intentId = null, dirId = null;
-          try {
-            const doc = JSON.parse(dec3.decode(blob));
-            intentId = typeof doc.id === "string" ? doc.id : null;
-            dom = doc && doc.payload && typeof doc.payload.domain === "string" ? doc.payload.domain : null;
-            dirId = doc && doc.payload && typeof doc.payload.directiveId === "string" ? doc.payload.directiveId : null;
-          } catch {
-          }
+          const blob = bytesFromB64(c.changeB64);
+          const doc = c.intent;
+          const intentId = typeof c.id === "string" ? c.id : null;
+          const dom = typeof c.domain === "string" ? c.domain : null;
+          const dirId = typeof c.directiveId === "string" ? c.directiveId : null;
           if (!dom) {
             rejected.push({ oid: oid.slice(0, 10), error: "non-authored intent \u2014 governance enters its own admin lane" });
             continue;
@@ -1124,11 +1441,7 @@ async function admitAll(eng, ws, ledger, { receiptFence = null, shardRouting = n
             }
             const route = routes.get(`${dom} ${dirId}`);
             if (route) {
-              let payloadObj = null;
-              try {
-                payloadObj = JSON.parse(dec3.decode(blob)).payload?.payload ?? null;
-              } catch {
-              }
+              const payloadObj = doc?.payload?.payload ?? null;
               const verdict2 = await wrongHomeVerdict(shardRouting, route, payloadObj);
               if (verdict2) {
                 rejected.push({ oid: oid.slice(0, 10), error: verdict2.error, ...verdict2.wrongHome ? { wrongHome: verdict2.wrongHome } : {}, ...verdict2.homeMoving ? { homeMoving: verdict2.homeMoving } : {}, ...verdict2.deadLettered ? { deadLettered: true } : {} });
@@ -1137,11 +1450,7 @@ async function admitAll(eng, ws, ledger, { receiptFence = null, shardRouting = n
               }
             }
             if (dirId === "nomosReceiveAssignment" && shardRouting) {
-              let p = null;
-              try {
-                p = JSON.parse(dec3.decode(blob)).payload?.payload ?? null;
-              } catch {
-              }
+              const p = doc?.payload?.payload ?? null;
               const homeKey = p && typeof p.homeKey === "string" ? p.homeKey : null;
               const rows = homeKey ? await shardRouting.assignments() || [] : [];
               const a = homeKey ? rows.find((x) => x.homeKey === homeKey) : null;
@@ -1166,34 +1475,32 @@ async function admitAll(eng, ws, ledger, { receiptFence = null, shardRouting = n
             skipped.push({ oid: oid.slice(0, 10), intent: intentId.slice(0, 12), alreadyOnMain: true });
             continue;
           }
-          const cap = summaryCtx ? beginSummaryCapture(eng, ws, summaryCtx, blob) : null;
-          const verdict = offerIntent(eng, ws, blob, { defer: canDeferProjection });
-          const res = verdict.outcome === "admitted" ? { ok: true, head: verdict.head } : { ok: false, error: verdict.verdict?.reason ?? verdict.error ?? "the offer was refused" };
+          const cap = summaryCtx ? beginSummaryCapture(eng, ws, summaryCtx, doc) : null;
+          const verdict = offerIntent(eng, ws, blob, {
+            defer: canDeferProjection,
+            // The session commit is inert custody. Passing its content address lets the kernel recover
+            // typed auxiliary assets (notably a USDA law closure) bound by the sealed intent. The kernel
+            // authenticates the closure and runs the same offer gate; the adapter interprets nothing.
+            candidateCommit: oid
+          });
+          const res = verdict.outcome === "admitted" ? { ok: true, head: verdict.head } : { ok: false, error: verdict.error };
           if (res.ok) {
-            main.ids.add(intentId);
+            if (intentId) main.ids.add(intentId);
             main.oids.add(res.head);
             main.head = res.head;
             admitted.push({ oid: oid.slice(0, 10), head: res.head });
-            if (cap) finishSummaryCapture(eng, ws, summaryCtx, cap, res.head ?? "", intentId);
+            if (cap) finishSummaryCapture(eng, ws, summaryCtx, cap, res.head ?? "", intentId ?? "");
             if (shardRouting && dirId) {
               const placement = placementDirectives(eng).get(dirId);
               if (placement) {
-                let p = null;
-                try {
-                  p = JSON.parse(dec3.decode(blob)).payload?.payload ?? null;
-                } catch {
-                }
+                const p = doc?.payload?.payload ?? null;
                 const homeKey = p ? p[String(placement.keyField)] : void 0;
                 if (typeof homeKey === "string" && typeof p?.shard === "string") {
                   placements.push({ directive: dirId, homeKey, shard: p.shard, mapVersion: 1 });
                 }
               }
               if (dirId === "nomosSplitShard" && !shardRouting.selfLabel) {
-                let p = null;
-                try {
-                  p = JSON.parse(dec3.decode(blob)).payload?.payload ?? null;
-                } catch {
-                }
+                const p = doc?.payload?.payload ?? null;
                 if (p && typeof p.fromShard === "string" && typeof p.toShard === "string" && Array.isArray(p.homeKeys)) {
                   splits.push({ fromShard: p.fromShard, toShard: p.toShard, homeKeys: p.homeKeys.filter((k) => typeof k === "string") });
                 }
@@ -1201,7 +1508,7 @@ async function admitAll(eng, ws, ledger, { receiptFence = null, shardRouting = n
             }
             if (globalsDeclared && globalsDeclared.size > 0) {
               let touchesGlobal = false;
-              for (const ev of parseIntentEvents(blob)) {
+              for (const ev of parseIntentEvents(doc)) {
                 const rows = qById(eng, ws, ev.aggregate);
                 const t = ev.sets.get("__type") ?? (rows.length ? rows[0].type : void 0);
                 if (t !== void 0 && globalsDeclared.has(t)) {
@@ -1287,7 +1594,7 @@ async function admitAll(eng, ws, ledger, { receiptFence = null, shardRouting = n
   }
   const newMain = kgit.resolveRef(eng, gitdir, BRANCH);
   log("admit", { ws, sessions: results.length, main: newMain });
-  const summary = summaryCtx ? summaryOfCapture(summaryCtx, headBefore, newMain) : null;
+  const summary = summaryCtx ? summaryOfCapture(summaryCtx, headBefore ?? "", newMain) : null;
   const _total = Date.now() - _t0;
   const timings = { totalMs: _total, scanMs: _scanMs, fetchMs: _fetchMs, sealMs: _sealMs, gateFoldMs: Math.max(0, _total - _scanMs - _fetchMs - _sealMs), intents: _intents, sessions: results.length, spans: _spans };
   return {
@@ -1312,12 +1619,13 @@ async function writeRefusedRef(eng, ws, dl) {
   try {
     const prevOid = kgit.resolveRef(eng, gitdir, refForStamp);
     if (prevOid) {
-      const prev = JSON.parse(dec3.decode(kgit.readBlob(eng, gitdir, prevOid, "verdict.json") ?? new Uint8Array()));
+      const prevBytes = kgit.readBlob(eng, gitdir, prevOid, "verdict.usda");
+      const prev = prevBytes ? kgit.inspectDocument(eng, prevBytes) : null;
       if (prev && typeof prev.parkedAt === "string") parkedAt = prev.parkedAt;
     }
   } catch {
   }
-  const verdict = enc3.encode(JSON.stringify({
+  const verdict = kgit.encodeDocument(eng, {
     offerId: dl.intentId || null,
     oid: dl.oid || null,
     domain: dl.domain || null,
@@ -1325,11 +1633,11 @@ async function writeRefusedRef(eng, ws, dl) {
     session: dl.session || null,
     parkedAt,
     verdict: { reason: String(dl.error || "refused") }
-  }));
+  });
   const ref = refusedRefName(dl.intentId || dl.oid);
   kgit.writeMetaCommit(eng, gitdir, {
     parents: [],
-    files: [{ path: "intent.json", bytes: blob }, { path: "verdict.json", bytes: verdict }],
+    files: [{ path: "change.usda", bytes: blob }, { path: "verdict.usda", bytes: verdict }],
     message: `refused: ${dl.domain || "?"}/${dl.directiveId || "?"} \u2014 ${String(dl.error || "").slice(0, 120)}`,
     timeSecs: 0,
     ref
@@ -1342,10 +1650,10 @@ async function listRefusedRefs(eng, ws) {
   const out = [];
   for (const { ref, oid } of refs) {
     try {
-      const vb = kgit.readBlob(eng, gitdir, oid, "verdict.json") ?? new Uint8Array();
-      const ib = kgit.readBlob(eng, gitdir, oid, "intent.json") ?? new Uint8Array();
-      const v = JSON.parse(dec3.decode(vb));
-      out.push({ ref, ...v, intentB64: b64Bytes(ib) });
+      const vb = kgit.readBlob(eng, gitdir, oid, "verdict.usda") ?? new Uint8Array();
+      const ib = kgit.readBlob(eng, gitdir, oid, "change.usda") ?? new Uint8Array();
+      const v = kgit.inspectDocument(eng, vb);
+      out.push({ ref, ...v, changeB64: b64Bytes(ib) });
     } catch {
     }
   }
@@ -1357,7 +1665,9 @@ async function refusedSummary(eng, ws) {
   let count2 = 0, latestParkedAt = null;
   for (const { oid } of refs) {
     try {
-      const v = JSON.parse(dec3.decode(kgit.readBlob(eng, gitdir, oid, "verdict.json") ?? new Uint8Array()));
+      const bytes = kgit.readBlob(eng, gitdir, oid, "verdict.usda");
+      if (!bytes) continue;
+      const v = kgit.inspectDocument(eng, bytes);
       count2++;
       if (v && typeof v.parkedAt === "string" && (!latestParkedAt || v.parkedAt > latestParkedAt)) latestParkedAt = v.parkedAt;
     } catch {
@@ -1408,92 +1718,6 @@ async function boot(eng, ws, ledger) {
     `unborn-workspace: '${ws}' has no genesis and the host does not create workspaces \u2014 author its birth on its PARENT (birthChild/birthHome/an estate .births()); the parent's offer-effect materializes it in custody, then it serves from here. (root self-adopts via _ensureRootGenesis; this is not that path.)`
   );
 }
-async function deploy(eng, ws, ledger, usda, domainHash, dispositions, opts = {}) {
-  const existing = qById(eng, ws, `domain-installation:${domainHash}`);
-  if (existing.length > 0) {
-    const phase = String(existing[0]?.data?.["status.phase"] ?? "");
-    return {
-      head: kgit.resolveRef(eng, gitdirOf(ws), BRANCH),
-      installation: existing,
-      staged: phase === "Pending",
-      alreadyInstalled: true
-    };
-  }
-  const before = currentLaw(eng, ws);
-  const tenantHashes = [...new Set(Object.values(before).filter(
-    (hash) => typeof hash === "string" && hash !== eng.hashes.bootstrap && hash !== eng.hashes.nomos
-  ))];
-  const upgrade = tenantHashes.length > 0;
-  let supersedes = opts.supersedes?.trim() || void 0;
-  if (supersedes !== void 0 && !tenantHashes.includes(supersedes)) {
-    throw new Error(
-      `deploy-predecessor-changed: the client named ${supersedes.slice(0, 12)}\u2026 as the current model, but this workspace no longer serves it. Refresh and deploy again; nothing was committed.`
-    );
-  }
-  if (upgrade && supersedes === void 0) {
-    if (tenantHashes.length === 1) supersedes = tenantHashes[0];
-    else {
-      throw new Error(
-        `deploy-predecessor-ambiguous: this workspace currently serves ${tenantHashes.length} business-model packages. Nomos will not guess which one this candidate follows; use the generated deploy client, which binds the candidate to the current model before staging. Nothing was committed.`
-      );
-    }
-  }
-  if (upgrade && dispositions && Object.keys(dispositions).length > 0) {
-    throw new Error(
-      "deploy-manual-evolution-refused: successor deployment no longer accepts caller-chosen schema dispositions. Schema evolution belongs to the candidate model's adoption proof; nothing was committed."
-    );
-  }
-  const directiveId = upgrade ? "stageDomain" : "installDomain";
-  const payload = upgrade ? stagePayload(domainHash, usda, eng.installedBy, supersedes) : installPayload(domainHash, usda, eng.installedBy, dispositions);
-  const result = author(eng, ws, "nomos", directiveId, payload, eng.hashes.nomos, {
-    actor: opts.actor ?? "",
-    ...opts.authToken ? { authToken: opts.authToken } : {},
-    ...opts.authorSecret ? { authorSecret: opts.authorSecret } : {}
-  });
-  if (result.ok === false) {
-    unmount(eng, ws);
-    throw new Error(
-      `deploy-refused: ${upgrade ? "staging" : "installing"} ${domainHash.slice(0, 12)}\u2026 was REFUSED by the one gate (custody unchanged): ${result.error ?? "unknown refusal"}`
-    );
-  }
-  try {
-    const installation = qById(eng, ws, `domain-installation:${domainHash}`);
-    if (upgrade) {
-      const phase = String(installation[0]?.data?.["status.phase"] ?? "");
-      if (phase !== "Pending") {
-        throw new Error(
-          `deploy-did-not-stage: candidate ${domainHash.slice(0, 12)}\u2026 admitted but its lifecycle phase is '${phase || "missing"}', not Pending. Custody was not pushed.`
-        );
-      }
-      const after = currentLaw(eng, ws);
-      const moved = Object.entries(before).filter(([key, hash]) => after[key] !== hash);
-      if (moved.length > 0 || Object.values(after).includes(domainHash)) {
-        throw new Error(
-          `deploy-activated-candidate: staging ${domainHash.slice(0, 12)}\u2026 changed served law (${moved.map(([key]) => key).join(", ") || "candidate became current"}). Nomos refuses to persist an upgrade that bypassed model.adopt().`
-        );
-      }
-      await commitAndPush(eng, ws, ledger);
-      return { head: result.head, installation, staged: true, supersedes };
-    }
-    const law = installedLaw(eng, ws);
-    const installed = (law?.domains ?? []).find((row) => row?.domainHash === domainHash);
-    const keys = installed?.domainKeys ?? installation[0]?.data?.domainKeys ?? installation[0]?.domainKeys ?? [];
-    if (keys.length > 0) {
-      const currentLaw2 = law?.currentLaw ?? {};
-      const stale = keys.filter((k) => currentLaw2[k] !== domainHash);
-      if (stale.length > 0) {
-        throw new Error(
-          `deploy-did-not-advance: the install of ${domainHash.slice(0, 12)}\u2026 ADMITTED but the workspace's current law still serves ${stale.map((k) => `'${k}' from ${String(currentLaw2[k]).slice(0, 12)}\u2026`).join(", ")} \u2014 refusing (custody unchanged) instead of a silent no-op. This usually means the existing installation's era/lineage prevents supersession: run \`githolon deploy --dry-run=evolve\` for the gate's verdict, supply #58 dispositions for a true removal/retype, or re-forge the workspace onto the current lineage.`
-        );
-      }
-    }
-    await commitAndPush(eng, ws, ledger);
-    return { head: result.head, installation, staged: false };
-  } catch (error) {
-    unmount(eng, ws);
-    throw error;
-  }
-}
 function snapshot(eng, ws) {
   const wsDir = dirOf(eng.preopen.dir.contents.get("ws")).contents.get(ws);
   return serializeTree(wsDir);
@@ -1504,9 +1728,9 @@ async function ledgerStats(eng, ws, ledger = null) {
   if (!head && ledger?.remote) {
     try {
       await custodySkeleton(eng, gitdir);
-      const remoteMain = await custodyFetch(eng, ws, ledger, { remoteRef: "refs/heads/main" });
+      const remoteMain = await custodyFetch(eng, ws, ledger, { remoteRef: "refs/heads/main", writeRef: false });
       if (!remoteMain) return { head: null, commits: 0 };
-      kgit.writeRef(eng, gitdir, "HEAD", `ref: refs/heads/${BRANCH}`);
+      kgit.restoreMain(eng, ws, remoteMain);
       head = kgit.resolveRef(eng, gitdir, BRANCH);
       const mounted2 = eng.mounted.get(ws);
       if (mounted2) {
@@ -1525,7 +1749,7 @@ async function ledgerStats(eng, ws, ledger = null) {
   if (mounted) mounted.ledgerStats = out;
   return out;
 }
-var enc3, dec3, BRANCH, RESULT_PACK_INLINE_MAX, dirOf, repoArgOf, gitdirOf, unpack, log, repoArgOfGitdir, bytesFromB64, kgit, installPayload, stagePayload, routeTagHexOfHomeKey, SUMMARY_SEP, summaryKey, splitSummaryKey, NOMOS_SHARD_ROWS_READ, groupOf, tallyOf, isExtremumRead, extremumMonotone, pushVia, fullRef, applyPackInto, custodyLsRefs, qById, query, authorKeygen, attestedRead, certSign, readPosture, count, sum, pendingConflicts, pendingConflictSummary, spatialBboxParams, spatialWithin, extremum, nomosActive, refusedRefName, GENESIS_WARRANT_ID, isWarranted;
+var enc3, dec3, BRANCH, PROTO_ABI_VERSION, protoRequestSequence, RESULT_PACK_INLINE_MAX, dirOf, repoArgOf, gitdirOf, unpack, unsignedWasiPointers, log, protoTarget, protoAuthority, repoArgOfGitdir, bytesFromB64, kgit, closureInstallPayload, routeTagHexOfHomeKey, SUMMARY_SEP, summaryKey, splitSummaryKey, NOMOS_SHARD_ROWS_READ, groupOf, tallyOf, isExtremumRead, extremumMonotone, pushVia, fullRef, applyPackInto, custodyLsRefs, queryArguments, queryAuthorityOptions, qById, query, authorKeygen, certSign, readPosture, count, sum, pendingConflicts, pendingConflictSummary, spatialBboxParams, spatialWithin, extremum, nomosActive, refusedRefName, GENESIS_WARRANT_ID, isWarranted;
 var init_engine = __esm({
   "../adapter/engine.ts"() {
     "use strict";
@@ -1533,57 +1757,199 @@ var init_engine = __esm({
     init_tree();
     init_custody_transport();
     init_managed_promotion();
+    init_kernel_pb();
     enc3 = new TextEncoder();
     dec3 = new TextDecoder();
     BRANCH = "main";
+    PROTO_ABI_VERSION = 1;
+    protoRequestSequence = 0;
     RESULT_PACK_INLINE_MAX = 256 * 1024;
     dirOf = (n) => n;
     repoArgOf = (ws) => `/work/ws/${ws}`;
     gitdirOf = (ws) => `/work/ws/${ws}/nomos.git`;
     unpack = (p) => {
-      const v = typeof p === "bigint" ? p : BigInt(p);
-      return { ptr: Number(v >> 32n), len: Number(v & 0xffffffffn) };
+      const v = BigInt.asUintN(64, typeof p === "bigint" ? p : BigInt(p));
+      return { ptr: Number(v >> 32n & 0xffffffffn), len: Number(v & 0xffffffffn) };
+    };
+    unsignedWasiPointers = (imports) => {
+      const pointerArgs = {
+        args_sizes_get: [0, 1],
+        args_get: [0, 1],
+        environ_sizes_get: [0, 1],
+        environ_get: [0, 1],
+        clock_res_get: [1],
+        clock_time_get: [2],
+        fd_fdstat_get: [1],
+        fd_filestat_get: [1],
+        fd_pread: [1, 4],
+        fd_prestat_get: [1],
+        fd_prestat_dir_name: [1],
+        fd_pwrite: [1, 4],
+        fd_read: [1, 3],
+        fd_readdir: [1, 4],
+        fd_seek: [3],
+        fd_tell: [1],
+        fd_write: [1, 3],
+        path_create_directory: [1],
+        path_filestat_get: [2, 4],
+        path_filestat_set_times: [2],
+        path_link: [2, 5],
+        path_open: [2, 8],
+        path_readlink: [1, 3, 5],
+        path_remove_directory: [1],
+        path_rename: [1, 4],
+        path_symlink: [0, 3],
+        path_unlink_file: [1],
+        poll_oneoff: [0, 1],
+        random_get: [0]
+      };
+      for (const [name, indexes] of Object.entries(pointerArgs)) {
+        const original = imports[name];
+        if (typeof original !== "function") continue;
+        imports[name] = (...args) => {
+          for (const index of indexes) args[index] = args[index] >>> 0;
+          return original(...args);
+        };
+      }
+      return imports;
     };
     log = (evt, fields = {}) => console.log(JSON.stringify({ evt, t: Date.now(), ...fields }));
+    protoTarget = (ws = "root", branch = BRANCH) => create(WorkspaceTargetSchema, {
+      repo: repoArgOf(ws),
+      workspace: ws,
+      branch
+    });
+    protoAuthority = (principal = "", keys = [], authToken = "", nowUnix = 0, authorSecret = "") => create(QueryAuthoritySchema, {
+      principalClaim: principal,
+      authToken: authToken ? enc3.encode(authToken) : new Uint8Array(),
+      nowUnix: BigInt(nowUnix),
+      authorSecret: authorSecret ? bytesFromB64(authorSecret) : new Uint8Array(),
+      keys: keys.map((key) => create(InjectedKeySchema, {
+        scope: key.scope,
+        epoch: BigInt(key.epoch),
+        key: bytesFromB64(key.key)
+      }))
+    });
     repoArgOfGitdir = (gitdir) => gitdir.replace(/\/nomos\.git$/, "");
     bytesFromB64 = (b64) => Uint8Array.from(atob(b64), (c) => c.charCodeAt(0));
     kgit = {
       // resolveRef → tip oid hex, or null if the ref is absent (replaces git.resolveRef(...).catch(()=>null)).
-      resolveRef: (eng, gitdir, ref) => JSON.parse(call(eng.ex, "resolve_ref", { repoArg: repoArgOfGitdir(gitdir), ref }, eng.STDERR)).oid,
+      resolveRef: (eng, gitdir, ref) => custodyProtoCase(eng, {
+        case: "resolveRef",
+        value: create(ResolveRefRequestSchema, { repo: repoArgOfGitdir(gitdir), reference: ref })
+      }, "resolveRef").oid ?? "",
       // readBlob → the blob bytes at `path` inside commit `oid`, or null if not found (no throw).
-      readBlob: (eng, gitdir, oid, path2) => {
-        const r = JSON.parse(call(eng.ex, "read_blob", { repoArg: repoArgOfGitdir(gitdir), oid, path: path2 }, eng.STDERR));
-        return r.ok ? bytesFromB64(r.blobB64) : null;
+      readBlob: (eng, gitdir, oid, path3) => {
+        const result = custodyProtoCase(eng, {
+          case: "readBlob",
+          value: create(ReadBlobRequestSchema, { repo: repoArgOfGitdir(gitdir), oid, path: path3 })
+        }, "readBlob");
+        return result.found ? result.blob : null;
       },
-      // intentsAbove → [{ oid, intentB64 }] oldest→newest over (base, head] (replaces log + readBlob intent.json).
+      // intentsAbove → [{ oid, changeB64 }] oldest→newest over (base, head] (replaces log + readBlob intent.json).
       // `limit` (0 = all) caps to the most-recent N intent commits (replaces git.log depth).
-      intentsAbove: (eng, gitdir, head, base = "", limit = 0) => JSON.parse(call(eng.ex, "intents_above", { repoArg: repoArgOfGitdir(gitdir), head, base, limit }, eng.STDERR)).intents,
+      intentsAbove: (eng, gitdir, head, base = "", limit = 0, completeLogical = false) => custodyProtoCase(eng, {
+        case: "intentsAbove",
+        value: create(IntentsAboveRequestSchema, {
+          repo: repoArgOfGitdir(gitdir),
+          head: head || void 0,
+          base: base || void 0,
+          branch: BRANCH,
+          limit: BigInt(limit),
+          completeLogical
+        })
+      }, "intentsAbove").intents.map((intent) => ({
+        oid: intent.oid,
+        id: intent.intentId,
+        domain: intent.domain,
+        directiveId: intent.directive,
+        changeB64: b64Bytes(intent.changeUsda),
+        intent: jsStruct(intent.semantic)
+      })),
+      // inspectChange → compact semantic view decoded by the kernel; the adapter never parses USDA.
+      inspectChange: (eng, bytes) => jsStruct(custodyProtoCase(eng, {
+        case: "inspectChange",
+        value: create(InspectChangeRequestSchema, { changeUsda: bytes })
+      }, "inspectChange").semantic),
+      // Open structured custody sidecars are USDA too. The kernel owns their syntax and validation;
+      // the adapter only relays transient values and opaque bytes.
+      encodeDocument: (eng, value) => custodyProtoCase(eng, {
+        case: "encodeDocument",
+        value: create(EncodeDocumentRequestSchema, { document: protoValue(value) })
+      }, "encodeDocument").documentUsda,
+      inspectDocument: (eng, bytes) => jsValue(custodyProtoCase(eng, {
+        case: "inspectDocument",
+        value: create(InspectDocumentRequestSchema, { documentUsda: bytes })
+      }, "inspectDocument").document),
       // listRefs → [{ ref, oid }] under prefix (replaces git.listRefs for LOCAL refs).
-      listRefs: (eng, gitdir, prefix) => JSON.parse(call(eng.ex, "list_refs", { repoArg: repoArgOfGitdir(gitdir), prefix }, eng.STDERR)).refs,
+      listRefs: (eng, gitdir, prefix) => custodyProtoCase(eng, {
+        case: "listRefs",
+        value: create(ListRefsRequestSchema, { repo: repoArgOfGitdir(gitdir), prefix })
+      }, "listRefs").refs.map(({ reference, oid }) => ({ ref: reference, oid })),
       // writeRef → force-point a ref (plain oid or `ref:`-symbolic) (replaces git.writeRef).
-      writeRef: (eng, gitdir, ref, value) => JSON.parse(call(eng.ex, "write_ref", { repoArg: repoArgOfGitdir(gitdir), ref, value }, eng.STDERR)),
+      writeRef: (eng, gitdir, ref, value) => {
+        custodyProtoCase(eng, {
+          case: "writeRef",
+          value: create(WriteRefRequestSchema, { repo: repoArgOfGitdir(gitdir), reference: ref, target: value })
+        }, "writeRef");
+        return { ok: true };
+      },
+      // restoreMain → promote already-imported custody only after the kernel re-admits the complete chain.
+      // Unlike writeRef this is allowed to establish an absent main; it can never advance an existing one.
+      restoreMain: (eng, ws, head) => custodyProtoCase(eng, {
+        case: "restoreMain",
+        value: create(RestoreMainRequestSchema, {
+          target: create(WorkspaceTargetSchema, { repo: repoArgOf(ws), workspace: ws, branch: BRANCH }),
+          head
+        })
+      }, "restoreMain"),
       // deleteRef → remove a local ref, idempotent (replaces git.deleteRef).
-      deleteRef: (eng, gitdir, ref) => JSON.parse(call(eng.ex, "delete_ref", { repoArg: repoArgOfGitdir(gitdir), ref }, eng.STDERR)),
+      deleteRef: (eng, gitdir, ref) => {
+        custodyProtoCase(eng, {
+          case: "deleteRef",
+          value: create(DeleteRefRequestSchema, { repo: repoArgOfGitdir(gitdir), reference: ref })
+        }, "deleteRef");
+        return { ok: true };
+      },
       // applyPack → ingest a pack's objects into ws's repo (kernel apply_pack; refs are the caller's job).
       applyPack: (eng, ws, packBytes) => applyPackInto(eng, ws, packBytes),
+      // repoStats → kernel-owned physical custody accounting (host never walks Git's loose/pack layout).
+      repoStats: (eng, ws) => {
+        const stats = custodyProtoCase(eng, {
+          case: "repoStats",
+          value: create(RepoStatsRequestSchema, { repo: repoArgOf(ws) })
+        }, "repoStats");
+        return {
+          ok: true,
+          totalBytes: Number(stats.totalBytes),
+          objectBytes: Number(stats.objectBytes),
+          looseObjects: Number(stats.looseObjects),
+          looseBytes: Number(stats.looseBytes),
+          packFiles: Number(stats.packFiles),
+          packBytes: Number(stats.packBytes),
+          indexBytes: Number(stats.indexBytes)
+        };
+      },
       // writeMetaCommit → blobs→tree→commit→ref for a CUSTODY-META fact (checkpoint/refused/outbox/shape).
       // `files`: [{ path, bytes:Uint8Array }]; returns the commit oid (replaces writeBlob+writeTree+writeCommit[+writeRef]).
-      writeMetaCommit: (eng, gitdir, { parents = [], files, message = "nomos custody meta", timeSecs = 0, ref = "" }) => JSON.parse(call(eng.ex, "write_meta_commit", {
-        repoArg: repoArgOfGitdir(gitdir),
-        parents,
-        files: files.map((f) => ({ path: f.path, blobB64: b64Bytes(f.bytes) })),
-        message,
-        timeSecs,
-        ref
-      }, eng.STDERR)).oid
+      writeMetaCommit: (eng, gitdir, { parents = [], files, message = "nomos custody meta", timeSecs = 0, ref = "" }) => custodyProtoCase(eng, {
+        case: "writeMetaCommit",
+        value: create(WriteMetaCommitRequestSchema, {
+          repo: repoArgOfGitdir(gitdir),
+          parents,
+          files: files.map((file) => ({ path: file.path, content: file.bytes })),
+          message,
+          timeSeconds: BigInt(timeSecs),
+          reference: ref || void 0
+        })
+      }, "writeMetaCommit").oid
     };
-    installPayload = (hash, usda, installedBy, dispositions) => ({ domainHash: hash, packageUsda: usda, installedBy, dependencies: [], finalizers: [], ...dispositions ? { dispositions } : {} });
-    stagePayload = (hash, usda, installedBy, supersedes) => ({
+    closureInstallPayload = (hash, installedBy, options = {}) => ({
       domainHash: hash,
-      packageUsda: usda,
       installedBy,
       dependencies: [],
-      ...supersedes ? { supersedes } : {},
+      ...options.supersedes ? { supersedes: options.supersedes } : {},
+      ...options.dispositions ? { dispositions: options.dispositions } : {},
       finalizers: []
     });
     routeTagHexOfHomeKey = async (homeKey) => (await sha256hex(`nomos-route:${homeKey}`)).slice(0, 12);
@@ -1604,21 +1970,35 @@ var init_engine = __esm({
     extremumMonotone = (read, prev, next) => next === null && prev === null || next !== null && (prev === null || (read.kind === "min" ? next <= prev : next >= prev));
     pushVia = (ledger, fn) => ledger && ledger.pushLane ? ledger.pushLane(fn) : fn();
     fullRef = (r) => r === "HEAD" || r.startsWith("refs/") ? r : `refs/heads/${r}`;
-    applyPackInto = (eng, ws, pack) => {
+    applyPackInto = (eng, ws, pack, head = null) => {
       if (!pack || !pack.length) return;
-      const r = JSON.parse(call(eng.ex, "apply_pack", { repoArg: repoArgOf(ws), packB64: b64Bytes(pack) }, eng.STDERR));
-      if (!r || r.ok !== true) throw new Error(`apply_pack: ${r && r.error}`);
+      custodyProtoCase(eng, {
+        case: "applyPack",
+        value: create(ApplyPackRequestSchema, {
+          repo: repoArgOf(ws),
+          source: { case: "pack", value: pack },
+          head: head || void 0
+        })
+      }, "applyPack");
     };
     custodyLsRefs = (ledger, prefix = null) => lsRefs(ledger.remote, ledger.headers || {}, { service: "git-upload-pack", prefix });
-    qById = (eng, ws, id, principal = "", keys = []) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "byId", aggregateId: id }), principal, keys, branch: BRANCH }, eng.STDERR));
-    query = (eng, ws, queryId, paramsJson, principal = "", keys = []) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ kind: "query", queryId, paramsJson }), principal, keys, branch: BRANCH }, eng.STDERR));
-    authorKeygen = (eng) => JSON.parse(call(eng.ex, "query", { queryBytes: b64Json({ op: "authorKeygen" }) }, eng.STDERR));
-    attestedRead = (eng, ws, { queryId, paramsJson, attestorSecret, nowMs, includeRosterProof }) => JSON.parse(call(eng.ex, "query", {
-      repoArg: repoArgOf(ws),
-      workspace: ws,
-      branch: BRANCH,
-      queryBytes: b64Json({ op: "attestedRead", queryId, paramsJson: paramsJson || "{}", attestorSecret, nowMs: nowMs ?? Date.now(), sourceWorkspace: ws, ...includeRosterProof ? { includeRosterProof: true } : {} })
-    }, eng.STDERR));
+    queryArguments = (paramsJson) => {
+      const value = JSON.parse(paramsJson || "{}");
+      if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("query arguments must be a JSON object");
+      }
+      return value;
+    };
+    queryAuthorityOptions = (principal, keys, authToken, nowUnix, authorSecret) => ({ principal, keys, authToken, nowUnix, authorSecret });
+    qById = (eng, ws, id, principal = "", keys = [], authToken = "", nowUnix = 0, authorSecret = "") => applicationQueryProto(eng, ws, {
+      case: "byId",
+      value: create(ByIdQuerySchema, { aggregateId: id, principal })
+    }, queryAuthorityOptions(principal, keys, authToken, nowUnix, authorSecret));
+    query = (eng, ws, queryId, paramsJson, principal = "", keys = [], authToken = "", nowUnix = 0, authorSecret = "") => applicationQueryProto(eng, ws, {
+      case: "rows",
+      value: create(RowsQuerySchema, { id: queryId, arguments: protoStruct(queryArguments(paramsJson)), principal })
+    }, queryAuthorityOptions(principal, keys, authToken, nowUnix, authorSecret));
+    authorKeygen = (eng) => namedQueryProto(eng, "root", QueryOperation.AUTHOR_KEYGEN);
     certSign = (eng, {
       child,
       founder,
@@ -1633,8 +2013,7 @@ var init_engine = __esm({
       authProviderIssuer,
       authProviderJwks,
       authProviderAudience
-    }) => JSON.parse(call(eng.ex, "query", { queryBytes: b64Json({
-      op: "certSign",
+    }) => namedQueryProto(eng, "root", QueryOperation.CERT_SIGN, {
       child,
       founder,
       verified,
@@ -1649,18 +2028,51 @@ var init_engine = __esm({
       ...authProviderIssuer !== void 0 ? { authProviderIssuer } : {},
       ...authProviderJwks !== void 0 ? { authProviderJwks } : {},
       ...authProviderAudience !== void 0 ? { authProviderAudience } : {}
-    }) }, eng.STDERR)).cert;
-    readPosture = (eng, ws, principal = "", authToken = "", nowUnix = 0) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "readPosture", authToken, nowUnix }), principal, branch: BRANCH }, eng.STDERR));
-    count = (eng, ws, countId, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "count", countId, groupKey }), principal, branch: BRANCH }, eng.STDERR));
-    sum = (eng, ws, sumId, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "sum", sumId, groupKey }), principal, branch: BRANCH }, eng.STDERR));
-    pendingConflicts = (eng, ws, principal = "", aggregateType = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "pendingConflicts", aggregateType }), principal, branch: BRANCH }, eng.STDERR));
-    pendingConflictSummary = (eng, ws, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "pendingConflictSummary" }), principal, branch: BRANCH }, eng.STDERR));
+    }).cert;
+    readPosture = (eng, ws, principal = "", authToken = "", nowUnix = 0, authorSecret = "") => namedQueryProto(
+      eng,
+      ws,
+      QueryOperation.READ_POSTURE,
+      {},
+      queryAuthorityOptions(principal, [], authToken, nowUnix, authorSecret)
+    );
+    count = (eng, ws, countId, groupKey, principal = "", authToken = "", nowUnix = 0, authorSecret = "") => applicationQueryProto(eng, ws, {
+      case: "count",
+      value: create(TallyQuerySchema, { id: countId, arguments: protoStruct({ groupKey: groupKey ?? null }), principal })
+    }, queryAuthorityOptions(principal, [], authToken, nowUnix, authorSecret));
+    sum = (eng, ws, sumId, groupKey, principal = "", authToken = "", nowUnix = 0, authorSecret = "") => applicationQueryProto(eng, ws, {
+      case: "sum",
+      value: create(TallyQuerySchema, { id: sumId, arguments: protoStruct({ groupKey: groupKey ?? null }), principal })
+    }, queryAuthorityOptions(principal, [], authToken, nowUnix, authorSecret));
+    pendingConflicts = (eng, ws, principal = "", aggregateType = "", authToken = "", nowUnix = 0, authorSecret = "") => namedQueryProto(
+      eng,
+      ws,
+      QueryOperation.PENDING_CONFLICTS,
+      { aggregateType },
+      queryAuthorityOptions(principal, [], authToken, nowUnix, authorSecret)
+    );
+    pendingConflictSummary = (eng, ws, principal = "", authToken = "", nowUnix = 0, authorSecret = "") => namedQueryProto(
+      eng,
+      ws,
+      QueryOperation.PENDING_CONFLICT_SUMMARY,
+      {},
+      queryAuthorityOptions(principal, [], authToken, nowUnix, authorSecret)
+    );
     spatialBboxParams = (bbox) => {
       const minX = bbox.minX ?? bbox.minLng, minY = bbox.minY ?? bbox.minLat, maxX = bbox.maxX ?? bbox.maxLng, maxY = bbox.maxY ?? bbox.maxLat;
       return { minX, minY, maxX, maxY, minLng: minX, minLat: minY, maxLng: maxX, maxLat: maxY };
     };
-    spatialWithin = (eng, ws, spatialId, bbox, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "spatial", spatialId, ...spatialBboxParams(bbox) }), principal, branch: BRANCH }, eng.STDERR));
-    extremum = (eng, ws, extremumId, kind, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "extremum", extremumId, kind, groupKey: groupKey ?? "" }), principal, branch: BRANCH }, eng.STDERR));
+    spatialWithin = (eng, ws, spatialId, bbox, principal = "", authToken = "", nowUnix = 0, authorSecret = "") => applicationQueryProto(eng, ws, {
+      case: "spatial",
+      value: create(SpatialQuerySchema, { id: spatialId, arguments: protoStruct(spatialBboxParams(bbox)), principal })
+    }, queryAuthorityOptions(principal, [], authToken, nowUnix, authorSecret));
+    extremum = (eng, ws, extremumId, kind, groupKey, principal = "", authToken = "", nowUnix = 0, authorSecret = "") => namedQueryProto(
+      eng,
+      ws,
+      QueryOperation.EXTREMUM,
+      { extremumId, kind, groupKey: groupKey ?? "" },
+      queryAuthorityOptions(principal, [], authToken, nowUnix, authorSecret)
+    );
     nomosActive = (eng, ws) => qById(eng, ws, `domain-installation:${eng.hashes.nomos}`).length > 0;
     refusedRefName = (offerId) => `refs/heads/refused/${String(offerId || "unknown").replace(/[^A-Za-z0-9._-]/g, "_")}`;
     GENESIS_WARRANT_ID = "genesis-warrant:self";
@@ -1686,12 +2098,12 @@ var init_types = __esm({
 var bootstrap_exports = {};
 __export(bootstrap_exports, {
   bootstrapPlatform: () => bootstrapPlatform,
-  completeDevAuthProviderPayload: () => completeDevAuthProviderPayload,
-  homeDomainOf: () => homeDomainOf,
+  devAuthProviderPayload: () => devAuthProviderPayload,
   isTestMint: () => isTestMint
 });
 import { readFileSync } from "node:fs";
 import { createHash } from "node:crypto";
+import path from "node:path";
 function isTestMint(eng) {
   try {
     setTestKRoot(eng, "");
@@ -1700,54 +2112,21 @@ function isTestMint(eng) {
     return !/poisoned|unknown|adapter-visible API/.test(errMsg(e));
   }
 }
-function completeDevAuthProviderPayload(deployBody, homeDomain, initial, nowMillis = Date.now(), operator = "user:dev-operator") {
-  const payload = { ...initial };
-  const iface = deployBody?.interface ?? {};
-  const legacy = iface.domains?.[homeDomain]?.directives?.setAuthProvider?.fields ?? iface[homeDomain]?.directives?.setAuthProvider?.fields ?? {};
-  const openapi = deployBody?.openapi;
-  const frameworkPaths = openapi?.["x-nomos-framework-routes"]?.paths ?? {};
-  const setAuthOperation = Object.values(frameworkPaths).map((pathItem) => pathItem.post).filter((operation) => operation?.["x-nomos"]?.directiveId === "setAuthProvider").sort((a, b) => Number(b?.["x-nomos"]?.domain === homeDomain) - Number(a?.["x-nomos"]?.domain === homeDomain))[0] ?? frameworkPaths["/setAuthProvider"]?.post;
-  const schema = setAuthOperation?.requestBody?.content?.["application/json"]?.schema;
-  const required = new Set(schema?.required ?? []);
-  const fields = { ...legacy };
-  for (const [name, spec] of Object.entries(schema?.properties ?? {})) {
-    fields[name] = {
-      kind: spec.type === "integer" ? "int" : spec.type,
-      optional: !required.has(name)
-    };
-  }
-  for (const [name, spec] of Object.entries(fields)) {
-    if (spec.optional === true || payload[name] !== void 0) continue;
-    if (spec.kind === "int" && /At$/.test(name)) payload[name] = nowMillis;
-    else if (spec.kind === "string" && /At$/.test(name)) payload[name] = new Date(nowMillis).toISOString();
-    else if (spec.kind === "string" && /By$/.test(name)) payload[name] = operator;
-    else if (spec.kind === "string" && /url$/i.test(name)) payload[name] = `${payload.issuer}/jwks.json`;
-    else if (spec.kind === "string") payload[name] = "dev";
-    else log2(`dev test IdP: required setAuthProvider field '${name}' (kind ${spec.kind}) is not synthesizable \u2014 the author below may refuse typed`);
-  }
-  return payload;
-}
-function homeDomainOf(opts) {
-  if (!opts) return null;
-  const deploy2 = homeDeployPathOf(opts);
-  if (!deploy2) return null;
-  try {
-    const body = JSON.parse(readFileSync(deploy2, "utf8"));
-    const frameworkPaths = body.openapi?.["x-nomos-framework-routes"]?.paths ?? {};
-    for (const pathItem of Object.values(frameworkPaths)) {
-      const route = pathItem.post?.["x-nomos"];
-      if (route?.directiveId === "birthHome" && typeof route.domain === "string") return route.domain;
-    }
-    const domains = body.summary && body.summary.domains || [];
-    const hit = domains.find((d) => Array.isArray(d.directives) && d.directives.includes("seedBirthAttestation"));
-    return hit ? hit.domain : null;
-  } catch {
-    return null;
-  }
+function devAuthProviderPayload(initial, nowMillis = Date.now(), operator = "user:dev-operator") {
+  return {
+    ...initial,
+    jwksUrl: `${initial.issuer}/jwks.json`,
+    principalClaim: "sub",
+    deviceBindingClaim: "nonce",
+    label: "dev",
+    setBy: operator,
+    setAt: nowMillis
+  };
 }
 async function bootstrapPlatform(dev, opts) {
   const { eng, custody, ledgerFor, serialize, origin } = dev;
   const platform = opts.platform || "co2-platform-local";
+  const lawInputs = lawInputsOf(opts);
   log2(`standing up platform '${platform}' on ${origin}`);
   await serialize(async () => {
     custody.create(`holon-${platform}`);
@@ -1758,25 +2137,54 @@ async function bootstrapPlatform(dev, opts) {
         platform,
         "bootstrap",
         "installDomain",
-        installPayload(eng.hashes.nomos, eng.nomosPkg, "dev-bootstrap"),
+        closureInstallPayload(eng.hashes.nomos, "dev-bootstrap"),
         "",
-        {}
+        { lawUsdz: eng.nomosLawUsdz }
       );
       if (r && r.ok === false) throw new Error(`platform genesis (framework install) REFUSED: ${String(r.error).slice(0, 300)}`);
     }
     log2(`platform '${platform}' genesis'd via the operator anchor lane (framework ${eng.hashes.nomos.slice(0, 12)})`);
   });
+  const stageZeroLaw = lawInputs[0];
+  if (stageZeroLaw) {
+    if (!stageZeroLaw.endsWith(".law.usdz")) {
+      throw new Error(`--law requires a canonical .law.usdz archive, received ${stageZeroLaw}`);
+    }
+    const lawUsdz = new Uint8Array(readFileSync(stageZeroLaw));
+    const info = stageLawClosure(eng, lawUsdz, path.basename(stageZeroLaw));
+    const domainHash = String(info.identity || "");
+    if (!/^[0-9a-f]{64}$/.test(domainHash)) {
+      throw new Error(`kernel did not derive a valid law identity for ${stageZeroLaw}`);
+    }
+    const installed = await serialize(async () => authorOn(
+      eng,
+      platform,
+      ledgerFor(platform),
+      "nomos",
+      "installDomain",
+      closureInstallPayload(domainHash, "dev-bootstrap"),
+      eng.hashes.nomos,
+      { lawUsdz }
+    ));
+    if (!installed.ok) {
+      throw new Error(`stage-zero application law install REFUSED: ${String(installed.error).slice(0, 400)}`);
+    }
+    (dev.deployedLawIdentities ??= []).push(domainHash);
+    log2(`application root law installed through stage zero: ${domainHash.slice(0, 12)}`);
+  }
   const testMint = isTestMint(eng);
   if (!testMint) {
     throw new Error(
       "dev bootstrap: `--platform` needs the test-mint kernel (set_test_k_root is poisoned in this one). The bundled cloud/dev-server/kernel-testmint.wasm is used automatically when reachable; otherwise build one (./git-holon/build_wasm.sh --release --features test-mint --bin wasm_git_holon) and set NOMOS_LOCAL_WASM."
     );
   } else {
-    const OPERATOR = opts.operator || "user:dev-operator";
     const kRoot = authorKeygen(eng);
     setTestKRoot(eng, kRoot.public);
     log2(`K_root ceremony: pinned LOCAL test K_root ${kRoot.public.slice(0, 16)}\u2026`);
     const sP = authorKeygen(eng);
+    const sOp = authorKeygen(eng);
+    const opKeyHash = createHash("sha256").update(Buffer.from(sOp.public, "base64")).digest("hex");
+    const foundingPrincipal = `key:${opKeyHash}`;
     const { generateKeyPairSync, sign: nodeSign } = await import("node:crypto");
     const { privateKey: idpPrivateKey, publicKey: idpPublicKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
     const idpJwk = idpPublicKey.export({ format: "jwk" });
@@ -1792,7 +2200,7 @@ async function bootstrapPlatform(dev, opts) {
     };
     const platformCert = certSign(eng, {
       child: platform,
-      founder: OPERATOR,
+      founder: foundingPrincipal,
       verified: true,
       parentKey: sP.public,
       // P_P — the onboarding signer the platform vouches for
@@ -1813,25 +2221,30 @@ async function bootstrapPlatform(dev, opts) {
     const lawHash = (lawKeys || {})[homeDomain] || "";
     if (!lawHash) {
       throw new Error(
-        `dev bootstrap: the deployed platform law declares no '${homeDomain}' framework domain (seedBirthAttestation/enrollSigner/seedGenesis absent) \u2014 an era-0 platform must be born WARRANTED. Deploy a law that composes the home framework (export the birth machinery from @githolon/dsl) via --deploy.`
+        `dev bootstrap: the deployed platform law declares no '${homeDomain}' framework domain (seedBirthAttestation/enrollSigner/seedGenesis absent) \u2014 an era-0 platform must be born WARRANTED. Deploy a law that composes the home framework (export the birth machinery from @githolon/dsl) via --law.`
       );
     } else {
       let devIdP;
       let pendingIdP;
       {
-        let apPayload = { issuer: idpIssuer, keys: idpJwks, audience: idpAudience, principalClaim: "sub", deviceBindingClaim: "nonce" };
-        try {
-          const homeDeploy = homeDeployPathOf(opts);
-          const deployBody = homeDeploy ? JSON.parse(readFileSync(homeDeploy, "utf8")) : null;
-          apPayload = completeDevAuthProviderPayload(deployBody, homeDomain, apPayload, Date.now(), OPERATOR);
-        } catch (e) {
-          log2(`dev test IdP: BYO-shape fill failed (${errMsg(e).slice(0, 200)}) \u2014 the canonical payload stands`);
-        }
+        const apPayload = devAuthProviderPayload(
+          { issuer: idpIssuer, keys: idpJwks, audience: idpAudience },
+          Date.now(),
+          foundingPrincipal
+        );
         pendingIdP = { ISS: idpIssuer, AUD: idpAudience, JWKS: idpJwks, mint: mintDevToken, apPayload };
       }
-      const sOp = authorKeygen(eng);
-      const opKeyHash = createHash("sha256").update(Buffer.from(sOp.public, "base64")).digest("hex");
-      const A = (directiveId, payload) => serialize(async () => authorOn(
+      const preWarrant = (directiveId, payload) => serialize(async () => authorOn(
+        eng,
+        platform,
+        ledgerFor(platform),
+        homeDomain,
+        directiveId,
+        payload,
+        lawHash,
+        { actor: foundingPrincipal }
+      ));
+      const signed = (directiveId, payload) => serialize(async () => authorOn(
         eng,
         platform,
         ledgerFor(platform),
@@ -1839,13 +2252,11 @@ async function bootstrapPlatform(dev, opts) {
         directiveId,
         payload,
         lawHash,
-        { actor: OPERATOR, principalVerified: true }
+        { actor: foundingPrincipal, authorSecret: sOp.secret }
       ));
-      const en = await A("enrollSigner", { keyHash: opKeyHash, grantedBy: OPERATOR, grantedAt: 1 });
-      if (!en.ok) throw new Error(`platform founding enrollSigner REFUSED: ${String(en.error).slice(0, 400)}`);
-      const seed = await A("seedBirthAttestation", {
+      const seed = await preWarrant("seedBirthAttestation", {
         child: platform,
-        founder: OPERATOR,
+        founder: foundingPrincipal,
         verified: "true",
         parentId: "root",
         parentKey: sP.public,
@@ -1853,13 +2264,21 @@ async function bootstrapPlatform(dev, opts) {
         certChain
       });
       if (!seed.ok) throw new Error(`platform BirthAttestation seed REFUSED: ${String(seed.error).slice(0, 400)}`);
-      const warrant = await A("seedGenesis", {
-        principal: OPERATOR,
+      const enrolled = await preWarrant("enrollSigner", {
+        principal: foundingPrincipal,
+        keyHash: opKeyHash,
+        grantedBy: "root",
+        grantedAt: Date.now()
+      });
+      if (!enrolled.ok) throw new Error(`platform founding signer enrollment REFUSED: ${String(enrolled.error).slice(0, 400)}`);
+      const warrant = await signed("seedGenesis", {
+        principal: foundingPrincipal,
         workspaceId: platform,
         bornAt: (/* @__PURE__ */ new Date()).toISOString()
       });
       if (!warrant.ok) throw new Error(`platform WARRANT (seedGenesis) REFUSED: ${String(warrant.error).slice(0, 400)}`);
       dev.operatorDevice = sOp;
+      dev.operatorPrincipal = foundingPrincipal;
       if (pendingIdP) {
         const ap = await serialize(async () => authorOn(
           eng,
@@ -1869,7 +2288,7 @@ async function bootstrapPlatform(dev, opts) {
           "setAuthProvider",
           pendingIdP.apPayload,
           lawHash,
-          { actor: OPERATOR, principalVerified: true, authorSecret: sOp.secret }
+          { actor: foundingPrincipal, authorSecret: sOp.secret }
         ));
         if (ap.ok) {
           devIdP = { issuer: pendingIdP.ISS, audience: pendingIdP.AUD, jwks: pendingIdP.JWKS, mint: pendingIdP.mint };
@@ -1879,7 +2298,7 @@ async function bootstrapPlatform(dev, opts) {
         }
       }
       dev.testIdP = devIdP;
-      log2(`root-attested platform: enrolled founding device ${opKeyHash.slice(0, 12)}\u2026, seeded BirthAttestation (platform_cert signed by K_root, P_P=${sP.public.slice(0, 12)}\u2026), WARRANTED (self-id ${platform})`);
+      log2(`root-attested platform: founding key ${opKeyHash.slice(0, 12)}\u2026 signed GenesisWarrant, seeded BirthAttestation (platform_cert signed by K_root, P_P=${sP.public.slice(0, 12)}\u2026), WARRANTED (self-id ${platform})`);
       log2("  a birthHome under this platform now assembles [home_cert, u_delegation(S_P), platform_cert(K_root)] \u2014 no unwarranted-cert.");
       log2("  ENROLL each user via the warranted lane: enrollFirstDevice (AuthProvider) or enrollDelegation (S_P-signed cert).");
       dev.testKRoot = kRoot;
@@ -1889,35 +2308,56 @@ async function bootstrapPlatform(dev, opts) {
       dev.homeDomain = homeDomain;
     }
   }
-  const deployPaths = deployPathsOf(opts);
-  if (deployPaths.length > 0) {
+  const rolloutLaws = lawInputs.slice(1);
+  if (rolloutLaws.length > 0) {
     const founderDevice = dev.operatorDevice;
     if (!founderDevice) throw new Error("platform law deploy needs the warranted founder device established by bootstrap");
-    for (const deployPath of deployPaths) {
-      const body = JSON.parse(readFileSync(deployPath, "utf8"));
-      const usda = body.packageUsda || body.usda;
-      if (!usda) throw new Error(`--deploy ${deployPath} has no packageUsda (nothing to install)`);
+    for (const inputPath of rolloutLaws) {
+      if (!inputPath.endsWith(".law.usdz")) {
+        throw new Error(`--law requires a canonical .law.usdz archive, received ${inputPath}`);
+      }
+      const lawUsdz = new Uint8Array(readFileSync(inputPath));
+      const info = stageLawClosure(eng, lawUsdz, path.basename(inputPath));
+      const domainHash = String(info.identity || "");
+      if (!/^[0-9a-f]{64}$/.test(domainHash)) {
+        throw new Error(`kernel did not derive a valid law identity for ${inputPath}`);
+      }
+      (dev.deployedLawIdentities ??= []).push(domainHash);
       const deployErr = await serialize(async () => {
         const ledger = ledgerFor(platform);
-        const domainHash = await sha256hex(usda);
         try {
-          const out = await deploy(eng, platform, ledger, usda, domainHash, body.dispositions || null, {
-            actor: "user:dev-operator",
-            authorSecret: founderDevice.secret
-          });
+          const current = currentLaw(eng, platform);
+          const tenantPredecessors = [...new Set(Object.values(current).filter(
+            (hash) => hash !== eng.hashes.bootstrap && hash !== eng.hashes.nomos
+          ))];
+          if (tenantPredecessors.length > 1) {
+            throw new Error(`bootstrap fixture serves ${tenantPredecessors.length} tenant models; refusing to guess a lifecycle predecessor`);
+          }
+          const supersedes = tenantPredecessors[0];
+          const directiveId = supersedes ? "stageDomain" : "installDomain";
+          const out = await authorOn(
+            eng,
+            platform,
+            ledger,
+            "nomos",
+            directiveId,
+            closureInstallPayload(domainHash, "dev-bootstrap", supersedes ? { supersedes } : {}),
+            eng.hashes.nomos,
+            { actor: dev.operatorPrincipal || "", authorSecret: founderDevice.secret, lawUsdz }
+          );
           if (out && out.ok === false) return String(out.error || "the law refused the platform package");
           log2(
-            out.staged === true ? `application payload staged for child birth: ${domainHash.slice(0, 12)} (head ${String(out.head).slice(0, 12)})` : `platform law deployed: ${domainHash.slice(0, 12)} (head ${String(out.head).slice(0, 12)})`
+            supersedes !== void 0 ? `application payload staged for child birth: ${domainHash.slice(0, 12)} (head ${String(out.head).slice(0, 12)})` : `platform law deployed: ${domainHash.slice(0, 12)} (head ${String(out.head).slice(0, 12)})`
           );
           return null;
         } catch (e) {
           return errStack(e);
         }
       });
-      if (deployErr) throw new Error(`platform law deploy REFUSED (${deployPath}): ${deployErr.slice(0, 400)}`);
+      if (deployErr) throw new Error(`platform law deploy REFUSED (${inputPath}): ${deployErr.slice(0, 400)}`);
     }
-  } else {
-    log2("no --deploy given; platform runs framework law only (deploy your platform package to enable births)");
+  } else if (lawInputs.length === 0) {
+    log2("no application root law was supplied; the framework-only platform cannot establish a private home authority");
   }
   if (opts.authProvider || opts.firebaseProject) {
     log2(`AuthProvider: ${opts.authProvider || `firebase:${opts.firebaseProject}`} \u2014 register it via the platform's setAuthProvider governance offer;`);
@@ -1927,7 +2367,7 @@ async function bootstrapPlatform(dev, opts) {
   log2(attested ? "bootstrap complete \u2014 platform law deployed + ROOT-ATTESTED (BirthAttestation certChain seeded; birthHome assembles a valid travelling cert)." : "bootstrap complete (platform law deployed; attested-birth legs gated as noted above \u2014 need the test-mint wasm).");
   return { platform, testMint, attested };
 }
-var log2, FRAMEWORK_HOME_DOMAIN, deployPathsOf, homeDeployPathOf;
+var log2, FRAMEWORK_HOME_DOMAIN, lawInputsOf;
 var init_bootstrap = __esm({
   "../cloud/dev-server/bootstrap.ts"() {
     "use strict";
@@ -1935,8 +2375,7 @@ var init_bootstrap = __esm({
     init_types();
     log2 = (m) => console.log(`[bootstrap] ${m}`);
     FRAMEWORK_HOME_DOMAIN = "__nomos_application_home_v1";
-    deployPathsOf = (opts) => opts.deploys && opts.deploys.length > 0 ? [...opts.deploys] : opts.deploy ? [opts.deploy] : [];
-    homeDeployPathOf = (opts) => deployPathsOf(opts).at(-1);
+    lawInputsOf = (opts) => opts.lawUsdzs && opts.lawUsdzs.length > 0 ? [...opts.lawUsdzs] : opts.lawUsdz ? [opts.lawUsdz] : [];
   }
 });
 
@@ -1947,7 +2386,7 @@ import http from "node:http";
 import { createHash as createHash2, randomBytes } from "node:crypto";
 import { readFileSync as readFileSync2, writeFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, mkdtempSync } from "node:fs";
 import { fileURLToPath } from "node:url";
-import path from "node:path";
+import path2 from "node:path";
 import os from "node:os";
 
 // ../adapter/pack_auth_contract.ts
@@ -1983,13 +2422,13 @@ function bulkReadForbidden(ws, kind, verdict) {
 }
 
 // ../cloud/cloudflare-shell/src/gateway-route-resolver.ts
-function aliasIdsFor(x, path2) {
+function aliasIdsFor(x, path3) {
   const ids = [];
   for (const key of ["directiveId", "queryId", "countId", "sumId", "extremumId", "spatialId"]) {
     const value = x && x[key];
     if (typeof value === "string" && value) ids.push(value);
   }
-  const leaf = String(path2 || "").replace(/^\/+/, "").split("/").filter(Boolean).at(-1);
+  const leaf = String(path3 || "").replace(/^\/+/, "").split("/").filter(Boolean).at(-1);
   if (leaf) ids.push(leaf);
   return new Set(ids);
 }
@@ -2011,11 +2450,11 @@ function resolveGatewayOperation(spec, opName, method) {
     const requestedAlias = String(opName).slice(slash + 1);
     const matches2 = [];
     for (const paths of routeTables) {
-      for (const [path2, methods] of Object.entries(paths)) {
+      for (const [path3, methods] of Object.entries(paths)) {
         const op = methods?.[normalizedMethod];
         const x = op?.["x-nomos"];
         if (!op || !x || x.domain !== requestedDomain) continue;
-        if (aliasIdsFor(x, path2).has(requestedAlias)) matches2.push({ op, path: path2 });
+        if (aliasIdsFor(x, path3).has(requestedAlias)) matches2.push({ op, path: path3 });
       }
     }
     if (matches2.length === 1) return { ...matches2[0], ambiguous: null };
@@ -2024,11 +2463,11 @@ function resolveGatewayOperation(spec, opName, method) {
   }
   const matches = [];
   for (const paths of routeTables) {
-    for (const [path2, methods] of Object.entries(paths)) {
+    for (const [path3, methods] of Object.entries(paths)) {
       const op = methods?.[normalizedMethod];
       const x = op?.["x-nomos"];
       if (!op || !x) continue;
-      if (aliasIdsFor(x, path2).has(opName)) matches.push({ op, path: path2 });
+      if (aliasIdsFor(x, path3).has(opName)) matches.push({ op, path: path3 });
     }
   }
   if (matches.length === 1) return { ...matches[0], ambiguous: null };
@@ -2040,8 +2479,8 @@ function resolveGatewayOperation(spec, opName, method) {
 
 // ../cloud/cloudflare-shell/src/kernel-registry.generated.ts
 var DEPLOYED_KERNELS = [
-  { prefix: "bc52f7eb", hash: "bc52f7eb630bc5a9a03b4c62b9b7ab58c4b6f25e687ecd51c72f9251763593fc", version: "kernel-bc52f7eb", note: "production (this candidate)", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"] },
-  { prefix: "17d8f91b", hash: "17d8f91b661dc8c3a6dea72d699f9f5759ab5e6b4e3e3e5e90afceb3a7034154", version: "kernel-17d8f91b", note: "test-mint (this candidate) \u2014 feature-equivalent to production", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"] }
+  { prefix: "efe619cb", hash: "efe619cbabba8f5d9d1a1309e7ab60feb489ddb4794ce5a6a95f35c7e7ae5928", version: "kernel-efe619cb", note: "production (this candidate)", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"] },
+  { prefix: "0a801b8f", hash: "0a801b8f40a17d3a1534d1452f0dc990f160299f6db55fe9c0c39d7aa726730b", version: "kernel-0a801b8f", note: "test-mint (this candidate) \u2014 feature-equivalent to production", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"] }
 ];
 
 // ../cloud/cloudflare-shell/src/staged-intents.ts
@@ -2081,7 +2520,7 @@ async function resolveStagedIntent(bucket, ref) {
   if (typeof ref?.size === "number" && ref.size !== bytes.length) return { ok: false, status: 422, error: `staged-intent-size-mismatch: the ref names ${ref.size} bytes but ${bytes.length} are staged` };
   const got = await sha256hexBytes(bytes);
   if (got !== sha256) return { ok: false, status: 422, error: `staged-intent-hash-mismatch: staged bytes hash to ${got}, not the offered ${sha256} \u2014 the signed offer's hash is the binding; refuse` };
-  return { ok: true, intentB64: b64OfBytes(bytes), sha256, size: bytes.length };
+  return { ok: true, changeB64: b64OfBytes(bytes), sha256, size: bytes.length };
 }
 
 // ../cloud/dev-server/custody.ts
@@ -2218,8 +2657,8 @@ function receivePackCommands(raw) {
 
 // ../cloud/dev-server/server.ts
 init_types();
-var DIR = path.dirname(fileURLToPath(import.meta.url));
-var REPO_ROOT = path.resolve(DIR, "../..");
+var DIR = path2.dirname(fileURLToPath(import.meta.url));
+var REPO_ROOT = path2.resolve(DIR, "../..");
 var RECOGNIZED_UNSUPPORTED = /* @__PURE__ */ new Set([
   "container-status",
   "recycle-container",
@@ -2233,7 +2672,6 @@ var RECOGNIZED_UNSUPPORTED = /* @__PURE__ */ new Set([
   "git-read-lease",
   "poke-admit",
   "clear-checkpoint",
-  "domain-package",
   "capabilities"
 ]);
 var UNSUPPORTED_WHY = {
@@ -2258,7 +2696,7 @@ globalThis.fetch = (input, init) => {
 };
 var unb64 = (s) => new Uint8Array(Buffer.from(s, "base64"));
 function configDir() {
-  return process.env.HOLON_CONFIG_DIR || path.join(os.homedir(), ".holon");
+  return process.env.HOLON_CONFIG_DIR || path2.join(os.homedir(), ".holon");
 }
 function explicitRuntimeDir() {
   if (process.env.NOMOS_CANDIDATE_RUNTIME) {
@@ -2270,7 +2708,7 @@ function explicitRuntimeDir() {
   return null;
 }
 function selectedRuntimeDir() {
-  return explicitRuntimeDir()?.dir ?? path.join(configDir(), "runtime");
+  return explicitRuntimeDir()?.dir ?? path2.join(configDir(), "runtime");
 }
 function firstExisting(...paths) {
   for (const p of paths) {
@@ -2279,7 +2717,11 @@ function firstExisting(...paths) {
   return null;
 }
 var TEST_MINT_MARKER = Buffer.from("set_test_k_root");
-var isTestMintBytes = (bytes) => bytes.includes(TEST_MINT_MARKER);
+var isTestMintBytes = (bytes) => {
+  if (bytes.includes(TEST_MINT_MARKER)) return true;
+  const sha = createHash2("sha256").update(bytes).digest("hex");
+  return DEPLOYED_KERNELS.some((entry) => entry.hash === sha && /test-mint/i.test(entry.note));
+};
 var HISTORICAL_KERNEL_CAPABILITY_REGISTRY = [
   {
     prefix: "f50d0cc5",
@@ -2315,11 +2757,11 @@ function capabilitiesForKernelHash(hash) {
   const hit = KERNEL_CAPABILITY_REGISTRY.find((e) => h.startsWith(e.prefix) || e.prefix.startsWith(h.slice(0, 8)));
   return hit ? { hash: h, version: hit.version, note: hit.note, features: hit.features, known: true } : { hash: h, version: null, note: "UNKNOWN kernel \u2014 not in the capability registry", features: [], known: false };
 }
-var DEFAULT_KERNEL_SOURCE = "https://nomos.captainapp.co.uk";
+var DEFAULT_KERNEL_SOURCE = "https://nomos.cafe";
 async function resolveTestMintWasm(kernelSource) {
   const explicitRuntime = explicitRuntimeDir();
   const runtimeCache = selectedRuntimeDir();
-  const cachePath = path.join(runtimeCache, "holon-testmint.wasm");
+  const cachePath = path2.join(runtimeCache, "holon-testmint.wasm");
   if (explicitRuntime) {
     if (existsSync2(cachePath)) {
       const bytes = readFileSync2(cachePath);
@@ -2338,7 +2780,7 @@ async function resolveTestMintWasm(kernelSource) {
     const bytes = readFileSync2(local);
     if (isTestMintBytes(bytes)) return { wasmPath: local, wasmBytes: bytes, kernelKind: "test-mint", kernelSource: "NOMOS_LOCAL_WASM" };
   }
-  const bundled = path.join(DIR, "kernel-testmint.wasm");
+  const bundled = path2.join(DIR, "kernel-testmint.wasm");
   if (!explicitRuntime && existsSync2(bundled)) {
     const bytes = readFileSync2(bundled);
     if (isTestMintBytes(bytes)) return { wasmPath: bundled, wasmBytes: bytes, kernelKind: "test-mint", kernelSource: "bundled" };
@@ -2372,17 +2814,17 @@ async function resolveTestMintWasm(kernelSource) {
 async function loadRuntime(opts = {}) {
   const explicitRuntime = explicitRuntimeDir();
   const runtimeCache = selectedRuntimeDir();
-  const repoDomainsDir = path.join(REPO_ROOT, "cloud/cloudflare-shell/container/domains");
-  const vendoredFrameworkDir = path.join(DIR, "framework");
+  const repoDomainsDir = path2.join(REPO_ROOT, "cloud/cloudflare-shell/domains");
+  const vendoredFrameworkDir = path2.join(DIR, "framework");
   let wasmPath, wasmBytes, kernelKind, kernelSource;
   if (opts.attested) {
     ({ wasmPath, wasmBytes, kernelKind, kernelSource } = await resolveTestMintWasm(opts.kernelSource));
   } else {
     wasmPath = firstExisting(
-      explicitRuntime ? path.join(runtimeCache, "holon.wasm") : null,
+      explicitRuntime ? path2.join(runtimeCache, "holon.wasm") : null,
       explicitRuntime ? null : process.env.NOMOS_LOCAL_WASM,
-      explicitRuntime ? null : path.join(REPO_ROOT, "cloud/cloudflare-shell/container/vendor/wasm_git_holon.wasm"),
-      explicitRuntime ? null : path.join(runtimeCache, "holon.wasm")
+      explicitRuntime ? null : path2.join(REPO_ROOT, "cloud/cloudflare-shell/container/vendor/wasm_git_holon.wasm"),
+      explicitRuntime ? null : path2.join(runtimeCache, "holon.wasm")
     );
     if (!wasmPath) {
       throw new Error(
@@ -2393,36 +2835,31 @@ async function loadRuntime(opts = {}) {
     kernelKind = isTestMintBytes(wasmBytes) ? "test-mint" : "production";
     kernelSource = wasmPath === process.env.NOMOS_LOCAL_WASM ? "NOMOS_LOCAL_WASM" : wasmPath.startsWith(runtimeCache) ? "cache" : "repo-vendor";
   }
-  const repoBootstrap = firstExisting(path.join(repoDomainsDir, "domain_bootstrap.package.usda"));
-  const repoNomos = firstExisting(path.join(repoDomainsDir, "domain_nomos.package.usda"));
-  let bootstrapPkg, nomosPkg;
-  const explicitPackages = explicitRuntime ? path.join(runtimeCache, "packages.json") : null;
-  if (explicitPackages && existsSync2(explicitPackages)) {
-    const pkgs = JSON.parse(readFileSync2(explicitPackages, "utf8"));
-    bootstrapPkg = pkgs.bootstrap;
-    nomosPkg = pkgs.nomos;
+  const repoBootstrap = firstExisting(path2.join(repoDomainsDir, "build/bootstrap/domain_bootstrap.law.usdz"));
+  const repoNomos = firstExisting(path2.join(repoDomainsDir, "build/nomos/nomos.law.usdz"));
+  const explicitBootstrap = explicitRuntime ? path2.join(runtimeCache, "bootstrap.law.usdz") : null;
+  const explicitNomos = explicitRuntime ? path2.join(runtimeCache, "nomos.law.usdz") : null;
+  let bootstrapLawUsdz;
+  let nomosLawUsdz;
+  if (explicitBootstrap && explicitNomos && existsSync2(explicitBootstrap) && existsSync2(explicitNomos)) {
+    bootstrapLawUsdz = new Uint8Array(readFileSync2(explicitBootstrap));
+    nomosLawUsdz = new Uint8Array(readFileSync2(explicitNomos));
   } else if (explicitRuntime) {
     throw new Error(
-      `explicit runtime is missing framework packages at ${explicitPackages}; hydrate that exact runtime bundle before starting the local Nomos cloud`
+      `explicit runtime is missing bootstrap.law.usdz or nomos.law.usdz in ${runtimeCache}; hydrate that exact runtime bundle before starting the local Nomos cloud`
     );
   } else if (repoBootstrap && repoNomos) {
-    bootstrapPkg = readFileSync2(repoBootstrap, "utf8");
-    nomosPkg = readFileSync2(repoNomos, "utf8");
-  } else if (existsSync2(path.join(vendoredFrameworkDir, "domain_bootstrap.package.usda"))) {
-    bootstrapPkg = readFileSync2(path.join(vendoredFrameworkDir, "domain_bootstrap.package.usda"), "utf8");
-    nomosPkg = readFileSync2(path.join(vendoredFrameworkDir, "domain_nomos.package.usda"), "utf8");
+    bootstrapLawUsdz = new Uint8Array(readFileSync2(repoBootstrap));
+    nomosLawUsdz = new Uint8Array(readFileSync2(repoNomos));
+  } else if (existsSync2(path2.join(vendoredFrameworkDir, "bootstrap.law.usdz")) && existsSync2(path2.join(vendoredFrameworkDir, "nomos.law.usdz"))) {
+    bootstrapLawUsdz = new Uint8Array(readFileSync2(path2.join(vendoredFrameworkDir, "bootstrap.law.usdz")));
+    nomosLawUsdz = new Uint8Array(readFileSync2(path2.join(vendoredFrameworkDir, "nomos.law.usdz")));
   } else {
-    const pkgsCache = path.join(runtimeCache, "packages.json");
-    if (!existsSync2(pkgsCache)) {
-      throw new Error(
-        "no framework packages found (domain_bootstrap/domain_nomos). Warm the runtime cache by running any `githolon` cloud command once, or run from the monorepo checkout."
-      );
-    }
-    const pkgs = JSON.parse(readFileSync2(pkgsCache, "utf8"));
-    bootstrapPkg = pkgs.bootstrap;
-    nomosPkg = pkgs.nomos;
+    throw new Error(
+      "no framework USDA closures found (bootstrap.law.usdz and nomos.law.usdz); compile the framework law before starting the dev cloud"
+    );
   }
-  return { wasmPath, wasmBytes, bootstrapPkg, nomosPkg, kernelKind, kernelSource };
+  return { wasmPath, wasmBytes, bootstrapLawUsdz, nomosLawUsdz, kernelKind, kernelSource };
 }
 async function startDevCloud(opts = {}) {
   let devSelf = null;
@@ -2430,10 +2867,10 @@ async function startDevCloud(opts = {}) {
   const host = opts.host || "127.0.0.1";
   const origin = `http://${host}:${port}`;
   const ephemeral = !!opts.ephemeral;
-  const dataDir = ephemeral ? mkdtempSync(path.join(os.tmpdir(), "nomos-dev-cloud-")) : path.resolve(opts.data || ".nomos/dev-cloud");
+  const dataDir = ephemeral ? mkdtempSync(path2.join(os.tmpdir(), "nomos-dev-cloud-")) : path2.resolve(opts.data || ".nomos/dev-cloud");
   mkdirSync2(dataDir, { recursive: true });
   const attested = !!(opts.attested || opts.bootstrap || opts.platform);
-  const { wasmPath, wasmBytes, bootstrapPkg, nomosPkg, kernelKind, kernelSource } = await loadRuntime({ attested, kernelSource: opts.kernelSource });
+  const { wasmPath, wasmBytes, bootstrapLawUsdz, nomosLawUsdz, kernelKind, kernelSource } = await loadRuntime({ attested, kernelSource: opts.kernelSource });
   console.log(`[dev-cloud]   kernel   : ${kernelKind} (from ${kernelSource})`);
   const wasmModule = await WebAssembly.compile(wasmBytes);
   const kernelSha = createHash2("sha256").update(wasmBytes).digest("hex");
@@ -2442,7 +2879,7 @@ async function startDevCloud(opts = {}) {
   let replica = 0n;
   for (let i = 0; i < 8; i++) replica = replica << 8n | BigInt(replicaDigest[i]);
   replica &= (1n << 63n) - 1n;
-  const eng = await createEngine({ wasmModule, bootstrapPkg, nomosPkg, replica, installedBy: "nomos-cloud-dev" });
+  const eng = await createEngine({ wasmModule, bootstrapLawUsdz, nomosLawUsdz, replica, installedBy: "nomos-cloud-dev" });
   const custody = new FilesystemGitCustody(dataDir, origin);
   const stagedBytes = /* @__PURE__ */ new Map();
   const stageBucket = {
@@ -2517,12 +2954,17 @@ async function startDevCloud(opts = {}) {
     req.on("data", (c) => chunks.push(c));
     req.on("end", () => resolve(Buffer.concat(chunks)));
   });
-  const principalOf = (req) => String(req.headers["x-nomos-principal"] || "").slice(0, 128);
+  const claimedPrincipalOf = (req) => String(req.headers["x-nomos-principal"] || "").slice(0, 128);
   const authTokenOf = (req) => String(req.headers["x-nomos-auth"] || "").replace(/^Bearer\s+/i, "");
   const postureGate = (res, ws, req, kind) => {
+    if (process.env.NOMOS_TEST_DIAGNOSTICS === "1") {
+      console.error(
+        `[dev-cloud] read-posture request ${ws} ${kind} auth-bytes=${authTokenOf(req).length} principal=${claimedPrincipalOf(req) || "(none)"}`
+      );
+    }
     let posture;
     try {
-      posture = readPosture(eng, ws, principalOf(req), authTokenOf(req), Math.floor(Date.now() / 1e3));
+      posture = readPosture(eng, ws, claimedPrincipalOf(req), authTokenOf(req), Math.floor(Date.now() / 1e3));
     } catch {
       return false;
     }
@@ -2541,25 +2983,41 @@ async function startDevCloud(opts = {}) {
       const x = o;
       return String(x && x["x-nomos"] && x["x-nomos"].domain ? x["x-nomos"].domain : "domain");
     };
-    const mergeInto = (frag) => {
+    const mergeInto = (frag, target = merged.paths) => {
       for (const [p, methods] of Object.entries(frag.paths || {})) {
         for (const [m, op] of Object.entries(methods)) {
-          const existing = merged.paths[p] && merged.paths[p][m];
+          const existing = target[p] && target[p][m];
           if (existing === void 0) {
-            (merged.paths[p] ||= {})[m] = op;
+            (target[p] ||= {})[m] = op;
           } else if (JSON.stringify(existing) !== JSON.stringify(op)) {
-            (merged.paths[`/${domOf(existing)}${p}`] ||= {})[m] = existing;
-            (merged.paths[`/${domOf(op)}${p}`] ||= {})[m] = op;
-            delete merged.paths[p][m];
-            if (Object.keys(merged.paths[p]).length === 0) delete merged.paths[p];
+            (target[`/${domOf(existing)}${p}`] ||= {})[m] = existing;
+            (target[`/${domOf(op)}${p}`] ||= {})[m] = op;
+            delete target[p][m];
+            if (Object.keys(target[p]).length === 0) delete target[p];
           }
         }
       }
     };
     try {
       const spec = describe(eng, ws);
+      if (process.env.NOMOS_TEST_DIAGNOSTICS === "1") {
+        console.error(
+          `[dev-cloud] describe ${ws} paths=${JSON.stringify(Object.keys(spec?.paths ?? {}))} described=${JSON.stringify(spec?.["x-nomos-described"] ?? [])}`
+        );
+      }
       if (spec && spec.paths) mergeInto(spec);
-    } catch {
+      const frameworkPaths = spec?.["x-nomos-framework-routes"]?.paths;
+      if (frameworkPaths && Object.keys(frameworkPaths).length > 0) {
+        const framework = merged["x-nomos-framework-routes"] ??= { paths: {} };
+        mergeInto({ paths: frameworkPaths }, framework.paths);
+      }
+      if (Object.keys(spec?.paths ?? {}).length === 0 && Object.keys(frameworkPaths ?? {}).length === 0) {
+        console.error(
+          `[dev-cloud] describe '${ws}' returned no law routes; installed=${JSON.stringify(installedLaw(eng, ws)).slice(0, 2e3)}`
+        );
+      }
+    } catch (error) {
+      console.error(`[dev-cloud] describe '${ws}' failed: ${error instanceof Error ? error.message : String(error)}`);
     }
     merged.paths["/openapi.json"] = {
       get: { operationId: "nomos__openapi", summary: "this workspace's live OpenAPI", responses: { "200": { description: "ok" } } }
@@ -2645,8 +3103,15 @@ async function startDevCloud(opts = {}) {
           vocabulary: KERNEL_CAPABILITY_REGISTRY.flatMap((e) => e.features).filter((f, i, a) => a.indexOf(f) === i).sort()
         });
       }
-      if (url.pathname === "/v1/runtime/packages") {
-        return sendJson(res, { bootstrap: bootstrapPkg, nomos: nomosPkg });
+      if (url.pathname === "/v1/runtime/bootstrap.law.usdz") {
+        res.writeHead(200, { "content-type": "model/vnd.usdz+zip", "cache-control": "public, max-age=31536000, immutable" });
+        res.end(bootstrapLawUsdz);
+        return;
+      }
+      if (url.pathname === "/v1/runtime/nomos.law.usdz") {
+        res.writeHead(200, { "content-type": "model/vnd.usdz+zip", "cache-control": "public, max-age=31536000, immutable" });
+        res.end(nomosLawUsdz);
+        return;
       }
       {
         const m = url.pathname.match(/^\/v2\/stage\/([0-9a-f]{64})$/);
@@ -2720,59 +3185,12 @@ async function startDevCloud(opts = {}) {
             });
           }
           if (req.method === "POST") {
-            const raw = await readBody(req);
-            return await serialize(async () => {
-              const ledger = ledgerFor(ws);
-              await mountWorkspace(eng, ws, ledger);
-              if (!nomosActive(eng, ws)) return sendJson(res, { ok: false, error: `workspace '${ws}' is not initialized \u2014 POST /v2/workspaces/${ws} first` }, 409);
-              let usda, dispositions = null;
-              const text = raw.toString("utf8");
-              if (text.trimStart().startsWith("#usda")) {
-                usda = text;
-              } else {
-                const body = JSON.parse(text || "{}");
-                usda = body.packageUsda || body.usda;
-                dispositions = body.dispositions || null;
-              }
-              if (!usda) return sendJson(res, { ok: false, error: "deploy body must be raw #usda or JSON with packageUsda" }, 400);
-              const domainHash = await sha256hex(usda);
-              const dryRun = url.searchParams.get("dryRun");
-              if (dryRun === "evolve") {
-                const verdict = evolveDryRun(eng, ws, usda, domainHash, dispositions);
-                return sendJson(res, { ok: true, dryRun: "evolve", verdict });
-              }
-              if (dryRun) return sendJson(res, { ok: true, dryRun: true, wouldInstall: domainHash, bytes: usda.length });
-              const actor = principalOf(req);
-              const authToken = authTokenOf(req);
-              try {
-                const out = await deploy(eng, ws, ledger, usda, domainHash, dispositions, { actor, ...authToken ? { authToken } : {} });
-                sendJson(res, {
-                  ok: true,
-                  ws,
-                  domainHash,
-                  head: out.head,
-                  installation: out.installation,
-                  staged: out.staged === true,
-                  ...out.supersedes ? { supersedes: out.supersedes } : {},
-                  ...out.alreadyInstalled ? { alreadyInstalled: true } : {}
-                }, 201);
-              } catch (e) {
-                const msg = errMsg(e);
-                const status = /deploy-did-not-advance|deploy-did-not-stage|deploy-predecessor|deploy-activated-candidate/.test(msg) ? 409 : 422;
-                sendJson(res, { ok: false, refused: true, error: msg.slice(0, 600) }, status);
-              }
-            });
+            return sendJson(res, {
+              ok: false,
+              error: "raw law deployment is retired: author installDomain/stageDomain locally as an ordinary signed offer, push its opaque candidate custody, then request admission"
+            }, 410);
           }
         }
-        if (sub[0] === "domains" && sub.length === 3 && sub[2] === "package.usda") {
-          return await serialize(async () => {
-            await mountWorkspace(eng, ws, ledgerFor(ws));
-            const pkg = domainPackage(eng, ws, sub[1]);
-            if (!pkg || !pkg.usda) return sendJson(res, { ok: false, error: "no such package" }, 404);
-            res.writeHead(200, { "content-type": "text/plain", ...CORS });
-            res.end(pkg.usda);
-          });
-        }
         if (sub[0] === "openapi.json" && req.method === "GET") {
           return await serialize(async () => {
             await mountWorkspace(eng, ws, ledgerFor(ws));
@@ -2803,7 +3221,7 @@ async function startDevCloud(opts = {}) {
             await mountWorkspace(eng, ws, ledger);
             const body = JSON.parse((await readBody(req)).toString("utf8") || "{}");
             const offers = Array.isArray(body.offers) ? body.offers.slice(0, 100) : [];
-            if (!offers.length) return sendJson(res, { ok: false, error: "body must be { offers:[{session, oid, intentB64}] }" }, 400);
+            if (!offers.length) return sendJson(res, { ok: false, error: "body must be { offers:[{session, oid, changeB64}] }" }, 400);
             const clientBase = /^[0-9a-f]{40}$/i.test(body.base || "") ? body.base : null;
             const out = await admitIntentOffers(eng, ws, ledger, offers, { ...clientBase ? { clientBase } : {} });
             if (Array.isArray(out.born) && out.born.length) await persistBorn(out.born);
@@ -2843,12 +3261,12 @@ async function startDevCloud(opts = {}) {
             const retried = [], failed = [];
             for (const e of refs) {
               if (only && e.offerId !== only && e.oid !== only) continue;
-              if (!e.intentB64) {
+              if (!e.changeB64) {
                 failed.push({ intentId: e.offerId, error: "refused ref carries no intent bytes" });
                 continue;
               }
               try {
-                const r2 = offerAdmit(eng, ws, unb64(e.intentB64), {});
+                const r2 = offerAdmit(eng, ws, unb64(e.changeB64), {});
                 if (r2.ok) retried.push({ intentId: e.offerId, head: r2.head });
                 else failed.push({ intentId: e.offerId, error: String(r2.error || "").slice(0, 300) });
               } catch (err) {
@@ -2856,7 +3274,7 @@ async function startDevCloud(opts = {}) {
               }
             }
             if (retried.length) await commitAndPush(eng, ws, ledger);
-            for (const r2 of retried) await deleteRefusedRef(eng, ws, ledger, r2.intentId);
+            for (const r2 of retried) await deleteRefusedRef(eng, ws, ledger, String(r2.intentId || "unknown"));
             sendJson(res, { ok: true, ws, retried, failed, remaining: (await listRefusedRefs(eng, ws)).length });
           });
         }
@@ -2867,7 +3285,7 @@ async function startDevCloud(opts = {}) {
             const body = req.method === "DELETE" ? {} : JSON.parse((await readBody(req)).toString("utf8") || "{}");
             const only = body.id || url.searchParams.get("id") || null;
             const targets = (await listRefusedRefs(eng, ws)).filter((e) => !only || e.offerId === only || e.oid === only);
-            for (const e of targets) await deleteRefusedRef(eng, ws, ledger, e.offerId || e.oid);
+            for (const e of targets) await deleteRefusedRef(eng, ws, ledger, String(e.offerId || e.oid || "unknown"));
             sendJson(res, { ok: true, ws, discarded: targets.length });
           });
         }
@@ -2907,7 +3325,7 @@ async function startDevCloud(opts = {}) {
           const id = sub[0] === "aggregates" ? decodeURIComponent(sub.slice(1).join("/")) : url.searchParams.get("id");
           return await serialize(async () => {
             await mountWorkspace(eng, ws, ledgerFor(ws));
-            const rows = qById(eng, ws, id, principalOf(req));
+            const rows = qById(eng, ws, id, claimedPrincipalOf(req), [], authTokenOf(req), Math.floor(Date.now() / 1e3));
             sendJson(res, { ok: true, ws, rows });
           });
         }
@@ -2935,14 +3353,14 @@ async function startDevCloud(opts = {}) {
               }
               return sendJson(res, { ok: false, error: "unknown operation", see: `GET /v2/workspaces/${ws}` }, 404);
             }
-            const principal = principalOf(req);
+            const principal = claimedPrincipalOf(req);
             const authToken = authTokenOf(req);
             if (x.kind === "offer" && method === "post") {
               const body = JSON.parse((await readBody(req)).toString("utf8") || "{}");
               if (body.intentRef && typeof body.intentRef === "object") {
                 const resolved2 = await resolveStagedIntent(stageBucket, body.intentRef);
                 if (!resolved2.ok) return sendJson(res, { ok: false, refused: true, error: resolved2.error }, resolved2.status);
-                body.intentBytes = resolved2.intentB64;
+                body.intentBytes = resolved2.changeB64;
               }
               try {
                 let out;
@@ -2950,19 +3368,15 @@ async function startDevCloud(opts = {}) {
                   out = offerAdmit(eng, ws, unb64(body.intentBytes), {});
                   if (out.ok) await commitAndPush(eng, ws, ledger);
                 } else {
-                  const { actor, authorSecret, attestations, ...payload } = body;
-                  const effectiveActor = actor || principal || "";
-                  const lawHash = (currentLaw(eng, ws) || {})[x.domain] || "";
-                  out = await authorOn(eng, ws, ledger, x.domain, x.directiveId, payload, lawHash, {
-                    actor: effectiveActor,
-                    ...effectiveActor ? { principalVerified: true } : {},
-                    ...authToken ? { authToken } : {},
-                    ...authorSecret ? { authorSecret } : {},
-                    ...Array.isArray(attestations) ? { attestations } : {}
-                  });
+                  return sendJson(res, {
+                    ok: false,
+                    refused: true,
+                    error: "offer requires sealed intentBytes or a content-addressed intentRef; the host cannot author raw payloads",
+                    code: "nomos.host_authority.raw_offer_refused"
+                  }, 400);
                 }
                 if (!out.ok) return sendJson(res, { ok: false, refused: true, error: String(out.error).slice(0, 600) }, 422);
-                const born = out.born ? await persistBorn(out.born) : void 0;
+                const born = Array.isArray(out.born) && out.born.length ? await persistBorn(packBornChildren(eng, out.born)) : void 0;
                 sendJson(res, { ok: true, ws, head: out.head, ...born ? { born } : {}, ...out.birthOutcomes ? { birthOutcomes: out.birthOutcomes } : {} });
               } catch (e) {
                 sendJson(res, { ok: false, refused: true, error: errMsg(e).slice(0, 600) }, 422);
@@ -3062,7 +3476,14 @@ Sec-WebSocket-Accept: ${accept}\r
 \r
 `
     );
-    socket.on("data", () => {
+    socket.on("data", (frame) => {
+      if (frame.length > 0 && (frame[0] & 15) === 8) {
+        try {
+          socket.write(Buffer.from([136, 0]));
+        } catch {
+        }
+        socket.end();
+      }
     });
     socket.on("error", () => {
     });
@@ -3111,11 +3532,11 @@ async function startGeneratedApplicationProofCloud(opts) {
     ephemeral: true,
     attested: true,
     platform: opts.platform,
-    deploy: opts.deploy
+    lawUsdz: opts.lawUsdz
   });
   try {
     const { bootstrapPlatform: bootstrapPlatform2 } = await Promise.resolve().then(() => (init_bootstrap(), bootstrap_exports));
-    await bootstrapPlatform2(dev, { platform: opts.platform, deploy: opts.deploy, attested: true });
+    await bootstrapPlatform2(dev, { platform: opts.platform, lawUsdz: opts.lawUsdz, attested: true });
     dev.platformReady = true;
     if (dev.operatorDevice === void 0) {
       throw new Error("the local proof cloud did not establish its private founding device");
@@ -3144,10 +3565,10 @@ function parseArgs(argv) {
     else if (a === "--data") o.data = argv[++i];
     else if (a === "--firebase-project") o.firebaseProject = argv[++i];
     else if (a === "--platform") o.platform = argv[++i];
-    else if (a === "--deploy") {
-      const deploy2 = argv[++i];
-      o.deploy = deploy2;
-      (o.deploys ??= []).push(deploy2);
+    else if (a === "--law") {
+      const lawUsdz = argv[++i];
+      o.lawUsdz = lawUsdz;
+      (o.lawUsdzs ??= []).push(lawUsdz);
     } else if (a === "--auth-provider") o.authProvider = argv[++i];
     else if (a === "--bootstrap") o.bootstrap = true;
     else if (a === "--attested") o.attested = true;