githolon 0.110.1 → 0.111.1

package/dist/full-cli.mjs

@@ -9279,7 +9279,7 @@ var init_recovery_desk_pb = __esm({
 // ../adapter/proto/nomos/runtime/v2/observability_desk_pb.js
 import { enumDesc as enumDesc15, fileDesc as fileDesc22, messageDesc as messageDesc22, tsEnum as tsEnum15 } from "@bufbuild/protobuf/codegenv2";
 import { file_google_protobuf_any as file_google_protobuf_any2 } from "@bufbuild/protobuf/wkt";
-var file_nomos_runtime_v2_observability_desk, RuntimeFailureSchema, RuntimeUnavailableSchema, RuntimeRefusalSchema, DiagnosticAttributeSchema, RuntimeEventSchema, FollowsSummarySchema, FollowObservationSchema, CredentialRefreshRequestedSchema, RuntimeReadySchema, WatchChangedSchema, SyncCompletedSchema, LinkChangedSchema, RuntimeSpanSchema, RuntimeFailureKindSchema, RuntimeFailureKind, RuntimeUnavailableReasonSchema, RuntimeUnavailableReason, RuntimeRefusalReasonSchema, RuntimeRefusalReason, FollowObservationPhaseSchema, FollowObservationPhase, LinkStatusSchema, LinkStatus;
+var file_nomos_runtime_v2_observability_desk, RuntimeFailureSchema, RuntimeUnavailableSchema, RuntimeRefusalSchema, DiagnosticAttributeSchema, RuntimeEventSchema, FollowsSummarySchema, FollowObservationSchema, CredentialRefreshRequestedSchema, RuntimeReadySchema, WatchChangedSchema, SyncCompletedSchema, LinkChangedSchema, RuntimeSpanSchema, WritePreparationSchema, RuntimeFailureKindSchema, RuntimeFailureKind, RuntimeUnavailableReasonSchema, RuntimeUnavailableReason, RuntimeRefusalReasonSchema, RuntimeRefusalReason, FollowObservationPhaseSchema, FollowObservationPhase, LinkStatusSchema, LinkStatus;
 var init_observability_desk_pb = __esm({
   "../adapter/proto/nomos/runtime/v2/observability_desk_pb.js"() {
     "use strict";
@@ -9291,7 +9291,7 @@ var init_observability_desk_pb = __esm({
     init_model_adoption_desk_pb();
     init_receiving_group_desk_pb();
     init_recovery_desk_pb();
-    file_nomos_runtime_v2_observability_desk = /* @__PURE__ */ fileDesc22("Cilub21vcy9ydW50aW1lL3YyL29ic2VydmFiaWxpdHlfZGVzay5wcm90bxIQbm9tb3MucnVudGltZS52MiJCCgxUcmFjZUNvbnRleHQSEAoIdHJhY2VfaWQYASABKAwSDwoHc3Bhbl9pZBgCIAEoDBIPCgdzYW1wbGVkGAMgASgIIp0CCg5SdW50aW1lRmFpbHVyZRIMCgRjb2RlGAEgASgJEg8KB21lc3NhZ2UYAiABKAkSEQoJY29tcG9uZW50GAMgASgJEhYKCXdvcmtzcGFjZRgEIAEoCUgAiAEBEhMKBmRvbWFpbhgFIAEoCUgBiAEBEhYKCWRpcmVjdGl2ZRgGIAEoCUgCiAEBEjkKCmF0dHJpYnV0ZXMYByADKAsyJS5ub21vcy5ydW50aW1lLnYyLkRpYWdub3N0aWNBdHRyaWJ1dGUSMgoEa2luZBgIIAEoDjIkLm5vbW9zLnJ1bnRpbWUudjIuUnVudGltZUZhaWx1cmVLaW5kQgwKCl93b3Jrc3BhY2VCCQoHX2RvbWFpbkIMCgpfZGlyZWN0aXZlIr4BChJSdW50aW1lVW5hdmFpbGFibGUSOgoGcmVhc29uGAEgASgOMioubm9tb3MucnVudGltZS52Mi5SdW50aW1lVW5hdmFpbGFibGVSZWFzb24SEQoJd29ya3NwYWNlGAIgASgJEhEKCXJldHJ5YWJsZRgDIAEoCBIfChJyZXRyeV9hZnRlcl9taWxsaXMYBCABKA1IAIgBARIOCgZkZXRhaWwYBSABKAlCFQoTX3JldHJ5X2FmdGVyX21pbGxpcyJ+Cg5SdW50aW1lUmVmdXNhbBI2CgZyZWFzb24YASABKA4yJi5ub21vcy5ydW50aW1lLnYyLlJ1bnRpbWVSZWZ1c2FsUmVhc29uEhEKCXdvcmtzcGFjZRgCIAEoCRIRCglyZXRyeWFibGUYAyABKAgSDgoGZGV0YWlsGAQgASgJIqUBChNEaWFnbm9zdGljQXR0cmlidXRlEgwKBG5hbWUYASABKAkSFgoMc3RyaW5nX3ZhbHVlGAIgASgJSAASFwoNaW50ZWdlcl92YWx1ZRgDIAEoEkgAEhYKDGRvdWJsZV92YWx1ZRgEIAEoAUgAEhcKDWJvb2xlYW5fdmFsdWUYBSABKAhIABIVCgtieXRlc192YWx1ZRgGIAEoDEgAQgcKBXZhbHVlIuMKCgxSdW50aW1lRXZlbnQSEAoIc2VxdWVuY2UYASABKAQSFAoHc2Vzc2lvbhgCIAEoCUgBiAEBEi8KBXJlYWR5GAogASgLMh4ubm9tb3MucnVudGltZS52Mi5SdW50aW1lUmVhZHlIABI3Cg13YXRjaF9jaGFuZ2VkGAsgASgLMh4ubm9tb3MucnVudGltZS52Mi5XYXRjaENoYW5nZWRIABI5Cg5zeW5jX2NvbXBsZXRlZBgMIAEoCzIfLm5vbW9zLnJ1bnRpbWUudjIuU3luY0NvbXBsZXRlZEgAEjUKDGxpbmtfY2hhbmdlZBgNIAEoCzIdLm5vbW9zLnJ1bnRpbWUudjIuTGlua0NoYW5nZWRIABI5Cg5zaWduYWxfY2hhbmdlZBgOIAEoCzIfLm5vbW9zLnJ1bnRpbWUudjIuU2lnbmFsQ2hhbmdlZEgAEjsKD2N1c3RvZHlfY2hhbmdlZBgPIAEoCzIgLm5vbW9zLnJ1bnRpbWUudjIuQ3VzdG9keUNoYW5nZWRIABJCChNsb2NhbF93b3JrX3JlamVjdGVkGBAgASgLMiMubm9tb3MucnVudGltZS52Mi5Mb2NhbFdvcmtSZWplY3RlZEgAEjMKC2xhd19jaGFuZ2VkGBEgASgLMhwubm9tb3MucnVudGltZS52Mi5MYXdDaGFuZ2VkSAASQwoPa2VybmVsX3Byb2dyZXNzGBIgASgLMigubm9tb3MucnVudGltZS52Mi5LZXJuZWxQcm9ncmVzc09ic2VydmVkSAASLQoEc3BhbhgTIAEoCzIdLm5vbW9zLnJ1bnRpbWUudjIuUnVudGltZVNwYW5IABI/ChF0cmFuc2Zlcl9wcm9ncmVzcxgUIAEoCzIiLm5vbW9zLnJ1bnRpbWUudjIuVHJhbnNmZXJQcm9ncmVzc0gAEkkKFG1haW50ZW5hbmNlX3Byb2dyZXNzGBUgASgLMikubm9tb3MucnVudGltZS52Mi5SZWFkTWFpbnRlbmFuY2VQcm9ncmVzc0gAEjsKDXNvY2tldF9lZmZlY3QYFiABKAsyIi5ub21vcy5ydW50aW1lLnYyLlBlZXJTb2NrZXRFZmZlY3RIABJUChxjcmVkZW50aWFsX3JlZnJlc2hfcmVxdWVzdGVkGBcgASgLMiwubm9tb3MucnVudGltZS52Mi5DcmVkZW50aWFsUmVmcmVzaFJlcXVlc3RlZEgAElIKG3JlY2VpdmluZ19ncm91cF9jb252ZXJnZW5jZRgYIAEoCzIrLm5vbW9zLnJ1bnRpbWUudjIuUmVjZWl2aW5nR3JvdXBDb252ZXJnZW5jZUgAEkoKF21vZGVsX2Fkb3B0aW9uX3Byb2dyZXNzGBkgASgLMicubm9tb3MucnVudGltZS52Mi5Nb2RlbEFkb3B0aW9uUHJvZ3Jlc3NIABI7Cg9mb2xsb3dzX3N1bW1hcnkYGiABKAsyIC5ub21vcy5ydW50aW1lLnYyLkZvbGxvd3NTdW1tYXJ5SAASRAoUbG9jYWxfY29weV9wcmVzZXJ2ZWQYGyABKAsyJC5ub21vcy5ydW50aW1lLnYyLlByZXNlcnZlZExvY2FsQ29weUgAEk4KGWZvcmVpZ25fcGxhY2VtZW50X2lnbm9yZWQYHCABKAsyKS5ub21vcy5ydW50aW1lLnYyLkZvcmVpZ25QbGFjZW1lbnRJZ25vcmVkSAASQwoTYmluZGluZ19xdWFyYW50aW5lZBgdIAEoCzIkLm5vbW9zLnJ1bnRpbWUudjIuUXVhcmFudGluZWRCaW5kaW5nSABCBwoFZXZlbnRCCgoIX3Nlc3Npb24ivAEKDkZvbGxvd3NTdW1tYXJ5EhAKCGZvbGxvd2VkGAEgASgNEg8KB3NldHRsZWQYAiABKA0SDAoEbGl2ZRgDIAEoDRI3Cgp3b3Jrc3BhY2VzGAQgAygLMiMubm9tb3MucnVudGltZS52Mi5Gb2xsb3dPYnNlcnZhdGlvbhIkChdvYnNlcnZlZF9hdF91bml4X21pbGxpcxgFIAEoBEgAiAEBQhoKGF9vYnNlcnZlZF9hdF91bml4X21pbGxpcyLRAgoRRm9sbG93T2JzZXJ2YXRpb24SEQoJd29ya3NwYWNlGAEgASgJEjcKBXBoYXNlGAIgASgOMigubm9tb3MucnVudGltZS52Mi5Gb2xsb3dPYnNlcnZhdGlvblBoYXNlEgwKBGxpdmUYAyABKAgSEwoGZGV0YWlsGAQgASgJSACIAQESIQoUcmV0cnlfYXRfdW5peF9taWxsaXMYBSABKARIAYgBARIfChJkdWVfYXRfdW5peF9taWxsaXMYBiABKARIAogBARIUCgdhdHRlbXB0GAcgASgNSAOIAQESGgoNYWN0aXZlX2VmZmVjdBgIIAEoCUgEiAEBQgkKB19kZXRhaWxCFwoVX3JldHJ5X2F0X3VuaXhfbWlsbGlzQhUKE19kdWVfYXRfdW5peF9taWxsaXNCCgoIX2F0dGVtcHRCEAoOX2FjdGl2ZV9lZmZlY3QiVgoaQ3JlZGVudGlhbFJlZnJlc2hSZXF1ZXN0ZWQSOAoHcGVuZGluZxgBIAEoCzInLm5vbW9zLnJ1bnRpbWUudjIuQ29ycmVzcG9uZGVuY2VQZW5kaW5nIj4KDFJ1bnRpbWVSZWFkeRIXCg9ydW50aW1lX3ZlcnNpb24YASABKAkSFQoNa2VybmVsX3NoYTI1NhgCIAEoDCL8AQoMV2F0Y2hDaGFuZ2VkEhcKD3N1YnNjcmlwdGlvbl9pZBgBIAEoCRITCgtyZXN1bHRfdXNkYRgCIAEoDBI2CgdmYWlsdXJlGAMgASgLMiAubm9tb3MucnVudGltZS52Mi5SdW50aW1lRmFpbHVyZUgAiAEBEjUKEmFwcGxpY2F0aW9uX3Jlc3VsdBgEIAEoCzIULmdvb2dsZS5wcm90b2J1Zi5BbnlIAYgBARIaCg1pbnRlZ2VyX3ZhbHVlGAUgASgDSAKIAQFCCgoIX2ZhaWx1cmVCFQoTX2FwcGxpY2F0aW9uX3Jlc3VsdEIQCg5faW50ZWdlcl92YWx1ZSKcAQoNU3luY0NvbXBsZXRlZBIOCgZyZWFzb24YASABKAkSNwoGcmVzdWx0GAIgASgLMicubm9tb3MucnVudGltZS52Mi5TeW5jV29ya3NwYWNlUmVzcG9uc2USNgoHZmFpbHVyZRgDIAEoCzIgLm5vbW9zLnJ1bnRpbWUudjIuUnVudGltZUZhaWx1cmVIAIgBAUIKCghfZmFpbHVyZSI7CgtMaW5rQ2hhbmdlZBIsCgZzdGF0dXMYASABKA4yHC5ub21vcy5ydW50aW1lLnYyLkxpbmtTdGF0dXMiOAoNU2lnbmFsQ2hhbmdlZBIOCgZkb21haW4YASABKAkSFwoPcHJvamVjdGlvbl91c2RhGAIgASgMIlAKCkxhd0NoYW5nZWQSDgoGZG9tYWluGAEgASgJEhYKDnBhY2thZ2Vfc2hhMjU2GAIgASgJEhoKEmNvbXBhdGliaWxpdHlfdXNkYRgDIAEoDCLdAQoLUnVudGltZVNwYW4SEAoIdHJhY2VfaWQYASABKAwSDwoHc3Bhbl9pZBgCIAEoDBIbCg5wYXJlbnRfc3Bhbl9pZBgDIAEoDEgAiAEBEgwKBG5hbWUYBCABKAkSGgoSc3RhcnRlZF91bml4X25hbm9zGAUgASgEEhYKDmR1cmF0aW9uX25hbm9zGAYgASgEEjkKCmF0dHJpYnV0ZXMYByADKAsyJS5ub21vcy5ydW50aW1lLnYyLkRpYWdub3N0aWNBdHRyaWJ1dGVCEQoPX3BhcmVudF9zcGFuX2lkIuoBChZLZXJuZWxQcm9ncmVzc09ic2VydmVkEjkKCHNuYXBzaG90GAEgASgLMicubm9tb3Mua2VybmVsLnYxLktlcm5lbFByb2dyZXNzU25hcHNob3QSJAocaG9zdF9vYnNlcnZlZF9lbGFwc2VkX21pY3JvcxgCIAEoBBIqCiJob3N0X29ic2VydmVkX3BoYXNlX2VsYXBzZWRfbWljcm9zGAMgASgEEh4KFnByb2Nlc3NfcmVzaWRlbnRfYnl0ZXMYBCABKAQSIwobcHJvY2Vzc19wZWFrX3Jlc2lkZW50X2J5dGVzGAUgASgEIoIBChBUcmFuc2ZlclByb2dyZXNzEhYKDnJlY2VpdmVkX2J5dGVzGAEgASgEEhgKC3RvdGFsX2J5dGVzGAIgASgESACIAQESLAoEa2luZBgDIAEoDjIeLm5vbW9zLnJ1bnRpbWUudjIuVHJhbnNmZXJLaW5kQg4KDF90b3RhbF9ieXRlcyrKAQoSUnVudGltZUZhaWx1cmVLaW5kEiQKIFJVTlRJTUVfRkFJTFVSRV9LSU5EX1VOU1BFQ0lGSUVEEAASIQodUlVOVElNRV9GQUlMVVJFX0tJTkRfSU5URVJOQUwQARIhCh1SVU5USU1FX0ZBSUxVUkVfS0lORF9QUk9UT0NPTBACEiIKHlJVTlRJTUVfRkFJTFVSRV9LSU5EX0lOVEVHUklUWRADEiQKIFJVTlRJTUVfRkFJTFVSRV9LSU5EX1VOU1VQUE9SVEVEEAQqpwMKGFJ1bnRpbWVVbmF2YWlsYWJsZVJlYXNvbhIqCiZSVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9VTlNQRUNJRklFRBAAEjIKLlJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX1JFTU9URV9PTkxZX09GRkxJTkUQARIxCi1SVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9SRU1PVEVfVU5SRUFDSEFCTEUQAhItCilSVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9SRU1PVEVfVElNRU9VVBADEjYKMlJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX0xPQ0FMX1JFUExJQ0FfTk9UX1JFQURZEAQSNQoxUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fQ1JFREVOVElBTF9VTkFWQUlMQUJMRRAFEjAKLFJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX1dPUktTUEFDRV9PUEVOSU5HEAYSKAokUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fUEVFUl9CVVNZEAcq8AEKFFJ1bnRpbWVSZWZ1c2FsUmVhc29uEiYKIlJVTlRJTUVfUkVGVVNBTF9SRUFTT05fVU5TUEVDSUZJRUQQABItCilSVU5USU1FX1JFRlVTQUxfUkVBU09OX0lOVkFMSURfQ1JFREVOVElBTBABEigKJFJVTlRJTUVfUkVGVVNBTF9SRUFTT05fQUNDRVNTX0RFTklFRBACEisKJ1JVTlRJTUVfUkVGVVNBTF9SRUFTT05fUExBQ0VNRU5UX1BPTElDWRADEioKJlJVTlRJTUVfUkVGVVNBTF9SRUFTT05fU0VTU0lPTl9VTkJPVU5EEAQqlQQKFkZvbGxvd09ic2VydmF0aW9uUGhhc2USKAokRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX1VOU1BFQ0lGSUVEEAASJAogRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX0RFU0lSRUQQARIgChxGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfRFVFEAISJAogRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX1JVTk5JTkcQAxIkCiBGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfU0VUVExFRBAEEjAKLEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9BV0FJVElOR19ERVBFTkRFTkNZEAUSJAogRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX09GRkxJTkUQBhIvCitGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfSU5WQUxJRF9DUkVERU5USUFMEAcSJAogRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX0JBQ0tPRkYQCBIsCihGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfUkVCT1JOX1JFTU9URUxZEAkSLAooRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX1JFUExBQ0lOR19MT0NBTBAKEjIKLkZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9MT0NBTF9DT1BZX1VOUkVBREFCTEUQCypXCgpMaW5rU3RhdHVzEhsKF0xJTktfU1RBVFVTX1VOU1BFQ0lGSUVEEAASFAoQTElOS19TVEFUVVNfT1BFThABEhYKEkxJTktfU1RBVFVTX0NMT1NFRBACKnYKDFRyYW5zZmVyS2luZBIdChlUUkFOU0ZFUl9LSU5EX1VOU1BFQ0lGSUVEEAASFwoTVFJBTlNGRVJfS0lORF9ERUxUQRABEhYKElRSQU5TRkVSX0tJTkRfRlVMTBACEhYKElRSQU5TRkVSX0tJTkRfUFVTSBADYgZwcm90bzM", [file_google_protobuf_any2, file_nomos_kernel_v1_progress, file_nomos_runtime_v2_correspondence_desk, file_nomos_runtime_v2_custody_desk, file_nomos_runtime_v2_placement_desk, file_nomos_runtime_v2_maintenance_desk, file_nomos_runtime_v2_model_adoption_desk, file_nomos_runtime_v2_receiving_group_desk, file_nomos_runtime_v2_recovery_desk]);
+    file_nomos_runtime_v2_observability_desk = /* @__PURE__ */ fileDesc22("Cilub21vcy9ydW50aW1lL3YyL29ic2VydmFiaWxpdHlfZGVzay5wcm90bxIQbm9tb3MucnVudGltZS52MiJCCgxUcmFjZUNvbnRleHQSEAoIdHJhY2VfaWQYASABKAwSDwoHc3Bhbl9pZBgCIAEoDBIPCgdzYW1wbGVkGAMgASgIIp0CCg5SdW50aW1lRmFpbHVyZRIMCgRjb2RlGAEgASgJEg8KB21lc3NhZ2UYAiABKAkSEQoJY29tcG9uZW50GAMgASgJEhYKCXdvcmtzcGFjZRgEIAEoCUgAiAEBEhMKBmRvbWFpbhgFIAEoCUgBiAEBEhYKCWRpcmVjdGl2ZRgGIAEoCUgCiAEBEjkKCmF0dHJpYnV0ZXMYByADKAsyJS5ub21vcy5ydW50aW1lLnYyLkRpYWdub3N0aWNBdHRyaWJ1dGUSMgoEa2luZBgIIAEoDjIkLm5vbW9zLnJ1bnRpbWUudjIuUnVudGltZUZhaWx1cmVLaW5kQgwKCl93b3Jrc3BhY2VCCQoHX2RvbWFpbkIMCgpfZGlyZWN0aXZlIr4BChJSdW50aW1lVW5hdmFpbGFibGUSOgoGcmVhc29uGAEgASgOMioubm9tb3MucnVudGltZS52Mi5SdW50aW1lVW5hdmFpbGFibGVSZWFzb24SEQoJd29ya3NwYWNlGAIgASgJEhEKCXJldHJ5YWJsZRgDIAEoCBIfChJyZXRyeV9hZnRlcl9taWxsaXMYBCABKA1IAIgBARIOCgZkZXRhaWwYBSABKAlCFQoTX3JldHJ5X2FmdGVyX21pbGxpcyJ+Cg5SdW50aW1lUmVmdXNhbBI2CgZyZWFzb24YASABKA4yJi5ub21vcy5ydW50aW1lLnYyLlJ1bnRpbWVSZWZ1c2FsUmVhc29uEhEKCXdvcmtzcGFjZRgCIAEoCRIRCglyZXRyeWFibGUYAyABKAgSDgoGZGV0YWlsGAQgASgJIqUBChNEaWFnbm9zdGljQXR0cmlidXRlEgwKBG5hbWUYASABKAkSFgoMc3RyaW5nX3ZhbHVlGAIgASgJSAASFwoNaW50ZWdlcl92YWx1ZRgDIAEoEkgAEhYKDGRvdWJsZV92YWx1ZRgEIAEoAUgAEhcKDWJvb2xlYW5fdmFsdWUYBSABKAhIABIVCgtieXRlc192YWx1ZRgGIAEoDEgAQgcKBXZhbHVlIqQLCgxSdW50aW1lRXZlbnQSEAoIc2VxdWVuY2UYASABKAQSFAoHc2Vzc2lvbhgCIAEoCUgBiAEBEi8KBXJlYWR5GAogASgLMh4ubm9tb3MucnVudGltZS52Mi5SdW50aW1lUmVhZHlIABI3Cg13YXRjaF9jaGFuZ2VkGAsgASgLMh4ubm9tb3MucnVudGltZS52Mi5XYXRjaENoYW5nZWRIABI5Cg5zeW5jX2NvbXBsZXRlZBgMIAEoCzIfLm5vbW9zLnJ1bnRpbWUudjIuU3luY0NvbXBsZXRlZEgAEjUKDGxpbmtfY2hhbmdlZBgNIAEoCzIdLm5vbW9zLnJ1bnRpbWUudjIuTGlua0NoYW5nZWRIABI5Cg5zaWduYWxfY2hhbmdlZBgOIAEoCzIfLm5vbW9zLnJ1bnRpbWUudjIuU2lnbmFsQ2hhbmdlZEgAEjsKD2N1c3RvZHlfY2hhbmdlZBgPIAEoCzIgLm5vbW9zLnJ1bnRpbWUudjIuQ3VzdG9keUNoYW5nZWRIABJCChNsb2NhbF93b3JrX3JlamVjdGVkGBAgASgLMiMubm9tb3MucnVudGltZS52Mi5Mb2NhbFdvcmtSZWplY3RlZEgAEjMKC2xhd19jaGFuZ2VkGBEgASgLMhwubm9tb3MucnVudGltZS52Mi5MYXdDaGFuZ2VkSAASQwoPa2VybmVsX3Byb2dyZXNzGBIgASgLMigubm9tb3MucnVudGltZS52Mi5LZXJuZWxQcm9ncmVzc09ic2VydmVkSAASLQoEc3BhbhgTIAEoCzIdLm5vbW9zLnJ1bnRpbWUudjIuUnVudGltZVNwYW5IABI/ChF0cmFuc2Zlcl9wcm9ncmVzcxgUIAEoCzIiLm5vbW9zLnJ1bnRpbWUudjIuVHJhbnNmZXJQcm9ncmVzc0gAEkkKFG1haW50ZW5hbmNlX3Byb2dyZXNzGBUgASgLMikubm9tb3MucnVudGltZS52Mi5SZWFkTWFpbnRlbmFuY2VQcm9ncmVzc0gAEjsKDXNvY2tldF9lZmZlY3QYFiABKAsyIi5ub21vcy5ydW50aW1lLnYyLlBlZXJTb2NrZXRFZmZlY3RIABJUChxjcmVkZW50aWFsX3JlZnJlc2hfcmVxdWVzdGVkGBcgASgLMiwubm9tb3MucnVudGltZS52Mi5DcmVkZW50aWFsUmVmcmVzaFJlcXVlc3RlZEgAElIKG3JlY2VpdmluZ19ncm91cF9jb252ZXJnZW5jZRgYIAEoCzIrLm5vbW9zLnJ1bnRpbWUudjIuUmVjZWl2aW5nR3JvdXBDb252ZXJnZW5jZUgAEkoKF21vZGVsX2Fkb3B0aW9uX3Byb2dyZXNzGBkgASgLMicubm9tb3MucnVudGltZS52Mi5Nb2RlbEFkb3B0aW9uUHJvZ3Jlc3NIABI7Cg9mb2xsb3dzX3N1bW1hcnkYGiABKAsyIC5ub21vcy5ydW50aW1lLnYyLkZvbGxvd3NTdW1tYXJ5SAASRAoUbG9jYWxfY29weV9wcmVzZXJ2ZWQYGyABKAsyJC5ub21vcy5ydW50aW1lLnYyLlByZXNlcnZlZExvY2FsQ29weUgAEk4KGWZvcmVpZ25fcGxhY2VtZW50X2lnbm9yZWQYHCABKAsyKS5ub21vcy5ydW50aW1lLnYyLkZvcmVpZ25QbGFjZW1lbnRJZ25vcmVkSAASQwoTYmluZGluZ19xdWFyYW50aW5lZBgdIAEoCzIkLm5vbW9zLnJ1bnRpbWUudjIuUXVhcmFudGluZWRCaW5kaW5nSAASPwoRd3JpdGVfcHJlcGFyYXRpb24YHiABKAsyIi5ub21vcy5ydW50aW1lLnYyLldyaXRlUHJlcGFyYXRpb25IAEIHCgVldmVudEIKCghfc2Vzc2lvbiK8AQoORm9sbG93c1N1bW1hcnkSEAoIZm9sbG93ZWQYASABKA0SDwoHc2V0dGxlZBgCIAEoDRIMCgRsaXZlGAMgASgNEjcKCndvcmtzcGFjZXMYBCADKAsyIy5ub21vcy5ydW50aW1lLnYyLkZvbGxvd09ic2VydmF0aW9uEiQKF29ic2VydmVkX2F0X3VuaXhfbWlsbGlzGAUgASgESACIAQFCGgoYX29ic2VydmVkX2F0X3VuaXhfbWlsbGlzItECChFGb2xsb3dPYnNlcnZhdGlvbhIRCgl3b3Jrc3BhY2UYASABKAkSNwoFcGhhc2UYAiABKA4yKC5ub21vcy5ydW50aW1lLnYyLkZvbGxvd09ic2VydmF0aW9uUGhhc2USDAoEbGl2ZRgDIAEoCBITCgZkZXRhaWwYBCABKAlIAIgBARIhChRyZXRyeV9hdF91bml4X21pbGxpcxgFIAEoBEgBiAEBEh8KEmR1ZV9hdF91bml4X21pbGxpcxgGIAEoBEgCiAEBEhQKB2F0dGVtcHQYByABKA1IA4gBARIaCg1hY3RpdmVfZWZmZWN0GAggASgJSASIAQFCCQoHX2RldGFpbEIXChVfcmV0cnlfYXRfdW5peF9taWxsaXNCFQoTX2R1ZV9hdF91bml4X21pbGxpc0IKCghfYXR0ZW1wdEIQCg5fYWN0aXZlX2VmZmVjdCJWChpDcmVkZW50aWFsUmVmcmVzaFJlcXVlc3RlZBI4CgdwZW5kaW5nGAEgASgLMicubm9tb3MucnVudGltZS52Mi5Db3JyZXNwb25kZW5jZVBlbmRpbmciPgoMUnVudGltZVJlYWR5EhcKD3J1bnRpbWVfdmVyc2lvbhgBIAEoCRIVCg1rZXJuZWxfc2hhMjU2GAIgASgMIvwBCgxXYXRjaENoYW5nZWQSFwoPc3Vic2NyaXB0aW9uX2lkGAEgASgJEhMKC3Jlc3VsdF91c2RhGAIgASgMEjYKB2ZhaWx1cmUYAyABKAsyIC5ub21vcy5ydW50aW1lLnYyLlJ1bnRpbWVGYWlsdXJlSACIAQESNQoSYXBwbGljYXRpb25fcmVzdWx0GAQgASgLMhQuZ29vZ2xlLnByb3RvYnVmLkFueUgBiAEBEhoKDWludGVnZXJfdmFsdWUYBSABKANIAogBAUIKCghfZmFpbHVyZUIVChNfYXBwbGljYXRpb25fcmVzdWx0QhAKDl9pbnRlZ2VyX3ZhbHVlIpwBCg1TeW5jQ29tcGxldGVkEg4KBnJlYXNvbhgBIAEoCRI3CgZyZXN1bHQYAiABKAsyJy5ub21vcy5ydW50aW1lLnYyLlN5bmNXb3Jrc3BhY2VSZXNwb25zZRI2CgdmYWlsdXJlGAMgASgLMiAubm9tb3MucnVudGltZS52Mi5SdW50aW1lRmFpbHVyZUgAiAEBQgoKCF9mYWlsdXJlIjsKC0xpbmtDaGFuZ2VkEiwKBnN0YXR1cxgBIAEoDjIcLm5vbW9zLnJ1bnRpbWUudjIuTGlua1N0YXR1cyI4Cg1TaWduYWxDaGFuZ2VkEg4KBmRvbWFpbhgBIAEoCRIXCg9wcm9qZWN0aW9uX3VzZGEYAiABKAwiUAoKTGF3Q2hhbmdlZBIOCgZkb21haW4YASABKAkSFgoOcGFja2FnZV9zaGEyNTYYAiABKAkSGgoSY29tcGF0aWJpbGl0eV91c2RhGAMgASgMIt0BCgtSdW50aW1lU3BhbhIQCgh0cmFjZV9pZBgBIAEoDBIPCgdzcGFuX2lkGAIgASgMEhsKDnBhcmVudF9zcGFuX2lkGAMgASgMSACIAQESDAoEbmFtZRgEIAEoCRIaChJzdGFydGVkX3VuaXhfbmFub3MYBSABKAQSFgoOZHVyYXRpb25fbmFub3MYBiABKAQSOQoKYXR0cmlidXRlcxgHIAMoCzIlLm5vbW9zLnJ1bnRpbWUudjIuRGlhZ25vc3RpY0F0dHJpYnV0ZUIRCg9fcGFyZW50X3NwYW5faWQi6gEKFktlcm5lbFByb2dyZXNzT2JzZXJ2ZWQSOQoIc25hcHNob3QYASABKAsyJy5ub21vcy5rZXJuZWwudjEuS2VybmVsUHJvZ3Jlc3NTbmFwc2hvdBIkChxob3N0X29ic2VydmVkX2VsYXBzZWRfbWljcm9zGAIgASgEEioKImhvc3Rfb2JzZXJ2ZWRfcGhhc2VfZWxhcHNlZF9taWNyb3MYAyABKAQSHgoWcHJvY2Vzc19yZXNpZGVudF9ieXRlcxgEIAEoBBIjChtwcm9jZXNzX3BlYWtfcmVzaWRlbnRfYnl0ZXMYBSABKAQiggEKEFRyYW5zZmVyUHJvZ3Jlc3MSFgoOcmVjZWl2ZWRfYnl0ZXMYASABKAQSGAoLdG90YWxfYnl0ZXMYAiABKARIAIgBARIsCgRraW5kGAMgASgOMh4ubm9tb3MucnVudGltZS52Mi5UcmFuc2ZlcktpbmRCDgoMX3RvdGFsX2J5dGVzIjkKEFdyaXRlUHJlcGFyYXRpb24SEgoKcmVxdWVzdF9pZBgBIAEoCRIRCgl3b3Jrc3BhY2UYAiABKAkqygEKElJ1bnRpbWVGYWlsdXJlS2luZBIkCiBSVU5USU1FX0ZBSUxVUkVfS0lORF9VTlNQRUNJRklFRBAAEiEKHVJVTlRJTUVfRkFJTFVSRV9LSU5EX0lOVEVSTkFMEAESIQodUlVOVElNRV9GQUlMVVJFX0tJTkRfUFJPVE9DT0wQAhIiCh5SVU5USU1FX0ZBSUxVUkVfS0lORF9JTlRFR1JJVFkQAxIkCiBSVU5USU1FX0ZBSUxVUkVfS0lORF9VTlNVUFBPUlRFRBAEKqcDChhSdW50aW1lVW5hdmFpbGFibGVSZWFzb24SKgomUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fVU5TUEVDSUZJRUQQABIyCi5SVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9SRU1PVEVfT05MWV9PRkZMSU5FEAESMQotUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fUkVNT1RFX1VOUkVBQ0hBQkxFEAISLQopUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fUkVNT1RFX1RJTUVPVVQQAxI2CjJSVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9MT0NBTF9SRVBMSUNBX05PVF9SRUFEWRAEEjUKMVJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX0NSRURFTlRJQUxfVU5BVkFJTEFCTEUQBRIwCixSVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9XT1JLU1BBQ0VfT1BFTklORxAGEigKJFJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX1BFRVJfQlVTWRAHKvABChRSdW50aW1lUmVmdXNhbFJlYXNvbhImCiJSVU5USU1FX1JFRlVTQUxfUkVBU09OX1VOU1BFQ0lGSUVEEAASLQopUlVOVElNRV9SRUZVU0FMX1JFQVNPTl9JTlZBTElEX0NSRURFTlRJQUwQARIoCiRSVU5USU1FX1JFRlVTQUxfUkVBU09OX0FDQ0VTU19ERU5JRUQQAhIrCidSVU5USU1FX1JFRlVTQUxfUkVBU09OX1BMQUNFTUVOVF9QT0xJQ1kQAxIqCiZSVU5USU1FX1JFRlVTQUxfUkVBU09OX1NFU1NJT05fVU5CT1VORBAEKpUEChZGb2xsb3dPYnNlcnZhdGlvblBoYXNlEigKJEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9VTlNQRUNJRklFRBAAEiQKIEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9ERVNJUkVEEAESIAocRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX0RVRRACEiQKIEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9SVU5OSU5HEAMSJAogRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX1NFVFRMRUQQBBIwCixGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfQVdBSVRJTkdfREVQRU5ERU5DWRAFEiQKIEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9PRkZMSU5FEAYSLworRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX0lOVkFMSURfQ1JFREVOVElBTBAHEiQKIEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9CQUNLT0ZGEAgSLAooRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX1JFQk9STl9SRU1PVEVMWRAJEiwKKEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9SRVBMQUNJTkdfTE9DQUwQChIyCi5GT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfTE9DQUxfQ09QWV9VTlJFQURBQkxFEAsqVwoKTGlua1N0YXR1cxIbChdMSU5LX1NUQVRVU19VTlNQRUNJRklFRBAAEhQKEExJTktfU1RBVFVTX09QRU4QARIWChJMSU5LX1NUQVRVU19DTE9TRUQQAip2CgxUcmFuc2ZlcktpbmQSHQoZVFJBTlNGRVJfS0lORF9VTlNQRUNJRklFRBAAEhcKE1RSQU5TRkVSX0tJTkRfREVMVEEQARIWChJUUkFOU0ZFUl9LSU5EX0ZVTEwQAhIWChJUUkFOU0ZFUl9LSU5EX1BVU0gQA2IGcHJvdG8z", [file_google_protobuf_any2, file_nomos_kernel_v1_progress, file_nomos_runtime_v2_correspondence_desk, file_nomos_runtime_v2_custody_desk, file_nomos_runtime_v2_placement_desk, file_nomos_runtime_v2_maintenance_desk, file_nomos_runtime_v2_model_adoption_desk, file_nomos_runtime_v2_receiving_group_desk, file_nomos_runtime_v2_recovery_desk]);
     RuntimeFailureSchema = /* @__PURE__ */ messageDesc22(file_nomos_runtime_v2_observability_desk, 1);
     RuntimeUnavailableSchema = /* @__PURE__ */ messageDesc22(file_nomos_runtime_v2_observability_desk, 2);
     RuntimeRefusalSchema = /* @__PURE__ */ messageDesc22(file_nomos_runtime_v2_observability_desk, 3);
@@ -9305,6 +9305,7 @@ var init_observability_desk_pb = __esm({
     SyncCompletedSchema = /* @__PURE__ */ messageDesc22(file_nomos_runtime_v2_observability_desk, 11);
     LinkChangedSchema = /* @__PURE__ */ messageDesc22(file_nomos_runtime_v2_observability_desk, 12);
     RuntimeSpanSchema = /* @__PURE__ */ messageDesc22(file_nomos_runtime_v2_observability_desk, 15);
+    WritePreparationSchema = /* @__PURE__ */ messageDesc22(file_nomos_runtime_v2_observability_desk, 18);
     RuntimeFailureKindSchema = /* @__PURE__ */ enumDesc15(file_nomos_runtime_v2_observability_desk, 0);
     RuntimeFailureKind = /* @__PURE__ */ tsEnum15(RuntimeFailureKindSchema);
     RuntimeUnavailableReasonSchema = /* @__PURE__ */ enumDesc15(file_nomos_runtime_v2_observability_desk, 1);
@@ -11691,7 +11692,7 @@ function filesystemCustodyFetch(dataDir, origin, options = {}, networkFetch = fe
 async function runGitHttpBackend(projectRoot, { method, pathInfo, query: query2, contentType, body }, options = {}) {
   const stdin = body && body.length ? await requestBodyStdin(body) : void 0;
   try {
-    return await new Promise((resolve8, reject) => {
+    return await new Promise((resolve9, reject) => {
       const env = {
         ...process.env,
         GIT_PROJECT_ROOT: projectRoot,
@@ -11766,7 +11767,7 @@ async function runGitHttpBackend(projectRoot, { method, pathInfo, query: query2,
           }
           headers[k] = v;
         }
-        resolve8({ status: status2, headers, body: payload });
+        resolve9({ status: status2, headers, body: payload });
       });
     });
   } finally {
@@ -14850,6 +14851,22 @@ var init_credential_sessions = __esm({
   }
 });
 
+// ../peer-office/src/runtime/credential_failure.ts
+function recoverableCredential(failure) {
+  return failure.code === "nomos.auth.token_expired" || failure.code === "nomos.auth.token_missing";
+}
+function syncNeedsCredentialRefresh(result, failure) {
+  if (failure !== void 0 && recoverableCredential(failure)) return true;
+  const offer = result?.offerReceipt?.outcome;
+  const pushNeedsRefresh = offer?.case === "failure" ? recoverableCredential(offer.value) : result?.pushError?.status === 401;
+  return pushNeedsRefresh || result?.discoveryError?.status === 401;
+}
+var init_credential_failure = __esm({
+  "../peer-office/src/runtime/credential_failure.ts"() {
+    "use strict";
+  }
+});
+
 // ../peer-office/src/runtime/credential_renewal.ts
 function identityTokenClaim(token, claim) {
   const claims = tokenClaims(token);
@@ -15048,19 +15065,11 @@ var init_sha256 = __esm({
 
 // ../peer-office/src/runtime/credential_recovery_desk.ts
 import { create as create17, fromBinary as fromBinary9, toBinary as toBinary8 } from "@bufbuild/protobuf";
-function recoverableCredential(failure) {
-  return failure.code === "nomos.auth.token_expired" || failure.code === "nomos.auth.token_missing";
-}
-function syncNeedsCredentialRefresh(event) {
-  const failures = [event.result?.pushError, event.result?.discoveryError];
-  if (failures.some((failure) => failure?.status === 401 || failure?.status === 403)) return true;
-  const text2 = `${event.failure?.message ?? ""} ${failures.map((failure) => failure?.message ?? "").join(" ")}`.toLowerCase();
-  return text2.includes("unauthenticated") || text2.includes("token expired") || text2.includes("invalid token");
-}
 var CredentialRecoveryDesk;
 var init_credential_recovery_desk = __esm({
   "../peer-office/src/runtime/credential_recovery_desk.ts"() {
     "use strict";
+    init_credential_failure();
     init_kernel_pb();
     init_correspondence_desk_pb();
     init_credentials_desk_pb();
@@ -15145,7 +15154,7 @@ var init_credential_recovery_desk = __esm({
         return false;
       }
       observeSync(session, event) {
-        if (!syncNeedsCredentialRefresh(event) || this.#tokenless(session)) return;
+        if (!syncNeedsCredentialRefresh(event.result, event.failure) || this.#tokenless(session)) return;
         this.#prune();
         const capability = this.#ports.capabilityFor(session);
         const existing = this.#active.get(capability);
@@ -16352,6 +16361,7 @@ var init_receiving_group_desk = __esm({
       #accounts = /* @__PURE__ */ new Map();
       /** D22: device key hash → the workspaces the console reported this key enrolled in (this process's memory, not truth). */
       #consoleEnrolments = /* @__PURE__ */ new Map();
+      #preparingWrites = /* @__PURE__ */ new Map();
       #sequence = 0;
       #internalRequestId = 30000000000n;
       constructor(ports) {
@@ -16391,16 +16401,124 @@ var init_receiving_group_desk = __esm({
         if (head === account.observedHead) return;
         this.#tails.set(workspace, { ...account, inFlight: false, attempts: 0, notBefore: 0n });
       }
-      /** A refused nominal Home action can wait for framework recovery and retry once.
-       * Sealed/pending history is never re-signed, and no child is mistaken for Home. */
+      /** Only a proven non-admission can enter recovery. Console-enrolled children
+       * share the owning application's route, selected by credential capability and
+       * principal, never by workspace-name guessing or an unverified payload. */
       recoverOffer(request, response) {
-        if (!this.#ports.call || request.command.case !== "kernelCall" || request.command.value.credentialUse !== CredentialUse.SESSION || request.command.value.request?.operation.case !== "offer" || request.command.value.request.operation.value.intent.case !== "call" || response.outcome.case !== "failure" || !["nomos.authz.signer_enrollment_missing", "nomos.authz.device_key_revoked"].includes(response.outcome.value.code)) return;
+        if (!this.#ports.call || request.command.case !== "kernelCall" || request.command.value.credentialUse !== CredentialUse.SESSION || request.command.value.request?.operation.case !== "offer" || request.command.value.request.operation.value.intent.case !== "call") return;
+        const missing = response.outcome.case === "failure" ? response.outcome.value.code === "nomos.authz.signer_enrollment_missing" : response.outcome.case === "offer" && response.outcome.value.outcome.case === "refused" && response.outcome.value.outcome.value.refusal?.code === KernelRefusalCode.FORGED_PRINCIPAL && response.outcome.value.outcome.value.refusal.details?.fields.actor?.kind.case === "text" && response.outcome.value.outcome.value.refusal.details.fields.actor.kind.value === "unenrolled-signer-key";
+        const revoked = response.outcome.case === "failure" && response.outcome.value.code === "nomos.authz.device_key_revoked";
+        if (!missing && !revoked) return;
         const binding = this.#ports.binding(request.command.value.session);
-        const account = binding ? this.#accounts.get(binding.workspace) : void 0;
-        if (!account) return;
+        if (!binding) return;
+        const enrolled = [...this.#accounts.values()].find((account2) => {
+          const owner = this.#ports.binding(account2.session);
+          return account2.enrolment && owner?.credentialCapability === binding.credentialCapability && owner.principal === binding.principal;
+        });
         const copy3 = fromBinary14(RuntimeRequestSchema, toBinary11(RuntimeRequestSchema, request));
+        if (enrolled?.enrolment) {
+          if (revoked) return this.#writeRefused(binding.workspace, "This device's access has been revoked.");
+          return this.#begin(request, `enrolled-write-${++this.#sequence}`, (workId2) => this.#prepareEnrolledWrite(copy3, binding, enrolled.application, enrolled.enrolment, workId2));
+        }
+        const account = this.#accounts.get(binding.workspace);
+        if (!account) return;
         return this.#begin(request, `receiving-group-authoring-${++this.#sequence}`, (workId2) => this.#recoverOffer(copy3, response, account, workId2));
       }
+      #writeRefused(workspace, detail, reason = RuntimeRefusalReason.ACCESS_DENIED) {
+        return { case: "refused", value: create24(RuntimeRefusalSchema, {
+          reason,
+          workspace,
+          retryable: false,
+          detail
+        }) };
+      }
+      #writeWaiting(workspace, detail) {
+        return { case: "unavailable", value: create24(RuntimeUnavailableSchema, {
+          reason: RuntimeUnavailableReason.CREDENTIAL_UNAVAILABLE,
+          workspace,
+          retryable: true,
+          retryAfterMillis: 1e3,
+          detail
+        }) };
+      }
+      *#prepareEnrolledWrite(request, binding, application, route, workId2) {
+        if (request.command.case !== "kernelCall") throw new Error("write preparation lost its call");
+        const command = request.command.value;
+        const principal = binding.principal;
+        const unavailable = () => this.#writeWaiting(
+          binding.workspace,
+          "This device is still being prepared to save changes. Your change has not been saved. Try again when connected."
+        );
+        this.#ports.emit(binding.session, { case: "writePreparation", value: create24(WritePreparationSchema, {
+          requestId: command.request.requestId,
+          workspace: binding.workspace
+        }) });
+        const key2 = JSON.stringify([binding.credentialCapability, principal, binding.workspace]);
+        const shared = this.#preparingWrites.get(key2);
+        const deadline = this.#ports.clock.monotonicNanoseconds() + 30000000000n;
+        let wake = 0;
+        if (shared) {
+          while (!shared.settled) {
+            if (this.#ports.clock.monotonicNanoseconds() >= deadline) return unavailable();
+            const receipt = yield { case: "wake", value: create24(PeerWakeEffectSchema, {
+              effectId: `${workId2}:join-${++wake}`,
+              delayMillis: 250
+            }) };
+            if (receipt.outcome.case !== "woken") return unavailable();
+          }
+          if (shared.result) return shared.result;
+        } else {
+          const preparation = { settled: false };
+          this.#preparingWrites.set(key2, preparation);
+          try {
+            const secret = this.#ports.authorSecretIfPresent(binding.session);
+            if (!secret) return preparation.result = this.#writeRefused(binding.workspace, "Sign in again to set up this device.", RuntimeRefusalReason.INVALID_CREDENTIAL);
+            const keyHash = sha256Hex6(this.#ports.deriveSigningPublicKey(secret));
+            let posture = this.#ports.posture(request, binding.session, principal, secret, false);
+            if (posture.deviceSignerStatus === DeviceSignerStatus.REVOKED) {
+              return preparation.result = this.#writeRefused(binding.workspace, "This device's access has been revoked.");
+            }
+            if (!posture.enrolledDevice || posture.deviceSignerStatus !== DeviceSignerStatus.ACTIVE) {
+              const enrolled = yield* this.#enrolAtConsole(
+                route,
+                binding,
+                `${application}|${principal}`,
+                principal,
+                keyHash,
+                [binding.workspace],
+                `${workId2}:console`
+              );
+              if (enrolled.case === "deferred") return preparation.result = enrolled.credentialRefused ? this.#writeRefused(binding.workspace, "Sign in again to set up this device.", RuntimeRefusalReason.INVALID_CREDENTIAL) : unavailable();
+              if (!(binding.workspace in enrolled.value.heads)) {
+                return preparation.result = this.#writeRefused(binding.workspace, "This device could not obtain access to save changes in this workspace.");
+              }
+              while (true) {
+                posture = this.#ports.posture(request, binding.session, principal, secret, false);
+                if (posture.deviceSignerStatus === DeviceSignerStatus.REVOKED) {
+                  return preparation.result = this.#writeRefused(binding.workspace, "This device's access has been revoked.");
+                }
+                if (posture.enrolledDevice && posture.deviceSignerStatus === DeviceSignerStatus.ACTIVE) break;
+                if (this.#ports.clock.monotonicNanoseconds() >= deadline) return preparation.result = unavailable();
+                const receipt = yield { case: "wake", value: create24(PeerWakeEffectSchema, {
+                  effectId: `${workId2}:observe-${++wake}`,
+                  delayMillis: 500
+                }) };
+                if (receipt.outcome.case !== "woken") return preparation.result = unavailable();
+              }
+            }
+          } catch (error) {
+            if (error instanceof ReceivingGroupRefusal) {
+              return preparation.result = this.#writeRefused(binding.workspace, "This device could not obtain access to save changes in this workspace.");
+            }
+            preparation.result = unavailable();
+            throw error;
+          } finally {
+            preparation.settled = true;
+            this.#preparingWrites.delete(key2);
+          }
+        }
+        return { case: "retried", request, response: this.#ports.call(request, command) };
+      }
       *#recoverOffer(request, response, account, workId2) {
         const workspace = this.#ports.binding(account.session).workspace;
         const deadline = this.#ports.clock.monotonicNanoseconds() + 60000000000n;
@@ -16468,6 +16586,7 @@ var init_receiving_group_desk = __esm({
         this.#opening.clear();
         this.#accounts.clear();
         this.#consoleEnrolments.clear();
+        this.#preparingWrites.clear();
       }
       #begin(request, workId2, procedure) {
         const held = {
@@ -20359,6 +20478,7 @@ var init_replica_follow_controller = __esm({
     init_replica_follow_state();
     init_local_copy_readability();
     init_placement_desk();
+    init_credential_failure();
     ReplicaFollowReconciliationKind = Object.freeze({
       Following: "following",
       NotFollowing: "not_following"
@@ -20626,12 +20746,12 @@ var init_replica_follow_controller = __esm({
           this.#desk.transition(result.workspace, { case: ReplicaFollowEventKind.WentOffline, nowUnixMillis });
           return delayUntilDue(this.#desk.get(result.workspace), nowUnixMillis);
         }
-        const credentialFailure = [result.pushError, result.discoveryError].find((failure) => failure?.status === 401 || failure?.status === 403);
-        if (credentialFailure) {
+        if (syncNeedsCredentialRefresh(result)) {
+          const offer = result.offerReceipt?.outcome;
           const transition = this.#desk.transition(result.workspace, {
             case: ReplicaFollowEventKind.CredentialRejected,
             nowUnixMillis,
-            failure: credentialFailure.message || `remote rejected credential with HTTP ${credentialFailure.status}`
+            failure: (offer?.case === "failure" ? offer.value.message : void 0) || result.pushError?.message || result.discoveryError?.message || "remote requires a refreshed credential"
           });
           if (transition.effects.some((effect) => effect.case === ReplicaFollowEffectKind.RefreshCredential)) {
             return 0;
@@ -22818,7 +22938,7 @@ import { create as create55, fromBinary as fromBinary20 } from "@bufbuild/protob
 function releaseSyncJudgment(workspace) {
   judgedThisLifetime.delete(workspace);
 }
-var PLACEMENT_REF3, LAW_PRODUCTS_MEDIA_TYPE, WorkspaceSyncPhase, trackedMain, NO_COMMON_BASE, deferredRemote, deferredLocal, judgedThisLifetime, MAX_REBASES_PER_ROUND, elapsedMillis, WorkspaceSyncWork;
+var PLACEMENT_REF3, LAW_PRODUCTS_MEDIA_TYPE, WorkspaceSyncPhase, trackedMain, deferredRemote, deferredLocal, judgedThisLifetime, MAX_REBASES_PER_ROUND, elapsedMillis, WorkspaceSyncWork;
 var init_workspace_sync = __esm({
   "../peer-office/src/runtime/workspace_sync.ts"() {
     "use strict";
@@ -22844,7 +22964,6 @@ var init_workspace_sync = __esm({
       Done: "done"
     });
     trackedMain = "refs/remotes/nomos/main";
-    NO_COMMON_BASE = "this replica holds local history with no frontier its upstream ever confirmed; convergence needs a common admitted base \u2014 drop the local copy to refetch it, or re-discover a provider holding this lineage";
     deferredRemote = "refs/remotes/nomos/deferred";
     deferredLocal = "refs/nomos/sync-deferred-local";
     judgedThisLifetime = /* @__PURE__ */ new Map();
@@ -23052,38 +23171,13 @@ var init_workspace_sync = __esm({
         }), { case: "awaiting", requestId });
       }
       /**
-       * NO COMMON BASE — a round that cannot converge, and must not pay for history to find out.
-       *
-       * This replica holds a non-empty ledger but has never recorded a frontier its upstream
-       * confirmed (`refs/remotes/nomos/main` is absent). The kernel refuses convergence in that
-       * state ("a non-empty live ledger requires a common admitted base"), so every step after the
-       * O(1) frontier probe is wasted work — and it is not cheap waste: the fetch negotiates with
-       * no `have` (a full-history pack), and the dependency planner decodes EVERY intent from
-       * genesis and inspects every change, once per round. That is O(history) per follow round,
-       * repeated at every retry, for a round that can only end in a refusal.
-       *
-       * The one base this round can establish costs nothing and is established before this is
-       * asked: an upstream holding exactly this replica's head (the probe's answer) converges it
-       * and records the tracking frontier. Anything else needs the local copy to be dropped and
-       * refetched (an application decision, which preserves the copy), or a re-discovery that
-       * names a provider holding this lineage. Both are reported, at O(1), as this failure.
-       */
-      /**
-       * Establish this round's base when none is tracked, without walking any history it can avoid.
-       *
-       * The upstream just named its own frontier. If that commit is in THIS replica's lineage, it is
-       * a common admitted base by definition — both sides hold it — and adopting it turns the round
-       * into an ordinary fast-forward: the offer carries only the suffix above it, the fetch can name
-       * it as a truthful `have`, and convergence has the base the kernel requires. One commit walk
-       * (no change decoding, no pack, no network) decides it.
-       *
-       * If it is not in this replica's lineage, no base exists to establish and the round is refused
-       * (#noCommonBase) before it leases, fetches or plans anything.
-       *
-       * A kernel without the commit walk cannot be asked, so it keeps the previous behaviour.
+       * Establish a cheap base when the provider's current tip is in our local chain.
+       * A negative answer means the base is unknown: both sides may have advanced from
+       * an earlier shared commit. Acquire the candidate and let the kernel discover
+       * and judge that history. A tracking bookmark is not an admission prerequisite.
        */
       #establishBase(upstreamHead) {
-        if (!this.#noCommonBase() || !this.#kernel.historySummary) return true;
+        if (!this.#missingTrackedBase() || !this.#kernel.historySummary) return true;
         const summary = this.#kernel.historySummary(this.#mount, this.#requestId, upstreamHead, this.#localHead);
         if (!summary.reachedBase) return false;
         this.#previousHead = upstreamHead;
@@ -23098,26 +23192,9 @@ var init_workspace_sync = __esm({
       get establishedBase() {
         return this.#establishedBase;
       }
-      #noCommonBase() {
+      #missingTrackedBase() {
         return this.#previousHead === void 0 && this.#localHead !== void 0 && this.#replaceLocalHead === void 0;
       }
-      #noCommonBaseResult() {
-        return this.#finish(create55(SyncWorkspaceResponseSchema, {
-          workspace: this.#mount.workspace,
-          ...this.#localHead === void 0 ? {} : { currentHead: this.#localHead },
-          stillAhead: true,
-          ...this.#offerReceipt === void 0 ? {} : { offerReceipt: this.#offerReceipt },
-          pushError: create55(RuntimeTransportFailureSchema, {
-            endpoint: this.#offerEndpoint(),
-            status: 409,
-            refused: true,
-            message: NO_COMMON_BASE
-          }),
-          timings: create55(SyncPhaseTimingsSchema, {
-            convergeMillis: elapsedMillis(this.#clock, this.#started)
-          })
-        }));
-      }
       #holdsLocalWork() {
         return this.#command.admit && !!this.#localHead && this.#localHead !== this.#previousHead;
       }
@@ -23269,7 +23346,6 @@ var init_workspace_sync = __esm({
         if (!this.#desiredHead) return this.#transportFailure("resident peer returned no admitted frontier", false);
         this.#candidateDurable = admission.sealedMain === this.#desiredHead;
         if (state.phase === WorkspaceSyncPhase.Probe && this.#desiredHead !== this.#localHead) {
-          if (!this.#establishBase(this.#desiredHead)) return this.#noCommonBaseResult();
           if (this.#alreadyJudged(this.#desiredHead)) {
             return this.#finish(create55(SyncWorkspaceResponseSchema, {
               workspace: this.#mount.workspace,
@@ -23281,6 +23357,22 @@ var init_workspace_sync = __esm({
               offerReceipt: this.#offerReceipt
             }));
           }
+          if (!this.#establishBase(this.#desiredHead)) {
+            this.#offerAfterConverge = this.#command.admit;
+            this.#rebaseFrom = void 0;
+            return this.#leaseEffect();
+          }
+          if (this.#establishedBase && !this.#candidateDurable && this.#kernel.resolveRef(this.#mount, this.#requestId, trackedMain) === void 0) {
+            return this.#finish(create55(SyncWorkspaceResponseSchema, {
+              workspace: this.#mount.workspace,
+              currentHead: this.#localHead,
+              previousHead: this.#previousHead,
+              stillAhead: true,
+              directOfferDeferred: true,
+              reconnectRequired: false,
+              offerReceipt: this.#offerReceipt
+            }));
+          }
           if (this.#probeOnly) {
             this.#needsReconciliation = true;
             return this.#finish(create55(SyncWorkspaceResponseSchema, {
@@ -23326,7 +23418,7 @@ var init_workspace_sync = __esm({
           return this.#converge(this.#desiredHead, admission.resultPack.byteLength, 0);
         }
         if (this.#desiredHead === this.#previousHead) return this.#converge(this.#desiredHead, 0, 0);
-        if (!this.#establishBase(this.#desiredHead)) return this.#noCommonBaseResult();
+        this.#establishBase(this.#desiredHead);
         if (admission.recoveryRequired !== false) return this.#leaseEffect();
         return this.#transportFailure("resident peer supplied neither the missing delta nor a history gap", false);
       }
@@ -23549,7 +23641,7 @@ var init_workspace_sync = __esm({
         }
       }
       #converge(candidateHead, receivedBytes, prefetchMillis) {
-        if (!this.#establishBase(candidateHead)) return this.#noCommonBaseResult();
+        this.#establishBase(candidateHead);
         this.#beforeConverge?.(candidateHead, this.#previousHead);
         const convergeStarted = this.#clock.monotonicNanoseconds();
         let judged;
@@ -23883,9 +23975,9 @@ var init_workspace_sync = __esm({
         return this.#route?.receptionUrl || `${this.#cloudBase()}/v2/workspaces/${encodeURIComponent(this.#mount.workspace)}`;
       }
       #authToken() {
-        const resolve8 = this.#credentials.authTokenForCapability ?? this.#credentials.authToken;
-        if (!resolve8) throw new Error("workspace sync has no credential capability resolver");
-        return resolve8.call(this.#credentials, this.#binding.credentialCapability);
+        const resolve9 = this.#credentials.authTokenForCapability ?? this.#credentials.authToken;
+        if (!resolve9) throw new Error("workspace sync has no credential capability resolver");
+        return resolve9.call(this.#credentials, this.#binding.credentialCapability);
       }
     };
   }
@@ -26083,13 +26175,21 @@ var init_correspondence_desk = __esm({
       }
       #observeSyncResult(requestId, workId2, result) {
         const timings = result.timings;
+        const receipt = result.offerReceipt?.outcome;
+        const admission = receipt?.case === "admission" ? receipt.value : void 0;
         this.#events.instant("peer.follow.sync-result", {
           request: create60(RuntimeRequestSchema, { protocolVersion: 2, requestId }),
           workspace: result.workspace
         }, {
           "sync.workId": workId2,
           ...result.currentHead ? { "sync.head": result.currentHead } : {},
+          ...result.previousHead ? { "sync.previousHead": result.previousHead } : {},
+          ...admission?.main ? { "sync.providerHead": admission.main } : {},
+          ...admission?.sealedMain ? { "sync.sealedHead": admission.sealedMain } : {},
           "sync.stillAhead": result.stillAhead,
+          "sync.reconnectRequired": result.reconnectRequired,
+          "sync.refused": result.refused,
+          "sync.deferred": result.deferred,
           "sync.directOfferDeferred": result.directOfferDeferred,
           "sync.offline": result.offline,
           ...timings ? {
@@ -29367,6 +29467,7 @@ var init_peer_office = __esm({
         return this.#responses.modelAdoption(request, step);
       }
       #receivingGroupResponse(request, step) {
+        if (step.case === "refused") return this.#response(request, { case: "refused", value: step.value });
         if (step.case === "retried") return this.#birthCustodyResponse(step.request, this.#birthCustody.afterKernelCall(step.request, step.response));
         if (step.case === "pending") return this.#response(request, { case: "correspondencePending", value: step.value });
         if (step.case === "failure") return this.#failure(request, step.code, step.message);
@@ -29660,7 +29761,7 @@ function createPeerOfficeFrameRunner(kernel, credentials, profile, observations,
       const deadline = Date.now() + Math.max(0, withinMillis);
       while (outstanding() > 0 && Date.now() < deadline) {
         lanes.wake(0);
-        await new Promise((resolve8) => setTimeout(resolve8, 10));
+        await new Promise((resolve9) => setTimeout(resolve9, 10));
       }
       return outstanding();
     },
@@ -29721,7 +29822,7 @@ async function drivePeerFrame(runner, initialFrame, fetchImpl = globalThis.fetch
     if (response.outcome.case === "localReadPending") {
       if (yieldLocalReadToCaller) return responseFrame;
       const pending2 = response.outcome.value;
-      await new Promise((resolve8) => setTimeout(resolve8, pending2.resumeAfterMillis));
+      await new Promise((resolve9) => setTimeout(resolve9, pending2.resumeAfterMillis));
       responseFrame = runner.handleFrame(toBinary26(RuntimeRequestSchema, create72(RuntimeRequestSchema, {
         protocolVersion: response.protocolVersion,
         requestId: response.requestId,
@@ -29891,7 +29992,7 @@ async function executeHistoryAcquisitionEffect(effect, custody) {
   }
 }
 async function executeWakeEffect(effect) {
-  await new Promise((resolve8) => setTimeout(resolve8, effect.delayMillis));
+  await new Promise((resolve9) => setTimeout(resolve9, effect.delayMillis));
   return create72(PeerEffectReceiptSchema, { effectId: effect.effectId, outcome: { case: "woken", value: create72(PeerWokenSchema) } });
 }
 async function executeCredentialRefreshEffect(effect, provider) {
@@ -31208,7 +31309,7 @@ async function prepareRemoteModelTransition(cloud, input) {
     }
     atHash = status2.outcome.value.head ?? "";
     if (atHash || Date.now() >= deadline) break;
-    await new Promise((resolve8) => setTimeout(resolve8, 1e3));
+    await new Promise((resolve9) => setTimeout(resolve9, 1e3));
   }
   if (!atHash) {
     throw new Error("workspace has no current Git frontier to prove after pulling it");
@@ -31254,8 +31355,8 @@ async function prepareRemoteModelTransition(cloud, input) {
       target3
     );
     if (response.outcome.case !== "unavailable" || !response.outcome.value.retryable || Date.now() >= proofDeadline) break;
-    await new Promise((resolve8) => setTimeout(
-      resolve8,
+    await new Promise((resolve9) => setTimeout(
+      resolve9,
       Math.max(500, response.outcome.case === "unavailable" ? response.outcome.value.retryAfterMillis ?? 1e3 : 1e3)
     ));
   }
@@ -32108,7 +32209,7 @@ async function waitForWorkspaceMain(cloud, workspace, timeoutMs = 3e4) {
   while (Date.now() < deadline) {
     const head = await workspaceMainHead(cloud, workspace);
     if (head !== void 0) return head;
-    await new Promise((resolve8) => setTimeout(resolve8, 250));
+    await new Promise((resolve9) => setTimeout(resolve9, 250));
   }
   return void 0;
 }
@@ -32329,7 +32430,7 @@ async function ensureSovereignHome(opts = {}) {
     const deadline = Date.now() + 3e4;
     while (Date.now() < deadline) {
       if (await fetch(`${cloud}/v2/workspaces/${encodeURIComponent(home)}`).then((r) => r.ok).catch(() => false)) break;
-      await new Promise((resolve8) => setTimeout(resolve8, 250));
+      await new Promise((resolve9) => setTimeout(resolve9, 250));
     }
     if (!await fetch(`${cloud}/v2/workspaces/${encodeURIComponent(home)}`).then((r) => r.ok).catch(() => false)) {
       throw new Error(`Nomos admitted the birth of '${home}' but its custody did not become readable`);
@@ -32377,7 +32478,7 @@ async function ensureSovereignHome(opts = {}) {
         return typeof leaf?.verifiedVia === "string" && leaf.verifiedVia.length > 0;
       }).catch(() => false);
       if (visible) break;
-      await new Promise((resolve8) => setTimeout(resolve8, 250));
+      await new Promise((resolve9) => setTimeout(resolve9, 250));
     }
     if (!visible) throw new Error(`the session home's verified device enrollment did not become readable`);
   }
@@ -32391,8 +32492,19 @@ async function ensureApplicationWorkspace(application, opts = {}) {
   }
   const statusUrl = `${cloud}/v2/workspaces/${encodeURIComponent(application)}`;
   const current = await fetch(statusUrl).catch(() => null);
-  if (current?.ok) {
-    const status2 = await current.json().catch(() => null);
+  const status2 = current?.ok ? await current.json().catch(() => null) : null;
+  let unborn = false;
+  if (current?.ok && !status2?.lineage && !status2?.durableHead && !status2?.sealedHead) {
+    const domains2 = await fetch(`${statusUrl}/domains`);
+    if (domains2.status === 409) {
+      const body2 = await domains2.json().catch(() => null);
+      unborn = typeof body2?.error === "string" && body2.error.includes("unborn");
+    }
+    if (!unborn && !domains2.ok) {
+      throw new Error(`could not establish whether application '${application}' has custody (${domains2.status})`);
+    }
+  }
+  if (current?.ok && !unborn) {
     const principal = String(status2?.lineage?.principal ?? "");
     const actualParent = String(status2?.lineage?.parent ?? "");
     const expectedParent = requestedParent === "root" ? "" : requestedParent;
@@ -32428,7 +32540,7 @@ async function ensureApplicationWorkspace(application, opts = {}) {
       ...principal !== "" && session !== "" && sameIdentity(principal, session) ? { deployPrincipal: principal } : {}
     };
   }
-  if (current !== null && current.status !== 404 && current.status !== 409) {
+  if (current !== null && !unborn && current.status !== 404 && current.status !== 409) {
     throw new Error(`could not inspect deploy target '${application}' (${current.status}); refusing to guess that it is unborn`);
   }
   if (requestedParent !== void 0) {
@@ -33750,7 +33862,7 @@ async function waitForDurableMainAdvance(cloud, ws2, previousHead, opts = {}) {
   while (Date.now() < deadline) {
     const head = await durableMainHead(cloud, ws2, fetchImpl);
     if (head !== void 0 && head !== previousHead) return head;
-    await new Promise((resolve8) => setTimeout(resolve8, pollMs));
+    await new Promise((resolve9) => setTimeout(resolve9, pollMs));
   }
   return void 0;
 }
@@ -34306,8 +34418,10 @@ var init_commands = __esm({
       "mcp",
       "init-editor",
       "test",
+      "conformance",
       "doctor",
       "cloud",
+      "console",
       "status",
       "model",
       "platform",
@@ -34358,6 +34472,19 @@ var init_help = __esm({
     "use strict";
     init_commands();
     HELP = {
+      console: {
+        usage: "githolon console <login|logout|workspaces|universe|rollouts>",
+        what: "Use a downloaded console API credential. The browser and CLI use the same console API.\nCredentials are stored locally with owner-only permissions; tokens are never printed.",
+        flags: [
+          ["login --file <credential.json>", "verify and save a downloaded credential"],
+          ["logout", "remove the local credential; revoke other copies in the console"],
+          ["workspaces | universe", "read registered workspaces or their live subtree as JSON"],
+          ["rollouts [show <id>]", "list runs or inspect one"],
+          ["rollouts start --file <request.json>", "submit {payload:{kind:law,source:workspace},only:[workspace]} (JSON strings quoted)"],
+          ["rollouts resume <id>", "retry an existing law rollout"]
+        ],
+        examples: ["githolon console login --file nomos-console-example.json", "githolon console workspaces"]
+      },
       compile: {
         usage: "githolon compile [config] [--require-usdcat]",
         what: "Compile typed authoring input into canonical OpenUSD. nomos.project.ts emits the readable law\nclosure, its .law.usdz transport archive, and generated clients; nomos.application.ts emits the application\ncomposition stage. TypeScript is authoring input only: the kernel admits and custodies USD.",
@@ -34423,6 +34550,16 @@ var init_help = __esm({
         ],
         examples: ["githolon cloud dev", "githolon cloud dev --port 8787 --ephemeral", "githolon cloud dev --platform my-platform --law build/my.law.usdz"]
       },
+      conformance: {
+        usage: "githolon conformance [--json] [--offline] [--runtime <directory>]",
+        what: "Check the installed Node packages with an isolated generated application and the real test harness.\nProves write, read, refusal without mutation, persisted history and cold restore. Reports package versions\nand the kernel identity. First use may download verified runtime artifacts; no cloud workspace is changed.",
+        flags: [
+          ["--json", "emit one report for CI; exit nonzero if any check fails"],
+          ["--offline", "use local runtime artifacts only; fail if unavailable"],
+          ["--runtime <directory>", "use this verified runtime bundle"]
+        ],
+        examples: ["githolon conformance", "githolon conformance --offline --json"]
+      },
       test: {
         usage: "githolon test [test-file-or-flutter-test-flags] [--diagnostics]",
         what: "Run generated Dart application scenarios through Flutter with the real local Nomos custody plane.\nThe server rides inside githolon; connected scenarios, partitions, restarts and fresh reinstalls need no\nserver path, environment variables, certificates, workspace setup or separate application state.",
@@ -34689,6 +34826,84 @@ var init_help = __esm({
   }
 });
 
+// src/console.ts
+var console_exports = {};
+__export(console_exports, {
+  consoleCommand: () => consoleCommand,
+  consoleCredential: () => consoleCredential,
+  consoleRequest: () => consoleRequest
+});
+import { URL as URL2 } from "node:url";
+import { chmodSync as chmodSync3, mkdirSync as mkdirSync10, readFileSync as readFileSync11, renameSync as renameSync4, rmSync as rmSync5, writeFileSync as writeFileSync11 } from "node:fs";
+import { join as join15 } from "node:path";
+import { randomUUID as randomUUID4 } from "node:crypto";
+function consoleCredential(value) {
+  if (!value || typeof value !== "object") throw new Error("Invalid console credential file");
+  const v = value;
+  if (v.format !== "nomos-console-credential-v1" || typeof v.endpoint !== "string" || typeof v.tenant !== "string" || typeof v.token !== "string") throw new Error("Invalid console credential file");
+  const endpoint = new URL2(v.endpoint);
+  if (endpoint.protocol !== "https:" || endpoint.username || endpoint.password || endpoint.pathname !== "/" || endpoint.search || endpoint.hash) throw new Error("Console endpoint must be an HTTPS origin");
+  const token = /^nomos_api\.([a-z][a-z0-9-]{1,62})\.[a-f0-9]{32}\.[A-Za-z0-9_-]{43}$/.exec(v.token);
+  if (!token || token[1] !== v.tenant) throw new Error("Credential does not match its workspace account");
+  return { format: v.format, endpoint: endpoint.origin, tenant: v.tenant, token: v.token };
+}
+async function consoleRequest(profile, path4, method = "GET", body, fetcher = fetch) {
+  const response = await fetcher(profile.endpoint + path4, {
+    method,
+    redirect: "error",
+    signal: AbortSignal.timeout(12e4),
+    headers: { authorization: `Bearer ${profile.token}`, "content-type": "application/json" },
+    ...body !== void 0 ? { body: JSON.stringify(body) } : {}
+  });
+  const result = await response.json();
+  if (!response.ok) throw new Error(`Console ${response.status}: ${result.error ?? "request refused"}`);
+  return result;
+}
+async function consoleCommand(args) {
+  const file = join15(configDir(), "console.json");
+  if (args[0] === "login" && args.length === 3 && args[1] === "--file") {
+    const profile2 = consoleCredential(JSON.parse(readFileSync11(args[2], "utf8")));
+    await consoleRequest(profile2, `/v1/tenants/${profile2.tenant}/workspaces`);
+    mkdirSync10(configDir(), { recursive: true });
+    const temporary = `${file}.${randomUUID4()}.tmp`;
+    try {
+      writeFileSync11(temporary, JSON.stringify(profile2) + "\n", { mode: 384, flag: "wx" });
+      renameSync4(temporary, file);
+      chmodSync3(file, 384);
+    } finally {
+      rmSync5(temporary, { force: true });
+    }
+    console.log(`Console credential saved for ${profile2.tenant} at ${profile2.endpoint}`);
+    return 0;
+  }
+  if (args[0] === "logout" && args.length === 1) {
+    rmSync5(file, { force: true });
+    console.log("Local console credential removed. Revoke the key in the console to disable other copies.");
+    return 0;
+  }
+  const profile = consoleCredential(JSON.parse(readFileSync11(file, "utf8")));
+  const root = `/v1/tenants/${encodeURIComponent(profile.tenant)}`;
+  let result;
+  if (args[0] === "workspaces" && args.length === 1) result = await consoleRequest(profile, `${root}/workspaces`);
+  else if (args[0] === "universe" && args.length === 1) result = await consoleRequest(profile, "/v1/universe");
+  else if (args[0] === "rollouts" && args.length === 1) result = await consoleRequest(profile, `${root}/rollouts`);
+  else if (args[0] === "rollouts" && args[1] === "show" && args.length === 3) result = await consoleRequest(profile, `${root}/rollouts/${encodeURIComponent(args[2])}`);
+  else if (args[0] === "rollouts" && args[1] === "resume" && args.length === 3) result = await consoleRequest(profile, `${root}/rollouts/${encodeURIComponent(args[2])}/resume`, "POST", {});
+  else if (args[0] === "rollouts" && args[1] === "start" && args[2] === "--file" && args.length === 4) {
+    const input = JSON.parse(readFileSync11(args[3], "utf8"));
+    if (input?.payload?.kind !== "law") throw new Error("Console CLI supports law rollouts only");
+    result = await consoleRequest(profile, `${root}/rollouts`, "POST", input);
+  } else throw new Error("See githolon console --help for supported commands");
+  console.log(JSON.stringify(result, null, 2));
+  return 0;
+}
+var init_console = __esm({
+  "src/console.ts"() {
+    "use strict";
+    init_cloud();
+  }
+});
+
 // src/mcp.ts
 var mcp_exports = {};
 __export(mcp_exports, {
@@ -34957,35 +35172,171 @@ var init_mcp = __esm({
   }
 });
 
+// src/conformance.ts
+var conformance_exports = {};
+__export(conformance_exports, {
+  runConformance: () => runConformance
+});
+import { spawnSync as spawnSync5 } from "node:child_process";
+import { cpSync, existsSync as existsSync13, mkdirSync as mkdirSync11, mkdtempSync as mkdtempSync4, readFileSync as readFileSync12, rmSync as rmSync6, symlinkSync, writeFileSync as writeFileSync12 } from "node:fs";
+import { createRequire as createRequire3 } from "node:module";
+import { tmpdir as tmpdir3 } from "node:os";
+import { dirname as dirname4, join as join17, resolve as resolve5 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+function installedPackage(name, from) {
+  const require2 = createRequire3(join17(from, "package.json"));
+  const entry = require2.resolve(name === "@githolon/testing" ? name : `${name}/package.json`);
+  for (let directory2 = dirname4(entry); ; directory2 = dirname4(directory2)) {
+    const manifest = join17(directory2, "package.json");
+    if (existsSync13(manifest)) {
+      const pkg = JSON.parse(readFileSync12(manifest, "utf8"));
+      if (pkg.name === name) return { name, version: pkg.version, directory: directory2 };
+    }
+    if (dirname4(directory2) === directory2) throw new Error(`Cannot identify installed ${name}`);
+  }
+}
+function runConformance(args, cwd = process.cwd()) {
+  let json = false, offline = false, runtime;
+  for (let index = 0; index < args.length; index++) {
+    const arg = args[index];
+    if (arg === "--json") json = true;
+    else if (arg === "--offline") offline = true;
+    else if (arg === "--runtime" && args[index + 1] && !args[index + 1].startsWith("--")) runtime = resolve5(cwd, args[++index]);
+    else {
+      process.stderr.write(`error: unknown or incomplete conformance option: ${arg}. See githolon conformance --help.
+`);
+      return 2;
+    }
+  }
+  const report = { passed: false, packages: [], checks: [] };
+  let scratch;
+  let stage = "installed packages";
+  let action = "Run npm install in this project. Install githolon, @githolon/dsl and @githolon/testing as development dependencies if absent.";
+  try {
+    const packages = ["githolon", "@githolon/dsl", "@githolon/testing"].map((name) => {
+      const pkg = installedPackage(name, cwd);
+      report.packages.push({ name, version: pkg.version });
+      return pkg;
+    });
+    const [cli, dsl] = packages;
+    const peer2 = installedPackage("@githolon/runtime", dsl.directory);
+    report.packages.push({ name: peer2.name, version: peer2.version });
+    report.checks.push({ name: stage, passed: true });
+    if (!json) {
+      process.stdout.write("Nomos conformance \u2014 isolated generated application, real local runtime\n");
+      for (const pkg of report.packages) process.stdout.write(`  ${pkg.name} ${pkg.version}
+`);
+    }
+    scratch = mkdtempSync4(join17(tmpdir3(), "nomos-conformance-"));
+    const here = dirname4(fileURLToPath2(import.meta.url));
+    const distribution = existsSync13(join17(here, "conformance-probe.mjs")) ? here : resolve5(here, "../dist");
+    cpSync(join17(distribution, "conformance-fixture"), scratch, { recursive: true });
+    writeFileSync12(join17(scratch, "package.json"), '{"name":"nomos-conformance-probe","private":true,"type":"module"}\n');
+    const modules = join17(scratch, "node_modules");
+    mkdirSync11(join17(modules, "@githolon"), { recursive: true });
+    for (const pkg of [dsl, peer2]) {
+      symlinkSync(pkg.directory, join17(modules, pkg.name), process.platform === "win32" ? "junction" : "dir");
+    }
+    const environment = { ...process.env, TMPDIR: scratch, TMP: scratch, TEMP: scratch };
+    const run2 = (argv) => {
+      const result = spawnSync5(process.execPath, argv, {
+        cwd: scratch,
+        env: environment,
+        encoding: "utf8",
+        timeout: 18e4,
+        maxBuffer: 8 * 1024 * 1024
+      });
+      if (result.error) throw result.error;
+      if (result.status !== 0) throw new Error((result.stderr || result.stdout || `Exited ${result.status}`).slice(-6e3));
+    };
+    stage = "compile generated application";
+    action = "Reinstall compatible githolon and @githolon/dsl versions from your lockfile. If this bundled fixture still fails, report the diagnostic and package versions to Nomos.";
+    if (!json) process.stdout.write(`Checking ${stage}\u2026
+`);
+    run2([join17(cli.directory, "dist/cli.mjs"), "compile", "--no-mount-check"]);
+    report.checks.push({ name: stage, passed: true });
+    stage = "runtime and application behavior";
+    action = "Check the selected runtime and installed @githolon/testing version. For an uncached runtime, run once online or supply a verified runtime directory with --runtime. Report repeatable behavior failures with this report.";
+    if (!json) process.stdout.write(`Checking ${stage}\u2026
+`);
+    const resultFile = join17(scratch, "result.json");
+    const testingEntry = createRequire3(join17(cwd, "package.json")).resolve("@githolon/testing");
+    const probe = spawnSync5(process.execPath, [
+      join17(distribution, "conformance-probe.mjs"),
+      testingEntry,
+      scratch,
+      resultFile,
+      runtime ?? "",
+      String(offline)
+    ], {
+      cwd: scratch,
+      env: environment,
+      encoding: "utf8",
+      timeout: 18e4,
+      maxBuffer: 8 * 1024 * 1024
+    });
+    if (existsSync13(resultFile)) {
+      const result = JSON.parse(readFileSync12(resultFile, "utf8"));
+      report.checks.push(...result.checks);
+      if (result.runtime) report.runtime = result.runtime;
+      if (result.failure) report.failure = result.failure;
+      report.passed = result.passed && probe.status === 0;
+    }
+    if (!report.passed && !report.failure) throw probe.error ?? new Error((probe.stderr || probe.stdout || `Probe exited ${probe.status}`).slice(-6e3));
+  } catch (error) {
+    report.checks.push({ name: stage, passed: false });
+    report.failure = { stage, detail: error instanceof Error ? error.message : String(error), action };
+  } finally {
+    if (scratch) rmSync6(scratch, { recursive: true, force: true });
+  }
+  if (json) process.stdout.write(JSON.stringify(report, null, 2) + "\n");
+  else {
+    if (report.runtime) process.stdout.write(`Kernel SHA-256: ${report.runtime.kernelSha256}
+`);
+    for (const check2 of report.checks) process.stdout.write(`${check2.passed ? "PASS" : "FAIL"} ${check2.name}${check2.detail ? ` \u2014 ${check2.detail}` : ""}
+`);
+    if (report.failure) process.stderr.write(`${report.failure.detail}
+Next: ${report.failure.action}
+`);
+    process.stdout.write(report.passed ? "PASS \u2014 installed Node stack conforms.\n" : "FAIL \u2014 conformance did not pass.\n");
+  }
+  return report.passed ? 0 : 1;
+}
+var init_conformance = __esm({
+  "src/conformance.ts"() {
+    "use strict";
+  }
+});
+
 // src/test.ts
 var test_exports = {};
 __export(test_exports, {
   resolveTestCloudEntry: () => resolveTestCloudEntry,
   runDartTests: () => runDartTests
 });
-import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync13 } from "node:fs";
-import { dirname as dirname4, resolve as resolve5 } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { spawnSync as spawnSync6 } from "node:child_process";
+import { existsSync as existsSync14 } from "node:fs";
+import { dirname as dirname5, resolve as resolve6 } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 function resolveTestCloudEntry(options = {}) {
   const cwd = options.cwd ?? process.cwd();
   const environment = options.environment ?? process.env;
   const explicit = environment.NOMOS_TEST_CLOUD_ENTRY;
   if (explicit !== void 0) {
-    const candidate = resolve5(cwd, explicit);
-    if (!existsSync13(candidate)) {
+    const candidate = resolve6(cwd, explicit);
+    if (!existsSync14(candidate)) {
       throw new Error(`NOMOS_TEST_CLOUD_ENTRY does not exist: ${candidate}`);
     }
     return candidate;
   }
-  const here = dirname4(fileURLToPath2(options.moduleUrl ?? import.meta.url));
+  const here = dirname5(fileURLToPath3(options.moduleUrl ?? import.meta.url));
   const candidates = [
-    resolve5(here, "dev-server.mjs"),
-    resolve5(here, "../dist/dev-server.mjs"),
-    resolve5(here, "../../platform-shells/node/local-development/server.ts"),
-    resolve5(cwd, "platform-shells/node/local-development/server.ts")
+    resolve6(here, "dev-server.mjs"),
+    resolve6(here, "../dist/dev-server.mjs"),
+    resolve6(here, "../../platform-shells/node/local-development/server.ts"),
+    resolve6(cwd, "platform-shells/node/local-development/server.ts")
   ];
-  const server = candidates.find((candidate) => existsSync13(candidate));
+  const server = candidates.find((candidate) => existsSync14(candidate));
   if (server === void 0) {
     throw new Error("the bundled local Nomos cloud is missing \u2014 rebuild or reinstall githolon");
   }
@@ -35003,7 +35354,7 @@ function runDartTests(args) {
     return 1;
   }
   process.stdout.write("githolon test \u2014 generated application scenarios with real local custody\n");
-  const result = spawnSync5("flutter", ["test", ...forwarded], {
+  const result = spawnSync6("flutter", ["test", ...forwarded], {
     cwd: process.cwd(),
     stdio: "inherit",
     env: {
@@ -35619,7 +35970,7 @@ var init_law_command_projection = __esm({
 });
 
 // src/law_encoder.ts
-import { readFileSync as readFileSync11 } from "node:fs";
+import { readFileSync as readFileSync13 } from "node:fs";
 async function loadInstalledLaw(input) {
   const file = discoverLawUsdz(input.cwd ?? process.cwd(), input.file);
   const inspected = await inspectLawArchive(input.cloud, file);
@@ -35631,7 +35982,7 @@ async function loadInstalledLaw(input) {
     );
   }
   const projection = parseLawCommandProjection(
-    readLawClosureAsset(new Uint8Array(readFileSync11(file)), COMMAND_PROJECTION)
+    readLawClosureAsset(new Uint8Array(readFileSync13(file)), COMMAND_PROJECTION)
   );
   return { identity: inspected.identity, servedDomains: served, projection, file };
 }
@@ -35927,7 +36278,7 @@ var init_model_children = __esm({
     init_law_directive_call();
     init_law_command_projection();
     init_law_encoder();
-    sleep = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms));
+    sleep = (ms) => new Promise((resolve9) => setTimeout(resolve9, ms));
   }
 });
 
@@ -36052,7 +36403,7 @@ async function modelAdopt(workspace, opts) {
         inventory = observed;
         break;
       }
-      await new Promise((resolve8) => setTimeout(resolve8, 250));
+      await new Promise((resolve9) => setTimeout(resolve9, 250));
     } while (Date.now() < deadline);
     if (inventory === void 0) throw new Error("the active-law projection did not converge within 30 seconds");
     const candidate = inventory.domains.find((installed) => installed.domainHash === identity);
@@ -36117,8 +36468,8 @@ __export(platform_exports, {
   storeSeatDevice: () => storeSeatDevice
 });
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync14, mkdirSync as mkdirSync10, readFileSync as readFileSync12, writeFileSync as writeFileSync11 } from "node:fs";
-import { join as join16 } from "node:path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync12, readFileSync as readFileSync14, writeFileSync as writeFileSync13 } from "node:fs";
+import { join as join18 } from "node:path";
 function refuse(message) {
   throw new PlatformRefusal(message);
 }
@@ -36191,8 +36542,8 @@ async function readModelAuthority(cloud, platform, seatedAt) {
 }
 function loadSeatDevice(workspace) {
   const path4 = seatDevicePath(workspace);
-  if (!existsSync14(path4)) return void 0;
-  const stored = JSON.parse(readFileSync12(path4, "utf8"));
+  if (!existsSync15(path4)) return void 0;
+  const stored = JSON.parse(readFileSync14(path4, "utf8"));
   const publicKey = stored.publicKey ?? (stored.publicKeyHex === void 0 ? void 0 : Buffer.from(stored.publicKeyHex, "hex").toString("base64"));
   if (typeof stored.secret !== "string" || publicKey === void 0 || typeof stored.keyHash !== "string") {
     refuse(`${path4} is not a stored device key {secret, publicKey, keyHash}`);
@@ -36201,8 +36552,8 @@ function loadSeatDevice(workspace) {
 }
 function storeSeatDevice(workspace, device) {
   const path4 = seatDevicePath(workspace);
-  mkdirSync10(join16(path4, ".."), { recursive: true });
-  writeFileSync11(path4, JSON.stringify(device, null, 2) + "\n", { mode: 384 });
+  mkdirSync12(join18(path4, ".."), { recursive: true });
+  writeFileSync13(path4, JSON.stringify(device, null, 2) + "\n", { mode: 384 });
 }
 async function mintSeatDevice(cloud) {
   const generated = await generateDeviceKey(cloud);
@@ -36425,7 +36776,7 @@ async function platformAuthor(workspace, directiveId, opts) {
   }
 }
 function readPayload(opts) {
-  const raw = opts.payloadFile !== void 0 ? readFileSync12(opts.payloadFile, "utf8") : opts.payload;
+  const raw = opts.payloadFile !== void 0 ? readFileSync14(opts.payloadFile, "utf8") : opts.payload;
   if (raw === void 0 || raw.trim() === "") refuse("author needs --payload <json> or --payload-file <file>");
   let parsed;
   try {
@@ -36617,7 +36968,7 @@ async function waitFor(condition, deadlineMillis, report) {
       announced = elapsed;
       report(elapsed);
     }
-    await new Promise((resolve8) => setTimeout(resolve8, 1e3));
+    await new Promise((resolve9) => setTimeout(resolve9, 1e3));
   }
   return false;
 }
@@ -36637,7 +36988,7 @@ var init_platform = __esm({
     PlatformRefusal = class extends Error {
     };
     ws = (name) => encodeURIComponent(name);
-    seatDevicePath = (workspace) => join16(configDir(), `seat-device-${workspace}.json`);
+    seatDevicePath = (workspace) => join18(configDir(), `seat-device-${workspace}.json`);
     SEAT_CONVERGENCE_MILLIS = 18e4;
   }
 });
@@ -36703,9 +37054,9 @@ var init_dlq = __esm({
 
 // src/custodian.ts
 import { createHash as createHash7, createPrivateKey as createPrivateKey2, createPublicKey as createPublicKey2 } from "node:crypto";
-import { existsSync as existsSync15, readFileSync as readFileSync13 } from "node:fs";
-import { dirname as dirname5, isAbsolute as isAbsolute3, join as join17, resolve as resolve6 } from "node:path";
-import { fileURLToPath as fileURLToPath3, pathToFileURL as pathToFileURL3 } from "node:url";
+import { existsSync as existsSync16, readFileSync as readFileSync15 } from "node:fs";
+import { dirname as dirname6, isAbsolute as isAbsolute3, join as join19, resolve as resolve7 } from "node:path";
+import { fileURLToPath as fileURLToPath4, pathToFileURL as pathToFileURL3 } from "node:url";
 import { create as create80 } from "@bufbuild/protobuf";
 import { AnySchema as AnySchema3 } from "@bufbuild/protobuf/wkt";
 function custodianKeyHash(seed) {
@@ -36751,8 +37102,8 @@ async function resolveCustodianCredential(reference) {
     return fromSeed(custodianSeedFromText(device.secret, `~/.holon device key for ${rest}`), reference);
   }
   if (scheme === "file") {
-    if (rest === "" || !existsSync15(rest)) throw new Error(`--custodian-key file:<path> \u2014 no file at '${rest}'`);
-    return fromSeed(custodianSeedFromText(readFileSync13(rest, "utf8"), rest), `file:${rest}`);
+    if (rest === "" || !existsSync16(rest)) throw new Error(`--custodian-key file:<path> \u2014 no file at '${rest}'`);
+    return fromSeed(custodianSeedFromText(readFileSync15(rest, "utf8"), rest), `file:${rest}`);
   }
   if (scheme === "env") {
     const value = process.env[rest];
@@ -36778,8 +37129,8 @@ async function resolveCustodianCredential(reference) {
 }
 function readCustodianChain(file) {
   if (file === void 0) return [];
-  if (!existsSync15(file)) throw new Error(`--chain <file> \u2014 no file at '${file}'`);
-  const parsed = JSON.parse(readFileSync13(file, "utf8"));
+  if (!existsSync16(file)) throw new Error(`--chain <file> \u2014 no file at '${file}'`);
+  const parsed = JSON.parse(readFileSync15(file, "utf8"));
   const links = Array.isArray(parsed) ? parsed : typeof parsed === "object" && parsed !== null && Array.isArray(parsed.certChain) ? parsed.certChain : void 0;
   if (links === void 0) {
     throw new Error(
@@ -36829,10 +37180,10 @@ function scarFromVerdict(verdict) {
 }
 function frameworkReceptionPath(here = moduleDirectory()) {
   const candidates = [
-    join17(here, "framework", "nomos.reception.mjs"),
-    resolve6(here, "../../cloud/cloudflare-shell/domains/build/nomos/nomos.reception.mjs")
+    join19(here, "framework", "nomos.reception.mjs"),
+    resolve7(here, "../../cloud/cloudflare-shell/domains/build/nomos/nomos.reception.mjs")
   ];
-  const found = candidates.find((candidate) => existsSync15(candidate));
+  const found = candidates.find((candidate) => existsSync16(candidate));
   if (found === void 0) {
     throw new Error(
       "the framework controller's compiled Reception is missing \u2014 reinstall `githolon`, or compile it with `node dsl/compile_package.mjs domain_nomos.nomos.project.ts` in cloud/cloudflare-shell/domains"
@@ -36841,8 +37192,8 @@ function frameworkReceptionPath(here = moduleDirectory()) {
   return found;
 }
 async function encodeDirectiveCall(receptionPath, domain, directiveId, workspace, payload) {
-  const absolute = isAbsolute3(receptionPath) ? receptionPath : resolve6(process.cwd(), receptionPath);
-  if (!existsSync15(absolute)) throw new Error(`--reception <path> \u2014 no compiled Reception at '${absolute}'`);
+  const absolute = isAbsolute3(receptionPath) ? receptionPath : resolve7(process.cwd(), receptionPath);
+  if (!existsSync16(absolute)) throw new Error(`--reception <path> \u2014 no compiled Reception at '${absolute}'`);
   const module = await import(pathToFileURL3(absolute).href);
   const frameworkCalls = module["nomosFrameworkCalls"];
   if (typeof frameworkCalls === "object" && frameworkCalls !== null) {
@@ -36907,7 +37258,7 @@ async function encodeDirectiveCall(receptionPath, domain, directiveId, workspace
   return captured;
 }
 function readPayload2(opts) {
-  const text2 = opts.payloadFile !== void 0 ? readFileSync13(opts.payloadFile, "utf8") : opts.payload;
+  const text2 = opts.payloadFile !== void 0 ? readFileSync15(opts.payloadFile, "utf8") : opts.payload;
   if (text2 === void 0) throw new Error("pass the directive's payload with --payload <json> or --payload-file <file>");
   const parsed = JSON.parse(text2);
   if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
@@ -37121,7 +37472,7 @@ var init_custodian = __esm({
       [/forged-principal|ForgedPrincipal|VERIFIED author/i, "ForgedPrincipal"],
       [/bad-signature|BadSignature/i, "BadSignature"]
     ];
-    moduleDirectory = () => dirname5(fileURLToPath3(import.meta.url));
+    moduleDirectory = () => dirname6(fileURLToPath4(import.meta.url));
     CapturedCall = class extends Error {
       constructor() {
         super("call captured");
@@ -37247,9 +37598,9 @@ Options
 });
 
 // src/cli.ts
-import { existsSync as existsSync16, readFileSync as readFileSync14 } from "node:fs";
-import { dirname as dirname6, join as join18, resolve as resolve7 } from "node:path";
-import { pathToFileURL as pathToFileURL4, fileURLToPath as fileURLToPath4 } from "node:url";
+import { existsSync as existsSync17, readFileSync as readFileSync16 } from "node:fs";
+import { dirname as dirname7, join as join20, resolve as resolve8 } from "node:path";
+import { pathToFileURL as pathToFileURL4, fileURLToPath as fileURLToPath5 } from "node:url";
 
 // src/generate.ts
 import { mkdirSync, existsSync, writeFileSync } from "node:fs";
@@ -37761,6 +38112,7 @@ var USAGE2 = `githolon \u2014 model a business; Nomos owns the compute science
 Start here:
   githolon compile                 compile aggregates, birth, directives, and reads into law + a typed client
   githolon test                    run generated Dart scenarios with real local custody
+  githolon conformance             check the installed stack with an isolated generated application
   githolon check                   explain anything the law can already prove it would refuse
 
 The application surface is one idea:
@@ -37949,6 +38301,9 @@ async function main(argv) {
     process.stdout.write(USAGE2);
     return 0;
   }
+  if (argv[0] === "console") {
+    return (await Promise.resolve().then(() => (init_console(), console_exports))).consoleCommand(argv.slice(1));
+  }
   if (argv[0] === "compile") {
     return runCompileCommand(argv.slice(1));
   }
@@ -37966,6 +38321,9 @@ async function main(argv) {
     const { initEditor: initEditor2 } = await Promise.resolve().then(() => (init_editor(), editor_exports));
     return initEditor2(process.cwd());
   }
+  if (argv[0] === "conformance") {
+    return (await Promise.resolve().then(() => (init_conformance(), conformance_exports))).runConformance(argv.slice(1));
+  }
   if (argv[0] === "test") {
     const { runDartTests: runDartTests2 } = await Promise.resolve().then(() => (init_test(), test_exports));
     return runDartTests2(argv.slice(1));
@@ -37989,18 +38347,18 @@ async function main(argv) {
 ${commandHelp("cloud") ?? USAGE2}`);
       return 1;
     }
-    const { spawnSync: spawnSync6 } = await import("node:child_process");
-    const here = dirname6(fileURLToPath4(import.meta.url));
+    const { spawnSync: spawnSync7 } = await import("node:child_process");
+    const here = dirname7(fileURLToPath5(import.meta.url));
     const candidates = [
-      resolve7(here, "dev-server.mjs")
+      resolve8(here, "dev-server.mjs")
       // published: dist/dev-server.mjs
     ];
-    const serverPath = candidates.find((p) => existsSync16(p));
+    const serverPath = candidates.find((p) => existsSync17(p));
     if (!serverPath) {
       process.stderr.write("error: dev-server not found \u2014 reinstall `githolon` or run `npm run build` in the cli package\n");
       return 1;
     }
-    const r = spawnSync6(process.execPath, [serverPath, ...argv.slice(2)], { stdio: "inherit" });
+    const r = spawnSync7(process.execPath, [serverPath, ...argv.slice(2)], { stdio: "inherit" });
     return r.status ?? 0;
   }
   if (argv[0] === "status") {