nomos_client 0.64.39

Nomos 2 Dart client — generated domain values, intent payloads and application lifecycle types over the typed Nomos kernel protocol and USDA custody model.

0.64.39

• Resolve kernel compatibility through typed OSGi Contract Namespace requirements and OpenUSD candidate custody, removing the private JSON selection and feature-manifest formats from generated hosts.

0.64.38

• Acquire the runtime provider's protocol-compatible, content-addressed kernel selection instead of requiring the package's original kernel digest. Retain verified selections for offline proofs without bundling executable bytes.

0.64.37

• Restaged with the current kernel candidate: regenerated vendored assets (kernel release identity is baked into them). Published pub.dev archives are immutable, so regenerated bytes ride their own version.

0.64.36

• Restaged with the current kernel candidate: regenerated vendored assets (kernel release identity is baked into them). Published pub.dev archives are immutable, so regenerated bytes ride their own version.

0.64.35

• Match application home birth certificates to the locally sealed parent offer's CAS-as-law verification verdict.

0.64.34

• Keep the typed birth certificate on the birth offer only, so preliminary signer enrolment can settle before generated business APIs open.

0.64.33

• Converge arbitrary historical generated-model backlogs while failing a genuinely repeated immutable lifecycle step with a typed stall error.

0.64.32

• Prove a restored generated-application device is enrolled before exposing business APIs, including recovery from an interrupted bootstrap journal.

0.64.31

• Restage the validated intent-offer byte gate and deterministic signer-posture reader into the immutable Dart runner.

0.64.30

• Recover an authenticated generated application's replacement device through the established repeated-birth compatibility lane when guardian policy refuses keyless enrolment.
• Resolve signer posture from the relation tuple's deterministic aggregate address so composed application law cannot make framework query aliases ambiguous.

0.64.29

• Restaged with the current kernel candidate: regenerated vendored assets (kernel release identity is baked into them). Published pub.dev archives are immutable, so regenerated bytes ride their own version.

0.64.28

• Restaged with the current kernel candidate: regenerated vendored assets (kernel release identity is baked into them). Published pub.dev archives are immutable, so regenerated bytes ride their own version.

0.64.27

• Make https://nomos.cafe the sole default Nomos Cloud surface used by the WebView bridge. The published Dart runtime no longer points at the retired Captain App hostname.

0.64.26

• Restaged with the current kernel candidate: regenerated vendored assets (kernel release identity is baked into them). Published pub.dev archives are immutable, so regenerated bytes ride their own version.

0.64.25

• Rebuild the vendored Dart runner from @githolon/client 0.105.8. Web-client source is an input to this immutable pub.dev archive, so the Dart package now advances whenever that source changes.

0.64.24

• Restaged with the current kernel candidate: regenerated vendored assets (kernel release identity is baked into them). Published pub.dev archives are immutable, so regenerated bytes ride their own version.

0.64.23

• Rebuild the self-contained runner without the retired structural-interface sidecar assumption; compatibility is carried by the generated client and offered by installed USDA.
• Depend on nomos_types 0.8.7 so JSON-valued domain objects retain fields alongside value.

0.64.22

• connect() no longer manufactures a custody verdict from an unrelated failure. A boot error propagates as itself; nomos.custody.snapshot_corrupt is raised only by the snapshot reader that found the bytes unreadable, so a transient network fault cannot trigger quarantine-and-reclone of healthy local custody.

0.64.21

• NEW: Realm.snapshot(name) — export one workspace's exact resident custody without manufacturing a runner session. A generated birth can leave a child resident in the shared kernel before application code acquires it, so host persistence cannot be defined as "every connected session": mounted, parked and born-but-unopened residents all export. This is what makes a locally-born estate survive a close.
• Snapshots carry the workspace they belong to. Restoring one into a DIFFERENT workspace is now a typed recoverable error rather than a silent misinterpretation, and a corrupt v2 envelope is refused instead of being decoded as legacy binary custody.
• The kernel's colocated-read residency refusal is recognised and satisfied on the device runner lane, matching the cloud.
• Restaged with the current kernel candidate: regenerated vendored assets (kernel release identity is baked into them). Published pub.dev archives are immutable, so regenerated bytes ride their own version.

0.64.20

• NEW: bridge.localWorkRejectedEvents — a typed stream of NomosLocalWorkRejectedEvent (from nomos_types 0.8.6) forwarded over the runner bridge, so apps render honest UX ("queued, will retry" vs "preserved for review — contact support") instead of scraping raw refusal prose.
• parentSignerEnrollment gains remote: true — force the CLOUD-gateway read even when this holon IS the parent: the seated barrier's proof-by-read (enrolled there ⇒ durably in custody, not merely locally folded).
• Rebuild the bundled runner from @githolon/client 0.105.5 (the seal-obligation release: footage-first offer lane, scoreboard truth, FF-only seals, seal retry, no-evict-while-dirty).

0.64.19

• Rebuild the bundled runner assets from @githolon/client 0.105.3: fixes ensureParentSignerEnrollment routing enrollFirstDevice when the caller is already connected directly to the target workspace (parent === workspace) — the local structural lookup can never find it (deliberately absent from public business OpenAPI), and the framework-route fallback was previously gated to skip exactly this case.

0.64.18

• Restaged with the current kernel candidate: regenerated vendored assets (kernel release identity is baked into them). Published pub.dev archives are immutable, so regenerated bytes ride their own version.

0.64.17

• Rebuild the bundled runner assets from @githolon/client 0.104.0 (the evolve-on-read release). Published pub.dev archives are immutable, so regenerated runtime bytes need their own version.

0.64.16

• Rebundle the runner runtime (node-entry.mjs, offline-install.mjs) generated from @githolon/client 0.103.19, which carries the evolve-gate fix: promoteDomain dispositions are read from the law that DECLARES the call, so a law upgrade with a genuine field/aggregate removal is promotable through the offer lane.

0.64.15

• DomainClientModelAdoptionRequired.accept gains an optional dispositions parameter, threaded through to the bridge's nomosFrameworkAdoptGeneratedModel — a tenant can now acknowledge a genuine field/aggregate removal ({"retired": [sid, ...]}) from a generated client's model.adopt() decision instead of only via a raw adapter script.

0.64.14

• Resolve framework-private first-device offers through the application law's concrete home route, and distinguish a merely installed model from the model currently serving generated application writes.

0.64.13

• Preserve cross-replica foreign-read identity with the canonical USDA state root while treating the Git commit as a replica-local custody hint; the shared kernel resolves and rederives the resident source state.

0.64.12

• Preserve a clean resident unborn workspace across successive offers so framework genesis remains colocated until its first durable push; only an actual failed restore is discarded for a dependency-ready retry.

0.64.11

• Preserve typed, kernel-proved cross-workspace residency through cold cloud restore while removing duplicate verification replay and timeout retry amplification. The host supplies exact sibling custody bytes but never authors, attests or decides a foreign read.

0.64.10

• Single-flight each generated child open on the process-wide kernel plane, reuse resident sibling custody for foreign reads, and restore every generated child from framework-owned local custody before consulting cloud transport. Typed kernel refusals and the offer gate remain the only authority path.

0.64.9

• Cache the installed structural law interface across generated domain binding, eliminating repeated full-interface kernel reads while retaining governed invalidation on replay and law changes.

0.64.8

• Deduplicate structurally identical workspace and application status snapshots while still seeding every new listener, preventing periodic metrics refreshes from rebuilding otherwise unchanged applications.

0.64.7

• Bound generated application startup and referenced-workspace opens, preserving typed custody failures and retryable custody while keeping law adoption inside the generated lifecycle.
• Preserve compound action output contracts through generated clients.

0.64.6

• Publish the complete generated-application runtime already present in the coordinated source release, including typed operation receipts, model changes, custody actions and staged-model handling.
• Refuse to treat an occupied pub.dev version as released unless its runtime library and package metadata byte-match the current checkout.

0.64.5

• Consume nomos_types 0.8.3 so custody object identities remain typed through generated clients.
• Dispatch generated reads through protobuf enum variants and preserve Nomos value kinds end to end, eliminating the generic JSON request envelope from the kernel boundary.
• Execute framework births, genesis and common read plans as typed USDA-native recipes while retaining tenant-authored JSON only as an explicit presentation edge.

0.64.4

• Require generated applications to seed explicit child-birth and workspace policies before first use; missing law remains a typed kernel refusal instead of a compiled allowance or creation fallback.
• Keep application startup single-flight and bounded through authentication, custody restore, law install and client binding so concurrent UI consumers share one lifecycle and one actionable result.

0.64.3

• Single-flight generated child-workspace acquisition and continuous sync so concurrent references share one open, one lifecycle result and one error rather than cloning or registering the same workspace twice.
• Generate separate shared-workspace reads so applications can render denormalized owned-workspace cards without eagerly opening every founded child merely to discover genuinely shared lives.

0.64.2

• Execute generated applications through the typed USDA-native kernel boundary, including native read recipes, sealed offer diagnostics and lawful self-serve birth retries after typed kernel refusals.
• Remove the legacy JSON deployment and bridge paths so tenant type errors continue to originate at the kernel boundary used in production.

0.64.1

• Resolve a compiled OpenUSD application as one ordered package set in generated offline and connected scenarios, keeping reference-only control law off user replicas while payload law births their workspaces.
• Pin source and published test runs to the exact coordinated kernel release, and make restart, reconnect and clean reinstall use the same hidden multi-workspace custody lifecycle.
• Seat every business workspace founder on its private transport relation at genesis so public business records can coexist with framework-private identity state and still reopen on a fresh device.

0.64.0

• Generate one self-documenting application object: intent-shaped business actions at the root, typed aggregate collections for reads and navigation, aggregate-specific conflict decisions, and verified activity. The generated application is the application state; raw runtime clients are private.
• Let one intent atomically create and ensure any number of aggregate consequences. Every created record and reference-bearing query uses NomosRef<T>; secondary ensures keep their aggregate identity through compilation and admission.
• Generate restart-safe offline scenarios and ownership-aware proofs while keeping keys, certificates, signers, warrants, topology and retry machinery outside the tenant API.
• Mark the generator-only runtime library internal, so tenant imports receive an analyzer refusal while compiler-generated application code retains the sole intentional implementation bridge.

0.63.1

• Make automatic sync a truthful client-owned lifecycle: local acceptance is durable, offline/restored sessions remain usable, reconnect converges parent before child, and failed/offline sync never reports a successful timestamp.
• Make home bootstrap and designated recovery resumable across interruption, exposing one typed next action while keeping identity proofs, signers, custody wrapping and retry state private.
• Expand the generated CO2 gauntlet through application, home, Estate, Site and Asset with two offline devices, process restart, conflict merge, automatic convergence and cold replay.

0.63.0

• Generated clients now expose business-first conflict policy, schema-aware merge continuation and recursive organisation descriptions. The client privately owns lifecycle discovery, parent/child traversal, signer custody and replay; applications follow typed business references rather than framework routes.

0.62.2

• Make NomosTestHarness own a complete, verifiable local trust lineage. Tests still bind a business actor and call the generated birth method; the harness privately mints its test root, seats the signer and delegation, lands the warrant in order, and refuses any child whose full chain does not replay to that root.

0.62.1

• Align the public Dart documentation with the one Flutter application entry point: identity comes from the token passed to NomosScope.home(application:, authToken:); application code no longer supplies a subject or device-token callback.

0.62.0

• Generated business clients expose one birth(payload) method. The bound session supplies its verified principal from the authentication token, and Nomos owns the identity, provenance, persistence, and recovery ceremony beneath the business call.

0.61.3

• cloudBound seeds the KEYLESS enroll-once delegation (mintKeylessDelegation) so a keyless private home is born with a well-formed cert chain (was: platform_cert in the delegation slot → self-refusal).

0.61.2

• cloudBound works against PRIVATE platforms/homes (declared read caps — the co2 shape): the device ceremony uses a LOCAL scratch session (never clones the platform), and the born home mounts with the dev-IdP token when the caller passes none (a private ledger serves only a VERIFIED principal).

0.61.1

• Runner entry resolution prefers the BUILT @githolon/client/runner/node-entry.mjs (published consumers: node refuses type-stripping under node_modules, so the raw .ts entry only booted in-repo — DEFECT P3-002).

0.61.0

• ERA-0 cloud-bound harness — NomosTestHarness.cloudBound now runs the full WARRANTED onboarding ceremony against the test cloud: the platform is BORN warranted+attested at cloud boot (NomosTestCloud.start(platform:, deployJsonPath:)), the owner's device enrols through the REAL first-device lane (/dev/mint-token → enrollFirstDevice), and birthHome is device-signed + attested with ownerKeyHash (the born home is SIGNER-READY — it births estates/catalogues offline from intent 0). Six named phases, all deadlined.
• NomosTestCloud.start(platform:, deployJsonPath:) — the dev cloud stands the platform up at boot (era-0: the host does not create workspaces; the harness's old POST-create refuses 409 by design). /health gates on platformReady: true so clients never race the ceremony.
• acquireSession(…, authorSecret:) — sign a locally-born (warranted) child session's writes with its owner's device key; deviceSecret(workspace)/devicePublicKey(workspace) expose the harness device (the harness IS the device) for .births() payload ownerKeyHash derivation.
• Requires githolon/@githolon/client ≥ the era-0 release (the client auto-signs self-serve birth certs on the kernel's typed birth-unattestable refusal — apps never hand-roll certs).

0.56.0

• NomosTestCloud (co2 #4) — a headless, cloud-BOUND real-sync test harness: start/stop a local githolon cloud dev (the same engine plane production runs), an online/offline PARTITION proxy (setOnline) for deterministic link sever/heal, and remote head/commit inspection (remoteHead). Sessions connect cloud-bound to cloud.origin; sync/convergence uses the existing bridge.sync.
• Typed snapshot lifecycle on NomosTestHarness (co2 #5) — snapshotWorkspace/snapshotPlane and restoreWorkspace/restorePlane over the per-workspace export()/connect(restoreFrom:) primitives, with typed WorkspaceSnapshot/PlaneSnapshot (JSON round-trip, session/workspace metadata). Migrate staged AppSim snapshots mechanically — no reaching into custody internals.
• assertCompatible surfaces a projection read failure (co2 #2) as a distinct projectionReadFailed cause (carrying the failed query) instead of reclassifying an evicted/failed session as trulyNotDeployed.

0.55.2

• Session-state DX (co2): explicit workspace lifecycle state on listWorkspaces() — connected | resident | parked — so a listed-but-unopened workspace (e.g. a locally-born child) is distinguishable at a glance, ending the "listed but session(ws) fails on first op" footgun.
• NomosRef.acquire(bridge) — open a born/resident ref directly: await outcome.bornRefs.single.acquire(bridge) (sugar over acquireSession, keyed by the ref's workspace).
• NomosSession.isConnected + assertConnected() — the fail-at-bind guard: a clear, actionable StateError instead of an opaque "session is not connected" on the first read/write.
• Patch bump — keeps the exact-minor ^0.55.0 pins valid, no generated-client re-pin needed.

0.55.1

• Add deriveWorkspaceName(namespace, key) — re-derive the workspace name a keyed birth (birth.keyed) produced, so a born workspace is addressable from its key with zero persistence (byte-identical to @githolon/dsl + @githolon/client; contract-tested vectors). Replaces hand-rolled <x>WorkspaceFor<Id> helpers.
• Expose bridge.issueDelegationCert({signerSecret, grantorId, relation, subject, epoch, certChain}) — issue a role-delegation cert (the .delegatedRole() lane) from the public client; deliver via acceptDelegatedRole. Runner bundle rebuilt.

0.55.0

• Security: enrollSigner self-binds (device can only enroll itself; cross-principal forgery closed by construction, offline-secure). Client lifecycle fixes from the adversarial sweep: watches survive LRU park/remount (realm-owned rebind registry — no more silent watch death), DLQ recovery never drops salvage on offline/unborn planes, a failed connect leaves no phantom session, evicted handles throw typed nomos.session.disposed, and query()/queryById() throw on a read-forbidden verdict. Per-offer authorSecret threads to the signing path. Requires bundle >= 0.80.0.

0.54.2

• Runner-bundle floor -> 0.79.0 (the fixed-group npm lift; 0.54.1 was published mid-release with the 0.78.1 floor — runtime-equivalent, this aligns the published package with the paired bundle exactly).

0.54.1

• Fix: principal normalization mismatch in signer recovery — enrollment wrote identity:user:<uid>#signer (the kernel-canonical captured principal) while the posture/preflight reads stripped user: and reported false missing-signer-enrollment immediately after a successful repair. One canonical normalizer now routes every surface; co2's five-step acceptance (repair → immediate enrolled:true → canAuthor ok → birth admits) is the regression test, with user:-shaped principals, proven failing-then-passing. Typed authz diagnosis now also rides the createWorkspace relay (no more generic 422).

0.54.0

• Parent-signer recovery (the reborn-parent scar): ensureParentSignerEnrollment(...) — idempotent verify-and-repair of identity:<uid>#signer on a configured parent (one relation read when healthy; lawful repair via the discovered signing directive — enrollSigner pre-warrant, the keyless enrollFirstDevice lane on a warranted parent); parentSignerEnrollment(...) posture read; devicePublicOf(secret).
• canAuthor(directiveId, ...) preflight — evaluates the gate's premises read-only and returns the typed verdict ({actor, keyHash, cause}) BEFORE the user fills a form; NomosSession.canAuthorTyped throws the typed error.
• Gate refusals classify into nomos.authz.* typed errors (see nomos_types 0.4.0). Requires the paired runner bundle >= 0.78.0.

0.53.0

• Stale-baked-bundle detection. The runner bundle stamps its release version into the ready frame (build-time injected — it cannot lie); the bridge refuses an older or pre-stamp bundle at boot with the typed StaleRunnerBundle naming found/expected and the flutter clean remedy. Flutter silently keeping an old baked bundle across a pub upgrade is now a one-line error at app start instead of behavioral archaeology. allowStaleRunnerBundle: true is the deliberate mixed-version escape hatch. Requires the paired runner bundle >= 0.77.1 (nomos_flutter 0.53.7).

0.52.0

• Offer ack decoupled from watch fan-out (co2's 2.08s 3×3-grid report): the durable acknowledgement (plan + gate + fold + git write) resolves before any watch fan-out runs; the post-write nudge — including the O(law-size) compat recompute that was the bulk of the unaccounted ~1.1s — is a coalesced macrotask after the ack. Ack latency is now watcher-count-independent (fixture: 346ms with 12 watchers → 71ms flat). Read-your-writes holds (projection updates at fold time, tested); ticks are never lost (coalescing + flush-on-dispose, tested).
• Full offer span taxonomy on recentSpans/spanEvents with no new API: payload-encode, compat-preflight, bridge-ipc, gate-fold, watch-nudge, response-delivery (git-write is not separable client-side — plan+gate+fold+write is ONE wasm call). Older runner bundles degrade cleanly (no bridge-leg spans).
• Regression test for local-only sync observational inertness (offer → query → sync{localOnly} → head unchanged → same row).

0.51.0

• The burn-down wave. Dead-letter queue surface on the session plane: deadLetters(), retryDeadLetter(), discardDeadLetter(), salvage(), absorbSalvage() — with the local-only retry/absorb fixes and the salvage-shape parking fix (refused work is NEVER silently dropped). nomos_headless.dart exports the full session surface. Requires Nomos Cloud ≥ the 2026-07-11 burn-down deploy for the fleet DLQ sweep lanes (/dlq-summary, /dlq-sweep) and the content-addressed large-deploy staging lane.

0.50.1

• Structural: the session-delegation-gap class is closed. All event-dispatch registries (watch subscriptions, compat watches, custody/sync/signal/flame/span/transfer/status controllers, span buffers, session registries) now route through one _eventPlane seam that resolves to the plane owning the message loop — the base class is correct for NomosSession automatically, and all 17 hand-written per-method session overrides are DELETED (including the 0.48.1 watchPendingConflicts fix, whose regression test still passes — the proof). Five latent unreported instances of the same bug fixed en passant: session.custodyEvents (dead stream), connectedSessions (empty), connect()-on-session state stamping, checkCompat() caching, noteLocalSpan() (dead buffer). A source-level tripwire test fails the suite if a future Stream-returning method bypasses the seam.
• The first-five-minutes gauntlet — one checklist test walking the entire promised surface (deviceKeyed cluster + phase diagnostics, the blessed session-bound shape, local autoSync posture with zero-fetch assertion, acquireSession single-flight, reactive first-snapshots, attested keyed reads, custody reset/re-seed, deadline-bounded disposal) — now runs in CI on every client/runner/codegen change. Every one of this week's four tenant-reported lifecycle bugs appears as an explicit leg.

0.50.0

• No silent hangs — the standing harness property. Every NomosTestHarness lifecycle phase now has a deadline (overridable via the new phaseTimeout param) and throws a typed HarnessPhaseTimeout naming the phase (e.g. "3b: keyed reconnect of 'catalogue'"), workspace, elapsed time, the awaited bridge op, and likely causes — a wedge is a 30-second named exception, never a 40-minute bisection. Every phase logs terse enter/exit diagnostics. Disposal deadline breaches are logged, not thrown — teardown always completes.
• Keyed-reconnect lane hardened (the deviceKeyed cluster hang report): harness phase 3b (keygen + keyed reconnect) had no timeout and no diagnostics — any wedge there hung silently after "4 session(s) connected". Additionally two runner/realm defects fixed: the stale session record stayed routable during an async re-open (concurrent ops could hit the disposed holon — now an atomic replace with a fast typed refusal in the window), and a re-open with new credentials but no restoreFrom silently kept the OLD identity (the fresh authorSecret was never installed) — an identity-bearing option change now forces an in-place re-mount over resident custody.
• co2's acceptance implemented verbatim: cluster(deviceKeyed:) completes, devicePublicKey populated, colocated attested read signed by the re-opened key, disposal completes.

0.49.0

• Fix: local-only autoSync() deadlocked the multi-workspace plane. A local:// session's autoSync registered the full cloud machinery (doorbell WebSocket retry loop, fallback timers, intent-offer POSTs that could never land) — the future never completed, the runner dispatcher starved, sibling queries and listWorkspaces() hung, and teardown wedged. autoSync() on a local-only session now registers nothing and returns immediately; sync() is a true no-op (localOnly: true summary); a local:// holon performs ZERO network attempts. (co2's acceptance test implemented verbatim; failed before, passes after.)
• New: acquireSession(workspace, {ifAbsentCredentials}) — atomic single-flight session acquisition: reuses a connected session, joins an in-flight open (concurrent calls yield the same handle, one connect), opens local-only for workspaces the plane already knows (mounted/parked/resident custody — credentials never invoked), and only calls ifAbsentCredentials (exactly once) when a genuine cloud open is required.

0.48.1

• Fix: NomosSession.watchPendingConflicts() never emitted. The session overrode every other reactive read to register on the parent plane (which owns the message loop) but omitted this one — a session-bound generated client's conflict stream registered on the session's own dead controller registry and never delivered an event. Now delegates like watch/watchById/watchActivity. Regression test: a session-level subscription must emit its first snapshot. (Reported by co2 with the exact fix — thank you.)

0.48.0

• Session-bound clients (architecture/session_bound_clients.md) — generated clients now bind to exactly ONE NomosSession: XClient.bind(session) async preflight factory (structural interface compat, typed DomainClientSessionMismatch at construction), all dispatch through the session, births infer the parent from the session (no loose parent strings), engine.follow(NomosRef) mounts by ref, NomosOfferOutcome.bornRefs. The kernel's generic "no active installed law declares domain 'x'" is wrapped into the context-rich DomainNotInstalledForSession (session identity, both workspaces, active domain keys/hashes, the four possible causes).
• Root-bridge generic writes (offer/offerDirective/offerIntent/offerCreates/createWorkspace) are @Deprecated in app code — kept for CLI/admin tooling; the session-bound generated surface is the path.
• NomosSession.pendingConflicts() / watchPendingConflicts() — the maintained Surfaced-conflict "decisions needed" read (derived, not drained).
• Test harness: resetWorkspaceCustody, seedWorkspaceFromDeployJson, assertDomainInstalled, session.assertCompatible(XClient.interface).
• Requires Nomos Cloud ≥ the 2026-07-11 deploy (wasm 72604ff7 — the Surfaced/captured-basis kernel) and pairs with @githolon/dsl 0.72.0 codegen.

0.47.0

• Fix: NomosBridge.createWorkspace hardcoded domain: "workspaces" in the underlying signed offer — a tenant birthing through their OWN platform's custom law (e.g. a birthEstateWorkspace directive under a co2_platform domain) was refused, because the sealed intent always claimed domain: "workspaces" regardless of which law actually declares the requested directiveId. Added a domain parameter (default "workspaces", fully back-compatible) — call bridge.createWorkspace(domain: 'co2_platform', directiveId: 'birthEstateWorkspace', domainHash: ..., ...) to birth through a custom platform law. This release was overdue: the fix landed in nomos_flutter 0.52.2's bundled JS runtime, but this Dart-level API surface lives in nomos_client and was never republished alongside it — a real release-process gap, not a client-side workaround. Requires nomos_flutter >= 0.52.2 to match the bundled runtime behavior.

0.46.0

• Custody lifecycle on NomosBridge/NomosSession: connect(..., onCustodyBreak: CustodyBreakPolicy), custodyStatus(), the custodyEvents stream, resolveCustodyBreak() (the ask lane — put the decision in front of the user), salvagedIntents/reofferSalvaged/discardSalvaged. A rebirth/supersession is a first-class typed event: named truthfully, decided by the app, local work never silently adopted nor lost. Requires nomos_types >= 0.1.4.

0.45.0

• offerOutcome(...) — the one outcome-returning offer lane generated clients now call for EVERY directive: returns NomosOfferOutcome with workspace-stamped created (NomosCreated gains workspace + a NomosRef get ref view). Activity raw rows carry created + workspace. Requires nomos_types >= 0.1.3.

0.44.0

• Activity-feed runtime reads on NomosBridge/NomosSession: activityLog({base, limit}) — the committed intent log as raw rows {intentId, domain, directiveId, actorSubject, occurredAt, payload} (decoded payload; the verified author; the physical HLC) — and watchActivity({base}), a stream re-deriving the feed on every sync tick. Generic (raw Maps); the generated renderActivity (from directives' declared .activity() metadata) types them into ActivityEvents. Requires nomos_types >= 0.1.2.

0.43.0

• NomosBridge.foreignReader({cloud}) — a NomosForeignReader backed by the device's multi-workspace bridge plane, so a generated ForeignRef (t.foreignRef) resolves against real data: it mounts the foreign workspace on demand (connect(session: ws, allowUnborn: true), idempotent) and reads it (session(ws).queryById(id)); watch re-reads on each sync tick. A locator resolver, not a foreign key — the foreign holon is mounted only when you resolve. Requires nomos_types >= 0.1.1 (the ForeignRef types).

0.41.0

• NomosTestHarness emits named phase-progress diagnostics (install → spawn runner → await ready → connect, plus per-session progress in cluster) and each connect() carries a connectTimeout (default 120s) that throws a NAMED remedy instead of hanging — so a multi-test AppSim run can tell install vs runner-wait vs session-block vs deadlock (co2 feedback).

0.40.0

• connect(maxMounted: …) — the realm's mounted-workspace budget (LRU park/remount above it); useful on memory-constrained devices holding many local workspaces.
• MULTI-WORKSPACE BY DEFAULT IN TESTS: NomosTestHarness.ephemeral now connects a DECOY session alongside the workspace under test, and harness.bridge is a NomosSession HANDLE pinned to it (existing tenant tests work unchanged). Sole-session inference therefore never silently passes under the harness — an op that forgot its session refuses in your first test with the same multiple sessions connected — pass session a real multi-workspace app raises. Opt out with decoySession: false.
• NomosBridge.open(...) — connect + pinned NomosSession handle in one call (final home = await bridge.open(workspace: …); HomeClient(home)): the recommended plane/handle shape; the bare bridge methods remain one-workspace sugar.

0.39.0

• Multi-session compat surface: watchCompatibility takes an optional session; NomosSession pins its compat watch, compat, and onLawChanged to ITS workspace (per-session lawChanged scoping — previously a multi-session plane's compat verdict was whichever session synced last, and a session's compat watch refused on a >1-session plane).

0.38.0

• SPLIT: the pure data core (wire types, offer codec, NomosReads, aggregate meta, schema validation, error info) moved to the new nomos_types package; nomos_client depends on and re-exports it, so existing imports are unchanged. Frontend/UI code can now depend on nomos_types alone.

0.37.1

• Doc fix: NomosBridge.attestedRead docs now match the runtime — the call answers { entry: {queryId, result, attestation: …} }; pass result['entry'] as one offerDirective attestations element.

0.32.0

• SPATIAL READS: NomosBbox + NomosBridge.spatialWithin(spatialId, bbox) + watchSpatial(...) — the R*Tree probe surfaces on the bridge; generated clients (tooling ≥0.46) emit typed sitesByBounds({required NomosBbox bbox}) + watch accessors.
• Analyzer-clean under strict lints (curly-braces rule) — the two remaining unbraced ifs in the bridge are gone.

0.31.0

• NomosFieldMeta.fromBirth — the registry surfaces BIRTH-PRESENCE LAW (.fromBirth() fields, tooling ≥0.42): a gate invariant guarantees the field present on every row, and the generated read models type it non-nullable.

0.30.0

• RUNTIME AGGREGATE METADATA: NomosAggregateMeta / NomosFieldMeta / mergeAggregateMeta (src/aggregate_meta.dart) — the support types for the generated per-domain const Map<String, NomosAggregateMeta> <domain>AggregateMeta registry (nomos-compile ≥0.41 tooling). Generic surfaces (history/audit UIs, op renderers, in-app agents) resolve NomosAggregateMeta.typeOfId(op.aggregate) → field kinds, enum wire values, VO/variant names, and the typed fromJson decoder — the compiler's knowledge emitted as data, derived from the law's own declarations.

0.29.0

• LAW-MINTED IDS RETURN TO THE CALLER: NomosBridge.offerCreates(...) → NomosOfferOutcome{head, created} — a .creates plan mints its aggregate id inside the sealed intent (payloads never carry one); the offer now hands the minted ids back, so generated create methods return the typed id with no query-after round-trip. New types NomosOfferOutcome / NomosCreated.
• NomosBridge.mintId(typeTag) — reserve a kernel-minted typed id (<TypeTag>_<uuidv7>) via the holon's front-door mint, for app-side references. (.creates payloads still carry NO id — the law mints those.)
• Generated Dart clients (nomos-compile ≥0.38 tooling): .creates(...) directive methods now return Future<NomosOfferOutcome> instead of Future<String> — outcome.created.single.id is the new aggregate's typed id.

0.28.0

• NomosTestHarness (nomos_headless.dart): ephemeral real-law fixtures — one call births a throwaway cloud workspace, deploys compiled *.deploy.json law, and hands out independent client replicas (connect(clientId:)) over the node runner. Identity defaults to the githolon login --agent session (~/.holon/credentials.json). Live-proven: birth → deploy → write on one replica → converge + typed read on another, 14s end-to-end.
• HEADLESS TRANSPORT (package:nomos_client/nomos_headless.dart): NodeRunnerTransport — a BridgeTransport over the @githolon/client node runner (runner/node-entry.mjs) as a plain child process (NDJSON stdio). flutter test / dart test / CI drive the REAL githolon (byte-identical wasm, real ledger, real gate) through NomosBridge + the generated typed clients — no Flutter plugins, no WebView, no assets. Requires node on PATH + a resolvable @githolon/client (auto-resolved from the app's node_modules, or pass entry:). Proven end-to-end: connect → offerDirective → sync(admit) → typed query, and the same test green under both dart test and flutter test.

0.27.0

• TYPED SNAPSHOT RECOVERY (corrupt local custody): NomosBridge.connect(recover: true) recovers IN-PLACE from a corrupt restoreFrom snapshot — salvages local-only authored writes (via the fallible intents_above, which stops at a missing-ancestor gap) + the DLQ, refolds FRESH from cloud, re-offers the salvaged work (deduped), re-queues the DLQ. The report rides bridge.lastRecovery = {salvagedWrites, requeuedDeadLetters, unsalvageable} — a write the current law refuses lands in unsalvageable + the DLQ (surfaced, never dropped). Also holon.salvage() / holon.absorbSalvage(). Closes the restoreFrom-leaves-read-model-empty case.

0.26.0

• TIER-2 SYNC SIZE: NomosBridge.syncSize() → {bytes, kind} — how many bytes this workspace would transfer to catch up, WITHOUT downloading (a HEAD on the serving pack; the host answers Content-Length, cached ~15s). Sum across open workspaces for an aggregate "X MB to sync" total before any download.

0.25.0

• SYNC STATE + REAL LOADING BARS: NomosBridge gains syncStatus (Stream

0.24.0

• createWorkspace / shareWith no longer require authorSecret — it defaults to the connection's signing key (the home device key NomosScope.home loaded). A frontend dev never threads a key through make-workspace or share.

0.23.0

• NomosBridge.shareWith — one-call cross-custody share (sign quote + deliver recordShare to the subjects home). Closes the shared-with-me loop.

0.22.0

• NomosBridge.offerIntent (canonical write verb; offerDirective kept as alias) + one-call NomosBridge.createWorkspace (sign + relay a control-plane offer).

0.21.0

• NomosBridge.noteLocalSpan(...) — inject a locally-measured span (e.g. the Dart-side durable save, the "saved to disk" number) into the span stream so it appears on the flame chart AND the per-phase stats exactly like a kernel span. Additive; used by nomos_flutter's durable-save-on-write.

0.20.2

• NomosBridge.connect accepts the internal allowUnborn opt-in used by NomosScope.home, so the home-birth ceremony can boot a local bridge before the home workspace has a remote main. The default remains strict for ordinary workspaces.

0.20.1

• NomosBridgeError now carries structured NomosErrorInfo alongside the existing human-readable message. The envelope includes stable code/component/operation fields, workspace/domain/directive context, trace/span ids, arbitrary attributes, and toTelemetryAttributes() for future OpenTelemetry export without taking an SDK dependency.
• Every bridge request now carries an OpenTelemetry-shaped trace context. String-only legacy runner errors still work and are upgraded locally with operation/trace metadata.

0.20.0

• Authority-aware: NomosBridge.offerDirective(domain, directiveId, payload, {actor, domainHash}) — generated clients route every offer through THE ONE encoder (encodeIntentOfferBytes in @githolon/client); no per-client envelope encoding. New typed MissingOfferAuthority — a .requires(...) directive authored with no actor throws BEFORE submit (an actorless gated offer cannot be generated). Lockstep jump to 0.20.0.

0.17.0

• Lockstep bump with the birth-primitive release (see @githolon/dsl 0.17.0): birth is one law primitive (birthChild), the platform-creator tier collapsed onto #creator, grantCreation takes a user or key subject. The Dart wire types track the current /v2 governance surface.

0.16.0

• First pub.dev release: kernel wire types, NomosBridge protocol, typed offer/query/watch surface.