nomos_flutter 0.27.0

Drive the real Nomos GitHolon from a Flutter app — a local-first domain runtime. iOS runs the native-AOT kernel (no WebView memory cap); Android/macOS use a hidden secure WebView. Write TypeScript dom [...]

0.27.0

• Local-first durability — a delete (or any write) now survives force-quit + reopen, and lands as a visible "saved" number. Three fixes: (1) the snapshot persists the converged fork point (syncedBase), so restore replays the un-synced local tail instead of resetting it to cloud main (the delete-resurrection bug); (2) the author is persisted durably OFF the author thread the instant a write seals, emitting a persist span — the new "saved" metric (NomosScope shows ready / saved / →main); (3) a thrown converge replay is dead-lettered, never silently dropped. NomosScope.dispose now tears down ordered (final save → bridge dispose) — no more bridge disposed race on app close. Kernel unchanged (1249458d…). Proven on the macOS native harness: delete → kill → reopen → still deleted.
• Integrates the home-onboarding line (0.22.x): HomeBirth.enrollmentGate/HomeBirthEnrollmentEndpoint, the signed first-birth raw fallback, and allowUnborn home scopes — see the 0.22.x entries below.

0.26.0

• Kernel pin → 1249458d… (the O(state) checkpoint-restore cloud kernel, deployed worker 5eaffe41): the #58 stable-id lineage check no longer discards a materialized projection. materialize_from_fold now STAMPS the projection's label_lineage (via stamp_materialized_lineage) at BOTH call sites — checkpoint_import (the container cold-mount) and canonicalize_projection (runs on EVERY client converge). Before, the materialized read model had label_lineage = None while the law derived a non-empty stable-id target, so the first read EVICTED + cold-refolded the whole chain from genesis (O(chain)) — the 60–158s client converge and the 24s container cold-mount. Now the restore is O(state): proven 132ms vs 2776ms (400 commits), flat 120/400/800 → 111/122/138ms. Era-safe — verify_chain is untouched (verdict b6fea50e… unchanged), so every live ledger replays byte-identically. Hash-pinned xcframework at /v1/runtime/ios/NomosKernel-1249458d….xcframework.zip.
• A native client built before this is on a stale kernel — rm -rf ios/Frameworks/NomosKernel.xcframework then pod install to re-fetch.

0.25.0

• Kernel pin → c8152e9d… (the GENERICISATION cloud kernel, deployed worker 15080fcf): the kernel names NO domain/directive/aggregate by ad-hoc literal — AuthProvider, the x5c rotation trigger, the birth-cert seed, and the genesis-install primitives are first-class (kernel-owned, the law compiles to them, drift-guarded); parent-attested birth reads its owner/cert locators from the law's declaration; the keyless arm reads its directive + payload fields from the law. Behaviour-identical + era-safe — every live ledger replays byte-green (verdict b6fea50e… unchanged), so this is a transparent superset of 0.24.0.
• Supersedes the (never-published) 0.23.0/0.24.0 keyless line — this is the first pub.dev release carrying the keyless self-serve home birth AND the genericisation kernel. Hash-pinned xcframework uploaded to /v1/runtime/ios/NomosKernel-c8152e9d….xcframework.zip.
• A native client built before this is on a stale kernel — rm -rf ios/Frameworks/NomosKernel.xcframework then pod install to re-fetch.

0.24.0

• Keyless self-serve home birth — HomeBirth.keyless(...). A new user births their home with NO admin and NO server in the loop: pass their IdP token as NomosScope.home(authToken:) and birth: HomeBirth.keyless(parent:…, frameworkHash:…, lawHash:…, verifiedVia: <the parent's AuthProvider issuer>). The bundled @githolon/client ceremony mints the device key, bootstraps it on the parent via enrollFirstDevice (the on-chain device-bound IdP attestation the kernel re-verifies on every lane), then births the home — all in the embedded engine. Runner assets rebuilt with the ceremony.
• NOTE: under the kernel's STRICT device-binding default the token must carry a nonce/cnf == sha256(the device pubkey). A plain IdP token works when the parent sets requireDeviceBinding:false (the bounded-window lane); full strict device-binding via a sign-in callback is the documented follow-up.

0.23.0

• Kernel pin → 75014bd1… (the keyless verified-first-device cloud kernel — superset of the signer-schema kernel): a brand-new IdP-verified user can self-enroll its FIRST device-signer on a WARRANTED workspace from an on-chain, device-bound IdP attestation (enrollFirstDevice) — self-serve + peer-to-peer, no admin/server in the loop. Era-gated + inert unless a law composes the directive, so every existing chain replays byte-identically (verdict b6fea50e… unchanged). Hash-pinned xcframework uploaded to /v1/runtime/ios/NomosKernel-75014bd1….xcframework.zip.
• A native client built before this is on a stale kernel — rm -rf ios/Frameworks/NomosKernel.xcframework then pod install to re-fetch.

0.22.9

• Add HomeBirth.enrollmentGate and HomeBirthEnrollmentEndpoint so a tenant can run its live device enrollment gate before the signed home-birth offer. This keeps device secrets local while letting the tenant verify Firebase/AuthProvider identity and record the parent signer/delegation facts.
• Rebuild the embedded runner assets with @githolon/client 0.24.10, including x-nomos-auth forwarding for the first-birth raw signed fallback.

0.22.8

• Rebuild the embedded runner assets with the first-birth signed raw fallback. When the home bridge is still unborn/lawless and cannot locally seal home/birthHome, NomosScope.home now sends the parent birth payload with the minted device key for the kernel author door.

0.22.7

• Rebuild the embedded runner assets with the signed-author home-birth fix. NomosScope.home now seals the parent home/birthHome offer locally with the minted device key and relays opaque intentBytes, so warranted platform workspaces no longer reject first-launch home birth for missing authorSecret.

0.22.6

• Rebuild the embedded runner assets with the first-birth lawless-home enrollment fix. NomosScope.home no longer fails before the parent birthHome offer when the home has not yet installed its law.

0.22.5

• Rebuild the embedded runner assets with allowUnborn forwarding in the native and WebView entrypoints. This is the patch that makes NomosScope.home's unborn-home first launch work through the published Flutter package.

0.22.4

• Rebuild the embedded @githolon/client runner assets with the home-birth custody-head race fix. The birthHome ceremony now waits for the born home to have a ledger head before peer verification, and the ceremony's HTTP calls use the native injected transport.

0.22.3

• NomosScope.home now passes the bridge's unborn-home opt-in before running the birth ceremony. This fixes the iOS/native first-launch failure where connect threw workspace '<home>' has no ledger main before birthHome could create and verify the home. Plain NomosScope remains strict.
• Depends on nomos_client: ^0.20.2.

0.22.2

• Structured Nomos runtime failures. NomosNativeTransport now preserves { error, errorInfo } from the shared runner/provider boundary instead of collapsing failures to strings, including provider, fetch, kernel-call, watch, and auto-sync paths.
• The native iOS FFI facade now catches WABT wasm_rt_trap failures around nomos_call and returns nomos.native.wasm_trap as structured JSON instead of aborting the app process. The hash-pinned NomosKernel-04a04ef3....xcframework.zip runtime artifact has been rebuilt and uploaded.
• Depends on nomos_client: ^0.20.1.

0.22.1

• Native/WebView microtask shim. Bare JavaScriptCore in the iOS flutter_js path does not expose queueMicrotask, but the shared @githolon/client orchestration uses it for process.nextTick and post-offer warm queries. The generated nomos-native.js / nomos-runner.js bundles now install a standards-shaped queueMicrotask fallback before client code loads, so native estate/workspace offers do not fail with Can't find variable: queueMicrotask.

0.22.0

• Publish the regenerated JS orchestration bundles from the @githolon/client 0.24.1 build. The generated nomos-runner.js / nomos-native.js assets are no longer tracked in Git; release tooling builds them from source and includes them in the pub package, so Flutter consumers get current bytes without CO2 carrying a local path override.

0.21.1

• Native (iOS) text-codec shim — no tenant patch needed. Bare JavaScriptCore (the flutter_js engine) has no TextEncoder/TextDecoder; the client orchestration uses them, so the native path crashed at load and required a hand-patch. The bundled nomos-native.js now carries a pure-JS, WHATWG-correct TextEncoder/TextDecoder (byte-identical to the platform impl, parity-tested), so NomosScope boots on-device out of the box. The asset is now auto-synced from the build (no stale bundle). If you carried a local native_transport.dart polyfill, you can delete it.

0.21.0

• Kernel pin → 04a04ef3… (the serve-path fold-root certification + warrant verify cloud kernel): the iOS native shell now runs the S1 serve-cert kernel and can verify its OWN warranted home locally (the warrant-flip is LAW-only, but the shell needs this kernel for the serve-cert + on-device home verify). Byte-identical to cloud/web — proven THREE ways on the pinned verifyChain fixture (verdict b6fea50e…): the wasm2c-native AOT build (the iOS kernel), Node's builtin node:wasi, and the @bjorn3/browser_wasi_shim the cloud edge + web peers run all produce the same 435-byte response. The hash-pinned xcframework (device+sim+macos) is rebuilt via wasm2c (--module-name holon, 8 outputs) and uploaded to the cloud runtime store (GET /v1/runtime/ios/NomosKernel-04a04ef3….xcframework.zip → 200).
• A native client built before this is on a stale kernel — rm -rf ios/Frameworks/NomosKernel.xcframework then pod install to re-fetch (the prepare_command only re-fetches when the local framework is absent).

0.20.0

• The native (iOS) path now runs the ONE @githolon/client orchestration (index.mjs) inside an embedded JS engine (flutter_js / JavaScriptCore) over an FFI kernel provider + a dart:io fetch — the Dart _Holon reimplementation of connect/offer/sync/the ceremony is DELETED. One orchestration on every peer; JS↔Dart drift is structurally impossible. THE RAM LAW: the ~1GB holon stays in NATIVE memory — the JS engine runs only the light control plane; packs/snapshots never enter the JS heap (proven: export keeps bytes native).
• Authority: NomosScope.home(subject:) binds the actor onto generated clients automatically; gated directives throw MissingOfferAuthority before submit. nomos_client → ^0.20.0.
• RESIDUAL: the native runtime is structurally + unit + crypto-parity (SHA-256 shim ↔ WebCrypto) proven but NOT yet validated on a physical iOS device — run a birthHome + sync on-device to confirm flutter_js boots.

0.19.0

• Native home-birth parity (co2). The iOS native (dart:ffi) path now runs the full VA home-birth ceremony, matching the WebView engine. Two fixes:
  • NomosScope.home no longer dies when the home is unborn: native connect now TOLERATES an unborn workspace (boots an empty holon — the kernel crypto/ceremony ops need no chain state, parity with the WebView "unborn is fine"), so the birth ceremony in onConnected actually runs. After the birth the holon delta-pulls the full born chain. (Before: native connect threw "no ledger head" and the ceremony never fired.)
  • The five VA ceremony bridge ops are now wired on the native transport (they were declared on the bridge but only implemented on WebView): mintDeviceKey, signBirthCert (kernel cert_sign), enrollDevice (offers home/enrollSigner), verifyChain, and birthHome (the full ceremony — mint+enroll the device key → device-sign the home cert → offer the parent's birthHome → poll born → verify_chain). Exact parity with @githolon/client birthHome.
  • ONE native deviation: the post-birth peer-verify runs verify_chain on the connected holon (which connected empty to the home name and delta-pulls the born chain — a genuine fresh peer) rather than spinning up a second holon, because the native worker runs one process-singleton wasm module.
• Pairs with the cloud fix (worker f7dd87a2) that persists offer-effect-born children to their own custody — so a native birthHome now lands a child with a real head (was head:null).

0.18.0

• Kernel pin → 169d1fee… (the Verified Authority cloud deploy): VA core, the peer-sovereign birth-cert root-of-trust, offline-births enforced at the custody boundary, and the drift-proof cert_sign op. Byte-identical to cloud/web (prove_byte_identity.sh green — the self-test fixture replays identically); the hash-pinned xcframework is uploaded to the cloud runtime store.
• nomos_client → ^0.18.0. NomosScope.home now runs the VA birth ceremony (mint + enroll the device signing key, device-sign the home cert via cert_sign, offer birthHome, poll + verify).
• A native client built before this is on a stale kernel — rm -rf ios/Frameworks/NomosKernel.xcframework then pod install to re-fetch (the prepare_command only re-fetches when the local framework is absent).

0.17.0

• FIX the invalid plugin spec that broke 0.16.2 on pub.dev: Android/macOS were declared with the legacy pluginClass: none, which current Flutter rejects. They are now correctly OMITTED from the plugin block (consumed as a plain Dart package on those platforms; iOS keeps the native-AOT kernel plugin). 0.16.2 cannot be overwritten, so this is the corrected republish — pin ^0.17.0 (not the broken 0.16.2).
• Depend on nomos_client: ^0.17.0 (lockstep birth-primitive release).

0.16.2

• Restore Android + macOS support (hidden-WebView engine); iOS keeps the native-AOT kernel.
• Depend on the renamed nomos_client (was nomos_dsl).

0.1.0

• Initial release. NomosScope boots the real Nomos GitHolon (the byte-identical wasm32-wasip1 artifact) inside a hidden, secure WebView host and hands your builder a connected NomosClient — drive it with the typed Dart client nomos compile generates.
• Hosts the runner over a loopback http://127.0.0.1 origin (a secure context, so crypto.subtle + storage work) via flutter_inappwebview — the robust WKWebView/Android-WebView embedding. macOS/iOS/Android/web.