nomos_flutter 0.51.0

Drive the real Nomos GitHolon from a Flutter app — a local-first domain runtime. iOS + macOS run the native-AOT kernel (no WebView memory cap); Android uses a hidden secure WebView. Write TypeScript d [...]

0.51.0

• NomosScope / NomosScope.home expose onCustodyBreak (a CustodyBreakPolicy) for the FIRST workspace mount — plug-and-play rebirth handling (co2 feedback). Threaded scope → home scope → bridge.connect; the barrel re-exports CustodyBreakPolicy/NomosCustodyBreak/NomosCustodyStatus/ NomosCustodyEvent so apps need no direct nomos_client import. Null keeps the fail-closed default (typed break, never silent adoption/loss). Requires nomos_client >= 0.46.0.

0.50.0

• Bundles the current @githolon/client runner: bridge.attestedRead(from: <sibling>) now resolves IN-PLANE from a colocated local-only workspace (the explicit API shares the offer-path colocation resolver) — a cross-workspace local read no longer fails attested-read-unreachable/no active installed law declares that query. Pairs with nomos_client ≥0.41.0.

0.49.0

• NATIVE REALM MIGRATION: the native (dart:ffi) path now runs the SAME shared runner + realm plane every other host runs (createWebviewRunner over openRealm with a native FFI engine plane) — the hand-rolled native ops table and session map are deleted, so the native op surface can no longer drift. This brings the native path: the 11 previously-missing ops (dead-letters, the crypto/E2E surface, checkCompat/compatHas, pull, manifests, …), per-session lawChanged forwarding (compat live-events now work natively), locally-born children opening IN-PLACE, in-plane colocated attested reads, and LRU park/remount (connect(maxMounted: …)), all conformance-tested on macOS. Pairs with @githolon/client 0.60.0 (the bundled runner).
• FIX (per-session auth): the native transport no longer keeps a global last-connect-wins auth header map — one session's x-nomos-auth never rides another session's cloud traffic. The holon's own per-session headers are authoritative on fetches (parity with the WebView/web paths); the pack byte-shuttle and the doorbell WebSocket resolve THEIR session's credential. Conformance: test/native_multisession_auth_test.dart (a loopback fake cloud records auth per request; a tokenless session must not inherit a sibling's token).

0.48.0

• FIX (native multi-session regression): the native (dart:ffi) transport now retains EVERY connected session. Previously a second bridge.connect(workspace:…, session:…) re-booted the single global kernel, replaced the JS engine, and overwrote the singleton workspace placement — listWorkspaces() showed only the latest session and earlier sessions failed session '…' is not connected. The engine now boots ONCE and keeps a per-session placement map (kernel calls, ws files, git tree, restore staging, pack apply, export all route by the session key native-entry stamps on every provider message), and connect forwards session to the runner.
• FIX: a LOCAL-ONLY session (no cloud) works on the native path — the local:// sentinel never touches dart:io networking (the workspace-status probe answers unborn locally, parity with the node runner's offline lane), and connect no longer requires a cloud argument.
• Native-path conformance test (test/native_multisession_test.dart, macOS): home connect → sibling connect → listWorkspaces contains both → home query + pre-existing watch still answer → child query/watch works. Runs under plain flutter test against the repo-built kernel slice via the new native/build_test_dylib.sh (the static macos-arm64 slice linked as a loadable test dylib).

0.42.0

• Depend on nomos_client ^0.32.0 — spatial reads (NomosBbox, spatialWithin, watchSpatial) reach app clients; pairs with the ≥0.46 compiler wave (semantic enum names, analyzer-clean output, all-creates proofs with spatial membership).

0.41.0

• Depend on nomos_client ^0.31.0 — pairs with the 0.42/0.43 compiler wave: the runtime aggregate-meta registry (NomosAggregateMeta/NomosFieldMeta incl. fromBirth), variant() sealed unions, unit() extension types, idOf() typed ids, fromBirth() non-nullable read models, and copyWith on generated VO/arm classes. Recompile domains with @githolon/dsl ≥0.43 tooling.

0.40.0

• Depend on nomos_client ^0.29.0 — the headless test lane (NodeRunnerTransport + NomosTestHarness in package:nomos_client/nomos_headless.dart) and the law-minted-id offer surface (offerCreates/mintId) are available to app test suites; flutter test drives the real githolon with no plugins/WebView (proof: test/headless_transport_test.dart).

0.39.0

• WEB SUPPORT: nomos_flutter now compiles and runs on Flutter web. The browser is itself a JS/wasm host, so web uses NO dart:ffi and NO WebView — a new dart:js_interop transport (web_transport.dart) loads the same @githolon/client browser runner (nomos-runner.js) in-page and drives it over the identical NomosBridge wire. Platform selection is via conditional imports (engine_host.dart), so dart:ffi/flutter_js/flutter_inappwebview never enter the web graph; native (iOS/macOS AOT) and Android (WebView) paths are unchanged. Web persistence (snapshots + device keys) is backed by IndexedDB (async, large-capacity) — NOT localStorage — so a durable save never blocks the main thread or hits the ~5MB cap. Proven end-to-end against the live cloud: connect, ledger clone, offline write → edge admission → main, undo/redo (kernel strike), history, and the profiler flame chart all run in-browser. (Known follow-up: on very large ledgers the runner runs on the single JS thread; a Web Worker host is future work.)

0.38.0

• macOS NATIVE: macOS now runs the native-AOT kernel (the macos-arm64 slice of the same xcframework iOS uses) instead of the WebView engine — faster, no WKWebView memory cap, byte-identical. New macOS plugin (macos/nomos_flutter.podspec force-loads the macos-arm64 slice; macos/Classes/NomosFlutterPlugin.swift). _nativeEngine now covers iOS+macOS by default; set NOMOS_FORCE_WEBVIEW=1 to opt back to WebView on macOS. After upgrading: cd macos && pod install. Android stays on the WebView engine.

0.37.1

• DX: clearer macOS error when the native path is FORCED (NOMOS_FORCE_NATIVE=1) without a linked macos-arm64 kernel slice — the loader now explains macOS uses the WebView engine by default + how to fix, instead of a cryptic "framework not loadable". (No behaviour change: macOS has always defaulted to WebView; _nativeEngine is iOS-only unless NOMOS_FORCE_NATIVE=1.)

0.37.0

• TYPED SNAPSHOT RECOVERY: a corrupt local snapshot is no longer lose-it-or-keep-a-broken-app. Connect with recover: true (via the bridge) to recover IN-PLACE — salvage local-only writes + DLQ from the corrupt snapshot, refold fresh from cloud, re-offer the salvaged work. NomosClient.recovery → {salvagedWrites, requeuedDeadLetters, unsalvageable} (unsalvageable = writes the current law refused — kept in the DLQ, never dropped). Quarantine-then-recover becomes one connect. Same kernel (the salvage verbs were already fallible — no deploy).

0.36.0

• TIER-2 SYNC SIZE (aggregate-before-download): NomosClient.syncSize() → {bytes, kind} via a HEAD on the serving pack (host answers Content-Length, no body, cached ~15s). Sum across your open workspaces to show "X MB to sync" BEFORE any download starts; per-workspace transferProgress (0.35) then fills the bar. Host endpoint live (HEAD /v2/workspaces/:ws/pack). Same kernel.

0.35.0

• SYNC-STATE UI + REAL LOADING BARS (tier 1): NomosClient exposes syncStatus (truthful aggregated state), transferProgress (live pack byte-progress), currentStatus. The native pack shuttle streams the response + emits {received,total,kind} from the host Content-Length (the warm host packs then sends, so the real total is in the headers before the body) — real 0→100ars, never estimated. Drive a sync-state page off nomos.syncStatus. See co2-handover/SYNC_STATE.md (incl. the tier-2 HEAD /pack aggregate-size spec).

0.34.0

• NATIVE LOCAL WORKSPACE CREATION FIXED: the iOS AOT kernel now uses uvwasi for its filesystem syscalls instead of the incomplete hand-rolled wasi shim. The multi-workspace kernel can init a fresh LOCAL workspace on device (the birthEstateWorkspace "Unreachable instruction" trap is gone) — estates/sites/assets all init locally, offline-first, then sync. Same canonical kernel wasm (07929c03); only the per-platform wasi provider changed. Determinism preserved: clock/random stay pinned to constants (the kernel takes time/entropy from captured ports), proven byte-identical (b6fea50e). REQUIRES re-fetching the kernel xcframework: rm -rf ios/Frameworks/NomosKernel.xcframework && pod install.

0.33.0

• STRICT device-binding for keyless onboarding: NomosScope.home gains authTokenForDevice(devicePublicKey) => Future<String>. The ceremony mints the device key FIRST, then calls back for an IdP token whose nonce == sha256(pubkey) (e.g. a Firebase Cloud Function that mints a device-bound custom token). Overrides the static authToken (the relaxed lane). Needed when the parent AuthProvider sets requireDeviceBinding:true. Same kernel (07929c03). See co2-handover/STRICT_FIREBASE.md.

0.32.0

• KEY-FREE GOVERNANCE: createWorkspace / shareWith (and NomosBridge) default authorSecret to the connection's signing key — the home device key NomosScope.home already loaded. A frontend dev never handles a key to make a workspace or share it. Same kernel (07929c03); Dart-only.

0.31.0

• OFFLINE BIRTHS no longer trap on device: the native kernel folds the parent shallow-safe (resident frontier, never the panicking genesis walk) when running a .births() offer-effect locally (home/birthEstateWorkspace). A new estate births on-device + syncs to the edge. New kernel 07929c03 (byte-identical fold/verify). REQUIRES re-fetching the kernel xcframework.

0.30.0

• RECOVERY / new-device on a BORN home: NomosScope.home now enrolls THIS device on an already-born home (via the admin-delegated enrollmentGate or keyless verifiedVia) instead of no-opping — so a lost/never-saved device key is recovered on reopen, keeping the homes data (no re-birth). Pairs with the 0.28 device-key store.

0.29.0

• Re-exports nomos_client 0.23.0 (shareWith cross-custody sharing). Bumps the nomos_client floor to ^0.23.0.

0.28.0

• Device key now PERSISTS: NomosDeviceKeyStore (authority credential, separate from the snapshot, file default + Keychain-swappable). NomosScope.home loads it on launch, saves the minted key on first birth, and reconnects SIGNED — a born home survives a device/session change. deviceKeyStore param. Requires nomos_client ^0.22.0.

0.27.1

• Durability without the memory bomb: the durable-save-on-write now backs off adaptively (next save gated to ~4x the last save's cost) so the full-ledger re-serialize can never pile up faster than it completes — fixes an iOS jetsam crash on a large ledger where per-keystroke full-tree exports exhausted memory. The 45s periodic
  • lifecycle saves remain the backstops.

0.27.0

• Local-first durability — a delete (or any write) now survives force-quit + reopen, and lands as a visible "saved" number. Three fixes: (1) the snapshot persists the converged fork point (syncedBase), so restore replays the un-synced local tail instead of resetting it to cloud main (the delete-resurrection bug); (2) the author is persisted durably OFF the author thread the instant a write seals, emitting a persist span — the new "saved" metric (NomosScope shows ready / saved / →main); (3) a thrown converge replay is dead-lettered, never silently dropped. NomosScope.dispose now tears down ordered (final save → bridge dispose) — no more bridge disposed race on app close. Kernel unchanged (1249458d…). Proven on the macOS native harness: delete → kill → reopen → still deleted.
• Integrates the home-onboarding line (0.22.x): HomeBirth.enrollmentGate/HomeBirthEnrollmentEndpoint, the signed first-birth raw fallback, and allowUnborn home scopes — see the 0.22.x entries below.

0.26.0

• Kernel pin → 1249458d… (the O(state) checkpoint-restore cloud kernel, deployed worker 5eaffe41): the #58 stable-id lineage check no longer discards a materialized projection. materialize_from_fold now STAMPS the projection's label_lineage (via stamp_materialized_lineage) at BOTH call sites — checkpoint_import (the container cold-mount) and canonicalize_projection (runs on EVERY client converge). Before, the materialized read model had label_lineage = None while the law derived a non-empty stable-id target, so the first read EVICTED + cold-refolded the whole chain from genesis (O(chain)) — the 60–158s client converge and the 24s container cold-mount. Now the restore is O(state): proven 132ms vs 2776ms (400 commits), flat 120/400/800 → 111/122/138ms. Era-safe — verify_chain is untouched (verdict b6fea50e… unchanged), so every live ledger replays byte-identically. Hash-pinned xcframework at /v1/runtime/ios/NomosKernel-1249458d….xcframework.zip.
• A native client built before this is on a stale kernel — rm -rf ios/Frameworks/NomosKernel.xcframework then pod install to re-fetch.

0.25.0

• Kernel pin → c8152e9d… (the GENERICISATION cloud kernel, deployed worker 15080fcf): the kernel names NO domain/directive/aggregate by ad-hoc literal — AuthProvider, the x5c rotation trigger, the birth-cert seed, and the genesis-install primitives are first-class (kernel-owned, the law compiles to them, drift-guarded); parent-attested birth reads its owner/cert locators from the law's declaration; the keyless arm reads its directive + payload fields from the law. Behaviour-identical + era-safe — every live ledger replays byte-green (verdict b6fea50e… unchanged), so this is a transparent superset of 0.24.0.
• Supersedes the (never-published) 0.23.0/0.24.0 keyless line — this is the first pub.dev release carrying the keyless self-serve home birth AND the genericisation kernel. Hash-pinned xcframework uploaded to /v1/runtime/ios/NomosKernel-c8152e9d….xcframework.zip.
• A native client built before this is on a stale kernel — rm -rf ios/Frameworks/NomosKernel.xcframework then pod install to re-fetch.

0.24.0

• Keyless self-serve home birth — HomeBirth.keyless(...). A new user births their home with NO admin and NO server in the loop: pass their IdP token as NomosScope.home(authToken:) and birth: HomeBirth.keyless(parent:…, frameworkHash:…, lawHash:…, verifiedVia: <the parent's AuthProvider issuer>). The bundled @githolon/client ceremony mints the device key, bootstraps it on the parent via enrollFirstDevice (the on-chain device-bound IdP attestation the kernel re-verifies on every lane), then births the home — all in the embedded engine. Runner assets rebuilt with the ceremony.
• NOTE: under the kernel's STRICT device-binding default the token must carry a nonce/cnf == sha256(the device pubkey). A plain IdP token works when the parent sets requireDeviceBinding:false (the bounded-window lane); full strict device-binding via a sign-in callback is the documented follow-up.

0.23.0

• Kernel pin → 75014bd1… (the keyless verified-first-device cloud kernel — superset of the signer-schema kernel): a brand-new IdP-verified user can self-enroll its FIRST device-signer on a WARRANTED workspace from an on-chain, device-bound IdP attestation (enrollFirstDevice) — self-serve + peer-to-peer, no admin/server in the loop. Era-gated + inert unless a law composes the directive, so every existing chain replays byte-identically (verdict b6fea50e… unchanged). Hash-pinned xcframework uploaded to /v1/runtime/ios/NomosKernel-75014bd1….xcframework.zip.
• A native client built before this is on a stale kernel — rm -rf ios/Frameworks/NomosKernel.xcframework then pod install to re-fetch.

0.22.9

• Add HomeBirth.enrollmentGate and HomeBirthEnrollmentEndpoint so a tenant can run its live device enrollment gate before the signed home-birth offer. This keeps device secrets local while letting the tenant verify Firebase/AuthProvider identity and record the parent signer/delegation facts.
• Rebuild the embedded runner assets with @githolon/client 0.24.10, including x-nomos-auth forwarding for the first-birth raw signed fallback.

0.22.8

• Rebuild the embedded runner assets with the first-birth signed raw fallback. When the home bridge is still unborn/lawless and cannot locally seal home/birthHome, NomosScope.home now sends the parent birth payload with the minted device key for the kernel author door.

0.22.7

• Rebuild the embedded runner assets with the signed-author home-birth fix. NomosScope.home now seals the parent home/birthHome offer locally with the minted device key and relays opaque intentBytes, so warranted platform workspaces no longer reject first-launch home birth for missing authorSecret.

0.22.6

• Rebuild the embedded runner assets with the first-birth lawless-home enrollment fix. NomosScope.home no longer fails before the parent birthHome offer when the home has not yet installed its law.

0.22.5

• Rebuild the embedded runner assets with allowUnborn forwarding in the native and WebView entrypoints. This is the patch that makes NomosScope.home's unborn-home first launch work through the published Flutter package.

0.22.4

• Rebuild the embedded @githolon/client runner assets with the home-birth custody-head race fix. The birthHome ceremony now waits for the born home to have a ledger head before peer verification, and the ceremony's HTTP calls use the native injected transport.

0.22.3

• NomosScope.home now passes the bridge's unborn-home opt-in before running the birth ceremony. This fixes the iOS/native first-launch failure where connect threw workspace '<home>' has no ledger main before birthHome could create and verify the home. Plain NomosScope remains strict.
• Depends on nomos_client: ^0.20.2.

0.22.2

• Structured Nomos runtime failures. NomosNativeTransport now preserves { error, errorInfo } from the shared runner/provider boundary instead of collapsing failures to strings, including provider, fetch, kernel-call, watch, and auto-sync paths.
• The native iOS FFI facade now catches WABT wasm_rt_trap failures around nomos_call and returns nomos.native.wasm_trap as structured JSON instead of aborting the app process. The hash-pinned NomosKernel-04a04ef3....xcframework.zip runtime artifact has been rebuilt and uploaded.
• Depends on nomos_client: ^0.20.1.

0.22.1

• Native/WebView microtask shim. Bare JavaScriptCore in the iOS flutter_js path does not expose queueMicrotask, but the shared @githolon/client orchestration uses it for process.nextTick and post-offer warm queries. The generated nomos-native.js / nomos-runner.js bundles now install a standards-shaped queueMicrotask fallback before client code loads, so native estate/workspace offers do not fail with Can't find variable: queueMicrotask.

0.22.0

• Publish the regenerated JS orchestration bundles from the @githolon/client 0.24.1 build. The generated nomos-runner.js / nomos-native.js assets are no longer tracked in Git; release tooling builds them from source and includes them in the pub package, so Flutter consumers get current bytes without CO2 carrying a local path override.

0.21.1

• Native (iOS) text-codec shim — no tenant patch needed. Bare JavaScriptCore (the flutter_js engine) has no TextEncoder/TextDecoder; the client orchestration uses them, so the native path crashed at load and required a hand-patch. The bundled nomos-native.js now carries a pure-JS, WHATWG-correct TextEncoder/TextDecoder (byte-identical to the platform impl, parity-tested), so NomosScope boots on-device out of the box. The asset is now auto-synced from the build (no stale bundle). If you carried a local native_transport.dart polyfill, you can delete it.

0.21.0

• Kernel pin → 04a04ef3… (the serve-path fold-root certification + warrant verify cloud kernel): the iOS native shell now runs the S1 serve-cert kernel and can verify its OWN warranted home locally (the warrant-flip is LAW-only, but the shell needs this kernel for the serve-cert + on-device home verify). Byte-identical to cloud/web — proven THREE ways on the pinned verifyChain fixture (verdict b6fea50e…): the wasm2c-native AOT build (the iOS kernel), Node's builtin node:wasi, and the @bjorn3/browser_wasi_shim the cloud edge + web peers run all produce the same 435-byte response. The hash-pinned xcframework (device+sim+macos) is rebuilt via wasm2c (--module-name holon, 8 outputs) and uploaded to the cloud runtime store (GET /v1/runtime/ios/NomosKernel-04a04ef3….xcframework.zip → 200).
• A native client built before this is on a stale kernel — rm -rf ios/Frameworks/NomosKernel.xcframework then pod install to re-fetch (the prepare_command only re-fetches when the local framework is absent).

0.20.0

• The native (iOS) path now runs the ONE @githolon/client orchestration (index.mjs) inside an embedded JS engine (flutter_js / JavaScriptCore) over an FFI kernel provider + a dart:io fetch — the Dart _Holon reimplementation of connect/offer/sync/the ceremony is DELETED. One orchestration on every peer; JS↔Dart drift is structurally impossible. THE RAM LAW: the ~1GB holon stays in NATIVE memory — the JS engine runs only the light control plane; packs/snapshots never enter the JS heap (proven: export keeps bytes native).
• Authority: NomosScope.home(subject:) binds the actor onto generated clients automatically; gated directives throw MissingOfferAuthority before submit. nomos_client → ^0.20.0.
• RESIDUAL: the native runtime is structurally + unit + crypto-parity (SHA-256 shim ↔ WebCrypto) proven but NOT yet validated on a physical iOS device — run a birthHome + sync on-device to confirm flutter_js boots.

0.19.0

• Native home-birth parity (co2). The iOS native (dart:ffi) path now runs the full VA home-birth ceremony, matching the WebView engine. Two fixes:
  • NomosScope.home no longer dies when the home is unborn: native connect now TOLERATES an unborn workspace (boots an empty holon — the kernel crypto/ceremony ops need no chain state, parity with the WebView "unborn is fine"), so the birth ceremony in onConnected actually runs. After the birth the holon delta-pulls the full born chain. (Before: native connect threw "no ledger head" and the ceremony never fired.)
  • The five VA ceremony bridge ops are now wired on the native transport (they were declared on the bridge but only implemented on WebView): mintDeviceKey, signBirthCert (kernel cert_sign), enrollDevice (offers home/enrollSigner), verifyChain, and birthHome (the full ceremony — mint+enroll the device key → device-sign the home cert → offer the parent's birthHome → poll born → verify_chain). Exact parity with @githolon/client birthHome.
  • ONE native deviation: the post-birth peer-verify runs verify_chain on the connected holon (which connected empty to the home name and delta-pulls the born chain — a genuine fresh peer) rather than spinning up a second holon, because the native worker runs one process-singleton wasm module.
• Pairs with the cloud fix (worker f7dd87a2) that persists offer-effect-born children to their own custody — so a native birthHome now lands a child with a real head (was head:null).

0.18.0

• Kernel pin → 169d1fee… (the Verified Authority cloud deploy): VA core, the peer-sovereign birth-cert root-of-trust, offline-births enforced at the custody boundary, and the drift-proof cert_sign op. Byte-identical to cloud/web (prove_byte_identity.sh green — the self-test fixture replays identically); the hash-pinned xcframework is uploaded to the cloud runtime store.
• nomos_client → ^0.18.0. NomosScope.home now runs the VA birth ceremony (mint + enroll the device signing key, device-sign the home cert via cert_sign, offer birthHome, poll + verify).
• A native client built before this is on a stale kernel — rm -rf ios/Frameworks/NomosKernel.xcframework then pod install to re-fetch (the prepare_command only re-fetches when the local framework is absent).

0.17.0

• FIX the invalid plugin spec that broke 0.16.2 on pub.dev: Android/macOS were declared with the legacy pluginClass: none, which current Flutter rejects. They are now correctly OMITTED from the plugin block (consumed as a plain Dart package on those platforms; iOS keeps the native-AOT kernel plugin). 0.16.2 cannot be overwritten, so this is the corrected republish — pin ^0.17.0 (not the broken 0.16.2).
• Depend on nomos_client: ^0.17.0 (lockstep birth-primitive release).

0.16.2

• Restore Android + macOS support (hidden-WebView engine); iOS keeps the native-AOT kernel.
• Depend on the renamed nomos_client (was nomos_dsl).

0.1.0

• Initial release. NomosScope boots the real Nomos GitHolon (the byte-identical wasm32-wasip1 artifact) inside a hidden, secure WebView host and hands your builder a connected NomosClient — drive it with the typed Dart client nomos compile generates.
• Hosts the runner over a loopback http://127.0.0.1 origin (a secure context, so crypto.subtle + storage work) via flutter_inappwebview — the robust WKWebView/Android-WebView embedding. macOS/iOS/Android/web.