nomos_flutter 0.61.0

Drive the real Nomos GitHolon from a Flutter app — a local-first domain runtime. iOS + macOS run the native-AOT kernel (no WebView memory cap); Android uses a hidden secure WebView. Write TypeScript d [...]

0.61.0

• Replace configurable home-birth profiles with one public application contract: NomosScope.home(cloud:, application:, authToken:, builder:). Nomos derives the canonical subject from the token, discovers the active framework/home laws, and owns routing, enrollment, provenance, recovery and persistence internally.
• Make device bootstrap resumable: the application-scoped key is saved before any remote effect, reused after interruption, and storage failures stop setup instead of minting a replacement identity. Internal lifecycle failures surface as NomosHomeSetupFailure while retaining technical detail for support.
• Ship the exact compound-key cloud/web kernel (ca687c59887…) in the Apple xcframework. Dart verifies the linked binary's full source-wasm identity at startup; CI, pub release and cloud deploy now refuse any JavaScript/native/cloud skew. There is no engine fallback for a broken package.

0.60.0

• Bundle the one-call business birth runtime and require nomos_client 0.62.0, whose session-bound generated clients derive the verified principal automatically.

0.59.0

• nomos_client floor ^0.61.0 (the era-0 release: signer-ready births — birthHome requires ownerKeyHash; the client auto-signs self-serve birth certs on the kernel's typed refusal; follow/acquireSession accept authorSecret for warranted locally-born children).

0.55.11

• Runner assets carry the colocated attested-read fix: a generated directive's foreign read(q, {from}) now resolves from the mounted source session in-engine (signed envelope, zero HTTP) — the session-alias vs workspace-name keying bug that made it fall through to a 31s HTTP fetch on Flutter. Adds fast-fail SourceSessionNotMounted. Depends on nomos_client ^0.58.0.

0.55.9

• Pin nomos_client: ^0.56.0 (was a wider range in 0.55.8) to match the generated-client pin convention (NOMOS_CLIENT_DEP) — nomos_client 0.56.0 and nomos_flutter move together.

0.55.8

• Widen the nomos_client dependency to >=0.55.0 <0.57.0 so nomos_client 0.56.0 (NomosTestCloud, typed snapshot lifecycle, projectionReadFailed) resolves alongside nomos_flutter — the caret ^0.55.0 wrongly excluded 0.56.0, so the two could not coexist. Bundled JS runner assets are rebuilt from the compound-key-capable @githolon/client at publish.

0.55.7

• Carry the @githolon/client fix: sync() now surfaces a typed pushError (endpoint, status, body) with pushFailed:true / stillAhead:true on a non-2xx/invalid direct offer, instead of a silent pushed:null that hangs the app waiting on custody that never advances. Runner bundle rebuilt. Patch bump — keeps the nomos_client: ^0.55.0 pin valid.

0.55.6

• Export NomosRefAcquire (the ref.acquire(bridge) extension) from the barrel, carrying the nomos_client 0.55.2 session-state DX: explicit workspace state on listWorkspaces(), openable born/resident refs (await outcome.bornRefs.single.acquire(bridge)), and the NomosSession.isConnected/assertConnected() fail-at-bind guard.
• Patch bump — keeps the nomos_client: ^0.55.0 pin valid.

0.55.5

• Fix NomosScope snapshot persistence for multiple sessions: _exportAndSave now binds head()/export() to bridge.session(workspace) instead of the bare plane-level calls, which refuse "multiple sessions connected — pass session" once an estate/catalogue sibling session mounts — previously silently stopping home snapshot persistence.

0.55.4

• Runner bundle rebuilt to carry issueDelegationCert (the public role-delegation cert lane) and the deriveWorkspaceName addressing helper reachable through the bridge. Native kernel unchanged (efff5199).

0.55.3

• Native iOS/macOS kernel re-pinned to wasm efff5199 (delegated-authority offline births — the delegation-cert gate verifies a platform's grant to K_root on every lane; additive/era-ruled, so verify_chain over the selftest fixture is byte-identical to f4e05b47). Matches the live cloud. nomos_client: ^0.55.0 floor unchanged.

0.55.2

• Native iOS/macOS kernel re-pinned to wasm f4e05b47 (the Surfaced read-collapse fix — replica as string for RFC-8785 canonicalization; byte-identity proven), matching the live cloud. 0.55.1's native path was one kernel behind. Also carries 0.55.1's nomos_client: ^0.55.0 floor.

0.55.1

• Fix: the nomos_client dependency floor was ^0.54.2, not ^0.55.0 — 0.55.0 shipped with a stale floor (a release-process no-op), so a Flutter app using a client generated by @githolon/dsl 0.80.0+ (which pins nomos_client: ^0.55.0) could not pub get without an override. Floor corrected to ^0.55.0. (A pins tripwire now ties this floor to the generated-client floor so they can't diverge again.)

0.55.0

• Bundled runner rebuilt with the adversarial-sweep client fixes (watch rebind, DLQ salvage, self-binding enrollSigner recovery lane). nomos_client floor -> ^0.55.0; bundle stamp 0.80.0.

0.54.1

• Signer-recovery principal normalization fix (see nomos_client 0.54.1); home scope passes the canonical actor. Bundled runner rebuilt. Floors: nomos_client ^0.54.1, bundle >= 0.78.1.

0.54.0

• NomosScope.home recovers parent authority: the born+keyed fast path now verifies the stored device signer is enrolled on the configured parent (one relation read per open) and lawfully repairs after a parent custody rebirth — sibling births no longer refuse with an opaque gate error on a reborn parent. Posture exposed via onParentAuthority / parentAuthorityOf; an unreachable parent records posture and never bricks offline use. Bundled runner rebuilt (enrollment + canAuthor ops, authz diagnosis classification).

0.53.7

• Bundled JS runner rebuilt from @githolon/client 0.77.1 — carries the version stamp the new nomos_client 0.53.0 stale-bundle boot check expects. Upgrading BOTH and rebuilding with flutter clean yields a verified-fresh pair; a stale baked bundle now fails loudly at boot.

0.53.6

• The fast kernel. Native + bundled kernel re-pinned to wasm c23d07b2 — the offer-latency arc: a pooled local offer on co2-scale (3MB) law drops from ~390ms to ~2.7ms on the reference machine (warm-law resident dispatch, gate-scan indexing, amortized fold-root; determinism proven by byte-identity suites + live-chain replay, which also got ~2× faster). Byte-identity proven for the native build; artifact live at the hash-pinned URL.
• Bundled JS runner rebuilt: the idle intent-walk burn is gone (51.5% CPU → 0.0% under multi-MB law — head-cursored activity walks, size-gated decodes; rows for >192KB intents carry payloadOmitted: true).

0.53.5

• Bundled JS runner rebuilt: offer ack decoupled from watch fan-out (watcher-count-independent ack; co2's grid-offer latency), offer span taxonomy, offerPlanned timing envelope. nomos_client floor → ^0.52.0.

0.53.4

• Native kernel re-pinned to wasm 7cfe416a (Surfaced conflicts + captured-basis + ATTRIBUTED READS — opt-in per-field author provenance; byte-identity proven; artifact live at the hash-pinned URL).
• Bundled JS runner rebuilt (DLQ session ops, sealing-refusal typed errors, staging lane).
• nomos_client floor → ^0.51.0.

0.53.3

• Bundled JS runner rebuilt: atomic session re-open (no routable stale record mid-replace) and identity-change re-mount (new credentials on an open session install instead of being silently ignored). nomos_client floor → ^0.50.0 (HarnessPhaseTimeout / phaseTimeout).

0.53.2

• Bundled JS runner rebuilt: local-only sessions no longer register cloud sync machinery (the autoSync deadlock fix). nomos_client floor → ^0.49.0 (acquireSession).

0.53.1

• iOS/macOS native kernel re-pinned to wasm 72604ff7 (the Surfaced/captured-basis kernel, byte-identity proven) — 0.53.0's podspecs still pinned the previous kernel, which would have put the native path one kernel behind the bundled JS runner. Artifact live at the hash-pinned runtime URL.

0.53.0

• Bundled JS runtime rebuilt: the runner gains the interfaceOffer op (session-bound client preflight) and the pendingConflicts/watchPendingConflicts lanes (Surfaced conflicts).
• nomos_client floor → ^0.48.0 (session-bound clients, Surfaced DX).

0.52.3

• No code change — bumps the nomos_client dependency floor to ^0.47.0 (the release that actually carries the Dart-level createWorkspace(domain: ...) signature; 0.52.2 fixed the bundled JS runtime but the corresponding nomos_client publish was missed — see nomos_client 0.47.0's changelog).

0.52.2

• Fix: createWorkspace hardcoded domain: "workspaces", so a tenant birthing through their OWN platform's custom law (e.g. a birthEstateWorkspace directive under a co2_platform domain) was refused by the kernel: the sealed intent always claimed domain: "workspaces" regardless of which law actually declared the directive. Added a domain parameter (default "workspaces", fully back-compatible) to NomosBridge.createWorkspace and the underlying @githolon/client createWorkspace/runner handler; call bridge.createWorkspace(domain: 'co2_platform', directiveId: 'birthEstateWorkspace', domainHash: ..., ...) to birth through a custom platform law. Regression added proving the parameter reaches the signer (a domain the workspace doesn't declare is correctly refused BY NAME, never silently dropped to "workspaces") and that the no-domain default is unchanged.

0.52.1

• Fix: the 0.52.0 pub artifact embedded a STALE (pre-compact) native framework, defeating the kernel_sha pin — CocoaPods skipped the fetch because Frameworks/ already existed on disk (a build-hygiene bug: a local Frameworks/ dir was present at publish time; macos/Frameworks/ was missing from .pubignore while ios/Frameworks/ had it). Fixed the asymmetry, removed the stale local artifact, and HARDENED both podspecs: prepare_command now stamps the fetched kernel_sha and re-fetches whenever the stamp disagrees with the pin, instead of trusting bare directory presence. Added native/check_release_framework.sh — a release-gate script (no embedded Frameworks/ + the pinned runtime URL actually serves a binary containing nomos:usdJsonB64) to run before every future dart pub publish.
• Fix: createWorkspace/shareWith runner handlers forgot to await the (async) connected-holon lookup (need(a) is async; the handler used the unresolved Promise, so typeof h.createWorkspace was always the string for "undefined", failing every estate-creation call with "connected holon does not expose createWorkspace()" even on a correct kernel). Fixed at the source (cloud/web-client/src/webview-runner.mjs) and rebundled into both assets/nomos-native.js and assets/nomos-runner.js.

0.52.0

• Native kernel resync (COMPACT-CAPABLE). The bundled NomosKernel.xcframework is rebuilt from kernel 7394d6fe (compact-native, 2026-07-07) — the SAME bytes the cloud runs. Fixes: the native macOS/iOS runtime could not open a workspace whose lineage (active OR superseded) contains a COMPACT (nomos:usdJsonB64) package — it errored missing nomos:usdJsonHex. The prior published native kernel (891bad48, 2026-07-04) predated compact support; the Dart wrapper had advanced without resyncing the AOT.
• Guardrail (the improvement): stale-native is now self-diagnosing. A USDA-encoding parse failure is rewritten into an actionable error naming the on-device native kernel (kNativeKernelSha) + the fix (upgrade nomos_flutter / rebuild), with code nomos.native.stale-kernel — never a cryptic field name. Requires nomos_client >= 0.46.0. Rebuild your app so the podspec pulls the new xcframework.

0.51.0

• NomosScope / NomosScope.home expose onCustodyBreak (a CustodyBreakPolicy) for the FIRST workspace mount — plug-and-play rebirth handling (co2 feedback). Threaded scope → home scope → bridge.connect; the barrel re-exports CustodyBreakPolicy/NomosCustodyBreak/NomosCustodyStatus/ NomosCustodyEvent so apps need no direct nomos_client import. Null keeps the fail-closed default (typed break, never silent adoption/loss). Requires nomos_client >= 0.46.0.

0.50.0

• Bundles the current @githolon/client runner: bridge.attestedRead(from: <sibling>) now resolves IN-PLANE from a colocated local-only workspace (the explicit API shares the offer-path colocation resolver) — a cross-workspace local read no longer fails attested-read-unreachable/no active installed law declares that query. Pairs with nomos_client ≥0.41.0.

0.49.0

• NATIVE REALM MIGRATION: the native (dart:ffi) path now runs the SAME shared runner + realm plane every other host runs (createWebviewRunner over openRealm with a native FFI engine plane) — the hand-rolled native ops table and session map are deleted, so the native op surface can no longer drift. This brings the native path: the 11 previously-missing ops (dead-letters, the crypto/E2E surface, checkCompat/compatHas, pull, manifests, …), per-session lawChanged forwarding (compat live-events now work natively), locally-born children opening IN-PLACE, in-plane colocated attested reads, and LRU park/remount (connect(maxMounted: …)), all conformance-tested on macOS. Pairs with @githolon/client 0.60.0 (the bundled runner).
• FIX (per-session auth): the native transport no longer keeps a global last-connect-wins auth header map — one session's x-nomos-auth never rides another session's cloud traffic. The holon's own per-session headers are authoritative on fetches (parity with the WebView/web paths); the pack byte-shuttle and the doorbell WebSocket resolve THEIR session's credential. Conformance: test/native_multisession_auth_test.dart (a loopback fake cloud records auth per request; a tokenless session must not inherit a sibling's token).

0.48.0

• FIX (native multi-session regression): the native (dart:ffi) transport now retains EVERY connected session. Previously a second bridge.connect(workspace:…, session:…) re-booted the single global kernel, replaced the JS engine, and overwrote the singleton workspace placement — listWorkspaces() showed only the latest session and earlier sessions failed session '…' is not connected. The engine now boots ONCE and keeps a per-session placement map (kernel calls, ws files, git tree, restore staging, pack apply, export all route by the session key native-entry stamps on every provider message), and connect forwards session to the runner.
• FIX: a LOCAL-ONLY session (no cloud) works on the native path — the local:// sentinel never touches dart:io networking (the workspace-status probe answers unborn locally, parity with the node runner's offline lane), and connect no longer requires a cloud argument.
• Native-path conformance test (test/native_multisession_test.dart, macOS): home connect → sibling connect → listWorkspaces contains both → home query + pre-existing watch still answer → child query/watch works. Runs under plain flutter test against the repo-built kernel slice via the new native/build_test_dylib.sh (the static macos-arm64 slice linked as a loadable test dylib).

0.42.0

• Depend on nomos_client ^0.32.0 — spatial reads (NomosBbox, spatialWithin, watchSpatial) reach app clients; pairs with the ≥0.46 compiler wave (semantic enum names, analyzer-clean output, all-creates proofs with spatial membership).

0.41.0

• Depend on nomos_client ^0.31.0 — pairs with the 0.42/0.43 compiler wave: the runtime aggregate-meta registry (NomosAggregateMeta/NomosFieldMeta incl. fromBirth), variant() sealed unions, unit() extension types, idOf() typed ids, fromBirth() non-nullable read models, and copyWith on generated VO/arm classes. Recompile domains with @githolon/dsl ≥0.43 tooling.

0.40.0

• Depend on nomos_client ^0.29.0 — the headless test lane (NodeRunnerTransport + NomosTestHarness in package:nomos_client/nomos_headless.dart) and the law-minted-id offer surface (offerCreates/mintId) are available to app test suites; flutter test drives the real githolon with no plugins/WebView (proof: test/headless_transport_test.dart).

0.39.0

• WEB SUPPORT: nomos_flutter now compiles and runs on Flutter web. The browser is itself a JS/wasm host, so web uses NO dart:ffi and NO WebView — a new dart:js_interop transport (web_transport.dart) loads the same @githolon/client browser runner (nomos-runner.js) in-page and drives it over the identical NomosBridge wire. Platform selection is via conditional imports (engine_host.dart), so dart:ffi/flutter_js/flutter_inappwebview never enter the web graph; native (iOS/macOS AOT) and Android (WebView) paths are unchanged. Web persistence (snapshots + device keys) is backed by IndexedDB (async, large-capacity) — NOT localStorage — so a durable save never blocks the main thread or hits the ~5MB cap. Proven end-to-end against the live cloud: connect, ledger clone, offline write → edge admission → main, undo/redo (kernel strike), history, and the profiler flame chart all run in-browser. (Known follow-up: on very large ledgers the runner runs on the single JS thread; a Web Worker host is future work.)

0.38.0

• macOS NATIVE: macOS now runs the native-AOT kernel (the macos-arm64 slice of the same xcframework iOS uses) instead of the WebView engine — faster, no WKWebView memory cap, byte-identical. New macOS plugin (macos/nomos_flutter.podspec force-loads the macos-arm64 slice; macos/Classes/NomosFlutterPlugin.swift). _nativeEngine now covers iOS+macOS by default; set NOMOS_FORCE_WEBVIEW=1 to opt back to WebView on macOS. After upgrading: cd macos && pod install. Android stays on the WebView engine.

0.37.1

• DX: clearer macOS error when the native path is FORCED (NOMOS_FORCE_NATIVE=1) without a linked macos-arm64 kernel slice — the loader now explains macOS uses the WebView engine by default + how to fix, instead of a cryptic "framework not loadable". (No behaviour change: macOS has always defaulted to WebView; _nativeEngine is iOS-only unless NOMOS_FORCE_NATIVE=1.)

0.37.0

• TYPED SNAPSHOT RECOVERY: a corrupt local snapshot is no longer lose-it-or-keep-a-broken-app. Connect with recover: true (via the bridge) to recover IN-PLACE — salvage local-only writes + DLQ from the corrupt snapshot, refold fresh from cloud, re-offer the salvaged work. NomosClient.recovery → {salvagedWrites, requeuedDeadLetters, unsalvageable} (unsalvageable = writes the current law refused — kept in the DLQ, never dropped). Quarantine-then-recover becomes one connect. Same kernel (the salvage verbs were already fallible — no deploy).

0.36.0

• TIER-2 SYNC SIZE (aggregate-before-download): NomosClient.syncSize() → {bytes, kind} via a HEAD on the serving pack (host answers Content-Length, no body, cached ~15s). Sum across your open workspaces to show "X MB to sync" BEFORE any download starts; per-workspace transferProgress (0.35) then fills the bar. Host endpoint live (HEAD /v2/workspaces/:ws/pack). Same kernel.

0.35.0

• SYNC-STATE UI + REAL LOADING BARS (tier 1): NomosClient exposes syncStatus (truthful aggregated state), transferProgress (live pack byte-progress), currentStatus. The native pack shuttle streams the response + emits {received,total,kind} from the host Content-Length (the warm host packs then sends, so the real total is in the headers before the body) — real 0→100ars, never estimated. Drive a sync-state page off nomos.syncStatus. See co2-handover/SYNC_STATE.md (incl. the tier-2 HEAD /pack aggregate-size spec).

0.34.0

• NATIVE LOCAL WORKSPACE CREATION FIXED: the iOS AOT kernel now uses uvwasi for its filesystem syscalls instead of the incomplete hand-rolled wasi shim. The multi-workspace kernel can init a fresh LOCAL workspace on device (the birthEstateWorkspace "Unreachable instruction" trap is gone) — estates/sites/assets all init locally, offline-first, then sync. Same canonical kernel wasm (07929c03); only the per-platform wasi provider changed. Determinism preserved: clock/random stay pinned to constants (the kernel takes time/entropy from captured ports), proven byte-identical (b6fea50e). REQUIRES re-fetching the kernel xcframework: rm -rf ios/Frameworks/NomosKernel.xcframework && pod install.

0.33.0

• STRICT device-binding for keyless onboarding: NomosScope.home gains authTokenForDevice(devicePublicKey) => Future<String>. The ceremony mints the device key FIRST, then calls back for an IdP token whose nonce == sha256(pubkey) (e.g. a Firebase Cloud Function that mints a device-bound custom token). Overrides the static authToken (the relaxed lane). Needed when the parent AuthProvider sets requireDeviceBinding:true. Same kernel (07929c03). See co2-handover/STRICT_FIREBASE.md.

0.32.0

• KEY-FREE GOVERNANCE: createWorkspace / shareWith (and NomosBridge) default authorSecret to the connection's signing key — the home device key NomosScope.home already loaded. A frontend dev never handles a key to make a workspace or share it. Same kernel (07929c03); Dart-only.

0.31.0

• OFFLINE BIRTHS no longer trap on device: the native kernel folds the parent shallow-safe (resident frontier, never the panicking genesis walk) when running a .births() offer-effect locally (home/birthEstateWorkspace). A new estate births on-device + syncs to the edge. New kernel 07929c03 (byte-identical fold/verify). REQUIRES re-fetching the kernel xcframework.

0.30.0

• RECOVERY / new-device on a BORN home: NomosScope.home now enrolls THIS device on an already-born home (via the admin-delegated enrollmentGate or keyless verifiedVia) instead of no-opping — so a lost/never-saved device key is recovered on reopen, keeping the homes data (no re-birth). Pairs with the 0.28 device-key store.

0.29.0

• Re-exports nomos_client 0.23.0 (shareWith cross-custody sharing). Bumps the nomos_client floor to ^0.23.0.

0.28.0

• Device key now PERSISTS: NomosDeviceKeyStore (authority credential, separate from the snapshot, file default + Keychain-swappable). NomosScope.home loads it on launch, saves the minted key on first birth, and reconnects SIGNED — a born home survives a device/session change. deviceKeyStore param. Requires nomos_client ^0.22.0.

0.27.1

• Durability without the memory bomb: the durable-save-on-write now backs off adaptively (next save gated to ~4x the last save's cost) so the full-ledger re-serialize can never pile up faster than it completes — fixes an iOS jetsam crash on a large ledger where per-keystroke full-tree exports exhausted memory. The 45s periodic
  • lifecycle saves remain the backstops.

0.27.0

• Local-first durability — a delete (or any write) now survives force-quit + reopen, and lands as a visible "saved" number. Three fixes: (1) the snapshot persists the converged fork point (syncedBase), so restore replays the un-synced local tail instead of resetting it to cloud main (the delete-resurrection bug); (2) the author is persisted durably OFF the author thread the instant a write seals, emitting a persist span — the new "saved" metric (NomosScope shows ready / saved / →main); (3) a thrown converge replay is dead-lettered, never silently dropped. NomosScope.dispose now tears down ordered (final save → bridge dispose) — no more bridge disposed race on app close. Kernel unchanged (1249458d…). Proven on the macOS native harness: delete → kill → reopen → still deleted.
• Integrates the home-onboarding line (0.22.x): HomeBirth.enrollmentGate/HomeBirthEnrollmentEndpoint, the signed first-birth raw fallback, and allowUnborn home scopes — see the 0.22.x entries below.

0.26.0

• Kernel pin → 1249458d… (the O(state) checkpoint-restore cloud kernel, deployed worker 5eaffe41): the #58 stable-id lineage check no longer discards a materialized projection. materialize_from_fold now STAMPS the projection's label_lineage (via stamp_materialized_lineage) at BOTH call sites — checkpoint_import (the container cold-mount) and canonicalize_projection (runs on EVERY client converge). Before, the materialized read model had label_lineage = None while the law derived a non-empty stable-id target, so the first read EVICTED + cold-refolded the whole chain from genesis (O(chain)) — the 60–158s client converge and the 24s container cold-mount. Now the restore is O(state): proven 132ms vs 2776ms (400 commits), flat 120/400/800 → 111/122/138ms. Era-safe — verify_chain is untouched (verdict b6fea50e… unchanged), so every live ledger replays byte-identically. Hash-pinned xcframework at /v1/runtime/ios/NomosKernel-1249458d….xcframework.zip.
• A native client built before this is on a stale kernel — rm -rf ios/Frameworks/NomosKernel.xcframework then pod install to re-fetch.

0.25.0

• Kernel pin → c8152e9d… (the GENERICISATION cloud kernel, deployed worker 15080fcf): the kernel names NO domain/directive/aggregate by ad-hoc literal — AuthProvider, the x5c rotation trigger, the birth-cert seed, and the genesis-install primitives are first-class (kernel-owned, the law compiles to them, drift-guarded); parent-attested birth reads its owner/cert locators from the law's declaration; the keyless arm reads its directive + payload fields from the law. Behaviour-identical + era-safe — every live ledger replays byte-green (verdict b6fea50e… unchanged), so this is a transparent superset of 0.24.0.
• Supersedes the (never-published) 0.23.0/0.24.0 keyless line — this is the first pub.dev release carrying the keyless self-serve home birth AND the genericisation kernel. Hash-pinned xcframework uploaded to /v1/runtime/ios/NomosKernel-c8152e9d….xcframework.zip.
• A native client built before this is on a stale kernel — rm -rf ios/Frameworks/NomosKernel.xcframework then pod install to re-fetch.

0.24.0

• Keyless self-serve home birth — HomeBirth.keyless(...). A new user births their home with NO admin and NO server in the loop: pass their IdP token as NomosScope.home(authToken:) and birth: HomeBirth.keyless(parent:…, frameworkHash:…, lawHash:…, verifiedVia: <the parent's AuthProvider issuer>). The bundled @githolon/client ceremony mints the device key, bootstraps it on the parent via enrollFirstDevice (the on-chain device-bound IdP attestation the kernel re-verifies on every lane), then births the home — all in the embedded engine. Runner assets rebuilt with the ceremony.
• NOTE: under the kernel's STRICT device-binding default the token must carry a nonce/cnf == sha256(the device pubkey). A plain IdP token works when the parent sets requireDeviceBinding:false (the bounded-window lane); full strict device-binding via a sign-in callback is the documented follow-up.

0.23.0

• Kernel pin → 75014bd1… (the keyless verified-first-device cloud kernel — superset of the signer-schema kernel): a brand-new IdP-verified user can self-enroll its FIRST device-signer on a WARRANTED workspace from an on-chain, device-bound IdP attestation (enrollFirstDevice) — self-serve + peer-to-peer, no admin/server in the loop. Era-gated + inert unless a law composes the directive, so every existing chain replays byte-identically (verdict b6fea50e… unchanged). Hash-pinned xcframework uploaded to /v1/runtime/ios/NomosKernel-75014bd1….xcframework.zip.
• A native client built before this is on a stale kernel — rm -rf ios/Frameworks/NomosKernel.xcframework then pod install to re-fetch.

0.22.9

• Add HomeBirth.enrollmentGate and HomeBirthEnrollmentEndpoint so a tenant can run its live device enrollment gate before the signed home-birth offer. This keeps device secrets local while letting the tenant verify Firebase/AuthProvider identity and record the parent signer/delegation facts.
• Rebuild the embedded runner assets with @githolon/client 0.24.10, including x-nomos-auth forwarding for the first-birth raw signed fallback.

0.22.8

• Rebuild the embedded runner assets with the first-birth signed raw fallback. When the home bridge is still unborn/lawless and cannot locally seal home/birthHome, NomosScope.home now sends the parent birth payload with the minted device key for the kernel author door.

0.22.7

• Rebuild the embedded runner assets with the signed-author home-birth fix. NomosScope.home now seals the parent home/birthHome offer locally with the minted device key and relays opaque intentBytes, so warranted platform workspaces no longer reject first-launch home birth for missing authorSecret.

0.22.6

• Rebuild the embedded runner assets with the first-birth lawless-home enrollment fix. NomosScope.home no longer fails before the parent birthHome offer when the home has not yet installed its law.

0.22.5

• Rebuild the embedded runner assets with allowUnborn forwarding in the native and WebView entrypoints. This is the patch that makes NomosScope.home's unborn-home first launch work through the published Flutter package.

0.22.4

• Rebuild the embedded @githolon/client runner assets with the home-birth custody-head race fix. The birthHome ceremony now waits for the born home to have a ledger head before peer verification, and the ceremony's HTTP calls use the native injected transport.

0.22.3

• NomosScope.home now passes the bridge's unborn-home opt-in before running the birth ceremony. This fixes the iOS/native first-launch failure where connect threw workspace '<home>' has no ledger main before birthHome could create and verify the home. Plain NomosScope remains strict.
• Depends on nomos_client: ^0.20.2.

0.22.2

• Structured Nomos runtime failures. NomosNativeTransport now preserves { error, errorInfo } from the shared runner/provider boundary instead of collapsing failures to strings, including provider, fetch, kernel-call, watch, and auto-sync paths.
• The native iOS FFI facade now catches WABT wasm_rt_trap failures around nomos_call and returns nomos.native.wasm_trap as structured JSON instead of aborting the app process. The hash-pinned NomosKernel-04a04ef3....xcframework.zip runtime artifact has been rebuilt and uploaded.
• Depends on nomos_client: ^0.20.1.

0.22.1

• Native/WebView microtask shim. Bare JavaScriptCore in the iOS flutter_js path does not expose queueMicrotask, but the shared @githolon/client orchestration uses it for process.nextTick and post-offer warm queries. The generated nomos-native.js / nomos-runner.js bundles now install a standards-shaped queueMicrotask fallback before client code loads, so native estate/workspace offers do not fail with Can't find variable: queueMicrotask.

0.22.0

• Publish the regenerated JS orchestration bundles from the @githolon/client 0.24.1 build. The generated nomos-runner.js / nomos-native.js assets are no longer tracked in Git; release tooling builds them from source and includes them in the pub package, so Flutter consumers get current bytes without CO2 carrying a local path override.

0.21.1

• Native (iOS) text-codec shim — no tenant patch needed. Bare JavaScriptCore (the flutter_js engine) has no TextEncoder/TextDecoder; the client orchestration uses them, so the native path crashed at load and required a hand-patch. The bundled nomos-native.js now carries a pure-JS, WHATWG-correct TextEncoder/TextDecoder (byte-identical to the platform impl, parity-tested), so NomosScope boots on-device out of the box. The asset is now auto-synced from the build (no stale bundle). If you carried a local native_transport.dart polyfill, you can delete it.

0.21.0

• Kernel pin → 04a04ef3… (the serve-path fold-root certification + warrant verify cloud kernel): the iOS native shell now runs the S1 serve-cert kernel and can verify its OWN warranted home locally (the warrant-flip is LAW-only, but the shell needs this kernel for the serve-cert + on-device home verify). Byte-identical to cloud/web — proven THREE ways on the pinned verifyChain fixture (verdict b6fea50e…): the wasm2c-native AOT build (the iOS kernel), Node's builtin node:wasi, and the @bjorn3/browser_wasi_shim the cloud edge + web peers run all produce the same 435-byte response. The hash-pinned xcframework (device+sim+macos) is rebuilt via wasm2c (--module-name holon, 8 outputs) and uploaded to the cloud runtime store (GET /v1/runtime/ios/NomosKernel-04a04ef3….xcframework.zip → 200).
• A native client built before this is on a stale kernel — rm -rf ios/Frameworks/NomosKernel.xcframework then pod install to re-fetch (the prepare_command only re-fetches when the local framework is absent).

0.20.0

• The native (iOS) path now runs the ONE @githolon/client orchestration (index.mjs) inside an embedded JS engine (flutter_js / JavaScriptCore) over an FFI kernel provider + a dart:io fetch — the Dart _Holon reimplementation of connect/offer/sync/the ceremony is DELETED. One orchestration on every peer; JS↔Dart drift is structurally impossible. THE RAM LAW: the ~1GB holon stays in NATIVE memory — the JS engine runs only the light control plane; packs/snapshots never enter the JS heap (proven: export keeps bytes native).
• Authority: NomosScope.home(subject:) binds the actor onto generated clients automatically; gated directives throw MissingOfferAuthority before submit. nomos_client → ^0.20.0.
• RESIDUAL: the native runtime is structurally + unit + crypto-parity (SHA-256 shim ↔ WebCrypto) proven but NOT yet validated on a physical iOS device — run a birthHome + sync on-device to confirm flutter_js boots.

0.19.0

• Native home-birth parity (co2). The iOS native (dart:ffi) path now runs the full VA home-birth ceremony, matching the WebView engine. Two fixes:
  • NomosScope.home no longer dies when the home is unborn: native connect now TOLERATES an unborn workspace (boots an empty holon — the kernel crypto/ceremony ops need no chain state, parity with the WebView "unborn is fine"), so the birth ceremony in onConnected actually runs. After the birth the holon delta-pulls the full born chain. (Before: native connect threw "no ledger head" and the ceremony never fired.)
  • The five VA ceremony bridge ops are now wired on the native transport (they were declared on the bridge but only implemented on WebView): mintDeviceKey, signBirthCert (kernel cert_sign), enrollDevice (offers home/enrollSigner), verifyChain, and birthHome (the full ceremony — mint+enroll the device key → device-sign the home cert → offer the parent's birthHome → poll born → verify_chain). Exact parity with @githolon/client birthHome.
  • ONE native deviation: the post-birth peer-verify runs verify_chain on the connected holon (which connected empty to the home name and delta-pulls the born chain — a genuine fresh peer) rather than spinning up a second holon, because the native worker runs one process-singleton wasm module.
• Pairs with the cloud fix (worker f7dd87a2) that persists offer-effect-born children to their own custody — so a native birthHome now lands a child with a real head (was head:null).

0.18.0

• Kernel pin → 169d1fee… (the Verified Authority cloud deploy): VA core, the peer-sovereign birth-cert root-of-trust, offline-births enforced at the custody boundary, and the drift-proof cert_sign op. Byte-identical to cloud/web (prove_byte_identity.sh green — the self-test fixture replays identically); the hash-pinned xcframework is uploaded to the cloud runtime store.
• nomos_client → ^0.18.0. NomosScope.home now runs the VA birth ceremony (mint + enroll the device signing key, device-sign the home cert via cert_sign, offer birthHome, poll + verify).
• A native client built before this is on a stale kernel — rm -rf ios/Frameworks/NomosKernel.xcframework then pod install to re-fetch (the prepare_command only re-fetches when the local framework is absent).

0.17.0

• FIX the invalid plugin spec that broke 0.16.2 on pub.dev: Android/macOS were declared with the legacy pluginClass: none, which current Flutter rejects. They are now correctly OMITTED from the plugin block (consumed as a plain Dart package on those platforms; iOS keeps the native-AOT kernel plugin). 0.16.2 cannot be overwritten, so this is the corrected republish — pin ^0.17.0 (not the broken 0.16.2).
• Depend on nomos_client: ^0.17.0 (lockstep birth-primitive release).

0.16.2

• Restore Android + macOS support (hidden-WebView engine); iOS keeps the native-AOT kernel.
• Depend on the renamed nomos_client (was nomos_dsl).

0.1.0

• Initial release. NomosScope boots the real Nomos GitHolon (the byte-identical wasm32-wasip1 artifact) inside a hidden, secure WebView host and hands your builder a connected NomosClient — drive it with the typed Dart client nomos compile generates.
• Hosts the runner over a loopback http://127.0.0.1 origin (a secure context, so crypto.subtle + storage work) via flutter_inappwebview — the robust WKWebView/Android-WebView embedding. macOS/iOS/Android/web.