app.communicationos-web

@lssm-tech/app.communicationos-web

The authenticated /communications/meetings surface is hCircle's calm, connection-first projection of the shared OPA meeting workspace. Preparation is optional and non-blocking; productivity scoring and clinical inference are not available, sensitive inference is ephemeral, and sharing remains consent-led. An opaque meetingRef selected by the route loads live contract-validated OPA state through the current hCircle access grant; route state never grants access.

The Search workspace calls the canonical communication.message.search@2.0.0 projection. Queries stay within the authenticated tenant, workspace, and space; the browser does not search provider APIs or infer authority from route state.

Thin Next.js App Router and installable PWA shell for CommunicationOS. It consumes @lssm-tech/bundle.communication-os, uses managed-cloud or self-hosted connectors, and declares encrypted IndexedDB as its projection store. Credentials never belong in browser storage.

For focused source feedback, run bun run check:edit -- --package @lssm-tech/app.communicationos-web --test packages/apps/communicationos-web/src/app/CommunicationSignIn.test.tsx. The reviewed fixture profile also accepts the inbox and route-copy test files; lint and source typechecking remain required. This is focused feedback, not affected-consumer or release acceptance.

bun run dev:focus -- --package @lssm-tech/app.communicationos-web selects the local signed-out UI fixture on http://127.0.0.1:43120. It mirrors this app into an ignored, disposable directory without dotenv or generated output, links existing workspace dependencies, and runs the existing Next development server. The loopback API fixture on port 43121 returns no authenticated session and denies sign-in and consequential mutations. It never sends invitations or messages. App edits are mirrored using filesystem events with a bounded 500 ms app-only reconciliation fallback; shared workspace source remains directly linked. Stop the command to close its server, fixture and source watcher. Cold-route and Fast Refresh qualification is recorded under docs/refactoring/lssm-ecosystem/evidence/w1-ui-feedback; the presence of this profile alone does not establish that the UI latency budgets have passed.

The qualified browser binding uses the existing CommunicationOS locale, capability and personalization providers and Calm Signal shell through their four module subpaths. The module's package-level browser metadata is a union of supported surfaces; it does not make its root or server exports browser-safe. Failed central sign-in responses are shown through the existing localized alert, and pending/error state is part of the local interaction qualification.

Signed-out users receive an invite-only hCircle entry surface. When NEXT_PUBLIC_HCIRCLE_LSSM_RP_ENABLED=1, it offers only central LSSM OIDC; the local invited-email magic-link control is removed from the rendered tree. The web-owned callback strictly forwards the bounded authorization response to the hCircle API; the browser route never exchanges tokens or accepts an arbitrary destination. Disabling the central RP restores the existing-email magic-link path as an explicit rollback authority, so both authorities are never active in one deployment.

Authenticated users receive an explicit product-local sign-out in the Calm Signal shell. It clears only the current hCircle session projection, active-room selection, and scoped queued-message outbox; the central Passport and other products retain their independent sessions. The protected production replay is opt-in through HCIRCLE_LSSM_PRODUCTION_CANARY_AUTHORIZED=1, exact E2E_PRODUCTION_BASE_URL=https://chat.hcircle.app, and secret-manager-provided canary credentials. bun run test:production-oidc-canary proves central sign-in, optional consent, hCircle session exchange, product sign-out, denied replay, and Passport sign-out with Playwright traces and screenshots disabled.

The public host boundary is explicit: www.hcircle.app serves the Human Topography product site, localized EN/FR/ES feature/persona/solution pages, waitlist and status experiences, and deterministic sitemap/robots/LLMS files; chat.hcircle.app owns the Chat one-pager and authenticated application. The apex redirects to www, private app routes are excluded from discovery, and unknown hosts fail with 421. All acquisition surfaces use the shared design system; the authenticated CommunicationOS route registry remains unchanged.

A hosting-recovery canary may set HCIRCLE_PREVIEW_SURFACE=marketing. Only the exact injected RAILWAY_PUBLIC_DOMAIN then rewrites to the public acquisition surface; a provider suffix or another generated domain is not trusted. The canary does not activate CommunicationOS auth, API, realtime, or waitlist delivery.

The PWA registers a same-origin service worker for the offline shell and hashed static assets only. Navigations fall back to the Calm Signal /offline route; /api/*, /v2/*, messages, credentials, and authenticated responses are never placed in the service-worker cache. Security headers bind browser connections to the configured CommunicationOS API and realtime origins.

The Calm Signal Spaces and Rooms routes consume live typed projections. They show isolation and encryption posture, list canonical rooms, and keep the explicit active-room choice for the current browser session.

The catch-all route validates all 23 canonical CommunicationOS paths through the shared route registry. Room and thread detail URLs retain their opaque target; unknown paths return the Next.js not-found boundary, disabled extensions render an explicit recovery state, and neither case silently opens another room. Traversal-shaped, separator-bearing, malformed, control-character, and oversized opaque targets are rejected by the same shared resolver before the conversation surface receives an identifier.

The production canary proves HTTP resolution for all 23 canonical paths. Its 10-route anonymous public-web cohort additionally exercises 320, 390, 768, 1280, and 1440 CSS pixels in light and dark mode with reduced motion. Every representative route receives route-level Axe scanning in both themes; phone widths reject sub-44px visible controls, and keyboard focus, navigation containment, active-route state when navigation links are present, console errors, and document overflow are checked explicitly. This evidence is scoped to standalone web and does not promote PWA, Expo, or Tauri qualification.

Inbox is a dedicated route-specific overview rather than an alias for the active room. It shows the authorized room count, a compact recent-message ledger for the active room, canonical links to every other authorized room, and an explicit room-setup recovery state when the scope is empty.

The room composer accepts up to five PDF, image, CSV, or text attachments (5 MB each). It verifies and uploads files before sending, preserves opaque attachment IDs during offline message replay, and downloads through the authenticated API; no provider or storage URL enters the browser projection. At phone widths, the message field and explicit Attach/Send actions reflow into full-width rows with 44px-or-larger targets. Accounts without an authorized space receive a recovery-oriented empty state instead of a blank content region.

The governed-work routes are no longer event-only placeholders. Each route can create a persisted work item and presents the allowed approve, reject, or resolve decision. Realtime and periodic refreshes reconcile the journal-backed state, while the API remains the authority for manager-only decisions.

The Connections route presents one-click official OAuth cards for Gmail, Slack, and WhatsApp Business with explicit managed/self-hosted placement. Telegram's opaque vault-reference workflow remains behind an operator-only disclosure; public users are never asked to paste provider tokens or secret references.

Run bun dev, bun test, bun run typecheck, or bun run build from this package.

Better Auth 1.7 callback forwarding

The existing public LSSM callback alias forwards only its bounded authorization response to the fixed API owner's /auth/callback/ endpoint, replacing the removed /auth/oauth2/callback/ path. Existing issuer and parameter checks remain in force. API token exchange, provider registrations, cookies and account-identity migration still require live qualification before cutover.

Build compute policy

Automatic Vercel Git builds are disabled for this app. Build compute is assigned to Railway; this does not change the existing runtime or domain topology. See the operator policy and evidence^† for configuration scope and the unqualified Vercel prebuilt delivery gap.