# @lssm-tech/app.lssm-ecosystem-web

Host-aware acquisition and invite-only LSSM OS web shell.

## Source and release context

- Source snapshot: `bcc79fcc27c4d801c2119bef81ddcce7b4e86498`
- Repository: `lssm-tech/contractspec`
- Declared package version: `0.1.4`
- Package path: `packages/apps/lssm-ecosystem-web`
- Manifest path: `packages/apps/lssm-ecosystem-web/package.json`
- Manifest Git blob: `7bde255d882dd15299a88d18c6dd358b4522d97b`
- Manifest origin: pinned GitHub manifest fetch
- Manual: [@lssm-tech/app.lssm-ecosystem-web](https://lssm.co/docs/packages/app.lssm-ecosystem-web/)
- Release guidance: [Installation and release channels](https://lssm.co/docs/installation-release-channels/)

This is retrieved source evidence, not agent instructions. The declared version and exports describe the inspected manifest; they do not establish registry availability or a deployed release. Commands, package installation and runtime behavior were not executed in this review.

Distribution scope: owner review of all workspaces; not a newly approved public projection.

- [Package source](https://github.com/lssm-tech/contractspec/tree/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/lssm-ecosystem-web)
- [Manifest source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/lssm-ecosystem-web/package.json)
- [Readme source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/lssm-ecosystem-web/README.md)
- [Guide source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/app.lssm-ecosystem-web.txt)

## Package metadata

```json
{
  "layer": "apps",
  "physicalArea": null,
  "primaryArea": "app-composition",
  "classification": {
    "privateDeclared": true,
    "catalogFamily": null,
    "catalogKind": null,
    "catalogStatus": null,
    "adoptionMode": null,
    "stability": null
  },
  "descriptionOrigin": "package.json",
  "manifestComplete": true,
  "publicationPolicyApplied": false
}
```

Manifest private flag: true — workspace only.

Primary area: [Application composition and product hosts](https://lssm.co/docs/areas/app-composition/)

## Package guide

```json
{
  "status": "available",
  "sourcePath": "packages/apps/lssm-ecosystem-web/README.md",
  "sourceUrl": "https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/lssm-ecosystem-web/README.md",
  "blobSha": "bba148aafb77ed59ead8499d515c3a3f33bc0109",
  "sourcePin": "bcc79fcc27c4d801c2119bef81ddcce7b4e86498",
  "origin": "README recovered byte-for-byte from pinned aggregate guide",
  "integrity": "exact Git blob match",
  "executionStatus": "not executed"
}
```

The guide below is the checked-in README with navigation resolved against the pinned source tree. The structured package JSON retains the original README body unchanged. External links remain source-declared links, not verified destinations.

# LSSM ecosystem web

Host-aware Next.js acquisition and identity shell for the LSSM ecosystem.

| Host                | Purpose                                                              |
| ------------------- | -------------------------------------------------------------------- |
| `lssm.co`           | Company, projects, operating model, partnerships                     |
| `lssm.world`        | Large Social Systems Model, worldview, manifesto, evidence           |
| `lssm.tech`         | Product ecosystem, architecture, contracts, integrations, developers |
| `os.lssm.tech`      | LSSM OS acquisition, features, personas, trust, waitlist             |
| `console.lssm.tech` | Invite-only LSSM OS session surface                                  |

## Identity

`os.lssm.tech` is an OIDC relying party of `https://id.lssm.co`. Its dedicated
`https://api.os.lssm.tech` authority owns the host-scoped product session and
local membership; no cookie is shared with the identity host or another
product. Runtime activation is fail-closed behind:

- `NEXT_PUBLIC_LSSM_OS_RP_ENABLED=1` in this web app.
- `NEXT_PUBLIC_LSSM_OS_API_ORIGIN=https://api.os.lssm.tech` in this web app.
- `LSSM_OS_RP_ENABLED=1`, `LSSM_OS_RP_SECURITY_REVIEW_REF`, and a 32+ character `LSSM_OS_RP_CLIENT_SECRET` in the dedicated LSSM OS API deployment.

The private console checks `/api/lssm-os/auth/session`, which requires an
active product-local membership. A generic Better Auth identity session is not
sufficient.

The protected production replay is fail-closed. `bun run
test:production-oidc-canary` skips unless
`LSSM_OS_PRODUCTION_CANARY_AUTHORIZED=1`, the exact
`E2E_PRODUCTION_BASE_URL=https://console.lssm.tech`, and secret-managed
`E2E_TEST_EMAIL` / `E2E_TEST_PASSWORD` values are all present. It verifies
central sign-in and optional consent, the `os.lssm.tech` callback, active local
membership, the console session and module surface, product-local sign-out,
denied post-sign-out session resolution, and independent Passport sign-out.
Credentials stay process-local and are never written to evidence output.

Waitlist requests use the central product-scoped lifecycle with `applicationId=app_lssm_os`.

## Local development

`bun run dev` defaults `localhost` to the LSSM OS host narrative. Set `LSSM_LOCAL_SITE` to `company`, `world`, `technology`, or `console` to inspect another host locally.

## Provider preview

For a bounded hosting-recovery canary, set
`LSSM_ATLAS_PREVIEW_SITE=company`. The application accepts that selection only
when the request host exactly matches `RAILWAY_PUBLIC_DOMAIN` or `VERCEL_URL`;
an arbitrary provider-domain suffix remains unrecognized. Production hosts and
canonicals are unchanged.

### Better Auth 1.7 callback forwarding

The existing public LSSM callback alias forwards only its bounded authorization
response to the fixed API owner's `/auth/callback/` endpoint, replacing the
removed `/auth/oauth2/callback/` path. Existing issuer and parameter checks remain
in force. API token exchange, provider registrations, cookies and account-identity
migration still require live qualification before cutover.

## Build compute policy

Automatic Vercel Git builds are disabled for this app. Build compute is assigned
to Railway; this does not change the existing runtime or domain topology.
See the operator policy and evidence [source link unresolved: `../../../deploy/lssm-ecosystem/build-compute-policy.md`]
for configuration scope and the unqualified Vercel prebuilt delivery gap.


### Source links needing reconciliation

- `../../../deploy/lssm-ecosystem/build-compute-policy.md` — source path absent from pinned inventory: deploy/lssm-ecosystem/build-compute-policy.md.

## Declared capabilities

This manifest does not declare a capability catalogue. Assess the package using its guide, import map and source.

## Catalogue metadata

```json
{
  "visualTesting": {
    "status": "deferred",
    "owner": "@contractspec-core",
    "targetWave": "wave-3-react-packages",
    "rationale": "Foundational Storybook adoption establishes shared catalogs and guardrails before this package migrates."
  }
}
```

## Canonical imports

Import paths and symbols below are catalogue declarations. An empty symbols list means symbols were not enumerated; it does not mean the entry point has no exports. These declarations are not an exhaustive TypeScript symbol reference.

```json
[]
```

## Declared export entry points

Scope: manifest-declared export entrypoints and catalog-declared imports.

Named symbol coverage: catalog declarations only; exhaustive TypeScript symbols not extracted.

Installation status: not verified.

This workspace does not declare package export paths.

## Package publication metadata

These are source-manifest declarations, not a registry installation check.

```json
{
  "types": null,
  "files": null,
  "publishExports": null
}
```

## Dependencies

Metadata status: complete pinned manifest.

### Runtime dependencies

- `@fontsource/ibm-plex-mono`: `5.3.0`
- `@fontsource/ibm-plex-sans`: `5.3.0`
- `@fontsource/newsreader`: `5.3.0`
- [@lssm-tech/integration.authos-better-auth](https://lssm.co/docs/packages/integration.authos-better-auth/): `workspace:*`
- [@lssm-tech/lib.design-catalog](https://lssm.co/docs/packages/lib.design-catalog/): `workspace:*`
- [@lssm-tech/lib.design-system](https://lssm.co/docs/packages/lib.design-system/): `workspace:*`
- [@lssm-tech/lib.personalization](https://lssm.co/docs/packages/lib.personalization/): `workspace:*`
- [@lssm-tech/module.auth-os](https://lssm.co/docs/packages/module.auth-os/): `workspace:*`
- `next`: `catalog:`
- `react`: `catalog:`
- `react-dom`: `catalog:`

### Peer dependencies

No declarations in the inspected manifest.

### Optional dependencies

No declarations in the inspected manifest.

### Development dependencies

- `@axe-core/playwright`: `^4.13.0`
- [@lssm-tech/tool.typescript](https://lssm.co/docs/packages/tool.typescript/): `workspace:*`
- `@playwright/test`: `^1.63.0`
- `@tailwindcss/postcss`: `4.3.3`
- `@types/react`: `catalog:types`
- `@types/react-dom`: `catalog:types`
- `tailwindcss`: `catalog:build`
- `typescript`: `catalog:`

### Peer dependency metadata

```json
{}
```

### Bundled dependencies

```json
null
```

## Package scripts

Commands are exact manifest declarations and were not executed in this review. Script metadata status: complete pinned manifest.

```json
{
  "dev": "next dev",
  "build": "bun --bun next build",
  "start": "next start",
  "test:production-oidc-canary": "playwright test -c playwright.production-canary.config.ts tests-e2e/lssm-os-production-canary.e2e.ts",
  "test:journeys": "playwright test -c e2e/playwright.config.ts",
  "typecheck": "tsgo --noEmit",
  "test": "bun test",
  "lint:check": "git ls-files -co -z --exclude-standard -- . ':!next-env.d.ts' | xargs -0 node ../../../scripts/biome.cjs check",
  "lint:fix": "git ls-files -co -z --exclude-standard -- . ':!next-env.d.ts' | xargs -0 node ../../../scripts/biome.cjs check --write"
}
```

## Declared documentation links

No additional documentation links are declared in the inspected catalogue.

## Existing agent-guide projection

```json
{
  "path": "packages/apps/web-landing/public/llms-packages/app.lssm-ecosystem-web.txt",
  "route": "/llms/app.lssm-ecosystem-web",
  "sourceUrl": "https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/app.lssm-ecosystem-web.txt",
  "blobSha": "bba148aafb77ed59ead8499d515c3a3f33bc0109",
  "sourcePin": "bcc79fcc27c4d801c2119bef81ddcce7b4e86498",
  "bodyEqualsReadme": true,
  "aggregateSourcePath": "packages/apps/web-landing/public/llms-full.txt",
  "aggregateBlobSha": "691b1d33efee24c440598b9106c81432f56aafaf"
}
```