app.personalos-worker

PersonalOS Worker

Bounded transactional-outbox worker for PersonalOS projections, revocation, rights, and provider-sync destinations. It uses lease ownership, retries with a bounded backoff, and dead-letters poison work. Payloads are never embedded in outbox records; handlers reload authorized subject state from durable stores.

Production startup requires PERSONAL_OS_WORKER_COMPOSITION_MODULE, exporting createPersonalWorkerRuntime(). The host supplies subject-bound outbox stores, destination handlers, telemetry, and cadence. Cycles never overlap, destinations settle independently, and SIGINT/SIGTERM stop the loop after the active cycle.

createPersonalOsDurableWorkerRuntime() is the direct production factory for the independently leased personal.workspace.projection, personal.rights.export, personal.rights.delete, and personal.support.effect destinations. Its injected support executor reloads the immutable event and encrypted subject state, then returns evidence receipts bound to content-free notification intents for both-party grant/revoke/block delivery or subject plus safety recovery for reports. The worker requires the exact audience set, canonical event-derived intent IDs and templates, distinct provider assurance evidence, exact subject/recipient binding, and delivery inside the intent window. Extra audiences, incomplete, substituted, duplicate, or replayed proofs retry instead of acknowledging. Each handler reloads the immutable event by subject and event ID before effects. Projection work reloads and re-encrypts the composite workspace cursor; rights work binds the exact export/deletion event and delegates idempotent artifact or propagation effects to an injected rights executor. Provider deployment, artifact storage, and deletion-propagation canaries remain deployer evidence. Concrete notification provider credentials, provider callbacks, manual receipt reconciliation, and production delivery canaries remain host qualification; this package proves the fail-closed contract and acknowledgement boundary only.

PersonalGovernedProjectionTransportV1 binds the bundle's minimized Pactena and hCircle packets to the canonical governed data plane. The worker resolves the exact pairwise product authority, invokes the governed gateway before encryption, seals only its returned field allowlist with the receiving product key, and writes the strict encrypted materialization. Revocation acknowledges only an exact applied product receipt at or above the current watermark. The qualified harness sends the ciphertext through the bounded HTTPS source port and product ingress, proving the same request, idempotency, authority, and receipt boundaries used by host composition without sharing a database. The same harness sends each exact revocation through the bounded recovery port and product ingress before constructing the source acknowledgement; local lease metadata never crosses the product boundary. The host still owns durable authority stores, product databases, regions, KMS custody, recovery workers, rights processors, and production qualification.

When healthAuthorization is supplied, the same factory also composes an independent periodic consumer for the broker's durable, secret-free connection dispatches. It revalidates receipt, authority-proposal, and dispatch digests, executes through the subject workspace runtime, and settles by exact lease. Revision conflicts request a fresh authority decision and atomically supersede the old dispatch without reusing an OAuth code or PKCE verifier. This consumer must run even when callback API instances are unavailable so persisted completions remain recoverable after process failure.