bundle.managed-companyos

Managed CompanyOS Bundle

The OPA Planner renders persisted Work-backed proposals and unscheduled reasons separately from committed focus time. Proposal generation does not apply calendar effects. History and idempotent replays remain scoped to the active workspace.

OPA Settings includes localized per-action automation defaults/ceilings across organization, workspace, team, and user targets. Effective inherited modes and the inactive-background-execution status remain visible. The Planner offers an explicit reviewed Add to calendar action, with pending synchronization kept distinct from completed writes.

The CommunicationOS screen contract accepts an explicit dataMode. Authenticated managed routes use live; deterministic previews retain preview, preventing production workspaces from presenting fixture counts or demo disclosures.

The meeting-intelligence projection makes decision and workshop meetings written-first: preparation is required unless an explicit urgent override is recorded. Private playbooks stay separate from shared pre-reads, and publication and follow-up dispatch require current human approval. The bundle can now render contract-validated live readiness, context, artifacts, and work-session counts for a server-selected meeting while keeping refresh authority host-owned.

OPA Settings includes the CompanyOS Briefings 2.0 personal control plane: Google connection health, calendar selection, explicit authorized-workspace mapping, locale, timezone, recap time, preparation lead, enablement, recent privacy-safe delivery evidence, and separate one-to-one morning/preparation previews through the current user's real personal pipeline. The surface displays setup_required until the current user completes their own personal setup and does not offer a workspace-calendar fallback.

The native OPA Booking hub lets an authorized owner edit each active booking link's exact HTTPS embed-origin allowlist after creation. Saving uses the current link revision, refreshes the scoped ledger, and keeps hosted-only mode available by saving an empty list. Embed snippets remain disabled until at least one origin is persisted.

@lssm-tech/bundle.managed-companyos is the provider-neutral composition boundary for Managed CompanyOS, the invite-led AI operating system for companies built on the ContractSpec substrate.

CompanyOS design pack (./design)

./design exports two CompanyOS-scoped designs. Neither is a built-in catalog pack, so sibling products do not inherit them.

Calm pack: the workspace default

CompanyOsCalmDesignPack (companyos.design.calm-assistant@1.0.0) is the CompanyOS-scoped default design: warm paper, pine actions, rust focus, certified light and dark modes.

• createCompanyOsDesignRegistries() returns theme and design-pack registries with the CompanyOS pack first and every built-in pack after it (multi-theme selection keeps working).
• COMPANYOS_DESIGN_PACKS / COMPANYOS_DESIGN_THEMES list what CompanyOS hosts offer; COMPANYOS_CALM_DESIGN_PACK_REF is the default for app policies and SSR hydration fallbacks.
• COMPANYOS_CUSTOM_DESIGN_BASES is the catalog passed to materializeCustomDesign, so tenant custom designs may start from the CompanyOS pack.
• listCompanyOsDesignChoices() maps COMPANYOS_DESIGN_PACKS to picker options (key, version, title, light-mode background/primary/accent swatches), and toDesignPackRef() turns a choice back into a DesignPackRef.

Campaign pack: public site only, never a user choice

CompanyOsCampaignDesignPack (companyos.design.room-for-work@1.0.0, theme CompanyOsCampaignTheme, companyos.theme.room-for-work) is the "Room for the real work" campaign design: mineral white canvas, deep ink, restrained cobalt and a warm worklight accent, IBM Plex Sans and an editorial style profile. COMPANYOS_CAMPAIGN_PALETTE holds its light and dark palettes and COMPANYOS_CAMPAIGN_DESIGN_PACK_REF its reference. It is marked experimental.

The campaign pack is not in COMPANYOS_DESIGN_PACKS, so it is never offered by listCompanyOsDesignChoices(), never registered in the workspace design picker and never persisted as a user selection. Do not add it to the designs passed to AppearanceMenu.

The web app applies the campaign theme to its public pages only. CampaignThemeScope (packages/apps/web-application-monolith/src/lib/campaign-theme.tsx, app-internal) wraps the (marketing) layout in DesignSystemThemeProvider with CompanyOsCampaignTheme, mode="light" and CSS variables applied. Marketing routes are forced light by the route theme. The scope never calls the design selection adapter, so a visitor's or user's saved design is untouched.

AppearanceMenu (./ui/appearance)

AppearanceMenu is the header control for light/dark/system mode and the design pack. Choices are a transient preview scoped to the open menu. Only "Apply" calls onCommit; closing the menu or "Cancel" restores the committed design and mode.

AppearanceMenuProps (ui/appearance/types.ts):

A rejected onCommit keeps the menu open, shows labels.error as an alert and leaves the committed selection unchanged. Hosts build onCommit with createAppearanceCommit(ports): it persists a changed design first (APPEARANCE_DESIGN_UNKNOWN for a key not in designs), and only after that succeeds applies the mode and refreshes the server-resolved design. The web app composes it in src/lib/use-appearance-control.tsx with listCompanyOsDesignChoices().

This contract replaced the earlier mode/onModeChange/activeDesignKey/onDesignChange/pending/error props (.changeset/companyos-visual-growth.md).

Feature Hub composition

./feature-hubs now consumes the canonical module-owned Integration, Auth User, Auth Admin, Agent System, Agent Network, Workflow, CommunicationOS, and CompanyOS Hubs through composeFeatureHubs(). The bundle keeps opinionated CompanyOS route aliases and compatibility re-exports, but the modules remain the canonical owners. Provider adapters, secrets, schedulers, databases, and deployment topology stay host-supplied. Social Media remains independently installable and can be added by verticals that opt into that feature.

It is intentionally safe for app packages to import while keeping lower layers pure:

• Apps may compose this bundle plus approved modules/libs.
• This bundle must not import app packages, example packages, provider SDKs, or raw provider credentials.
• Managed and BYOK integration ownership modes must expose equivalent admin affordances while using different support/accountability copy.
• Secret material is represented only as redacted references, never raw values.
• Public managed CompanyOS surfaces are inventoried with compatibility intent and verification evidence.
• Executable proof helpers must stay tied to runnable code and tests, not PRD-only narrative.

Experience coverage ledger

./experience-coverage exports the governed CompanyOS, OPA, CommunicationOS, and SupportOS feature/journey manifest plus its redacted product-health projection. Callers can pass explicit productIds to produce a scoped report; its totals and completion denominator are recomputed from only those products. Empty or unknown product scopes fail closed instead of producing a misleading empty report. Status and completion are computed from verified evidence gates; route existence and fixture rendering do not count as implementation.

The web application exposes the projection through the authenticated, read-only /api/companyos/admin/product-health endpoint and renders it at /companyos/admin/product-health. Both surfaces use the exported managedCompanyOsProductHealthScope, so SupportOS cannot alter the CompanyOS, OPA, and CommunicationOS denominator. The UI filters by product, module, persona, platform, status, provider, and blocker. Run the completeness and report loop with:

bun test packages/apps/web-application-monolith/src/product-health/route-inventory.test.ts
bun run --cwd packages/apps/web-application-monolith experience:coverage

The generated Markdown and JSON reports live under generated/experience-coverage/. The companyos-opa-communicationos-1.0.0 artifact intentionally excludes SupportOS, which retains its own capability matrix. Generation fails when an in-scope route has no feature classification or an out-of-scope product enters the report.

Tenant-aware workspace shell

./view-models/workspace-shell accepts an optional provider-neutral workspaceIdentity presentation override. Apps may use server-authoritative tenant composition to replace fixture display name, domain, and industry in workspace summaries, breadcrumbs, command headings, adaptive context, and graph labels. Fixture ids, source anchors, records, navigation, and evidence ids stay unchanged.

When the requested RoleMorph role is absent from a presentation fixture, the projection preserves that requested role and derives presentation defaults from the fixture. It never silently substitutes the fixture's first role. Tenant resolution, membership, capabilities, and provider authority remain app and runtime responsibilities.

The web shell may hydrate its switcher with a server-verified active context so the current organization and workspace are visible on first paint while the authoritative context list refreshes. Only optional OPA and CommunicationOS route families are module-entitlement gated; authenticated core CompanyOS routes continue to rely on their own persona and capability guards.

UI surface (./ui)

The G006 profile surface exports provider-neutral profile DTOs, projection and health helpers, an optimistic revision reducer, and typed en/fr/es catalogs. Its admin and public templates accept persisted API projections only; provider connections, authentication, transport, and secrets remain outside the bundle. Profile analytics are limited to destinationMode and revisionBucket.

G006 browser projections and copied local drafts strip tenant, profile, link, event, scheduling, connection, avatar, and public-booking references. A new hybrid event may be persisted with an approved HTTPS Calendly destination; a new unprovisioned owned-live event fails closed and uses the locale catalog for its validation feedback. The final size gates are 235 lines for the catalog, 90 for ProfileEventList, and 150 for ProfileAdminEditor.

Apps may attach an opaque contextFingerprint to the admin load DTO. The template uses it only to remount local editor state; the browser sends it in the authoritative preview header and echoes it on initialize, draft, publish, and revoke commands. The bundle never interprets it as tenant or provider authority, and it must not contain a raw tenant, organization, session, token, profile, calendar, or provider reference.

The same UI barrel exports responsive Company Intelligence and Organization Planning dynamic templates. They consume request-backed, tenant-free snapshots, render all seven canonical route states in en, fr, and es, and keep blocked actions and dependency health visible without inventing executable client authority. Browser transport, authentication, persistence, and provider effects remain app/runtime responsibilities.

The Organization Planning surface now resolves a canonical adaptive experience from server authority, RoleMorph, policy ceilings, explicit preferences, accepted suggestions, and safe role/job defaults—in that order. It exposes Today, Scheduling hub, and Module dashboard modes only when the current role may use them; auditors remain evidence-first and AI operators remain proposal-only for accountable actions. The mode toolbar persists only a user’s explicit, tenant-scoped home choice through the app BFF. Runtime adaptation remains non-persistent and includes visible “why” and reset controls.

Public booking projects six explicit steps—event, date, time, details, review, and outcome—and distinguishes draft, pending approval, processing, durable confirmation, and repair states. Unsafe or stale availability never becomes a selectable slot. Tenant branding is presentation-only and cannot hide the CompanyOS trust mark or lifecycle truth.

OPA_VISUAL_MATRIX freezes 2,448 governed cases across 320/375/768/1280px, light/dark, en/fr/es, every role-permitted home mode, host/company/neutral branding, and standard/expanded copy. It is the canonical input for visual baseline generation; generated screenshots and human approval remain promotion evidence rather than source contracts.

All 427+ shared React components from the app shell have been migrated into this bundle under src/ui/<domain>/ via PR series chore/migration/slice-* (Slices 1–13). The ./ui subpath is the canonical UI surface for managed CompanyOS.

Import patterns:

// Barrel (all domains)
import { GovernancePolicyPanel } from '@lssm-tech/bundle.managed-companyos/ui';

// Per-domain (tree-shakeable, preferred)
import { GovernancePolicyPanel } from '@lssm-tech/bundle.managed-companyos/ui/governance';

UI domains available: agents, analytics, audit, auth, autonomy, brain, cockpit, composition, finance, governance, graph, inbox, integrations, knowledge, landing, lifecycle, onboarding, policy, replay, shared, special-ops, status, team, threads.

• SSR by default — all components are React Server Components unless they carry an explicit "use client" directive.
• App shells must not import from src/ui/ by filesystem path; use the subpath exports only.

Integration Hub reusable surfaces

The bundle is the canonical source for the reusable Integration Hub view-models and templates consumed by examples and app shells.

Provider-neutral view-models:

• buildIntegrationHubViewModel from the root export or ./view-models/integration-hub builds the searchable catalog summary, managed/BYOK counts, health counts, recommended tiles, screen-state matrix, and redacted credential references.
• normalizeManagedCompanyOsIntegrationCatalog and normalizeManagedCompanyOsIntegrationConnections convert workspace integrations into reusable catalog/connection records without app-local catalog rebuilding.
• buildIntegrationHubViewModelFromCatalog accepts normalized IntegrationHubCatalogRecord[] and IntegrationHubConnectionRecord[] input, so examples and app shells can pass provider-neutral records through the bundle instead of forking list/detail behavior.
• Public helper types (IntegrationHubCatalogRecord, IntegrationHubConnectionRecord, IntegrationHubFilterState, IntegrationHubHealthSummary, and IntegrationHubActionDescriptor) are exported with the catalog seam and remain pure data contracts.
• buildIntegrationDetailViewModel, buildIntegrationConnectionsViewModel, buildIntegrationSyncsViewModel, buildIntegrationCredentialsViewModel, buildIntegrationSecretsViewModel, buildIntegrationConfigViewModel, and buildIntegrationAuditViewModel live under their ./view-models/integration-* subpaths and stay pure: no provider SDKs, network calls, persistence, filesystem reads, or secret access.
• buildIntegrationHubRegistryCatalog (root export) maps host-joined registry catalog records (for example joinIntegrationCatalogView output) into healthy catalog entries with the view-support-boundary affordance; hosts keep loading the definitions.
• The legacy ./integration-hub-view-model shim is source-compatible for one release cycle; new consumers should import from ./view-models/integration-hub.

Reusable UI:

• Catalog and detail templates are exported from @lssm-tech/bundle.managed-companyos/ui/templates (IntegrationHubTemplate, IntegrationDetailTemplate, ConnectionsTemplate, SyncsTemplate, ConfigTabTemplate, IntegrationAuditTabTemplate, CredentialsTabTemplate, and SecretsTabTemplate).
• DeploymentTopologyTemplate renders the EN/FR/ES topology passport: nine independent deployment axes, RoleMorph-resolved authority copy, non-activating reference postures, and a provider-proof ledger. New consumers supply a canonical providerReceipt, exact receiptScope, and trusted time; missing, stale, failed, cross-scope, or digest-mismatched proof never renders as verified. The legacy display-only receipt input remains deprecated for source compatibility.
• IntegrationHubTemplate owns the health overview/details CTA, Info links, search/category/status/mode filters, recommended row, explicit managed/BYOK install wizard, and read-only configure affordance for denied personas.
• Capability atoms and integration-domain design primitives are exported from @lssm-tech/bundle.managed-companyos/ui/integrations.
• CredentialsTabTemplate and SecretsTabTemplate are security-class templates. App routes that render them must be force-dynamic and must re-resolve session/persona per request.

Ownership and redaction contract:

• Every catalog entry must expose managed/BYOK support metadata or an explicit exception rationale.
• Turn-on/configuration flows must require an explicit managed vs BYOK choice; do not silently default to managed.
• View-models, fixtures, rendered HTML, snapshots, logs, and evidence packets may show only redacted credential references such as ******** or secretref://...; raw credential-like values block promotion.

Registry projection contract:

• Managed CompanyOS consumes provider-neutral catalog view records only. Bundle source must not import Integration Hub examples, implementation packages, concrete provider SDKs, provider clients, network adapters, or raw credential fixtures to build catalog tiles.
• Preserve the registry two-state model in view-models: catalog availability is a policy/display overlay, while connection activation is derived from tenant/workspace connection records. Filtering one state must not mutate or erase the other.
• Displayed tile counts, recommended tiles, and health summaries should be based on the same filtered provider-neutral tile set unless a helper explicitly documents a global/unfiltered summary.
• requiresModeChoice remains true for install/configure affordances so the user/operator selects managed or BYOK before any connection flow starts.
• Promotion evidence for catalog changes should include:

bun test packages/bundles/managed-companyos/src/view-models/integration-hub/__tests__/integration-hub-normalized.test.ts
bun run --cwd packages/bundles/managed-companyos typecheck
bun run managed-companyos:provider-safety

Public composition helpers

• createManagedCompanyOsWorkspace creates the deterministic reference workspace with tenant, policy, graph, workflow, replay, evidence, and health projections.
• createManagedCompanyOsReadinessReport proves required app surfaces, dual-mode integrations, fail-closed approvals, evidence receipts, and runtime health.
• createManagedCompanyOsGovernanceReport classifies managed public surfaces, S0 inventory row refs, and evidence refs before risky implementation changes.
• createManagedCompanyOsExecutableProof proves this bundle exposes runnable managed CompanyOS behavior and test-backed evidence.
• buildManagedCompanyOsIntegrationOwnershipViewModel keeps managed and BYOK integration UX at affordance parity with redacted credentials.
• evaluateManagedCompanyOsProviderCandidate fails closed for raw secrets and requires explicit approval before concrete provider SDK wiring.
• createReferenceManagedCompanyOsIntegrationPort provides a deterministic provider-neutral port for app layers.

Concrete provider defaults, managed-provider SDK wiring, credential-handling authority, persistence adapters, and production queue choices remain approval-gated follow-up work.

Managed Builder navigation

The bundle registers /companyos/builder as a bundle-backed navigation surface for the managed Builder Workbench. It links to integration setup and evidence surfaces, but it does not replace or relabel the existing agent/workflow route families. App shells should consume managedCompanyOsNavRegistry and managedCompanyOsNavGraph rather than duplicating Builder route copy locally.

I18n-ready product surface copy

The bundle owns Managed CompanyOS business display copy so app shells do not fork route labels, route descriptions, or degraded-state wording into app-local dictionaries. Product surface snapshots and route builders accept an optional locale input and resolve copy through the bundle translation runtime:

import { createManagedCompanyOsProductSurfaceSnapshot } from '@lssm-tech/bundle.managed-companyos/product-surfaces';

const snapshot = createManagedCompanyOsProductSurfaceSnapshot({
  locale: 'fr',
});

The ./product-surfaces subpath is the preferred app/mobile import because it exposes only the RN-safe pure route/view-model snapshot seam and avoids pulling SSR/web UI barrels into Expo.

Current catalog coverage for the product-surface route group is en, fr, and es; unsupported or partial requests fall back through the deterministic bundle translation runtime to en. The localized fields are display-only: route ids, API paths, web paths, capability refs, evidence refs, health statuses, policy/evidence reason fields, tenant ids, and correlation ids remain stable machine values.

App adapters should pass a negotiated locale or preference context into the bundle helpers instead of duplicating Managed CompanyOS business copy locally. Web and mobile shells remain responsible for host-specific locale detection, document metadata, React/React Native boundaries, and hydration/snapshot handling.

Capability graph

src/capability-graph/ exposes the production-owned, pure shape contracts and view-model projections for the Special Ops capability graph. It is the SHAPE source-of-truth — repository (T4), API (T7), worker (T8), and web (T9) surfaces must match these types.

• Types: CapabilityNodeKind, CapabilityStatus (enabled | blocked | degraded | disabled), CapabilityNode, CapabilityEdge, CapabilityGraph.
• Pure builders: createSpecialOpsCapabilityGraph(), createSpecialOpsWorkspaceProfile(), createSpecialOpsSeedRunReceipt(), attachSpecialOpsCapabilityGraph() (clock is injectable; no Date.now()).
• Projection selectors: selectCockpitProjection, selectOpsSprintProjection, selectWorkGraphProjection — tenant/workspace-scoped, redaction-aware. Disabled or restricted nodes surface a [redacted-capability] label and a disabled effective status with no raw secret material.
• View-models that consume these projections live in src/view-models/special-ops, src/view-models/ai-ops-sprint, and src/view-models/work-graph. Each output carries a deterministic locale (default en) and an optional displayCopy map keyed by ManagedCompanyOsI18nKey, ready for T7/T9 to hydrate localized strings without forking builders.
• Major-version cleanup removed legacy Managed* capability aliases; use CapabilityNodeKind, CapabilityStatus, and CapabilityGraph directly.

Repository ports and deterministic adapters (./repositories)

@lssm-tech/bundle.managed-companyos/repositories owns the reusable, driver-free repository layer that the API host composes:

• WorkspaceCapabilityRepository port, WorkspaceRow / CapabilityNodeRow / CapabilityEdgeRow / SeedRunInput row contracts, TenantMismatchError, and the row-to-capability-graph projections (workspaceRowToProfile, nodeRowToNode, edgeRowToEdge).
• InMemoryRepository<E> (fail-closed assertTenantAccess on every call, idempotent dry-run aware mutations), the seeded create*Repository() factories, and InMemoryWorkspaceCapabilityRepository.
• MutationLedgerRepository port, mutationResultFromLedger, and the in-memory and injected-SQL (DrizzleMutationLedgerRepository) ledgers over managed_companyos_mutation_ledger.
• RepositoryQueryFn / RepositoryExecFn / RepositorySqlParam: the minimal injected SQL seam. The bundle ships no driver; hosts bind these to their own pool and keep env-based repository selection.

import {
  createInMemoryWorkspaceCapabilityRepository,
  InMemoryMutationLedgerRepository,
} from '@lssm-tech/bundle.managed-companyos/repositories';

Special Ops domain (./special-ops)

@lssm-tech/bundle.managed-companyos/special-ops owns the Special Ops lifecycle over the bundle-declared managed_companyos_special_ops_* tables:

• Row contracts (SpecialOpsMissionRow, SpecialOpsDraftRow, SpecialOpsReviewCardRow, SpecialOpsWeeklyReportRow, SpecialOpsGovernanceAssessmentRow, SpecialOpsEvidenceReceiptRow, SpecialOpsAuditEventRow) and the SpecialOpsRepository port.
• Role mutation policy (assertCanMutate; SpecialOpsLifecycleRole is ManagedCompanyOsRole), scope/redaction guards, typed errors carrying HTTP status, and deterministic receipt/audit builders shared by every adapter.
• InMemorySpecialOpsRepository (deterministic test/dev authority) and the weekly report Markdown export (composeWeeklyReportMarkdown).
• DrizzleSpecialOpsRepository: the SQL adapter over those tables. It takes an injected SpecialOpsQueryFn (statement, params, access); the host binds it to its driver, applies the RLS GUCs, and hydrates jsonb columns.
• createSpecialOpsFacade(resolveRepository): the command/query facade. Hosts pass a resolver so env-based adapter selection and database driver binding stay in the host composition root.

import {
  createSpecialOpsFacade,
  InMemorySpecialOpsRepository,
} from '@lssm-tech/bundle.managed-companyos/special-ops';

const repository = new InMemorySpecialOpsRepository();
const specialOps = createSpecialOpsFacade(() => repository);

Evidence ledger adapter (./evidence-ledger)

@lssm-tech/bundle.managed-companyos/evidence-ledger exports EvidenceLedgerRepository, the driver-free adapter for the @lssm-tech/lib.observability EvidenceAppendPort / EvidenceLedgerReadPort over the bundle-declared managed_companyos_evidence_outbox and managed_companyos_evidence_ledger tables. appendEvidence is idempotent (ON CONFLICT (idempotency_key) DO NOTHING), drainOutbox returns EvidenceOutboxRows for the worker relay, and readEvidence clamps reads to 1000 rows. Hosts construct it per transaction with the active tenant-scoped EvidenceQueryFn so outbox rows commit atomically with the producing mutation.

Observability and behavior signals (./observability)

@lssm-tech/bundle.managed-companyos/observability is node-free and owns the PostHog wire names (POSTHOG_EVENTS, POSTHOG_PROPS, POSTHOG_LIBS) plus the CompanyOS behavior-signal vocabulary shared by the web and native hosts: CompanyOsSurfaceId, CompanyOsBehaviorSignal, hashTenantRef (FNV-1a tenant_ref_<hex>), COMPANYOS_BEHAVIOR_SIGNAL_PROHIBITED_CONCLUSIONS and the builders createCompanyOsBehaviorSignal, createCompanyOsBehaviorSignalEvent, createCompanyOsBlockedActionEvent and createCompanyOsBehaviorSignalCaptureProperties.

Hosts call createCompanyOsBehaviorSignalRecorder({ emitter, transport, sink }) and inject only their adaptive-experience emitter and capture sink (posthog-js or posthog-react-native). Every signal carries the non-overridable tenant-identity-inference prohibited conclusion (on the signal model and in event metadata.prohibitedConclusions) and only a pre-hashed tenant_ref.

RoleMorph action contracts (./rolemorph-action-contracts)

createManagedCompanyOsActionContracts({ workflowId, componentKey, displayActionIds, governedActionIds, namespace, governedImpact, governedSafetyRefs }) classifies display-only and governed actions and builds their ontology refs under namespace (default companyos). governedImpact: 'mutate' marks governed actions high-impact (policy and evidence required); their safety refs come only from the caller's governedSafetyRefs, so a host without evidence is blocked by RoleMorph.

createManagedCompanyOsAuthorityDecisions(workflowId, actionIds, policyDecisions, { namespace, allowReason }) is bound to resolved policy: an action is authorized only when exactly one policy decision resolves it, and is denied otherwise (fail closed). createManagedCompanyOsPermissionDecisions and governedManagedCompanyOsActionIds derive explicit permissions from a component registry.

Superapp shell (./superapp-shell)

The CompanyOS superapp catalog (SUPERAPP_PERSONAS, workspace/surface types, SUPERAPP_ACTION_LABEL_KEYS, createSuperappComponentRegistry), the per-persona RoleMorph policy (createSuperappPolicyDecisions) and the pure resolveSuperappShell({ config, workspaceId, personaId, translate, roleMorph }) resolver. Hosts inject the workspace config, their translator (which must know SUPERAPP_SHELL_MESSAGES_EN / _FR / _ES, spread into the host catalogs; each persona declares its labelKey and objectiveKey) and the RoleMorph binding (namespace, governedSafetyRefs, decision copy). Governed actions are high-impact; without host evidence they are blocked and their surfaces are removed (fail closed).

Tenant-safe read projections (./read-projections)

projectCompanyBrain, projectTemporalGraph, projectExperimentOutcome and projectProviderHealth gate every read through the authenticated tenant actor, assertTenantAccess and the injected authorize port, failing with AUTHENTICATION_REQUIRED, TENANT_ACCESS_DENIED or AUTHORIZATION_DENIED, and project only redacted, read-only fields. Hosts (for example the MCP server) keep the resource-registry glue.

Worker supervision (./worker-supervision)

createManagedWorkerSupervisionHealth(run, nowMs) derives the canonical ManagedWorkerSupervisionHealth from a narrow structural run view (stale, degradedReasons, jobs[].kind/status/stale).

Company Intelligence snapshot projection (./view-models/company-intelligence)

projectCompanyIntelligenceSnapshot(descriptor, results, surface) maps the companyos-spec surface descriptor and API results into the CompanyIntelligenceSnapshot view model (401/403 → unauthorized, 503-only → degraded, mixed → partial); hosts keep their HTTP transport.

Design-partner readiness view-model

The bundle owns the pure design-partner readiness projection for the Managed CompanyOS private-pilot path. The fixture remains fictive and test/demo only; the activated path must receive persisted API data and follow the shared private-pilot contract^†. Import from the root bundle export or the narrow subpath:

import {
  buildDesignPartnerReadinessViewModel,
  createNdconsultingDesignPartnerFixture,
  evaluateDesignPartnerReadinessProof,
} from '@lssm-tech/bundle.managed-companyos/view-models/design-partner-readiness';

The view-model exposes the deterministic tenant/workspace/scenario identifiers, mission command cycle, decision packet, expert attestation, founder approval, weekly report draft, evidence/replay links, known gaps, blocked/degraded reasons, role-gated affordances, and aiCannotDispatch: true.

Design-partner fixture boundary:

expert_reviewer is now part of ManagedCompanyOsRole. It may attest the decision packet, but cannot founder-approve or dispatch. founder_approver may founder-approve but not attest. operations_manager prepares only; auditor is read-only; AI proposes only; frontline_staff cannot mutate; enterprise_admin is not accepted as founder approval.

The fixture readiness proof can reach ready_for_design_partner_review only for the design-partner review boundary. It still carries noProductionReadinessClaim, noProviderDispatch, and fictive-only assertions. Production activation is a separate operator decision and remains blocked until the private-pilot contract's tenant, data, domain, ownership, support, restore, kill-switch, and deferred-surface decisions are approved.

Special Ops production cutover

The Special Ops monolith production slice is documented in docs/runbooks/special-ops-monolith-production.md^†. The bundle owns only pure, provider-neutral contracts for Special Ops, AI Ops Sprint, work graph, capability graph, replay, evidence, redaction view models, and deterministic database lifecycle artifacts. Live tenant/workspace persistence and provider dispatch remain app-layer approval-gated work; do not import example packages, provider SDKs, or raw fixture/customer data to satisfy the production cutover.

Managed CompanyOS production-path boundary

The authenticated workspace shell accepts persisted workspace module entitlements in addition to RoleMorph authority. LSSM, CompanyOS, and newly provisioned personal workspaces enable only opa and communicationos; the sidebar omits all other module screens and the API host independently rejects disabled authenticated OPA operations before storage or provider work. Seed selection is explicit: live commands accept core-workspaces or all (the live lssm and companyos organizations). Hirly and NDconsulting were decommissioned on 2026-10-20 (Evidence^†); the deprecated legacy-reference profile keeps NDconsulting available in source for local/reference fixtures only and is refused live. The retired lssm-hirly profile is refused by every bootstrap and seed path and stays exported by the company spec only until its next major.

The broader Managed CompanyOS production path is coordinated by docs/runbooks/managed-companyos.md^†. For this bundle, the production-path review has one hard boundary: keep schema, manifests, pure builders, view-models, redaction helpers, capability graph contracts, replay, and evidence receipts deterministic and provider-neutral.

Production runtime concerns belong outside bundle module-load/helper execution:

• live DB repositories/connections (the bundle only prints deterministic migrate/seed SQL artifacts);
• session cookies, headers, and protected-route guards;
• concrete provider SDK dispatch, webhook calls, queues, or filesystem state;
• external production credentials or customer data.

The bundle exposes pure SQL/manifest/contract artifacts for app-owned tooling to execute through bun run --cwd packages/bundles/managed-companyos database:cli <migrate|seed|verify|plan>. The deterministic seed includes tenant/workspace, capability graph, Special Ops proof rows, replay/evidence rows, and AuthOS fixture-backed projections in managed_companyos_authos_projections; it must not open connections, mutate persistence, read secrets, or import app/example/provider packages during import or helper calls. Attach static import-guard, redaction-scan, database:verify, database CLI artifact, test, typecheck, lint, and build evidence before treating a boundary change as complete.

Host-bound behavior subpaths

These subpaths hold behavior that app hosts previously duplicated. They stay pure or take explicit host bindings; fetch origins, cookies, browser storage, navigation, digests and session lookup remain in the host.

• ./access-policy — fail-closed mutation predicates shared by hosts: authorizeManagedCompanyOsSessionRole (a request acts only with its session role), authorizeManagedCompanyOsSessionRevoke (enterprise_admin, siblings only), authorizeManagedCompanyOsIntegrationConfigure (enterprise_admin with an explicit managed/BYOK choice), authorizeManagedCompanyOsWorkflowDecision (auditors read-only, approval_required steps only, AI-operator steps fail closed) and toManagedCompanyOsActorKind.
• ./profile-drafts — the OPA profile trust boundary: redactProfileAdmin strips server refs and OPA_PROFILE_PROTECTED_AUTHORITY_KEYS before the browser and derives owned-live readiness; restorePrivateDraft re-binds server refs by client id from a host-computed opaque digest; buildDefaultIntroEventDraft appends the default 30-minute Google Meet intro event to a schema-validated mutation draft.
• ./public-booking — v2 public booking client over an injected PublicBookingTransport: availability parsing (on the shared @lssm-tech/opa-booking-react/availability parsers), the lifecycle client implementing PublicBookingLifecyclePorts, status mapping, and the latest-request refresh guard. Status exchange tokens stay in memory; only the safe manage model is persisted through the host callback.
• ./ui/public-booking — PublicBookingTemplateClient, the smart container for PublicBookingTemplate over a stable PublicBookingHostBinding.
• ./ui/organization-workspace — OrganizationWorkspaceSwitcher and useOrganizationWorkspaceSwitcher over a host OrganizationWorkspaceTransport with en/fr/es copy (resolveOrganizationWorkspaceSwitcherCopy).

Agent/Workflow Command Center readiness

The production-path Agent/Workflow Command Center slice is tracked by docs/agent-workflow-command-center-production-readiness.md^†. Treat that packet as the gate for agent lifecycle, tool registry/permissions, workflow builder/run execution, review/governance/audit/replay, and cross-surface UX parity. The bundle remains the reusable product surface; web/mobile hosts and examples must consume module/bundle APIs rather than owning command-center domain behavior.

The command-center view-model now exposes explicit Atomic CRUD coverage through buildAgentWorkflowCommandCenterViewModel().atomic:

• domains: tool, agent, and workflow;
• modes: list, create, update, and detail for every domain;
• states: loading, empty, error, denied, read-only, allowed, dirty-invalid, review-required, and blocked;
• per-surface capabilities, policy, auditRefs, replayRefs, redaction mode, app-relative pillarRoute, and optional host-prefixed hostRoute.

AgentWorkflowCommandCenterTemplate renders that matrix with CVA-backed state variants. Keep it client-safe: do not import database, provider SDK, app, or example code into the view-model or template.

S6 release and operations readiness

The S6 handoff for this bundle is evidence-first and provider-neutral. A release candidate is ready only when the acceptance matrix, operator runbook, release copy guardrails, and final evidence packet all point to runnable checks.

Vercel-only Managed CompanyOS readiness seam

The bundle is the pure source of truth for production readiness snapshots. App shells should consume createManagedCompanyOsProductSurfaceSnapshot(), createManagedCompanyOsWebShell(), and status view-model helpers to expose vercelSnapshot manual-refresh semantics:

• vercelSnapshot.mode is manual-refresh.
• vercelSnapshot.transport is request-time-http.
• scheduled work is represented through API/Vercel Cron evidence, not a browser realtime channel.
• retained realtime exports are legacy/future VPS compatibility only and must not be used as Vercel production readiness requirements.

Acceptance matrix

Provider-neutral smoke harness

Use createManagedCompanyOsOrchestrationFacade and createManagedCompanyOsReleaseReadinessPacket for bundle-level dry-run proof. Smoke inputs must use deterministic reference providers, redacted credential previews, and expectedSdkInstantiation: false. App-layer provider catalog smoke may cover approved live/reference adapters only when each provider has managed/BYOK support metadata or an explicit exception rationale. Live Resend, Slack, PostHog, database, or webhook dispatch may be validated only from deployment secret-manager values after provider approval; missing values must fail closed. Raw values must not appear in git, snapshots, logs, release copy, or evidence receipts.

Environment validation and runbook

Support evidence is part of the same release gate: the operator packet must show how an incident or customer escalation moves from intake to acknowledgement, severity classification, mitigation, customer status updates, post-incident evidence capture, closure, and ownership handoff. P0/P1 communication expectations may be documented as reference-mode operating guidance, but the bundle must not claim managed support availability, contracted response times, or uptime commitments until a support owner and coverage model are separately approved.

Before promotion, operators validate these non-secret runtime variables:

• LSSM_STUDIO_DATABASE_URL

The Vercel API must not use MANAGED_COMPANYOS_STATE_FILE: Vercel Function storage is ephemeral, so PostgreSQL is the production state authority.

• MANAGED_COMPANYOS_DEFAULT_TENANT_ID

Provider env vars such as MANAGED_COMPANYOS_RESEND_API_KEY, MANAGED_COMPANYOS_SLACK_WEBHOOK_URL, and MANAGED_COMPANYOS_BYOK_SLACK_WEBHOOK_URL are optional until the approved provider dispatch smoke is enabled, and must be configured only through the deployment secret manager.

Before any approved provider smoke begins, validate the filled G006 decision artifact. The command is intentionally fail-closed: exit 0 means all mandatory provider categories are ready for adapter smoke, exit 1 means the artifact parsed but remains blocked, and exit 2 means malformed JSON or an invalid decision shape. Artifacts marked not_real_approval also fail closed unless the operator passes --allow-example, which is reserved for synthetic command-path evidence and must not be used as customer authorization.

bun run --cwd packages/bundles/managed-companyos provider-approval:validate \
  .omx/plans/evidence/g006-provider-approval-decision-template.json

Recommended S6 evidence commands:

bun run --cwd packages/bundles/managed-companyos test
bun run --cwd packages/bundles/managed-companyos typecheck
bun run --cwd packages/bundles/managed-companyos lint:check
bun run --cwd packages/bundles/managed-companyos build
bun scripts/check-managed-companyos-production-hardening.ts

The final release handoff should also include the executable scanManagedCompanyOsReleaseSurface secret/redaction scan, a provider-catalog parity guard, and a static import guard proving this bundle has no app, example, provider SDK, or CRDT/Loro enablement imports. Do not add a Managed CompanyOS CRDT flag, env var, or adapter import until docs/data-transmission-crdt-v0.md#crdt-promotion-criteria has green root baseline and focused CRDT evidence.

UX states

The managed bundle keeps the canonical UI states visible instead of collapsing them into a single healthy/failed binary:

• healthy surfaces the normal operator and product views.
• degraded keeps the degraded banner and degraded reason copy visible across the status and communication screens.
• down blocks promotion and keeps replay, scheduled snapshot, or evidence failures explicit instead of hiding them behind an API-only green check. Realtime worker/WebSocket failures are explicit future-VPS signals, not Vercel production requirements.
• active / inactive remain the auth-capability states for role and session affordances.
• Blocked or approval-required actions use explicit guard copy rather than provider, compliance, or credential claims.

These states are already exercised by the managed CompanyOS status, communication-screen, and product-surface tests; the S6 docs should describe them as UX contracts, not as new runtime modes.

Operator docs and evidence packet

Operators should use this bundle README together with:

• docs/companyos-ai-os-release-verification.md for the central evidence packet and verifier checklist.
• docs/release-workflow.md for the broader release-capsule and /llms* guardrails.
• The bundle tests that prove health, redaction, provider-neutral smoke, and release-copy guardrails.

The final evidence packet must list the exact commands that were run, the expected guardrail outcomes, and any known gaps that remain intentionally out of scope.

Integration with Custom Applications

This bundle is intended to be composed by the three official app monoliths (web, API, worker). If you need to integrate Managed CompanyOS into a custom application, use this bundle to build your own app composition:

import {
  createManagedCompanyOsWorkspace,
  createManagedCompanyOsReadinessReport,
  buildManagedCompanyOsIntegrationOwnershipViewModel
} from '@lssm-tech/bundle.managed-companyos';

// Build deterministic workspace
const workspace = createManagedCompanyOsWorkspace({
  tenantId: 'custom_tenant_id'
});

// Verify readiness
const ready = createManagedCompanyOsReadinessReport(workspace);
if (!ready.allGatesPass) {
  console.error('Not release ready:', ready.failures);
}

// Get dual-mode integration models
const managed = buildManagedCompanyOsIntegrationOwnershipViewModel('managed');
const byok = buildManagedCompanyOsIntegrationOwnershipViewModel('byok');

Important: Do not import this bundle at runtime in examples/*, packages/foundation/*, packages/platform/*, or packages/domains/*. The three official apps are the only supported composition boundary.

Provider Approval

This bundle is provider-neutral. All concrete provider integrations (Slack, Resend, PostHog, database/webhook adapters, AWS, etc.) are intentionally wired via approval-gated adapters in app/integration/provider packages, not in the bundle. Provider SDKs and credentials belong at the app composition layer, not here. Each catalog entry should expose managed and BYOK support by default; any managed-only or BYOK-only exception must name the operational reason and the approval/evidence path needed to close it.

The root export now includes parseManagedCompanyOsProviderApprovalDecision, evaluateManagedCompanyOsProviderApprovalDecision, assertManagedCompanyOsProviderApprovalReady, and createManagedCompanyOsLiveAdapterSmokePlan so approval artifacts can be parsed, evaluated, and converted into the per-category smoke checklist required before live adapter work starts. These helpers do not select a provider, open credentials, or authorize live dispatch; they only convert a filled decision record into approval_blocked or ready_for_smoke readiness and required smoke assertions.

Agent/workflow command center view-model

buildAgentWorkflowCommandCenterViewModel() exposes the production walking skeleton for the Agent + Workflow pillar. The model is deterministic and client-safe: it uses simulator-only tool bindings by default, records review-required workflow state, includes correlated audit/replay evidence, and never requires provider credentials or external side effects.

import { buildAgentWorkflowCommandCenterViewModel } from '@lssm-tech/bundle.managed-companyos';

const commandCenter = buildAgentWorkflowCommandCenterViewModel();

Use mode: 'blocked_tool' to render the fail-closed authorization-required state for tool registry and audit/replay screens.

Public comms + booking hub MVP

Managed CompanyOS now owns a provider-neutral public communications and booking hub for founder/design-partner workflows.

The public profile and booking templates use the Executive Ledger composition: an editorial identity panel, compact ledger-marked booking surfaces, a visible localized step state, responsive date/time selection, and semantic light/dark tokens. Internal labels such as Event Type: are stripped at the public projection boundary without changing stored administrative names.

• Public profile route: /u/nd-consulting renders configured profile copy, a social icon row (links with kind: "social", icon chosen from the link host, mailto: opens in place), list links grouped under their section headings with optional descriptions, and booking entry points.
• Public booking route: /book/founder-design-partner-call renders a public scheduler with date-first selection, duration chips, timezone viewing, and user-facing confirmation/trust copy; final confirmation still stays fail-closed until an approved app/integration calendar adapter is bound.
• Protected admin route: /companyos/admin/public-comms configures profile fields, link ordering, event type/duration, availability summary, calendar connection metadata, confirmation copy, evidence, and safety posture. Its desktop/mobile preview is revision-bound and request-backed; unsaved local edits are never presented as the persisted publication candidate.
• Calendar semantics reuse @lssm-tech/lib.organization-planning-spec public booking primitives and the app/integration calendar adapter seam; the bundle does not import provider SDKs or write calendars directly.
• Evidence/replay projections are redacted (evidence:companyos-public-booking:redacted, replay:companyos-public-booking:deterministic) and keep booker PII out of logs.
• The Organization Planning template provides an en/fr/es responsive smart-meeting form backed by the same-origin authenticated BFF. It renders fresh/cached/unavailable availability, distinct runtime-unavailable and role-blocked states, durable pending approval, replay, and explicit no-event-created states without receiving tenant or provider authority. Enterprise admins and founder approvers receive approval, denial, cancellation, rescheduling, manual status-refresh, and ready Google Meet affordances; operations managers can prepare and monitor without receiving mutation controls they cannot use.
• OPA uses one global CompanyOS shell plus contextual planning tabs. Its Today surface prioritizes the time ribbon, recommended action, setup gaps, and smart meeting preparation; personalization explanations and reset controls no longer compete with primary work in the page header.
• Planner and Focus are distinct request-backed Executive Ledger workbenches. Focus creates, reschedules, and cancels owner-calendar blocks with localized synchronization evidence; Planner groups committed time by day, generates a seven-day plan run, and exposes current workspace, write calendar, protected hours, and conflict count without leaking provider identifiers.
• MVP defers payments/tipping, public marketplaces, and workforce analytics.

Verification runbook:

bun test --cwd packages/bundles/managed-companyos src/view-models/public-comms-booking-hub/__tests__/public-comms-booking-hub.test.ts src/view-models/public-comms-booking-hub/__tests__/public-comms-booking-seam.test.ts src/view-models/public-comms-booking-hub/__tests__/public-comms-evidence.test.ts
bun test --cwd packages/apps/web-application-monolith src/proxy.test.ts
bun test --cwd packages/apps/web-application-monolith src/next-app.test.tsx -t "public-comms|public CompanyOS profile"

Verification runbook:

bun test --cwd packages/bundles/managed-companyos src/view-models/public-comms-booking-hub/__tests__/public-comms-booking-hub.test.ts src/view-models/public-comms-booking-hub/__tests__/public-comms-booking-seam.test.ts src/view-models/public-comms-booking-hub/__tests__/public-comms-evidence.test.ts
bun test packages/apps/web-application-monolith/src/next-app.test.tsx -t "public CompanyOS profile|runtime-configured public booking adapter"

Operator runbook: docs/runbooks/opa-public-booking.md^† covers adapter readiness modes, provider/vault safety, outbox replay evidence, smoke evidence, degraded states, rollback, and public-safe communication boundaries. Keep MANAGED_COMPANYOS_PUBLIC_BOOKING_ADAPTER_STATUS unset/invalid for fail-closed dry-run mode, sandbox_only for non-live provider proof, and adapter_ready only after approved app/integration adapter, vault, idempotency, outbox, route-policy, and Connect evidence are attached.

Smart-meeting operator runbook: docs/runbooks/opa-smart-meeting.md^†.

The additive forms workspace module mounts at /companyos/forms; public forms use /f/{opaqueToken}. Forms storage and authorization remain owned by CompanyOS and do not mutate OPA tables.

Native OPA demonstration view models use organization-planning-proof-runtime.native.ts over the pure manual-loop engine. The server seam retains the installed runtime. A parity test verifies identical deterministic output and blocked external effects, avoiding server database/Node imports in the native proof. This does not qualify the whole Expo application or native recording.

Meeting intelligence opens on My private preparation and offers an explicit Shared meeting workspace view. Each view has its own mounted client state and uses the matching server owner selector for reads and mutations. Switching views disposes private transcript state. Graph-context refresh is offered in the private view; shared notes/artifacts remain accessible separately. The selector is localized in English, French and Spanish and does not grant server permissions.

The private meeting view now offers Create private meeting when no meeting is selected. It reuses the canonical owner-bound creation API, retains ambiguous retry identities in tab session storage, and opens the returned private workspace with a resumable meetingRef URL. Creation does not start recording or invite participants. Capacity, denied authority and unavailable creation stay explicit. This web entry requires the private-meeting API to be deployed; browser audio capture/import is not added by this change.

Private meeting notes

CompanyOS exposes one private human-authored notes draft per meeting through additive opa.meeting_artifact.get_note and opa.meeting_artifact.save_note operations at GET/POST /api/v2/opa/smart-meetings/:meetingRef/notes. Existing meeting-work-session management permission authorizes this personal authoring surface; recording, transcript generation and model credentials are not prerequisites. Saves use expectedRevision (zero for creation), at most 100000 characters and a stable idempotency key. Notes remain live_notes/private_user/draft, persisted in the existing encrypted aggregate. Empty content clears the draft. Revision conflicts preserve the local draft and show the latest saved notes before an explicit choice to continue. Saving notes creates no Work task and sends no message.

Private meetings include a gated audio-file import panel (MP3/MPEG, MP4, WAV, OGG or WebM, up to 32 MiB). It requires server-advertised processing readiness and explicit consent/participant notice, rechecks owner/policy context and recovers using the exact original file plus tab-scoped digest checkpoints. No raw file or filename is persisted in browser storage. Missing capture configuration leaves private notes usable. This adds file import, not microphone recording, and activates no provider.

Recent private meetings are available through additive opa.meeting_workspace.recent (GET /api/v2/opa/private-meetings?expectedOwnerScopeDigest=...). Use the existing private creation-context digest; it prevents stale scope selection and grants no authority. The fixed latest-twenty view uses stored timestamps/readiness and optional 160-character canonical manual-note previews. Current authority is reproven before and after the encrypted owner read, and no caller scope or limit is accepted. CompanyOS renders snippets as plain text and reopens the existing meetingRef URL.

Selected meeting workspaces expose All private meetings (English/French/Spanish) to return to the recent list without reloading. The control clears only meetingRef, preserves other URL state and does not let an unchanged host prop restore the old selection. Actual incoming meeting-reference changes remain synchronized.

Pending planner placements expose a localized Check synchronization action that refreshes the live schedule and resolves only the matching focus block. Placement button state is scoped to the plan-run identity so a replacement proposal does not inherit an earlier accepted state. A bounded observer refreshes at most twelve times with five seconds between completed checks, stops when the pending reference clears or unmounts, and retains manual recovery afterward. Signed-client and browser acceptance remain separate qualification work.

Placement refresh shares an immediate in-flight guard with the apply action, and schedule reads time out after twenty seconds so manual recovery remains possible.

Schedule refreshes carry a local revision so late responses cannot overwrite newer planner state; unmount invalidates pending view updates.

Task split preferences use the existing scheduling proxy and opa.work_split_preference.get/save operations. Owner identity is server-derived; saves use revision CAS plus an idempotency receipt and enqueue replanning atomically. Apply migrations 0088/0089 and verify runtime grants before deploying this workflow. Absent/null preference remains unsplit, and saving never changes the Work estimate or applies calendar effects. Production acceptance remains pending.

The composition build explicitly targets Node-compatible server hosts (including Bun), matching the package runtime scope and default server rendering model. Existing ./ui entry points, client directives, and Node/Bun export targets are preserved; the composition root does not advertise a browser condition. UI helpers import their existing implementations directly rather than re-entering the server composition barrel. This keeps presentation dependencies narrower without changing role affordances, evidence verification or public exports.

UI projection imports use existing domain-specific view-model subpaths to avoid loading unrelated server domains through the all-domain barrel.

Reusable sign-in config accepts optional emailOtpEnabled, magicLinkEnabled and passwordResetEnabled flags. Explicit false removes the related control; omitted values preserve legacy defaults. These presentation flags never grant authentication authority.

OPA usability corrections: mobile booking exposes Change date from time selection; committed planner blocks group and display their saved timezone with both endpoints. Private notes identify unsaved edits and require explicit discard before Reload. Browser unload protection applies where supported; SPA navigation and meeting switching are not yet covered. Recent private-note filtering is local to authorized previews, and proposed-plan summaries distinguish sessions from distinct unscheduled Work tasks. Focused tests do not qualify deployed browser or signed-native journeys.

OPA interaction recovery preserves unsaved private notes when the meeting workspace itself changes meeting or private/shared view: users can continue editing or explicitly discard. This guard does not intercept unrelated SPA links or external authority/workspace changes, and it does not persist private drafts. Planner mutation retries retain the exact pending request and idempotency key while the mounted sender remains alive; ambiguous responses block a different mutation until the original intent is resolved. Refreshing or unmounting does not provide durable client recovery. Public booking date/time transitions move keyboard focus into the visible panel. These UI protections do not establish browser-wide, native or production release qualification.

OPA setup distinguishes booking configuration from calendar connection and keeps unknown readiness explicit. Private note navigation preserves the draft when anchor navigation is cancelled and restores appropriate focus. These client corrections do not grant server authority or qualify production readiness.

Private briefing consent reads and draft operations reject superseded UI responses. Refresh clears stale consent settings, and consent changes clear the displayed draft immediately. This client fencing does not establish durable model retry recovery or provider cancellation.

Private draft generation suppresses concurrent clicks and retains command identity for same-kind retries after failure. Keys are memory-only and clear after a validated successful result; page reload recovery and retrieval of a previously consumed command result remain outstanding.

Processing consent can be revoked while private draft generation is pending. The client aborts its old request and rejects late generated content; server-side cancellation/preemption remains subject to the documented admission and locking behavior.

Private briefing requests enforce browser deadlines across headers and JSON decoding: 15 seconds for consent and 60 seconds for drafts. Cancellation releases the UI even if a transport stalls; it does not prove that remote model work was cancelled.

Canonical portable composition declarations use narrow @lssm-tech/lib.contracts-spec-core leaves. The original package i18n factory and hydration stack are owned by @lssm-tech/lib.translation-runtime/contracts/i18n-factory; historical facade paths remain compatible. This import migration does not qualify providers or authorize host actions.

Autonomous Work Order fixture source projection

Managed CompanyOS owns the complete semantic authoring modules under generation/rolemorph/. They are source-generation inputs with the original Surface module context, outside the bundle TypeScript src include and builder entry patterns. They are never compiled or imported as a second runtime.

SurfaceRuntime retains its published fixture paths, barrel and singleton instance. Its contributor fixture:generate workflow parses the canonical ontology source and Core constructor source without importing either runtime module, then emits the complete original fixture bodies and a private typed six-reference binding. fixture:check rejects stale projections. Input SHA256 provenance covers both whole fixture sources, ontology/Core source and generator code; changed inputs are rejected before writing and after completion. Preparation, development, checks and publication inputs include the higher authoring source directly, without a bundle-build prerequisite or platform-to-domain dependency.

The bundle exposes ./fixtures/autonomous-work-order and ./fixtures/autonomous-work-order-helpers as exact forwards to the same Surface instance. The generator admits only the existing six literal ontology records and the known import projection. It does not evaluate product policy or emit approvals. Generated outputs and their qualification are pending the controlled owning workflow; Source implementation alone is not resulting-tree acceptance.

The canonical build retains its Node entry selection and emits the two fixture forwarding entries through build:browser:fixtures. Intentional published maps remain fixed, including all existing aliases and conditions. The full published surface and both new browser targets still require owning producer and consumer qualification.

Founder canary and executive cockpit (G1)

src/founder-canary/ composes the G1 one-mailbox canary: a read-only mailbox adapter bound to one connection and driven by S03's history-based createGmailMailboxSync (so mail after a traversal is admitted), Knowledge OriginalDocumentCustody and readability extraction, S02 account→context routing mapped to server-resolved Work scopes (an account default stays a candidate until an item classifier or the founder confirms it, and the binding revision is re-verified before any Work write), read-time withdrawal of cited originals, an evidence-keyed adapter over WorkManagementService, and PostgresFounderCanaryStore (founderCanaryMigrationStatements, tenant RLS). createFounderCanaryService implements the four founder.canary.* contracts. ui/founder-executive renders Today, Needs you, Brief, Evidence and Recovery through contract data views with EN/FR/ES catalogs; view-models/founder-executive projects canary status, briefs and the S06 morning/EOD model, never upgrading stale or partial sources to success. All five surfaces are in the experience-coverage ledger as implemented_local with missing evidence until verified.

Founder canary item classification policy

Recorded owner decision (2026-10-15): until an item classifier is qualified, every canary message's concerned context is reviewed by the founder in Needs you, even when the receiving account has a default context. Hosts bind no classifier to createAccountContextResolverPort, and the API readiness reports item_classifier: "manual_review_policy". Readable canary originals are recorded in the Knowledge evidence ledger (createKnowledgeEvidenceRecorder) once the context is confirmed, so a Gmail source or thread withdrawal also withdraws them; briefs drop withdrawn citations when read. Today renders the owner's newest validated S06 morning/EOD brief (founder.dayBrief.read) or states that the day context is not connected.