@lssm-tech/integration.governed-data-postgres
Durable PostgreSQL persistence for the LSSM governed projection gateway.
The adapter stores projection catalog metadata, exact field/purpose grants, payload-free access decisions, revocation events, leased delivery attempts and acknowledgements, and export/erasure job state. Product records and shared projection payloads remain in their source systems and are read only through the governed gateway.
Every subject-bearing table uses forced row-level security. Runtime stores set
app.governed_subject_ref inside a short transaction and repeat the subject predicate in every query. The catalog is global metadata and cannot contain a domain payload or secret material.
The package accepts the provider-neutral DatabaseProvider, so the host may bind managed PostgreSQL, a vertical-managed database, or a customer-managed database without changing domain authority.
Catalog entries are immutable by projection id. Exact idempotent replay is accepted; a changed schema, offer, consent copy, or provenance record must use a new projection id so an existing grant cannot silently change meaning.
PostgresGovernedDeliveryWorkerStore claims due work with expiring leases, recovers abandoned leases, records only explicit consumer outcomes, schedules bounded retries, and moves ambiguous effects to a dead letter. Its operator projection omits pairwise subjects and payloads; only terminal failed items can be manually returned to pending.
The rights-job queue stores indexed processor, next-attempt, lease-expiry, and update metadata alongside the schema-validated record. Existing rows are backfilled additively from their payload-free record JSON so scheduled scans do not deserialize complete subject histories merely to find due work.
