Railway provider for LSSM OS
This package adapts the authoritative LSSM OS ProviderExecutionPort to one injected Railway execution surface. An adapter instance exclusively owns either the Railway provider API or Railway TypeScript IaC; dual ownership fails closed.
The ./runtime-node export directly implements ProviderLifecyclePortV1 over closed, secret-free, digest-bound V2 commands. It binds one injected ownership driver (provider_api or railway_iac), reserves the exact execution fence, persists exact V2 receipts, and replays only independently verified durable results. It never loads the legacy ProviderExecutionPort, and Railway IaC cannot claim ownership of the provider feature-flag registry.
It supports complete, paginated discovery/import of workspaces, projects, environments, services, databases, volumes, buckets, variable references, domains, deployments, metrics, usage, and the separate project/workspace feature flag registries. Mutation is allowlisted by resource family and ownership mode.
Idempotency and fencing are delegated to an injected durable atomic state port. Receipts bind the exact plan, effect, Connect decision and attestation, fence, provider observation, and evidence. Timeouts abort the driver call and remain a durable indeterminate outcome; retries cannot silently duplicate an unsettled effect. The deadline scheduler and trusted UTC clock are injected for deterministic testing while production defaults use a monotonic system scheduler.
Secrets are references only. Billing reports are explicit actual, estimated, or unavailable claims, each backed by provider evidence. Compensation requires the exact prior apply observation. Partial-create cleanup is restricted to handles reported by the failed current step.
The ./conformance entrypoint shapes an offline verifier target whose replay and fence decisions use the verifier oracle's read-only observation boundary. ./testing
exports sanitized fakes and fixtures. Neither entrypoint performs a live Railway call or claims live-provider qualification. bun run test:pack stages governed workspace dependency ranges, installs the real tarball with npm, and imports every public subpath in clean Node and Bun consumers.
Drift compares resource and flag state independently of evidence-reference IDs. A new observation reference alone is not a configuration change. Returned evidence references still identify the current discovery pages; receipts and their integrity checks remain unchanged. Resource properties, status, flag versions and rules continue to participate in drift detection.
Packed-consumer checks do not run dependency lifecycle hooks in the source workspace. They stage already-built artifacts, apply published export maps in the staging directory, and install the resulting archives with scripts disabled.
