integration.meeting-effect-worker-postgres-http

Meeting Effect Worker PostgreSQL + HTTP Composition

Production composition for @lssm-tech/app.meeting-effect-worker. It claims only explicitly assigned owner scopes, binds all five RLS axes inside PostgreSQL transactions, decrypts meeting state with the shared versioned BYOK cipher, obtains fresh authority and effect-time reproof from a host authority service, enforces the host rollout contract, and submits approved artifacts to a live delivery service.

The package does not contain a success stub or a generic “delivered” fallback. A delivery is successful only after the configured HTTPS service returns an exact, identity-matched provider receipt. Network errors, timeouts, non-200 responses, malformed JSON, stale authority, missing rollout, and receipt mismatches all fail closed and flow into the worker's bounded retry policy; typed permanent rejections are dead-lettered with their failure code.

Host configuration

Set the worker host's module to:

OPA_MEETING_EFFECT_WORKER_COMPOSITION_MODULE=@lssm-tech/integration.meeting-effect-worker-postgres-http

Required variables:

Optional bounded settings are OPA_MEETING_EFFECT_DATABASE_SSL_MODE (require, prefer, or explicit allow), OPA_MEETING_EFFECT_INTERVAL_MS, OPA_MEETING_EFFECT_LIMIT, OPA_MEETING_EFFECT_LEASE_MS, OPA_MEETING_EFFECT_MAX_ATTEMPTS, and OPA_MEETING_EFFECT_HTTP_TIMEOUT_MS. OPA_MEETING_EFFECT_KILL_SWITCH=1 stops new claims (readiness reports paused); any value other than unset, empty, 0 or 1 is rejected at startup.

The database must have migration 0166 (opaMeetingFollowUpMigrationStatements): it adds the dead_letter outbox state, last_error_code, provider_receipt_ref and the host delivery ledger. Without it, settling a lease fails and the effect is retried after its lease expires.

HTTPS boundary

Both endpoints receive authenticated JSON POST requests and must return HTTP 200 with application/json. Authority requests carry version, a unique requestRef, the full lease, and either operation: "resolve" or operation: "reprove". An allow response must echo the request reference and return an active, strict runtime authority containing opa.meeting_dispatch.execute; a deny response contains only version, requestRef, and decision: "deny".

Delivery requests use the v2 envelope defined by OpaMeetingEffectDeliveryRequestSchema in @lssm-tech/lib.organization-planning-spec: operation: "deliver", a requestRef, the effect reference as idempotencyKey, the owner scope, plan and meeting references, the approved effect (target, artifact, recipient and effect digest), the approved artifact digest and the plan approval receipt. Artifact content is never sent; the host reloads and re-verifies it. The API host (/api/internal/opa/meeting-effects/deliver) routes targets to its follow-up adapters and answers with OpaMeetingEffectDeliveryResponseSchema:

{
  "version": "v2",
  "requestRef": "meeting-effect-request:...",
  "effectRef": "meeting-dispatch-effect:...",
  "status": "delivered",
  "providerReceiptRef": "provider-receipt:..."
}

status may also be drafted (calendar proposals) or rejected with a failure code and retryable flag. Permanent rejections dead-letter the effect at once; retryable ones follow the bounded exponential backoff (1 s doubling to 5 min, OPA_MEETING_EFFECT_MAX_ATTEMPTS, then attempts_exhausted).

The distinct authority and delivery bearers are sent only in the Authorization header. They are never included in configuration errors, response bodies, rollout digests, or persisted meeting state.