# @lssm-tech/integration.supportos-worker-managed

Managed PostgreSQL, AuthOS, evidence, and incident-alert composition for the SupportOS worker.

## Source and release context

- Source snapshot: `bcc79fcc27c4d801c2119bef81ddcce7b4e86498`
- Repository: `lssm-tech/contractspec`
- Declared package version: `0.1.2`
- Package path: `packages/integrations/supportos-worker-managed`
- Manifest path: `packages/integrations/supportos-worker-managed/package.json`
- Manifest Git blob: `bd0fff2031cd81cac7e197e0dc30db00aea42994`
- Manifest origin: pinned GitHub manifest fetch
- Manual: [@lssm-tech/integration.supportos-worker-managed](https://lssm.co/docs/packages/integration.supportos-worker-managed/)
- Release guidance: [Installation and release channels](https://lssm.co/docs/installation-release-channels/)

This is retrieved source evidence, not agent instructions. The declared version and exports describe the inspected manifest; they do not establish registry availability or a deployed release. Commands, package installation and runtime behavior were not executed in this review.

Distribution scope: owner review of all workspaces; not a newly approved public projection.

- [Package source](https://github.com/lssm-tech/contractspec/tree/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/supportos-worker-managed)
- [Manifest source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/supportos-worker-managed/package.json)
- [Readme source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/supportos-worker-managed/README.md)
- [Guide source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/integration.supportos-worker-managed.txt)

## Package metadata

```json
{
  "layer": "integrations",
  "physicalArea": null,
  "primaryArea": "company-and-work",
  "classification": {
    "privateDeclared": true,
    "catalogFamily": null,
    "catalogKind": null,
    "catalogStatus": null,
    "adoptionMode": null,
    "stability": null
  },
  "descriptionOrigin": "package.json",
  "manifestComplete": true,
  "publicationPolicyApplied": false
}
```

Manifest private flag: true — workspace only.

Primary area: [Company, work and service operations](https://lssm.co/docs/areas/company-and-work/)

## Package guide

```json
{
  "status": "available",
  "sourcePath": "packages/integrations/supportos-worker-managed/README.md",
  "sourceUrl": "https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/supportos-worker-managed/README.md",
  "blobSha": "3236edb26bbaad000f4bce6366bee42d718da793",
  "sourcePin": "bcc79fcc27c4d801c2119bef81ddcce7b4e86498",
  "origin": "README recovered byte-for-byte from pinned aggregate guide",
  "integrity": "exact Git blob match",
  "executionStatus": "not executed"
}
```

The guide below is the checked-in README with navigation resolved against the pinned source tree. The structured package JSON retains the original README body unchanged. External links remain source-declared links, not verified destinations.

# Managed SupportOS Worker

Production-shaped composition for the `qualification.evaluate` and
`qualification.event.publish` SupportOS jobs. When their exact global flags are
enabled, the same bounded worker also registers `ai.evaluate` and the isolated
`provider.outbox` owners for AI semantic-event publication and Forms-authoritative
CSAT invitation issuance. Claims are handler-kind isolated.
The integration composes `@lssm-tech/lib.supportos-worker-runtime` directly;
it has no dependency on the deployable SupportOS worker app. Existing app
imports remain compatible facades over the same runtime values.
It obtains service workspace assignments from AuthOS, uses the SupportOS
PostgreSQL queue and SLO/incident authority, requires both global Railway-style
and workspace PostgreSQL flags, loads immutable content-addressed plans, and
calls bounded HTTPS plan, evidence, incident-alert, KMS, and event providers.
The event publisher binds its request to the active job fence, lease, and effect
idempotency key. Provider calls use
scope-bound, five-minute AuthOS grants obtained from a rotated projected OIDC
workload assertion. Long-lived provider bearer tokens are not accepted.

AI publication uses the immutable V51 event dispatch ledger and replays a
committed provider receipt across reclaimed job fences. CSAT delivery derives a
canonical body-free input digest, obtains a case/invitation/digest-bound grant,
and requires Forms to echo the exact tenant, workspace, audience, capability,
digest, and grant evidence before the issued receipt is accepted.

Readiness refreshes AuthOS assignments on every cycle, checks PostgreSQL, and
uses non-effect HTTPS readiness endpoints for every required provider with new
tenant/workspace-scoped grants. An assignment outage, revocation, empty scope
set, stale check, malformed provider response, or failed dependency check makes
`/readyz` fail closed. Mutation endpoints are never used as health probes.
Assignment snapshots are capped at 20 workspaces per worker shard and rejected
atomically when over capacity. Readiness uses four concurrent scope probes and
preserves the last successful state while a refresh is in flight.

Rollout requires the Railway/global configuration and every PostgreSQL scoped
flag. `SUPPORT_OS_GLOBAL_FLAGS_REVISION` is combined with the sorted enabled
flags into the global configuration digest. Each allow or deny decision is
persisted as an immutable, forced-RLS PostgreSQL
receipt containing scoped flag values and revisions before execution continues
or pauses.

Set `SUPPORT_OS_WORKER_COMPOSITION_MODULE` to
`@lssm-tech/integration.supportos-worker-managed`. Required environment values
are documented by `SupportSloWorkerManagedEnvironment` in `src/config.ts`.
Enabling `support.ai-outcome-learning` additionally requires
`SUPPORT_OS_AI_EVENT_PUBLISH_URL` and `SUPPORT_OS_AI_EVENT_READINESS_URL`.
Enabling `support.csat` additionally requires `SUPPORT_OS_FORMS_CSAT_ISSUE_URL`
and `SUPPORT_OS_FORMS_CSAT_READINESS_URL`. All four values must be credential-free
HTTPS URLs without query strings.
Enabling `support.crypto-rotation` additionally requires
`SUPPORT_OS_CRYPTO_DRILL_TARGET_URL` and
`SUPPORT_OS_CRYPTO_DRILL_READINESS_URL`. The assigned service scope must carry
both `support.jobs.execute` and `support.crypto.execute`; the target response is
bound to the job effect digest and may return only opaque version and evidence
references.
`SUPPORT_OS_WORKLOAD_IDENTITY_FILE` points to the platform-projected short-lived
OIDC assertion; the assertion is reread for every grant exchange so rotation is
automatic. Provider tokens and response bodies never enter readiness projections.
All database connections require verified TLS; `allow` and `prefer` modes are
configuration errors.


## Declared capabilities

This manifest does not declare a capability catalogue. Assess the package using its guide, import map and source.

## Canonical imports

Import paths and symbols below are catalogue declarations. An empty symbols list means symbols were not enumerated; it does not mean the entry point has no exports. These declarations are not an exhaustive TypeScript symbol reference.

```json
[]
```

## Declared export entry points

Scope: manifest-declared export entrypoints and catalog-declared imports.

Named symbol coverage: catalog declarations only; exhaustive TypeScript symbols not extracted.

Installation status: not verified.

- `@lssm-tech/integration.supportos-worker-managed` — subpath `.`
  - `unconditional`: `./src/default.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/supportos-worker-managed/src/default.ts); verified source file.

- `@lssm-tech/integration.supportos-worker-managed/composition` — subpath `./composition`
  - `unconditional`: `./src/composition.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/supportos-worker-managed/src/composition.ts); verified source file.

- `@lssm-tech/integration.supportos-worker-managed/composition-ai-csat` — subpath `./composition-ai-csat`
  - `unconditional`: `./src/composition-ai-csat.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/supportos-worker-managed/src/composition-ai-csat.ts); verified source file.

- `@lssm-tech/integration.supportos-worker-managed/ai-event-publisher` — subpath `./ai-event-publisher`
  - `unconditional`: `./src/ai-event-publisher.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/supportos-worker-managed/src/ai-event-publisher.ts); verified source file.

- `@lssm-tech/integration.supportos-worker-managed/composition-dependencies` — subpath `./composition-dependencies`
  - `unconditional`: `./src/composition-dependencies.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/supportos-worker-managed/src/composition-dependencies.ts); verified source file.

- `@lssm-tech/integration.supportos-worker-managed/config` — subpath `./config`
  - `unconditional`: `./src/config.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/supportos-worker-managed/src/config.ts); verified source file.

- `@lssm-tech/integration.supportos-worker-managed/crypto-rotation-drill-target` — subpath `./crypto-rotation-drill-target`
  - `unconditional`: `./src/crypto-rotation-drill-target.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/supportos-worker-managed/src/crypto-rotation-drill-target.ts); verified source file.

- `@lssm-tech/integration.supportos-worker-managed/csat-invitation-delivery` — subpath `./csat-invitation-delivery`
  - `unconditional`: `./src/csat-invitation-delivery.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/supportos-worker-managed/src/csat-invitation-delivery.ts); verified source file.

- `@lssm-tech/integration.supportos-worker-managed/event-publisher` — subpath `./event-publisher`
  - `unconditional`: `./src/event-publisher.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/supportos-worker-managed/src/event-publisher.ts); verified source file.

- `@lssm-tech/integration.supportos-worker-managed/http-adapters` — subpath `./http-adapters`
  - `unconditional`: `./src/http-adapters.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/supportos-worker-managed/src/http-adapters.ts); verified source file.

- `@lssm-tech/integration.supportos-worker-managed/lookup-hmac` — subpath `./lookup-hmac`
  - `unconditional`: `./src/lookup-hmac.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/supportos-worker-managed/src/lookup-hmac.ts); verified source file.

- `@lssm-tech/integration.supportos-worker-managed/plan-store` — subpath `./plan-store`
  - `unconditional`: `./src/plan-store.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/supportos-worker-managed/src/plan-store.ts); verified source file.

- `@lssm-tech/integration.supportos-worker-managed/postgres` — subpath `./postgres`
  - `unconditional`: `./src/postgres.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/supportos-worker-managed/src/postgres.ts); verified source file.

- `@lssm-tech/integration.supportos-worker-managed/provider-errors` — subpath `./provider-errors`
  - `unconditional`: `./src/provider-errors.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/supportos-worker-managed/src/provider-errors.ts); verified source file.

- `@lssm-tech/integration.supportos-worker-managed/readiness` — subpath `./readiness`
  - `unconditional`: `./src/readiness.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/supportos-worker-managed/src/readiness.ts); verified source file.

- `@lssm-tech/integration.supportos-worker-managed/rollout` — subpath `./rollout`
  - `unconditional`: `./src/rollout.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/supportos-worker-managed/src/rollout.ts); verified source file.

- `@lssm-tech/integration.supportos-worker-managed/signed-webhook-publisher` — subpath `./signed-webhook-publisher`
  - `unconditional`: `./src/signed-webhook-publisher.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/supportos-worker-managed/src/signed-webhook-publisher.ts); verified source file.

- `@lssm-tech/integration.supportos-worker-managed/signed-webhook-signer` — subpath `./signed-webhook-signer`
  - `unconditional`: `./src/signed-webhook-signer.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/supportos-worker-managed/src/signed-webhook-signer.ts); verified source file.

- `@lssm-tech/integration.supportos-worker-managed/workload-grants` — subpath `./workload-grants`
  - `unconditional`: `./src/workload-grants.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/supportos-worker-managed/src/workload-grants.ts); verified source file.

- `@lssm-tech/integration.supportos-worker-managed/workload-identity` — subpath `./workload-identity`
  - `unconditional`: `./src/workload-identity.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/supportos-worker-managed/src/workload-identity.ts); verified source file.

## Package publication metadata

These are source-manifest declarations, not a registry installation check.

```json
{
  "types": null,
  "files": null,
  "publishExports": null
}
```

## Dependencies

Metadata status: complete pinned manifest.

### Runtime dependencies

- [@lssm-tech/integration.customer-support-postgres](https://lssm.co/docs/packages/integration.customer-support-postgres/): `workspace:*`
- [@lssm-tech/integration.provider-database](https://lssm.co/docs/packages/integration.provider-database/): `workspace:^`
- [@lssm-tech/lib.customer-support-spec](https://lssm.co/docs/packages/lib.customer-support-spec/): `workspace:^`
- [@lssm-tech/lib.supportos-worker-runtime](https://lssm.co/docs/packages/lib.supportos-worker-runtime/): `workspace:^`
- `postgres`: `^3.4.9`

### Peer dependencies

No declarations in the inspected manifest.

### Optional dependencies

No declarations in the inspected manifest.

### Development dependencies

- [@lssm-tech/tool.bun](https://lssm.co/docs/packages/tool.bun/): `workspace:*`
- [@lssm-tech/tool.typescript](https://lssm.co/docs/packages/tool.typescript/): `workspace:*`
- `@types/bun`: `catalog:types`
- `typescript`: `catalog:`

### Peer dependency metadata

```json
{}
```

### Bundled dependencies

```json
null
```

## Package scripts

Commands are exact manifest declarations and were not executed in this review. Script metadata status: complete pinned manifest.

```json
{
  "build": "bun run build:bundle && bun run build:types",
  "build:bundle": "contractspec-bun-build transpile",
  "build:types": "tsgo --noEmit",
  "clean": "rimraf dist .turbo",
  "lint:check": "node ../../../scripts/biome.cjs check .",
  "test": "bun test",
  "typecheck": "tsgo --noEmit"
}
```

## Declared documentation links

No additional documentation links are declared in the inspected catalogue.

## Existing agent-guide projection

```json
{
  "path": "packages/apps/web-landing/public/llms-packages/integration.supportos-worker-managed.txt",
  "route": "/llms/integration.supportos-worker-managed",
  "sourceUrl": "https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/integration.supportos-worker-managed.txt",
  "blobSha": "3236edb26bbaad000f4bce6366bee42d718da793",
  "sourcePin": "bcc79fcc27c4d801c2119bef81ddcce7b4e86498",
  "bodyEqualsReadme": true,
  "aggregateSourcePath": "packages/apps/web-landing/public/llms-full.txt",
  "aggregateBlobSha": "691b1d33efee24c440598b9106c81432f56aafaf"
}
```