integration.supportos-worker-managed

Managed SupportOS Worker

Production-shaped composition for the qualification.evaluate and qualification.event.publish SupportOS jobs. When their exact global flags are enabled, the same bounded worker also registers ai.evaluate and the isolated provider.outbox owners for AI semantic-event publication and Forms-authoritative CSAT invitation issuance. Claims are handler-kind isolated. The integration composes @lssm-tech/lib.supportos-worker-runtime directly; it has no dependency on the deployable SupportOS worker app. Existing app imports remain compatible facades over the same runtime values. It obtains service workspace assignments from AuthOS, uses the SupportOS PostgreSQL queue and SLO/incident authority, requires both global Railway-style and workspace PostgreSQL flags, loads immutable content-addressed plans, and calls bounded HTTPS plan, evidence, incident-alert, KMS, and event providers. The event publisher binds its request to the active job fence, lease, and effect idempotency key. Provider calls use scope-bound, five-minute AuthOS grants obtained from a rotated projected OIDC workload assertion. Long-lived provider bearer tokens are not accepted.

AI publication uses the immutable V51 event dispatch ledger and replays a committed provider receipt across reclaimed job fences. CSAT delivery derives a canonical body-free input digest, obtains a case/invitation/digest-bound grant, and requires Forms to echo the exact tenant, workspace, audience, capability, digest, and grant evidence before the issued receipt is accepted.

Readiness refreshes AuthOS assignments on every cycle, checks PostgreSQL, and uses non-effect HTTPS readiness endpoints for every required provider with new tenant/workspace-scoped grants. An assignment outage, revocation, empty scope set, stale check, malformed provider response, or failed dependency check makes /readyz fail closed. Mutation endpoints are never used as health probes. Assignment snapshots are capped at 20 workspaces per worker shard and rejected atomically when over capacity. Readiness uses four concurrent scope probes and preserves the last successful state while a refresh is in flight.

Rollout requires the Railway/global configuration and every PostgreSQL scoped flag. SUPPORT_OS_GLOBAL_FLAGS_REVISION is combined with the sorted enabled flags into the global configuration digest. Each allow or deny decision is persisted as an immutable, forced-RLS PostgreSQL receipt containing scoped flag values and revisions before execution continues or pauses.

Set SUPPORT_OS_WORKER_COMPOSITION_MODULE to @lssm-tech/integration.supportos-worker-managed. Required environment values are documented by SupportSloWorkerManagedEnvironment in src/config.ts. Enabling support.ai-outcome-learning additionally requires SUPPORT_OS_AI_EVENT_PUBLISH_URL and SUPPORT_OS_AI_EVENT_READINESS_URL. Enabling support.csat additionally requires SUPPORT_OS_FORMS_CSAT_ISSUE_URL and SUPPORT_OS_FORMS_CSAT_READINESS_URL. All four values must be credential-free HTTPS URLs without query strings. Enabling support.crypto-rotation additionally requires SUPPORT_OS_CRYPTO_DRILL_TARGET_URL and SUPPORT_OS_CRYPTO_DRILL_READINESS_URL. The assigned service scope must carry both support.jobs.execute and support.crypto.execute; the target response is bound to the job effect digest and may return only opaque version and evidence references. SUPPORT_OS_WORKLOAD_IDENTITY_FILE points to the platform-projected short-lived OIDC assertion; the assertion is reread for every grant exchange so rotation is automatic. Provider tokens and response bodies never enter readiness projections. All database connections require verified TLS; allow and prefer modes are configuration errors.