Source snapshot bcc79fcc · Declared package version 3.0.5. This page combines the checked-in package guide and manifest; commands and runtime behavior were not executed in this review.
CompanyOS VoiceOps is represented as a governed-action scenario, not as a provider runtime. The canonical Voice-to-Product-Gap path starts from CommunicationOS voice/transcript evidence, redacts customer identifiers, proposes an internal product-gap work item, blocks the next-day customer promise, routes PM approval for internal work, and emits replay/receipt material with no production-write claim.
This package owns the CompanyOS side of that story: action origin, authority explanation, policy verdict, approval gate, governed-action lifecycle, replay trace, and evidence receipt material. CommunicationOS owns the source thread/transcript evidence and proposed-action extraction. Provider STT/TTS adapters, live customer sends, CRM writes, and compliance claims stay outside the spec boundary.
Canonical CompanyOS V0 contracts for ContractSpec.
CompanyOS models company operations as explicit, inspectable, and bounded contracts:
company identity and operating model
authority, roles, principals, and accountable owners
autonomy policies and approval boundaries
company brain entries and knowledge gaps
decisions, commitments, and operating projections over canonical Work refs
operator inbox items and operating review summaries
Enterprise purpose and multi-company governance
The additive V1 enterprise surface models a company mission and vision over the canonical LSSM OS goal, outcome, conflict, and harm-guardrail contracts. It also models holdings, legal entities, operating companies, joint ventures, brands, products, and workspaces without treating those categories as interchangeable.
Enterprise portfolios make ownership and control, consolidation boundaries, shared-service mandates, capital and budget responsibility, residency and compliance scopes, cross-company grants, delegated business authority, goal cascades, conflicts, escalation, provenance, evidence, and redaction explicit. Semantic validation fails closed for cycles, dangling references, incompatible controlling interests, unauthorized cross-company grants, exceptions to non-waivable boundaries, and embedded secret material.
CompanyOS records business intent and approval evidence; it does not authorize a technical effect. Every cross-company grant structurally declares that ContractSpec Connect authorization is still required.
Positioning
Long-term governance/runtime layer behind proofs like CompanyOS VoiceOps.
V0 scope
This package intentionally implements contracts only. It does not include runtime execution, real providers, UI, app shells, modules, or autonomous customer sends.
Work OS v2 boundary
Canonical tasks, projects, goals, portfolios, views, collaboration metadata, external bindings, and sync conflicts belong exclusively to
@lssm-tech/lib.work-spec. CompanyOS no longer exports CompanyWorkItem,
CompanyWorkGraph, or the ./types/work subpath. Its operating loop carries a
CompanyOperatingWorkProjection containing WorkObjectRef values alongside CompanyOS-owned feedback, commitments, and decisions.
V1 remains provider-free and side-effect-free. It describes executable work semantics and evidence, but does not execute those operations.
Governed company metrics V1
The additive types/company-metrics and types/company-metrics-governance
subpaths define CompanyOS-owned metric definitions, typed aggregations and filters, source bindings, four comparison windows, discovery proposals, collection runs, alerts, digests, scoped shareholder grants, immutable snapshots/publications, and CommunicationOS delivery receipts. Legacy
CompanyMetricSchema and MetricObservationSchema remain unchanged.
Operating graph / AI OS contracts
The additive operating graph surface keeps Company Brain semantics inside CompanyOS without creating a separate package. It includes contract-only schemas for:
source systems and source record refs with evidence, freshness, ACL, and Knowledge fragment refs
graph nodes, edges, conflicts, tombstones, supersession, confidence, and review state
cross-source identity candidates and reviewed link decisions
actor/session/source ACL/policy permission requests, decisions, and redactions
runbook procedures, readiness checks, and conformance cases that fail closed for stale, unauthorized, conflicted, or low-confidence evidence
The package still does not ingest Knowledge, evaluate AuthOS/RBAC, open realtime transports, execute runbooks, or mutate providers. Those are substrate/runtime responsibilities.
Agentic Company Brain contract surfaces
The V2 operating graph packet also carries additive agentic Company Brain contracts for compiled, versioned skill/runbook artifacts; source/identity/ACL readiness checks; conformance evidence; and correction/outcome receipts. These surfaces prove that a Company Brain procedure can become an agent-readable artifact only when source records, identity decisions, ACL decisions, freshness, runbook readiness, and conformance evidence are explicit. They remain references and receipts only: no runtime execution, provider SDK, credential material, source mutation, or production write is introduced here.
Canonical Company Intelligence records
The additive @lssm-tech/lib.companyos-spec/types/company-intelligence
surface closes the canonical record vocabulary needed by production Company Intelligence without replacing existing CompanyOS owners. It covers source and immutable source-version lineage, raw assets, extracted parts and stable fragments, locator-backed evidence, claims, policies, entities, relations, conflicts, gaps, bounded graph snapshots, immutable editions, grounded queries, answers and verification, feedback/outcomes, experiments, independent evaluations, promotions, rollback, and replay.
Every record carries tenant, accountable owner, recorded time, valid time, explicit record/evidence refs, contractVersion: "1.0.0", and a
company-intelligence-sha256:v1 fingerprint over canonical JSON. Semantic validation adds stable CI_* codes for missing tenant/owner/time/evidence, invalid refs, unsupported answers, failed evaluation/promotion gates, rollback time, replay order, and fingerprint drift. Knowledge answers explicitly set
knowledgeAuthorizesAction: false; policy, proposal, approval, execution, and outcome remain separate authority classes.
COMPANY_INTELLIGENCE_COMPATIBILITY_MATRIX is the machine-readable S1 classification for every new export, operation, and event. All entries are
additive; existing graph, edition, answer, learning, receipt, approval, execution, outcome, and replay identities remain unchanged. The package stays platform-neutral and contains no persistence, I/O, provider SDK, credential material, or execution path.
The additive structured-extraction contract fixes candidate kinds to fact, entity, relation, policy, and procedure; requires exact evidence record IDs and stable locators; and defines trusted review decisions plus redacted versioned receipts. Candidates cannot carry authority, review thresholds, or approval. Policy remains authorityClass: "policy"; procedure remains an evidence-backed claim and never becomes policy through source text.
Governed learning lifecycle
The existing learning record kinds now accept the optional
company-intelligence-governed-learning:v1 marker. Marked histories are append-only, sequence- and head-bound, and enforce all 25 stable promotion gates: G01–G23 before a deterministic canary receipt and G01–G25 before a promotion decision. Generator, evaluator, and approver identities must be independent; poisoned or quarantined feedback carries zero weight. Canary is evidence only, never live activation. Repository work items for code, public contracts, migrations, or deployment configuration are proposal-only and have no self-application path. Legacy S1 records remain valid and unchanged.
Company Intelligence Brain runtime contracts
The existing Company Intelligence subpath now defines immutable Brain entry versions, review decisions, explicit gaps and remediation, and bounded compiled policy/procedure envelopes. Entries preserve exact source-version and evidence refs, bitemporal coordinates, owner and permission fields, review/conflict state, and versioned SHA-256 fingerprints. Compiled artifacts reuse
CompanyOsCompiledAgenticArtifact, preserve normative content and approval boundaries, and assert that compilation neither authorizes nor executes action.
Managed CompanyOS contract inventory
The additive managed CompanyOS surface classifies the public contracts and release anchors needed by managed app/API/worker lanes before those lanes depend on them: tenant profiles, managed/BYOK credential refs, workflow correlation, WebSocket job events, runtime health/degraded state, evidence receipts, package export, and docs-release evidence. The contracts remain provider-neutral, use redacted credential refs only, and fail closed when worker/WebSocket/replay/evidence degradation would otherwise be hidden behind green API health.
Foundation P1/P2 compatibility
The additive Foundation surface exposes the tenant governance envelope and the storage-neutral temporal store contract without selecting persistence or a provider. Each surface publishes a canonical schema identity and pinned SHA-256 fingerprint so packed consumers can detect drift before runtime composition.
types/tenant-governance-envelope keeps authority server-derived and binds residency, retention, legal basis, idempotency, evidence, and replay refs to tenant/workspace scope.
fixtures/tenant-governance-envelope provides current, legacy, and unknown neutral fixtures; validation/tenant-governance-envelope accepts current state, requires explicit legacy migration, and quarantines unknown shapes.
types/temporal-store declares append/query/erasure transaction semantics over existing temporal assertions. Durable adapter selection remains outside this package.
Design-partner readiness contracts
@lssm-tech/lib.companyos-spec/types/design-partner-readiness defines the additive Managed CompanyOS design-partner schemas:
mission command cycle;
decision packet;
expert attestation;
founder approval;
readiness state (draft, degraded, blocked, ready_for_design_partner_review);
by-reference evidence/replay links that reuse existing receipt and replay IDs.
The companion fixture subpath @lssm-tech/lib.companyos-spec/fixtures/design-partner-readiness is fictive only:
The schemas enforce the safety boundary: expert attestation requires expert_reviewer, founder approval requires founder_approver, AI cannot dispatch reserved work, evidence/replay are referenced by ID only, and noProductionReadinessClaim / noProviderDispatch remain explicit assertions. The package still owns contracts only: no UI, DB, provider SDK, runtime execution, real customer data, or production writes.
Layer 0 action-packet contracts
@lssm-tech/lib.companyos-spec/types/layer0-action-packet and related Layer 0 subpaths define sponsor-neutral packet, routing-rule, adapter-contract, core, and unknown schemas. They are additive over existing CompanyOS authority, policy, evidence, and execution primitives; active routing rules require completed review before use.
Outcome value projection contracts
@lssm-tech/lib.companyos-spec/types/outcome-value defines CompanyOS-only business value contracts over ContractSpec outcome claim refs: BusinessValueEvent, OperationalValueClaim, BusinessValueReport, SalesValueReport, ReviewQueue, AutonomyReadinessSignal, and PromptSkillInfluenceReport. These contracts do not redefine the generic OutcomeClaim kernel. Business meaning stays in CompanyOS, while the source claim, evidence, review, correction, and attribution identity remains a portable ContractSpec claim ref. No evidence means no business value event.
Rich outcome ingestion contracts
@lssm-tech/lib.companyos-spec/types/outcome-observation normalizes provider-neutral reply, call, meeting, CRM activity, and deal outcome observations before they are projected into the existing ContractSpec OutcomeClaim kernel. Corrections are evidence-backed and append-only, supersession lineage is explicit, and attribution windows use half-open time intervals. Window membership remains correlation evidence, not causal proof. The companion fixture is deterministic, fictive, and performs no provider or CRM mutation.
Public entrypoints
Grounded Company Intelligence answers are additive contracts under
@lssm-tech/lib.companyos-spec/types/company-intelligence/grounding-result, with semantic validation under ./validation/company-intelligence-grounding and deterministic fictive fixtures under ./fixtures/company-intelligence/grounding-result. The result is a strict answered/abstained/refused/conflicted/degraded union with server-minted citation support, replay fingerprints, bounded call receipts, and
knowledgeAuthorizesAction: false. Existing Company Intelligence record, operation, event, status, and fingerprint identities are unchanged.
@lssm-tech/lib.companyos-spec — root barrel
@lssm-tech/lib.companyos-spec/types — schemas and inferred types
@lssm-tech/lib.companyos-spec/types/outcome-value — CompanyOS business value projection contracts over ContractSpec OutcomeClaim refs
@lssm-tech/lib.companyos-spec/types/outcome-observation — normalized rich outcome observations, correction lineage, and half-open attribution windows
@lssm-tech/lib.companyos-spec/fixtures/rich-outcome-observations — deterministic reply/deal correction and attribution fixture
@lssm-tech/lib.companyos-spec/types/temporal-assertion — neutral bitemporal assertion envelopes with half-open valid-time intervals, known time, contradictions, and supersession lineage
@lssm-tech/lib.companyos-spec/fixtures/temporal-assertions — deterministic neutral contradiction and supersession fixture
@lssm-tech/lib.companyos-spec/validation/temporal-assertion — schema and reciprocal-lineage validation without persistence or destructive merge semantics
@lssm-tech/lib.companyos-spec/fixtures/v1-execution.parts — deterministic execution/evidence fixture parts
@lssm-tech/lib.companyos-spec/validation/semantic-v1-execution — semantic validation for execution refs and fail-closed invariants
Safety model
Authority answers who may act and who is accountable. Autonomy answers how independently the action may proceed. They are related but not interchangeable.
Customer-facing sends, legal/financial changes, and production-impacting work should default to approval-required or reserved-human-only until a future runtime explicitly proves stricter policy gates. V1 agent-native descriptors must require dry-run and approval semantics for execute-capable operations.
Execution descriptors are evidence contracts, not runtime permission. A later CompanyOS module may coordinate agent, job, integration, human, dry-run, or manual-record lanes only after policy-gate evidence, idempotency, claim/lease, approval, and replay requirements are satisfied.
Managed CompanyOS credential refs never carry raw secrets (secretMaterialAvailable is contractually false). Managed provider defaults, SDK wiring, procurement, and credential custody claims remain approval-gated outside this spec package.
Dispatch authorization is modeled as an explicit substrate contract. CompanyOsExecutionDispatchAuthorizationSchema binds a dispatch lane to a policy-gate decision, accountable owner, approvals, and optional fail-closed CompanyOsDispatchAuthorizationFailureSchema. CompanyOsSourceEvidenceRefSchema records AIP, command-inbox, dry-run, operator, and outcome provenance with authorizationAuthority: false; source evidence can explain a request, but it cannot authorize dispatch. CompanyOsPolicyReplayPacketSchema, CompanyOsReplayDeterminismCaseSchema, CompanyOsOperatorInboxRouteSchema, and CompanyOsOutcomeLinkageSchema complete the deterministic replay, operator handoff, and outcome trace without introducing provider or module execution.
Policy Runtime Hardening
This package now includes additive policy-runtime contracts under @lssm-tech/lib.companyos-spec/types/policy-runtime, fixtures under ./fixtures/v1-policy-runtime, and validation under ./validation/semantic-v1-policy-runtime.
These contracts extend existing CompanyOS policy gate request/decision semantics with authority, RBAC, risk, budget, tool-scope, dry-run, approval workflow, fallback, explanation, and assurance packet refs. They do not replace autonomy levels, authority graphs, execution plans, receipts, or outcome contracts.
Published export maps include explicit browser conditions for the emitted browser artifacts, alongside the existing Node and Bun conditions. A browser bundler can select these without relying on the default server-runtime condition.
Generic grounded-retrieval schemas and semantic validation are canonical in @lssm-tech/lib.contracts-spec-core/knowledge/grounding. Existing CompanyIntelligence exports forward the same schemas/functions; Company entities, policy, records and projections remain here.
The explicit ./managed-companyos/* namespace owns the existing Managed CompanyOS commands, queries, events, schema models, keyed semantic maps and pure policy declarations. Historical ContractSpec paths forward to these exact canonical objects. Contract keys, versions, wire validation, PII, admin/user policy and approval/evidence requirements retain their existing behavior. Concrete organization profiles, production origins, owner bindings, booking activation and mixed host composition remain outside this semantic namespace.
CompanyOS ontology spine
@lssm-tech/lib.companyos-spec/ontology/companyos owns the existing CompanyOS reference constants and execution-free ontology spine: six nodes and five edges. Original compatibility ontology imports forward here. Reference strings, graph relationships, safety requirements and evidence IDs are unchanged.
Managed CompanyOS composition
The ./managed-companyos leaves own production auth topology, booking and calendar metadata, organization bootstrap/seed profiles, self-service contracts and public authority composition. Legacy CompanyOS subpaths forward to the same constants and contract objects. These declarations do not provision accounts, grant authority, send calendar messages or perform deployment effects.
@lssm-tech/lib.companyos-spec/managed-companyos/context-authority owns the server-side context authority model behind context.list and
context.set-active: authority snapshots, context/team/workspace choices, resolved context authority, personal-context lifecycle records, selection records and the CONTEXT_AUTHORITY_FAILURE_CODES vocabulary with its typed
ContextAuthorityRepositoryError. Every failure code is declared by one of the context operations. Physical identifiers in these types never cross the public opaque-reference projection.
Founder context, account authority and executive federation
Context registry — stable context IDs (private-founder, lssm,
chaman-ventures, contractspec, companyos, pactena-founder,
pactena-creator, hirly-b2c, hirly-b2b, tellshift, gtm-learning,
hcircle, artisanos) with legacy/spelling/display aliases.
resolveFounderContextAlias keeps shared terms (pactena, hirly) ambiguous. Aliases carry no legal registration, asset ownership, runtime scope or access grant; projectFounderContext shows those slots as unresolved until an evidence-backed record resolves them. Alias mapping migrates no data.
Account authority — AccountAuthorityBinding binds one source account (mailbox, calendar, device, meeting-notes) to an owning context with
read, draft and send granted separately, an expiry and revocation.
resolveAccountAuthority(bindings, { accountId, sourceKind, at, capability? })
and the port-backed createAccountAuthorityResolver fail closed for unknown, ambiguous, malformed, revoked, expired, re-versioned or under-privileged requests. A mailbox connection never creates a login alias.
Private executive federation — planExecutiveFederation and
authorizePrivateProjection combine contexts for the Personal context owner only through scoped, expiring, revocable, non-shareable grants.
Additive founder bootstrap — planFounderBootstrap verifies
tenant_lssm, tenant_companyos and tenant_hirly without rewriting them, plans only approved membership changes and never replays core-workspaces
defaults. organization-bootstrap:v3 and its compatibility forwarder are unchanged.
Profile loader — loadFounderProfile validates founder and mailbox-canary profiles against the v2 authoring schema shape and refuses enabled drafts or enabled entries with template placeholders; deriveAccountBindingsFromProfile
turns qualified, explicitly mapped connections into bindings.
Operation contracts (founderContextOperationRegistry) are declared for
founder-context.registry.get, .profile.validate, .bootstrap.plan|apply,
.account-authority.bind|revoke|resolve and .federation.grant|revoke|plan; host handlers and persistence live outside this package.
Cohort 2 adds founder-context.registry.resolve-slot (evidence-backed, append-only slot resolution and correction), the FW-001 desired operating outcome (FounderOperatingOutcomeSchema, reusing the LSSM OS goal, outcome-metric and harm-guardrail contracts, with
founder-context.operating-outcome.record|get), the durable record vocabulary (founder-context-records) and createAccountContextResolver, the canonical
resolved / review_required / unresolved ownership router consumed by
@lssm-tech/integration.communication-channel-email.
Declared capabilities.
Lib Companyos Spec
Contract-first CompanyOS V0/V1 specifications for bounded company operations.
Use it to
Adopt contract-first companyos v0/v1 specifications for bounded company operations
Requires
TypeScript
Choose another boundary when
The @lssm-tech/lib.companyos-spec package constraints do not match the target runtime or platform.
These are package-manifest entry points. Named symbols listed above come from the capability catalogue; this is not an exhaustive TypeScript symbol reference.
