lib.organization-planning-runtime

@lssm-tech/lib.organization-planning-runtime

./database includes encrypted resumable capture staging through SqlOpaCaptureSessionStore and additive capture migration statements. Hosts must supply current authority/consent reproof and authenticated encryption bound to owner, session, chunk index and digest. Staging supports ordered retries, pause/resume, checked completion, retention, legal holds and deletion tombstones. SqlOpaCaptureConsentStore persists four-hour explicit recording/participant-notice attestations bound to actor, meeting, source and policy. Revocation serializes with intake and cancels active sessions; replay cannot reactivate a revoked receipt. The CompanyOS API mounts the corresponding routes behind its capture switch. This store is not a final object-storage archive or transcription worker.

./database exposes SqlOpaAutomationPolicyStore, its host transaction authority port, and additive migration statements. The store reads complete applicable ancestry and uses revision checks, immutable audit, and idempotent writes. Hosts must derive membership and writable targets server-side and reprove before commit. Saving delegated-autopilot settings does not enable background execution.

The ./authz surface now includes runWithOpaAutomationAuthority: each effect attempt must reprove the complete policy ancestry, authority revision, consent, and a digest-bound approval/delegation inside the host's durable fence. This is a reusable guard, not a mounted policy store or an enabled autopilot. Meeting artifacts preserve optional model/prompt/input/processing-approval provenance; template generation remains an explicitly injectable manual/reference utility.

Website: https://contractspec.io

Fail-closed profile and meeting-workspace runtime for Organization Planning & Agenda (OPA) v2.

What It Provides

• Couche: lib. (foundational runtime).
• Exposes the canonical 127-operation v2/v3/v4 catalog separately from an exact partial handler map and the installed operation registry.
• Installs eight profile handlers and, when its service and fresh-authority ports are both present, nineteen governed meeting-workspace handlers. Retained booking, governance, scheduling, and adapter helpers are not promoted as v2 operations unless their exact v2 input, output, authority, and lifecycle semantics are implemented and tested.
• Composes contracts from @lssm-tech/lib.organization-planning-spec and owns the execution surface (./execution/*) that the module re-exports.
• Provides a concrete provider-neutral reference service for all nineteen meeting operations: owner-scoped idempotent state, policy ceilings, preparation, artifacts, Loro session closure, outcome proposals, governed sharing, recorder binding, and an approval-reproved effect worker. Hosts inject knowledge, generation, cryptographic digest, access, and delivery ports.
• Provides collectMeetingContext, a bounded context-source collector that drops invalid shared-sensitive material. An intentionally empty sources: [] configuration contributes no context; a configured source failure rejects the refresh. Host adapters remain responsible for authority and retrieval.
• Provides createMeetingQualityTelemetry, a bounded reference aggregator for server-derived, content-free quality observations. Production hosts must bind durable scoped retention before qualification.
• Provides deterministic Meeting Intelligence rollout evaluation from host-owned configuration and server-derived scope digests. Missing authority, invalid configuration, kill switches, and rollback fail closed; the reference dispatch worker rejects every shadow-mode side effect. Side-effect permits are process-local: serialized, replayed, or structurally forged decisions are rejected.
• Provides resolveMeetingOperatingPlan, a deterministic written-first gate that keeps sufficient updates asynchronous, reserves immediate war rooms for P0 incidents, postpones unprepared strategic work, and selects strict purpose-specific timeboxes, agendas, and output obligations.
• Provides an encrypted, owner-scoped SQL aggregate adapter for durable reference-workflow recovery. Optimistic aggregate revisions prevent lost updates while immutable artifact and dispatch projections stay directly verifiable by digest-bound approval queries.

Boundaries

• No provider SDKs inside this lib. Provider bridges (Google Calendar, Twilio SMS, email outbound, durable queues) live in packages/integrations/*. This runtime only composes their ports.
• Fail-closed. With both handler groups configured, 93 operations remain absent; incomplete groups install nothing. Transports remain host-owned; CompanyOS and Pactena explicitly mount the meeting group behind their session and migration boundaries.
• Booking workers expose fenced create, cancel, and reschedule lifecycle runners, resume intermediate states after crashes, and reconcile ambiguity against the identity for the active lifecycle step. Provider freshness is evaluated against the exact durable original or replacement slot interval.
• Meeting dispatch workers require an OpaTransactionRunner; the worker itself holds a PostgreSQL transaction-scoped advisory lock across effect reproof and delivery. Callers cannot substitute a process-local or no-op fence.
• Request-time availability and booking provider effects carry tenant, workspace, scheduling-resource, and write-calendar scope. Hosts can bind the provider-neutral WorkspaceCalendarAvailabilityPort plus workspace-aware freshness methods; provider bridges may then reject missing or stale workspace authority before cache, secret-vault, or provider access.
• Approval gates preserved. Governed-action and approval-required semantics from the spec/module layers flow through unchanged.
• Transcript intake is provider-neutral and unmounted. Hosts supply only server-derived scope, current consent receipts, and recorder bindings; the bounded normalizer does not log or emit transcript text and rejects revoked or expired retention state.

Installation

npm install @lssm-tech/lib.organization-planning-runtime

or

bun add @lssm-tech/lib.organization-planning-runtime

Usage

Import the root entrypoint from @lssm-tech/lib.organization-planning-runtime.

Public Entry Points

• . — root barrel; opaOpSpecs exposes the 127-operation v2/v3/v4 catalog, buildOpaV2Handlers(deps) exposes the exact partial handler map, and buildOpaOps(deps) contains only installed handlers. Phase B installs the eight exact opa.profile.* handlers and nineteen exact meeting-workspace handlers; 93 operations remain unavailable when both groups are configured.
• ./authz — fail-closed authorization checks, including fresh persisted membership/binding/grant resolution and commit/effect reproof.
• ./crypto — BYOK envelope crypto primitives.
• ./meeting-workspace/operating-system — side-effect-free written-first meeting classification and purpose-specific format selection.
• ./vault — BYOK secret vault over the crypto layer. Token rotation preserves an existing refresh token when the provider omits a replacement, and tenant-scoped deletion is available only after remote revocation succeeds at the provider edge.
• ./database — opa_* schema, RLS-scoped pools, migration helpers, and the additive tenant profile/calendar topology/collision-safe booking persistence repositories, including separate mutable G006 drafts and immutable published projection history with audit/cache-invalidation outbox (node-only; reach via this subpath, never the root barrel). OpaSqlProfileStore performs draft, handle-claim, publish, revoke, snapshot-history, and outbox writes through an OpaTransactionRunner; OpaProfileDraftStore is reference/test-only. Owned-live publication loads current tenant-scoped connection/resource health inside the publish transaction and never trusts draft-authored health. The profile cache outbox worker leases publish/revoke signals, retries failures, and marks dispatch only after the host invalidator succeeds. OpaSqlTransaction is the caller-owned transaction handle for guards and proofs that must lock and reprove inside the caller's transaction. ./database/calendar-topology-lock owns the shared/exclusive workspace topology lock key and protocol; ./database/google-calendar-topology-store (persistGoogleCalendarTopology) is the transactional compare-and-set topology writer (version conflict, resource/preference/event-type rebind denial, null-workspace preference adoption, audit projection) over the owner opa_* calendar tables. Meeting intake persistence maps only digested calendar/participant evidence to current meeting revisions and stores bounded digest-only recorder candidates. Identical occurrence and review replays are idempotent; payload drift fails closed, and human decisions are immutable owner-scoped audit rows. Participant preparation accepts only product-owned, exact-scope readers and projects bounded role, organization, relationship, and prior-interaction memory with opaque citations and explicit consent for shared sensitivity. The additive 0041 intake scheduler persists protected provider references, materializes due executions with database time, claims through expiring SKIP LOCKED leases, and fences every settlement with the exact owner and lease token. Calendar topology persistence keeps scheduling preferences in the selected event-type config, while connection/resource rows retain the exact protected provider-enumerated busy and owned-write identifiers. The product-baseline builder creates a fresh-only canonical OPA v2 schema for an explicit product. CompanyOS 0037 remains default-off until explicit schema-bootstrap, FORCE-RLS, profile-runtime, and authorization evidence is supplied.
• ./outbox — transactional outbox dispatch. Booking relay claims use expiring tenant/owner fences, and notification delivery claims use expiring token fences so crashed work is reclaimable without allowing stale settlement. Booking creation emits notification work only after a definitive confirmed provider result; ambiguous outcomes remain recoverable without creating a premature delivery ahead of the final confirmation.
• ./scheduler — scheduler / optimizer worker.
• ./public-booking-availability-policy — availabilityPolicyFromEventConfig derives a schema-validated OpaAvailabilityPolicy from a self-service event configuration (authoritative availabilityPolicy first, else DST-safe working windows from weekday rules); it returns null (fail closed) without a policy or rules.
• ./zoned-local-time — instantForLocalDate and zonedClock, Intl-based DST-safe wall-clock helpers shared by availability derivation and hosts.
• ./personal-scheduling/placement-validation — pure planner-placement predicates: exact draft/placement provenance match, availability fit (fresh evidence, notice, working-window containment, blocked-window and buffered event overlap), and preference-digest proof. Hosts keep the locked SQL reads.
• ./work-proposal/guards — WorkProposalGuards (authority, lease and policy reproof ports) over the caller-owned WorkProposalTransaction.
• ./work-proposal/suggestion-policy — createProposalSuggestionPolicyGuard and createWorkSuggestionPolicyGuard: resolve owner authority before and after input reproof and lease assertion, reject stale authority/policy digests, admit only explicit suggest mode, and run the policy_suggestion intent for planning.propose. Hosts inject owner resolution and lease SQL.
• ./private-draft/canonical, ./private-draft/command-evidence — canonical (sorted-key) JSON and digests for private calendar drafts, the domain-separated HMAC command signature with timing-safe verification, and 60-second human_command evidence for intelligence.generate. Hosts keep the one-use command receipt table.
• ./profile-service — createProfileService owner-scoped profile use cases over the OpaProfileStore port (mutation binding via bindProfileMutation, commit-authority guard pass-through, public projection lookup) and the in-memory createReferenceProfileService for tests/reference only. Hosts compose the production store and overlays.
• ./profile-seo-service — createProfileSeoService over the OpaProfileSeoReaderPort: checksummed cursors, typed ProfileSeoError codes, schema-parsed pages and validated==published plus 15-minute freshness readiness, all failing closed. Hosts own the reader-role transaction.
• ./support-destination-store — createOpaSupportDestinationStore resolves a support handoff destination (published profile handle, or an active current-revision booking link within expiry and max uses) to a canonical URL on the host's HTTPS web origin with a digest-bound OPA evidence ref, inside a tenant/workspace/product-scoped transaction.
• ./meeting-workspace/automatic-preparation — createOpaAutomaticMeetingPreparation refreshes a meeting context at its expected revision (one bounded CONFLICT retry, NOT_FOUND as revision 1) under derived idempotency keys and generates a private_playbook only for individual owners, through the OPA registry. Hosts bind the session, owner scope and handler context.
• ./meeting-workspace/ai-artifact-generator — createOpaMeetingAiArtifactGenerator implements OpaMeetingArtifactGeneratorPort over a host-resolved model binding and chat provider: recorded-evidence refusal, audience filtering, prompt/output bounds, the governed system prompt, draft schema and action rules, citation allow-list and escaped markdown with provenance. Hosts inject the binding resolver, gateway routing proof and optional binding-currency check.
• ./meeting-workspace/preparation-jobs — the OpaMeetingPreparationJobPort contract (idempotent enqueue, bound-source reconciliation, fenced leasing, prepared/blocked/terminal settlement, dispatch-cycle receipts) with its job and state types. Hosts implement it over their own job tables.
• ./smart-meeting/authority, ./smart-meeting/lifecycle-types — the SmartMeetingAuthority scope plus the smart-meeting proposal record, scheduling topology, lifecycle store and booking ports, service interface, and SmartMeetingLifecycleError codes.
• ./smart-meeting/lifecycle-service — createSmartMeetingLifecycleService, the port-only approval state machine (deny, approve with slot selection and slot/conference drift rejection, schedule-then-link, cancel/reschedule that require a booking, canonical reprojection, fail-closed error translation). Hosts supply the persistence and booking-saga adapters.
• ./smart-meeting/types, ./smart-meeting/service — createSmartMeetingService prepares an approval-gated smart-meeting receipt over host availability/persistence ports and an OpaRuntime: readiness classification, opa.loop.run_manual authorization, digest-bound replay, deterministic run/receipt ids, the manual loop with an externalEffectsBlocked assertion, and agenda/slot projection. Hosts bind their role model into the OpaRuntime RBAC dependencies.
• ./smart-meeting/identity, ./smart-meeting/runtime-input — deterministic request digest, run id and receipt ref derivation, and the buildSmartMeetingRuntimeInput proposal-only manual-loop input.
• ./smart-meeting/lifecycle-projection — projectSmartMeetingLifecycle maps a proposal plus canonical booking saga state to the schema-validated OpaSmartMeetingLifecycleProjection.
• ./smart-meeting/windows — buildSmartMeetingPolicy turns scheduling preferences into a DST-safe availability policy over the booking horizon (minimum notice, buffers, a blocked fallback window when no working window remains).
• ./smart-meeting/availability — booking-readiness availability rules: classifySmartMeetingAvailability (fresh <= 120 s with a matching refresh, cached <= 15 min, else unusable), the fail-closed unavailableSmartMeetingContext, busy-interval event mapping, and resolveSmartMeetingAvailability (query-window coverage, fresh digest match, evidence only when fresh). Hosts own the topology/snapshot SQL and refresh.
• ./database/capture-processing-cycle — runOpaCaptureProcessingCycle runs one durable capture-processing job: claim with the capacity limit, binding-staleness reproof, lease-asserted chunk reads, size and sha256 digest binding, consent/meeting/digest authority reproof at persistence via the injected OpaCaptureProcessingGuard, 365-day transcript retention, supported audio media types, and retryable-vs-terminal failure classification with a fenced fail. Hosts inject the guard, media protector (key custody), provider factory and any provider-specific retry rule.
• ./database/transcript-read-service — createOpaTranscriptService: the private transcript read/review projection. Each read and review reproves the capability through the injected OpaTranscriptAuthority and an unrevoked consent granted by the actor for a ready capture (policy digest, source and meeting bound), selects the latest ready capture of the meeting, prefers the reviewed redacted replacement, bounds text at 100k characters and parses the opa.transcript.get output. Hosts supply viewer capability flags, key custody and the transaction runner.
• ./personal-scheduling/conflict-resolution — resolvePersonalSchedulingConflict is the scheduling-conflict resolution workflow over a PersonalSchedulingConflictStorePort: idempotent replay short-circuit, allow_overlap without a calendar effect, otherwise cancel or move the focus block at its current revision with a conflict_resolution source, execute the accepted command, and finish the conflict from the result. Hosts own the conflict tables, store construction and execution.
• ./work-planning/planning-input — projectWorkOpaPlanningSnapshot is the canonical Work-to-OPA projection of one workspace event log (per-aggregate replay through the injected WorkOpaAggregateReplayPort, relationship edges indexed on both ends, completed prerequisites, estimate_required unscheduled work, execution-kind filter, workspace revision digest) and loadWorkOpaDayPlanInput builds the day-plan input from trusted WorkOpaAvailabilitySnapshotPort availability; scheduling metadata comes from WorkOpaSchedulingMetadataPort. Hosts own the event-log SQL and bind the Work reducer (no Work runtime dependency here).
• ./work-planning/revision-digest — workEventRevisionDigest and workWorkspaceHeadsDigest (Work workspace head digests shared by planning snapshots and proposal revision locks).
• ./profile-authority-segment — encodeProfileAuthoritySegment, the lossless length-prefixed base32 projection of an opaque authority id into the owner-ref grammar.
• ./profile-seed-content — projection of the canonical CompanyOS organization seed manifest's public-profile-booking family (@lssm-tech/lib.companyos-spec) into OPA ProfileDraftAggregate and PublishedSnapshot: approved-hybrid booking activation (evidence-ref check, Calendly URL normalisation and digest), materializeOrganizationSeedManifest and canonical JSON. The seed runner and SQL adapter stay in the host.
• ./database/meeting-task-projection — projectOpaMeetingTask projects one approved, reviewed meeting action into Work in a single transaction: approved/published artifact at the expected revision and digest, recomputed content digest, reviewed-transcript reproof before and after the write, persisted approval receipt, explicit confirmation of uncertain actions, and an idempotent opa.task.project replay receipt stored in meeting state. The Work commit is an injected OpaMeetingTaskWorkCommit (no Work runtime dependency); hosts bind authority, automation policy, key custody and Work.
• ./database/smart-meeting-store — createSqlSmartMeetingStore is the SmartMeetingPersistencePort SQL adapter over the runtime-owned opa_plans/opa_agendas/opa_bookings/opa_domain_command_events/ opa_outbox DDL: the approval packet, an externalEffectsBlocked audit row and the opa.plan.proposed outbox row commit in one tenant transaction, with request-digest idempotent replay and receipt-ref checks. Hosts supply the tenant-scoped transaction (pool and database URL stay in the host).
• ./database/meeting-workspace-sql-ports — createSqlMeetingWorkspacePorts is the one SQL implementation of the reference meeting-workspace persistence ports shared by every host (approval receipts into opa_meeting_approval_receipts, dispatch effects into opa_meeting_effect_outbox, expiring public-link grants, and exact digest/version-vector verified Loro snapshot materialisation through an injected readDocumentText provider binding). It also owns the tenant-bound Loro/state protectors and resolveOpaMeetingShare (grant resolve plus artifact decrypt). Hosts keep env/pool/key binding and the product check.
• ./governance — runtime governance + RGPD enforcement, including atomic protected-booker erasure with legal-hold and observable-failure semantics.
• ./install — the dependency assembly boundary (createOpaRuntime).

Install kit — ./install

createOpaRuntime(config) assembles runtime dependencies with safe fail-closed production defaults. It is not a promoted HTTP operation host in Phase B.

import { createOpaRuntime, opaHandlerCtx } from '@lssm-tech/lib.organization-planning-runtime/install';

const runtime = createOpaRuntime({
	meetingWorkspace,             // governed service + fresh host authority
  rbac,                       // host-bound OpaPermissionEngine + bindings, e.g. identity-rbac RBACPolicyEngine (omit → fail-closed unless localDefaults)
  calendar,                   // opa-calendar-bridge CalendarExecutionAdapterPort
  communication,              // opa-notification-bridge CommunicationSendAdapterPort
  schedulingLinks,            // public scheduling-link resolver
  workspaceCalendar,          // workspace-authorized busy-window reader
  availabilityFreshness,      // workspace-aware authoritative slot refresh
  publicBookingAudit,         // audit sink for public booking attempts
  publicBookingAbuseGuard,    // abuse guard for the public confirm endpoint
  governanceErasure,          // RGPD erasure store (defaults from sqlExecutor when omitted)
  observability,              // lib.observability Instrumentation sink
  sqlExecutor,                // backs the default service-role erasure store
  transactionRunner,         // auto-creates the durable booking saga store
  bookingSagaMetadataProtector, // required host encryption for provider refs
});

// runtime.registry → exact configured profile and meeting-workspace handlers
// runtime.deps     → resolved deps, exposed for inspection/composition
runtime.runManualLoopDetailed(input); // deterministic domain projection only

The install entrypoint also exports OpaRuntimeInput for hosts that map a strict browser intent into the canonical manual-loop input after resolving session authority and workspace-scoped calendar availability. Persistence remains host-owned so plan, agenda, booking proposal, command audit, and outbox writes can share the host transaction. The runtime never writes a calendar during manual-loop preparation.

The G015 saga fields are an additive-compatible evolution of the canonical G014 booking-intent table. Auto-creation deliberately requires a host-supplied metadata protector: provider-returned references are never persisted in clear text, and this runtime does not invent or accept raw booker PII. Conference persistence is additive on the same tenant/RLS-scoped intent row: legacy records default to none, Meet records require a timestamped non-none status, and a ready conference requires protected ciphertext. Pending, ambiguous, failed, cancelled, and superseded states reject stored links. Rescheduling stages a separately protected replacement link and promotes it only after the replacement is ready and the old event is definitively cancelled. The root barrel exposes the provider-neutral canonical saga types and coordinators needed by trusted hosts to reuse this lifecycle for authenticated smart meetings. A protected smart-event envelope is additive; legacy public booker payloads remain byte-compatible. Provider SDKs and decrypted event details stay outside this package and inside the trusted worker composition. The Google production binding uses the workspace-aware seams for public availability, approval rechecks, provider-effect relays, cancellation, rescheduling, reconciliation, and authenticated smart meetings. Legacy tenant/resource freshness and calendar methods remain additive compatibility surfaces for connection-wide maintenance and non-Google hosts; they do not grant Google request authority. Cancellation uses the same fenced compare-and-set path from approval-pending, provider-effect-pending, and provider-ambiguous states, preventing an in-flight create worker from confirming a booking after the visitor has cancelled it. Public booking bearer tokens are persisted as opaque 256-bit values with global collision protection and resolve directly to the current tenant publication; legacy deterministic projections fail closed.

• Returns { registry, deps, runManualLoopDetailed }. The removed manual-loop operation is not aliased into v2; its deterministic domain projection remains available outside the operation registry for trusted proof/demo composition.
• The barrel also exports opaHandlerCtx(scope) (builds a tenant/auth-scoped HandlerCtx) and createLocalOpaAuthorizer() (demo-only permissive authorizer).
• Fail-closed by default. Unconfigured providers stay unbound in production. Opt in to localDefaults: true for a permissive LOCAL authorizer + fake calendar/communication adapters — DEMO/LOCAL ONLY, never production.

Trusted smart-meeting and managed-CompanyOS consumers use the deterministic detailed helper outside the operation registry. Profile and meeting-workspace handler groups are installed only with complete dependencies and remain unmounted; Phase C transport authorization and routing are still required before API promotion.

probeLegacySmartMeetingCanonicalRead remains diagnostic-only. Production CompanyOS supplies an immutable persisted binding resolver; a missing, invalid or foreign binding cannot create a synthetic workspace. Other hosts may retain explicit diagnostic synthesis. The correlation reference in observations remains diagnostic, and successful reads do not establish workflow parity or authorize route cutover.

./database exposes SqlLegacyMeetingMappingStore and additive migration 0082. Bindings are immutable across all five owner axes, with unique legacy receipt, source record and canonical meeting identities. Hosts must verify actual source and canonical records before insertion and immediately before commit. Runtime roles cannot update or delete bindings. The CompanyOS diagnostic lookup is read-only; verified backfill, semantic parity and production activation remain outstanding.

The ./personal-scheduling subpath implements durable focus intent and a fenced effect worker. Create, update, and cancellation serialize per focus aggregate; known provider event identity makes ambiguous retries recoverable, and a stale create completion cannot overwrite a newer cancellation intent. Provider selection and persistence remain host-owned.

Internals (not public subpaths)

• src/observability/ — null-safe OPA observability hooks + withOpaObservability.
• Legacy public-confirm and notification internals are not supported v2 package subpaths. They remain non-operation helpers until exact v2 contracts and handlers are deliberately promoted.

Local Commands

• bun run test — package tests
• bun run typecheck — TypeScript check
• bun run build — bundle + types
• bun run lint:check — Biome check

The CompanyOS scheduling store serializes worker claims per private owner/focus aggregate, caps attempts at five and leases at five minutes, requires READ COMMITTED transactions, and rejects finalization after database-clock expiry. CompanyOS additionally rechecks persisted human approval and current policy at provider effect time. Delegated planning remains separately unqualified.

processPersonalSchedulingCommand requires effectAuthority. The host must reprove the exact command, resource, saved approval and current policy before invoking the provider closure. CompanyOS supplies persisted receipt checks and holds policy/membership locks during the effect. Resolve credentials inside that closure. Missing authority fails closed; error storage accepts stable codes only. Delegated planning still needs separate qualification.

Capture transcription core

transcribeCapturedMeeting binds source media, live scoped authorization and an approved pinned speech model before normalizing transcript segments. The database SqlOpaTranscriptRevisionStore preserves encrypted revision history, idempotent replays and deletion tombstones under owner RLS and commit-time authority reproof. Any legal hold in a transcript family blocks its erasure; it does not authorize access after permission withdrawal or retention expiry.

AI-mode artifact generation cannot create a transcript from meeting context. CompanyOS wires the durable worker and private transcript read route. Retention cleanup and the remaining host/client qualification must be completed separately.

SqlOpaCaptureProcessingJobs supplies scoped durable queue, source-digest binding, lease fencing and completion inside the transcript transaction. CompanyOS now wires the worker and private transcript GET route. Global admission caps processing at ten jobs and 384 MiB of reserved media. The dispatcher role receives only narrow scope discovery rights.

SqlOpaTranscriptReviewStore appends source-bound decisions with encrypted replacement text. It rechecks current review/read authority, rejects stale source or review revisions, and retains original recorded evidence. The transcript authority port now includes review; implement it explicitly. Parent erasure clears encrypted review envelopes, and old approval never applies to a new source.

Reviewed outcome source binding

Outcome analysis 3.0.0 requires the exact transcript reference, source digest and review revision. AI runtimes must load authorized reviewed content and reprove current generation policy. Generated outcomes remain private when their source is private, and remain pending review. Citation membership checks do not establish semantic accuracy. CompanyOS binds its persisted review source through the private owner view. Durable asynchronous generation, downstream source-bound actions and live quality qualification remain incomplete.

createDurableOutcomeAnalysis performs source authorization in a short transaction, generates drafts without an open aggregate transaction, then reloads and reauthorizes before atomic finalization. CompanyOS supplies this handler to its governed runtime. Completed requests replay without regenerating; changed or missing source bindings cannot replay historical outcomes. This is not yet a persisted background job queue: a crash during generation requires retry and may incur repeated provider cost.

Derived outcome artifacts now retain reviewedSource identity/revision/digest evidence without transcript text. Current source reproof is required for approval, publication, dispatch planning/execution and delivery. A worker without loadReviewedTranscript fails closed for bound artifacts. Legacy artifacts without this metadata retain their existing behavior; their source provenance is not retroactively qualified. CompanyOS still needs its complete production effect worker and deletion propagation through derived artifacts.

Effect hosts share one lease processor. processMeetingEffectLease reloads encrypted state under the owner lock, reproves authority (resolve and effect-time reprove must match), evaluates rollout, verifies the plan approval and artifact digest inside the Postgres dispatch fence, delivers, and persists plan evidence; meetingEffectLeaseOutcome maps the result to delivered or dead-letter. Hosts supply only transport: the standalone worker reaches authority and delivery over HTTPS, the CompanyOS API cron calls them in process. staticMeetingEffectRollout binds a host-owned rollout config to the leased effect, and summarizeMeetingEffectCycle produces the count-only cycle snapshot. Migration helper opaMeetingEffectDispatchMigrationStatements (CompanyOS 0172) adds the discovery-only companyos_meeting_effect_dispatcher role and companyos_meeting_effect_due_scopes, which returns owner scopes, never effect refs or payloads. Run exactly one effect host per database.

Derived artifact and copied-context reads reprove their reviewed source. Generation from copied transcript context preserves its binding, including on cached responses. Private artifacts require an explicitly reviewed shared copy before issuing any recipient or public share; public token resolution excludes private revisions. Recognizable transcript-derived content without a source binding fails closed pending qualification. These access controls do not replace physical erasure, retention or backup deletion.

Correcting and reviewing outcome drafts

Artifact review 3.0.0 accepts optional editedContentMarkdown when approving. The request still binds the displayed artifact revision and original content digest; the receipt approves the corrected digest. Human edit metadata records the prior digest, actor and timestamp. Empty edits, edits combined with rejection/CRDT snapshots, and independent edits during open collaborative sessions are rejected. A retry key cannot approve a different payload.

The private draft cards expose edit, approve and needs-changes controls using server-derived canReviewOutcomes. Uncertain review responses retain the current draft for retry; access denial removes it. Approval does not send messages, publish links or create Work tasks. Actual edited-review PostgreSQL qualification, complete collaborative editing and downstream actions remain open.

Durable outcome processing

Analyze 3.1.0 accepts executionMode: background on its existing route. Repeating the exact request observes the same persisted job; processing responses carry processingJobRef, while completion returns the saved outcome. The private draft client selects background mode when the server advertises it and can stop polling without cancelling accepted work. Terminal failures remain failures.

Apply additive migration 0080, configure a dedicated companyos_outcome_dispatcher login, and enable OPA_OUTCOME_JOBS_ENABLED=1 only with approved pinned OPA_MEETING_AI_* EU processing. The every-minute /api/cron/opa-outcome-processing route requires CRON_SECRET. Runtime credentials must not be superuser, BYPASSRLS or a member of opa_migrator. The queue admits four global jobs and one per owner, bounds pending owner jobs at 25, retries at most five times and uses six-minute fenced leases. Current membership, module entitlement, intelligence policy, source consent/review and model binding are rechecked before generation and commit.

Outcome persistence and completion share a transaction; model calls are outside SQL. Queue rows contain references and authorization evidence, not transcript text or credentials. Model cost may repeat after a crash before commit. Terminal-job self-service repair, queue retention/deletion propagation, live model/provider qualification and production rollout remain open. No production activation is implied by the local tests.

Evidence-bound action proposals

Meeting prompt 2.0.0 requires structured actions for action-plan generation. Each proposal carries a title, optional description, explicit/uncertain classification and exact quotations tied to supplied citation references. Missing action output or unsupported quotes fails generation. Model output cannot supply owners or deadlines. Quote membership proves traceability, not semantic correctness.

Action-plan artifacts retain actionProposals, and their content digest covers prose and structured actions together. Artifact review 3.1.0 requires acknowledgeActions for a nonempty task list. Reviewers may edit titles/details while preserving verifiable source evidence. The private draft cards display proposed tasks, uncertainty and source quotes with an explicit approve-draft-and-tasks label. Prose-only or collaborative edits clear stale structured actions; edited structured input is revalidated against the current approved transcript.

This creates reviewed proposals, not Work commitments. Assignment, due dates, canonical Work projection, downstream delivery, deletion propagation and the live precision/recall benchmark remain open. Prompt-version changes invalidate incompatible queued generation bindings; never relabel old processing as using the new prompt.

SqlPrivateMeetingStore on ./database creates private ad-hoc workspaces through existing encrypted state/projection storage. Hosts supply fresh management authority and key readiness. A scope digest rejects workspace drift; an owner lock serializes creation and a durable receipt handles unknown HTTP outcomes. The store enforces an initial 10,000-meeting owner bound while allowing exact replay. It performs no calendar or recording effects and does not extend the mandatory nineteen-operation service interface.

createDurableArtifactGeneration performs preparation in short phases: authorize and read context, generate outside SQL, then reload and atomically finalize using existing artifact semantics. It rechecks between model calls, rejects context/policy drift and conflicting request-key reuse, and reproves cached results. Hosts can supply reprovePreparationContext to validate source ACLs inside the caller transaction. createGovernedMeetingWorkspaceService.artifactGeneration installs this path without changing legacy service interfaces.

createDurableOutcomeAnalysis.generateArtifact optionally supplies a dedicated generator for an already authorized reviewed transcript. This keeps graph-specific context validation separate from reviewed-source authorization; the outcome orchestrator retains source, policy and finalization checks.

CompanyOS preparation generation now requires additive migration 0083 before deploying this runtime. SqlPreparationAdmissionStore admits one active model request per complete owner scope, using six-minute database-clock leases and at most five attempts per request. Immutable digests bind the request key to its exact input, context and policy; conflicting reuse fails. Concurrent requests receive the existing IDEMPOTENCY_IN_PROGRESS error and may retry the same key. Expired workers cannot commit artifacts or release a replacement worker's lease. Admission completion and artifact persistence share one transaction. Cached artifacts still require fresh authority and source checks. Crashes may repeat model cost after lease expiry; this does not establish global model quotas, background preparation qualification or live-provider acceptance.

Capture webhook settlement reuses the immutable owner-scoped meeting idempotency ledger. SqlCaptureWebhookReceiptStore on the runtime ./database subpath accepts host-verified notification identity and a transaction-only apply callback. Current authority/provider binding is reproved before writes and commit, including replay; changed payload/capture binding conflicts. Receipt and domain writes commit together. Receipt storage contains digests and a content-free result. The host still owns signature verification, durable bot mapping and HTTP routing; external effects must use an outbox, never the callback transaction.

Bot capture bindings are distinct from reviewed recorder-source matches. SqlBotCaptureBindingStore on the runtime database subpath persists immutable encrypted capture/provider mappings and a reverse identity index in the existing meeting receipt ledger. A host-provided authenticated encryption port binds full owner scope and the binding digest. Binding confirmation must reprove actual capture/start intent and provider evidence; reads require current owner authority. Identity receipts never override capture consent, revocation or deletion. HTTP callback routing and the live bot host remain separate integration work.

createBoundBotWebhookSettlement composes encrypted bot identity with webhook receipts on one owner transaction. The host supplies a verified owner and deployment reference; the stored provider/bot/deployment mapping must match before current capture policy is reproved. resolveInTransaction avoids borrowing a second connection. Deployment-aware callback identities have separate receipt namespaces; legacy inputs preserve existing keys. Raw-signature verification, owner routing and domain lifecycle application remain host responsibilities.

Bot reconciliation uses additive migration 0084 and a coalescing owner-scoped request row. Verified callback intake defaults to enqueueing reconciliation in its receipt transaction, rather than applying delayed provider state. Workers claim three-minute leases, one active per owner, with five failed attempts and a retry delay. New notifications during a lease remain queued after completion; expired/replaced workers cannot settle. More notifications cannot revive an exhausted job. The provider-fetch worker, repair UI and deployment dispatcher still require integration; do not activate callback routes before migration and host wiring.

runBotReconciliation resolves the immutable bot binding under a current lease, fetches provider state outside SQL, then rechecks binding/lease before transactional apply. Hosts provide an adapter that rechecks effect authority immediately before provider access and a domain/outbox-only apply function. Unknown/mismatched observations fail; retries store a stable content-free error. Failed settlement is distinguished from confirmed lease fencing. Provider readiness does not prove media ingestion or final transcript quality. Production dispatcher, actual capture projection and deployed-provider binding remain required.

Bot reconciliation provider reads default to a 30-second deadline (maximum 60 seconds), shorter than the job lease. The worker passes an AbortSignal and rejects late results even if a provider ignores it. Shutdown before claim consumes no attempt; cancellation during finalization prevents apply. Attendee get accepts the optional signal, combines it with its transport timeout, and checks cancellation before and after secret resolution. Host read adapters must forward the worker signal.

dispatchBotReconciliation runs one bounded owner cycle using an explicitly authorized due-page reader. Due rows are ordered by availability and capped at 100 (default 10); duplicates or over-budget pages are rejected. Candidate failures do not suppress later rows, and cancellation stops additional claims. This is not a global privileged dispatcher: production owner enumeration, periodic scheduling and provider/lifecycle bindings remain host-owned and unqualified until integrated.

Bot reconciliation admission is bounded per owner: at most 100 queued/leased captures and 10,000 retained capture rows. An owner admission lock prevents concurrent inserts from exceeding these bounds. Wakeups for existing queued/leased captures coalesce at capacity; idle activation needs a pending slot. Failed rows remain terminal and do not regain retries from webhook traffic. Retention/repair operators must manage exhausted retained capacity before further new captures are admitted. These application-path limits do not replace global tenant/service capacity qualification.

repairBotReconciliation is an explicit authorized reset for a failed job at its expected requested revision. It records operator, reason, prior attempt count and failure code in the immutable receipt ledger, enforces pending admission and reproves repair authority before commit. Exact retries return the original repair receipt without resetting later work. Callback admission never invokes repair. An operator-facing endpoint/UI and production repair authority must still be composed.

SqlBotDeploymentStore persists owner-scoped encrypted deployment configuration revisions in the existing immutable receipt ledger. Configuration contains HTTPS endpoints, managed/customer-operated mode, EU region, disabled/active/draining state and server secret references; no credential values. New deployments default disabled. Activation requires licensing/processing references and the host administration guard must verify their evidence. Writes use expected revisions and current operator authority; replay cannot overwrite later configuration. Operator UI, concrete secret-store binding, bot-start state enforcement and live deployment qualification remain open.

CompanyOS deployment resolution now permits existing-bot reads only for active or draining configurations. It captures the encrypted registry revision, lazily resolves the owner-scoped API secret, and rechecks configuration before secret access and again before HTTP dispatch. Disabling or rotating configuration invalidates pending reads. SqlBotDeploymentStore.readInTransaction reuses the effect-authority transaction without acquiring another connection. Administrative UI, concrete secret-store binding, bot starts, global scheduling and live provider qualification remain open.

Private meeting notes

CompanyOS exposes one private human-authored notes draft per meeting through additive opa.meeting_artifact.get_note and opa.meeting_artifact.save_note operations at GET/POST /api/v2/opa/smart-meetings/:meetingRef/notes. Existing meeting-work-session management permission authorizes this personal authoring surface; recording, transcript generation and model credentials are not prerequisites. Saves use expectedRevision (zero for creation), at most 100000 characters and a stable idempotency key. Notes remain live_notes/private_user/draft, persisted in the existing encrypted aggregate. Empty content clears the draft. Revision conflicts preserve the local draft and show the latest saved notes before an explicit choice to continue. Saving notes creates no Work task and sends no message.

Recent private meetings are available through additive opa.meeting_workspace.recent (GET /api/v2/opa/private-meetings?expectedOwnerScopeDigest=...). Use the existing private creation-context digest; it prevents stale scope selection and grants no authority. The fixed latest-twenty view uses stored timestamps/readiness and optional 160-character canonical manual-note previews. Current authority is reproven before and after the encrypted owner read, and no caller scope or limit is accepted. CompanyOS renders snippets as plain text and reopens the existing meetingRef URL.

Durable AI preparation requires a configured admission adapter before database or model work. Omission returns preparation_admission_required; manual generation remains available without model admission. CompanyOS already binds the SQL admission store. Existing stored artifacts and request records remain unchanged.

CompanyOS uses one processing-readiness predicate for the capture configuration view and new-session admission. New captures check readiness before insertion and before commit. Exact authorized create retries bypass new-session admission; existing media can still be uploaded and recovered under current consent, policy and source controls. An unavailable processor does not silently collect new recordings.

Google free/busy snapshots now carry normalized query provenance. Cache reuse requires the same calendars, time window and timezone, and rejects future or unbound observations. CompanyOS preparation requires covered planning time plus a matching refresh snapshot digest, evaluated at current server time after refresh. Additive migration 0085 adds query_binding; apply it before deploying the new store/read paths. Historical rows remain readable without earning freshness, and older refreshes cannot overwrite newer observations. Calendar identifiers stay in the tenant-scoped server store.

Explicit authorization policy_suggestion is available only for planning.propose under an effective suggest policy. The host must hold its durable fence, reprove authority/resource access and current policy, and recompute the proposal inputDigest. No command/approval/delegation evidence may be mixed into this intent. Legacy intents and all other actions retain their evidence requirements. Execution is restricted by the host to proposal persistence; it does not authorize placements, Work commits, capture, sharing or delivery.

Automation policy ownership

./authz continues to export resolveOpaAutomationPolicy, forwarding directly to the canonical spec policy leaf. Effect-time execution uses that same resolver without loading the composition module for policy evaluation.

OpaAutomationEffectAuthorityPort and runWithOpaAutomationAuthority retain their existing runtime ownership and behavior: each attempt stays inside the durable host fence and rechecks scope, revision, consent, policy/input digests, evidence and clock before execution.

Execution ownership

The runtime no longer depends on @lssm-tech/module.organization-planning. It owns the execution surface under ./execution/adapter-ports, ./execution/fake-adapters, ./execution/domain-command-persistence and ./execution/opa-runtime (runOpaManualLoop). The fail-closed execution verdict (OpaExecutionAuthorization, DENY_OPA_EXECUTION, isOpaExecutionAllowed) is owned by @lssm-tech/lib.organization-planning-spec/opa-execution-authorization. The module's existing subpaths re-export these same objects for compatibility. The runtime depends on neither @lssm-tech/lib.companyos-runtime nor @lssm-tech/lib.identity-rbac. The outbox store implements the generic @lssm-tech/lib.jobs/outbox/types port, and hosts drive it with the Jobs ./outbox/dispatcher and ./outbox/backoff (CompanyOS keeps its old outbox paths as identity-preserving aliases). Authorization goes through the OpaPermissionEngine port (./authz/permission-engine, also re-exported from ./authz): host composition roots construct the identity RBAC RBACPolicyEngine and pass it as rbac.engine. createLocalOpaAuthorizer() and the runtime tests use the OPA-owned createLocalOpaPermissionEngine() (./install/local-permission-engine), whose verdicts match identity RBAC for OPA-validated bindings (proven by the API application's opa-rbac-engine-parity test).