@lssm-tech/lib.personal-os-runtime
Pure PersonalOS runtime primitives for subject-bound authorization, autonomy policy resolution, immutable event replay, minimized projections, and portable data-rights plans.
The runtime performs no I/O. Hosts provide durable stores, verified identity, clock, audit, encryption, and effect execution through explicit ports.
PersonalSubjectStateTransactionPort is the production persistence seam. It atomically commits an exact authority-bound command, receipt, immutable event, encrypted snapshot, idempotency result, and outbox records, then supports subject-bound hydration and cursor-safe worker reads. Digest helpers expose the same canonical, domain-separated payload binding used by domain reducers. The digest map includes online-only, human-required private progress-celebration configuration, disable commands, and goal-scoped support commands.
./household-command-builder is the shared browser-safe constructor for the invite, activate, delegate, and revoke journey. Hosts provide exact IDs, identity, revisions, evidence, timestamps, and native digest execution where needed; the builder fixes high-risk, human-required, online-only policy and never treats a newly created delegation as authority for its own command.
./productivity-command-builder owns Today-plan and habit command construction. Hosts supply IDs, trusted subject/actor, revision, time and evidence; the pure builder preserves low-risk, human-required, queueable policy and binds the existing canonical payload digest. Form parsing and trusted-context binding stay in delivery hosts. Construction does not execute a command or authorize a retry.
createPersonalPlanCommandDraftV1 returns the same command unbound (zero payload digest) for hosts that bind digests through a native port. The same subpath exports buildPersonalReflectionCommandV1 and
createPersonalReflectionCommandDraftV1 for check-in, missed-day recovery and weekly-review commands: observed-values-only, no invented metrics, neutral no-shame recovery tone and submission evidence on the review. Hosts keep form parsing, week/period selection, identifiers, time and undo routing.
./command-envelope owns the generic unbound command envelope (buildUnboundPersonalCommandEnvelopeV1: the submitting surface's evidence first, copied consent/delegation ids, placeholder digest) and
bindPersonalWorkspaceCommandV1, which validates a workspace command and binds its domain-separated payload digest. Hosts keep form parsing, identifiers, time and the surface evidence reference; native hosts with digest ports bind themselves.
./coach-command-builder owns coach adaptation propose/activate/inspect/undo/ reset construction. Hosts supply IDs, trusted subject/actor, consent, coach and adaptation revisions, time, evidence and proposal copy; the builder fixes human-required, online-only policy, per-action risk, the presentation-only Today-density change and its seven-day expiry. createPersonalCoachCommandDraftV1
leaves digest binding to native hosts. Construction grants no authority.
./outcome-command-builder owns record/correct/remove outcome observation commands: self-declared, full-confidence observations at submission time with the submission evidence as provenance, no raw sensitive data and no protected-trait inference. Hosts keep value parsing, metric resolution, identifiers, time and digest ports; createPersonalOutcomeCommandDraftV1 leaves digest binding to native hosts.
./foundation-command-builder owns household creation, mission establishment and first-goal construction: households are created online at revision 0 with the creator as sole active owner and the non-waivable member exclusions; missions and goals are self-declared, and a goal starts one self-reported 0→target percent metric over 90 days. Hosts keep form parsing, identifiers, consent/guardrail selection, time and digest ports.
./rights-command-builder owns export/deletion rights requests: all personal data, portable JSON exports, exact-subject deletion confirmation, high-risk, human-required and online-only. The request itself exports or deletes nothing.
./support-command-builder owns goal-scoped support grant/report/revoke/block construction: seven-day single-goal read-and-encourage grants with the non-waivable delegate exclusions and one-day goal-scope evidence referenced from the envelope. The goal-scope digest stays with the support domain and is injected by hosts (digestGoalScope); hosts also keep delegation/grant lookup, identifiers, time and digest ports.
createPersonalConsentCommandDraftV1 returns the unbound consent command for native digest ports. ./consent-command-builder creates the canonical grant/revoke envelope with no ambient consent, delegation, or autonomy authority. The host runtime rechecks every referenced lifecycle consent at the command submission time once a workspace has adopted the consent domain; revoked and expired grants deny before authority or persistence.
./meeting-context-consumer and ./meeting-memory-intake are the PersonalOS host decisions for the companyos_meeting_context consumer.
answerPersonalMeetingContextReadV1 and decidePersonalMeetingMemoryIntakeV1
take the host-resolved subject, its consent ledger, the self-declared declaration and the host clock (a request more than five minutes off it is refused). They answer only under one current consent (granted, purpose
projection_sharing, category personal_projection, unrevoked by status or receipt, inside expiry and retentionDays) and otherwise withhold everything. Stored memory entries keep retainUntil = storedAt + retentionDays; the host persists entry and receipt atomically and answers a repeated entry id with the first receipt.
./guardrail-command-builder creates the canonical guardrail and goal-conflict envelopes. It fixes high risk, human-required authority, and online-only eligibility while binding exact subject, revision, evidence, idempotency, and domain-separated payload digest; it cannot itself declare a trigger safe.
./digest-port is the native-safe binding lane: it exports the workspace command digest domain map, the canonical digest material, the shared canonical JSON serializer, and bindPersonalWorkspaceCommandWithDigestPortV1, which binds the payload digest through an injected (async, platform-native) SHA-256 port. React Native hosts use it with expo-crypto instead of copying the domain map; the result equals bindPersonalWorkspaceCommandV1.
./journey-command-context exports projectPersonalJourneyCommandContextV1, the one pure derivation of the command-building context from a
PersonalWorkspaceProjectionV1: revisions, mission/goal/outcome ids (with the latest observation), granted consent ids, delegations and the first active
propose_support delegation, support grants and the first active grant, and coach adaptation revisions. Web, desktop, and mobile hosts use it instead of re-deriving references; it selects ids only and grants no authority.
./progress-celebration-command-builder owns configure/disable progress celebration construction: low risk, human-required, online-only, bound to the granted consent, private privacy mode, and the fixed anti-dark-pattern guardrails (PERSONAL_PROGRESS_CELEBRATION_GUARDRAILS_V1: no pay-to-win, no artificial scarcity, no protected-trait targeting, no leaderboards). Hosts keep form parsing, identifiers, time and consent selection.
PersonalAuthorityReceiptVerificationPort keeps receipt signature/replay proof host-owned while binding its result to the exact canonical receipt, authority draft, and proposal digests. A receipt allowlist alone cannot authorize a self-consistently resealed draft or proposal.
Production execution is two-phase: PersonalAuthorityTwoPhasePort.prepare
reserves an immutable receipt identity and decision tuple without effects, a pure reducer computes the proposed state, and finalize binds the canonical before/after semantic state digests. Encryption then binds that state digest as AAD while keeping ciphertext integrity separate, so randomized nonces never change the authority meaning of the proposal. Denied and confirmation-required drafts are finalized with identical before/after state digests and recorded through
PersonalAuthorityDecisionAuditPort; they never produce an event, snapshot, or outbox effect.
The productivity constructor validates through the existing productivity contract leaf and returns only that domain, preserving the canonical workspace digest. Fresh typing-cost and packed-consumer acceptance remain separate qualification.
