Source snapshot bcc79fcc · Declared package version 2.0.4. This page combines the checked-in package guide and manifest; commands and runtime behavior were not executed in this review.
Consent-aware personal mission, agency-goal, and projection contracts for LSSM OS.
PersonalOS gives a person an explicit contract for what they want to learn, earn, build, own, and contribute. It can align those goals with products or companies without turning personal data into employer authority.
The ./productivity leaf exports PersonalProductivityWorkspaceCommandV1Schema
and its output type. It is the exact strict productivity branch also used by the full workspace command schema, including command-prefixed error paths. Consumers can check this branch without importing unrelated workspace domains.
Boundary
A mission and its goals are self-declared and independently revocable.
Observations are append-only references to redacted or minimized evidence.
Pactena, HCircle, and CompanyOS consume purpose-limited projections, never the private profile.
Every projection requires an active sharing grant that names audiences, fields, purpose, expiry, and revocation state.
Raw sensitive values, inferred protected traits, secrets, and credentials fail validation. Runtime policy and ContractSpec Connect remain responsible for authorization and effects.
Commands and events use subject-bound, idempotent execution envelopes. Every decision emits an evidence-linked receipt, and autonomous approvals require a scoped policy plus undo or compensation. Human approval is the default; diagnosis, treatment, emergency monitoring, sensitive sharing, delegation, deletion, and authority changes are never silently automated.
Authority services may emit the additive commandBinding tuple on V1 receipts. PersonalOS effect boundaries use the strict full-binding helper so an approval cannot be replayed after changing command name, revision, idempotency key, submission time, policy, or canonical payload digest. The legacy helper remains available only for compatibility readers that do not execute effects.
Server identity bridges emit PersonalAuthenticatedSessionV1, a strict, pseudonymous session reference bound to one exact personal subject, assurance level, authentication time, and expiry. Clients cannot construct authority from this value: hosts must reverify the underlying provider session on every request.
The minimized experience projection is a strict, subject-and-actor-bound wire contract. It exposes revisioned journey state, bounded area availability, and privacy counts without raw health, provider, credential, or private payloads. Its optional personalizationIdentity member carries only an opaque SHA-256 tenant reference plus one consent reference/status. Clients combine that binding with the exact outer subject and actor refs to retire scoped telemetry buffers; raw tenant labels and consent evidence are rejected by the schema. Its additive presentation projection binds exact subject and actor kinds and versions plus an active view_shared_projection delegation when the actor is not the subject. It contains only canonical component/action identifiers, authority boundaries, attributed presentation preferences, generic explanation codes, and a reset patch. Its domain-separated SHA-256 digest is recomputed by the schema over the complete projection material. The outer projection rejects a presentation rebound to another subject or actor.
The additive mission-goals and productivity contracts cover the full personal planning loop: establish a mission and principles, define outcomes and observed metrics, correct or remove self-reported observations without erasing their evidence-linked history, rank a capacity-aware Today plan, maintain habits, check in, recover explicit missed days without synthesizing values, and complete a weekly review. Low-risk personal edits may be queued offline; authority and household-rights changes are always online and require a human decision receipt.
Progress celebration is a separate, opt-in, online-only preference contract. V1 supports private evidence-receipted XP only: each policy binds one exact subject, goal, consent, transparent rule, and total cap. Pay-to-win mechanics, artificial scarcity, protected-trait targeting, leaderboards, raw activity content, and authority effects are structurally unavailable. Disabling a policy preserves its history while preventing new celebration projection.
The additive workspace command union composes that loop with revision-zero household bootstrap and human-confirmed export/deletion requests. The paired authorized-command schema rejects receipts that do not bind the exact subject, actor, command, revision, idempotency key, policy, submission time, and payload digest. PersonalWorkspaceProjectionV1 adds bounded, privacy-minimized mission, goal, current outcome/provenance, Today, habit, check-in, recovery, review, delegation, health, coach, and private progress-celebration summaries to composite revisions. It never exposes raw health measurements, provider payloads, credentials, or private reflection text; those remain encrypted host state.
Consent lifecycle is an explicit workspace domain. Grant and revoke commands are exact-subject, high-risk, human-required, online-only, revisioned, and evidence-linked. Grants name a purpose, bounded data categories, known consumers, retention, and expiry. Revocation atomically preserves an authority receipt plus the exact affected consumers; raw consent evidence is never projected. Legacy snapshots without this domain remain on their existing host consent port until an explicit grant migrates them. The companyos_meeting_context consumer (./meeting-context-consumer,
./meeting-memory-intake) covers CompanyOS meeting preparation and private meeting memory. A read request carries an opaque account ref the PersonalOS host resolves to its own subject; the answer is either a minimized projection of at most ten self-declared fields, bound to the request id, consent id and a revision ref and carrying its consent and retention window, or withheld with a stable reason. A memory entry is digest-stable per follow-up effect and is answered stored (consent id, retainUntil) or withheld. The optional V1 dashboard window adds only purpose, category and consumer identifiers, lifecycle status, retention, and expiry. It reports exact totals, prioritizes active grants, marks truncation, and excludes receipt IDs, evidence references, subject identifiers, and private purpose text.
Guardrails and goal conflicts are an explicit workspace domain. Definitions, triggers, resolutions, conflicts, and subject decisions are exact-subject, high-risk, human-required, online-only, revisioned, and evidence-linked. Pause and block responses stop affected goal progress; revoke-sharing responses block current and future goal-scoped support until resolution. Public workspace reads contain bounded counts only, never descriptions or evidence references.
Coach adaptations expose a reversible explanation and categorized basis without raw behavioral signals. Governed proposal and activation commands are the only production creation path: they permit bounded presentation changes, preserve data and authority visibility, expire, and carry undo plus compensation. Human approval is the default; policy-governed or autonomous display-only changes need an exact active, scoped, budgeted policy. Inspect, undo, and reset remain online, consent-bound human controls. Hosts compare workspace, coach, and adaptation revisions against hydrated state before authority or effects.
Households model explicitly invited members and purpose-limited permissions. Membership cannot amend another person's mission, infer protected traits, or create consequential authority.
Goal-scoped delegated support is an additive contract beside the existing household V1 grant. It names exact goals, visible minimized fields, permitted proposal-only actions, purpose, consent, expiry, evidence, and immutable excluded authority. Grant, revoke, block, and categorical report commands are online-only, high-risk, and human-required. Safety reports contain no free-text narrative or private profile data. The workspace union now carries those support commands and its minimized projection exposes bounded grant status/scope plus categorical recovery counts, never consent IDs, purpose text, evidence references, or report narratives. The additive support-notifications entrypoint defines content-free delivery intents and receipts for those recovery effects. Intent IDs, canonical template references, immutable event, exact subject/recipient, audience, support kind, expiry, and domain-separated digest are bound together. Grant, revoke, and block require subject plus delegate delivery; reports require subject plus the safety service. The worker rejects extra audiences, duplicate intent or evidence IDs, replayed events, recipient substitution, and non-assurance provider evidence before acknowledging the outbox lease. Those exact-binding checks are owned by the support-notification-validation entrypoint (assertPersonalSupportNotificationIntents,
assertPersonalSupportNotifications,
requiredPersonalSupportNotificationAudiencesV1) so every host enforces the same rule.
Compatibility intent: additive V1 public contract package.
Workspace health may carry an optional bounded wellbeing-goal window. It keeps exact goal and experiment IDs, lifecycle, safe metric/direction, observation count, window, and uncertainty-aware interpretation only. Raw measurements, evidence, target values, provider fields, clinical claims, and causal claims are structurally excluded; duplicate IDs and count/cursor inflation fail closed.
Declared capabilities.
Lib Personal Os Spec
Consent-aware personal mission, agency goal, and projection contracts for LSSM OS.
Use it to
Adopt consent-aware personal mission, agency goal, and projection contracts for lssm os
Requires
TypeScript
Choose another boundary when
The @lssm-tech/lib.personal-os-spec package constraints do not match the target runtime or platform.
These are package-manifest entry points. Named symbols listed above come from the capability catalogue; this is not an exhaustive TypeScript symbol reference.
