lib.work-spec

@lssm-tech/lib.work-spec

Canonical provider-neutral Work Graph contracts for CompanyOS and independent downstream products.

The package owns opaque UUIDv7 work identity, tenant structure, strategy and execution objects, organization metadata, collaboration metadata, personal productivity records, external bindings, sync conflicts, immutable events, mutation envelopes, and capability manifests.

Custom-field definitions and values are native contracts. A value always references both its custom_field_definition and the Work object it applies to; provider-specific fields remain external binding payloads rather than becoming canonical required fields.

WorkObjectRef.kind is restricted to the canonical Work taxonomy. Events are explicit and immutable: object lifecycle, recurrence configuration, time tracking, relationship, comment-creation, and attachment-link events. Recurrence rules are attached to recurrence-template aggregates; time entries, comments, and attachment links are attached to their tracked Work aggregate. Relationship events are attached to their source aggregate, including blocking dependencies consumed by OPA planning projections.

It does not schedule work, call providers, persist data, evaluate CompanyOS authority, or store collaborative document bodies. OPA owns actual placement; CRDT packages own document and canvas bodies.

import {
  WorkObjectSchema,
  WorkMutationEnvelopeSchema,
  WorkObjectRefSchema,
} from "@lssm-tech/lib.work-spec";

Production integrations must map provider IDs into external bindings and declare field-group authority. They must never substitute remote identity for a canonical Work ID.

Managed host implementations must satisfy WORK_MANAGED_COMMIT_AUTHORITY_CONTRACT: keep current organization/session/workspace/team authority and canonical Work event/outbox persistence in one transaction. A caller-selected action label never grants mutation authority. Existing operation envelopes and canonical identity bindings remain unchanged.

Canonical Work hierarchy and legacy parity

Apply additive migration 0081 after 0080 before enabling new Work identity allocation. New operators reuse canonical tenant/organization/workspace IDs for the same verified legacy scope, and a principal retains its canonical ID across workspaces within a tenant. The database enforces this during mixed-version rollout; new allocation is serialized per legacy tenant. Existing bindings are read without taking the allocation lock.

Existing rows and Work events remain intact. A coherent legacy mapping is adopted for new operators; conflicting parent or principal mappings block new allocation with WORK_IDENTITY_RECONCILIATION_REQUIRED. Use inspectWorkIdentityParity inside an authorized transaction with the physical tenant GUC set to inventory conflicts. It reports scope categories and counts without rewriting data. Do not pick an arbitrary legacy ID or rewrite immutable Work events to clear the error. A reviewed reconciliation and parity/restore proof are required before enabling shared projection for a conflicted tenant.

The preparation function rejects foreign scope or unavailable trigger enforcement. Personal-context provisioning uses distinct physical tenants/workspaces, which remain isolated. This change is locally verified on PostgreSQL 15; production migration and existing-data reconciliation remain separate release gates.

Work scope validation now includes tenant, organization and workspace on object reads, including both materialized projections and replay fallback. Mismatched projection identities fail closed. Mutation services validate the current object's identity/scope and replay receipts against the authorized actor and scope. PostgreSQL commits serialize by aggregate before revision checks and reject changing an existing aggregate's scope; projection upserts cannot replace a newer revision with an older worker result. These changes preserve existing wire contracts and require no schema migration. Tenant-only event/outbox worker ports remain trusted internal surfaces and must not be exposed as workspace-authorized reads.

Work object reads compare materialized projection revision with the committed event head in one SQL snapshot. A lagging or missing projection falls back to scoped event replay, so committed updates, archives and restores are visible without waiting for the outbox worker. Returned metadata carries the current aggregate revision, including lifecycle-only events. Reads do not mutate projections. Long aggregate histories still require performance qualification.

GET /api/companyos/work/objects/:objectId reads a canonical UUIDv7 Work object under current server-derived workspace authority. The request accepts no scope parameters. Existing coherent canonical workspace mappings are read without allocation; conflicting mappings fail closed. The API uses the scoped, event-head-aware Work store and reproves read authority before returning. Responses are private/no-store, and absent, foreign or archived objects return not found. Native task-detail presentation is separate qualification work.

POST /api/companyos/work/objects/:objectId/status accepts only a canonical object ID, expected revision, status category and idempotency key. Current writable authority and actor/scope are derived server-side inside the transaction. The existing Work service commits status changes and three outbox destinations atomically. Completion uses server time; reopening clears completion time. Identical retries resolve the stored event before current-state validation. Native controls and live end-to-end qualification remain open.

Work outbox lease validity uses the PostgreSQL clock. A caller availability cutoff cannot expire another worker’s active lease, and expired leases cannot acknowledge or release work even before replacement. Settlement checks expiry again in its conditional write. Hosts must still use distinct claim identities and authorize effects independently; this does not activate the OPA consumer.

Work outbox lease contract v2 requires deliveryAttempt on acknowledge/release, copied from the claimed record's deliveryAttempts. The dispatcher supplies it automatically. Matching a worker name and future expiry is insufficient: settlement also checks the exact persisted attempt. Old or missing attempt values fail closed. Update custom callers before upgrading; no database migration or stored-record reset is required.

Workspace revision fencing hashes every canonical Work aggregate head, including unplaced, completed and archived work. Work commits take a shared workspace advisory lock; proposal publication takes its exclusive counterpart and checks the complete digest before persistence. The interactive planner and internal background proposal publisher use this fence. Upgrade all Work writers before qualifying it; older writers that omit the shared lock are not covered. Calendar freshness and policy/approval checks remain independent.