module.customer-support

@lssm-tech/module.customer-support

Reusable SupportOS product module for the calm tri-pane operator inbox, accessible DecisionGraph/SOP AI canvas, progressively loaded customer messenger, host routing, embedding SDK, and MCP/agent descriptors.

The module consumes design-system primitives and presentation-only personalization. It references CommunicationOS threads, Forms, workflow operations, SOPs, and DecisionGraph revisions without taking authority from their canonical owners.

DecisionGraph authoring now pairs the visual canvas with a synchronized structured graph view. The ordered ledger exposes localized node labels, entry state, incoming and outgoing counts, and named destinations while sharing the same selection, inspector, replay, and patch-review context. Both views are keyboard reachable and launch with English, French, and Spanish chrome. This is local implementation evidence, not WCAG qualification: automated axe and authenticated browser keyboard journeys, VoiceOver/NVDA, 200% zoom, RTL, dense-graph virtualization, native parity, manual review, and production canaries remain open.

DecisionGraph definitions now have strict additive create, draft-save, publish, get, list, and archive contracts plus a protected /api/support/v1/decisions surface and typed client. The shared en/fr/es lifecycle panel exposes the live draft and published revisions without tenant or workspace authority. PostgreSQL publishing is immutable and digest-pinned; draft writes are optimistic and exact retries retain their receipt. The independent support.decisioning conjunction must be enabled. Protected validate, simulate, evaluate, replay, and compare commands now require caller-stable retry keys and persist typed immutable evidence through forced-RLS PostgreSQL tables. Evaluation inputs use the idempotent and erasable DecisionInputProtectionPort, every response is revision- and digest-pinned, and pinned subgraphs are resolved recursively before publication or execution. Protected evidence list/detail queries reauthorize live membership, validate every immutable receipt before projection, omit protected inputs and outcome payload data, and paginate through opaque database-issued fixed-watermark cursors. Retention, legal holds, erasure, authenticated browser/RTL/screen-reader journeys, a standalone decision workspace, real database contention, restore/load drills, manual accessibility, and production canaries remain open.

SupportOS data lifecycle is independently gated by support.data-lifecycle. Strict retention-policy, legal-hold, erasure-request, and redacted status contracts derive tenant, workspace, actor, and the subject closure from current server authority. The administration surface at /support/settings/data-lifecycle ships English, French, and Spanish chrome, retry-stable mutations, explicit irreversible confirmation, and no protected subject or governance evidence. Erasure completion requires live membership, every canonical owner receipt, no active hold, a freshly verified state-bound Connect decision, and durable deletion evidence. Database-clock scheduled retention defaults to and caps closed-case/evidence horizons at 730 days, caps temporary state at 90 days, and erases only SupportOS-owned closed-case protected values through live-rollout-checked, least-privilege, lease-fenced durable jobs. Automatic case resume uses the same durable worker boundary. Deployments compose createSupportCaseUnsnoozeRegistration; the handler accepts only service-scoped case.unsnooze leases, and PostgreSQL rechecks revision, state, resume target, and the database-clock deadline under lock before persisting the immutable event and receipt. Managed startup and readiness require both the queue and a worker that advertises this handler whenever support.case-lifecycle is enabled. Audited exports at /support/admin/exports freeze redacted or separately authorized sensitive case projections, stream formula-safe BOM-prefixed UTF-8 CSV through a durable worker whose current job lease and rollout are rechecked, bind content-computed digest/byte evidence and completion or permanent failure to an exact immutable receipt, and load the workspace revision fence from server authority. Completed exports expose only artifact availability. The independent support.export-downloads path issues a five-minute, actor-bound, hash-only token for an exact encrypted artifact version; live permissions are rechecked, downloads are proxied without server buffering, browser-native file sinks apply backpressure, and the compatibility fallback is capped at 32 MiB. Completed, aborted, or failed streams settle immutable evidence. A fenced cleanup worker deletes expired exact versions and records storage tombstones plus semantic deletion outbox evidence. A shipped managed worker/object-store deployment, retry-exhaustion and cancellation soak, production owner adapters, browser RTL/assistive-technology E2E, manual accessibility, restore/soak, and canaries remain unqualified.

SLO and incident administration is independently gated by support.slo-incident-response. The protected operations API exposes profile configuration, fixed-watermark assessment and incident history, declaration, and legal lifecycle actions through the typed client. The shared en/fr/es operator surface at /support/admin/operations preserves pagination watermarks, recovers revision conflicts from fresh projections, and never exposes protected plan, destination, workload-grant, or provider evidence. PostgreSQL and the managed worker retain authority for qualification, alert reservation and delivery, semantic-event publication, rollout receipts, and revocation. Real provider credentials, dashboards, drills, authenticated browser/RTL/assistive- technology journeys, manual accessibility, load/soak, and production canaries remain qualification gates.

Deterministic living-SOP generation now has a reusable server composition at @lssm-tech/module.customer-support/server/sop-generation-inputs. It requires the host's canonical authenticated SupportAuthorityScope, including assurance and authority evidence, while the generation intent carries no tenant, workspace, actor, policy, or capability authority. Contributor-based sources support capability, integration, operation, policy, health, Knowledge, incident, and case evidence without making every category mandatory. The runtime copies only declared semantics, applies strict kind-specific age and validity ceilings, resolves operation aliases to canonical registered revisions, and returns a content-addressed source snapshot that the host must persist for replay. Delivery-matrix state is documentation provenance only and never decides runtime availability. Raw contact-shaped identity/evidence references, reserved derived facts, conflicting health authority, duplicate source identities, stale or future observations, excessive validity, malformed sources, and missing requested health fail closed. Only explicitly requested health enters the snapshot; Knowledge, incident, and case references remain typed generation evidence. Managed source providers, snapshot persistence, protected service transport, outage soak, and production canaries remain unqualified.

Customer sessions and consent are independently gated by support.customer-sessions. Authenticated hosts issue opaque public-access tokens for exact HTTPS origins; the public SDK exchanges them for 30-minute, memory-only sessions and rotates them with revision fencing. PostgreSQL stores only token hashes and daily rotating abuse identifiers. Purpose-specific grant and withdrawal receipts bind the exact policy, localized notice digest, and immutable evidence without storing IP addresses, messages, answers, or contact data. The reusable consent surface ships in English, French, and Spanish, and authenticated upgrade derives principal and workspace authority from AuthOS. Managed secret/KMS rotation, real AuthOS revocation and assurance, production rate-limit and PostgreSQL contention, browser RTL/assistive-technology E2E, restore drills, host canaries, and manual accessibility remain qualification gates.

The lifecycle behind SupportCustomerSessionHttpPort and SupportCustomerLiveChatHttpPort is module-owned: ./customer-session-service (createSupportCustomerSessionService: public access issued with revision-bound token versions, create/rotate with the 30-minute TTL, consent recorded only against active host notices, same-workspace assured upgrade, revoke) composes ./customer-live-chat-service (feature gating on support.messenger + support.live-chat-continuity, conversation binding, per-binding grant cache and grant/binding invariant checks). Hosts implement ./customer-session-security-port (the token codec; supportos-api keeps its HMAC implementation and secret) and ./customer-live-chat-transport-port (the CommunicationOS grant/message transport).

Cryptographic rotation is independently gated by support.crypto-rotation. Strict additive contracts bind plans to server-derived scope, key purpose, data class, active version, region, and Connect evidence. PostgreSQL migration 0029_supportos_crypto_rotation separates immutable plan/event evidence from revision- and fencing-token-guarded progress and schedules the first opaque crypto.reencrypt job atomically. Continuations use stable effect identities; the worker requires both crypto-execution and job-execution grants, advances through a constrained database function rather than table writes, and is bound to an expiring, revocable, reissuable database-principal grant. It emits a typed lifecycle outbox event, rejects non-progressing adapters, and enforces host-configured record and revision ceilings; the protected API returns a redacted projection without tenant or workspace authority. The additive 0056_supportos_crypto_rotation_drills migration now adds body-free drills for data-protection, lookup-HMAC, signing, webhook, service-secret, OAuth, and provider-credential targets. Each drill uses exact AuthOS-bound authorization, database leases and fencing, successor validation, rollback and restored validation, immutable dead-letter evidence, strict managed target/readiness adapters, and an English/French/Spanish administration route at /support/settings/crypto-rotation. Deployable KMS/keyring and target stores, their real credentials and revocation, supported-PostgreSQL contention and restore, manual security/accessibility review, and production canaries remain explicit blockers.

The locally executable saga is deliberately restricted to data-protection keys. Lookup-HMAC reindexing, signing-key trust overlap, and provider-secret rotation require separate purpose-specific strategies. Progress advancement is worker-internal and is not exposed by the protected HTTP API or typed client.

Billing entitlements are independently gated by support.billing-entitlements. V57 stores only Billing-minted account, plan, grant, quota, usage-watermark, decision, and evidence references under forced RLS. Snapshot refresh and decisions use exact short-lived AuthOS grants, live membership and rollout checks, revision fencing, immutable receipts, stable pagination, and revocation-safe replay. The protected API, typed client, neutral entitlement adapter, and English/French/Spanish administration route never expose invoice, payment, provider-body, credential, or secret material. A deployable BillingOS support authority, real credentials/connectors, retention/erasure, supported-PostgreSQL qualification, browser accessibility, and production canaries remain explicit blockers.

CompanyOS governed actions are independently gated by support.company-actions. V58 stores only opaque plan, case, target, protected payload, policy, Connect, Workflow, and evidence references under forced RLS. CompanyOS supplies a minimized expiring evidence projection; exact short-lived AuthOS grants bind the action plan and digest before Connect decides and Workflow starts or verifies an outcome. Compensation uses a separately pinned Workflow revision. Canonical digests, plan/revision effect claims, and repeated local case-revision checks prevent reordered inputs, alternate retry keys, or a stale case from reaching Workflow. Illegal state transitions, expanded projections, changed retries, stale receipts, and cross-workspace reads fail closed. The protected API, typed client, and English/French/Spanish administration route at /support/settings/company-actions never accept amounts, customer bodies, provider payloads, or direct effect execution. Deployable CompanyOS, Connect, and Workflow authorities, real credentials/revocation, evidence retention and erasure, supported-PostgreSQL qualification, browser accessibility, and production canaries remain explicit blockers.

Self-hosted adapters can now run the portable @lssm-tech/lib.customer-support-conformance core profile. The verifier creates fresh authorities per case and checks registry discovery, exact replay, changed-input conflicts, cross-tenant isolation, optimistic fencing, and bounded lists. Receipts are digest-bound and retain failures; passing fixture evidence does not claim live PostgreSQL, upgrade, restore, or production qualification.

The standalone @lssm-tech/app.supportos-web product mounts this module at /support only after exchanging the current AuthOS browser session for a short-lived SupportOS-audience grant with support.case.read. The grant stays in memory and refreshes through the bounded, single-flight exchange path. Its installable PWA caches only the static shell and offline route: API responses, cases, conversations, profiles, attachments, grants, and mutations are never cached. Product chrome is available in English, French, and Spanish. Real issuer/JWKS rotation and revocation, authenticated browser/RTL/assistive- technology journeys, installability, Core Web Vitals, deployment, and canaries remain qualification gates.

The standalone /support/onboarding route composes the same bounded exchange with the narrower support.workspace.onboard bootstrap capability. Both the authority and workspace-onboarding flags must be present before the route exists, and the resulting in-memory grant is forwarded only to the governed atomic onboarding operation.

Attachment safety is independently gated by support.attachment-safety and uses strict protected registration, keyset-list, and governed-release routes. The typed client keeps case and attachment authority in encoded paths and stable retry identities in headers. SupportOS stores and returns only opaque CommunicationOS, consent, scanner-policy, scanner-evidence, and Connect decision references—never bytes, names, media types, storage locations, or file content. Managed composition now uses exact short-lived AuthOS grants, HTTPS-only evidence exchange, bounded dependency calls, and capability-aware readiness. A shared redacted en/fr/es scan-status panel is independently gated across standalone SupportOS, CompanyOS, Pactena, hCircle web, desktop, and mobile. The native surface is deliberately status-only: it receives no bytes or evidence authority and uses the same authority-plus-capability flag conjunction. Real scanner credentials and revocation, customer upload-to-register orchestration, governed release UX, malware-corpus/outage qualification, browser/RTL/manual accessibility, and production canaries remain explicit blockers.

Customer context uses canonical strict v2 service-profile contracts with an explicit v1 query lookup. The protected API returns only a redacted projection: party references, entitlements, segments, available field keys, consent purposes, revision, and update time. Field values are encrypted behind the data-protection port and never enter the browser projection, immutable event, outbox payload, or CompanyOS verification call. Standalone SupportOS, CompanyOS, Pactena, hCircle web, desktop, and mobile mount the same en/fr/es redacted context behind support.service-profiles. The native projection omits party and profile authority. Production CompanyOS source verification, managed KMS rotation, device/browser/RTL/manual accessibility, contention, load, and canaries remain open.

Identity resolution is independently gated by support.identity-resolution. The protected API accepts opaque CommunicationOS/AuthOS identity references, never raw contact values or caller-computed hashes, and returns only redacted candidates and reversible merge projections. The managed bridge requires an exact, short-lived AuthOS grant and scope/resource/digest echo; startup and readiness fail closed when the capability lacks its identity authority. The same en/fr/es operator review flow is mounted in standalone SupportOS, CompanyOS, Pactena, hCircle web, desktop, and mobile. It never auto-merges and requires selected candidates, a target profile, and a Connect decision. Production credentials and revocation, KMS dual-key rotation/reindex, real PostgreSQL contention/RLS/restore, device/browser/RTL/manual accessibility, load/soak, rollback, and canaries remain explicit gates.

SupportOS search and saved views expose a protected, independently gated API backed by the shared authority port. Search returns only redacted operational case projections using database-issued watermarks and opaque keyset cursors. Saved views are owner-private or workspace-visible, revision-fenced, and use stable caller retry identities. The independently gated tri-pane operator surface is mounted in standalone SupportOS, CompanyOS, Pactena, and hCircle web, desktop, and mobile. It provides localized keyword, status, and priority search, deterministic reset, server-authorized private/workspace saved-view create/update/apply/archive controls, redacted result rows, and explicit loading/empty/error/success states. The public v2 projection exposes canMutate without returning the owner reference, and ambiguous save/archive retries retain the same operation identity. A deployed SupportOS host, native queue/assignee/tag filter editors, browser/device/manual accessibility, relevance/load qualification, and production canaries remain explicit blockers.

The operator case queue state is shared by web and native through ./ui/useSupportCaseQueue (useSupportCaseQueue). It is pure React with no DOM or React Native imports, so the native app imports it directly. Every list or search result carries a request id and only the newest request may apply its items; selection is reconciled with reconcileQueueSelection (the current case stays selected while it is still listed) and onSelectionChanged lets the host drop detail state for the previous case. SupportManagementWorkspace and the hCircle mobile support section both use it.

The web queue now adds a presentation-only keyboard command layer above the server-authorized ordering. Visible Previous, Next, and localized shortcut-help controls ship in English, French, and Spanish; J and K move one bounded row, focus the selected queue item, and never wrap or mutate case authority. Commands are suppressed while editing, inside dialogs, and with platform modifiers. Protected saved views remain the persistence owner. Governed collision-aware bulk planning, multi-selection evidence, a command palette, native parity, authenticated browser/RTL/screen-reader qualification, manual accessibility, and production canaries remain open.

SLA policy administration is available at /support/settings/slas behind the independent support.sla-admin flag. The en/fr/es surface uses plain-language minute/hour targets, reads current revisions, preserves retry identity after an ambiguous save, and never exposes tenant, workspace, or evidence authority. Target-bound v3 clock persistence and protected transport, database-time due scanning, collision-resistant durable-job scheduling, atomic case breach and immutable escalation evidence, and pinned Workflow/SOP handler primitives are implemented locally. A reusable worker registration now scans every server-assigned workspace before claims and binds the sla.clock handler. They remain disabled until the managed deployment supplies authorized scope discovery, worker readiness and an approved business-hours adapter; production crash/contention/soak and canary evidence remain qualification gates.

CSAT uses a strict canonical v2 contract with a pinned v1 compatibility lookup. The protected record path accepts only score, locale/channel, and opaque Forms definition/response/revision/stable-question references; an injected Forms authority must return an exact, fresh evidence receipt before immutable persistence. Reports use fixed watermarks and expose score aggregates without answers, comments, contact data, or evidence references. The en/fr/es report route is independently gated by support.csat. Managed Forms composition, customer handoff, exports, browser and manual accessibility, real contention, and canaries remain open.

Tags and custom fields now use strict localized definition contracts and a separate support.metadata rollout flag. Case replacements fence the current case revision, encrypt canonical values through the injected data-protection port, and keep plaintext out of events, audit rows, outbox payloads, and replay receipts. Definition and case APIs derive workspace authority from the session; the typed client preserves retry identity in headers. The en/fr/es settings surface is available at /support/settings/fields. CompanyOS also enables the case-level tri-pane editor: independent definition and case reads load in parallel, required values are validated before save, ambiguous retries retain the exact request, and the returned live case revision fences the next operator mutation. Pactena and hCircle web, desktop, and mobile now forward the same independently gated metadata capability into their shared operator workspace. Managed KMS qualification, definition edit/archive UX, localized option-label authoring, exports, real PostgreSQL contention, device/browser/manual accessibility, and canaries remain open.

The typed SupportOS client covers protected case creation, optimistic lifecycle transitions, atomic merge/split/link relations, list, detail, and CommunicationOS-owned replies. Transition and relation calls accept caller-persisted idempotency keys so ambiguous network failures can replay the exact mutation. Relation calls fence both case revisions and return both redacted projections. Per-call idempotency headers are merged with host authentication headers instead of being replaced by them.

The tri-pane context inspector now provides a localized merge/split/link review flow. It refreshes both case revisions immediately before confirmation, shows human-readable case numbers and subjects, keeps one retry identity for ambiguous outcomes, updates both inbox projections after success, and drops stale review responses when the operator changes cases. It never renders relation, evidence, tenant, workspace, or CommunicationOS content references. Browser keyboard and screen-reader E2E, real contention rehearsal, and production canaries remain explicit qualification gates.

hCircle mobile uses the same two-revision relation orchestration with an inline, localized kind/target review and confirmation. The native surface stays authority-gated and reconciles only the two redacted case projections. Device assistive-technology and RTL E2E remain qualification gates.

The tri-pane inbox exposes only lifecycle transitions allowed by the canonical transition graph. It fences the current case revision, preserves the same operation identity across retry, announces failures, and retains host-redacted requester and subject labels after the mutation. Late detail responses and late transition detail revisions are ignored for a newly selected case, while the completed case still reconciles in the inbox. Controls and status copy ship in English, French, and Spanish.

Case assignment uses the canonical v2 claim, release, assign, and steal contract. The operator surface exposes only authenticated self-claim and self-release; administrator assignment and evidence-bound steal remain protected API actions. Opaque assignee references are reduced to a current-operator-safe state before rendering. The optional presence lane uses server-owned expiry, monotonic opaque browser sessions, and count-only projections to surface concurrent operators without exposing their identities. Managed enablement fails closed until a distributed adapter is configured; cross-replica fan-out, reconnect soak, production contention, and canaries remain open.

Notifications are independently gated by support.notifications. The protected API and typed client cover preference upsert/list, body-free intent enqueue, and immutable delivery evidence with strict output validation, stable retry keys, keyset watermarks, and server-derived scope. Managed composition requires exact HTTPS policy and CommunicationOS delivery evidence adapters plus a worker advertising notification.deliver and a live queue before the flag can start. Real channel credentials, historical queued-intent migration, preference and customer surfaces, non-standalone product-host routing, browser accessibility, provider soak, and canaries remain explicit blockers. The reusable operator settings surface follows the active DESIGN.md contract: it edits only provisioned topic/channel rows, localizes en/fr/es chrome, exposes loading/empty/error/saved states, and retains the same retry identity after an ambiguous update without rendering contact or evidence data. The standalone /support/settings/notifications host uses a server-derived current-operator API alias; browser query parameters cannot substitute another party reference.

Team and queue administration uses canonical strict v2 contracts with explicit v1 lookup, revision and idempotency fencing, stable-watermark lists, and a separate support.routing-admin rollout flag. The /support/settings/routing/queues surface ships en/fr/es design-system controls. Capacity policy, AuthOS member synchronization, real contention, browser accessibility, load, and canaries remain explicit qualification blockers.

The adjacent skills-routing authority now persists revision-fenced policies and derives candidates from active teams, live workspace memberships, assignment load, and bounded capacity overrides. Protected policy and simulation endpoints freeze input digests, candidate watermarks, traces, audit receipts, and outbox evidence. The independently flagged en/fr/es simulator never executes assignment effects. Optional routed assign/steal mutations atomically consume one immutable decision after revalidating the case, assignee, active membership and team, target queue, current policy revision, and live capacity. In-memory authorities fail closed for routed mutations. Realtime availability recovery, AuthOS synchronization, real contention, property/load tests, browser and manual accessibility, and canaries remain open before automatic routing is enabled.

Hosts may pass the existing Personalization SupportSurfaceProjection. The workspace applies density and context-panel visibility, exposes bounded guidance, pace, and tone data hooks, and shows a localized explanation with a required reset control. This projection is strictly presentation-only: it cannot alter queue priority, access, SLAs, escalation, entitlements, refunds, or customer scoring. Persisted preferences, behavior signals, host profile composition, and production qualification remain open.

Workspace topology migration is exposed through typed preview, get, start, advance, and rollback calls. Scope remains path/server derived, while callers persist the operation idempotency key across ambiguous retries. The API validates contract outputs before returning them and fails closed when the migration authority is not composed. Both support.authority and the independent support.workspace-migration flag must be enabled for migration routes.

POST /workspaces/onboard is intentionally resolved before ordinary workspace-membership authorization. It requires a server-verified bootstrap scope, both support.authority and support.workspace-onboarding, a retry-stable idempotency header, and the typed onboarding body. Tenant, workspace, and founding-principal authority are never accepted over HTTP. The typed client preserves the retry identity outside the body. The reusable en/fr/es onboarding surface at /support/onboarding shows the isolated topology and EU residency before creation, uses only design-system primitives, and never renders tenant, workspace, principal, or Connect authority identifiers. Hosts must inject resolveRequestHeaders from their AuthOS browser-grant bridge; the surface does not infer authority from cookies or request bodies.

Case lists use the shared bounded SupportOS keyset cursor contract in memory and PostgreSQL. Invalid cursor input fails with the stable validation envelope; it is never classified as an infrastructure outage.

Host routes are /support for Pactena, /companyos/support for CompanyOS, and /communications/support for hCircle/CommunicationOS. Product shells supply auth, scope, branding, locale, authority mode, and capability grants through SupportHostAdapter.

Internal-note composition is a governed cross-service workflow. SupportOS first persists a body-free Connect decision and reconciliation intent, then forwards the transient body under an exact tenant/workspace/case/intent/delivery AuthOS grant. CommunicationOS encrypts the note, emits redacted immutable evidence and a durable outbox delivery, and the SupportOS reconciliation endpoint attaches that evidence idempotently. The legacy caller-supplied reference attachment route is disabled. Composer, evidence reads, and reconciliation require their full independent flag conjunction; readiness also requires a live CommunicationOS recovery worker. The en/fr/es workspace panel exposes pending, review, failure, and retry states without returning note content from SupportOS. Real AuthOS/Connect credentials, host browser E2E, multi-connection PostgreSQL contention, outage/DLQ soak, online key re-encryption, manual accessibility, and production canaries remain explicit qualification blockers.

Runtime feature checks are mandatory dependencies of the embed SDK, native model factory, and portfolio loader. Disabled flags fail before transport, projection, or customer-support work begins; the host must inject its scoped SupportFeatureFlagPort.

OPA profile and booking handoffs use a consent-bound, retry-safe SupportOS contract while OPA retains destination and booking authority. The protected API accepts only an opaque destination reference and minimized context references; tenant, workspace, actor, owner scope, public token, and URL are never browser authority. A host-injected resolver returns a verified public HTTPS destination, and the reusable card supports a classical new-tab journey or an injected inline widget. Return mutations require exact handoff and delivery grant bindings and store only redacted OPA evidence. Managed OPA adapter composition, durable PostgreSQL persistence, verified embed callbacks, browser qualification, and production canaries remain explicit blockers.

Capability and qualification truth

@lssm-tech/module.customer-support/capability-matrix exports the canonical SupportOS v1 delivery matrix. It covers 11 modules, 115 capability nodes, and 113 feature/subfeature leaves with owners, milestones, routes, operations, flags, source paths, dependencies, proof requirements, evidence, blockers, acceptance criteria, and next actions.

import {
  summarizeSupportCapabilityMatrix,
  supportOsV1CapabilityMatrix,
} from '@lssm-tech/module.customer-support/capability-matrix';

const summary = summarizeSupportCapabilityMatrix(
  supportOsV1CapabilityMatrix,
);

Delivery stage and blocker state are deliberately separate. Local integration does not imply production readiness. A capability may be marked qualified only after every required proof layer is verified and every blocker is resolved. Source files and test definitions never count as executed QA receipts. Proof profiles are derived from intrinsic module and exposure semantics, timestamps are parsed, newer failures supersede older passes, and blocker resolutions must link a valid verified receipt. Failed evidence remains visible on missing work. Nested evidence/blocker identities must be unique and malformed declarations fail validation. The same catalog is projected into the Managed CompanyOS product-health ledger with canonical qualification state, so it cannot report a blocked or unpromoted SupportOS feature as live.

See docs/supportos-v1-capability-matrix.md^† for the current gaps and qualification sequence.