{"id":"@lssm-tech/module.lssm-os-control-plane","slug":"module.lssm-os-control-plane","name":"@lssm-tech/module.lssm-os-control-plane","version":"2.1.5","path":"packages/domains/builder/control-plane","manifestPath":"packages/domains/builder/control-plane/package.json","manifestBlobSha":"e7d664a524dc32b175c4462c6607509fe46962e2","layer":"domains","physicalArea":"builder","primaryArea":"delivery-and-infrastructure","classification":{"privateDeclared":null,"catalogFamily":"solutions","catalogKind":"module","catalogStatus":"active","adoptionMode":"adoptable","stability":"experimental"},"description":"Tenant-safe application services and scheduling for the LSSM OS control plane.","descriptionOrigin":"package.json","catalog":{"family":"solutions","kind":"module","status":"active","adoptionMode":"adoptable","stability":"experimental","platforms":["web","server"],"runtimes":["bun","node","browser"],"entrypoints":[".","./application","./builder-candidate-local","./builder-handoff","./in-memory","./ports","./runtime-node-worker","./types","./worker"],"documentation":[{"title":"Module Lssm Os Control Plane documentation","url":"https://www.npmjs.com/package/%40lssm-tech%2Fmodule.lssm-os-control-plane","kind":"readme"}],"examples":[],"replacements":[],"capabilities":[{"id":"package.lssm.tech.module.lssm.os.control.plane","title":"Module Lssm Os Control Plane","description":"Tenant-safe application services and scheduling for the LSSM OS control plane.","status":"active","useCases":["Adopt tenant-safe application services and scheduling for the lssm os control plane"],"aliases":["module","lssm","control","plane"],"pythonEquivalents":[],"canonicalImports":[{"from":"@lssm-tech/module.lssm-os-control-plane","symbols":[]},{"from":"@lssm-tech/module.lssm-os-control-plane/application","symbols":[]},{"from":"@lssm-tech/module.lssm-os-control-plane/builder-candidate-local","symbols":[]},{"from":"@lssm-tech/module.lssm-os-control-plane/builder-handoff","symbols":[]},{"from":"@lssm-tech/module.lssm-os-control-plane/in-memory","symbols":[]},{"from":"@lssm-tech/module.lssm-os-control-plane/ports","symbols":[]},{"from":"@lssm-tech/module.lssm-os-control-plane/runtime-node-worker","symbols":[]},{"from":"@lssm-tech/module.lssm-os-control-plane/types","symbols":[]},{"from":"@lssm-tech/module.lssm-os-control-plane/worker","symbols":[]}],"constraints":{"platforms":["web","server"],"runtimes":["bun","node","browser"],"avoidWhen":["The @lssm-tech/module.lssm-os-control-plane package constraints do not match the target runtime or platform."],"requires":["TypeScript"]},"alternatives":[],"relationships":[],"resolutionPriority":50}]},"canonicalImports":[{"capabilityId":"package.lssm.tech.module.lssm.os.control.plane","from":"@lssm-tech/module.lssm-os-control-plane","symbols":[]},{"capabilityId":"package.lssm.tech.module.lssm.os.control.plane","from":"@lssm-tech/module.lssm-os-control-plane/application","symbols":[]},{"capabilityId":"package.lssm.tech.module.lssm.os.control.plane","from":"@lssm-tech/module.lssm-os-control-plane/builder-candidate-local","symbols":[]},{"capabilityId":"package.lssm.tech.module.lssm.os.control.plane","from":"@lssm-tech/module.lssm-os-control-plane/builder-handoff","symbols":[]},{"capabilityId":"package.lssm.tech.module.lssm.os.control.plane","from":"@lssm-tech/module.lssm-os-control-plane/in-memory","symbols":[]},{"capabilityId":"package.lssm.tech.module.lssm.os.control.plane","from":"@lssm-tech/module.lssm-os-control-plane/ports","symbols":[]},{"capabilityId":"package.lssm.tech.module.lssm.os.control.plane","from":"@lssm-tech/module.lssm-os-control-plane/runtime-node-worker","symbols":[]},{"capabilityId":"package.lssm.tech.module.lssm.os.control.plane","from":"@lssm-tech/module.lssm-os-control-plane/types","symbols":[]},{"capabilityId":"package.lssm.tech.module.lssm.os.control.plane","from":"@lssm-tech/module.lssm-os-control-plane/worker","symbols":[]}],"scripts":{"publish:pkg":"bun publish --tolerate-republish --ignore-scripts --verbose","publish:pkg:canary":"bun publish:pkg --tag canary","build":"bun run clean && bun run build:bundle && bun run build:types","build:bundle":"contractspec-bun-build transpile","build:types":"contractspec-bun-build types","clean":"rimraf dist .turbo","lint":"bun run lint:fix","lint:fix":"node ../../../../scripts/biome.cjs check --write .","lint:check":"node ../../../../scripts/biome.cjs check .","pack:verify":"bun run build && node ./scripts/verify-pack.mjs","test":"bun test","typecheck":"tsgo --noEmit"},"scriptStatus":"complete pinned manifest","dependencies":{"@lssm-tech/lib.builder-spec":"workspace:^","@lssm-tech/lib.contracts-spec-core":"workspace:^","@lssm-tech/lib.crypto-utils":"workspace:^","@lssm-tech/lib.lssm-os-runtime":"workspace:^","@lssm-tech/lib.lssm-os-spec":"workspace:^","@lssm-tech/lib.orchestration-spec":"workspace:^","@lssm-tech/lib.schema":"workspace:^","zod":"catalog:","@lssm-tech/lib.builder-runtime":"workspace:^","@lssm-tech/lib.contractspec-connect":"workspace:^"},"devDependencies":{"@lssm-tech/tool.bun":"workspace:*","@lssm-tech/tool.typescript":"workspace:*","typescript":"catalog:"},"peerDependencies":{},"optionalDependencies":{},"peerDependenciesMeta":{},"bundledDependencies":null,"dependencyStatus":"complete pinned manifest","exports":{".":"./src/index.ts","./application":"./src/application.ts","./builder-handoff":"./src/builder-handoff.ts","./in-memory":"./src/in-memory.ts","./ports":"./src/ports.ts","./runtime-node-worker":"./src/runtime-node-worker.ts","./topology":"./src/topology-controller.ts","./types":"./src/types.ts","./worker":"./src/worker.ts","./builder-claimed-payload":"./src/builder-claimed-payload.ts","./builder-candidate-local":"./src/builder-candidate-local.ts"},"publishExports":{".":{"types":"./dist/index.d.ts","browser":"./dist/browser/index.js","bun":"./dist/index.js","node":"./dist/node/index.js","default":"./dist/index.js"},"./application":{"types":"./dist/application.d.ts","browser":"./dist/browser/application.js","bun":"./dist/application.js","node":"./dist/node/application.js","default":"./dist/application.js"},"./builder-handoff":{"types":"./dist/builder-handoff.d.ts","browser":"./dist/browser/builder-handoff.js","bun":"./dist/builder-handoff.js","node":"./dist/node/builder-handoff.js","default":"./dist/builder-handoff.js"},"./in-memory":{"types":"./dist/in-memory.d.ts","browser":"./dist/browser/in-memory.js","bun":"./dist/in-memory.js","node":"./dist/node/in-memory.js","default":"./dist/in-memory.js"},"./ports":{"types":"./dist/ports.d.ts","browser":"./dist/browser/ports.js","bun":"./dist/ports.js","node":"./dist/node/ports.js","default":"./dist/ports.js"},"./runtime-node-worker":{"types":"./dist/runtime-node-worker.d.ts","browser":"./dist/browser/runtime-node-worker.js","bun":"./dist/runtime-node-worker.js","node":"./dist/node/runtime-node-worker.js","default":"./dist/runtime-node-worker.js"},"./topology":{"types":"./dist/topology-controller.d.ts","browser":"./dist/browser/topology-controller.js","bun":"./dist/topology-controller.js","node":"./dist/node/topology-controller.js","default":"./dist/topology-controller.js"},"./types":{"types":"./dist/types.d.ts","browser":"./dist/browser/types.js","bun":"./dist/types.js","node":"./dist/node/types.js","default":"./dist/types.js"},"./worker":{"types":"./dist/worker.d.ts","browser":"./dist/browser/worker.js","bun":"./dist/worker.js","node":"./dist/node/worker.js","default":"./dist/worker.js"},"./builder-claimed-payload":{"types":"./dist/builder-claimed-payload.d.ts","browser":"./dist/browser/builder-claimed-payload.js","bun":"./dist/builder-claimed-payload.js","node":"./dist/node/builder-claimed-payload.js","default":"./dist/builder-claimed-payload.js"},"./builder-candidate-local":{"types":"./dist/builder-candidate-local.d.ts","browser":"./dist/browser/builder-candidate-local.js","bun":"./dist/builder-candidate-local.js","node":"./dist/node/builder-candidate-local.js","default":"./dist/builder-candidate-local.js"}},"types":"./dist/index.d.ts","files":["dist","README.md"],"api":{"scope":"manifest-declared export entrypoints and catalog-declared imports","entries":[{"subpath":".","importPath":"@lssm-tech/module.lssm-os-control-plane","target":"./src/index.ts","targets":[{"conditions":[],"target":"./src/index.ts","sourcePath":"packages/domains/builder/control-plane/src/index.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/builder/control-plane/src/index.ts","sourceStatus":"verified source file"}]},{"subpath":"./application","importPath":"@lssm-tech/module.lssm-os-control-plane/application","target":"./src/application.ts","targets":[{"conditions":[],"target":"./src/application.ts","sourcePath":"packages/domains/builder/control-plane/src/application.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/builder/control-plane/src/application.ts","sourceStatus":"verified source file"}]},{"subpath":"./builder-handoff","importPath":"@lssm-tech/module.lssm-os-control-plane/builder-handoff","target":"./src/builder-handoff.ts","targets":[{"conditions":[],"target":"./src/builder-handoff.ts","sourcePath":"packages/domains/builder/control-plane/src/builder-handoff.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/builder/control-plane/src/builder-handoff.ts","sourceStatus":"verified source file"}]},{"subpath":"./in-memory","importPath":"@lssm-tech/module.lssm-os-control-plane/in-memory","target":"./src/in-memory.ts","targets":[{"conditions":[],"target":"./src/in-memory.ts","sourcePath":"packages/domains/builder/control-plane/src/in-memory.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/builder/control-plane/src/in-memory.ts","sourceStatus":"verified source file"}]},{"subpath":"./ports","importPath":"@lssm-tech/module.lssm-os-control-plane/ports","target":"./src/ports.ts","targets":[{"conditions":[],"target":"./src/ports.ts","sourcePath":"packages/domains/builder/control-plane/src/ports.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/builder/control-plane/src/ports.ts","sourceStatus":"verified source file"}]},{"subpath":"./runtime-node-worker","importPath":"@lssm-tech/module.lssm-os-control-plane/runtime-node-worker","target":"./src/runtime-node-worker.ts","targets":[{"conditions":[],"target":"./src/runtime-node-worker.ts","sourcePath":"packages/domains/builder/control-plane/src/runtime-node-worker.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/builder/control-plane/src/runtime-node-worker.ts","sourceStatus":"verified source file"}]},{"subpath":"./topology","importPath":"@lssm-tech/module.lssm-os-control-plane/topology","target":"./src/topology-controller.ts","targets":[{"conditions":[],"target":"./src/topology-controller.ts","sourcePath":"packages/domains/builder/control-plane/src/topology-controller.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/builder/control-plane/src/topology-controller.ts","sourceStatus":"verified source file"}]},{"subpath":"./types","importPath":"@lssm-tech/module.lssm-os-control-plane/types","target":"./src/types.ts","targets":[{"conditions":[],"target":"./src/types.ts","sourcePath":"packages/domains/builder/control-plane/src/types.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/builder/control-plane/src/types.ts","sourceStatus":"verified source file"}]},{"subpath":"./worker","importPath":"@lssm-tech/module.lssm-os-control-plane/worker","target":"./src/worker.ts","targets":[{"conditions":[],"target":"./src/worker.ts","sourcePath":"packages/domains/builder/control-plane/src/worker.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/builder/control-plane/src/worker.ts","sourceStatus":"verified source file"}]},{"subpath":"./builder-claimed-payload","importPath":"@lssm-tech/module.lssm-os-control-plane/builder-claimed-payload","target":"./src/builder-claimed-payload.ts","targets":[{"conditions":[],"target":"./src/builder-claimed-payload.ts","sourcePath":"packages/domains/builder/control-plane/src/builder-claimed-payload.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/builder/control-plane/src/builder-claimed-payload.ts","sourceStatus":"verified source file"}]},{"subpath":"./builder-candidate-local","importPath":"@lssm-tech/module.lssm-os-control-plane/builder-candidate-local","target":"./src/builder-candidate-local.ts","targets":[{"conditions":[],"target":"./src/builder-candidate-local.ts","sourcePath":"packages/domains/builder/control-plane/src/builder-candidate-local.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/builder/control-plane/src/builder-candidate-local.ts","sourceStatus":"verified source file"}]}],"entryCount":11,"namedSymbolCoverage":"catalog declarations only; exhaustive TypeScript symbols not extracted","installationStatus":"not verified"},"docsLinks":[{"title":"Module Lssm Os Control Plane documentation","url":"https://www.npmjs.com/package/%40lssm-tech%2Fmodule.lssm-os-control-plane","kind":"readme","pinnedUrl":null,"sourceStatus":"declared link; destination not verified"}],"sourceUrls":{"package":"https://github.com/lssm-tech/contractspec/tree/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/builder/control-plane","manifest":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/builder/control-plane/package.json","readme":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/builder/control-plane/README.md","guide":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/module.lssm-os-control-plane.txt"},"readme":{"status":"available","body":"# `@lssm-tech/module.lssm-os-control-plane`\n\nApplication-service composition for the LSSM OS control plane.\n\nIt coordinates validation, plan compilation, Connect authorization requests,\nexact-digest apply, work-order scheduling, tenant-safe status projections,\nBuilder handoff receipts, drift, and replay through injected ports. The module\ndoes not own policy authority, provider credentials, or provider SDKs.\n\n## Public entrypoints\n\n- `@lssm-tech/module.lssm-os-control-plane`\n- `@lssm-tech/module.lssm-os-control-plane/application`\n- `@lssm-tech/module.lssm-os-control-plane/worker`\n- `@lssm-tech/module.lssm-os-control-plane/builder-handoff`\n- `@lssm-tech/module.lssm-os-control-plane/ports`\n- `@lssm-tech/module.lssm-os-control-plane/in-memory`\n- `@lssm-tech/module.lssm-os-control-plane/runtime-node-worker`\n- `@lssm-tech/module.lssm-os-control-plane/topology`\n- `@lssm-tech/module.lssm-os-control-plane/builder-candidate-local`\n\n## Workspace and published resolution\n\nDevelopment exports resolve the exact public subpaths directly to TypeScript\nsource, so clean-checkout consumers can typecheck before dependency builds.\n`publishConfig.exports` retains the compiled Bun, Node, browser, and declaration\npaths. The pack verifier applies that projection only in disposable staging;\nnever copy the published export map into the workspace manifest.\n\n## Runtime Node V2 worker\n\n`LssmOsRuntimeNodeWorkerV2` composes the signed Runtime Node V2 contracts into\none fail-closed executable loop. It verifies the exact Connect-issued work\norder, delegates signed eligibility authority to the injected durable claim\nport, resumes only an exact ordered durable receipt prefix, routes each step to\nthe exact qualified provider binding, and completes from the authoritative\nreceipt/evidence set.\n\nEvery injected asynchronous operation shares one absolute monotonic deadline.\nProvider, receipt, or completion outcomes that cannot be proven are returned as\n`indeterminate`; the worker never fabricates a failed or successful terminal\nreceipt after an unresolved provider effect. Provider adapters, Connect\nverification, trusted time, durable work-order state, and durable receipt state\nremain injected ports. No provider SDK or credential material enters this\nmodule.\n\nThe V1 `LssmOsControlPlaneWorker` remains available unchanged. Adopters opt in\nto the V2 worker through the dedicated subpath and must provide the authoritative\nRuntime Node ports from `@lssm-tech/lib.lssm-os-runtime`.\n\n## Governed topology controller\n\n`LssmOsTopologyControllerV1` evaluates an exact active topology, signed scale\npolicy, and current capacity observation through injected ports. It initializes\nan observed transition durably, advances non-effect lifecycle evidence with\nexact-state CAS, requires fresh Connect and V3 operation verification before\ncreating `authorized` evidence, and delegates at most one observable step to\nRuntime Node V3. Generic callers cannot promote simulated state into an\nauthority-bearing state.\nRejected, blocked, indeterminate, and manual-custody evidence is admitted only\nwhen an injected verifier returns the exact closed receipt. Verifier denial,\nthrow, timeout, or substitution leaves durable topology state unchanged.\nThe controller never mints a Connect decision, work order, claim, fence, or\nprovider receipt. If an effect succeeds but its topology receipt cannot be\nconfirmed durably, the controller first CAS-transitions the exact V3 operation\ninto durable `indeterminate` custody with the receipt ref. Failure to obtain\nthat custody is reported separately and is never described as durable.\n\n`proposeScaleTransition` is the governed bridge from evaluation to transition\nadmission. It re-evaluates the active topology and observation, enforces the\nsigned replica, budget, quota, freeze, direction, and reversible-transition\nbounds, binds the exact decision and observation digests to a semantically valid\ntransition plan, and admits only one observed transition through the topology\nstate port. It does not authorize or execute the plan; those steps still require\nfresh Connect verification and Runtime Node V3 operation, claim, attempt, and\nfence authority.\n\n`createDeterministicScalePlannerV1` is the reference policy evaluator behind\nthat port. It owns dependency output graphs, accepts one exact stable and fresh\ncapacity window, applies hysteresis, cooldown, freeze mode, replica, provider\nquota, tenant concurrency, drain, backlog, and daily-cost bounds, and invokes\nan injected exact policy verifier before history or target resolution. It asks\nthe target resolver only for an already-qualified reversible topology\ndigest. A changing decision is recorded through an injected durable\n`recordIfLatest` history CAS before it is returned; concurrent controllers\neither receive that exact replay or fail closed. The planner does not provision,\nsign policy, mint Runtime Node authority, or treat a scale decision as execution\npermission.\n\n`recordObservedProfileTransition` additionally verifies the complete T0–T3\nrecipe before admission. Cache and broker promotion/removal must match the\nexact source and target topology profiles, preserve the authoritative SQL\ncomponent, tenant scope, residency, classification, and encryption policy, and\nchange only the declared cache or queue role. Same-kind vertical and horizontal\nplans retain this profile binding. This makes database-only fallback an exact\ngoverned recipe instead of an environment-driven transport switch.\n\nT0↔T1 moves use explicit `promote_state_backend` or `demote_state_backend`\nplans. Those plans must replace both the SQLite/in-process authority and queue\nroles with their PostgreSQL counterparts (or the exact reverse), preserve the\ndata policy and scope, and declare the full migration, drain, rollback, and\ndecommission lifecycle. Other transition classes continue to reject any\nauthority-store substitution.\n\n### Queue admission authority\n\nAuthorization and scheduling validate the exact externally verified decision,\nverdict, source-plan digest, tenant/workspace/environment, and current desired and\nobserved revisions before enqueueing. Time is read again after verification and\nstate reads, so expiry during those reads blocks admission. Authorization requests\nalso bind the returned decision to the requested actor. Workers retain their\nindependent pre-effect validation; queue admission does not replace execution\nfencing or atomic provider custody.\n\n### Reference work-order ownership\n\nThe in-memory queue snapshots admissions and returned records. Exact admission\nretries preserve the existing lifecycle; changed plan, authorization, execution,\nidempotency or retry-limit bindings are rejected. Scope tuples are encoded without\ndelimiter ambiguity. Completion/retry requires an active fenced claim, and exhausted\norders cannot be claimed again. This adapter remains a local reference, not a\npersistent production queue.\n\n### Legacy worker outcome custody\n\nThe legacy worker completes every explicit terminal executor result, including\nfailure. A thrown apply call or nonterminal return is recorded as indeterminate\nand is not automatically retried: an external effect may have occurred before an\nacknowledgement was lost. Resolve that evidence through the runtime reconciliation\npath before admitting new work. Queue completion errors propagate to the host.\n\n### Builder handoff interoperability\n\nHandoff verification reuses Builder's canonical payload digest, excluding the\nderived packet ID and digest field. Real Builder-produced packets can enter\nreview without translation. The original LSSM OS id-inclusive `sha256:` digest\nremains readable after exact recomputation for compatibility; new helper output\nuses Builder's format. Both paths require the expected digest and plan match.\nAcceptance remains plan-only and never grants apply authority.\n\nCanonical packet IDs are recomputed from the same payload before review acceptance,\nso changing only the packet ID cannot redirect an otherwise valid handoff.\n\nBuilder Runtime Node execution loads a digest-bound patch payload,\nmatches tenant/workspace/environment and delivery plan, and delegates to the\nexisting governed patch service only within the injected active-claim callback.\nIt does not mint work orders or permits. Runtime coordinator fencing and the\nprovider lifecycle receipt adapter remain required before live activation.\n\nThe apply-only Builder provider adapter keeps patch generation and\nreceipt persistence/verification within the active claim callback. Returned\nRuntime Node receipts must match the execution and reference the candidate ID,\npatch hash and head revision. Compensation/observation remain explicitly\nunqualified. Durable receipt storage and actual claim fencing remain host ports.\n\nBuilder Runtime Node receipt persistence now adapts the existing scoped\nRuntimeWorkOrderReceiptPort. It binds candidate ID/hash/head to the execution,\nrequires append plus readback, and returns the original receipt for an identical\nstep replay. A changed candidate under the same step is a conflict. Tests use a\nstore fixture; production SQL durability and active-claim integration still need\nqualification. Candidate creation success does not mean release approval.\n\nThe Builder receipt writer is tested against the existing file-backed SQLite\nRuntime Node order/receipt ports: the database is closed and reopened, identical\nreplay returns one receipt, changed candidates conflict, and cross-tenant lookup\nis empty. Authority-verifier callbacks remain test fixtures; this validates SQL\npersistence/replay, not production authority or distributed execution fencing.\n\nThe Builder provider checks for an existing exact-step receipt inside the active\nclaim before invoking patch generation. Verified replay returns that receipt\nwithout generating a second candidate. Read/verification failures stop execution;\nthey are not treated as an absent receipt. Payload and scope admission still run\nbefore replay. This relies on host claim fencing for concurrent execution safety.\n\nWorker retries receiving already_claimed can reconcile durable terminal receipts\nand finish an unconfirmed completion write, but cannot execute missing provider\nsteps. Those return active_claim_requires_reconciliation. This prevents duplicate\nactive worker effects; it does not prove that an expired executor has stopped.\n\nThe root barrel now exports `createBuilderRuntimeProvider`, its configuration\ntypes, `BuilderRuntimePatchPayload`, and `createBuilderRuntimeReceiptWriter`.\nThe existing active-claim coordinator and durable receipt contracts remain\nmandatory; additive discoverability does not supply production implementations.\n\n`createBuilderProviderReceipt` is an additive data-construction export shared by\nV2 and V3 receipt persistence. Its digest is not an authorization or proof of\nstorage. Hosts must use the appropriate durable authority owner and verify\npersisted readback before treating the constructed receipt as evidence.\n\n## Builder candidate host\n\n`BuilderCandidateHost` implements the existing Builder candidate service with\ncanonical operation state, Connect V3 issuance, restart-safe issued-order reads,\nand Durable Queue V2 admission. Configure current member/project resolution and\nimmutable profile/lifecycle material; browser request IDs are correlation only.\nPrepare records the accepted operation. Approve persists the signed standard and\ncleanup lifecycle with its budget reservations. Execute separately verifies\nadmission authority, advances the operation by CAS and admits the exact envelope.\nInterrupted queue admission can resume; it is not pristine co-atomic admission.\n\nSuccessful candidate output requires a digest-valid terminal receipt linked to\nthe persisted provider receipt and verified retained patch/bundle bytes. Queue\nstatus reads recheck exact admission evidence. Missing, stale, conflicting or\nunavailable evidence never becomes a successful candidate or release. Agent Host\nowns provider effects and stricter dispatch verification. Installation still\nrequires concrete durable stores, qualified profiles, signing keys and current\npolicy; there is no default authority or model.\n\nCandidate payloads may bind their reviewed Builder plan through `builderPlanRef`.\nThat signed payload field is checked against the Runtime Node plan digest while\nConnect plan-packet, delivery-plan and quality-plan references retain their own\nidentities. Legacy payloads without `builderPlanRef` retain the original delivery-\nplan digest check. Changing the new reference changes the signed payload digest;\nit cannot substitute another plan under an existing work order.\n\nBuilder provider receipts now report `failed` when the canonical patch risk\nassessment contains `required_check_failed`. Successful generation and retained\npatch bytes cannot override a failed required QA gate. Other review-required\nrisk reasons remain review outcomes; they do not silently authorize release.\nHistorical immutable receipts are not rewritten. A replay whose recomputed\nresult conflicts with existing evidence must reconcile rather than replace it.\n\n`./builder-candidate-local` supplies the local-owner `BuilderCandidateHost`\ntargets. `createBuilderLocalTargets` re-resolves the server project profile\n(plan, member, binding, path, revision and bound checks) before and after the\ninjected issuance-store read and derives deterministic operation, order, claim,\nlease, step and budget-reservation identities, standard and emergency-cleanup\norder drafts and the Connect pre-mutation request. `builderLocalAdmission`\nrejects substituted payloads and rebuilds the exact Durable Queue V2 envelope\nand outbox reference from the issued order. Configuration is narrowed to\n`BuilderCandidateLocalPlanningConfiguration` (clock, queue binding/profile/\nrequirements, project resolver); hosts keep storage, migrations and keys.\n\nBuilder handoff acceptance consumes the lower LSSM-OS metadata-only planning protocol. Published handoff functions, digest compatibility, receipt status and Connect authority checks remain unchanged. Governed patch execution still belongs to its existing Builder owner.\n\n## Canonical ownership and compatibility\n\nThe existing module identity and all nine published entry maps remain at `packages/domains/builder/control-plane`. Builder candidate orchestration, Connect binding, governed patch inputs and durable full receipts stay canonical here. Generic scheduling, state ports, workers, topology orchestration and plan-only handoff acceptance are canonical in `@lssm-tech/lib.lssm-os-runtime/control-plane`; the original module entries forward to those same functions and classes. This does not narrow `targets.resolve` or `BuilderRuntimePatchPayload.input`, change policy, or introduce a platform-to-domain exception.\n\nThe original inventory row remains one package. Packed declaration compatibility, source checking and affected-consumer qualification remain mandatory. No runtime authority is created by the move.\n","sourcePath":"packages/domains/builder/control-plane/README.md","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/builder/control-plane/README.md","blobSha":"a276ba53842323863b93f04e0ae5b6436f451dd1","sourcePin":"bcc79fcc27c4d801c2119bef81ddcce7b4e86498","origin":"README recovered byte-for-byte from pinned aggregate guide","integrity":"exact Git blob match","executionStatus":"not executed"},"provenance":{"repository":"lssm-tech/contractspec","sourcePin":"bcc79fcc27c4d801c2119bef81ddcce7b4e86498","manifestOrigin":"pinned GitHub manifest fetch","manifestComplete":true,"publicationPolicyApplied":false},"areaSlug":"delivery-and-infrastructure","areaTitle":"Delivery, infrastructure and runtime operations","displayName":"module.lssm-os-control-plane","runtimes":["bun","node","browser"],"platforms":["web","server"],"kind":"module","scope":"Package manifest","canonicalRoute":"/docs/packages/module.lssm-os-control-plane/","contextUrl":"/docs/packages/module.lssm-os-control-plane.context.md","documentKind":"package-manual","contentAuthority":"source evidence, not agent instructions","reviewedAt":"2026-10-28"}