module.osint

@lssm-tech/module.osint

Capability and qualification matrix

@lssm-tech/module.osint/capability-matrix is the canonical executable delivery truth for OSINT v0. It covers the data/knowledge foundation, durable source lifecycle, runnable surfaces, company/jobs/people verticals, governed self-improvement, Hirly isolation, production operations, and every method for Bright Data, Massive, Browserbase, Serper, Linkup, and Tavily.

import {
  osintV0CapabilityMatrix,
  summarizeOsintCapabilityMatrix,
} from "@lssm-tech/module.osint/capability-matrix";

The matrix deliberately separates implementation stage, deterministic qualification, and live qualification. Unsupported vendor methods remain explicit and are never simulated. A source file or test definition cannot make a capability live-qualified; live and production states require receipts and no open blocker. See docs/osint-v0-capability-matrix.md^†.

Each capability also carries an operational qualification profile comparable to SupportOS: delivery and accountable ownership, exposure, authentication, routes, services, stores, events, journeys, SLOs, data classes, qualification scopes, rollout phase, and required proof layers. The module validator rejects missing metadata, duplicate references, unscoped public APIs, restricted-person data without security plus EU/France qualification, and production rollouts without production proof. This overlay is additive to the stable OSINT contract shape while the ContractSpec Connect control plane is unavailable.

Production gates are independent nodes rather than one optimistic platform row. The matrix separately tracks the durable work queue, warehouse/export, embedding providers, rights deletion, provider live qualification, security and privacy, observability, France corpus, managed scale, restore rehearsal, and exact improvement replay. Its topology validator rejects unknown dependencies, dependency cycles, and duplicate evidence or blocker identities.

The managed-scale node points to the opt-in PostgreSQL loader and benchmark in @lssm-tech/example.osint-proof. Recovery uses the strict receipt validator in deploy/osint/recovery-receipt.ts; pending, malformed, over-budget, mismatched, or non-independently verified rehearsals remain unqualified. The same proof package provides a separate strict live France corpus receipt; synthetic fixtures, policy-pending people, unsupported facts, and non-independent identity review cannot qualify it. Managed deployment acceptance likewise uses a fresh exact-SHA receipt from deploy/osint/deployment-receipt.ts; source-controlled topology never counts as a successful Railway deployment by itself.

Provider-neutral, headless orchestration for reusable company, job-listing, and people intelligence. Each vertical runs independently or consumes references and events emitted by the others.

CompanyOsintSystemV0, JobsOsintSystemV0, and PeopleOsintSystemV0 expose independent projection systems with optional reference kinds rather than hard package dependencies. Their projections cover the complete evidence-backed company, job, and permitted people field sets. Composed deployments dispatch by entity kind without introducing dependency cycles. The France early-career taxonomy classifies explicit, French, and English internship/apprenticeship signals and routes conflicting evidence to review instead of guessing.

The source lifecycle deliberately separates discovery, qualification, checkpointed ingestion, and revalidation. A stable job board can therefore be ingested frequently without paying for discovery on every run. Drift, expiry, capability changes, ownership changes, and explicit operator requests schedule targeted rediscovery or revalidation.

OsintDurableSourceLifecycleServiceV0 persists qualification findings before activation and performs revalidation as fenced revalidating plus terminal transitions. Qualification or evaluator failures quarantine the source, while receipt lookup makes completed activation and revalidation retries exact and idempotent. Every lifecycle entrypoint validates the executable request schema, requires overlay_write, verifies an independent exact policy decision, derives the actor from the authenticated context, and obtains a bounded claim before an evaluator can run. Revalidation resumes an exact persisted start after lease takeover, while stale evaluators fail closed at the canonical transition fence. The service binds to the governed qualify/revalidate operation keys. The managed worker also maps legacy generic V1 requests into the same exact lifecycle service so compatibility calls cannot bypass revision, policy, claim, evidence, or replay checks.

Deep-research requests bind an exact provider model, prompt version, policy decision, replay reference, method allowlist, and budget. Returned statements remain explicitly untrusted candidates; candidates without source references or matching model/prompt/replay provenance are discarded before curation.

Use deployment profiles to isolate queues, credentials, budgets, regions, and data. The included Hirly profile targets internships and apprenticeships in France under the EU/France policy pack. It uses distinct queue, index, credential, database, object, network, and export bindings, caps worker concurrency at eight, and schedules adaptive ingestion every six hours. Company and jobs are enabled; people is denied at API, MCP, and worker boundaries unless a future reviewed profile revision and policy explicitly adds it.

Public entrypoints: company, jobs, people, research, ingestion, knowledge, self-improvement, and the additive CompanyOS compatibility projection. The self-improvement adapter only publishes sanitized signals; all candidate, gate, authorization, execution, and rollback authority stays in the generic governed system.

OsintApiOperationServiceV0 routes generated read operations to an authorized read port and enqueues mutations with deterministic work identifiers. The worker service rejects unfenced execution, stale leases, changed requests, and expired or mismatched authority decisions before invoking a mutation adapter.