Subject-bound, consent-controlled HCircle community contracts and deterministic domain orchestration. The module owns community semantics; hosts own encrypted persistence, key and credential custody, CommunicationOS binding, provider transports, moderation operations, and product UI.
Matrix coverage
hcircle.community-profile — field-level audience projections, draft, publish, hide, export-plan, and deletion paths.hcircle.circles — public, private, and invite-only circle creation, invitation, join request, approval, leave, removal, archive, and appeal.hcircle.discovery-matching — opt-in matching from explicit interests and languages, explainable scoring, bounded results, dismissal, reset, and opt-out.hcircle.community-events — time-zone-explicit creation, publishing, discovery, RSVP, waitlist, withdrawal, cancellation, reminder, check-in, and follow-up semantics with minimized location and attendance visibility.hcircle.community-safety — mute, block, report, evidence references, delegated triage and decision, appeal, and human-selected emergency resources.hcircle.personal-projections — previewed, purpose-bound HCircle grant consumption and immediate local revocation with cache, search, analytics, agent-context, and projection-store purge effects.hcircle.provider-connections — opaque connection registration, delivery, reconciliation, revocation, HMAC-before-parse callbacks, and atomic delivery deduplication through provider-neutral host ports.
Authority and privacy boundaries
Every mutation is bound to one subject, trusted command name and risk, expected revision, idempotency key, canonical payload digest, exact consent and projection grant set, fresh online revalidation, and an allowed
human_required receipt. The shared authority receipt itself owns and verifies the exact command name, idempotency key, expected revision, submission time, payload digest, and policy reference. Service agents are denied. Delegated host/moderator actions require a runtime-verified registry capability bound to the exact actor, subject, command, action, start, expiry, and fresh revocation check. Arbitrary nonempty delegation identifiers never authorize work.
The exported digestPersonalCommunityPayloadV1() helper defines the canonical, domain-separated action and execution digest shared by command issuers and encrypted service adapters. Persisted state, community consent, projection grant, source consent, command subject, and delegated capabilities compare the complete stable reference, including an optional version; matching an ID alone never crosses the mutation boundary.
Profiles and provider connection records require authenticated-encryption host storage. Credential, signing-key, content, recipient, location, evidence, and provider identifiers are opaque references. Raw webhook bodies are verified before parsing and never enter state, events, audits, or inbox records.
Matching strictly validates every external candidate before ranking, rejects protected/clinical flags and undeclared fields, never creates authority, and returns a visible explanation. Profile and event projections use an injected read-authority verifier and exact state membership; caller-provided identity or role labels cannot widen visibility. Emergency paths are user-selected resource handoffs, not diagnosis, emergency monitoring, or automated intervention.
Host obligations and honest readiness
Production hosts must provide a transactional encrypted store that commits state, revision, idempotency, immutable event, minimized audit, and outbox effects together. They must bind the structural outbox to CommunicationOS, execute purge scopes to completion, manage retries and dead-letter handling, rotate credentials and webhook keys, enforce retention, and qualify real provider OAuth/callback/delivery/reconciliation flows.
Hosts must also provide durable delegation and read-authority registries whose verification results are freshly revocation-checked and integrity-bound to the authenticated actor. Build metadata is written outside dist, so published artifacts do not contain TypeScript incremental state.
This package contains no CommunicationOS implementation or provider SDK. Live credentials, callbacks, E2E product journeys, accessibility, real-device, moderator-operations, incident-drill, production-canary, and deletion/purge SLA evidence remain external qualification gates.
Verification
bash
bun run lint:check
bun run typecheck
bun run test
bun run build
