@lssm-tech/module.personal-founder-support
Pure PersonalOS orchestration for a founder-private cockpit that Pactena can host through explicit ports. It validates the 14-door founder catalog, keeps company and private domains separated, supports weekly review and recovery, and creates minimized read-only handoffs for the founder cockpit, portfolio, executive room, and talent workspace.
Cross-product packets omit the personal subject identifier and provenance evidence references; the opaque grant and minimized projection ids preserve revocation and traceability at the PersonalOS boundary.
Every mutation is bound to the exact personal subject, projection-sharing consent, Pactena-purpose grant, grant-owned destination allowlist, revision, idempotency key, canonical action digest, trusted risk, online revalidation, policy, and human decision receipt. Authority receipts use the strict PersonalOS command binding; the module receipt additionally binds action kind, confirmation, connectivity, grant, and destinations.
FounderSupportService is the encrypted transactional host seam. It validates the complete stored subject reference and nested subject-owned state, runs the pure reducer, and commits the authenticated-encryption record, minimized audit, immutable event, idempotency checkpoint, and Pactena publish/revocation outbox effects in one host transaction. Revocation effects name all five required derived-store purge scopes. The store and key-custody implementation remain host-owned and fail closed when unavailable.
Advisory enrichment is proposal-only and reversible. Its command contract accepts safe structured categories plus an opaque untrusted display reference, never raw advisory prose. Effect flags are fixed to display-only and non-consequential; health, finance, tax, legal, hiring, eligibility, protected-trait, and other consequential categories are rejected. Projection handoffs likewise exclude free-form outcome narratives.
Completed review evidence and terminal advisory/handoff identities are append-only: accepted, dismissed, undone, and revoked records cannot be overwritten or resurrected.
Host boundary
The module is provider-neutral and side-effect free except through injected ports. bundle.personal-os may bind its catalog, encrypted transaction, and handoff ports to lower-level founder intelligence and Pactena hosts. The module does not implement or claim concrete key custody, Pactena forms, conversations, managed databases, delivery workers, browser/native E2E, accessibility, real-device, or canary evidence.
Test fixtures are test-local and intentionally absent from package exports.
