Source snapshot bcc79fcc · Declared package version 2.0.4. This page combines the checked-in package guide and manifest; commands and runtime behavior were not executed in this review.
Pure PersonalOS runtime for explicit household invitations, membership activation, purpose-limited permission delegation, and retained revocation history.
Authority boundary
Membership and rights commands are online_required, high-risk, and default to human_required authority.
The reducer recomputes a domain-separated canonical payload digest and accepts only a decision receipt bound to the command name, revision, idempotency key, submission time, policy, payload, owner subject, actor, and risk. It does not create or infer permission.
Only an active member can receive a purpose-limited delegation.
Revocation removes current permissions but retains the member, delegation, timestamps, evidence, and command receipt for audit and recovery.
Owner rights, missions, consent, protected traits, sensitive data, and consequential authority cannot be transferred through this module.
Goal-scoped support is a separate additive service. It verifies exact active membership and current goal evidence through host-owned ports before an atomic commit. Grants name exact goals, visible fields, proposal-only actions, purpose, consent, and expiry.
Revoke, block, and categorical report recovery emits minimized idempotent effects for a host outbox. CommunicationOS remains an external adapter; this module never imports it or sends private narrative content.
The view model exposes only household actor references and purpose-limited rights; it never projects a private PersonalOS profile. Persistence, receipt creation, expiry enforcement, and provider effects belong to an online host.
These are package-manifest entry points. Named symbols listed above come from the capability catalogue; this is not an exhaustive TypeScript symbol reference.
