Source snapshot bcc79fcc · Declared package version 2.0.4. This page combines the checked-in package guide and manifest; commands and runtime behavior were not executed in this review.
Subject-bound PersonalOS contracts and pure orchestration for calendars, reminders, knowledge/file references, search, notifications, household care, personal projects, account recovery, trusted devices, export, and deletion.
Calendar V1
Provider-neutral contracts cover Google Calendar, Microsoft Graph, and CalDAV without accepting credentials or raw provider payloads. State retains only opaque provider-record and encrypted-cursor references.
Bounded imports require monotonic provider revisions, unique provider rows, exact connection scope, valid IANA time zones, and idempotent command receipts. Stale imports preserve the prior agenda.
People explicitly control calendar visibility, reminder load, focus protection, and whether suggestions are disabled or require review. Suggestions remain proposals until a human accepts one.
Existing create/edit and cancel actions stay compatible. Additive actions cover connect, import, move, decline, conflicts, reauthentication, reconnect, revoke, and suggestion review through metadata-only outbox effects.
Unified search V1
Exact query and authority contracts bind subject, actor, purpose, consent, mode, opted-in source kinds, freshness, expiry, and revocation checks.
Provider-neutral source windows expose metadata only. Deleted, revoked, archived, stale, offline, unsupported, malformed, and cross-subject rows do not enter results; denied authority prevents source reads entirely.
Keyword, semantic, recent, and saved modes have distinct strict inputs. Semantic results require a source-provided bounded score and saved results require an exact saved-query reference instead of treating either mode as a keyword wildcard.
The PersonalOS bundle adapter reads calendar, reminder, knowledge, file, and project metadata from the exact encrypted life-admin aggregate. The local on-disk replay proves restart search, ciphertext privacy, exact scope denial, and prompt removal after archive.
The public result contract is bounded to 50 unique source/id rows and requires exact agreement between complete, partial, empty, or denied status and unavailable sources. Hosts issue and independently verify authority; browsers never supply or receive its evidence.
Authenticated surface projection
./surface-projection exposes one strict, subject-bound V1 read contract for calendar, reminders, knowledge counts, calendar connection health, and an optional exact-actor care window.
Care rows are bounded, unique, metadata-only, and disclose only assignments for the authenticated actor. A non-owner actor needs a current exact
personal.life.care.read capability; expiry, revocation, actor drift, or subject-version drift suppresses the whole projection.
Calendar and reminder windows are bounded to 50 unique rows and carry exact totals, truncation, and opaque cursors. Inconsistent cardinality fails schema validation.
Knowledge is count-only. Encrypted content/file references, provider account references, cursors, credentials, receipts, evidence, delivery references, and device-key references are absent by construction.
The bundle runtime decrypts the exact subject aggregate server-side and only then compiles this projection. A differently bound snapshot fails closed.
Trust boundary
Every aggregate, command, query, receipt, and store operation is bound to one personal subject. A delegated actor needs an exact command-bound receipt and explicit delegation and consent references.
Sharing, care coordination, account recovery, device changes, exports, and deletions revalidate online. Offline execution is limited to the exported low-risk self-action allowlist and requires an undo reference.
Personal knowledge stores only opaque encrypted content/file references. Provider payloads, file bytes, secrets, recovery proofs, and keys are never accepted by public state, telemetry, audit records, errors, or projections.
Optimistic revisions and idempotency receipts make retries lossless. Encrypted state, immutable metadata-only events, minimized audit, and outbox effects use one host transaction, so a failed commit cannot partially apply a command.
The module recomputes a domain-separated canonical JSON SHA-256 for every action. The shared authority receipt's mandatory command binding and the module wrapper bind that digest plus the exact command, revision, authority policy, and connectivity tuple, so same-kind payload substitution fails.
Queries and delegated care projections require complete subject and actor references, including versions, plus the exact runtime-verified capability.
Terminal entities cannot be resurrected by upsert. Lifecycle timestamps are monotonic and each rights target preserves its complete evidence-bound attempt history across retries, reconciliation, finalization, and compensation.
Command construction
@lssm-tech/module.personal-life-admin/command-builder exports
buildPersonalLifeAdminCommandV1. It takes the command name and risk from
PERSONAL_LIFE_ADMIN_ACTION_POLICY, binds the envelope to the canonical action digest, requires at least the submitting surface's evidence reference, and defaults execution to online revalidation at submission time. Hosts supply the trusted subject/actor, revision, time, identifiers, consent and delegation ids; construction grants no authority.
Host responsibilities
@lssm-tech/bundle.personal-os/runtime now composes this reducer with the shared two-phase authority, host crypto, and atomic subject-state transaction ports. Its PostgreSQL E2E exercises a restartable export plan against forced RLS, AES-GCM ciphertext, exact idempotency, immutable events, verified receipts, and transactional outbox effects. The module's simpler PersonalLifeAdminService
port remains useful for adapters, but it is not the qualified production seam.
Hosts still provide managed key references, calendar and notification providers, file/blob custody, identity proofing, recovery channels, device key custody, export artifact generation, deletion propagation, file malware scanning/versioning, backup/restore, and operational monitoring. Search hosts also provide independently verified search authority, additional domain adapters, semantic indexes, saved-query storage, lifecycle propagation, ranking evaluation, and production operations. PersonalOS web now consumes keyword search and the bounded projection; native and provider-backed semantic/saved search remain separate qualification work. Calendar hosts also own credential custody, OAuth/callbacks, webhook authenticity, rate limits, pagination transport, recurring-event expansion, and provider-specific reconciliation. The local PGlite run does not claim configured providers, production key management, managed backup transport, product UI, or production canaries.
Verification
bash
bun run lint:check
bun run typecheck
bun run test
bun run build
Declared capabilities.
Module Personal Life Admin
Subject-bound PersonalOS life administration and personal knowledge runtime.
Use it to
Adopt subject-bound personalos life administration and personal knowledge runtime
Requires
TypeScript
Choose another boundary when
The @lssm-tech/module.personal-life-admin package constraints do not match the target runtime or platform.
These are package-manifest entry points. Named symbols listed above come from the capability catalogue; this is not an exhaustive TypeScript symbol reference.
