module.work-management

@lssm-tech/module.work-management

Reusable Work OS application services and view models.

The module composes @lssm-tech/lib.work-spec and @lssm-tech/lib.work-runtime without binding a database, provider, transport, or product shell. Consumers inject durable event/projection/idempotency ports.

./transports exposes REST, GraphQL, and MCP adapters over the same injected WorkMutationExecutor. Hosts bind authentication and tenant context before calling it; the module never creates a permissive or in-memory fallback. createAuthenticatedWorkTransportAdapters rejects any payload whose actor or tenant/organization/workspace scope differs from the verified host context.

Managed CompanyOS can compose this module with OPA, Knowledge, Workflow, and integration packages. Downstream products can consume it independently.

The current command surface covers object lifecycle and transitions, recurrence, time tracking, relationships, immutable comment creation, attachment linking, native custom-field values, and explicit Inbox Capture for source-provenanced inbox_item objects. Every command is authorized, idempotent, correlated, evidence-linked, and committed with at least one explicit transactional-outbox destination through an injected atomic port before its projection is published.

Durable command ports expose optional lookupCommitted so services can resolve an authorized retry before object-existence or revision validation. The PostgreSQL adapter fences the request identity and returns its persisted receipt, or an idempotency conflict for changed input. Managed hosts keep lookup, projection reads and commit in one outer authority transaction, so concurrent identical creates return one committed event. Other adapters must implement this receipt lookup to qualify equivalent retry behavior.

Work scope validation now includes tenant, organization and workspace on object reads, including both materialized projections and replay fallback. Mismatched projection identities fail closed. Mutation services validate the current object's identity/scope and replay receipts against the authorized actor and scope. PostgreSQL commits serialize by aggregate before revision checks and reject changing an existing aggregate's scope; projection upserts cannot replace a newer revision with an older worker result. These changes preserve existing wire contracts and require no schema migration. Tenant-only event/outbox worker ports remain trusted internal surfaces and must not be exposed as workspace-authorized reads.