@consciousclouds/workspace-model

The shell-neutral leaf of the Canvas Operating System's active-Workspace state.

This package is the Workspace model, graduated out of @consciousclouds/operator-shell (which re-exports every symbol here, so existing import { compose, Workspace } from "@consciousclouds/operator-shell" keeps working — a graduation, not a break). It is pure domain mechanism: plain data + total functions, depending only on @consciousclouds/canvas-sdk (for CanvasDefinition) and a peer react (for the workspace component-prop types). No shell, no chief, no transport — so any enrolled product can hold an active Workspace, apply the five verbs, and prove the autonomy boundary without importing operator-shell internals.

What it holds

• provenance — ComposedMeta (a live frame's provenance) + CompositionSource (a durable keep's provenance). The only coupling the model ever had to the shell, now living where the model lives.
• workspace-model — the frame lifecycle (live | pinned) + Workspace (an ordered frame list) and its total helpers (liveFrames, pinnedFrames, makeFrame, restoreWorkspace, …).
• workspace-verbs — the five verbs, each a pure Workspace → Workspace: compose (Chief) · evolve/replace (prompt; pins survive) · pin/dismiss (human). A sixth verb is a defect.
• workspace-boundary — the FREE / PROPOSE / NEVER authority classification (COMPOSER_VERBS / HUMAN_VERBS) and pinsPreserved, the machine-checkable invariant that no composer verb deletes or overwrites a pin.
• types — the Workspace-Framework mount contract (WorkspaceType, WorkspaceComponentProps, WORKSPACE_TYPE_IDS).
• session-adapter — the SessionAdapter transport types (types only — the wire stays product-owned; SDK-law thin).

Design references

• docs/design/canvas-operating-system.md §4.5 — the Workspace object + the five verbs.
• docs/design/composition-runtime-contract.md §4.2 — the autonomy boundary.
• docs/design/separation-law.md — the extraction is a photograph, not a negotiation.