@lssm/lib.customer-support-runtime

Provider-neutral SupportOS runtime with an event-sourced in-memory conformance authority, optimistic concurrency, workspace isolation, keyset pagination, deterministic SLA helpers, graduated-autonomy enforcement, and reference-only ecosystem hand-offs.

The relation authority executes merge, split, and link mutations under a per-workspace serialization fence. It validates both case revisions, advances both event streams atomically, and returns the original immutable result for exact idempotent replays.

The skills-routing evaluator is pure and replayable. It filters bounded opaque candidate projections by exclusion, availability, capacity, and required skills, then applies explicit preferred-team, load, oldest-assignment, and stable-reference ordering. Skill fallback is opt-in and visible in the trace. Assignment remains a separate governed effect.

The cryptographic lifecycle facade validates provider-neutral KMS and secret adapters before their evidence reaches a SupportOS authority. It enforces exact purpose/algorithm descriptors, tenant/workspace/data-class context binding, versioned envelope evidence, fenced rotation results, bounded lookup hashes, and scope-bound secret references. Plaintext data keys are always returned as destroyable values and are zeroized even when a provider cleanup hook fails. This facade is not a KMS implementation: managed providers, durable rotation ledgers, re-encryption workers, and production rotation drills remain host work.

CommunicationOS remains authoritative for message bodies and delivery. Forms remains authoritative for answers and verification. Personalization can change presentation only. Consequential CompanyOS operations require typed operation references and Connect evidence.

The OPA handoff authority is a provider-neutral local conformance runtime for public profile and booking journeys. It verifies the current case revision, mints a consent receipt, resolves only through a host-supplied OPA destination port, accepts public HTTPS URLs, isolates tenant/workspace state, and preserves exact idempotent replay. Returned bookings require an opaque booking reference; no owner scope, public bearer token, visitor answer, calendar record, or provider payload is persisted in the SupportOS projection.