Organization Planning React

Headless browser clients for contract-validating, authenticated Organization Planning workspaces.

useMeetingWorkspace loads the canonical workspace, artifacts, and available context for one opaque meeting reference. It exposes explicit unselected, loading, denied, missing, unavailable, and ready states plus a governed context refresh action. Hosts retain credential custody and inject fresh request headers; the package never persists tokens or meeting content.

The hook validates every successful response against the shared OPA models and uses cache: no-store, included credentials, bounded response bodies, abortable loads, and idempotent refresh requests.

MeetingOperatingPlanSummary renders the governed disposition, strict timebox, pre-read lead, agenda, and mandatory outputs supplied by the runtime. It does not infer authority or decide whether a meeting should run in the browser.

createOpaCaptureClient implements the seven capture and consent operations using server-derived configuration, strict media/session schemas, immutable retry keys, and caller-supplied authentication. Bearer requests omit cookies. All meeting and capture responses are bounded while streaming, abortable, time-limited, and reject redirects. API base paths reject scheme-relative URLs and embedded credentials. This client does not acquire microphones or implement encrypted device spooling.

createOpaCaptureClient().transcript(meetingRef) reads the existing private transcript query, including source capture and structured timestamped segments. It uses a bounded larger response allowance for transcript content and does not interpret an absent legacy text field as an empty transcript.

TranscriptReviewPanel loads the recorded transcript and binds approve/reject actions to exact source/review revisions. Its permission comes from the server. A reviewed replacement does not reuse original timestamps. Give the panel a new React key when the host authority context changes; the CompanyOS shell does so. The UI includes loading/denied/missing/failure states and localized en/fr/es copy.

Reviewed outcome drafts in CompanyOS

The approved transcript panel can generate and read private meeting drafts through existing OPA operations. Generation controls use server-derived canGenerateOutcomes; authority and automation policy are rechecked server-side. Draft generation creates no messages or Work tasks. French, English and Spanish copy distinguishes loading, generation, retry, denied access and empty history.

Artifact list 2.2.0 accepts optional reviewRef, selecting the current review before source reproof so stale historical drafts do not block current results. Transcript get 2.2.0 adds the generation capability projection. The client pins private ownership and an exact review-derived retry key, including across reloads. Interactive generation has a bounded 180-second request deadline; the web proxy allows a 300-second function budget. Persisted background jobs, signed-native presentation and full browser/accessibility qualification remain incomplete.

Correcting and reviewing outcome drafts

Artifact review 3.0.0 accepts optional editedContentMarkdown when approving. The request still binds the displayed artifact revision and original content digest; the receipt approves the corrected digest. Human edit metadata records the prior digest, actor and timestamp. Empty edits, edits combined with rejection/CRDT snapshots, and independent edits during open collaborative sessions are rejected. A retry key cannot approve a different payload.

The private draft cards expose edit, approve and needs-changes controls using server-derived canReviewOutcomes. Uncertain review responses retain the current draft for retry; access denial removes it. Approval does not send messages, publish links or create Work tasks. Actual edited-review PostgreSQL qualification, complete collaborative editing and downstream actions remain open.

Durable outcome processing

Analyze 3.1.0 accepts executionMode: background on its existing route. Repeating the exact request observes the same persisted job; processing responses carry processingJobRef, while completion returns the saved outcome. The private draft client selects background mode when the server advertises it and can stop polling without cancelling accepted work. Terminal failures remain failures.

Apply additive migration 0080, configure a dedicated companyos_outcome_dispatcher login, and enable OPA_OUTCOME_JOBS_ENABLED=1 only with approved pinned OPA_MEETING_AI_* EU processing. The every-minute /api/cron/opa-outcome-processing route requires CRON_SECRET. Runtime credentials must not be superuser, BYPASSRLS or a member of opa_migrator. The queue admits four global jobs and one per owner, bounds pending owner jobs at 25, retries at most five times and uses six-minute fenced leases. Current membership, module entitlement, intelligence policy, source consent/review and model binding are rechecked before generation and commit.

Outcome persistence and completion share a transaction; model calls are outside SQL. Queue rows contain references and authorization evidence, not transcript text or credentials. Model cost may repeat after a crash before commit. Terminal-job self-service repair, queue retention/deletion propagation, live model/provider qualification and production rollout remain open. No production activation is implied by the local tests.

Evidence-bound action proposals

Meeting prompt 2.0.0 requires structured actions for action-plan generation. Each proposal carries a title, optional description, explicit/uncertain classification and exact quotations tied to supplied citation references. Missing action output or unsupported quotes fails generation. Model output cannot supply owners or deadlines. Quote membership proves traceability, not semantic correctness.

Action-plan artifacts retain actionProposals, and their content digest covers prose and structured actions together. Artifact review 3.1.0 requires acknowledgeActions for a nonempty task list. Reviewers may edit titles/details while preserving verifiable source evidence. The private draft cards display proposed tasks, uncertainty and source quotes with an explicit approve-draft-and-tasks label. Prose-only or collaborative edits clear stale structured actions; edited structured input is revalidated against the current approved transcript.

Proposals become Work commitments only through explicit projection. Assignment, due-date selection, downstream delivery, deletion propagation and the live precision/recall benchmark remain open. Prompt-version changes invalidate incompatible queued generation bindings; never relabel old processing as using the new prompt.

Approved action to canonical Work

opa.task.project 3.0.0 projects one approved structured action through the existing task route. The request binds artifact revision/digest, approval receipt, action reference and selected workspace. It requires explicit workspace disclosure acknowledgment and confirmation for an uncertain proposal. The UI exposes this action only for approved task lists and server-derived projection permission.

Only the reviewed title and details are transferred; raw/private transcript text and source quotes are not copied into Work. Assignees and deadlines remain unset. Current outcome.commit policy, transcript review/consent and Work workspace write authority are rechecked. Work event/idempotency/outbox and the OPA projection receipt commit in one transaction. Repeated projection returns the existing Work object; a receipt represents committed task creation, not task completion or realtime projection convergence.

New owner capability manifests include opa.task.project; existing grants require an authorized update and are not silently widened. Legacy input-only projection clients must update to 3.0.0. CommunicationOS delivery, assignment/due-date controls, real-authority deployment qualification and full release gates remain open.

createOpaMeetingCreationClient (also exported from ./meeting-creation-client) reads private creation context and posts the expected scope digest plus a stable request key. It uses the existing bounded/authenticated transport and rejects a receipt for another scope. It does not persist credentials or intents; native hosts supply secure intent storage and session invalidation.

The existing ./useTranscriptReview entrypoint also exports useTranscriptReviewWithClient for hosts with a preconfigured authenticated capture client. Native hosts pass captureRef and an Expo-safe createRequestKey; the hook checks exact private capture identity before display, and preserves owner/source/review bindings on mutation responses. Loads and reviews share an abortable lifetime, changing clients or source selection clears old content, and uncertain retries reuse the same key and payload. The original browser useTranscriptReview wrapper delegates to this core. The hook does not generate outcomes or grant authority; review permission remains server-derived.

The existing ./useReviewedOutcomes subpath also exports useReviewedOutcomesWithClient. Hosts inject the existing private outcome client and optional SHA-256 text hashing for native runtimes. Browser and native retry identities remain byte-compatible for the same six-field approved-source identity. The shared hook validates every draft against the current review/content digest, resets on changed source selection and fences late work completion. A completed generation response must identify its source and artifacts, and the subsequent list must contain retrievable drafts. Edited prose and proposed actions remain together through explicit review; no Work or delivery effect is implied.

./useProjectMeetingAction provides the shared browser/native task-projection hook. Supply the authenticated outcome client, current approved artifact/action, server-selected target and disabled state; native hosts can inject SHA-256 hashing. Explicit disclosure and uncertain-action acknowledgments are required. Short action refs retain existing project:<actionRef> retry keys; long valid refs receive bounded deterministic keys. Success requires a matching private receipt, artifact revision, Work object and event. No effect runs on mount. Concurrent/confirmed repeats are suppressed locally, while durable server idempotency remains authoritative. Source/target/client changes abort old requests without claiming rollback. meetingActionProjectionCopy is exported from ./reviewed-outcomes-copy for localized platform presentation.

useProjectMeetingAction returns workObjectRef only with a matching confirmed done result. Source/target/client changes hide the prior reference immediately, allowing native hosts to navigate without guessing task identity. Navigation is host-owned and does not grant access to the destination object.

The bounded JSON transport accepts an explicit second work family argument for the exact /api/companyos/work base. The default OPA path grammar is unchanged. Both modes retain HTTPS-only remote origins, credential/path rejection, bounded streaming, timeout, abort and redirect controls. This mode does not infer authorization.

Private meeting notes

CompanyOS exposes one private human-authored notes draft per meeting through additive opa.meeting_artifact.get_note and opa.meeting_artifact.save_note operations at GET/POST /api/v2/opa/smart-meetings/:meetingRef/notes. Existing meeting-work-session management permission authorizes this personal authoring surface; recording, transcript generation and model credentials are not prerequisites. Saves use expectedRevision (zero for creation), at most 100000 characters and a stable idempotency key. Notes remain live_notes/private_user/draft, persisted in the existing encrypted aggregate. Empty content clears the draft. Revision conflicts preserve the local draft and show the latest saved notes before an explicit choice to continue. Saving notes creates no Work task and sends no message.

The additive @lssm/lib.organization-planning-react/meeting-notes-client export provides createOpaMeetingNotesClient and OpaMeetingNoteConflict. Read returns the fixed note or null; save validates the exact meeting, content and next revision returned by the server. HTTP 409 remains a distinct conflict and is never automatically retried as an overwrite.

The ./capture-media-upload entrypoint exports uploadOpaCapturedMedia, OpaCaptureUploadCheckpoint and OpaCaptureUploadFile. It shares the existing sequential source-bound upload protocol across native encrypted files and browser imports. Callers retain protected owner-scoped checkpoints and original media; the helper verifies acknowledged prefixes and uses stable finish identity. It does not obtain consent, record audio or configure processing.

Recent private meetings are available through additive opa.meeting_workspace.recent (GET /api/v2/opa/private-meetings?expectedOwnerScopeDigest=...). Use the existing private creation-context digest; it prevents stale scope selection and grants no authority. The fixed latest-twenty view uses stored timestamps/readiness and optional 160-character canonical manual-note previews. Current authority is reproven before and after the encrypted owner read, and no caller scope or limit is accepted. CompanyOS renders snippets as plain text and reopens the existing meetingRef URL.

MeetingOperatingPlanSummary translates controlled format, disposition, phase and required-output labels for English, French and Spanish. Unknown text and underlying plan values remain unchanged.