@lssm/module.personal-life-admin

Subject-bound PersonalOS contracts and pure orchestration for calendars, reminders, knowledge/file references, search, notifications, household care, personal projects, account recovery, trusted devices, export, and deletion.

Calendar V1

• Provider-neutral contracts cover Google Calendar, Microsoft Graph, and CalDAV without accepting credentials or raw provider payloads. State retains only opaque provider-record and encrypted-cursor references.
• Connections bind exact subjects, read/write authority, capabilities, provider revisions, reauthentication, reconnection, and terminal revocation.
• Bounded imports require monotonic provider revisions, unique provider rows, exact connection scope, valid IANA time zones, and idempotent command receipts. Stale imports preserve the prior agenda.
• People explicitly control calendar visibility, reminder load, focus protection, and whether suggestions are disabled or require review. Suggestions remain proposals until a human accepts one.
• Existing create/edit and cancel actions stay compatible. Additive actions cover connect, import, move, decline, conflicts, reauthentication, reconnect, revoke, and suggestion review through metadata-only outbox effects.

Unified search V1

• Exact query and authority contracts bind subject, actor, purpose, consent, mode, opted-in source kinds, freshness, expiry, and revocation checks.
• Provider-neutral source windows expose metadata only. Deleted, revoked, archived, stale, offline, unsupported, malformed, and cross-subject rows do not enter results; denied authority prevents source reads entirely.
• Keyword, semantic, recent, and saved modes have distinct strict inputs. Semantic results require a source-provided bounded score and saved results require an exact saved-query reference instead of treating either mode as a keyword wildcard.
• The PersonalOS bundle adapter reads calendar, reminder, knowledge, file, and project metadata from the exact encrypted life-admin aggregate. The local on-disk replay proves restart search, ciphertext privacy, exact scope denial, and prompt removal after archive.
• The public result contract is bounded to 50 unique source/id rows and requires exact agreement between complete, partial, empty, or denied status and unavailable sources. Hosts issue and independently verify authority; browsers never supply or receive its evidence.

Authenticated surface projection

• ./surface-projection exposes one strict, subject-bound V1 read contract for calendar, reminders, knowledge counts, calendar connection health, and an optional exact-actor care window.
• Care rows are bounded, unique, metadata-only, and disclose only assignments for the authenticated actor. A non-owner actor needs a current exact personal.life.care.read capability; expiry, revocation, actor drift, or subject-version drift suppresses the whole projection.
• Calendar and reminder windows are bounded to 50 unique rows and carry exact totals, truncation, and opaque cursors. Inconsistent cardinality fails schema validation.
• Knowledge is count-only. Encrypted content/file references, provider account references, cursors, credentials, receipts, evidence, delivery references, and device-key references are absent by construction.
• The bundle runtime decrypts the exact subject aggregate server-side and only then compiles this projection. A differently bound snapshot fails closed.

Trust boundary

• Every aggregate, command, query, receipt, and store operation is bound to one personal subject. A delegated actor needs an exact command-bound receipt and explicit delegation and consent references.
• Sharing, care coordination, account recovery, device changes, exports, and deletions revalidate online. Offline execution is limited to the exported low-risk self-action allowlist and requires an undo reference.
• Personal knowledge stores only opaque encrypted content/file references. Provider payloads, file bytes, secrets, recovery proofs, and keys are never accepted by public state, telemetry, audit records, errors, or projections.
• Optimistic revisions and idempotency receipts make retries lossless. Encrypted state, immutable metadata-only events, minimized audit, and outbox effects use one host transaction, so a failed commit cannot partially apply a command.
• The module recomputes a domain-separated canonical JSON SHA-256 for every action. The shared authority receipt's mandatory command binding and the module wrapper bind that digest plus the exact command, revision, authority policy, and connectivity tuple, so same-kind payload substitution fails.
• Queries and delegated care projections require complete subject and actor references, including versions, plus the exact runtime-verified capability.
• Terminal entities cannot be resurrected by upsert. Lifecycle timestamps are monotonic and each rights target preserves its complete evidence-bound attempt history across retries, reconciliation, finalization, and compensation.

Host responsibilities

@lssm/bundle.personal-os/runtime now composes this reducer with the shared two-phase authority, host crypto, and atomic subject-state transaction ports. Its PostgreSQL E2E exercises a restartable export plan against forced RLS, AES-GCM ciphertext, exact idempotency, immutable events, verified receipts, and transactional outbox effects. The module's simpler PersonalLifeAdminService port remains useful for adapters, but it is not the qualified production seam.

Hosts still provide managed key references, calendar and notification providers, file/blob custody, identity proofing, recovery channels, device key custody, export artifact generation, deletion propagation, file malware scanning/versioning, backup/restore, and operational monitoring. Search hosts also provide independently verified search authority, additional domain adapters, semantic indexes, saved-query storage, lifecycle propagation, ranking evaluation, and production operations. PersonalOS web now consumes keyword search and the bounded projection; native and provider-backed semantic/saved search remain separate qualification work. Calendar hosts also own credential custody, OAuth/callbacks, webhook authenticity, rate limits, pagination transport, recurring-event expansion, and provider-specific reconciliation. The local PGlite run does not claim configured providers, production key management, managed backup transport, product UI, or production canaries.

Verification

bun run lint:check
bun run typecheck
bun run test
bun run build