@x12i/lscp-governance

Org-scoped LSCP actors and permission grants — Express router + optional React admin — shared by Nowrox Docs, Tasks, and other LSCP adopters.

Humans sign in with Authix. AI agents do not: issue an MCP URL (lscp_… in the path). The URL is the secret.

License: Apache-2.0
Version: 0.2.4
Install: from the public npm registry
Companion: @x12i/lscp-core ^0.4.0

Install

npm install @x12i/lscp-governance@^0.2.4 @x12i/lscp-core mongoose express
# UI (optional)
npm install @tanstack/react-query lucide-react react

Server

import mongoose from "mongoose";
import {
  connectGovernanceDb,
  createGovernanceStore,
  KNOWLEDGE_AGENT_ACTIONS,
  WORK_AGENT_ACTIONS,
} from "@x12i/lscp-governance";

// Same URI + dbName + LSCP_ORG_ID in every product that should share agents:
const governanceConn = await connectGovernanceDb({
  uri: process.env.LSCP_GOVERNANCE_MONGODB_URI ?? process.env.MONGODB_URI!,
  dbName: process.env.LSCP_GOVERNANCE_MONGODB_DB ?? "lscp_governance",
});

const governance = createGovernanceStore({
  orgId: process.env.LSCP_ORG_ID ?? "sandbox1",
  connection: governanceConn,
});

await governance.ensureBootstrapActors();

app.use(
  "/api/lscp",
  governance.createRouter({
    onAudit: async (event) => {
      // optional: write product ActionRecord
    },
  }),
);

// Domain routes still use the same actor middleware:
app.use("/api/pages", governance.createResolveActor(), pagesRouter);

Mount product-specific propose/commit/neighborhood routes beside the governance router (do not put domain adapters in this package).

Env (multi-app)

| Variable | Purpose | |---|---| | LSCP_ORG_ID | Org scope (must match across apps) | | LSCP_GOVERNANCE_MONGODB_URI | Mongo URI for shared governance (defaults to product URI) | | LSCP_GOVERNANCE_MONGODB_DB | DB name (use lscp_governance so products share actors) |

React admin

import {
  AgentsAdmin,
  createGovernanceClient,
  WORK_AGENT_ACTIONS,
} from "@x12i/lscp-governance/react";

const client = createGovernanceClient({
  baseUrl: "/api/lscp",
  getAuthHeaders: () => ({ Authorization: "Bearer human:" + humanId }),
});

<AgentsAdmin
  client={client}
  defaultActions={WORK_AGENT_ACTIONS} // Oppix; Knoverix uses knowledge.* defaults
  mcpPathHint="/mcp"
/>

Host CSS should provide the same utility classes Knoverix uses (workspace-settings, lscp-card, primary-button, …), or wrap/restyle as needed.

What stays product-owned

• Knowledge / work propose-commit adapters
• ActionRecord domain rows (use onAudit for grant events)
• Context Graph / neighborhood
• MCP tool handlers that call domain adapters