13.1.0

companyos-solutions-starting-points

Redesign the CompanyOS /solutions buyer path around starter workflows, reusable governed workflow patterns, and bring-your-own-process conversion while adding structured marketing contract card fields and icon-key transport.

connect-local-approval-kernel

Add the durable local Connect approval kernel, linkage recovery, and tenant isolation.

managed-companyos-production-operation-v2

Add explicit v2 design-partner readiness, expert attestation, and founder approval contracts with server-derived authority, scoped durable receipts, pending evidence projection, replay linkage, and fail-closed health while preserving v1 unchanged. The release supports a private production-scoped pilot but does not activate a tenant or authorize broader production surfaces.

Consumers that only read card title, description, and href do not need to change. Consumers that render richer contract pages can display cards[].fields as labelled rows and cards[].iconKey through an icon registry with a fallback.

1. Continue accepting existing card title/description/href values.
2. Render cards[].fields when present for scannable package or pattern cards.
3. Resolve cards[].iconKey through the host icon set and keep a safe fallback for unknown keys.

Apply the additive migrations with an owner distinct from the runtime role.

When: Enabling durable PostgreSQL-backed local Connect review.

1. Run migrations 001 through 004 in order with the migration-owner role.
2. Ensure the runtime role owns no protected tables and has no BYPASSRLS capability.
3. Bind the non-owner database role to its tenant and workspace using the separately authorized migration/admin context; runtime input cannot choose or mutate this binding.

Adopt the versioned v2 registry while preserving the unchanged v1 key-only registry for existing consumers.

1. Resolve each operation through companyOsDesignPartnerOperationVersions[key]['2.0.0'].
2. Keep the v1 key-only registry until every generated client and handler has migrated.

Derive every authority and evidence reference from the verified server session and transaction.

1. Stop sending principal, role, evidence receipt, replay packet, prerequisite attestation, or correlation authority in request bodies.
2. Preserve tenant, workspace, packet-version, receipt, and correlation scope through the tenant transaction.

Treat implementation readiness as separate from approval to activate the first tenant.

1. Approve legal tenant/workspace names, named roles, data authority, residency, and exact domains/cookie parent.
2. Configure web https://app.companyos.lssm.tech, API/auth https://api.companyos.lssm.tech, and cookie parent .companyos.lssm.tech exactly.
3. Configure the API-owned admitted tenant, workspace, and scenario membership; do not accept browser-selected scope.
4. Fail closed when any admitted membership identifier is missing, blank, or malformed outside test/development.
5. Namespace idempotency with the exact packet version and verified principal before persistence.
6. Run the credential-parameterized deployed journey only with explicit authorization and the complete secret-store prerequisite set.
7. Verify expected authenticated user and tenant identities, then poll receipt-id evidence and correlation-id replay until projected.
8. Assert proof reads are immutable and verify the degraded web UI on an authorized degraded deployment.
9. Approve database, backup, restore, support, SLO, incident, rollback, deployed-journey, cron, and kill-switch evidence.
10. Confirm every deferred surface in docs/managed-companyos-private-pilot.md remains disabled or reference-only.

Apply the additive schema and verify FORCE RLS before enabling durable local review.

Packages: @lssm-tech/lib.contracts-spec, @lssm-tech/integration.runtime, @lssm-tech/app.cli-contractspec, @lssm-tech/bundle.workspace

1. Back up existing channel and Connect review tables.
2. Apply the ordered migrations under the migration-owner role.
3. Run tenant-isolation and linkage-recovery verification with the non-owner runtime role.

Bind v2 handlers to verified session membership, durable idempotency receipts, immutable replay/evidence projection, and fail-closed health.

Packages: @lssm-tech/lib.contracts-spec

1. Preserve receipt and correlation ids from command transaction through outbox and projection.
2. Return recorded_evidence_pending until evidence and replay rows are visible.
3. Reject founder approval without an accepted expert attestation on the exact packet version.
4. Degrade overall health for database, migration, relay, DLQ, or snapshot failures.
5. Deny reads, mutations, and scheduled relay work when the server-owned tenant kill switch is disabled.