14.1.0

Jul 27, 2026 · 23 packages · 14 unique changes · 4 release entries

appsbundlesintegrationslibsmodules

This release affects the contracts, integrations, sharedLibs, solutions familyies.

Run contractspec connect adoption resolve --family contracts to see how it impacts your project.

Release summaries

agent-application-foundation
Add a contract-first, filesystem-authored agent application foundation with governed runtime ports, durable cross-adapter conformance, isolated EVE integration, agent evals, and a reference application.
integrator
AgentSpec and WorkflowSpec now share one canonical runtime-adapter identity that includes `eve`; exhaustive adapter switches must handle the new key without importing EVE types into generic libraries.
maintainer
Durable stores, sandbox, file retrieval, subagent dispatch, collaboration leases, runtime parity, filesystem compilation, and eval evidence now have explicit package-local verification surfaces.
agent
Filesystem-authored applications can compile into portable AgentSpec and WorkflowSpec output, run bounded orchestrator/verifier flows, and emit replay-linked evaluation evidence.
enterprise-agent-platform
Add provider-adaptable multiplayer agents, governed self-improvement, continuous workers, self-maintaining APIs, and fail-closed enterprise qualification.
integrator
Compose the exact agent capabilities and enterprise controls required by a project, then choose or replace Vercel, Railway, Supabase, Docker, and custom profiles according to infrastructure, budget, security, and residency constraints.
maintainer
Qualify the exact digest-bound plan in each target environment and run multiplayer, improvement, maintenance, audit, recovery, and rollback workflows with live evidence.
managed-companyos-dynamic-intelligence-planning
Replace static Company Intelligence and OPA fixtures with authenticated, tenant-free dynamic surface descriptors and responsive managed templates.
integrator
Company Intelligence and Organization Planning pages now resolve authenticated authority per request and consume tenant-free server projections; no production route falls back to named-company fixtures.
maintainer
The additive surface descriptor accepts only a logical surface id and returns canonical route, route state, freshness, safe-read posture, action availability, and dependency blocks derived on the server.
managed-companyos-personal-team-contexts
Add non-shareable personal CompanyOS contexts and atomic opaque personal/company/team/workspace selection with request-time authority proof.
integrator
Authenticated users can operate in a personal context without a company and can atomically select any server-returned company, team, and workspace through opaque references.
maintainer
Context tokens bind session, user, projection, nonce, version, and expiry; explicit direct/team workspace grants constrain enumeration and selection, and protected requests fail closed when nested authority is stale.

Deprecations

- Runtime-local copies of the adapter-key union are deprecated; import the canonical identity from `@lssm-tech/lib.contracts-spec/runtime-adapters`.
- Treating a local child process as a production isolation boundary is unsupported; the local sandbox adapter is a development fixture only. Select the Docker adapter when the production containment suite and deployment prerequisites are satisfied.

Migration guide

Apply the personal and team context authority migrations
Required
Apply forward migrations 0029 and 0030 before deploying the context routes or enabling the production shell selector.
1. Apply migration 0029 followed by migration 0030.
2. Deploy the context authority routes and repository runtime.
3. Enable the production shell selector only after the migrations complete.
Handle the additive EVE adapter identity
Required
The closed AgentRuntimeAdapterKey union gained `eve` in both AgentSpec and WorkflowSpec.
When: When a consumer exhaustively switches over runtime adapter keys.
1. Add an `eve` branch or return an explicit unsupported/loss diagnostic.
2. Import the adapter identity from the canonical contracts-spec runtime-adapters subpath.
3. Keep EVE SDK types and imports inside the integration.eve composition boundary.
Preserve the sandbox isolation claim boundary
Required
The local-process adapter proves policy wiring and redaction, not operating-system containment.
When: Before selecting an AgentSandboxPort implementation for production.
1. Keep shell, network, mounts, and secrets deny-by-default.
2. Require containment-suite evidence before advertising an adapter as isolation-conformant.
3. Record unsupported capabilities and mapping losses instead of counting them as success.

Upgrade steps

Compose and qualify the target agent platform
manual
Built-in profiles are candidate templates, not production attestations. Pin the selected profiles, controls, and environment and qualify them before serving production traffic.
Packages: @lssm-tech/lib.contracts-spec, @lssm-tech/lib.ai-agent, @lssm-tech/lib.files, @lssm-tech/lib.agent-collaboration, @lssm-tech/integration.agent-durable-store, @lssm-tech/integration.workflow-devkit, @lssm-tech/integration.agent-sandbox, @lssm-tech/integration.eve, @lssm-tech/lib.execution-lanes, @lssm-tech/lib.agent-runtime-conformance, @lssm-tech/lib.agent-evals, @lssm-tech/agentpacks, @lssm-tech/lib.harness, @lssm-tech/integration.runtime, @lssm-tech/module.workspace, @lssm-tech/bundle.workspace, @lssm-tech/integration.provider-github, @lssm-tech/example.agent-application-foundation, @lssm-tech/app.worker-application-monolith, @lssm-tech/tool.bun, @lssm-tech/lib.contracts-runtime-core, @lssm-tech/bundle.library, @lssm-tech/app.web-landing
1. Select only the capabilities and provider profiles required by the project.
2. Bind authentication, tenant authority, secrets, durable storage, audit, observability, and budget controls in the host.
3. Run every required qualification suite against the exact target environment.
4. Pass the mandatory governance/security, supply-chain, observability-export, load/resilience, and clean-consumer-release baseline gates.
5. Accept intentional capability losses explicitly and retain the signed report with the plan digest.
6. Exercise pause, recovery, rollback, revocation, backup restore, and break-glass runbooks before promotion.
Qualify personal and nested context authority before canary
manual
Prove non-shareability, one-use switching, capability intersection, revocation denial, atomic audit, and tenant isolation on the target PostgreSQL topology.
Packages: @lssm-tech/lib.contracts-spec, @lssm-tech/app.api-application-monolith, @lssm-tech/app.web-application-monolith
1. Apply migration 0029 followed by migration 0030.
2. Run empty and populated migration replay against PostgreSQL 15.
3. Prove personal contexts reject invitations, teams, and additional members.
4. Prove existing workspaces receive explicit direct grants and ungranted workspaces are never listed or selected.
5. Prove stale or replayed tokens and revoked workspace/team grants cannot select or retain authority.
6. Qualify 1, 3, and 20-context mobile and desktop visual baselines before production promotion.
Qualify dynamic CompanyOS surfaces before canary
manual
Bind durable production dependencies and prove request authority, degraded behavior, responsive rendering, and tenant isolation in each target deployment.
Packages: @lssm-tech/lib.contracts-spec, @lssm-tech/app.api-application-monolith, @lssm-tech/bundle.managed-companyos, @lssm-tech/app.web-application-monolith
1. Bind the Company Intelligence PostgreSQL repositories and external model services.
2. Bind the persisted Organization Planning projection and provider-effect runtime.
3. Prove tenant and role resolution on every request with no shared browser cache.
4. Qualify loading, success, empty, error, degraded, unauthorized, and partial states.
5. Run mobile and desktop visual/usability baselines for LSSM, CompanyOS, and ND Consulting.
Validate the portable application surface
assisted
Compile the filesystem fixture, run package-local tests, and inspect the case-18 comparison artifact before enabling EVE.
Packages: @lssm-tech/agentpacks, @lssm-tech/lib.agent-evals, @lssm-tech/integration.agent-durable-store, @lssm-tech/lib.agent-runtime-conformance, @lssm-tech/integration.eve, @lssm-tech/example.agent-application-foundation
1. Run the agentpacks compiler tests and reference-application preflight.
2. Run the Workflow DevKit durable conformance gate and EVE integration-local conformance.
3. Confirm cases 16 and 17 remain explicitly not applicable with their stable reason codes.
4. Inspect declared losses and reject any unclassified case-18 difference.
Verify package artifacts outside the workspace
manual
No canary or stable release is implied by source-level validation; clean Node and Bun consumers remain a publication gate.
Packages: @lssm-tech/lib.contracts-spec, @lssm-tech/lib.ai-agent, @lssm-tech/lib.files, @lssm-tech/integration.agent-durable-store, @lssm-tech/integration.workflow-devkit, @lssm-tech/integration.agent-sandbox, @lssm-tech/integration.eve, @lssm-tech/lib.execution-lanes, @lssm-tech/lib.agent-runtime-conformance, @lssm-tech/lib.agent-evals, @lssm-tech/agentpacks, @lssm-tech/lib.harness, @lssm-tech/example.agent-application-foundation, @lssm-tech/tool.bun, @lssm-tech/lib.contracts-runtime-core
1. Build and pack the affected packages.
2. Install the tarballs in clean Node and Bun consumer fixtures.
3. Exercise public exports, both adapter fixtures, and a filesystem-generated application.
4. Publish a canary only after the clean-consumer matrix is recorded; do not promote a failed canary.

Unique release changes

- Add provider-adaptable multiplayer agents, governed self-improvement, continuous workers, self-maintaining APIs, and fail-closed enterprise qualification.
20 packages · 20 occurrences
- Built-in profiles are candidate templates, not production attestations. Pin the selected profiles, controls, and environment and qualify them before serving production traffic.
20 packages · 20 occurrences
- Add a contract-first, filesystem-authored agent application foundation with governed runtime ports, durable cross-adapter conformance, isolated EVE integration, agent evals, and a reference application.
12 packages · 12 occurrences
- Compile the filesystem fixture, run package-local tests, and inspect the case-18 comparison artifact before enabling EVE.
12 packages · 12 occurrences
- No canary or stable release is implied by source-level validation; clean Node and Bun consumers remain a publication gate.
12 packages · 12 occurrences
- Runtime-local copies of the adapter-key union are deprecated; import the canonical identity from `@lssm-tech/lib.contracts-spec/runtime-adapters`.
12 packages · 12 occurrences
- The closed AgentRuntimeAdapterKey union gained `eve` in both AgentSpec and WorkflowSpec.
12 packages · 12 occurrences
- The local-process adapter proves policy wiring and redaction, not operating-system containment.
12 packages · 12 occurrences
- Treating a local child process as a production isolation boundary is unsupported; the local sandbox adapter is a development fixture only. Select the Docker adapter when the production containment suite and deployment prerequisites are satisfied.
12 packages · 12 occurrences
- Bind durable production dependencies and prove request authority, degraded behavior, responsive rendering, and tenant isolation in each target deployment.
4 packages · 4 occurrences
- Replace static Company Intelligence and OPA fixtures with authenticated, tenant-free dynamic surface descriptors and responsive managed templates.
4 packages · 4 occurrences
- Add non-shareable personal CompanyOS contexts and atomic opaque personal/company/team/workspace selection with request-time authority proof.
3 packages · 3 occurrences
- Apply forward migrations 0029 and 0030 before deploying the context routes or enabling the production shell selector.
3 packages · 3 occurrences
- Prove non-shareability, one-use switching, capability intersection, revocation denial, atomic audit, and tenant isolation on the target PostgreSQL topology.
3 packages · 3 occurrences

Impacted packages

@lssm-tech/app.api-application-monolith
Layer: apps · 2 changes
@lssm-tech/app.web-application-monolith
Layer: apps · 2 changes
@lssm-tech/app.web-landing
Layer: apps · 2 changes
@lssm-tech/app.worker-application-monolith
Layer: apps · 2 changes
@lssm-tech/bundle.library
Layer: bundles · 2 changes
@lssm-tech/bundle.managed-companyos
Layer: bundles · 2 changes
@lssm-tech/bundle.workspace
Layer: bundles · 2 changes
@lssm-tech/integration.agent-durable-store
Layer: integrations · 7 changes
@lssm-tech/integration.agent-sandbox
Layer: integrations · 7 changes
@lssm-tech/integration.eve
Layer: integrations · 7 changes
@lssm-tech/integration.provider-github
Layer: integrations · 2 changes
@lssm-tech/integration.runtime
Layer: integrations · 2 changes
@lssm-tech/integration.workflow-devkit
Layer: integrations · 7 changes
@lssm-tech/lib.agent-collaboration
Layer: libs · 2 changes
@lssm-tech/lib.agent-evals
Layer: libs · 7 changes
@lssm-tech/lib.agent-runtime-conformance
Layer: libs · 7 changes
@lssm-tech/lib.ai-agent
Layer: libs · 7 changes
@lssm-tech/lib.contracts-runtime-core
Layer: libs · 7 changes
@lssm-tech/lib.contracts-spec
Layer: libs · 7 changes
@lssm-tech/lib.execution-lanes
Layer: libs · 7 changes
@lssm-tech/lib.files
Layer: libs · 7 changes
@lssm-tech/lib.harness
Layer: libs · 7 changes
@lssm-tech/module.workspace
Layer: modules · 2 changes