ContractSpecContractSpec

Start with OSS

Back to changelog index

14.4.0

Aug 03, 2026 · 6 packages · 3 unique changes · 1 release entry

appsbundleslibs

This release affects the contracts, sharedLibs, solutions familyies.

Run contractspec connect adoption resolve --family contracts to see how it impacts your project.

Release summaries

  • managed-companyos-authos-seed-profiles

    Add explicit seed profiles, multi-email AuthOS identity authority, private personal workspaces, and fail-closed OPA/CommunicationOS entitlements.

    maintainer

    Live seed and bootstrap commands now require an explicit MANAGED_COMPANYOS_SEED_PROFILE. Use lssm-hirly for only LSSM and Hirly; legacy-reference preserves LSSM, CompanyOS, and NDconsulting.

    customer

    The same account can authenticate with tboutron@lssm.co or theo@tryhirly.com and owns isolated LSSM and Hirly memberships with only OPA and CommunicationOS visible.

    maintainer

    AuthOS email addresses, membership-email bindings, workspace module entitlements, join policies, and profile-specific receipts are durable authority surfaces. Public signup stays fail-closed until every external evidence reference and Turnstile configuration is present.

Migration guide

  • Select the live seed profile explicitly

    Required

    Live bootstrap, seed, and verification no longer infer a profile.

    1. Apply migrations 0038 through 0041 after the canonical migration preflight succeeds.
    2. Set MANAGED_COMPANYOS_SEED_PROFILE to legacy-reference, lssm-hirly, or all.
    3. Run companyos:bootstrap-admin before companyos:db:seed:live.
    4. Run companyos:db:verify:live and retain the profile-specific receipts.

Upgrade steps

  • Do not promote public signup from local evidence

    manual

    Promotion is an operator decision requiring all live and human evidence references, not merely a passing build.

    Packages: @lssm-tech/lib.contracts-spec, @lssm-tech/lib.authos-spec, @lssm-tech/lib.authos-runtime, @lssm-tech/app.api-application-monolith, @lssm-tech/app.web-application-monolith, @lssm-tech/bundle.managed-companyos

    1. Keep MANAGED_COMPANYOS_PUBLIC_SIGNUP_ENABLED unset until every evidence reference exists.
    2. Configure the Turnstile secret and exact production hostname allowlist.
    3. Verify alias delivery, personal provisioning, module denial, and session authority against live PostgreSQL.
    4. Qualify OAuth alias linking, verified-domain joining, and access-request approval against the deployed identity provider.

Unique release changes

  • - Add explicit seed profiles, multi-email AuthOS identity authority, private personal workspaces, and fail-closed OPA/CommunicationOS entitlements.

    6 packages · 6 occurrences

  • - Live bootstrap, seed, and verification no longer infer a profile.

    6 packages · 6 occurrences

  • - Promotion is an operator decision requiring all live and human evidence references, not merely a passing build.

    6 packages · 6 occurrences

Impacted packages

  • @lssm-tech/app.api-application-monolith

    Layer: apps · 3 changes

  • @lssm-tech/app.web-application-monolith

    Layer: apps · 3 changes

  • @lssm-tech/bundle.managed-companyos

    Layer: bundles · 3 changes

  • @lssm-tech/lib.authos-runtime

    Layer: libs · 3 changes

  • @lssm-tech/lib.authos-spec

    Layer: libs · 3 changes

  • @lssm-tech/lib.contracts-spec

    Layer: libs · 3 changes