@open-matrix/system-platform (1.1.32)
Installation
@open-matrix:registry=npm install @open-matrix/system-platform@1.1.32"@open-matrix/system-platform": "1.1.32"About this package
System Platform
The platform hosts the Registry and tenant facades for centrally served operations.
Hosted facades derive the home from the delivered subject, refuse a conflicting payload
root, and forward that home to the operation owner. $introspect describes the owner's
schemas narrowed to the operations actually exposed by the facade.
The hosted Registry import shares NATS request-info and receives the requester identity and the
runtime id/subtrees signed into newly issued runtime credentials. Registry claims derive their
owning scope from those broker-supplied tags only when the claimed provider runtime id matches the
signed id and the claim mount is inside a signed subtree. No subtree fallback is permitted. Older
tagless credentials remain valid and are limited to the home proven by the imported subject.
Same-account delivery supplies no request-info header, so the hosted provider overwrites its private
handoff before forwarding to the central Registry owner. The real-broker boundary is locked by
broker-caller-identity.spec.ts; envelope from remains diagnostic and cannot authorize a scope.
The capabilities facade includes capability.access.list alongside explanation,
publication and request/response operations. It stamps the delivered home and
retains the caller's bus token; the capabilities owner verifies ownership before
listing that home's published operations. Membership alone does not authorize a list.
Hosted home owner
System Platform binds one hosted-home fan-in and maintains a bounded set of in-process tenant Home actor trees behind it. The delivered subject chooses the tenant; each tree retains its own actor references, and an evicted tenant is rehydrated from those retained references when its next request arrives. A caller cannot choose a different home through payload data.
Demos lesson H7, You leads to your private Profile, is the executable owner proof.
Its canonical packaged source is
applications/demos/src/catalogue/home-profile.ts, and
applications/demos/tests/home-profile.spec.ts executes that exact program through the
fan-in, hosted Home tree and platform Profile door. The lesson follows the private
home.projections.you answer's qualified reference and prints only display name and
current-home role. It does not display email, API keys, bearer material or other credentials.
Focused owner behavior is covered by
src/__tests__/hosted-home-actor-tree.spec.ts; broker authorization and tenant-scoped
profile/API-key imports are covered by
services/platform/identity/system-auth/src/__tests__/nats-authority-factory.spec.ts.
The installed canonical-program acceptance source is
tests/browser-regression/journeys/home-profile.journey.spec.ts; the independent
Settings browser journey is tests/browser-regression/journeys/settings-tree.journey.spec.ts.
The Profile's Form loads through the ordinary hosted application byte provider.
Its declared per-view module and digest chunks retain their exact module IDs;
only a cached main-entry revision follows the hosted release pointer. Replacing
a Form request with the package's main bundle is not a successful view load.
hosted-facade-description.spec.ts covers that forwarding distinction, and
package-runtime's projection/asset tests check that advertised views are served.
Application releases
The application-release owner stores immutable package trees and a durable catalog under the component store. Release, install, update, rollback, uninstall, withdraw, and delete are audited operations. If Directory, Registry, or Audit refuses after a local change, the owner restores the preceding catalog or installation record before returning the refusal and removes or restores the matching home projection. Compensation is guarded by the attempted digest/version so it cannot overwrite a newer concurrent result. Every lifecycle mutation also carries an owner settlement deadline into the durable store; expired writes are refused or restored before the Profile caller can time out. An identical release retry reuses the already verified immutable tree. Withdrawal applies to every stored version of the application: new installs stop, while an already installed version remains readable from its immutable package tree and is identified as withdrawn. Uninstall removes that home's projection and retained-version entitlement. A verified maker may then delete an owned withdrawn version only when no home retains it; deletion removes its exact catalogue record and immutable tree, and restores both if Audit refuses. The release owner authorizes visibility against the token-derived home authority: verified members may release privately or to that home, while platform-wide visibility requires a home owner or administrator. Caller-supplied principal, role, and administrator fields are ignored.
Scoped state
system.blackboard keeps hosted state tenant-bound by the authority root derived from the
called subject. state.read returns an opaque revision for the exact resolved key, and callers
pass that token (or null for a verified miss) to the distinct state.compare-and-set operation.
Only the matching writer is applied and emits state.changed; a stale contender receives the
current revision without overwriting the winner. During an upgrade, the shared web.canvas.manifest
key also accepts the old state.upsert operation when it carries a valid explicit revision and routes
it through the same atomic compare-and-set. Unfenced legacy writes remain refused. Payload identity
never selects tenant custody.
Notifications
system.notifications is a reserved central service, owned by
@open-matrix/system-notifications. Its hosted facade forwards notification.post,
notification.list, notification.acknowledge, notification.acknowledge.all,
and notification.watch, plus announcement.post, announcement.list and
announcement.withdraw. Announcement writes still require a verified platform operator;
the home facade conveys no operator authority. Account purge and canonical source
reconciliation stay on the central owner and are not advertised to homes. Authentication
is enforced by the notification owner.
notification.watch supplies bounded replay; subscribers consume notification.changed
on their home's system.notifications event channel. The platform re-exports each
change only to the home named by the owner's event. Registry changes use the same
fanout helper, with the Registry's namespace field. Every fanout subscription is
released with the hosted bindings.
The service-import request and event subjects, credential plan and account
export/import plans derive from @open-matrix/subjects; the platform manifest names
its hosted import mounts. Updating source does not change issued credentials.
Operator facts
registry.platform.claims.count reports the Registry owner's durable service-claim count.
It verifies the caller's platform.operator grant with system.auth; a refusal names that
grant and owner. The Auth Console reaches the operation through the profile facade and the
well-known Registry mount, never by reading Registry storage directly.
Audit reads
The system.audit facade exposes $ping, $introspect, audit.query, audit.get,
audit.list and the narrow audit.renderer.decision.append. It stamps the delivered home and retains the caller's proof for
owner verification. Append, verification and status stay central-only. Operators
using the home facade see that home by default; allHomes: true explicitly asks
the audit owner to verify operator authority and query every home. The schema-bounded renderer
decision write admits a verified same-home bus caller; generic append remains hidden and
scope-protected. No audit change fanout is installed.
Fleet
The hosted Tickets door forwards tickets.integration.admit with the original
caller proof and exact candidate/generation. Central Tickets still decides
submission or retained-operation observation; forwarding grants no integration
authority. If a checked Fleet candidate is waiting, inspect its retained Task
integration reference rather than starting another worker. The installed Demos
lesson S30 — Run a Fleet ticket through its owners follows that same route;
S27 reads its integration operation. hosted-namespace-surface.spec.ts verifies
the declared Tickets desk reaches its owner and preserves owner refusals.
Hosted homes receive system.fleet status.get through the same subject-stamped
service-import facade as Registry. The snapshot reads only the called home's
Registry, never the platform's roster. Hosted snapshots distinguish a live lease
(unknown response status) from missing or ambiguous claims (stale); Fleet Desk
probes status.get from the home to determine whether each agent answers.
Standalone Fleet also discovers plain agents.codex.<machine> claims. Their
machine is the final segment and environment is absent. It checks the proof-less
status.get identity (mount and authority root) and the live lease before
reporting present; that answer carries no path, check output or session. Existing environment
custodians retain their environment-scoped status and availability checks.
The fleet.agent-workstreams export exposes the existing Blackboard read, list and upsert operations to declared agent publishers. Workstream rows remain coordination observations, never locks or dispatch gates.
Dependencies
Dependencies
| ID | Version |
|---|---|
| @open-matrix/contracts | 1.1.32 |
| @open-matrix/core | 1.1.32 |
| @open-matrix/credential-plane | 1.1.32 |
| @open-matrix/package-artifacts | 1.1.32 |
| @open-matrix/package-runtime | 1.1.32 |
| @open-matrix/subjects | 1.1.32 |
| @open-matrix/system-directory | 1.1.32 |
| @open-matrix/system-postgres | 1.1.32 |
| @open-matrix/system-registry | 1.1.32 |
| @open-matrix/system-security | 1.1.32 |
| @open-matrix/system-sqlite | 1.1.32 |
Development Dependencies
| ID | Version |
|---|---|
| @matrix/runtime-host-engine | 1.1.32 |
| @matrix/test-utils | 1.1.32 |
| @open-matrix/codex-agent | 1.1.32 |
| @open-matrix/host-control | 1.1.32 |
| @open-matrix/interface-renderer | 1.1.32 |
| @open-matrix/nats-auth | 1.1.32 |
| @open-matrix/system-audit | 1.1.32 |
| @open-matrix/system-auth | 1.1.32 |
| @types/node | ^25.0.10 |
| esbuild | ^0.25.0 |
| nats | ^2.29.3 |
| tsx | ^4.0.0 |
| typescript | ^5.3.0 |