ConusAI vendor v0.1.0-beta.114

2026-11-14 09:56:45 +00:00
commit 1ce8d23c35
867 changed files with 122104 additions and 0 deletions
@@ -0,0 +1,30 @@
+<!-- SPDX-License-Identifier: LicenseRef-ConusAI-Template-1.0 -->
+# Activities
+
+Status: Implementation in progress; disabled by default; live acceptance pending.
+
+`kit module:on activities` includes task creation/editing, complete/reopen, discussion and a
+project task timeline. It requests only Activities read/write and comment-write scopes. An
+owner/admin must separately enable the service and approve permissions; the current verified
+binding, compatible service release and dependencies must be ready. Convex is explicitly
+unsupported. Turning the module off retains service records.
+
+The adapter resolves the current server-prepared `RequestBusinessBinding` after app membership
+and permission checks. There is no deployment singleton or organization-wide fallback. The
+service enforces the complete app/environment partition; this module additionally derives the
+app project reference from resolved scope and refuses foreign-project task IDs before reads or
+mutations. Browser input cannot select a binding, actor, participant or arbitrary subject.
+
+Tasks and comments live only in the Activities service. Member participant references are opaque
+and attributable; scoped export/erasure and retained audit obligations remain mandatory. There
+is no duplicate app activity table, browser storage, default delete/administrative privacy grant,
+email transmission or AI processing. Pending scoped privacy/job/callback acceptance is a blocker,
+not proof that a legacy organization-only callback erased app data.
+
+Mutations use stable per-submission request UUIDs, project/operation namespaces and the revision
+shown to the reviewer. Task updates preserve fields the form does not edit. Service policy
+refusals are bounded app states; remote error bodies are never rendered or logged by this module.
+
+Run the packed-template gate and module isolation suite. Fake ports prove UI/contracts and
+project ownership handling only. J10/J14/J16/J18 require the real signed gateway, database runtime
+roles, persisted results, callbacks, privacy obligations and browser/API/MCP verification.