openvibers/openvibe.contracts Commits

Add Host git-source routes and 0.87.0 release notes (#18)

OP OpenVibers committed 3 Oct 2026 · 98a7a8fa06 · 10 files, +402 −34

local checks ✓ 3/3 · CI ✓ 3/3 · review SHIP by DeepSeek harness

https://github.com/OpenVibers/OpenVibe.Contracts/pull/18

Changes

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex 68c92320..36d20625 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -4,7 +4,16 @@ All notable changes to `openvibe-contracts`. Releases are git tags (`vX.Y.Z`) th
  from `https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/<tag>`. Before v0.30.0,
  the notes were in the tag and commit messages (`git tag -n1`).
  
--## Unreleased
++## 0.87.0 — 2026-10-03
++
++**Host git sources** (plan T12 Stage B): a Host site may name a public Git source — provider, repository URL and branch;
++never a credential — and a site with a source also accepts a CI-built deploy at `/sites/:id/source/deploys` naming the
++ref and full `commit_sha`. That deploy is always a preview and records the commit as immutable provenance.
++- `host.site.manage` gains `GET`, `PUT` and `DELETE /api/v1/sites/:id/source`; `host.deploy.create` gains
++  `POST /api/v1/sites/:id/source/deploys`.
++- `host.deploy@1`: the `source` enum adds `preview` and `git`, and an optional `git` object carries `provider`,
++  `repo_url`, `ref` and a 40-hex `commit_sha`. New valid fixture `git`. Additive: every existing deploy stays valid,
++  and the object is present only on `source: git`.
  
  **The Bot service manifest** (plan T15 step 1; ADR-043; supersedes #8). OpenVibe.Bot has run on openvibe-ovh since
  2026-10-02 (`openvibe-bot.service`, `/opt/openvibe.bot`), and `ovhost validate` found no `bot` manifest to read its
@@@ -48,8 +57,6 @@ replica, the class set before and after a loss — never the object's bytes, tit
  already inside the streamable namespace; only the provider types changed. Valid and invalid fixtures for each, and
  `test/run.js` asserts every type Media produces starts with `media.`, is owned by `media` and is listed in its manifest.
  
--## 0.87.0 — 2026-10-03
--
  **User-owned trust class and the estate table** (plan T1 step 3; ADR-034 §5 control plane/data plane; the Fabric ADR,
  ADR-046, is still to write). A person's own node or machine is now a trust class of its own in Contracts, between
  `first-party` and `partner`. The SDK placement planner's runtime already honours an explicit `trust: ["user-owned"]`
ddiff --git a/contracts/host/deploy.v1.json b/contracts/host/deploy.v1.json
iindex 097ebe4d..85fee3ef 100644
---- a/contracts/host/deploy.v1.json
++++ b/contracts/host/deploy.v1.json
@@@ -45,9 +45,36 @@
      "source": {
        "enum": [
          "archive",
--        "files"
++        "files",
++        "preview",
++        "git"
        ]
      },
++    "git": {
++      "type": "object",
++      "required": [
++        "provider",
++        "repo_url",
++        "ref",
++        "commit_sha"
++      ],
++      "properties": {
++        "provider": {
++          "type": "string"
++        },
++        "repo_url": {
++          "type": "string"
++        },
++        "ref": {
++          "type": "string"
++        },
++        "commit_sha": {
++          "type": "string",
++          "pattern": "^[0-9a-f]{40}$"
++        }
++      },
++      "description": "Present on source git: the commit this deploy was built from (public provenance, never a credential)."
++    },
      "file_count": {
        "type": "integer",
        "minimum": 0
ddiff --git a/fixtures/host.deploy/invalid/bad-source.json b/fixtures/host.deploy/invalid/bad-source.json
iindex b8c31c09..043c7706 100644
---- a/fixtures/host.deploy/invalid/bad-source.json
++++ b/fixtures/host.deploy/invalid/bad-source.json
@@@ -4,7 +4,7 @@
    "project_id": "prj_01JAD1P2R3J4K5M6N7P8Q9R0S1",
    "state": "ready",
    "active": true,
--  "source": "git",
++  "source": "tarball",
    "file_count": 37,
    "total_bytes": 482113,
    "new_bytes": 20411,
ddiff --git a/fixtures/host.deploy/valid/git.json b/fixtures/host.deploy/valid/git.json
nnew file mode 100644
iindex 00000000..7c3c95a2
---- /dev/null
++++ b/fixtures/host.deploy/valid/git.json
@@@ -0,0 +1,21 @@
++{
++  "id": "dpl_01JAG7H8J9K0M1N2P3Q4R5S6T7",
++  "site_id": "site_01JAD2S3T4V5W6X7Y8Z9A0B1C2",
++  "project_id": "prj_01JAD1P2R3J4K5M6N7P8Q9R0S1",
++  "state": "ready",
++  "active": true,
++  "source": "git",
++  "git": {
++    "provider": "github",
++    "repo_url": "https://github.com/OpenVibers/example-site",
++    "ref": "refs/heads/main",
++    "commit_sha": "a3f1c9e0b4d2e6f8a1c3e5f7091b2d4f6a8c0e2f"
++  },
++  "file_count": 37,
++  "total_bytes": 482113,
++  "new_bytes": 20411,
++  "manifest_sha256": "a3f1c9e0b4d2e6f8a1c3e5f7091b2d4f6a8c0e2f4a6b8d0f2e4c6a8b0d2f4e6a",
++  "failure_code": null,
++  "created_by": "app:app_01JAD7A8B9C0D1E2F3G4H5J6K7",
++  "created_at": "2026-09-24T09:40:12.000Z"
++}
ddiff --git a/generated/json-schema/bundle.json b/generated/json-schema/bundle.json
iindex c9eb87db..199425a9 100644
---- a/generated/json-schema/bundle.json
++++ b/generated/json-schema/bundle.json
@@@ -56498,9 +56498,36 @@
            "source": {
              "enum": [
                "archive",
--              "files"
++              "files",
++              "preview",
++              "git"
              ]
            },
++          "git": {
++            "type": "object",
++            "required": [
++              "provider",
++              "repo_url",
++              "ref",
++              "commit_sha"
++            ],
++            "properties": {
++              "provider": {
++                "type": "string"
++              },
++              "repo_url": {
++                "type": "string"
++              },
++              "ref": {
++                "type": "string"
++              },
++              "commit_sha": {
++                "type": "string",
++                "pattern": "^[0-9a-f]{40}$"
++              }
++            },
++            "description": "Present on source git: the commit this deploy was built from (public provenance, never a credential)."
++          },
            "file_count": {
              "type": "integer",
              "minimum": 0
ddiff --git a/generated/openapi/host.json b/generated/openapi/host.json
iindex 219235a8..12575d62 100644
---- a/generated/openapi/host.json
++++ b/generated/openapi/host.json
@@@ -20,7 +20,7 @@
     "delete": {
      "operationId": "delete_api_v1_deploys_id",
      "summary": "Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner ",
--    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user.",
++    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "host.site"
      ],
@@@ -77,7 +77,7 @@
     "get": {
      "operationId": "get_api_v1_deploys_id",
      "summary": "Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys ",
--    "description": "**host.deploy.create** (first-party): Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys and their upload logs, activate a deploy and roll a site back to any earlier ready deploy (one atomic pointer switch). Also judged by the acting principal's project role (deployer or above); an app principal added to a project as deployer can deploy from CI.",
++    "description": "**host.deploy.create** (first-party): Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys and their upload logs, activate a deploy and roll a site back to any earlier ready deploy (one atomic pointer switch). Also judged by the acting principal's project role (deployer or above); an app principal added to a project as deployer can deploy from CI. A site with a Git source also accepts a CI-built deploy at /sites/:id/source/deploys naming the ref and full commit_sha; it is always a preview and records that commit as immutable provenance.",
      "tags": [
       "host.deploy"
      ],
@@@ -136,7 +136,7 @@
     "post": {
      "operationId": "post_api_v1_deploys_id_activate",
      "summary": "Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys ",
--    "description": "**host.deploy.create** (first-party): Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys and their upload logs, activate a deploy and roll a site back to any earlier ready deploy (one atomic pointer switch). Also judged by the acting principal's project role (deployer or above); an app principal added to a project as deployer can deploy from CI.",
++    "description": "**host.deploy.create** (first-party): Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys and their upload logs, activate a deploy and roll a site back to any earlier ready deploy (one atomic pointer switch). Also judged by the acting principal's project role (deployer or above); an app principal added to a project as deployer can deploy from CI. A site with a Git source also accepts a CI-built deploy at /sites/:id/source/deploys naming the ref and full commit_sha; it is always a preview and records that commit as immutable provenance.",
      "tags": [
       "host.deploy"
      ],
@@@ -202,7 +202,7 @@
     "get": {
      "operationId": "get_api_v1_deploys_id_log",
      "summary": "Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys ",
--    "description": "**host.deploy.create** (first-party): Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys and their upload logs, activate a deploy and roll a site back to any earlier ready deploy (one atomic pointer switch). Also judged by the acting principal's project role (deployer or above); an app principal added to a project as deployer can deploy from CI.",
++    "description": "**host.deploy.create** (first-party): Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys and their upload logs, activate a deploy and roll a site back to any earlier ready deploy (one atomic pointer switch). Also judged by the acting principal's project role (deployer or above); an app principal added to a project as deployer can deploy from CI. A site with a Git source also accepts a CI-built deploy at /sites/:id/source/deploys naming the ref and full commit_sha; it is always a preview and records that commit as immutable provenance.",
      "tags": [
       "host.deploy"
      ],
@@@ -386,7 +386,7 @@
     "get": {
      "operationId": "get_api_v1_projects",
      "summary": "Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner ",
--    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user.",
++    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "host.site"
      ],
@@@ -433,7 +433,7 @@
     "post": {
      "operationId": "post_api_v1_projects",
      "summary": "Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner ",
--    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user.",
++    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "host.site"
      ],
@@@ -489,7 +489,7 @@
     "delete": {
      "operationId": "delete_api_v1_projects_id",
      "summary": "Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner ",
--    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user.",
++    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "host.site"
      ],
@@@ -546,7 +546,7 @@
     "get": {
      "operationId": "get_api_v1_projects_id",
      "summary": "Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner ",
--    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user.",
++    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "host.site"
      ],
@@@ -605,7 +605,7 @@
     "delete": {
      "operationId": "delete_api_v1_projects_id_members_principal",
      "summary": "Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner ",
--    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user.",
++    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "host.site"
      ],
@@@ -670,7 +670,7 @@
     "put": {
      "operationId": "put_api_v1_projects_id_members_principal",
      "summary": "Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner ",
--    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user.",
++    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "host.site"
      ],
@@@ -744,7 +744,7 @@
     "get": {
      "operationId": "get_api_v1_projects_id_quota",
      "summary": "Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner ",
--    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user.",
++    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "host.site"
      ],
@@@ -801,7 +801,7 @@
     "put": {
      "operationId": "put_api_v1_projects_id_quota",
      "summary": "Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner ",
--    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user.",
++    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "host.site"
      ],
@@@ -867,7 +867,7 @@
     "get": {
      "operationId": "get_api_v1_projects_id_sites",
      "summary": "Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner ",
--    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user.",
++    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "host.site"
      ],
@@@ -924,7 +924,7 @@
     "post": {
      "operationId": "post_api_v1_projects_id_sites",
      "summary": "Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner ",
--    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user.",
++    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "host.site"
      ],
@@@ -990,7 +990,7 @@
     "delete": {
      "operationId": "delete_api_v1_projects_id_takedown",
      "summary": "Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner ",
--    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user.",
++    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "host.site"
      ],
@@@ -1047,7 +1047,7 @@
     "post": {
      "operationId": "post_api_v1_projects_id_takedown",
      "summary": "Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner ",
--    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user.",
++    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "host.site"
      ],
@@@ -1113,7 +1113,7 @@
     "delete": {
      "operationId": "delete_api_v1_sites_id",
      "summary": "Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner ",
--    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user.",
++    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "host.site"
      ],
@@@ -1170,7 +1170,7 @@
     "get": {
      "operationId": "get_api_v1_sites_id",
      "summary": "Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner ",
--    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user.",
++    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "host.site"
      ],
@@@ -1511,7 +1511,7 @@
     "get": {
      "operationId": "get_api_v1_sites_id_deploys",
      "summary": "Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys ",
--    "description": "**host.deploy.create** (first-party): Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys and their upload logs, activate a deploy and roll a site back to any earlier ready deploy (one atomic pointer switch). Also judged by the acting principal's project role (deployer or above); an app principal added to a project as deployer can deploy from CI.",
++    "description": "**host.deploy.create** (first-party): Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys and their upload logs, activate a deploy and roll a site back to any earlier ready deploy (one atomic pointer switch). Also judged by the acting principal's project role (deployer or above); an app principal added to a project as deployer can deploy from CI. A site with a Git source also accepts a CI-built deploy at /sites/:id/source/deploys naming the ref and full commit_sha; it is always a preview and records that commit as immutable provenance.",
      "tags": [
       "host.deploy"
      ],
@@@ -1568,7 +1568,7 @@
     "post": {
      "operationId": "post_api_v1_sites_id_deploys",
      "summary": "Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys ",
--    "description": "**host.deploy.create** (first-party): Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys and their upload logs, activate a deploy and roll a site back to any earlier ready deploy (one atomic pointer switch). Also judged by the acting principal's project role (deployer or above); an app principal added to a project as deployer can deploy from CI.",
++    "description": "**host.deploy.create** (first-party): Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys and their upload logs, activate a deploy and roll a site back to any earlier ready deploy (one atomic pointer switch). Also judged by the acting principal's project role (deployer or above); an app principal added to a project as deployer can deploy from CI. A site with a Git source also accepts a CI-built deploy at /sites/:id/source/deploys naming the ref and full commit_sha; it is always a preview and records that commit as immutable provenance.",
      "tags": [
       "host.deploy"
      ],
@@@ -1757,7 +1757,253 @@
     "post": {
      "operationId": "post_api_v1_sites_id_rollback",
      "summary": "Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys ",
--    "description": "**host.deploy.create** (first-party): Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys and their upload logs, activate a deploy and roll a site back to any earlier ready deploy (one atomic pointer switch). Also judged by the acting principal's project role (deployer or above); an app principal added to a project as deployer can deploy from CI.",
++    "description": "**host.deploy.create** (first-party): Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys and their upload logs, activate a deploy and roll a site back to any earlier ready deploy (one atomic pointer switch). Also judged by the acting principal's project role (deployer or above); an app principal added to a project as deployer can deploy from CI. A site with a Git source also accepts a CI-built deploy at /sites/:id/source/deploys naming the ref and full commit_sha; it is always a preview and records that commit as immutable provenance.",
++    "tags": [
++     "host.deploy"
++    ],
++    "x-openvibe-capabilities": [
++     "host.deploy.create"
++    ],
++    "x-openvibe-visibility": [
++     "first-party"
++    ],
++    "x-openvibe-quota-class": "host-deploy",
++    "security": [
++     {
++      "openvibeToken": [
++       "host.deploy.create"
++      ]
++     }
++    ],
++    "requestBody": {
++     "required": false,
++     "content": {
++      "application/json": {
++       "schema": {
++        "$ref": "#/components/schemas/host.deploy-create-request.v1"
++       }
++      }
++     }
++    },
++    "parameters": [
++     {
++      "name": "id",
++      "in": "path",
++      "required": true,
++      "schema": {
++       "type": "string"
++      }
++     }
++    ],
++    "responses": {
++     "2XX": {
++      "description": "Success",
++      "content": {
++       "application/json": {
++        "schema": {
++         "$ref": "#/components/schemas/host.deploy-create-result.v1"
++        }
++       }
++      }
++     },
++     "default": {
++      "description": "An error (RFC 9457 problem details)",
++      "content": {
++       "application/problem+json": {
++        "schema": {
++         "$ref": "#/components/schemas/errors.problem.v1"
++        }
++       }
++      }
++     }
++    }
++   }
++  },
++  "/api/v1/sites/{id}/source": {
++   "delete": {
++    "operationId": "delete_api_v1_sites_id_source",
++    "summary": "Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner ",
++    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
++    "tags": [
++     "host.site"
++    ],
++    "x-openvibe-capabilities": [
++     "host.site.manage"
++    ],
++    "x-openvibe-visibility": [
++     "first-party"
++    ],
++    "x-openvibe-quota-class": "host-manage",
++    "security": [
++     {
++      "openvibeToken": [
++       "host.site.manage"
++      ]
++     }
++    ],
++    "x-openvibe-input": {
++     "$ref": "#/components/schemas/host.site-manage-request.v1"
++    },
++    "parameters": [
++     {
++      "name": "id",
++      "in": "path",
++      "required": true,
++      "schema": {
++       "type": "string"
++      }
++     }
++    ],
++    "responses": {
++     "2XX": {
++      "description": "Success",
++      "content": {
++       "application/json": {
++        "schema": {
++         "$ref": "#/components/schemas/host.site-manage-result.v1"
++        }
++       }
++      }
++     },
++     "default": {
++      "description": "An error (RFC 9457 problem details)",
++      "content": {
++       "application/problem+json": {
++        "schema": {
++         "$ref": "#/components/schemas/errors.problem.v1"
++        }
++       }
++      }
++     }
++    }
++   },
++   "get": {
++    "operationId": "get_api_v1_sites_id_source",
++    "summary": "Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner ",
++    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
++    "tags": [
++     "host.site"
++    ],
++    "x-openvibe-capabilities": [
++     "host.site.manage"
++    ],
++    "x-openvibe-visibility": [
++     "first-party"
++    ],
++    "x-openvibe-quota-class": "host-manage",
++    "security": [
++     {
++      "openvibeToken": [
++       "host.site.manage"
++      ]
++     }
++    ],
++    "x-openvibe-input": {
++     "$ref": "#/components/schemas/host.site-manage-request.v1"
++    },
++    "parameters": [
++     {
++      "name": "id",
++      "in": "path",
++      "required": true,
++      "schema": {
++       "type": "string"
++      }
++     }
++    ],
++    "responses": {
++     "2XX": {
++      "description": "Success",
++      "content": {
++       "application/json": {
++        "schema": {
++         "$ref": "#/components/schemas/host.site-manage-result.v1"
++        }
++       }
++      }
++     },
++     "default": {
++      "description": "An error (RFC 9457 problem details)",
++      "content": {
++       "application/problem+json": {
++        "schema": {
++         "$ref": "#/components/schemas/errors.problem.v1"
++        }
++       }
++      }
++     }
++    }
++   },
++   "put": {
++    "operationId": "put_api_v1_sites_id_source",
++    "summary": "Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner ",
++    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
++    "tags": [
++     "host.site"
++    ],
++    "x-openvibe-capabilities": [
++     "host.site.manage"
++    ],
++    "x-openvibe-visibility": [
++     "first-party"
++    ],
++    "x-openvibe-quota-class": "host-manage",
++    "security": [
++     {
++      "openvibeToken": [
++       "host.site.manage"
++      ]
++     }
++    ],
++    "requestBody": {
++     "required": false,
++     "content": {
++      "application/json": {
++       "schema": {
++        "$ref": "#/components/schemas/host.site-manage-request.v1"
++       }
++      }
++     }
++    },
++    "parameters": [
++     {
++      "name": "id",
++      "in": "path",
++      "required": true,
++      "schema": {
++       "type": "string"
++      }
++     }
++    ],
++    "responses": {
++     "2XX": {
++      "description": "Success",
++      "content": {
++       "application/json": {
++        "schema": {
++         "$ref": "#/components/schemas/host.site-manage-result.v1"
++        }
++       }
++      }
++     },
++     "default": {
++      "description": "An error (RFC 9457 problem details)",
++      "content": {
++       "application/problem+json": {
++        "schema": {
++         "$ref": "#/components/schemas/errors.problem.v1"
++        }
++       }
++      }
++     }
++    }
++   }
++  },
++  "/api/v1/sites/{id}/source/deploys": {
++   "post": {
++    "operationId": "post_api_v1_sites_id_source_deploys",
++    "summary": "Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys ",
++    "description": "**host.deploy.create** (first-party): Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys and their upload logs, activate a deploy and roll a site back to any earlier ready deploy (one atomic pointer switch). Also judged by the acting principal's project role (deployer or above); an app principal added to a project as deployer can deploy from CI. A site with a Git source also accepts a CI-built deploy at /sites/:id/source/deploys naming the ref and full commit_sha; it is always a preview and records that commit as immutable provenance.",
      "tags": [
       "host.deploy"
      ],
@@@ -1823,7 +2069,7 @@
     "delete": {
      "operationId": "delete_api_v1_sites_id_takedown",
      "summary": "Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner ",
--    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user.",
++    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "host.site"
      ],
@@@ -1880,7 +2126,7 @@
     "post": {
      "operationId": "post_api_v1_sites_id_takedown",
      "summary": "Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner ",
--    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user.",
++    "description": "**host.site.manage** (first-party): Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "host.site"
      ],
@@@ -2273,9 +2519,36 @@
       "source": {
        "enum": [
         "archive",
--       "files"
++       "files",
++       "preview",
++       "git"
        ]
       },
++     "git": {
++      "type": "object",
++      "required": [
++       "provider",
++       "repo_url",
++       "ref",
++       "commit_sha"
++      ],
++      "properties": {
++       "provider": {
++        "type": "string"
++       },
++       "repo_url": {
++        "type": "string"
++       },
++       "ref": {
++        "type": "string"
++       },
++       "commit_sha": {
++        "type": "string",
++        "pattern": "^[0-9a-f]{40}$"
++       }
++      },
++      "description": "Present on source git: the commit this deploy was built from (public provenance, never a credential)."
++     },
       "file_count": {
        "type": "integer",
        "minimum": 0
ddiff --git a/generated/openapi/index.json b/generated/openapi/index.json
iindex 8ba4cf19..b81482db 100644
---- a/generated/openapi/index.json
++++ b/generated/openapi/index.json
@@@ -82,7 +82,7 @@
        "service": "host",
        "name": "OpenVibe.Host",
        "origin": "https://openvibe.host",
--      "operations": 30,
++      "operations": 34,
        "capabilities": 4
      },
      {
ddiff --git a/generated/typescript/index.d.ts b/generated/typescript/index.d.ts
iindex 55ed6ec7..524c9bef 100644
---- a/generated/typescript/index.d.ts
++++ b/generated/typescript/index.d.ts
@@@ -50329,7 +50329,16 @@ export interface HostDeploy {
    project_id: string;
    state: "ready" | "failed" | "deleted";
    active: boolean;
--  source: "archive" | "files";
++  source: "archive" | "files" | "preview" | "git";
++  /**
++   * Present on source git: the commit this deploy was built from (public provenance, never a credential).
++   */
++  git?: {
++    provider: string;
++    repo_url: string;
++    ref: string;
++    commit_sha: string;
++  };
    file_count: number;
    total_bytes: number;
    /**
ddiff --git a/manifests/capabilities/host.deploy.create.json b/manifests/capabilities/host.deploy.create.json
iindex 10b8fbf4..82f8dfcf 100644
---- a/manifests/capabilities/host.deploy.create.json
++++ b/manifests/capabilities/host.deploy.create.json
@@@ -4,7 +4,7 @@
    "owner": "host",
    "status": "active",
    "visibility": "first-party",
--  "description": "Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys and their upload logs, activate a deploy and roll a site back to any earlier ready deploy (one atomic pointer switch). Also judged by the acting principal's project role (deployer or above); an app principal added to a project as deployer can deploy from CI.",
++  "description": "Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys and their upload logs, activate a deploy and roll a site back to any earlier ready deploy (one atomic pointer switch). Also judged by the acting principal's project role (deployer or above); an app principal added to a project as deployer can deploy from CI. A site with a Git source also accepts a CI-built deploy at /sites/:id/source/deploys naming the ref and full commit_sha; it is always a preview and records that commit as immutable provenance.",
    "permissions": [
      "host:deploy"
    ],
@@@ -20,6 +20,7 @@
    "implementedBy": [
      "GET /api/v1/sites/:id/deploys",
      "POST /api/v1/sites/:id/deploys",
++    "POST /api/v1/sites/:id/source/deploys",
      "GET /api/v1/deploys/:id",
      "GET /api/v1/deploys/:id/log",
      "POST /api/v1/deploys/:id/activate",
ddiff --git a/manifests/capabilities/host.site.manage.json b/manifests/capabilities/host.site.manage.json
iindex a8202e9b..d3fa4a52 100644
---- a/manifests/capabilities/host.site.manage.json
++++ b/manifests/capabilities/host.site.manage.json
@@@ -4,7 +4,7 @@
    "owner": "host",
    "status": "active",
    "visibility": "first-party",
--  "description": "Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user.",
++  "description": "Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
    "permissions": [
      "host:write"
    ],
@@@ -25,6 +25,9 @@
      "GET /api/v1/projects/:id/sites",
      "POST /api/v1/projects/:id/sites",
      "GET /api/v1/sites/:id",
++    "GET /api/v1/sites/:id/source",
++    "PUT /api/v1/sites/:id/source",
++    "DELETE /api/v1/sites/:id/source",
      "DELETE /api/v1/sites/:id",
      "DELETE /api/v1/deploys/:id",
      "POST /api/v1/projects/:id/takedown",