Merge pull request #38 from OpenVibers/agent/contracts-pr-35-branch-agent-contracts-r-234849-muuh2e8m

OP OpenVibers committed 5 Oct 2026 · b035660188 · 40 files, +697 −0

Use a low-entropy sample idempotency key in the resize fixture

Changes

ddiff --cc CHANGELOG.md
iindex b0ff7c80,8d77e297..c86f1582
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@@ -4,22 -4,18 +4,32 @@@ All notable changes to `openvibe-contra
   from `https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/<tag>`. Before v0.30.0,
   the notes were in the tag and commit messages (`git tag -n1`).
   
  +## 0.96.0 — 2026-10-04
  +
  +**OpenVibe.Bot's job dispatch for OpenVibe.Run** (plan T14 step 6, R1c): Run hands a job to a paired Node through Bot.
  +Additive, no breaking changes. One new internal, sensitive capability owned by bot, added to
  +`manifests/services/bot.json`: `bot.job.dispatch` (permission `bot:jobs`, resource constraint `project`, input
  +`platform.job@1`, events `run.job.*`). Service-to-service only (Run's service token); never granted to an app or mod and
  +never delegated to people. It names three routes, so `generated/openapi/bot.json` carries them:
  +  - `POST /api/v1/jobs` `{node_id, job, project_id, subject, provider}` dispatches a job (idempotent by job id;
  +    `project_id` is required).
  +  - `POST /api/v1/jobs/:id/cancel` cancels it.
  +  - `GET /api/v1/jobs/:id` returns its state, stdout included.
  +
  +Its `outputSchema` is a recorded gap in `compatibility/capability-schema-gaps.json` until Bot's answer shapes land.
  +
   ## 0.95.0 — 2026-10-04
   
++ **The Services control plane** (ADR-048, plan T13 step 1). Additive: three new catalog ids at 1.0.0, owner `contracts`.
++ `common.resource-name@1` is the OVRN `ovrn:<service>:<project_id>:<type>/<id>`, with the pattern `common.usage-recorded@1`
++ and `common.resource-summary@1` already use. `common.resource-control-request@1` is one control operation OpenVibe.Services
++ sends to the authority that owns a resource (`action`, `resource` or, for `create`, `resource_kind`, `project_id`,
++ `idempotency_key`, optional `params`, `on_behalf_of`, `confirmation_id`, `dry_run`, `trace_id`), and
++ `common.resource-control-result@1` the authority's answer (`state` done, pending, refused or failed, with `result`,
++ `confirmation_required` or an `errors.problem@1`). New `contracts.resources`: `parse`, `format`, `nameOf`, `checkName`,
++ `checkControlRequest` (the resource's project is `project_id`; `create` names a kind, every other action a resource) and
++ `checkControlResult` (`problem` and `confirmation_required` fit `state`). New test `test/resources.test.js`.
++ 
   **OpenVibe.Chat's internal read API** (plan T3, J4b): OpenVibe.Live stops reading its mirrored copy of Chat's tables.
   Additive. Six new internal capabilities owned by chat (loopback, Chat service token, Live's principal today; never
   granted to an app or delegated), added to `manifests/services/chat.json`:

diff --cc CHANGELOG.md

index b0ff7c80,8d77e297..c86f1582

--- a/CHANGELOG.md

+++ b/CHANGELOG.md

@@@ -4,22 -4,18 +4,32 @@@ All notable changes to `openvibe-contra

from `https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/<tag>`. Before v0.30.0,

the notes were in the tag and commit messages (`git tag -n1`).

+## 0.96.0 — 2026-10-04

+**OpenVibe.Bot's job dispatch for OpenVibe.Run** (plan T14 step 6, R1c): Run hands a job to a paired Node through Bot.

+Additive, no breaking changes. One new internal, sensitive capability owned by bot, added to

+`manifests/services/bot.json`: `bot.job.dispatch` (permission `bot:jobs`, resource constraint `project`, input

+`platform.job@1`, events `run.job.*`). Service-to-service only (Run's service token); never granted to an app or mod and

+never delegated to people. It names three routes, so `generated/openapi/bot.json` carries them:

+ - `POST /api/v1/jobs` `{node_id, job, project_id, subject, provider}` dispatches a job (idempotent by job id;

+ `project_id` is required).

+ - `POST /api/v1/jobs/:id/cancel` cancels it.

+ - `GET /api/v1/jobs/:id` returns its state, stdout included.

+Its `outputSchema` is a recorded gap in `compatibility/capability-schema-gaps.json` until Bot's answer shapes land.

## 0.95.0 — 2026-10-04

+ **The Services control plane** (ADR-048, plan T13 step 1). Additive: three new catalog ids at 1.0.0, owner `contracts`.

+ `common.resource-name@1` is the OVRN `ovrn:<service>:<project_id>:<type>/<id>`, with the pattern `common.usage-recorded@1`

+ and `common.resource-summary@1` already use. `common.resource-control-request@1` is one control operation OpenVibe.Services

+ sends to the authority that owns a resource (`action`, `resource` or, for `create`, `resource_kind`, `project_id`,

+ `idempotency_key`, optional `params`, `on_behalf_of`, `confirmation_id`, `dry_run`, `trace_id`), and

+ `common.resource-control-result@1` the authority's answer (`state` done, pending, refused or failed, with `result`,

+ `confirmation_required` or an `errors.problem@1`). New `contracts.resources`: `parse`, `format`, `nameOf`, `checkName`,

+ `checkControlRequest` (the resource's project is `project_id`; `create` names a kind, every other action a resource) and

+ `checkControlResult` (`problem` and `confirmation_required` fit `state`). New test `test/resources.test.js`.

**OpenVibe.Chat's internal read API** (plan T3, J4b): OpenVibe.Live stops reading its mirrored copy of Chat's tables.

Additive. Six new internal capabilities owned by chat (loopback, Chat service token, Live's principal today; never

granted to an app or delegated), added to `manifests/services/chat.json`: