v0.33.0: ADR-027 Tools platform API; CHANGELOG, README and version 0.33.0

OP OpenVibers committed 23 Sept 2026 · tag v0.33. · 0 files, +0 −0

ADR-027 records the decisions of the Tools platform program:
- One descriptor per tool and one run API. Inline answers, or a job with 202 + Location. File results always come from a job. Inputs can reference Media objects or the caller's own job results.
- The gateway fronts the jobs API.
- Browser-only pure transforms may get an opt-in server engine, and their pages stay browser-only.
- yt is page-only (api false; YouTube's terms and legal exposure).
- Caller tiers: anonymous (IP, IPv6 /64) < session < user < app/service. Anonymous use is open; heavy job types need a session or a token; sandbox tokens keep their small allowance.
- Weighted quotas per class. Class names describe the work, never a tier or a price, so paid tiers can come later.
- Only one proxy hop is trusted for the client IP; a client-sent X-Forwarded-For is never trusted.
- A no-op challenge hook for a later Turnstile.
- Network probes need tools.net.probe (partner: staff-set allowances only). People keep the probe pages, which have a per-target throttle.
- The abuse log holds HMAC-SHA256(IP, daily salt, discarded after its day) plus the subject, tool and reason, kept 30 days and never raw IPs: pseudonymous security data under ADR-021, never joined into analytics.
- Legacy /api/process, /api/net/* and /api/dev/* keep working with Deprecation: true, Sunset: Thu, 31 Dec 2026 23:59:59 GMT and Link rel=successor-version.
- Honest statuses (unavailable until qpdf and poppler-utils are deployed).

The ADR also lists alternatives, the migration order (slices), rollback and acceptance tests.

README: counts (95 schemas, 176 capabilities), a Tools platform API section, and tools.job.* no longer described as planned. ADR index row. package.json and package-lock.json are 0.33.0.

This commit has no diff to show.