openvibers/openvibe.examples Commits

README and STATUS.json are current (roadmap WS-U task 3): the README gains Purpose, Capabilities (none implemented; the developer-app grants the examples use at Media, Events, Tools and Codes, and the chat bot's Live token), Security (SECURITY.md, env-only configuration, the public-surface and offline checks) and Deploy (nothing deployed; CI only) sections. The pins it names are the ones the packages use: openvibe-sdk v0.11.0 (was v0.4.0) and openvibe-contracts v0.49.0 for the mod manifest (was v0.28.0). STATUS.json names the same pins, gains deployed false and features, and is updated 2026-09-28. npm test passes on Node 22 (14/14).

OP OpenVibers committed 28 Sept 2026 · 92eb7c3b0f · 2 files, +47 −7





Changes
ddiff --git a/README.md b/README.md
iindex 6495f6e..36ace3b 100644
---- a/README.md
++++ b/README.md
@@@ -9,13 +9,19 @@ of them (Media, Events pull, a Tools job) against the real platform with your ow
  is not part of CI or `npm test`, and it was not run against production as part of this release.
  `npm run developer-path` is the Wave 20 exit check (account to Media and Events to revoked
  credentials); CI runs it against the mock platform, and a person runs it against production.  
--**Built on:** [openvibe-sdk v0.4.0](https://github.com/OpenVibers/OpenVibe.SDK/tree/v0.4.0), and
--openvibe-contracts v0.28.0 for the mod manifest.  
++**Built on:** [openvibe-sdk v0.11.0](https://github.com/OpenVibers/OpenVibe.SDK/tree/v0.11.0), and
++openvibe-contracts v0.49.0 for the mod manifest.  
  **Plan:** OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §15.1
  and §18.9; roadmap Wave 20, §30 (public SDK surface), ADR-014 (developer projects).  
  **License:** MIT ([LICENSE](LICENSE)), so you can copy any example into your own project. The
  OpenVibe services themselves are AGPL-3.0.
  
++## Purpose
++
++Show, with code a developer can copy, how an app outside the network uses OpenVibe: only the public
++SDK, scoped developer-app credentials and public APIs, never a loopback key or a first-party database.
++Each example is small, runs on its own and proves one thing with a smoke test.
++
  ## The examples
  
  | Example | What it proves | Uses |
@@@ -259,7 +265,7 @@ Repository checks (`test/`):
    value in a `.env.example`.
  - `structure.test.js` checks the nine examples are complete and copyable: README with "What it
    proves" and "Run it against the real platform", a `.env.example` that names every variable the
--  code reads, MIT license, `openvibe-sdk` pinned to the v0.4.0 tag, no `file:` links; and that
++  code reads, MIT license, `openvibe-sdk` pinned to the v0.11.0 tag, no `file:` links; and that
    `npm run e2e` is outside CI and `npm test` and refuses to start without its variables; and that
    CI runs the developer path against the mock platform only.
  - `developer-path.test.js` runs the developer path against the mock platform and checks the
@@@ -292,10 +298,19 @@ test/public-surface.test.js, test/structure.test.js
  
  ## Depends on
  
--- OpenVibe.SDK (v0.4.0), OpenVibe.Contracts (v0.28.0, mod manifest only)
++- OpenVibe.SDK (v0.11.0), OpenVibe.Contracts (v0.49.0, mod manifest only)
  - at run time against the real platform: Network (tokens, registry, developer projects), Events,
    Media, Tools, Chat (on openvibe.live)
  
++## Capabilities
++
++Examples implements no capability (its manifest lists none). The examples call the platform as a
++developer app with the grants a sandbox project asks for (`npm run new-app`): `media.object.upload`
++and `media.object.read` (Media), `events.app.publish`, `events.app.read` and `events.app.subscribe`
++(Events), and `tools.job.create`, `tools.job.read` and `tools.job.cancel` (Tools); a public browser app
++gets `media.object.read` only. The developer path check also uses `codes.release.manage` (Codes). The
++chat bot uses a Live `hbt_` token with scope `chat`, because `chat.message.send` is first-party.
++
  ## Acceptance
  
  - CI runs every example: **yes**, against the SDK's mock platform (and a small Chat WebSocket
@@@ -314,6 +329,21 @@ test/public-surface.test.js, test/structure.test.js
  - No example needs a loopback-only internal key or first-party database access: **yes**, enforced
    by `test/public-surface.test.js`.
  
++## Security
++
++Reporting a vulnerability: [SECURITY.md](SECURITY.md). Configuration is environment variables only;
++secrets are never logged or sent to a browser, and `.env.example` files hold names, not values
++(`test/public-surface.test.js` fails on a secret value there, on the loopback shared-key header and on
++internal routes or ports). Every smoke test replaces `fetch` with one that throws, so no test reaches the
++network. `npm run developer-path` refuses to run against production in CI.
++
++## Deploy
++
++Nothing is deployed from this repository: it has no unit, port or env file and is not published as a
++package. CI (`.github/workflows/ci.yml`) runs `npm test` and the developer path against the mock
++platform on every push. Copy an example, or start one with `create-openvibe-app`, and deploy it as your
++own app.
++
  ---
  
  Part of the [OpenVibe network](https://openvibe.network). Built in the open by [OpenVibers](https://github.com/OpenVibers).
ddiff --git a/STATUS.json b/STATUS.json
iindex d2403b0..612414a 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -4,8 +4,18 @@
    "code": true,
    "wave": "W20",
    "version": "0.3.0",
--  "sdk": "openvibe-sdk v0.4.0",
--  "contracts": "openvibe-contracts v0.28.0 (mod-manifest example)",
++  "sdk": "openvibe-sdk v0.11.0",
++  "contracts": "openvibe-contracts v0.49.0 (mod-manifest example)",
++  "deployed": false,
++  "deployment": "none: a repository with CI, not a runtime and not a published package",
++  "features": [
++    "nine copyable examples: browser app, Node server app, Media uploader, event subscriber, webhook consumer, tool job, OAuth app, chat bot, mod manifest",
++    "smoke tests against openvibe-sdk/testing's mock platform, offline",
++    "create-openvibe-app scaffolder",
++    "npm run e2e against the real platform (on demand)",
++    "developer path check (mock in CI, real on demand)",
++    "public-surface check: no loopback keys, internal routes or secret values"
++  ],
    "ci": "every example's smoke test runs on Node 22.22.1 against openvibe-sdk/testing's mock platform (developer-app rules for Events, Media and Tools as in production) plus a local Chat WebSocket mock; none reaches the network; a second job runs the developer path check (scripts/developer-path.js) against the same mock platform",
    "e2e": "npm run e2e runs media-uploader, event-subscriber (pull) and tool-job against the real platform with a sandbox app's OV_CLIENT_ID/OV_CLIENT_SECRET/OV_PROJECT_ID; on demand only, not in CI or npm test; not run against production as part of this release",
    "platform": "sandbox developer path (projects, sandbox grants, app tokens for openvibe.media/events/tools, Media project tenant, Events app.<project_key>.* events, Tools jobs, CORS-open discovery) verified in production on 2026-09-23 by the platform's W20 exit check (a curl script against the public endpoints); that check is now committed as npm run developer-path (SDK and examples, plus credential rotation, revocation and archive), which runs in CI against the mock platform and on demand against production (credentials from env only; refuses in CI against production); not yet run against production",
@@@ -17,5 +27,5 @@
      "mod publishing is first-party"
    ],
    "plan": "OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §15.1, §18.9; roadmap Wave 20, §30, ADR-014",
--  "updated": "2026-09-23"
++  "updated": "2026-09-28"
  }