STATUS names the contracts release the mod-manifest example pins (v0.209.0, not v0.126.0), and what still does not work drops the consent screen Network now shows (#27)

OP OpenVibers committed 22 days ago · be3e5845c6 · 3 files, +13 −12

Changes

ddiff --git a/README.md b/README.md
iindex 512100c..f0c07df 100644
---- a/README.md
++++ b/README.md
@@@ -9,7 +9,7 @@ of them (Media, Events pull, a Tools job) against the real platform with your ow
  is not part of CI or `npm test`, and it was not run against production as part of this release.
  `npm run developer-path` is the Wave 20 exit check (account to Media and Events to revoked
  credentials); CI runs it against the mock platform, and a person runs it against production.  
--**Built on:** [openvibe-sdk v0.60.0](https://github.com/OpenVibers/OpenVibe.SDK/tree/v0.37.2), and
++**Built on:** [openvibe-sdk v0.60.0](https://github.com/OpenVibers/OpenVibe.SDK/tree/v0.60.0), and
  openvibe-contracts v0.209.0 for the mod manifest.  
  **Plan:** OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §15.1
  and §18.9; roadmap Wave 20, §30 (public SDK surface), ADR-014 (developer projects).  
@@@ -223,8 +223,9 @@ and it refuses to run in CI against production.
  
  ## What still does not work
  
--- **No consent screen.** Network's account chooser names the app but does not list the
--  capabilities it asks for. Apps get no refresh tokens and learn only the person's `usr_…` id.
++- **No refresh tokens, and no profile.** Network's consent screen lists the capabilities an app asks for, and a
++  person who continues gives it a 5-minute app token with no refresh token. The app learns only the person's `usr_…`
++  id (`on_behalf_of`): profile lookups (`identity.subject.resolve`) are `first-party`.
  - **`/oauth/token` is not CORS-open**, like every Network route outside discovery and the
    registry, so a browser app exchanges its code on its own server
    ([browser-app](examples/browser-app) does).
@@@ -265,7 +266,7 @@ Repository checks (`test/`):
    value in a `.env.example`.
  - `structure.test.js` checks the nine examples are complete and copyable: README with "What it
    proves" and "Run it against the real platform", a `.env.example` that names every variable the
--  code reads, MIT license, `openvibe-sdk` pinned to one tag (the root package.json's, v0.37.2 now), no `file:` links; and that
++  code reads, MIT license, `openvibe-sdk` pinned to one tag (the root package.json's), no `file:` links; and that
    `npm run e2e` is outside CI and `npm test` and refuses to start without its variables; and that
    CI runs the developer path against the mock platform only.
  - `developer-path.test.js` runs the developer path against the mock platform and checks the
@@@ -298,7 +299,7 @@ test/public-surface.test.js, test/structure.test.js
  
  ## Depends on
  
--- OpenVibe.SDK (v0.37.2), OpenVibe.Contracts (v0.113.0, mod manifest only)
++- OpenVibe.SDK (v0.60.0), OpenVibe.Contracts (v0.209.0, mod manifest only)
  - at run time against the real platform: Network (tokens, registry, developer projects), Events,
    Media, Tools, Chat (on openvibe.live)
  
ddiff --git a/STATUS.json b/STATUS.json
iindex 6c6c614..74b0602 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -5,7 +5,7 @@
    "wave": "W20",
    "version": "0.3.0",
    "sdk": "openvibe-sdk v0.60.0",
--  "contracts": "openvibe-contracts v0.126.0 (mod-manifest example)",
++  "contracts": "openvibe-contracts v0.209.0 (mod-manifest example)",
    "deployed": false,
    "deployment": "none: a repository with CI, not a runtime and not a published package",
    "features": [
@@@ -21,12 +21,12 @@
    "e2e": "npm run e2e runs media-uploader, event-subscriber (pull) and tool-job against the real platform with a sandbox app's OV_CLIENT_ID/OV_CLIENT_SECRET/OV_PROJECT_ID; on demand only, not in CI or npm test; not run against production as part of this release",
    "platform": "sandbox developer path (projects, sandbox grants, app tokens for openvibe.media/events/tools, Media project tenant, Events app.<project_key>.* events, Tools jobs, CORS-open discovery) verified in production on 2026-09-23 by the platform's W20 exit check (a curl script against the public endpoints); that check is now committed as npm run developer-path (SDK and examples, plus credential rotation, revocation and archive), which runs in CI against the mock platform and on demand against production (credentials from env only; refuses in CI against production); not yet run against production",
    "not_working": [
--    "no consent screen; no refresh tokens or identity for apps",
++    "no refresh tokens for apps (an app token lasts 5 minutes), and an app learns only the person's usr_ id: profile lookups (identity.subject.resolve) are first-party",
      "/oauth/token is not CORS-open: browser apps exchange codes server-side",
      "chat.message.send is first-party: the chat bot uses a Live hbt_ token",
--    "production apps and allowances need staff",
--    "mod publishing is first-party"
++    "production apps and their allowances need staff (an admin manages a production app)",
++    "mod publishing is first-party (games.mod.manage)"
    ],
    "plan": "OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §15.1, §18.9; roadmap Wave 20, §30, ADR-014",
--  "updated": "2026-10-20"
++  "updated": "2026-10-22"
  }
ddiff --git a/examples/browser-app/README.md b/examples/browser-app/README.md
iindex e9ec3ff..8e1fca3 100644
---- a/examples/browser-app/README.md
++++ b/examples/browser-app/README.md
@@@ -68,6 +68,6 @@ Things to know:
  - **The server-side registry read is optional.** With `OV_REGISTRY_PROXY=1` the server also
    answers `/api/registry/services`, and the page falls back to it when the browser cannot reach
    Network. It is off by default because the registry is readable from the browser.
--- **No consent screen** yet (Network's account chooser does not list the capabilities), and an app
--  learns only the person's `usr_…` id: there is no identity-only sign-in for apps, and profile
++- **The app learns only the person's `usr_…` id.** Network's consent screen lists the capabilities
++  the app asks for (a request for none only tells the app which account signed in), and profile
    lookups are `first-party`.

diff --git a/README.md b/README.md

index 512100c..f0c07df 100644

--- a/README.md

+++ b/README.md

@@ -9,7 +9,7 @@ of them (Media, Events pull, a Tools job) against the real platform with your ow

is not part of CI or `npm test`, and it was not run against production as part of this release.

`npm run developer-path` is the Wave 20 exit check (account to Media and Events to revoked

credentials); CI runs it against the mock platform, and a person runs it against production.

-**Built on:** [openvibe-sdk v0.60.0](https://github.com/OpenVibers/OpenVibe.SDK/tree/v0.37.2), and

+**Built on:** [openvibe-sdk v0.60.0](https://github.com/OpenVibers/OpenVibe.SDK/tree/v0.60.0), and

openvibe-contracts v0.209.0 for the mod manifest.

**Plan:** OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §15.1

and §18.9; roadmap Wave 20, §30 (public SDK surface), ADR-014 (developer projects).

@@ -223,8 +223,9 @@ and it refuses to run in CI against production.

## What still does not work

-- **No consent screen.** Network's account chooser names the app but does not list the

- capabilities it asks for. Apps get no refresh tokens and learn only the person's `usr_…` id.

+- **No refresh tokens, and no profile.** Network's consent screen lists the capabilities an app asks for, and a

+ person who continues gives it a 5-minute app token with no refresh token. The app learns only the person's `usr_…`

+ id (`on_behalf_of`): profile lookups (`identity.subject.resolve`) are `first-party`.

- **`/oauth/token` is not CORS-open**, like every Network route outside discovery and the

registry, so a browser app exchanges its code on its own server

([browser-app](examples/browser-app) does).

@@ -265,7 +266,7 @@ Repository checks (`test/`):

value in a `.env.example`.

- `structure.test.js` checks the nine examples are complete and copyable: README with "What it

proves" and "Run it against the real platform", a `.env.example` that names every variable the

- code reads, MIT license, `openvibe-sdk` pinned to one tag (the root package.json's, v0.37.2 now), no `file:` links; and that

+ code reads, MIT license, `openvibe-sdk` pinned to one tag (the root package.json's), no `file:` links; and that

`npm run e2e` is outside CI and `npm test` and refuses to start without its variables; and that

CI runs the developer path against the mock platform only.

- `developer-path.test.js` runs the developer path against the mock platform and checks the

@@ -298,7 +299,7 @@ test/public-surface.test.js, test/structure.test.js

## Depends on

-- OpenVibe.SDK (v0.37.2), OpenVibe.Contracts (v0.113.0, mod manifest only)

+- OpenVibe.SDK (v0.60.0), OpenVibe.Contracts (v0.209.0, mod manifest only)

- at run time against the real platform: Network (tokens, registry, developer projects), Events,

Media, Tools, Chat (on openvibe.live)

diff --git a/STATUS.json b/STATUS.json

index 6c6c614..74b0602 100644

--- a/STATUS.json

+++ b/STATUS.json

@@ -5,7 +5,7 @@

"wave": "W20",

"version": "0.3.0",

"sdk": "openvibe-sdk v0.60.0",

- "contracts": "openvibe-contracts v0.126.0 (mod-manifest example)",

+ "contracts": "openvibe-contracts v0.209.0 (mod-manifest example)",

"deployed": false,

"deployment": "none: a repository with CI, not a runtime and not a published package",

"features": [

@@ -21,12 +21,12 @@

"e2e": "npm run e2e runs media-uploader, event-subscriber (pull) and tool-job against the real platform with a sandbox app's OV_CLIENT_ID/OV_CLIENT_SECRET/OV_PROJECT_ID; on demand only, not in CI or npm test; not run against production as part of this release",

"platform": "sandbox developer path (projects, sandbox grants, app tokens for openvibe.media/events/tools, Media project tenant, Events app.<project_key>.* events, Tools jobs, CORS-open discovery) verified in production on 2026-09-23 by the platform's W20 exit check (a curl script against the public endpoints); that check is now committed as npm run developer-path (SDK and examples, plus credential rotation, revocation and archive), which runs in CI against the mock platform and on demand against production (credentials from env only; refuses in CI against production); not yet run against production",

"not_working": [

- "no consent screen; no refresh tokens or identity for apps",

+ "no refresh tokens for apps (an app token lasts 5 minutes), and an app learns only the person's usr_ id: profile lookups (identity.subject.resolve) are first-party",

"/oauth/token is not CORS-open: browser apps exchange codes server-side",

"chat.message.send is first-party: the chat bot uses a Live hbt_ token",

- "production apps and allowances need staff",

- "mod publishing is first-party"

+ "production apps and their allowances need staff (an admin manages a production app)",

+ "mod publishing is first-party (games.mod.manage)"

"plan": "OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §15.1, §18.9; roadmap Wave 20, §30, ADR-014",

- "updated": "2026-10-20"

+ "updated": "2026-10-22"

}

diff --git a/examples/browser-app/README.md b/examples/browser-app/README.md

index e9ec3ff..8e1fca3 100644

--- a/examples/browser-app/README.md

+++ b/examples/browser-app/README.md

@@ -68,6 +68,6 @@ Things to know:

- **The server-side registry read is optional.** With `OV_REGISTRY_PROXY=1` the server also

answers `/api/registry/services`, and the page falls back to it when the browser cannot reach

Network. It is off by default because the registry is readable from the browser.

-- **No consent screen** yet (Network's account chooser does not list the capabilities), and an app

- learns only the person's `usr_…` id: there is no identity-only sign-in for apps, and profile

+- **The app learns only the person's `usr_…` id.** Network's consent screen lists the capabilities

+ the app asks for (a request for none only tells the app which account signed in), and profile

lookups are `first-party`.