openvibers/openvibe.host Commits

Adopt the D41 docs-status check (Shared 2.9.0 workflows) (#21)

OP OpenVibers committed 5 Oct 2026 · 153129c7af · 3 files, +26 −12

**Files changed**

- `.github/workflows/ci.yml`: bumped both `OpenVibe.Shared` reusable-workflow refs (test.yml line 9 and security.yml line 21) from `423fe519…` to `aa570e4815063dc65624a6a486038d83ff6f6ec0` (Shared 2.9.0), and added `docs-status: true` under the test job's `with:` so the D41 check runs.
- `STATUS.json`: ran Shared's `scripts/docs-status.js`, which rewrote `contracts` to v0.83.0, inserted `sdk` v0.26.0 and `shared` v2.6.0, moved/updated `updated`, and renormalized the file's JSON formatting; I also brought the `packages` array in line (v0.83.0 / v0.26.0 / v2.6.0) so the file no longer contradicts the fields the check owns.
- `README.md`: the script appended the `<!-- versions:start --> … <!-- versions:end -->` block (openvibe-contracts v0.83.0, openvibe-sdk v0.26.0, openvibe-shared v2.6.0); I updated the four current-pin prose mentions that would otherwise contradict it (Depends-on contracts/sdk, Events sdk, Grants contracts). Historical/since-versions and the pre-existing lifecycle note at line 207 were left alone.

**Test commands run**

- `git -C ~/OpenVibers/OpenVibe.Shared show origin/main:scripts/docs-status.js | node - <worktree> --check` → exit 0, "docs are current" (contracts/sdk/shared ok, README versions ok).
- Same script in write mode (`update`) → wrote nothing / all ok, confirming idempotency after my manual edits.
- `python3 -c "import yaml; yaml.safe_load(...)"` on ci.yml → `ci.yml: YAML ok`.
- `node -e "JSON.parse(...)"` on STATUS.json → `STATUS.json: JSON ok`.
- No `ov test` files are reached: no test reads STATUS.json/README.md/ci.yml (the matches in `test/*` are fixture filenames only), so there is no test file for this change; the acceptance test is the shared docs-status script itself.

**Could not do**

- The literal `curl -fsSL https://raw.githubusercontent.com/OpenVibers/OpenVibe.Shared/main/scripts/docs-status.js | node - . --check` — Bash network egress was denied in this sandbox. I ran the identical bytes instead from the local Shared `origin/main` git object, whose HEAD is `aa570e4815063dc65624a6a486038d83ff6f6ec0` (the same commit `main` points to, version 2.9.0), so the check result is equivalent.
- `updated` came out as `2026-10-05` because the script stamps `new Date().toISOString()` (UTC); the session's local date is 2026-10-04. The check does not validate `updated`, so I kept the generator's output rather than hand-editing it.
- README line 207 still contains a pre-existing, behavior-coupled claim ("still pins openvibe-contracts v0.49.0 … `validate` reports every service as undeclared") that is now false; fixing it accurately needs a `validate` run and is outside the D41 docs-status scope, so I left it untouched.

Changes

ddiff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
iindex eee4be6..871bc46 100644
---- a/.github/workflows/ci.yml
++++ b/.github/workflows/ci.yml
@@@ -6,7 +6,7 @@ on:
  jobs:
    # install, node --check, npm test and openvibe-contracts-check: the shared test job (Track Q).
    test:
--    uses: OpenVibers/OpenVibe.Shared/.github/workflows/test.yml@423fe519b5fe9594cc81b670e5ba5cb9f21f6176
++    uses: OpenVibers/OpenVibe.Shared/.github/workflows/test.yml@aa570e4815063dc65624a6a486038d83ff6f6ec0
      with:
        syntax-dirs: lib server
        contracts-service: host
@@@ -14,7 +14,8 @@ jobs:
        # scripts/test-services.sh). npm test runs every file on PGlite; test:pg runs them all through PgBouncer.
        test: 'eval "$(node_modules/openvibe-sdk/scripts/test-services.sh up)" && npm test && npm run test:pg'
        contracts-src: lib server
++      docs-status: true
        extra: node --check bin/ovhost && for f in scripts/*.sh; do bash -n "$f"; done
    # Secret scan (gitleaks) and dependency audit, shared by every OpenVibers repo (Track Q).
    security:
--    uses: OpenVibers/OpenVibe.Shared/.github/workflows/security.yml@423fe519b5fe9594cc81b670e5ba5cb9f21f6176
++    uses: OpenVibers/OpenVibe.Shared/.github/workflows/security.yml@aa570e4815063dc65624a6a486038d83ff6f6ec0
ddiff --git a/README.md b/README.md
iindex b882888..908e06b 100644
---- a/README.md
++++ b/README.md
@@@ -49,9 +49,9 @@ Stage A adds a few safety rules of its own:
  
  ## Depends on
  
--- OpenVibe.Contracts (`openvibe-contracts` v0.79.0; `host.*` capabilities and the `host` manifest were released in v0.24.0, and v0.32.0 adds the takedown routes to `host.site.manage`): service manifests (vhost rendering, snapshots, the first-party domain list), ids, problem+json, service-token verification, capability checks.
++- OpenVibe.Contracts (`openvibe-contracts` v0.83.0; `host.*` capabilities and the `host` manifest were released in v0.24.0, and v0.32.0 adds the takedown routes to `host.site.manage`): service manifests (vhost rendering, snapshots, the first-party domain list), ids, problem+json, service-token verification, capability checks.
  - OpenVibe.Network (Stage B): SSO for the dashboard, the JWKS that verifies user and service tokens, client-credentials tokens for the outbox relay.
--- OpenVibe.Events (Stage B): `host.*` events through the `openvibe-sdk` v0.25.0 transactional outbox (openvibe-sdk/limits for the per-actor limits).
++- OpenVibe.Events (Stage B): `host.*` events through the `openvibe-sdk` v0.26.0 transactional outbox (openvibe-sdk/limits for the per-actor limits).
  - `openvibe-shared` v2.6.0 (Stage B): shared chrome (Host's own pages are composed with `openvibe-shared/shell`), legal pages, `/release.json`, `/metrics`, `/api/ready`.
  - OpenVibe.Media: not yet. The roadmap stores artifacts "through Media where practical"; Stage B keeps them on local disk for now (see [Not done yet](#not-done-yet-stage-b)).
  
@@@ -355,7 +355,7 @@ jobs:
  
  ### Events
  
--Through the `openvibe-sdk` v0.25.0 transactional outbox (`event_outbox`), inside the transaction that makes the change:
++Through the `openvibe-sdk` v0.26.0 transactional outbox (`event_outbox`), inside the transaction that makes the change:
  
  | Event | When | Payload |
  |---|---|---|
@@@ -385,7 +385,7 @@ Server-rendered pages with the shared chrome (`openvibe-shared` v2.6.0 `shell.pa
  - OpenVibe.Network OAuth client **`host`**, redirect `https://openvibe.host/auth/callback`, scope `profile theme`. The same client is the service principal `svc:host`.
  - Grant `[host, events.event.publish, openvibe.events]`.
  - Callers of Host get `[<client>, host.site.manage | host.deploy.create | host.domain.manage, openvibe.host]` as needed. None exist yet (Codes, the expected first caller, is not built).
--- Released in `openvibe-contracts` v0.79.0 (CI contract check blocking); v0.32.0 adds the takedown routes to `host.site.manage.implementedBy`.
++- Released in `openvibe-contracts` v0.83.0 (CI contract check blocking); v0.32.0 adds the takedown routes to `host.site.manage.implementedBy`.
  
  ### Deploying Stage B (for the operator)
  
@@@ -489,3 +489,9 @@ review is [docs/threat-review.md](docs/threat-review.md). The launch has not bee
  ---
  
  Part of the [OpenVibe network](https://openvibe.network). Built in the open by [OpenVibers](https://github.com/OpenVibers).
++
++<!-- versions:start -->
++- openvibe-contracts: v0.83.0
++- openvibe-sdk: v0.26.0
++- openvibe-shared: v2.6.0
++<!-- versions:end -->
ddiff --git a/STATUS.json b/STATUS.json
iindex 2259c19..146fc81 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -2,17 +2,24 @@
    "repository": "OpenVibers/OpenVibe.Host",
    "stage": "alpha",
    "code": true,
--  "crawlRoutes": ["/robots.txt", "/sitemap.xml", "/llms.txt", "/llms-full.txt"],
++  "crawlRoutes": [
++    "/robots.txt",
++    "/sitemap.xml",
++    "/llms.txt",
++    "/llms-full.txt"
++  ],
    "wave": "W21 Stage A + Stage B",
    "plan": "OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026)",
    "runtime": "node 22; Stage A: CLI (ovhost); Stage B: express 4 + PostgreSQL 18 (openvibe-sdk/db, async) + Valkey 9 service",
    "port": 4910,
    "domain": "openvibe.host",
    "tenantDomain": "*.openvibe.host",
--  "contracts": "openvibe-contracts v0.79.0",
++  "contracts": "openvibe-contracts v0.83.0",
++  "sdk": "openvibe-sdk v0.26.0",
++  "shared": "openvibe-shared v2.6.0",
    "packages": [
--    "openvibe-contracts v0.79.0",
--    "openvibe-sdk v0.25.0",
++    "openvibe-contracts v0.83.0",
++    "openvibe-sdk v0.26.0",
      "openvibe-shared v2.6.0"
    ],
    "capabilities": [
@@@ -40,7 +47,6 @@
    "deployed": "loopback only, not launched",
    "placeholderInSites": true,
    "adoptedByServices": [],
--  "updated": "2026-10-03",
    "capabilitiesNote": "released in openvibe-contracts v0.24.0; v0.32.0 adds the four takedown routes to host.site.manage.implementedBy",
    "launchReady": true,
    "features": [
@@@ -56,5 +62,6 @@
      "Stage B: tenant static sites with immutable deploys, activation, rollback, custom domains, quotas and takedowns (not launched)",
      "Stage B git deploys, Phase 1: a site's Git source (repo + branch); the tenant's own CI posts each build, which lands as a source=git preview with immutable commit provenance and goes live only through activate (Host never clones, fetches, holds a credential or builds)",
      "per-actor limits on Stage B writes (openvibe-sdk/limits)"
--  ]
++  ],
++  "updated": "2026-10-05"
  }