openvibers/openvibe.network Commits

Pin openvibe-contracts v0.97.0 and openvibe-shared v2.9.0; drop the front door's icon override (#53)

OP OpenVibers committed 5 Oct 2026 · fab62251b9 · 8 files, +23 −22

## Files changed

- `README.md` — "Depends on" now names `openvibe-contracts` v0.97.0 and `openvibe-shared` v2.9.0 (were v0.80.0 / v1.29.2; `openvibe-sdk` v0.28.0 unchanged).
- `STATUS.json` — `"contracts": "openvibe-contracts v0.97.0"` (was v0.80.0).
- `docs/developer-projects.md` — the sandbox-allowance note's parenthetical "Network pins v0.30.1" → "Network pins v0.97.0".
- `server/home/render.js` — removed the local override `.sc-ic:has(.sc-ovi){background:none}.sc-ic .sc-ovi{--ovi-size:40px!important}` (openvibe-shared v2.9.0's showcase emits the 40 px size and the tintless ring itself) and updated the CSS comment; the `#developers` rules on the next line are untouched.
- `test/registry-exposure.test.js` — added `services: 'placeholder'` to `PINNED` and the exposure summary `placeholder: 4 → 5`, with comments: contracts v0.95.0 added the Services manifest.
- `test/registry-ecosystem.test.js` — added `'services'` to the expected `planned` category list, with comment.

`package.json` / `package-lock.json` were left exactly as prepared (not touched).

## Task 2 findings

- `node scripts/contracts-drift.js`: reports Network at v0.94.0 only because it reads GitHub HEAD (pre-merge); the local pin is already v0.97.0, so there is no Network drift to fix. All other warnings are other services.
- `git grep community.moderation -- server`: used only in `server/admin/moderation-audit.js` (topic constant + field-mapping case). Network never validates that payload (`assertValid`/`validate` are not applied to it), so contracts' additive 1.1.0 (space-moderator actions, target type `space`) needs no adaptation — the mapping is generic.
- CHANGELOG 0.94.1–0.97.0: 0.94.0/0.94.1 community.moderation additive; 0.94.2 billing events (not consumed here); **0.95.0 added the `services` placeholder manifest — this is what required the two registry-test fixes** — plus Chat's internal API; 0.96.0/0.97.0 Bot/Run job contracts. Nothing else Network uses changed.

## Tests

- Home icon check: rendered markup still has `class="ov-icon sc-ovi" … style="--ovi-size:40px"`.
- `ov test test/home-front-door.test.js test/page-checks.test.js test/perf-budget.test.js` → **3 passed** (19 s).
- `ov test test/registry-exposure.test.js test/registry-ecosystem.test.js` → **2 passed** (15 s). A first `ov test --all` (load 3.3) surfaced these two as failures from the v0.95.0 `services` manifest; after the fixes they pass.
- `ov test --all` (final, load 5.4) → **111 passed in 337 s, exit 0**.

No commit, push, deploy, or package install was performed.

Changes

ddiff --git a/README.md b/README.md
iindex e7386c47..7594de29 100644
---- a/README.md
++++ b/README.md
@@@ -45,8 +45,8 @@ Identity and account service for the OpenVibe network. Manages user accounts, OA
  
  ## Depends on
  
--- `openvibe-contracts` v0.80.0 (registry manifests, capability checks), `openvibe-sdk` v0.28.0 (PostgreSQL
--  and Valkey adapters, events, per-actor limits, universal telemetry), `openvibe-shared` v1.29.2, pinned by release tarball
++- `openvibe-contracts` v0.97.0 (registry manifests, capability checks), `openvibe-sdk` v0.28.0 (PostgreSQL
++  and Valkey adapters, events, per-actor limits, universal telemetry), `openvibe-shared` v2.9.0, pinned by release tarball
  - OpenVibe.Events (Network's outbox relay; the events it consumes), OpenVibe.AI (the `network.site_copy`
    workflow), OpenVibe.Blog (the changelog feed it proxies)
  - email (Resend), Discord and GitHub when their secrets are set ([Provider secrets](#provider-secrets))
ddiff --git a/STATUS.json b/STATUS.json
iindex adf98403..78ed96b5 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -6,7 +6,7 @@
    "runtime": "node 22, express, PostgreSQL 18 (openvibe-sdk/db, async) + Valkey 9",
    "port": 4000,
    "domain": "openvibe.network (with auth., api., admin., my. and themes.openvibe.network in its manifest)",
--  "contracts": "openvibe-contracts v0.80.0",
++  "contracts": "openvibe-contracts v0.97.0",
    "capabilities": [
      "identity.subject.resolve",
      "mods.grant.manage",
ddiff --git a/docs/developer-projects.md b/docs/developer-projects.md
iindex d20c07c5..b9079091 100644
---- a/docs/developer-projects.md
++++ b/docs/developer-projects.md
@@@ -45,7 +45,7 @@ A new project is `sandbox` only. Staff switch it to `sandbox+production`, which
  - The only grants that exist are capabilities in the openvibe-contracts catalog, at the version Network has installed.
  - **The grantability rule.** The contracts `visibility` enum is `public | partner | first-party | internal` (`partner` since the v0.83.0 release; Network's pin moves to v0.97.0). Only `active` capabilities with visibility `public` or `partner` may be granted to apps. Staff may put a `partner` capability in one project's allowance by hand, but it never comes from the default or the sandbox allowance. `first-party` and `internal` capabilities are never grantable: staff cannot add them to an allowance, members cannot request them, and token issuance filters them out again.
  - **The allowance** is the set of grantable capabilities one project's apps may hold. Only staff set it. `DEV_DEFAULT_ALLOWANCE` seeds new projects, with public capabilities only. It is empty by default, so staff decide each project's **production** apps.
--- **The sandbox allowance** is added to the allowance for **sandbox apps only**, in every project, without a staff decision. It comes from `DEV_SANDBOX_ALLOWANCE`. When that is unset, the code default is `media.object.upload`, `media.object.read`, `media.object.list`, `media.object.delete`, `events.app.publish`, `events.app.read`, `events.app.subscribe`, `tools.job.create`, `tools.job.read` and `tools.job.cancel`. Only `public` + `active` capabilities of the installed openvibe-contracts catalog count. `partner`, `first-party`, `internal` and unknown ids are dropped. The three `events.app.*` ids are defined from openvibe-contracts v0.28.0 (Network pins v0.30.1); with an older release they would be left out. `media.object.list` and `media.object.delete` (Media's list and delete verbs, WS-G task 2) are left out the same way until the pinned release defines them; until then a sandbox app's upload and read grants cover them at Media. The project view and `GET /catalog` show it as `sandbox_allowance`. Production apps never use it.
++- **The sandbox allowance** is added to the allowance for **sandbox apps only**, in every project, without a staff decision. It comes from `DEV_SANDBOX_ALLOWANCE`. When that is unset, the code default is `media.object.upload`, `media.object.read`, `media.object.list`, `media.object.delete`, `events.app.publish`, `events.app.read`, `events.app.subscribe`, `tools.job.create`, `tools.job.read` and `tools.job.cancel`. Only `public` + `active` capabilities of the installed openvibe-contracts catalog count. `partner`, `first-party`, `internal` and unknown ids are dropped. The three `events.app.*` ids are defined from openvibe-contracts v0.28.0 (Network pins v0.97.0); with an older release they would be left out. `media.object.list` and `media.object.delete` (Media's list and delete verbs, WS-G task 2) are left out the same way until the pinned release defines them; until then a sandbox app's upload and read grants cover them at Media. The project view and `GET /catalog` show it as `sandbox_allowance`. Production apps never use it.
  - **A grant never exceeds the allowance** (for a sandbox app: allowance ∪ sandbox allowance). It is checked in three places. Approval refuses with `403 grant.beyond_allowance`. Shrinking the allowance revokes approved grants, and denies requested ones, that fall outside it. A sandbox app's grant that is still inside the sandbox allowance is kept. Token issuance intersects approved grants with the current allowance and with the current grantability.
  - A developer's grant request waits in `requested`. When an owner or admin makes the request and the capability is inside the allowance, it is approved at once.
  - `GET /api/v1/projects/catalog` lists what could ever be granted.
ddiff --git a/package-lock.json b/package-lock.json
iindex e434e9eb..3594b074 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -21,9 +21,9 @@
          "iovalkey": "^0.4.0",
          "jsonwebtoken": "^9.0.0",
          "multer": "^1.4.5-lts.1",
--        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.94.0",
++        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.97.0",
          "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.28.0",
--        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.8.0",
++        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.9.0",
          "pg": "^8.23.0",
          "uuid": "^11.1.0",
          "web-push": "^3.6.7"
@@@ -1556,9 +1556,9 @@
        }
      },
      "node_modules/openvibe-contracts": {
--      "version": "0.94.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.94.0",
--      "integrity": "sha512-dh1eAdBUkjjIQuUSZZM0u2o/yzVb/cWOcl2J12dZfTg2q83yhgARSTTX0tGLLKuBCPks7TrYfoErXHZcXtWubA==",
++      "version": "0.97.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.97.0",
++      "integrity": "sha512-HPGBJYx6Dh2kaTg5B41WGhpw38zUdoU1VnWtkcsFkaU4E521uQOJxf6sIaLdHMsahqov7b9k2HKEFCnD9065MQ==",
        "license": "AGPL-3.0-only",
        "dependencies": {
          "ajv": "^8.17.1",
@@@ -1601,9 +1601,9 @@
        }
      },
      "node_modules/openvibe-shared": {
--      "version": "2.8.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.8.0",
--      "integrity": "sha512-QUHp0gGl5VdHa3yvGHXhGNJVD04CFkcWuTK44xZlu39KEnN+vijKiG4LN+3H5KDa9SBVgMlglIXXpgRdR0/dDw==",
++      "version": "2.9.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.9.0",
++      "integrity": "sha512-ESXg23tqj73C14KvoT3kC/6VfZEkjpN1Q9fdipQ3bqIGfxiiSQIz0osGzthHHm3okruCq6aDQld1kFP9tx8+kA==",
        "license": "MIT",
        "dependencies": {
          "jsonwebtoken": "^9.0.0"
ddiff --git a/package.json b/package.json
iindex b057322d..9122184e 100644
---- a/package.json
++++ b/package.json
@@@ -30,9 +30,9 @@
      "iovalkey": "^0.4.0",
      "jsonwebtoken": "^9.0.0",
      "multer": "^1.4.5-lts.1",
--    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.94.0",
++    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.97.0",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.28.0",
--    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.8.0",
++    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.9.0",
      "pg": "^8.23.0",
      "uuid": "^11.1.0",
      "web-push": "^3.6.7"
ddiff --git a/server/home/render.js b/server/home/render.js
iindex fb35f72a..71bbc493 100644
---- a/server/home/render.js
++++ b/server/home/render.js
@@@ -88,10 +88,9 @@ function rightNow(a) {
  <div class="now-col"><h3>From the blog</h3>${list(a.posts, (p) => `<li><a href="${esc(p.url)}"><b>${esc(p.title)}</b>${p.summary ? `<small>${esc(p.summary)}</small>` : ''}</a></li>`, 'No posts yet.')}<a class="now-more" href="https://openvibe.blog/">OpenVibe.Blog →</a></div></div></section>`;
  }
  
--// The kit (openvibe-shared/showcase, /shared/showcase.css) owns the sections and cards; this is only what it does not
--// draw: the "Right now" columns, the tool and "Opening next" chips, and the shared icon styles.
++// The kit (openvibe-shared/showcase, /shared/showcase.css) owns the sections, cards and icon styles; this is only what
++// it does not draw: the "Right now" columns and the tool and "Opening next" chips.
  const CSS = `
--.sc-ic:has(.sc-ovi){background:none}.sc-ic .sc-ovi{--ovi-size:40px!important}
  #developers{margin-bottom:56px}#developers .sc-grid{grid-template-columns:repeat(auto-fill,minmax(220px,1fr))}
  .home-chips{display:flex;flex-wrap:wrap;gap:8px;margin:14px 0 0;padding:0;list-style:none}
  .home-chips>li>a{display:inline-flex;align-items:center;gap:7px;padding:6px 12px 6px 7px;border-radius:999px;border:1px solid var(--border,rgba(255,255,255,.1));font-size:13.5px;font-weight:600;color:inherit;text-decoration:none}
ddiff --git a/test/registry-ecosystem.test.js b/test/registry-ecosystem.test.js
iindex 93ad3f84..a68d5279 100644
---- a/test/registry-ecosystem.test.js
++++ b/test/registry-ecosystem.test.js
@@@ -77,8 +77,8 @@ const { createEcosystemRegistry } = require('../server/registry/ecosystem');
      assert.strictEqual(inCat('events'), 'platform'); assert.strictEqual(inCat('ai'), 'platform'); assert.strictEqual(inCat('sources'), 'platform');
      assert.strictEqual(inCat('sdk'), 'library'); assert.strictEqual(inCat('contracts'), 'library');
      assert.strictEqual(inCat('examples'), 'repository');
--    // 'planned' = exposure placeholder: Contracts 0.83.0's media-hub and space, v0.87-v0.90's zone and run (charter only, nothing runs)
--    assert.deepStrictEqual(cats.planned.services.map(x => x.id).sort(), ['media-hub', 'run', 'space', 'zone']);
++    // 'planned' = exposure placeholder: Contracts 0.83.0's media-hub and space, v0.87-v0.90's zone and run, v0.95.0's services (charter only, nothing runs)
++    assert.deepStrictEqual(cats.planned.services.map(x => x.id).sort(), ['media-hub', 'run', 'services', 'space', 'zone']);
      const liveRow = cats.site.services.find(x => x.id === 'live');
      assert.strictEqual(liveRow.runtime, 'down'); assert.ok(liveRow.checked_at, 'rows carry the last check');
      r = await get('/api/v1/registry/categories/library');
ddiff --git a/test/registry-exposure.test.js b/test/registry-exposure.test.js
iindex 7621bb9a..6f9a22c4 100644
---- a/test/registry-exposure.test.js
++++ b/test/registry-exposure.test.js
@@@ -22,6 +22,8 @@ const PINNED = {
      ai: 'internal',
      // openvibe-contracts v0.86-v0.90: Bot runs (its own exposure row); Zone and Run are charters only.
      bot: 'live', zone: 'placeholder', run: 'placeholder',
++    // openvibe-contracts v0.95.0: OpenVibe.Services is a charter only (the T13 control plane).
++    services: 'placeholder',
      sdk: 'library', shared: 'library', contracts: 'library', publishing: 'library',
      examples: 'repository',
  };
@@@ -104,9 +106,9 @@ const ready = [200, { ready: true, status: 'ready', failed: [], degraded: [], ch
      assert.strictEqual(sBy.live.label, 'up');
      assert.strictEqual(sBy.live.origin, 'https://openvibe.live');
      assert.strictEqual(sBy.shared.label, `not running (library, released v${require('openvibe-shared/package.json').version})`);
--    // Contracts 0.83.0 added two placeholder services (media-hub, space), v0.86-v0.90 Bot (live) and two more (zone, run);
--    // none is retired
--    assert.deepStrictEqual(st.exposure_summary, { live: 15, internal: 11, library: 4, repository: 1, placeholder: 4, retired: 0 });
++    // Contracts 0.83.0 added two placeholder services (media-hub, space), v0.86-v0.90 Bot (live) and two more (zone, run),
++    // v0.95.0 Services; none is retired
++    assert.deepStrictEqual(st.exposure_summary, { live: 15, internal: 11, library: 4, repository: 1, placeholder: 5, retired: 0 });
  
      // The page: no row for a service whose domain serves a placeholder shows a bare "Up".
      const html = await fetch(base + '/status').then(x => x.text());