openvibers/openvibe.services STATUS.json
STATUS.json
| 1 | { |
| 2 | "repository": "OpenVibers/OpenVibe.Services", |
| 3 | "stage": "alpha", |
| 4 | "code": true, |
| 5 | "wave": "W13", |
| 6 | "plan": "OpenVibe Updated Plan Based On Codebase (plan T13, ADR-048; the developer portal of ADR-014 moved here from OpenVibe.Codes on 2026-10-08)", |
| 7 | "runtime": "node 22, express 4, PostgreSQL 18 (openvibe-sdk/db)", |
| 8 | "port": 4930, |
| 9 | "domain": "openvibe.services", |
| 10 | "contracts": "openvibe-contracts v0.419.0", |
| 11 | "sdk": "openvibe-sdk v0.161.0", |
| 12 | "shared": "openvibe-shared v4.237.0", |
| 13 | "packages": [ |
| 14 | "openvibe-contracts v0.419.0", |
| 15 | "openvibe-sdk v0.161.0", |
| 16 | "openvibe-shared v4.237.0" |
| 17 | ], |
| 18 | "capabilities": [ |
| 19 | "services.resource.read", |
| 20 | "services.release.read", |
| 21 | "services.release.manage", |
| 22 | "services.resource.control" |
| 23 | ], |
| 24 | "capabilitiesRegistered": true, |
| 25 | "capabilitiesNote": "services.resource.read, services.release.read and services.release.manage are registered since openvibe-contracts v0.113.0: services.resource.read (first-party, the merged index), services.release.read (public) and services.release.manage (an app managing its own releases). They replaced codes.resource.read and codes.release.read|manage when the portal moved here. services.resource.control (first-party, POST /api/v1/resources/control, plan T13 step 10) is registered in v0.154.0. The later services.recipe.run, services.usage.read and services.cost.read arrive with their plan T13 steps.", |
| 26 | "events": [ |
| 27 | "services.app.published", |
| 28 | "services.app.deprecated", |
| 29 | "services.app.revoked", |
| 30 | "services.moderation.action" |
| 31 | ], |
| 32 | "deployed": true, |
| 33 | "deployment": "openvibe-ovh: unit openvibe-services.service on 127.0.0.1:4930 (git-checkout /opt/openvibe.services, env /etc/openvibe/services.env, database ov_services), nginx deploy/nginx/openvibe.services.conf serving https://openvibe.services (the Sites placeholder left on 2026-10-08).", |
| 34 | "features": [ |
| 35 | "developer portal over Network's projects, apps, credentials, grants, quotas and audit", |
| 36 | "per-project usage page from Network's rollups", |
| 37 | "project export (JSON) and full archive (zip)", |
| 38 | "secrets shown once, never stored or logged", |
| 39 | "scope editor offering only grantable capabilities", |
| 40 | "docs generated from the pinned contracts and SDK", |
| 41 | "OAuth helper and webhook tester (signature v2)", |
| 42 | "grant-respecting Media and Events playgrounds", |
| 43 | "app and mod manifest validation and release metadata with services.app.* events", |
| 44 | "ADR-013 trust tiers", |
| 45 | "policy and governance pages (governance drafts pending owner review)", |
| 46 | "per-actor limits (openvibe-sdk/limits)", |
| 47 | "Services' own manifests and releases (services.manifest, services.release) in the merged index, read in process, with OVRN reads", |
| 48 | "crawl artifacts (robots.txt, sitemap.xml, llms.txt, llms-full.txt) and the home page's JSON-LD", |
| 49 | "the D12 money guides (/docs/vibes and /docs/balance) and a project's Balance page (the D9 page renamed, /credits 301s to /balance)", |
| 50 | "the authority registry (server/authorities/index.js): built at boot from the pinned openvibe-contracts service manifests — every non-placeholder service whose manifest lists an active <id>.resource.read is an authority (at v0.110.0: network, events, host, codes, media), with its manifest internalOrigin (SERVICES_<ID>_URL overrides) and audience openvibe.<id>; Services itself is never an authority", |
| 51 | "one adapter per authority (server/authorities/adapter.js): GET /api/v1/resources and GET /api/v1/resources/:ovrn over that authority's loopback origin with a Network client-credentials token for its audience, scoped to its resource.read capability and cached (one mint per authority, refreshed 60 s before expiry; server/authorities/tokens.js)", |
| 52 | "the merged resource index (server/resources.js, GET /api/v1/resources?project=&kind=&service=&cursor=&limit=): openvibe-sdk/resources' createResourceIndex fans out and merges every authority's pages (per-authority cursor walk, concurrency 4, per-authority timeout), Services adds a deterministic (service, ovrn, id) total order and an opaque keyset cursor, and filters project/kind/service locally so a scoped read never shows a row outside its scope", |
| 53 | "a slow, refusing or unreachable authority (or a Network that cannot mint its token) never fails the page: its rows are omitted and it is named in the body's partial array as { service, code } — the problem code the authority answered, or Services' own services.authority_timeout / services.authority_unavailable when nothing answered (common.resource-list-result@1, contracts 1.1.0; a complete page carries no partial key; ADR-046 section 6)", |
| 54 | "GET /api/v1/resources/:ovrn routes the name with openvibe-contracts' one parser to the authority that owns it and answers its common.resource-summary@1; a malformed name or an unknown service is 400, the authority's 404 is 404, anything else is 502", |
| 55 | "GET /api/v1/authorities: the registry as it stands (id, origin, audience, capability, manifest version) — Services-local, no contract yet", |
| 56 | "who may read: a first-party svc: Network service token holding services.resource.read, or a person's user token scoped to ONE project they own or belong to, verified with the caller's own token against Network's developer projects API (GET /api/v1/projects/:project; non-members are 404, existence is not disclosed). Never an unscoped person, and never an app, mod or agent token even with the grant", |
| 57 | "the kernel: config/db (PGlite in development, PostgreSQL through PgBouncer in production; migrations applied at boot), truthful /api/ready (db and network_jwks required; a down authority is a partial page, not a red readiness), loopback-only /metrics, /api/health, /release.json, RFC 9457 problem+json everywhere, and the openvibe-sdk outbox (idle: no services.* event type is registered yet, plan T13 step 10)", |
| 58 | "migrations/0001_initial.sql: Services' own rows only (services_authorities, services_resources, services_catalog_entries, services_recipes, services_recipe_runs, services_control_log, services_events_outbox) — Services never writes another service's database (ADR-048)" |
| 59 | ], |
| 60 | "notYet": [ |
| 61 | "The playgrounds have never been used on production (0 playground runs); the one production end-to-end run used curl, and it is not a committed, repeatable check", |
| 62 | "Usage counts come from the services' hourly *.usage.recorded rollups (Network adds them up per day; the current hour is not counted) and cost lives in Billing, not on the usage page; no trace or error dashboards beyond the sampled failures", |
| 63 | "Billing sandbox, Chat bot and Realtime playgrounds; CLI and scaffolding; templates", |
| 64 | "Consent screen for third-party production apps (a Network gap)", |
| 65 | "Governance material (code of conduct, contribution guide, contributor ladder, moderation policy) is written as drafts pending owner review: not in effect, not indexed", |
| 66 | "plan T13 step 4 done in OpenVibe.Contracts v0.110.0 (services.resource.read is registered, active and first-party), step 5 done in Network, step 7 (read model + ingestion), steps 9-15 (console, control operations, recipes, usage, deploy)" |
| 67 | ], |
| 68 | "updated": "2026-11-13" |
| 69 | } |
| 70 |