{
  "repository": "OpenVibers/OpenVibe.Services",
  "stage": "alpha",
  "code": true,
  "wave": "W13",
  "plan": "OpenVibe Updated Plan Based On Codebase (plan T13, ADR-048; the developer portal of ADR-014 moved here from OpenVibe.Codes on 2026-10-08)",
  "runtime": "node 22, express 4, PostgreSQL 18 (openvibe-sdk/db)",
  "port": 4930,
  "domain": "openvibe.services",
  "contracts": "openvibe-contracts v0.419.0",
  "sdk": "openvibe-sdk v0.161.0",
  "shared": "openvibe-shared v4.237.0",
  "packages": [
    "openvibe-contracts v0.419.0",
    "openvibe-sdk v0.161.0",
    "openvibe-shared v4.237.0"
  ],
  "capabilities": [
    "services.resource.read",
    "services.release.read",
    "services.release.manage",
    "services.resource.control"
  ],
  "capabilitiesRegistered": true,
  "capabilitiesNote": "services.resource.read, services.release.read and services.release.manage are registered since openvibe-contracts v0.113.0: services.resource.read (first-party, the merged index), services.release.read (public) and services.release.manage (an app managing its own releases). They replaced codes.resource.read and codes.release.read|manage when the portal moved here. services.resource.control (first-party, POST /api/v1/resources/control, plan T13 step 10) is registered in v0.154.0. The later services.recipe.run, services.usage.read and services.cost.read arrive with their plan T13 steps.",
  "events": [
    "services.app.published",
    "services.app.deprecated",
    "services.app.revoked",
    "services.moderation.action"
  ],
  "deployed": true,
  "deployment": "openvibe-ovh: unit openvibe-services.service on 127.0.0.1:4930 (git-checkout /opt/openvibe.services, env /etc/openvibe/services.env, database ov_services), nginx deploy/nginx/openvibe.services.conf serving https://openvibe.services (the Sites placeholder left on 2026-10-08).",
  "features": [
    "developer portal over Network's projects, apps, credentials, grants, quotas and audit",
    "per-project usage page from Network's rollups",
    "project export (JSON) and full archive (zip)",
    "secrets shown once, never stored or logged",
    "scope editor offering only grantable capabilities",
    "docs generated from the pinned contracts and SDK",
    "OAuth helper and webhook tester (signature v2)",
    "grant-respecting Media and Events playgrounds",
    "app and mod manifest validation and release metadata with services.app.* events",
    "ADR-013 trust tiers",
    "policy and governance pages (governance drafts pending owner review)",
    "per-actor limits (openvibe-sdk/limits)",
    "Services' own manifests and releases (services.manifest, services.release) in the merged index, read in process, with OVRN reads",
    "crawl artifacts (robots.txt, sitemap.xml, llms.txt, llms-full.txt) and the home page's JSON-LD",
    "the D12 money guides (/docs/vibes and /docs/balance) and a project's Balance page (the D9 page renamed, /credits 301s to /balance)",
    "the authority registry (server/authorities/index.js): built at boot from the pinned openvibe-contracts service manifests — every non-placeholder service whose manifest lists an active <id>.resource.read is an authority (at v0.110.0: network, events, host, codes, media), with its manifest internalOrigin (SERVICES_<ID>_URL overrides) and audience openvibe.<id>; Services itself is never an authority",
    "one adapter per authority (server/authorities/adapter.js): GET /api/v1/resources and GET /api/v1/resources/:ovrn over that authority's loopback origin with a Network client-credentials token for its audience, scoped to its resource.read capability and cached (one mint per authority, refreshed 60 s before expiry; server/authorities/tokens.js)",
    "the merged resource index (server/resources.js, GET /api/v1/resources?project=&kind=&service=&cursor=&limit=): openvibe-sdk/resources' createResourceIndex fans out and merges every authority's pages (per-authority cursor walk, concurrency 4, per-authority timeout), Services adds a deterministic (service, ovrn, id) total order and an opaque keyset cursor, and filters project/kind/service locally so a scoped read never shows a row outside its scope",
    "a slow, refusing or unreachable authority (or a Network that cannot mint its token) never fails the page: its rows are omitted and it is named in the body's partial array as { service, code } — the problem code the authority answered, or Services' own services.authority_timeout / services.authority_unavailable when nothing answered (common.resource-list-result@1, contracts 1.1.0; a complete page carries no partial key; ADR-046 section 6)",
    "GET /api/v1/resources/:ovrn routes the name with openvibe-contracts' one parser to the authority that owns it and answers its common.resource-summary@1; a malformed name or an unknown service is 400, the authority's 404 is 404, anything else is 502",
    "GET /api/v1/authorities: the registry as it stands (id, origin, audience, capability, manifest version) — Services-local, no contract yet",
    "who may read: a first-party svc: Network service token holding services.resource.read, or a person's user token scoped to ONE project they own or belong to, verified with the caller's own token against Network's developer projects API (GET /api/v1/projects/:project; non-members are 404, existence is not disclosed). Never an unscoped person, and never an app, mod or agent token even with the grant",
    "the kernel: config/db (PGlite in development, PostgreSQL through PgBouncer in production; migrations applied at boot), truthful /api/ready (db and network_jwks required; a down authority is a partial page, not a red readiness), loopback-only /metrics, /api/health, /release.json, RFC 9457 problem+json everywhere, and the openvibe-sdk outbox (idle: no services.* event type is registered yet, plan T13 step 10)",
    "migrations/0001_initial.sql: Services' own rows only (services_authorities, services_resources, services_catalog_entries, services_recipes, services_recipe_runs, services_control_log, services_events_outbox) — Services never writes another service's database (ADR-048)"
  ],
  "notYet": [
    "The playgrounds have never been used on production (0 playground runs); the one production end-to-end run used curl, and it is not a committed, repeatable check",
    "Usage counts come from the services' hourly *.usage.recorded rollups (Network adds them up per day; the current hour is not counted) and cost lives in Billing, not on the usage page; no trace or error dashboards beyond the sampled failures",
    "Billing sandbox, Chat bot and Realtime playgrounds; CLI and scaffolding; templates",
    "Consent screen for third-party production apps (a Network gap)",
    "Governance material (code of conduct, contribution guide, contributor ladder, moderation policy) is written as drafts pending owner review: not in effect, not indexed",
    "plan T13 step 4 done in OpenVibe.Contracts v0.110.0 (services.resource.read is registered, active and first-party), step 5 done in Network, step 7 (read model + ingestion), steps 9-15 (console, control operations, recipes, usage, deploy)"
  ],
  "updated": "2026-11-13"
}