# OpenVibe.Trade

> Informational watchlists, sourced market context and alerts. No custody, no order execution.

**Live site:** https://openvibe.trade · **API docs:** https://openvibe.services · **For AI:** https://openvibe.trade/llms.txt
**Run it:** `npm ci && npm run dev` (Node 22 or newer) · **Tests:** `npm test`

**Status:** alpha (roadmap Wave 19). The service runs, its tests pass, and it is **public at its
domain, [openvibe.trade](https://openvibe.trade), since 2026-10-09**, after an independent
pre-launch security review whose fixes shipped first. Since 2026-10-15 it carries about 8,000
US-listed companies from the SEC's own ticker list, their XBRL filings as they arrive, the key numbers
in those filings, and AI briefs that cite them (see "What it shows today"). Its capabilities and
service manifest are registered in openvibe-contracts. No price feed is configured.
**Domain:** `openvibe.trade` · **Port:** 4860 · **Service id:** `trade`
**Plan:** OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §12.11;
roadmap Wave 19, §15.13, §29, §32. **Binding decision:** ADR-025 (marketplace and commerce scope).
**License:** AGPL-3.0 (same as every OpenVibe service).

> **Information only — not investment advice; no trading here.** This sentence is on every page.

## Purpose

An informational product: instruments and their aliases with deterministic resolution, market
observations that always show when they were observed, when they were retrieved and which source
stated them, filings and other source documents from OpenVibe.Sources, private watchlists, alert
rules, short AI briefs written from SEC's filed numbers and filings (labelled, not reviewed by a person), and
context written by editors (or drafted by OpenVibe.AI and reviewed by a person).

Per ADR-025 Trade is informational **only**. There is no custody, no order execution, no escrow, no
listing between users and no personalised financial advice — not as a feature, not as an endpoint,
not as a table. The historical marketplace branch is recorded as an open question in
[docs/marketplace-open-question.md](docs/marketplace-open-question.md), not implemented.

## Owns

The nine charter tables (roadmap §15.13) live in Trade's own PostgreSQL database (`ov_trade` on the host's data role, ADR-035; schema in [migrations/](migrations/)):

| Charter table | What it is |
|---|---|
| `trade_instruments` | Symbol (canonical, upper case), name, kind, exchange, SEC CIK, trading currency, status, and which context revision is published. Companies come from SEC's own ticker list (Sources `sec-company-tickers`, created by `svc:trade`: one per CIK, other share classes as ticker aliases); currencies from the rates; anything else from an editor. |
| `trade_instrument_aliases` | Tickers, CIKs and names with their normalised resolution key. A ticker or CIK names exactly one instrument (unique index); a name may be shared (resolution is then ambiguous). |
| `trade_watchlists` | Private, one owner (`usr_…`). |
| `trade_watchlist_items` | Instruments on a watchlist, with an optional note. |
| `trade_market_observations` | Value (the decimal exactly as stated), unit, currency, period, `observed_at`, source key, Sources item, source URL, the source's own reference, `retrieved_at`, optional `max_age_sec`, who recorded it. **Immutable** (triggers abort UPDATE and DELETE); unique per `(source_key, source_ref)`. |
| `trade_source_documents` | Filings and other documents from Sources items: form type, filer, CIK, accession, URL, the source's own dates, `retrieved_at`, licence/terms notes, removal state. |
| `trade_alert_rules` | `threshold` (metric, above/below, threshold, unit, currency), `filing_type` (form types) or `new_document`, one owner. |
| `trade_alert_deliveries` | One row per `(rule, trigger kind, trigger id)` under a UNIQUE key — the idempotency of alerts. |
| `trade_context_revisions` | `openvibe-publishing/revisions` (prefix `trade_context`): immutable revisions of an instrument's context with authorship, `as_of` and citations of Trade's documents and observations. |

Other tables in the same database:

- Package companions: `trade_context_drafts`, `trade_context_revision_purges`,
  `trade_context_reviews` (a person's review of an AI draft) and `trade_index_revisions` (the
  Search document sequencer).
- `trade_source_status`: freshness of each source (Sources' health plus Trade's own clock).
- `trade_ingest_cursor`: the change cursor of the Sources feed (`openvibe-publishing/ingest`).
- `trade_sync_state`: the last sync error and counters of what was skipped and why.
- `event_outbox` (SDK outbox) and `idempotency_receipts` (SDK inbox for signed webhook deliveries).
- `telemetry_samples` (migration `0005_telemetry.sql`): request telemetry, openvibe-sdk 0.46
  `platform.telemetry-sample@1` shape. Each request is aggregated by route template, method and
  status class, never by raw URL; `/shared`, static assets, health, readiness and `/metrics` are not
  counted. `server/app.js` builds the collector (`createHttpTelemetry`) and mounts its middleware;
  every minute and on stop `server/index.js` writes one `http.request` sample per key plus the
  active-requests, p95 latency and event-loop-lag gauges, and deletes rows older than 14 days daily.

## Does not own

- **Money, custody, orders, escrow, listings, advice.** None exist here (ADR-025). Money belongs to
  OpenVibe.Billing (ADR-012).
- **Source items.** OpenVibe.Sources owns ingestion, robots, terms and the items; Trade keeps the
  metadata it shows, keyed by the item id, and follows revisions and removals.
- **Identity.** OpenVibe.Network: SSO, subjects, service principals.
- **Notifications.** Network renders and delivers them from `trade.alert.triggered` (ADR-020).
  Trade sends no email.
- **Search.** OpenVibe.Search indexes what Trade sends through Events.
- **AI generation.** OpenVibe.AI runs `trade.summarize_market_context`; Trade makes no provider calls.
- **Discussion.** Community (not wired yet; no comments here).

## What works

- **Instruments and resolution.** Editors add instruments (form or API). Resolution is exact and
  deterministic, in a fixed order: CIK (all digits, optionally `CIK…`) → ticker (symbol, then ticker
  aliases) → exact normalised name (diacritics, case, punctuation, `&`, `/DE/` and trailing corporate
  words normalised). Several instruments with the same name → `ambiguous`, candidates listed, none
  chosen. No fuzzy or prefix matching. `/i/aapl` and a ticker alias answer 301 to `/i/AAPL`.
- **Observations.** Recorded by a first-party feed (`POST /api/v1/observations`,
  `trade.observation.write`) or from Sources items that state a value: the explicit `fields.metric`,
  `value`, `unit`, `observed_at` (a symbol or CIK), or a rate the real trade sources state — the api
  adapter's `fields.rate` with `base`/`quote` (`frankfurter-eur-rates`), or a `<rate> <QUOTE> = 1
  <BASE>` reference-rate title (`ecb-euro-reference-rates`, the value and currencies read as stated).
  A bare date is that day at 00:00 UTC. `observed_at` and `retrieved_at` are required and never
  defaulted; a replay is `200 created:false`; the same reference with a different value is `409`. A
  rate's quote currency with no instrument yet registers one (kind `currency`, symbol/name the stated
  ISO code); every other item must match an editor-created instrument or it is skipped and counted.
  **No observation → no number:** the page says "No observations have been recorded for X, so no
  number is shown."
- **Freshness.** Per source: fresh only while the last successful fetch is younger than the source's
  window (Sources' `stale_after_sec`, else `TRADE_DEFAULT_STALE_AFTER_SEC`), computed with Trade's
  clock. A stale value stays visible with its timestamps and a **"stale since <time>"** badge; a
  source Trade has never heard of is "freshness unknown". An observation can also carry its own
  `max_age_sec`. `trade.source.stale` / `.recovered` are emitted on transitions only. If Sources or
  the sync fails, nothing is invented: the failure is recorded, and the data ages into "stale".
- **Documents.** The sync pulls `category=trade` items by cursor. SEC EDGAR filings (the seeded
  `sec-xbrl-filings` source) are recognised by their `sec.gov/Archives/edgar/data/<CIK>/<accession>/`
  URL: CIK and accession come from the URL, the form type from the item summary (the feed's
  `<description>`) when it looks like one, the filer from the title. A filing without a date says
  "not stated by the source". Items that match no instrument are skipped and counted, never stored.
  A Sources removal hides the document (the row stays as the record). If the sync ever advances the
  cursor past items that were skipped and later fixed, rewind it with
  `node scripts/rewind-sync-cursor.js` (dry run; `--apply` to move it) — re-reading is idempotent per
  item revision.
- **Watchlists.** Private per person; plain forms and the API. Anyone else gets 404.
- **Alerts.** `threshold` rules fire on a crossing (armed → fired → re-armed when a newer
  observation no longer meets the condition; late observations never fire; unit and currency must
  match exactly, no conversion). `filing_type` and `new_document` fire once per newly seen document;
  item revisions never re-fire. Each delivery is one row and one `trade.alert.triggered` event
  (visibility `subject`, subject = the owner), in the same transaction as the triggering
  observation or document.
- **Context.** Editors write Markdown context citing documents and observations (`as_of` = the
  newest cited time, never the time of writing), publish, retract, and review. OpenVibe.AI output is
  a labelled AI-generated draft, never attributed to a person, that cannot be published before a
  person on the editor list approves it. Text that recommends buying, selling or holding, or gives
  price targets, is refused (`context.advice_refused`).

### What it shows today

Trade shows only what a source stated:

- **Companies:** SEC's ticker list (Sources `sec-company-tickers`, daily): one instrument per CIK, other share
  classes as ticker aliases (`domain/ingest.js`).
- **Filings:** SEC's XBRL filings feed (Sources `sec-xbrl-filings`, every 15 minutes), matched by CIK.
- **Numbers:** SEC's XBRL company facts, read straight from `data.sec.gov` (`clients/sec.js`, `domain/facts.js`)
  when a company files a 10-K, 10-Q, 20-F or 40-F, or when a reader asks for a brief:
  - revenue, net income, operating income, diluted EPS and operating cash flow for the last five quarters and two
    years;
  - assets, liabilities, equity, cash, long-term debt and shares outstanding at the last five quarter ends.

  Only SEC's framed facts are used (one per period), each an immutable observation with its period, its filing and
  `source_key sec-companyfacts`.
- **Rates:** euro reference rates from the ECB and Frankfurter.
- **AI briefs** (`domain/briefs.js`, OpenVibe.AI `trade.summarize_market_context`):
  - written from a company's numbers and filings list only, when a report brings new numbers (the worker,
    `TRADE_BRIEFS_PER_TICK`) or when a reader asks (`POST /i/:symbol/brief`: same origin, 5 per address per 10
    minutes), within `TRADE_BRIEFS_PER_HOUR` for the whole site;
  - the worker's report brief asks OpenVibe.AI for the `batch` latency class: the run id and the exact inputs are
    kept in `trade_ai_brief_jobs` (migration `0009`), the answer is collected on a later tick, and a refused or
    expired batch falls back to the `background` class once (`TRADE_BRIEFS_BATCH=off` keeps it synchronous;
    `TRADE_BRIEFS_BATCH_DEADLINE_HOURS` defaults to 3: a market brief older than that is stale, so it falls back to background). A reader's ask stays synchronous;
  - every kept point cites Trade's own observation or document rows, and an uncited point is dropped and listed;
  - text that reads as advice is refused, and so is a placeholder run;
  - shown labelled "AI-written, not reviewed by a person". They do not make a page indexable: that still needs a
    person-reviewed context.
- **Market brief** (`domain/market-briefs.js`, the same OpenVibe.AI `trade.summarize_market_context` workflow): one
  a day at most (a UTC day, `TRADE_MARKET_BRIEFS=off` turns it off), written only from what Trade stored — the day's
  filings by form, the euro reference rates, the companies with new filings or SEC figures and aggregate watchlist
  activity. Every kept point links to its Trade page; no prices are sent. Each brief has its own page
  `/market/<YYYY-MM-DD>`: unreviewed it carries "AI-written, not yet reviewed by a person" and is noindex through the
  shared gate; once an editor approves it from `GET /api/v1/review-queue` (kind `market_brief`) the page is indexable
  and enters the pages sitemap. The home never changes indexability because of a brief: it shows the latest reviewed
  one in full (with its date), or a one-line link to the unreviewed page while none is reviewed. Without OpenVibe.AI
  nothing is made and nothing renders.
- **No prices:** no price feed is configured.

### Routes (server-rendered, useful without JavaScript)

| Route | What |
|---|---|
| `/` | the front page (`server/render/home.js`): a company search and the site's numbers, the latest reviewed daily market brief (or a link to the unreviewed one), the latest AI briefs, euro reference rates (each currency's newest rate, its date and source, and the change from the same source's previous rate), new 10-K/10-Q reports, the last 7 days' filings by form (plain names), the newest filings, companies with something new, what is here and six questions (FAQPage JSON-LD); `/?page=N` answers 301 to `/instruments?page=N` |
| `/market/<YYYY-MM-DD>` | one market brief: unreviewed it is noindex and labelled; a person's approval makes it indexable |
| `/instruments` | every instrument, the newest filing or figure first (the front page's old list), 50 a page |
| `/filings`, `/filings?form=` | the newest SEC filings, 50 a page, with the last 7 days' counts by form; one form's list is noindex with `/filings` as its canonical |
| `/resolve?q=` | resolution; one match → 302 to the instrument |
| `/i/:symbol`, `/i/:symbol.json` | the instrument page (observations with timestamps and sources, context with disclosure, documents, source freshness, watch/alert forms), and the same data as JSON |
| `/i/:symbol/documents.xml`, `.atom`, `.json` | the instrument's documents as RSS, Atom and JSON Feed |
| `/feed.xml`, `/atom.xml`, `/feed.json` | recent documents across instruments |
| `/sources` | freshness of every source and of the sync |
| `/watchlists` | your watchlists, alert rules and deliveries (private, noindex, `private, no-store`) |
| `/editor`, `/editor/i/:symbol` | the editor (plain forms, editors only) |
| `/sitemap.xml` → `/sitemaps/instruments.xml` | indexable instrument pages only |
| `/robots.txt`, `/llms.txt`, `/llms-full.txt` | crawler policy (private paths disallowed), orientation, and a short summary of every indexable instrument |
| `/terms`, `/privacy`, `/dmca` | openvibe-shared legal pages |
| `/auth/*` | sign-in; the same session layer as Blog and Community |
| `/api/health`, `/api/ready`, `/release.json`, `POST /release-metrics`, `/metrics` | health, readiness, release, open tabs' update reports (counted in `/metrics`), metrics (loopback only) |
| `POST /internal/events` | signed OpenVibe.Events deliveries (`sources.*`, and the two ADR-033 account events), host-local |

Sitemap entries carry lastmod from each instrument's latest recorded change.

### Discoverability (roadmap §32)

- Instrument pages go through the `openvibe-publishing/seo` gate. Financial information is a
  **sensitive** category: a page is `noindex` (`unreviewed_sensitive`) until a person-reviewed
  context is published, `noindex` when its newest monetary observation is older than
  `TRADE_PRICE_MAX_AGE_SEC` (`stale_price`), and `thin` below `TRADE_GATE_MIN_WORDS` of context.
- The sitemap lists indexable instrument pages only, `lastmod` = the instrument's latest recorded change.
- JSON-LD: `WebPage` (+ `Corporation` with `tickerSymbol` for equities) and breadcrumbs, from real
  fields only. No price, offer, rating or invented date.
- Every instrument page has a JSON twin with the same data (`/i/:symbol.json`).

### IndexNow (openvibe-shared/indexnow)

- With `INDEXNOW_KEY` set, the key file is served at `/<key>.txt` as `text/plain`.
- Whenever the gate's verdict for an instrument page changes — a person-reviewed context is published
  or updated, the context is retracted, the instrument is archived, or a price ages past
  `TRADE_PRICE_MAX_AGE_SEC` — Trade pings `api.indexnow.org` with the page's canonical URL and
  `/sitemap.xml`; the module batches and debounces (one POST per 30s window). A failed ping never
  takes a publish down.
- Drafts, unreviewed AI context, private pages and noindex pages never ping. Unset key: off — no key
  file, no requests.

### Caching (nothing personal in shared caches)

- `public, max-age=60` only for pages identical for everyone, served to anonymous viewers.
- `private, no-store` for everything personal (signed-in views, watchlists, alerts, editor), every
  error, every form response and the whole API. HTML varies on `Cookie` and `Authorization`.
- Feeds and sitemaps are public for 5 minutes and contain public documents and pages only.

### API `/api/v1` (problem+json errors)

| Capability | Routes |
|---|---|
| (public) | `GET /instruments`, `GET /instruments/:symbol`, `GET /instruments/:symbol/observations`, `GET /instruments/:symbol/documents`, `GET /sources` |
| `trade.instrument.resolve` | `GET /instruments/resolve?q=&kind=` |
| `trade.instrument.manage` | `POST /instruments`, `PATCH /instruments/:symbol`, `POST /instruments/:symbol/aliases` (people: editors) |
| `trade.observation.write` | `POST /observations` (services only) |
| `trade.context.read` | `GET /instruments/:symbol/context` (`?all=1` drafts), `GET /instruments/:symbol/context/input` (the AI workflow input) |
| `trade.context.propose` | `POST /instruments/:symbol/context` (`X-OV-Origin: ai` for AI drafts; editors) |
| people on the editor list | `POST /instruments/:symbol/context/revisions/:n/review` |
| `trade.watchlist.read` / `.create` / `.update` / `.delete` | `GET/POST /watchlists`, `GET/PATCH/DELETE /watchlists/:id`, `PUT/DELETE /watchlists/:id/items/:symbol` |
| `trade.alert.read` / `.create` / `.delete` | `GET /alerts`, `GET /alerts/deliveries`, `POST /alerts`, `DELETE /alerts/:id` |

Service tokens use audience `openvibe.trade`, one capability per route; private data needs
`X-OV-Subject` (the person the service acts for). Browsers with a Network JWT are judged by ownership
and the editor list. The charter's `trade.watchlist.create|update`, `trade.instrument.resolve`,
`trade.alert.create|delete` and `trade.context.read` are all 3-segment ids here; `read`, `delete`,
`manage`, `observation.write` and `context.propose` are additions. They and the service manifest
are released in openvibe-contracts (pinned at v0.97.0; the source proposals stay in
[docs/capabilities-proposal/](docs/capabilities-proposal/) and
[docs/service-manifest-proposal.json](docs/service-manifest-proposal.json)). Grants for these ids are
decided with the contracts library's matching rule (`server/auth/capabilities.js`).

### Events (SDK outbox, same transaction as the change)

| Event | Visibility | Notes |
|---|---|---|
| `trade.observation.created` | public | instrument, metric, value, unit, currency, observed_at, retrieved_at, source |
| `trade.alert.triggered` | subject (the owner) | delivery id, rule, instrument, trigger with its timestamps and source; data only, no rendered text (ADR-020) |
| `trade.source.stale`, `trade.source.recovered` | public | on transitions only, with `stale_since` |
| `trade.index_document.upserted` / `.deleted` | internal | `search.index-document@1` documents of listable instrument pages, tombstones otherwise |

Consumed: `sources.item.created|updated|removed` and `sources.fetch.failed` through the signed
webhook, as a wake-up for the cursor sync (the webhook is not durable truth; the sync is).

### Account export and deletion (ADR-033)

`network.account.export_requested` and `network.account.deleted` arrive at `POST /internal/events` and are answered by
`server/domain/account-data.js` (`openvibe-sdk/account-data`).

- **Export:** the person's watchlists and their items, alert rules and deliveries, context drafts, the revisions they
  wrote, the observations they recorded by hand, and their reviews.
- **Deleted:** watchlists (items cascade), alert rules with their deliveries, and drafts.
- **Made authorless:** instruments, aliases and purges they made. Context revisions and observations stay append-only:
  only inside the erasure transaction (`trade.account_erasure`, migration `0004_account_erasure.sql`) may a revision's
  author become NULL and their id leave `meta.authorship.authors`, or an observation's `recorded_by` become `deleted`.
  The text, the values and their provenance never change.
- **Kept, counted as retained:** reviews, since a person's approval is what lets reviewed text stay published.
- **Subscriptions:** the two are created at boot when missing (needs `EVENTS_URL` and `TRADE_EVENTS_WEBHOOK_SECRET`).
- **Receipts:** `account_data_events` keeps one per export and deletion.

### OpenVibe.AI seam (`trade.summarize_market_context`)

1. The AI (or its caller) reads `GET /api/v1/instruments/:symbol/context/input` — the workflow input
   with numbered sources: each observation and document with `observed_at`/`published_at`,
   `retrieved_at` and its staleness.
2. The AI service posts the output to `POST /api/v1/instruments/:symbol/context` with
   `X-OV-Origin: ai`, `workflow { id, run_id }`, `input_sources` and `output` (the workflow's
   schema). Citations are indices into `input_sources` and must exist.
3. The revision is an AI-generated **draft**: labelled, noindex, not shown to readers until a person
   on the editor list approves it at `/editor/i/:symbol`.

## Capabilities

Implemented here (the service manifest's `capabilities`, audience `openvibe.trade`, one per route; the
route table is under [API](#api-apiv1-problemjson-errors)): `trade.instrument.resolve`,
`trade.instrument.manage`, `trade.observation.write`, `trade.context.read`, `trade.context.propose`,
`trade.watchlist.read`, `.create`, `.update`, `.delete`, and `trade.alert.read`, `.create`, `.delete`.
None of them moves, holds or orders anything (ADR-025; `test/route-inventory.test.js`).

Called elsewhere, as the service principal `trade`: `events.event.publish` (Events) and
`sources.item.read` and `sources.source.read` (Sources). The list with audiences, and the grants other
services need to call Trade, is under [Grants the Network must hold](#grants-the-network-must-hold).

## Depends on

- **PostgreSQL 18 and Valkey 9** (OpenVibe.Host `roles/data/`, ADR-035): every read and write is async through
  `openvibe-sdk/db`; Valkey holds the per-actor limit counters (optional: without `VALKEY_URL` they count per process).
- **Packages** (pinned by release tarball): `openvibe-contracts` v0.97.0, `openvibe-publishing`
  v1.3.0 (revisions, authorship, seo, index-hooks, ssr, ingest, publication), `openvibe-shared` v4.179.0 (Frame, app icon,
  footer, legal, release, metrics, ready), `openvibe-sdk` v0.150.0 (events outbox and inbox, webhook
  signatures v2, service tokens, per-actor limits, service kit lifecycle).
- **OpenVibe.Network:** SSO (OAuth client `trade`, redirect `https://openvibe.trade/auth/callback`),
  JWKS, client-credentials tokens.
- **OpenVibe.Sources:** `sources.item.read` and `sources.source.read` (category `trade`).
- **OpenVibe.Events:** `events.event.publish`; a subscription for `sources.*` delivering to
  `http://127.0.0.1:4860/internal/events` (optional; the sync also runs on a timer).
- **OpenVibe.Search:** consumes `trade.index_document.*` (Search's `*.index_document.*` subscription;
  `trade` must be in `SEARCH_EVENT_OWNERS`).
- **OpenVibe.Network notifications:** Network consumes `trade.alert.triggered` (its `network`
  subscription) and puts a "Trade alert: <symbol>" notification in the rule owner's inbox, linking the
  instrument page; deliveries are also listed at `/watchlists`.
- **OpenVibe.AI:** `ai.run.create` (namespace `trade`) for the AI briefs, including the `batch` class for the
  worker's report briefs (`OV_AI_INTERNAL_URL`; off without it), and optionally the drafts below.
- **SEC EDGAR** (`data.sec.gov`, read directly, no key): XBRL company facts, public domain. Fair access: the
  User-Agent `TRADE_SEC_USER_AGENT` names us and a contact; requests are spaced `TRADE_SEC_MIN_INTERVAL_MS` (1 s)
  apart, at most `TRADE_SEC_PER_TICK` companies a tick. `TRADE_SEC_FACTS=off` turns it off.

### Grants the Network must hold

Each grant is `[client, capability, audience]`:

- `[trade, events.event.publish, openvibe.events]`
- `[trade, events.subscription.manage, openvibe.events]` (also the account subscriptions at boot)
- `[trade, network.account.export.contribute, openvibe.network]` and `[trade, network.account.deletion.confirm, openvibe.network]` (ADR-033; granted last, once this release is live)
- `[trade, sources.item.read, openvibe.sources]`
- `[trade, sources.source.read, openvibe.sources]`
- `[trade, ai.run.create, openvibe.ai, ['trade.*']]` (the AI briefs)
- For OpenVibe.AI to deliver drafts: `[ai, trade.context.read, openvibe.trade]` and
  `[ai, trade.context.propose, openvibe.trade]`
- For a first-party market data feed, when one exists: `[<feed client>, trade.observation.write, openvibe.trade]`
- For Network (or another first-party surface) to show a person's watchlists and alerts:
  `[network, trade.watchlist.read, openvibe.trade]`, `[network, trade.alert.read, openvibe.trade]` (optional)

## Acceptance (automated: `npm test`)

| Charter / roadmap / ADR-025 requirement | Test |
|---|---|
| **No execution, custody or advice endpoint exists**: a route-inventory test walks the live Express stack and fails on any route path, handler name, capability id or event type with order/buy/sell/execute/custody/wallet/escrow/checkout/listing semantics; every route has a named handler; a negative control proves it bites. | `test/route-inventory.test.js` |
| Every datum exposes observation and source timestamps; **no number without an observation**; times are required, never defaulted; observations immutable and idempotent per source reference. | `test/observations.test.js` |
| **Stale feeds shown as stale** (injected clock): "stale since" = last success + window; unknown freshness is not "current"; transitions emit once; a Sources outage invents nothing; `stale_price` in the gate. | `test/freshness.test.js` |
| **Alerts idempotent per triggering observation** (and per document): replayed observations, re-evaluation, replayed sync pages and item revisions deliver nothing new; crossing semantics; privacy of rules; no email. | `test/alerts.test.js` |
| **Watchlists never leak**: private cache headers, noindex, 404 for others, CSRF form tokens, capability + X-OV-Subject for services, never in sitemaps, feeds, Search or events. | `test/privacy.test.js` |
| AI output is a labelled draft, noindex until a person approves it; advice refused; editor forms; sitemap/Search follow publication. | `test/context.test.js` |
| Sources mapping (SEC filings), deterministic resolution, cursor replay, removals, signed webhook with inbox. | `test/sync.test.js` |
| Disclaimer on every page; no-JS pages; JSON twin = HTML; feeds without invented dates; robots/llms/sitemaps; readiness; the marketplace question is documented and nothing of it exists. | `test/pages.test.js` |
| IndexNow: off without `INDEXNOW_KEY` (no key route, nothing sent); with one the key file is served at `/<key>.txt` as `text/plain` and publishing or retracting indexable context pings the instrument path and the sitemap; a draft never pings. | `test/indexnow.test.js` |
| The home page's first load stays inside its size budgets (html/js/css, fresh database, no browser). | `test/perf-budget.test.js` |
| Proposals valid against the released schemas and equal to what the code enforces and emits; every envelope valid. | `test/contracts.test.js` |

## Launch rule

The launch rule (plan §12.12) is met: `openvibe.trade` went public on 2026-10-09, after an
independent pre-launch security review whose fixes shipped first.
[OpenVibers/OpenVibe.Sites](https://github.com/OpenVibers/OpenVibe.Sites) was deleted (plan T11), so
the domain serves the service itself. Status against each point:

1. **Runtime, health, readiness, observability:** done.
2. **Canonical identity and auth:** done (Network SSO, subjects, service tokens).
3. **SSR public routes useful without JS:** done.
4. **Persistence and end-to-end workflows:** done in tests and live on the host (empty database
   until editors add instruments); in production there is no market data source yet and the filings
   source is disabled in Sources (see "What it shows today").
5. **Capability and event registration against OpenVibe.Contracts:** done.
6. **Migration and seed strategy, threat review, sitemap/robots/feed behaviour:** done. Nothing to
   migrate (no current implementation); no seed (editors add instruments); threat review below.
7. **Acceptance tests:** done.

The launch release removed `openvibe.trade` from `OpenVibe.Sites/sites.json` and switched routing
(nginx vhost, DNS, TLS), flipped the Network hub entry and registered maturity in the ecosystem
registry, atomically, on 2026-10-09. OpenVibe.Sites is deleted (plan T11).

## Security and threat review

Reporting a vulnerability: [SECURITY.md](SECURITY.md).

- **Scope (ADR-025):** nothing moves or holds value. The route-inventory test is in CI; context that
  reads as advice is refused; the disclaimer is on every page.
- **Identity:** only verified Network JWTs (offline RS256 against JWKS) and service tokens for
  audience `openvibe.trade`; a bad service token is refused, never downgraded to anonymous; identity
  never comes from a body or query; `X-OV-*` headers are ignored for browsers.
- **Private data:** watchlists and alert rules are owner-only (404 otherwise), `private, no-store`,
  noindex, disallowed in robots, absent from sitemaps, feeds, Search documents and events (the
  alert event goes to its owner only, visibility `subject`).
- **CSRF:** SameSite=Lax session cookie plus an HMAC form token (`TRADE_FORM_SECRET`) on every form.
- **XSS:** all HTML through `openvibe-publishing/ssr` auto-escaping; context Markdown through its
  safe subset; external links `rel="nofollow noopener"`; CSP from helmet.
- **Honesty:** observation and retrieval times are required; values are stored exactly as stated;
  observations are immutable; documents never get invented dates; JSON-LD only from real fields;
  AI drafts are labelled and gated by a person's review.
- **SSRF:** Trade fetches only its configured Network and Sources hosts; it never fetches a URL from
  a source item (it links to it).
- **Webhook:** signature v2 only (HMAC over `<timestamp>.<raw body>`, timestamp within the replay
  window; a v1-only or stale delivery is refused), inbox per event id, host-local only (nginx returns 404).
- **Abuse:** rate limits on `/auth`, private forms and `/api/v1`, in Express and in the nginx
  reference; per-actor limits (below); per-person limits of 20 watchlists × 200 instruments and 100
  alert rules.
- **Known gaps:** the advice filter is a phrase guard, not a guarantee (editors remain accountable);
  there is no market data source yet; Network does not consume `trade.alert.triggered` yet; Search
  documents exist only for instruments with reviewed context.

### Per-actor limits

`/api/v1` and the watchlist, alert and editor forms also limit who calls them, once `req.viewer` is
resolved and a route's capability guard (for a form, the session and form token) passed, before any
work: `server/http/actor-limits.js`, openvibe-sdk/limits, roadmap WS-R task 4. Counted: a person as
`user:usr_…` (their own token or cookie, a first-party service naming them in `X-OV-Subject`, or an
app's `on_behalf_of`); a service or app acting as itself (a feed, OpenVibe.AI) by its principal;
anyone else by address. Signed-out reads keep only the per-address limit (many readers share a
carrier or campus address), and a first-party service reading for itself is not counted on reads.
Past a limit: `429` problem+json `rate_limited` with `Retry-After`, one log line and
`trade_rate_limited_total{limit,window}`. A form and the API route that do the same thing share one
budget.

| Routes (API and form) | Per caller, a minute / an hour |
|---|---|
| Signed-in API reads | `TRADE_LIMITS_MINUTE` / `TRADE_LIMITS_HOUR` (120 / 3000) |
| Instrument create, edit, aliases | 30 / 300 |
| `POST /observations` (a feed) | 240 / 10 000 |
| Context proposals and editor context revisions | 60 / 1200 |
| Context review, publish, retract | 30 / 300 |
| Watchlist create | 10 / 100 |
| Watchlist rename, delete, add and remove items | 60 / 600 |
| Alert create | 20 / 100 |
| Alert delete | 60 / 600 |

Never limited per actor: `/api/health`, `/api/ready`, `/release.json`, `/release-metrics`, `/metrics`,
sign-in, the pages and feeds people read, and the signed Events deliveries at `/internal/events`.
`test/actor-limits.test.js`.

## Development

```bash
fnm exec --using=22.22.1 npm install
fnm exec --using=22.22.1 npm test          # temp databases and in-process mocks, no network
fnm exec --using=22.22.1 npm run dev       # http://localhost:4860 (set OV_OAUTH_CLIENT_SECRET to sign in)
```

## Deploy (for the lead)

Production deploys with `sudo ovhost deploy trade` on the host (strategy `git-checkout`: fetch,
fast-forward `/opt/openvibe.trade`, install on a lockfile change, restart, wait for `/api/ready`).
The unit is `openvibe-trade.service` on `127.0.0.1:4860`, the env file `/etc/openvibe/trade.env`. The database is
`ov_trade` on the host's data role (`sudo /opt/openvibe.host/roles/data/add-service.sh trade` writes its settings); the
release migrates it at boot.
Rollback: ovhost puts the previous sha back by itself when `/api/ready` does not answer 2xx after the
restart; afterwards `sudo ovhost rollback trade --to <sha>`. Migrations only add tables and columns.

First install (done once; kept for a rebuild):

1. **Code and config:** code at `/opt/openvibe.trade`, `npm ci --omit=dev` on Node 22.
   Create `/etc/openvibe/trade.env` (0600) from `.env.example` with `OV_OAUTH_CLIENT_SECRET`,
   `TRADE_EDITORS`, `TRADE_FORM_SECRET`, `EVENTS_URL=http://127.0.0.1:4300`,
   `BASE_URL=https://openvibe.trade`, `OV_SOURCES_INTERNAL_URL=http://127.0.0.1:4720` and, if the
   Events subscription is created, `TRADE_EVENTS_WEBHOOK_SECRET`.
2. **Network:** register (or seed) the OAuth client `trade` with redirect
   `https://openvibe.trade/auth/callback`, set its secret, add the grants above.
3. **Events:** `node scripts/subscribe.js` creates the subscription for consumer `trade`, topic
   `sources.*`, endpoint `http://127.0.0.1:4860/internal/events` (loopback: nginx never proxies
   `/internal/`), secret = `TRADE_EVENTS_WEBHOOK_SECRET` (32+ characters). It needs
   `OV_OAUTH_CLIENT_SECRET` and the `[trade, events.subscription.manage, openvibe.events]` grant.
   Pass `--endpoint <url>` when the Events host differs.
4. **Search:** add `trade` to `SEARCH_EVENT_OWNERS` if it is not there.
5. **systemd:** install `deploy/systemd/openvibe-trade.service` (port 4860, `StateDirectory=openvibe-trade`).
6. **nginx:** install `deploy/nginx/openvibe.trade.conf` (`/metrics` and `/internal/` never proxied).
7. **Contracts:** done: the capabilities and manifest are released in openvibe-contracts v0.97.0,
   and CI's contracts check runs against them.
8. **Data:** editors add instruments at `/editor`. Filings appear once `sec-xbrl-filings` is enabled
   in Sources (after a person verifies its terms); numbers appear only once a market data source
   exists and states them.
9. **Launch:** done on 2026-10-09: `openvibe.trade` was removed from OpenVibe.Sites (now deleted,
   plan T11) and the Network hub entry flipped (see the launch rule).

---

Part of the [OpenVibe network](https://openvibe.network). Built in the open by [OpenVibers](https://github.com/OpenVibers).

<!-- versions:start -->
- openvibe-contracts: v0.419.0
- openvibe-sdk: v0.161.0
- openvibe-shared: v4.238.0
- openvibe-publishing: v1.7.0
<!-- versions:end -->