OpenVibe.Watch: the service — watch registry, scheduler, conditional-pull check engine (http/feed/api), observations and events (plan T18 steps 2-3). (#1)

OP OpenVibers committed 7 Oct 2026 · tag v0.1.0 · 0 files, +0 −0
Everything is built and green. Final report:

## What's in the checkout

`OpenVibe.Watch` on branch `agent/plan-w1-watch-10071025`, modelled file-for-file on `OpenVibe.Sources` (origin/main), pinned to **openvibe-contracts v0.107.0, openvibe-sdk v0.34.0, openvibe-shared v2.11.0**, PORT **4730**, `WATCH_RUN_URL` default **http://127.0.0.1:4920**. Nothing committed, nothing pushed.

### File list

**Root**
- `package.json` — dossier skeleton, corrected pins; deps via codeload tag tarballs
- `package-lock.json` — generated with `npm install --package-lock-only --ignore-scripts --no-audit --no-fund` (through `node` child_process); resolved 0.107.0 / 0.34.0 / 2.11.0
- `.env.example` — every `WATCH_*`/`OV_*` key from the dossier (+ `WATCH_ALLOWED_PORTS`, `WATCH_ALLOW_PRIVATE_HOSTS`, `WATCH_OBSERVATIONS_MAX_PER_CHECK`, `WATCH_RETENTION_DEFAULT_DAYS`, `WATCH_RUN_URL=…4920`)
- `LICENSE` — AGPL-3.0, copied from Sources
- `README.md` — purpose, model, binding carrier order, a check step by step, extraction/condition tables, API + limits, events, security, owns/does-not-own, acceptance
- `SECURITY.md` — copied from Sources
- `STATUS.json` — stage alpha, port 4730, contracts v0.107.0, `deployed: false`
- `.gitignore` — copied from Sources
- `.github/workflows/ci.yml` — Sources' shared test/security jobs with `contracts-service: watch`
- `migrations/0001_initial.sql` — the dossier's whole schema verbatim (watches, watch_endpoint_state, check_runs, observations, counters, event_outbox)

**server/**
- `config.js` — Sources' config with watch's port/service/audience/limits/worker/fetch, `run` and `retention` blocks; `secrets: env` for `WATCH_CRED_*` by name
- `db.js` — Sources', `service: 'watch'`/`'watch-migrate'`, PGlite in `data/pglite`, `nextSeq` kept
- `auth.js` — one capability per route; `svc:` via the JWKS client + contracts' `verifyServiceToken`, `usr_`/`agt_` via `openvibe-sdk/auth` `verifyUserToken`; sets `req.principal = { sub, kind, role, cap, jti, subject }`; `X-OV-Subject` only from a first-party `svc:`
- `registry.js` — request/view validation with openvibe-contracts' validator, CRUD with owner scoping, `nextDue` arming/backoff, soft delete, ULID keyset page, `due()`
- `observations.js` — build/insert (one transaction with the run), latest/before, `heldSince` (the for_sec trail), list, retention prune, `watch.observation@1` view
- `condition.js` — `changed` with tolerance/percent, every predicate op, `for_sec` debounce, no guessing on non-numbers
- `extract.js` — text/html/css subset (own tokenizer + selector matcher)/json/jsonpath/regex; `ai` → `unsupported`; `fields`
- `util.js` — sha256, canonical JSON, hashes, body decoding, text/date/URL helpers (Sources' adapters/util.js)
- `check.js` — the engine: inflight, carrier choice, fetch, extract, evaluate, observation+run+events in one transaction, arming, `watch.observation.recorded` / `watch.watch.triggered` / `watch.check.failed`
This commit has no diff to show.