Verification contract

Place opencloud.verify.yaml beside opencloud.yaml.

schemaVersion: 1
data:
  mode: owner
  table: items
  ownerColumn: owner_id
  markerColumn: title
  insert: {}
storage:
  objectPrefix: opencloud-verify/items
realtime:
  topic: items
function:
  name: summarize
  secretName: OPENCLOUD_VERIFY_SECRET
  digestField: secretDigest
  presentField: secretPresent
cron:
  name: hourly-summary

The CLI reads both files. It rejects unknown fields and contradictions before making live changes:

• Storage authorization is derived from the app manifest.
• Function and cron names must exist in the manifest.
• The verified Function must require a user JWT.
• The cron must be enabled.
• The verification secret must be declared in requiredSecrets.

Data modes

mode: owner verifies two-user isolation, default ownership, and forged-owner denial.

mode: shared verifies that two admitted users can see both fixtures. Use this for deliberately shared app-member tables. ownerColumn is optional in shared mode.

Runtime ladder

The verifier checks:

1. canonical origins, private redirect, and two brokered users;
2. the selected owner/shared data model;
3. manifest-derived Storage behavior and cross-app denial;
4. private Realtime delivery and foreign-topic denial;
5. Function authentication, secret non-disclosure, and live rotation;
6. a deterministically triggered successful cron history record; and
7. scoped logs and usage.

It cleans data and object fixtures. The verification Function must return only the secret’s SHA-256 digest and a presence flag.

Browser and interaction contract

The authoritative release gate runs in OpenCloud:

"$OPENCLOUD_CLI" app verify "$APP_ID"

For an additional local product-interaction diagnostic, run the real UI with the public CLI and a compatible Chromium:

"$OPENCLOUD_CLI" app verify-ui "$APP_ID"

The authoritative server gate and local diagnostic both render the canonical page, import the runtime-advertised SDK, fetch its declarations, check exact release metadata, and fail on console, page, failed same-origin request, or server-response errors. Public production verification executes the same window.__opencloudVerify({ client, config, session }) hook as dev.

For an interactive app, require a small product-specific interaction contract:

"$OPENCLOUD_CLI" app verify-ui "$APP_ID" --require-interaction

The app should also declare the requirement:

<meta name="opencloud-ui-contract" content="required">

globalThis.__opencloudVerify = async ({ client, config, session }) => {
  document.querySelector("[data-open-workspace]")?.click();
  if (!document.querySelector("[data-workspace-ready]")) {
    throw new Error("workspace did not render");
  }
  return {
    passed: true,
    checks: ["opened workspace", `matched app ${config.appId}`],
    coverage: ["view-transition", "state-assertion"],
  };
};

The function receives the first-party client, exact config, and safe session. It must finish in 10 seconds and return passed: true plus 1–20 short check names. A required contract must demonstrate both a meaningful view transition and a state assertion. All browser and network diagnostics generated during those interactions remain release blockers.