roster: live-data pipeline — public RosterView read + Ed25519 ingest + Obs*→roster

.github/workflows/test.yml

@@ -14,10 +14,8 @@ jobs:
     name: Build (TypeScript strict)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: latest
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: oven-sh/setup-bun@ecf28ddc73e819eb6fa29df6b34ef8921c743461 # v2
       - run: bun install
       - run: bun run build
 
@@ -26,31 +24,25 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: actions/checkout@v4
-      - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: latest
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: oven-sh/setup-bun@ecf28ddc73e819eb6fa29df6b34ef8921c743461 # v2
       - run: bun install
       - run: bun test
 
   lint:
     name: Lint (Biome)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: latest
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: oven-sh/setup-bun@ecf28ddc73e819eb6fa29df6b34ef8921c743461 # v2
       - run: bun install
-      - run: bun run lint
+      - run: bunx @biomejs/biome check .
 
   audit:
     name: Dependency Audit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: latest
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: oven-sh/setup-bun@ecf28ddc73e819eb6fa29df6b34ef8921c743461 # v2
       - run: bun install
-      - run: bun audit || true
+      - run: bunx audit-ci --moderate

biome.json

@@ -0,0 +1,12 @@
+{
+	"$schema": "https://biomejs.dev/schemas/1.9.4/schema.json",
+	"linter": {
+		"enabled": true,
+		"rules": {
+			"recommended": true,
+			"suspicious": {
+				"noExplicitAny": "off"
+			}
+		}
+	}
+}

config.yaml

@@ -1,17 +1,15 @@
 name: tps-observatory
 rest: true
 
-http:
-  port: 9927
+# Co-hosted as a component in the existing Harper instance — it shares the
+# instance's REST side (no own http.port) and is managed via the ops side.
+# Per-resource access (Obs* public-read at CP2) is set on the resources, not here.
 
 graphqlSchema:
   files: schemas/*.graphql
 
 jsResource:
   files: dist/resources/*.js
 
-authentication:
-  authorizeLocal: false   # Observatory is public-read; IngestEvents uses Ed25519
-
-static:
-  path: ui
+# static UI (the renderer) is added at CP2 — omitted at CP1 so the substrate
+# (Obs* schema + IngestEvents) loads without the static-serving config.

package.json

@@ -1,19 +1,19 @@
 {
-  "name": "tps-observatory",
-  "version": "0.1.0",
-  "description": "TPS Observatory \u2014 multi-Flair aggregation dashboard on Harper Fabric",
-  "type": "module",
-  "scripts": {
-    "build": "tsc --build",
-    "test": "bun test",
-    "lint": "biome lint ./resources ./schemas"
-  },
-  "dependencies": {
-    "harperdb": "*"
-  },
-  "devDependencies": {
-    "@types/bun": "latest",
-    "typescript": "^5.0.0",
-    "@biomejs/biome": "^1.0.0"
-  }
+	"name": "tps-observatory",
+	"version": "0.1.0",
+	"description": "TPS Observatory \u2014 multi-Flair aggregation dashboard on Harper Fabric",
+	"type": "module",
+	"scripts": {
+		"build": "tsc --build",
+		"test": "bun test",
+		"lint": "biome lint ./resources ./schemas"
+	},
+	"dependencies": {
+		"harperdb": "*"
+	},
+	"devDependencies": {
+		"@types/bun": "latest",
+		"typescript": "^5.0.0",
+		"@biomejs/biome": "^1.0.0"
+	}
 }