parasite log

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

config/conf.go

@@ -9,6 +9,9 @@ import "sync"
 // ===================================================
 
 type Config struct {
+	IsApi  bool
+	IsNano bool
+
 	APIPort        int
 	NATSUrl        string
 	MongoUrl       string
@@ -27,6 +30,7 @@ type Config struct {
 	InternalWorkspaceAPI  string
 	InternalPeerAPI       string
 	InternalDatacenterAPI string
+	InternalSchedulerAPI  string
 }
 
 func (c Config) GetUrl() string {
@@ -47,9 +51,13 @@ func GetConfig() *Config {
 	return instance
 }
 
-func SetConfig(mongoUrl string, database string, natsUrl string, lokiUrl string, logLevel string, port int,
+func SetConfig(isNano bool, isAPI bool, mongoUrl string, database string, natsUrl string, lokiUrl string, logLevel string, port int,
 	pkPath, ppPath,
-	internalCatalogAPI, internalSharedAPI, internalWorkflowAPI, internalWorkspaceAPI, internalPeerAPI, internalDatacenterAPI string) *Config {
+	internalCatalogAPI, internalSharedAPI, internalWorkflowAPI, internalWorkspaceAPI,
+	internalPeerAPI, internalDatacenterAPI string, internalSchedulerAPI string) *Config {
+	GetConfig().IsNano = isNano
+	GetConfig().IsApi = isAPI
+
 	GetConfig().MongoUrl = mongoUrl
 	GetConfig().MongoDatabase = database
 	GetConfig().NATSUrl = natsUrl
@@ -66,5 +74,6 @@ func SetConfig(mongoUrl string, database string, natsUrl string, lokiUrl string,
 	GetConfig().InternalWorkspaceAPI = internalWorkspaceAPI
 	GetConfig().InternalPeerAPI = internalPeerAPI
 	GetConfig().InternalDatacenterAPI = internalDatacenterAPI
+	GetConfig().InternalSchedulerAPI = internalSchedulerAPI
 	return GetConfig()
 }

dbs/dbs.go

@@ -2,6 +2,7 @@ package dbs
 
 import (
 	"fmt"
+	"reflect"
 	"runtime/debug"
 	"strings"
 
@@ -102,12 +103,12 @@ func GetBson(filters *Filters) bson.D {
 			}
 		}
 		if len(orList) > 0 && len(andList) == 0 {
-			f = bson.D{{"$or", orList}}
+			f = bson.D{{Key: "$or", Value: orList}}
 		} else {
 			if len(orList) > 0 {
 				andList = append(andList, bson.M{"$or": orList})
 			}
-			f = bson.D{{"$and", andList}}
+			f = bson.D{{Key: "$and", Value: andList}}
 		}
 	}
 	return f
@@ -148,6 +149,137 @@ type Filter struct {
 	Value    interface{} `json:"value,omitempty"`
 }
 
+// FiltersFromFlatMap builds a *Filters from a map[string]interface{} whose structure
+// mirrors the JSON form of Filters:
+//
+//	{
+//	  "and": { "name": [{"operator":"like","value":"foo"}] },
+//	  "or":  { "source": [{"operator":"equal","value":"bar"}] }
+//	}
+//
+// Keys inside "and"/"or" are json tag names; the function resolves each to its
+// full dotted BSON path using the target struct. Unknown keys are kept as-is.
+func FiltersFromFlatMap(flatMap map[string]interface{}, target interface{}) *Filters {
+	filters := &Filters{
+		And: make(map[string][]Filter),
+		Or:  make(map[string][]Filter),
+	}
+	paths := jsonToBsonPaths(reflect.TypeOf(target), "")
+	resolve := func(jsonKey string) string {
+		if p, ok := paths[jsonKey]; ok {
+			return p
+		}
+		return jsonKey
+	}
+	parseFilters := func(raw interface{}) map[string][]Filter {
+		out := make(map[string][]Filter)
+		m, ok := raw.(map[string]interface{})
+		if !ok {
+			return out
+		}
+		for jsonKey, val := range m {
+			bsonKey := resolve(jsonKey)
+			items, ok := val.([]interface{})
+			if !ok {
+				continue
+			}
+			for _, item := range items {
+				entry, ok := item.(map[string]interface{})
+				if !ok {
+					continue
+				}
+				f := Filter{}
+				if op, ok := entry["operator"].(string); ok {
+					f.Operator = op
+				}
+				if v, ok := entry["value"]; ok {
+					f.Value = v
+				}
+				out[bsonKey] = append(out[bsonKey], f)
+			}
+		}
+		return out
+	}
+	if and, ok := flatMap["and"]; ok {
+		filters.And = parseFilters(and)
+	}
+	if or, ok := flatMap["or"]; ok {
+		filters.Or = parseFilters(or)
+	}
+	return filters
+}
+
+// jsonToBsonPaths recursively walks a struct type and returns a map of
+// json_name → dotted_bson_path for every field reachable from that type.
+//
+// Anonymous embedded fields without any tag follow the BSON convention of this
+// codebase: they are stored as a nested sub-document whose key is the lowercased
+// struct type name (e.g. utils.AbstractObject → "abstractobject").
+func jsonToBsonPaths(t reflect.Type, prefix string) map[string]string {
+	for t.Kind() == reflect.Ptr || t.Kind() == reflect.Slice {
+		t = t.Elem()
+	}
+	result := make(map[string]string)
+	if t.Kind() != reflect.Struct {
+		return result
+	}
+	for i := 0; i < t.NumField(); i++ {
+		field := t.Field(i)
+
+		jsonTag := field.Tag.Get("json")
+		bsonTag := field.Tag.Get("bson")
+		jsonName := strings.Split(jsonTag, ",")[0]
+		bsonName := strings.Split(bsonTag, ",")[0]
+
+		// Anonymous embedded struct with no tags: use lowercase type name as BSON prefix.
+		if field.Anonymous && jsonName == "" && bsonName == "" {
+			ft := field.Type
+			for ft.Kind() == reflect.Ptr {
+				ft = ft.Elem()
+			}
+			if ft.Kind() == reflect.Struct {
+				embedPrefix := strings.ToLower(ft.Name())
+				if prefix != "" {
+					embedPrefix = prefix + "." + embedPrefix
+				}
+				for k, v := range jsonToBsonPaths(ft, embedPrefix) {
+					if _, exists := result[k]; !exists {
+						result[k] = v
+					}
+				}
+			}
+			continue
+		}
+
+		if jsonName == "" || jsonName == "-" {
+			continue
+		}
+		if bsonName == "" || bsonName == "-" {
+			bsonName = jsonName
+		}
+
+		fullPath := bsonName
+		if prefix != "" {
+			fullPath = prefix + "." + bsonName
+		}
+
+		result[jsonName] = fullPath
+
+		ft := field.Type
+		for ft.Kind() == reflect.Ptr || ft.Kind() == reflect.Slice {
+			ft = ft.Elem()
+		}
+		if ft.Kind() == reflect.Struct {
+			for k, v := range jsonToBsonPaths(ft, fullPath) {
+				if _, exists := result[k]; !exists {
+					result[k] = v
+				}
+			}
+		}
+	}
+	return result
+}
+
 type Input = map[string]interface{}
 
 func InputToBson(i Input, isUpdate bool) bson.D {

dbs/mongo/mongo.go

@@ -267,6 +267,9 @@ func (m *MongoDB) LoadOne(id string, collection_name string) (*mongo.SingleResul
 	}
 	filter := bson.M{"_id": id}
 	targetDBCollection := CollectionMap[collection_name]
+	if targetDBCollection == nil {
+		return nil, 503, errors.New("collection " + collection_name + " not initialized")
+	}
 	MngoCtx, cancel = context.WithTimeout(context.Background(), 5*time.Second)
 	//defer cancel()
 
@@ -279,16 +282,21 @@ func (m *MongoDB) LoadOne(id string, collection_name string) (*mongo.SingleResul
 	return res, 200, nil
 }
 
-func (m *MongoDB) Search(filters *dbs.Filters, collection_name string) (*mongo.Cursor, int, error) {
+func (m *MongoDB) Search(filters *dbs.Filters, collection_name string, offset int64, limit int64) (*mongo.Cursor, int, error) {
 	if err := m.createClient(mngoConfig.GetUrl(), false); err != nil {
 		return nil, 503, err
 	}
 	opts := options.Find()
-	opts.SetLimit(1000)
 	targetDBCollection := CollectionMap[collection_name]
+	if targetDBCollection == nil {
+		return nil, 503, errors.New("collection " + collection_name + " not initialized")
+	}
 
 	f := dbs.GetBson(filters)
 
+	opts.SetSkip(offset) // OFFSET
+	opts.SetLimit(limit) // LIMIT
+
 	MngoCtx, cancel = context.WithTimeout(context.Background(), 5*time.Second)
 	// defer cancel()
 	if cursor, err := targetDBCollection.Find(
@@ -323,7 +331,8 @@ func (m *MongoDB) LoadFilter(filter map[string]interface{}, collection_name stri
 	return res, 200, nil
 }
 
-func (m *MongoDB) LoadAll(collection_name string) (*mongo.Cursor, int, error) {
+func (m *MongoDB) LoadAll(collection_name string, offset int64, limit int64) (*mongo.Cursor, int, error) {
+
 	if err := m.createClient(mngoConfig.GetUrl(), false); err != nil {
 		return nil, 503, err
 	}
@@ -331,8 +340,10 @@ func (m *MongoDB) LoadAll(collection_name string) (*mongo.Cursor, int, error) {
 
 	MngoCtx, cancel = context.WithTimeout(context.Background(), 5*time.Second)
 	//defer cancel()
-
+	findOptions := options.Find()
-	res, err := targetDBCollection.Find(MngoCtx, bson.D{})
+	findOptions.SetSkip(offset) // OFFSET
+	findOptions.SetLimit(limit) // LIMIT
+	res, err := targetDBCollection.Find(MngoCtx, bson.D{}, findOptions)
 	if err != nil {
 		// m.Logger.Error().Msg("Couldn't find any resources. Error : " + err.Error())
 		return nil, 404, err

docs/plantuml-human-readable.md

@@ -0,0 +1,214 @@
+# PlantUML — Format de commentaire human-readable
+
+Ce document décrit la syntaxe des commentaires attachés aux ressources et aux liens
+dans les fichiers PlantUML importés par OpenCloud.
+
+---
+
+## Syntaxe générale
+
+```plantuml
+TypeRessource(varName, "Nom affiché") ' clé: valeur, clé.sous_clé: valeur
+```
+
+### Règles de parsing
+
+| Règle | Détail |
+|---|---|
+| Séparateur de paires | `,` |
+| Séparateur clé/valeur | premier `:` de la paire (les URLs `http://...` sont gérées) |
+| Sous-objets | notation pointée `access.container.image: nginx` |
+| Types | auto-inférés : `bool` > `float64` > `string` |
+| Fallback | JSON brut si le commentaire commence par `{` (compatibilité ascendante) |
+
+### Comportement à l'import
+
+Chaque ressource reçoit automatiquement une **instance par défaut**, seedée avec les
+attributs de la ressource parente. Le commentaire vient ensuite **surcharger** uniquement
+les champs explicitement renseignés.
+
+> **Exception :** `WorkflowEvent` n'a pas d'instance (voir section dédiée).
+
+---
+
+## Ressources disponibles
+
+### `Data(var, "nom")` — Données
+
+Ressource de données. Les attributs qualifient le modèle de données **et** son instance
+(source d'accès).
+
+| Clé | Type | Description |
+|---|---|---|
+| `type` | string | Type de données (`raster`, `vector`, `tabular`…) |
+| `quality` | string | Niveau de qualité |
+| `open_data` | bool | Données en accès libre |
+| `static` | bool | Données statiques (pas de mise à jour) |
+| `personal_data` | bool | Contient des données personnelles |
+| `anonymized_personal_data` | bool | Données personnelles anonymisées |
+| `size` | float64 | Taille en GB |
+| `access_protocol` | string | Protocole d'accès (`http`, `s3`, `ftp`…) |
+| `country` | string | Code pays ISO (`FR`, `DE`…) |
+| `location.latitude` | float64 | Latitude géographique |
+| `location.longitude` | float64 | Longitude géographique |
+| `source` | string | URL / endpoint d'accès à la donnée |
+
+```plantuml
+Data(d1, "Satellites L2A") ' type: raster, open_data: true, size: 120.5, source: https://catalogue.example.com, country: FR
+```
+
+---
+
+### `Processing(var, "nom")` — Traitement
+
+Ressource de traitement (algorithme, conteneur, service). Les attributs qualifient
+le modèle de traitement **et** sa configuration d'exécution.
+
+| Clé | Type | Description |
+|---|---|---|
+| `infrastructure` | int | Infrastructure cible : `0`=DOCKER, `1`=KUBERNETES, `2`=SLURM, `3`=HW, `4`=CONDOR |
+| `is_service` | bool | Traitement persistant (service long-running) |
+| `open_source` | bool | Code source ouvert |
+| `license` | string | Licence (`MIT`, `Apache-2.0`, `GPL-3.0`…) |
+| `maturity` | string | Maturité (`prototype`, `beta`, `production`…) |
+| `access_protocol` | string | Protocole d'accès |
+| `country` | string | Code pays ISO |
+| `location.latitude` | float64 | Latitude |
+| `location.longitude` | float64 | Longitude |
+| `access.container.image` | string | Image du conteneur |
+| `access.container.command` | string | Commande de démarrage |
+| `access.container.args` | string | Arguments de la commande |
+
+```plantuml
+Processing(p1, "NDVI Calc") ' infrastructure: 0, open_source: true, license: MIT, maturity: production, access.container.image: myrepo/ndvi:1.2
+```
+
+---
+
+### `Storage(var, "nom")` — Stockage
+
+Ressource de stockage. Produit une instance live (`LiveStorage`) à l'import.
+
+| Clé | Type | Description |
+|---|---|---|
+| `storage_type` | int | Type de stockage (enum) |
+| `source` | string | URL / endpoint du stockage |
+| `path` | string | Chemin ou bucket dans le stockage |
+| `local` | bool | Stockage local |
+| `security_level` | string | Niveau de sécurité |
+| `size` | float64 | Taille allouée en GB |
+| `encryption` | bool | Chiffrement activé |
+| `redundancy` | string | Politique de redondance |
+| `throughput` | string | Débit cible |
+| `access_protocol` | string | Protocole (`s3`, `nfs`, `smb`…) |
+| `country` | string | Code pays ISO |
+| `location.latitude` | float64 | Latitude |
+| `location.longitude` | float64 | Longitude |
+
+```plantuml
+Storage(s1, "Minio OVH") ' source: http://minio.example.com:9000, path: /bucket/data, access_protocol: s3, encryption: true, size: 500, country: FR
+```
+
+---
+
+### `ComputeUnit(var, "nom")` — Unité de calcul
+
+Ressource de calcul (datacenter, cluster). Produit une instance live (`LiveDatacenter`)
+à l'import.
+
+| Clé | Type | Description |
+|---|---|---|
+| `architecture` | string | Architecture CPU (`x86_64`, `arm64`…) |
+| `infrastructure` | int | `0`=DOCKER, `1`=KUBERNETES, `2`=SLURM, `3`=HW, `4`=CONDOR |
+| `source` | string | URL de l'API du datacenter |
+| `security_level` | string | Niveau de sécurité |
+| `annual_co2_emissions` | float64 | Émissions CO₂ annuelles (kg) |
+| `access_protocol` | string | Protocole d'accès |
+| `country` | string | Code pays ISO |
+| `location.latitude` | float64 | Latitude |
+| `location.longitude` | float64 | Longitude |
+
+```plantuml
+ComputeUnit(c1, "Datacenter Rennes") ' source: https://api.dc-rennes.example.com, infrastructure: 1, country: FR, location.latitude: 48.11, location.longitude: -1.68, security_level: high
+```
+
+---
+
+### `WorkflowEvent(var, "nom")` — Événement déclencheur de workflow
+
+Crée directement un `NativeTool` de type `WORKFLOW_EVENT` (Kind = 0).
+Représente le point de départ d'un workflow.
+
+> **Pas d'instance. Pas de commentaire.**
+> Le nom du `NativeTool` est forcé à `WORKFLOW_EVENT` à l'import.
+
+```plantuml
+WorkflowEvent(e1, "Start")
+```
+
+---
+
+## Liens
+
+Les commentaires sur les liens qualifient la connexion entre deux ressources
+(typiquement entre un traitement et un stockage).
+
+### Syntaxe
+
+```plantuml
+source --> destination ' clé: valeur
+source <-- destination ' clé: valeur
+source -- destination  ' clé: valeur (non directionnel)
+```
+
+### Attributs disponibles
+
+| Clé | Type | Description |
+|---|---|---|
+| `storage_link_infos.write` | bool | `true` = écriture, `false` = lecture |
+| `storage_link_infos.source` | string | Chemin source dans le lien |
+| `storage_link_infos.destination` | string | Chemin destination dans le lien |
+| `storage_link_infos.filename` | string | Nom du fichier échangé |
+
+```plantuml
+p1 --> s1 ' storage_link_infos.write: true, storage_link_infos.filename: output.tif
+d1 --> p1
+```
+
+---
+
+## Exemple complet
+
+```plantuml
+@startuml
+!include opencloud.puml
+
+WorkflowEvent(e1, "Start")
+
+Data(d1, "Satellites L2A") ' type: raster, open_data: true, size: 120.5, source: https://catalogue.example.com, country: FR
+
+Processing(p1, "NDVI") ' infrastructure: 0, open_source: true, license: MIT, access.container.image: myrepo/ndvi:1.2
+
+Storage(s1, "Minio résultats") ' source: http://minio.example.com:9000, path: /results, access_protocol: s3, encryption: true, size: 500, country: FR
+
+ComputeUnit(c1, "DC Rennes") ' source: https://api.dc.example.com, infrastructure: 1, country: FR, location.latitude: 48.11, location.longitude: -1.68
+
+e1 --> p1
+d1 --> p1
+p1 --> s1 ' storage_link_infos.write: true, storage_link_infos.filename: ndvi.tif
+s1 --> c1
+
+@enduml
+```
+
+---
+
+## Récapitulatif des types de ressources
+
+| Mot-clé PlantUML | Type Go | Instance | Live | Commentaire |
+|---|---|---|---|---|
+| `Data` | `DataResource` | `DataInstance` | non | oui |
+| `Processing` | `ProcessingResource` | `ProcessingInstance` | non | oui |
+| `Storage` | `StorageResource` | `StorageResourceInstance` | oui → `LiveStorage` | oui |
+| `ComputeUnit` | `ComputeResource` | `ComputeResourceInstance` | oui → `LiveDatacenter` | oui |
+| `WorkflowEvent` | `NativeTool` (Kind=WORKFLOW_EVENT) | aucune | non | non |

entrypoint.go

@@ -63,8 +63,16 @@ const (
 	LIVE_STORAGE                       = tools.LIVE_STORAGE
 	PURCHASE_RESOURCE                  = tools.PURCHASE_RESOURCE
 	NATIVE_TOOL                        = tools.NATIVE_TOOL
+	EXECUTION_VERIFICATION             = tools.EXECUTION_VERIFICATION
+	ALLOWED_IMAGE                      = tools.ALLOWED_IMAGE
+	SERVICE_RESOURCE                   = tools.SERVICE_RESOURCE
+	LIVE_SERVICE                       = tools.LIVE_SERVICE
 )
 
+func FiltersFromFlatMap(flatMap map[string]interface{}, target interface{}) *dbs.Filters {
+	return dbs.FiltersFromFlatMap(flatMap, target)
+}
+
 func GetMySelf() (*peer.Peer, error) {
 	pp, err := utils.GetMySelf((&peer.Peer{}).GetAccessor(&tools.APIRequest{Admin: true}))
 	if pp == nil {
@@ -149,6 +157,9 @@ func InitDaemon(appName string) {
 	// resources.InitNative()
 	// feed the library with the loaded config
 	SetConfig(
+		o.GetBoolDefault("IS_NANO", false),
+		o.GetBoolDefault("IS_API", true),
+
 		o.GetStringDefault("MONGO_URL", "mongodb://127.0.0.1:27017"),
 		o.GetStringDefault("MONGO_DATABASE", "DC_myDC"),
 		o.GetStringDefault("NATS_URL", "nats://localhost:4222"),
@@ -164,13 +175,16 @@ func InitDaemon(appName string) {
 		o.GetStringDefault("INTERNAL_WORKSPACE_API", "oc-workspace"),
 		o.GetStringDefault("INTERNAL_PEER_API", "oc-peer"),
 		o.GetStringDefault("INTERNAL_DATACENTER_API", "oc-datacenter"),
+		o.GetStringDefault("INTERNAL_SCHEDULER_API", "oc-scheduler"),
 	)
+	if config.GetConfig().IsApi {
 		// Beego init
 		beego.BConfig.AppName = appName
 		beego.BConfig.Listen.HTTPPort = o.GetIntDefault("port", 8080)
 		beego.BConfig.WebConfig.DirectoryIndex = true
 		beego.BConfig.WebConfig.StaticDir["/swagger"] = "swagger"
 	}
+}
 
 type IDTokenClaims struct {
 	UserID string   `json:"user_id"`
@@ -189,6 +203,53 @@ type Claims struct {
 	Session SessionClaims `json:"session"`
 }
 
+func GetExtends(objs []utils.ShallowDBObject, typ ...string) []map[string]interface{} {
+	cache := map[tools.DataType]map[string]interface{}{}
+	m := []map[string]interface{}{}
+	for _, obj := range objs {
+		m = append(m, GetExtend(obj, obj.Extend(typ...), cache))
+	}
+	return m
+}
+
+func GetExtend(obj utils.DBObject, extends map[string][]tools.DataType, cache map[tools.DataType]map[string]interface{}) map[string]interface{} {
+	base := obj.Serialize(obj)
+	for k, v := range extends {
+		if base[k+"_id"] == nil || base[k+"_id"] == "" {
+			fmt.Println(k+"_id", "GET EXTEND")
+			continue
+		}
+		for _, vv := range v {
+			if cache[vv] != nil && cache[vv][fmt.Sprintf("%v", base[k+"_id"])] != nil {
+				base[k] = cache[vv][fmt.Sprintf("%v", base[k+"_id"])]
+				continue
+			}
+			if d, _, err := models.Model(vv.EnumIndex()).GetAccessor(&tools.APIRequest{
+				Admin: true,
+			}).LoadOne(fmt.Sprintf("%v", base[k+"_id"])); d != nil && err == nil {
+				base[k] = d.Serialize(d)
+				if cache[vv] == nil {
+					cache[vv] = map[string]interface{}{}
+				}
+				if cache[vv][fmt.Sprintf("%v", base[k+"_id"])] == nil {
+					fmt.Println("TTT", vv, k, base[k])
+					cache[vv][fmt.Sprintf("%v", base[k+"_id"])] = base[k]
+				}
+				break
+			}
+		}
+	}
+	return base
+}
+
+func ExtractTokenInfoWs(request http.Request) (string, string, []string) {
+	reqToken := request.Header.Get("Sec-WebSocket-Protocol")
+	if reqToken != "" {
+		return extractFromToken(reqToken, "user_id"), extractFromToken(reqToken, "peer_id"), strings.Split(extractFromToken(reqToken, "groups"), ",")
+	}
+	return "", "", []string{}
+}
+
 func ExtractTokenInfo(request http.Request) (string, string, []string) {
 	reqToken := request.Header.Get("Authorization")
 	splitToken := strings.Split(reqToken, "Bearer ")
@@ -198,25 +259,42 @@ func ExtractTokenInfo(request http.Request) (string, string, []string) {
 		reqToken = splitToken[1]
 	}
 	if reqToken != "" {
-		token := strings.Split(reqToken, ".")
+		return extractFromToken(reqToken, "user_id"), extractFromToken(reqToken, "peer_id"), strings.Split(extractFromToken(reqToken, "groups"), ",")
-		if len(token) > 2 {
-			bytes, err := base64.StdEncoding.DecodeString(token[2])
-			if err != nil {
-				return "", "", []string{}
-			}
-			var c Claims
-			err = json.Unmarshal(bytes, &c)
-			if err != nil {
-				return "", "", []string{}
-			}
-			return c.Session.IDToken.UserID, c.Session.IDToken.PeerID, c.Session.IDToken.Groups
-		}
 	}
 	return "", "", []string{}
 }
 
-func InitAPI(appName string) {
+func extractFromToken(token string, attr string) string {
+	parts := strings.Split(token, ".")
+	if len(parts) < 2 {
+		return ""
+	}
+	payload := parts[1]
+	switch len(payload) % 4 {
+	case 2:
+		payload += "=="
+	case 3:
+		payload += "="
+	}
+	b, err := base64.URLEncoding.DecodeString(payload)
+	if err != nil {
+		return ""
+	}
+	var claims map[string]interface{}
+	if err := json.Unmarshal(b, &claims); err != nil {
+		return ""
+	}
+	ext, ok := claims["ext"].(map[string]interface{})
+	if !ok {
+		return ""
+	}
+	peerID, _ := ext[attr].(string)
+	return peerID
+}
+
+func InitAPI(appName string, extraRoutes ...map[string][]string) {
 	InitDaemon(appName)
+	if config.GetConfig().IsApi {
 		beego.BConfig.Listen.HTTPPort = config.GetConfig().APIPort
 		beego.BConfig.WebConfig.DirectoryIndex = true
 		beego.BConfig.WebConfig.StaticDir["/swagger"] = "swagger"
@@ -228,8 +306,10 @@ func InitAPI(appName string) {
 			AllowCredentials: true,
 		})
 		beego.InsertFilter("*", beego.BeforeRouter, c)
+
 		api := &tools.API{}
-	api.Discovered(beego.BeeApp.Handlers.GetAllControllerInfo())
+		api.Discovered(beego.BeeApp.Handlers.GetAllControllerInfo(), extraRoutes...)
+	}
 }
 
 //
@@ -251,10 +331,12 @@ func GetLogger() zerolog.Logger {
 * @param logLevel string
 * @return *Config
  */
-func SetConfig(mongoUrl string, database string, natsUrl string, lokiUrl string, logLevel string,
+func SetConfig(isNano bool, isApi bool, mongoUrl string, database string, natsUrl string, lokiUrl string, logLevel string,
 	port int, pppath string, pkpath string,
-	internalCatalogAPI, internalSharedAPI, internalWorkflowAPI, internalWorkspaceAPI, internalPeerAPI, internalDatacenterAPI string) *config.Config {
+	internalCatalogAPI, internalSharedAPI, internalWorkflowAPI,
-	cfg := config.SetConfig(mongoUrl, database, natsUrl, lokiUrl, logLevel, port, pkpath, pppath, internalCatalogAPI, internalSharedAPI, internalWorkflowAPI, internalWorkspaceAPI, internalPeerAPI, internalDatacenterAPI)
+	internalWorkspaceAPI, internalPeerAPI, internalDatacenterAPI string, internalSchedulerAPI string) *config.Config {
+	cfg := config.SetConfig(isNano, isApi, mongoUrl, database, natsUrl, lokiUrl, logLevel, port, pkpath, pppath, internalCatalogAPI, internalSharedAPI, internalWorkflowAPI,
+		internalWorkspaceAPI, internalPeerAPI, internalDatacenterAPI, internalSchedulerAPI)
 	defer func() {
 		if r := recover(); r != nil {
 			tools.UncatchedError = append(tools.UncatchedError, errors.New("Panic recovered in Init : "+fmt.Sprintf("%v", r)+" - "+string(debug.Stack())))
@@ -337,7 +419,7 @@ func (r *Request) PaymentTunnel(o *order.Order, scheduler *workflow_execution.Wo
 * @param c ...*tools.HTTPCaller
 * @return data LibDataShallow
  */
-func (r *Request) Search(filters *dbs.Filters, word string, isDraft bool) (data LibDataShallow) {
+func (r *Request) Search(filters *dbs.Filters, word string, isDraft bool, offset int64, limit int64) (data LibDataShallow) {
 	defer func() { // recover the panic
 		if r := recover(); r != nil {
 			tools.UncatchedError = append(tools.UncatchedError, errors.New("Panic recovered in Search : "+fmt.Sprintf("%v", r)))
@@ -350,7 +432,7 @@ func (r *Request) Search(filters *dbs.Filters, word string, isDraft bool) (data
 		PeerID:   r.PeerID,
 		Groups:   r.Groups,
 		Admin:    r.admin,
-	}).Search(filters, word, isDraft)
+	}).Search(filters, word, isDraft, offset, limit)
 	if err != nil {
 		data = LibDataShallow{Data: d, Code: code, Err: err.Error()}
 		return
@@ -365,7 +447,7 @@ func (r *Request) Search(filters *dbs.Filters, word string, isDraft bool) (data
 * @param c ...*tools.HTTPCaller
 * @return data LibDataShallow
  */
-func (r *Request) LoadAll(isDraft bool) (data LibDataShallow) {
+func (r *Request) LoadAll(isDraft bool, offset int64, limit int64) (data LibDataShallow) {
 	defer func() { // recover the panic
 		if r := recover(); r != nil {
 			tools.UncatchedError = append(tools.UncatchedError, errors.New("Panic recovered in LoadAll : "+fmt.Sprintf("%v", r)+" - "+string(debug.Stack())))
@@ -378,7 +460,7 @@ func (r *Request) LoadAll(isDraft bool) (data LibDataShallow) {
 		PeerID:   r.PeerID,
 		Groups:   r.Groups,
 		Admin:    r.admin,
-	}).LoadAll(isDraft)
+	}).LoadAll(isDraft, offset, limit)
 	if err != nil {
 		data = LibDataShallow{Data: d, Code: code, Err: err.Error()}
 		return
@@ -708,7 +790,7 @@ func InitNATSDecentralizedEmitter(authorizedDT ...tools.DataType) {
 					return // don't trust anyone... only friends and foes are privilege
 				}
 				access := NewRequestAdmin(LibDataEnum(resp.Datatype), nil)
-				if data := access.Search(nil, fmt.Sprintf("%v", p[resp.SearchAttr]), false); len(data.Data) > 0 {
+				if data := access.Search(nil, fmt.Sprintf("%v", p[resp.SearchAttr]), false, 0, 1); len(data.Data) > 0 {
 					delete(p, "id")
 					access.UpdateOne(p, data.Data[0].GetID())
 				} else {
@@ -727,8 +809,8 @@ func InitNATSDecentralizedEmitter(authorizedDT ...tools.DataType) {
 			access := NewRequestAdmin(LibDataEnum(resp.Datatype), nil)
 			err := json.Unmarshal(resp.Payload, &p)
 			if err == nil {
-				if data := access.Search(nil, fmt.Sprintf("%v", p[resp.SearchAttr]), false); len(data.Data) > 0 {
+				if data := access.Search(nil, fmt.Sprintf("%v", p[resp.SearchAttr]), false, 0, 1); len(data.Data) > 0 {
-					access.DeleteOne(fmt.Sprintf("%v", p[resp.SearchAttr]))
+					access.DeleteOne(data.Data[0].GetID())
 				}
 			}
 

go.mod

@@ -7,6 +7,7 @@ require (
 	github.com/go-playground/validator/v10 v10.22.0
 	github.com/google/uuid v1.6.0
 	github.com/goraz/onion v0.1.3
+	github.com/libp2p/go-libp2p/core v0.43.0-rc2
 	github.com/nats-io/nats.go v1.37.0
 	github.com/rs/zerolog v1.33.0
 	github.com/stretchr/testify v1.11.1
@@ -22,18 +23,33 @@ require (
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
 	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/google/gnostic-models v0.7.0 // indirect
+	github.com/ipfs/go-cid v0.5.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.10 // indirect
+	github.com/libp2p/go-buffer-pool v0.1.0 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/minio/sha256-simd v1.0.1 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
+	github.com/mr-tron/base58 v1.2.0 // indirect
+	github.com/multiformats/go-base32 v0.1.0 // indirect
+	github.com/multiformats/go-base36 v0.2.0 // indirect
+	github.com/multiformats/go-multiaddr v0.16.0 // indirect
+	github.com/multiformats/go-multibase v0.2.0 // indirect
+	github.com/multiformats/go-multicodec v0.9.1 // indirect
+	github.com/multiformats/go-multihash v0.2.3 // indirect
+	github.com/multiformats/go-multistream v0.6.1 // indirect
+	github.com/multiformats/go-varint v0.0.7 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/nats-io/nkeys v0.4.7 // indirect
 	github.com/nats-io/nuid v1.0.1 // indirect
+	github.com/spaolacci/murmur3 v1.1.0 // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/exp v0.0.0-20250606033433-dcc06ee1d476 // indirect
 	golang.org/x/oauth2 v0.30.0 // indirect
 	golang.org/x/term v0.37.0 // indirect
 	golang.org/x/time v0.9.0 // indirect
@@ -42,6 +58,7 @@ require (
 	k8s.io/klog/v2 v2.130.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
 	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 // indirect
+	lukechampine.com/blake3 v1.4.1 // indirect
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
 	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
@@ -67,7 +84,6 @@ require (
 	github.com/hashicorp/golang-lru v0.5.4 // indirect
 	github.com/klauspost/compress v1.17.9 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
-	github.com/libp2p/go-libp2p/core v0.43.0-rc2
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/montanaflynn/stats v0.7.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
@@ -89,3 +105,5 @@ require (
 	k8s.io/api v0.35.1
 	k8s.io/client-go v0.35.1
 )
+
+replace github.com/libp2p/go-libp2p/core => github.com/libp2p/go-libp2p v0.47.0

go.sum

@@ -133,6 +133,8 @@ github.com/multiformats/go-multicodec v0.9.1 h1:x/Fuxr7ZuR4jJV4Os5g444F7xC4XmyUa
 github.com/multiformats/go-multicodec v0.9.1/go.mod h1:LLWNMtyV5ithSBUo3vFIMaeDy+h3EbkMTek1m+Fybbo=
 github.com/multiformats/go-multihash v0.2.3 h1:7Lyc8XfX/IY2jWb/gI7JP+o7JEq9hOa7BFvVU9RSh+U=
 github.com/multiformats/go-multihash v0.2.3/go.mod h1:dXgKXCXjBzdscBLk9JkjINiEsCKRVch90MdaGiKsvSM=
+github.com/multiformats/go-multistream v0.6.1 h1:4aoX5v6T+yWmc2raBHsTvzmFhOI8WVOer28DeBBEYdQ=
+github.com/multiformats/go-multistream v0.6.1/go.mod h1:ksQf6kqHAb6zIsyw7Zm+gAuVo57Qbq84E27YlYqavqw=
 github.com/multiformats/go-varint v0.0.7 h1:sWSGR+f/eu5ABZA2ZpYKBILXTTs9JWpdEM/nEGOHFS8=
 github.com/multiformats/go-varint v0.0.7/go.mod h1:r8PUYw/fD/SjBCiKOoDlGF6QawOELpZAu9eioSos/OU=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=

logs/lokiwriter.go

@@ -59,13 +59,12 @@ func (w *LokiWriter) Write(p []byte) (n int, err error) {
 	// A bit unsafe since we don't know what could be stored in the event
 	// but we can't access this object once passed to the multilevel writter
 
-	for k,v := range(event){
+	for k, v := range event {
 		if k != "level" && k != "time" && k != "message" {
-			labels[k] = v.(string)
+			labels[k] = fmt.Sprintf("%v", v)
 		}
 	}
 
-
 	// Format the timestamp in nanoseconds
 	timestamp := fmt.Sprintf("%d000000", time.Now().UnixNano()/int64(time.Millisecond))
 

models/allowed_image/allowed_image.go

@@ -0,0 +1,56 @@
+package allowed_image
+
+import (
+	"cloud.o-forge.io/core/oc-lib/models/utils"
+	"cloud.o-forge.io/core/oc-lib/tools"
+)
+
+// AllowedImage représente une image de conteneur autorisée à persister
+// sur un peer après l'exécution d'un workflow.
+//
+// La décision de rétention est entièrement locale au datacenter —
+// le fournisseur de processing n'a aucun levier sur cette liste.
+//
+// Règle de matching (côté oc-datacenter) :
+//   - Registry vide  = toutes les registries
+//   - TagConstraint vide = toutes les versions
+//   - TagConstraint non vide = exact ou glob (ex: "3.*", "1.2.3")
+//
+// Les entrées IsDefault sont créées au bootstrap et ne peuvent pas
+// être supprimées via l'API.
+type AllowedImage struct {
+	utils.AbstractObject
+
+	// Registry source (ex: "docker.io", "registry.example.com").
+	// Vide = wildcard, accepte n'importe quelle registry.
+	Registry string `json:"registry,omitempty" bson:"registry,omitempty"`
+
+	// Image est le nom de l'image sans registry ni tag
+	// (ex: "natsio/nats-box", "library/alpine").
+	Image string `json:"image" bson:"image" validate:"required"`
+
+	// TagConstraint est la contrainte sur le tag.
+	// Vide = toutes les versions autorisées.
+	// Supporte exact ("1.2.3") ou glob ("3.*", "*-alpine").
+	TagConstraint string `json:"tag_constraint,omitempty" bson:"tag_constraint,omitempty"`
+
+	// IsDefault marque les entrées bootstrap insérées au démarrage.
+	// Ces entrées ne peuvent pas être supprimées via l'API.
+	IsDefault bool `json:"is_default,omitempty" bson:"is_default,omitempty"`
+}
+
+func (a *AllowedImage) StoreDraftDefault() {
+	a.IsDraft = false // les allowed images sont actives immédiatement
+}
+
+func (a *AllowedImage) CanUpdate(set utils.DBObject) (bool, utils.DBObject) {
+	return true, set
+}
+
+func (a *AllowedImage) CanDelete() bool {
+	return !a.IsDefault // les entrées bootstrap sont non supprimables
+}
+
+func (a *AllowedImage) GetAccessor(request *tools.APIRequest) utils.Accessor {
+	return NewAccessor(request)
+}

models/allowed_image/allowed_image_mongo_accessor.go

@@ -0,0 +1,23 @@
+package allowed_image
+
+import (
+	"cloud.o-forge.io/core/oc-lib/logs"
+	"cloud.o-forge.io/core/oc-lib/models/utils"
+	"cloud.o-forge.io/core/oc-lib/tools"
+)
+
+type allowedImageMongoAccessor struct {
+	utils.AbstractAccessor[*AllowedImage]
+}
+
+func NewAccessor(request *tools.APIRequest) *allowedImageMongoAccessor {
+	return &allowedImageMongoAccessor{
+		AbstractAccessor: utils.AbstractAccessor[*AllowedImage]{
+			Logger:         logs.CreateLogger(tools.ALLOWED_IMAGE.String()),
+			Request:        request,
+			Type:           tools.ALLOWED_IMAGE,
+			New:            func() *AllowedImage { return &AllowedImage{} },
+			NotImplemented: []string{"CopyOne"},
+		},
+	}
+}

models/bill/bill.go

@@ -2,12 +2,12 @@ package bill
 
 import (
 	"encoding/json"
-	"fmt"
 	"sync"
 	"time"
 
 	"cloud.o-forge.io/core/oc-lib/dbs"
 	"cloud.o-forge.io/core/oc-lib/models/common/enum"
+	"cloud.o-forge.io/core/oc-lib/models/common/pricing"
 	"cloud.o-forge.io/core/oc-lib/models/order"
 	"cloud.o-forge.io/core/oc-lib/models/peer"
 	"cloud.o-forge.io/core/oc-lib/models/resources"
@@ -28,6 +28,20 @@ type Bill struct {
 	Total     float64               `json:"total" bson:"total" validate:"required"`
 }
 
+func (ri *Bill) Extend(typ ...string) map[string][]tools.DataType {
+	ext := ri.AbstractObject.Extend(typ...)
+	for _, t := range typ {
+		switch t {
+		case "order":
+			if _, ok := ext[t]; !ok {
+				ext[t] = []tools.DataType{}
+			}
+			ext[t] = append(ext[t], tools.ORDER)
+		}
+	}
+	return ext
+}
+
 func GenerateBill(order *order.Order, request *tools.APIRequest) (*Bill, error) {
 	// hhmmm : should get... the loop.
 	return &Bill{
@@ -49,6 +63,7 @@ func DraftFirstBill(order *order.Order, request *tools.APIRequest) (*Bill, error
 			peers[p.DestPeerID] = []*PeerItemOrder{}
 		}
 		peers[p.DestPeerID] = append(peers[p.DestPeerID], &PeerItemOrder{
+			ResourceType: p.ResourceType,
 			Purchase:     p,
 			Item:         p.PricedItem,
 			Quantity:     1,
@@ -70,6 +85,8 @@ func DraftFirstBill(order *order.Order, request *tools.APIRequest) (*Bill, error
 			peers[b.DestPeerID] = []*PeerItemOrder{}
 		}
 		peers[b.DestPeerID] = append(peers[b.DestPeerID], &PeerItemOrder{
+			ResourceType: b.ResourceType,
+			Quantity:     1,
 			Item:         b.PricedItem,
 		})
 	}
@@ -136,6 +153,22 @@ type PeerOrder struct {
 	Total          float64               `json:"total,omitempty" bson:"total,omitempty"`
 }
 
+func PricedByType(dt tools.DataType) pricing.PricedItemITF {
+	switch dt {
+	case tools.PROCESSING_RESOURCE:
+		return &resources.PricedProcessingResource{}
+	case tools.STORAGE_RESOURCE:
+		return &resources.PricedStorageResource{}
+	case tools.DATA_RESOURCE:
+		return &resources.PricedDataResource{}
+	case tools.COMPUTE_RESOURCE:
+		return &resources.PricedComputeResource{}
+	case tools.WORKFLOW_RESOURCE:
+		return &resources.PricedResource[*pricing.ExploitPricingProfile[pricing.TimePricingStrategy]]{}
+	}
+	return nil
+}
+
 func (d *PeerOrder) Pay(request *tools.APIRequest, response chan *PeerOrder, wg *sync.WaitGroup) {
 
 	d.Status = enum.PENDING
@@ -145,7 +178,7 @@ func (d *PeerOrder) Pay(request *tools.APIRequest, response chan *PeerOrder, wg
 		d.Status = enum.PAID // TO REMOVE LATER IT'S A MOCK
 		if d.Status == enum.PAID {
 			for _, b := range d.Items {
-				var priced *resources.PricedResource
+				priced := PricedByType(b.ResourceType)
 				bb, _ := json.Marshal(b.Item)
 				json.Unmarshal(bb, priced)
 				if !priced.IsPurchasable() {
@@ -179,6 +212,7 @@ func (d *PeerOrder) SumUpBill(request *tools.APIRequest) error {
 }
 
 type PeerItemOrder struct {
+	ResourceType tools.DataType                      `json:"datatype,omitempty" bson:"datatype,omitempty"`
 	Quantity     int                                 `json:"quantity,omitempty" bson:"quantity,omitempty"`
 	Purchase     *purchase_resource.PurchaseResource `json:"purchase,omitempty" bson:"purchase,omitempty"`
 	Item         map[string]interface{}              `json:"item,omitempty" bson:"item,omitempty"`
@@ -190,11 +224,10 @@ func (d *PeerItemOrder) GetPriceHT(request *tools.APIRequest) (float64, error) {
 		return 0, nil
 	}
 	///////////
-	var priced *resources.PricedResource
+	priced := PricedByType(d.ResourceType)
 	b, _ := json.Marshal(d.Item)
 	err := json.Unmarshal(b, priced)
 	if err != nil {
-		fmt.Println(err)
 		return 0, err
 	}
 	accessor := purchase_resource.NewAccessor(request)
@@ -202,7 +235,7 @@ func (d *PeerItemOrder) GetPriceHT(request *tools.APIRequest) (float64, error) {
 		And: map[string][]dbs.Filter{
 			"resource_id": {{Operator: dbs.EQUAL.String(), Value: priced.GetID()}},
 		},
-	}, "", d.Purchase.IsDraft)
+	}, "", d.Purchase.IsDraft, 0, 10000)
 	if code == 200 && len(search) > 0 {
 		for _, s := range search {
 			if s.(*purchase_resource.PurchaseResource).EndDate == nil || time.Now().UTC().After(*s.(*purchase_resource.PurchaseResource).EndDate) {

models/booking/booking.go

@@ -3,12 +3,10 @@ package booking
 import (
 	"time"
 
-	"cloud.o-forge.io/core/oc-lib/dbs"
 	"cloud.o-forge.io/core/oc-lib/models/common/enum"
 	"cloud.o-forge.io/core/oc-lib/models/common/models"
 	"cloud.o-forge.io/core/oc-lib/models/utils"
 	"cloud.o-forge.io/core/oc-lib/tools"
-	"go.mongodb.org/mongo-driver/bson/primitive"
 )
 
 /*
@@ -16,6 +14,8 @@ import (
  */
 type Booking struct {
 	utils.AbstractObject // AbstractObject contains the basic fields of an object (id, name)
+
+	FromNano   string                 `json:"from_nano,omitempty" bson:"priced_item,omitempty"`
 	PricedItem map[string]interface{} `json:"priced_item,omitempty" bson:"priced_item,omitempty"` // We need to add the validate:"required" tag once the pricing feature is implemented, removed to avoid handling the error
 
 	ResumeMetrics    map[string]map[string]models.MetricResume `json:"resume_metrics,omitempty" bson:"resume_metrics,omitempty"`
@@ -25,7 +25,7 @@ type Booking struct {
 	DestPeerID        string             `json:"dest_peer_id,omitempty" bson:"dest_peer_id,omitempty"`                       // DestPeerID is the ID of the destination peer
 	WorkflowID        string             `json:"workflow_id,omitempty" bson:"workflow_id,omitempty"`                         // WorkflowID is the ID of the workflow
 	ExecutionID       string             `json:"execution_id,omitempty" bson:"execution_id,omitempty" validate:"required"`
-	State             enum.BookingStatus `json:"state,omitempty" bson:"state,omitempty" validate:"required"`                             // State is the state of the booking
+	State             enum.BookingStatus `json:"state" bson:"state"`                                                                     // State is the state of the booking
 	ExpectedStartDate time.Time          `json:"expected_start_date,omitempty" bson:"expected_start_date,omitempty" validate:"required"` // ExpectedStartDate is the expected start date of the booking
 	ExpectedEndDate   *time.Time         `json:"expected_end_date,omitempty" bson:"expected_end_date,omitempty" validate:"required"`     // ExpectedEndDate is the expected end date of the booking
 
@@ -36,6 +36,18 @@ type Booking struct {
 	ResourceID   string         `json:"resource_id,omitempty" bson:"resource_id,omitempty" validate:"required"`     // could be a Compute or a Storage
 	InstanceID   string         `json:"instance_id,omitempty" bson:"instance_id,omitempty" validate:"required"`     // could be a Compute or a Storage
 
+	// Authorization: identifies who created this draft and the Check session it belongs to.
+	// Used to verify UPDATE and DELETE orders from remote schedulers.
+	SchedulerPeerID string `json:"scheduler_peer_id,omitempty" bson:"scheduler_peer_id,omitempty"`
+
+	// Peerless is true when the booked resource has no destination peer
+	// (e.g. a public Docker Hub image). No peer confirmation or pricing
+	// negotiation is needed; the booking is stored locally only.
+	Peerless bool `json:"peerless,omitempty" bson:"peerless,omitempty"`
+
+	// OriginRef carries the registry reference of a peerless resource
+	// (e.g. "docker.io/pytorch/pytorch:2.1") so schedulers can validate it.
+	OriginRef string `json:"origin_ref,omitempty" bson:"origin_ref,omitempty"`
 }
 
 func (b *Booking) CalcDeltaOfExecution() map[string]map[string]models.MetricResume {
@@ -65,40 +77,15 @@ func (b *Booking) CalcDeltaOfExecution() map[string]map[string]models.MetricResu
 	return m
 }
 
-// CheckBooking checks if a booking is possible on a specific compute resource
-func (wfa *Booking) Check(id string, start time.Time, end *time.Time, parrallelAllowed int) (bool, error) {
-	// check if
-	if end == nil {
-		// if no end... then Book like a savage
-		e := start.Add(time.Hour)
-		end = &e
-	}
-	accessor := NewAccessor(nil)
-	res, code, err := accessor.Search(&dbs.Filters{
-		And: map[string][]dbs.Filter{ // check if there is a booking on the same compute resource by filtering on the compute_resource_id, the state and the execution date
-			"resource_id": {{Operator: dbs.EQUAL.String(), Value: id}},
-			"state":       {{Operator: dbs.EQUAL.String(), Value: enum.DRAFT.EnumIndex()}},
-			"expected_start_date": {
-				{Operator: dbs.LTE.String(), Value: primitive.NewDateTimeFromTime(*end)},
-				{Operator: dbs.GTE.String(), Value: primitive.NewDateTimeFromTime(start)},
-			},
-		},
-	}, "", wfa.IsDraft)
-	if code != 200 {
-		return false, err
-	}
-	return len(res) <= parrallelAllowed, nil
-}
-
 func (d *Booking) GetDelayForLaunch() time.Duration {
 	return d.RealStartDate.Sub(d.ExpectedStartDate)
 }
 
 func (d *Booking) GetDelayForFinishing() time.Duration {
-	if d.ExpectedEndDate == nil {
+	if d.ExpectedEndDate == nil || d.RealEndDate == nil {
 		return time.Duration(0)
 	}
-	return d.RealEndDate.Sub(d.ExpectedStartDate)
+	return d.RealEndDate.Sub(*d.ExpectedEndDate)
 }
 
 func (d *Booking) GetUsualDuration() time.Duration {
@@ -125,18 +112,25 @@ func (d *Booking) VerifyAuth(callName string, request *tools.APIRequest) bool {
 }
 
 func (r *Booking) StoreDraftDefault() {
-	r.IsDraft = false
+	r.IsDraft = true
+	r.State = enum.DRAFT
 }
 
 func (r *Booking) CanUpdate(set utils.DBObject) (bool, utils.DBObject) {
-	if !r.IsDraft && r.State != set.(*Booking).State || r.RealStartDate != set.(*Booking).RealStartDate || r.RealEndDate != set.(*Booking).RealEndDate {
+	incoming := set.(*Booking)
-		return true, &Booking{
+	if !r.IsDraft && r.State != incoming.State || r.RealStartDate != incoming.RealStartDate || r.RealEndDate != incoming.RealEndDate {
-			State:         set.(*Booking).State,
+		patch := &Booking{
-			RealStartDate: set.(*Booking).RealStartDate,
+			State:         incoming.State,
-			RealEndDate:   set.(*Booking).RealEndDate,
+			RealStartDate: incoming.RealStartDate,
-		} // only state can be updated
+			RealEndDate:   incoming.RealEndDate,
+		}
+		// Auto-set RealStartDate when transitioning to STARTED and not already set
+		if r.State != enum.STARTED && incoming.State == enum.STARTED && patch.RealStartDate == nil {
+			now := time.Now()
+			patch.RealStartDate = &now
+		}
+		return true, patch
 	}
-	// TODO : HERE WE CAN HANDLE THE CASE WHERE THE BOOKING IS DELAYED OR EXCEEDING OR ending sooner
 	return r.IsDraft, set
 }
 

models/booking/booking_mongo_accessor.go

@@ -4,6 +4,7 @@ import (
 	"errors"
 	"time"
 
+	"cloud.o-forge.io/core/oc-lib/dbs/mongo"
 	"cloud.o-forge.io/core/oc-lib/logs"
 	"cloud.o-forge.io/core/oc-lib/models/common/enum"
 	"cloud.o-forge.io/core/oc-lib/models/utils"
@@ -44,7 +45,10 @@ func (a *BookingMongoAccessor) LoadOne(id string) (utils.DBObject, int, error) {
 		now := time.Now()
 		now = now.Add(time.Second * -60)
 		if d.(*Booking).State == enum.DRAFT && now.UTC().After(d.(*Booking).ExpectedStartDate) {
-			return utils.GenericDeleteOne(d.GetID(), a)
+			// Direct raw delete to avoid infinite recursion:
+			// GenericDeleteOne calls a.LoadOne which would re-enter this callback.
+			mongo.MONGOService.DeleteOne(d.GetID(), a.GetType().String())
+			return nil, 410, errors.New("draft booking expired and deleted")
 		}
 		if (d.(*Booking).ExpectedEndDate) == nil {
 			d.(*Booking).State = enum.FORGOTTEN
@@ -62,7 +66,8 @@ func (a *BookingMongoAccessor) GetExec(isDraft bool) func(utils.DBObject) utils.
 		now := time.Now()
 		now = now.Add(time.Second * -60)
 		if d.(*Booking).State == enum.DRAFT && now.UTC().After(d.(*Booking).ExpectedStartDate) {
-			utils.GenericDeleteOne(d.GetID(), a)
+			// Direct raw delete to avoid infinite recursion (same as LoadOne callback).
+			mongo.MONGOService.DeleteOne(d.GetID(), a.GetType().String())
 			return nil
 		}
 		if d.(*Booking).State == enum.SCHEDULED && now.UTC().After(d.(*Booking).ExpectedStartDate) {

models/booking/planner/planner.go

@@ -2,9 +2,13 @@ package planner
 
 import (
 	"encoding/json"
+	"sort"
 	"time"
 
+	"cloud.o-forge.io/core/oc-lib/dbs"
 	"cloud.o-forge.io/core/oc-lib/models/booking"
+	"cloud.o-forge.io/core/oc-lib/models/common/enum"
+	"cloud.o-forge.io/core/oc-lib/models/live"
 	"cloud.o-forge.io/core/oc-lib/models/resources"
 	"cloud.o-forge.io/core/oc-lib/tools"
 )
@@ -15,6 +19,7 @@ type InstanceCapacity struct {
 	GPUMemGB      map[string]float64 `json:"gpu_mem_gb,omitempty"`  // model -> total memory GB
 	RAMGB         float64            `json:"ram_gb,omitempty"`      // total RAM GB
 	StorageGB     float64            `json:"storage_gb,omitempty"`  // total storage GB
+	MaxConcurrent float64            `json:"max_concurrent,omitempty"` // HOSTED service: max simultaneous callers
 }
 
 // ResourceRequest describes the resource amounts needed for a prospective booking.
@@ -37,12 +42,21 @@ type PlannerSlot struct {
 	Usage      map[string]float64 `json:"usage,omitempty"`       // dimension -> % of max (0-100)
 }
 
+// PlannerITF is the interface used by Planify to check resource availability.
+// *Planner satisfies this interface.
+type PlannerITF interface {
+	NextAvailableStart(resourceID, instanceID string, start time.Time, d time.Duration) time.Time
+}
+
 // Planner is a volatile (non-persisted) object that organises bookings by resource.
-// Only ComputeResource and StorageResource bookings appear in the schedule.
+// ComputeResource, StorageResource and HOSTED ServiceResource bookings appear in the schedule.
+// BlockedResources marks resources for which no matching Live was found at generation time:
+// any availability check against a blocked resource returns false immediately.
 type Planner struct {
 	GeneratedAt      time.Time                               `json:"generated_at"`
 	Schedule         map[string][]*PlannerSlot               `json:"schedule"`           // resource_id -> slots
 	Capacities       map[string]map[string]*InstanceCapacity `json:"capacities"`         // resource_id -> instance_id -> max capacity
+	BlockedResources map[string]bool                         `json:"blocked_resources,omitempty"` // resource_id -> no Live found
 }
 
 // Generate builds a full Planner from all active bookings.
@@ -58,32 +72,61 @@ func GenerateShallow(request *tools.APIRequest) (*Planner, error) {
 
 func generate(request *tools.APIRequest, shallow bool) (*Planner, error) {
 	accessor := booking.NewAccessor(request)
-	bookings, code, err := accessor.Search(nil, "*", false)
+	// Include both confirmed (IsDraft=false) and draft (IsDraft=true) bookings
+	// so the planner reflects the full picture: first-come first-served on all
+	// pending reservations regardless of confirmation state.
+	confirmed, code, err := accessor.Search(&dbs.Filters{
+		And: map[string][]dbs.Filter{
+			"expected_start_date": {{Operator: dbs.GTE.String(), Value: time.Now().UTC()}},
+		},
+	}, "*", false, 0, 10000)
 	if code != 200 || err != nil {
 		return nil, err
 	}
+	drafts, _, _ := accessor.Search(&dbs.Filters{
+		And: map[string][]dbs.Filter{
+			"expected_start_date": {{Operator: dbs.GTE.String(), Value: time.Now().UTC()}},
+		},
+	}, "*", true, 0, 10000)
+	bookings := append(confirmed, drafts...)
 
 	p := &Planner{
 		GeneratedAt:      time.Now(),
 		Schedule:         map[string][]*PlannerSlot{},
 		Capacities:       map[string]map[string]*InstanceCapacity{},
+		BlockedResources: map[string]bool{},
 	}
 
 	for _, b := range bookings {
 		bk := b.(*booking.Booking)
 
-		// Only compute and storage resources are eligible
+		// Skip terminal bookings — they no longer occupy capacity.
-		if bk.ResourceType != tools.COMPUTE_RESOURCE && bk.ResourceType != tools.STORAGE_RESOURCE {
+		switch bk.State {
+		case enum.SUCCESS, enum.FAILURE, enum.FORGOTTEN, enum.CANCELLED:
+			continue
+		}
+
+		// Eligible resource types: compute, storage, and HOSTED services.
+		if bk.ResourceType != tools.COMPUTE_RESOURCE &&
+			bk.ResourceType != tools.STORAGE_RESOURCE &&
+			bk.ResourceType != tools.SERVICE_RESOURCE {
 			continue
 		}
 
 		end := bk.ExpectedEndDate
 		if end == nil {
-			e := bk.ExpectedStartDate.Add(time.Hour)
+			e := bk.ExpectedStartDate.UTC().Add(5 * time.Minute)
 			end = &e
 		}
 
-		instanceID, usage, cap := extractSlotData(bk, request)
+		instanceID, usage, cap, blocked := extractSlotData(bk, request)
+		if blocked {
+			p.BlockedResources[bk.ResourceID] = true
+			continue
+		}
+		if instanceID == "" {
+			instanceID = bk.InstanceID
+		}
 
 		if cap != nil && instanceID != "" {
 			if p.Capacities[bk.ResourceID] == nil {
@@ -120,8 +163,11 @@ func generate(request *tools.APIRequest, shallow bool) (*Planner, error) {
 // Slots targeting other instances are ignored.
 // If no capacity is known for this instance (never booked), it is fully available.
 func (p *Planner) Check(resourceID string, instanceID string, req *ResourceRequest, start time.Time, end *time.Time) bool {
+	if p.BlockedResources[resourceID] {
+		return false // no Live found at generation time — cannot book
+	}
 	if end == nil {
-		e := start.Add(time.Hour)
+		e := start.Add(5 * time.Minute)
 		end = &e
 	}
 
@@ -132,7 +178,6 @@ func (p *Planner) Check(resourceID string, instanceID string, req *ResourceReque
 	if !ok {
 		return true
 	}
-
 	for _, slot := range slots {
 		// Only consider slots on the same instance
 		if slot.InstanceID != instanceID {
@@ -142,9 +187,13 @@ func (p *Planner) Check(resourceID string, instanceID string, req *ResourceReque
 		if !slot.Start.Before(*end) || !slot.End.After(start) {
 			continue
 		}
+		// If capacity is unknown (reqPct empty), any overlap blocks the slot.
+		if len(reqPct) == 0 {
+			return false
+		}
 		// Combined usage must not exceed 100 % for any requested dimension
 		for dim, needed := range reqPct {
-			if slot.Usage[dim]+needed > 100.0 {
+			if slot.Usage[dim]+needed >= 100.0 {
 				return false
 			}
 		}
@@ -231,6 +280,11 @@ func toPercentages(req *ResourceRequest, cap *InstanceCapacity) map[string]float
 		pct["storage"] = (*req.StorageGB / cap.StorageGB) * 100.0
 	}
 
+	// HOSTED service: each booking consumes one call slot.
+	if cap.MaxConcurrent > 0 {
+		pct["calls"] = (1.0 / cap.MaxConcurrent) * 100.0
+	}
+
 	return pct
 }
 
@@ -238,9 +292,11 @@ func toPercentages(req *ResourceRequest, cap *InstanceCapacity) map[string]float
 // Internal helpers
 // ---------------------------------------------------------------------------
 
-// extractSlotData parses the booking's PricedItem, loads the corresponding resource,
+// extractSlotData parses the booking's PricedItem, loads the corresponding Live resource
-// and returns the instance ID, usage percentages, and instance capacity in a single pass.
+// as the authoritative capacity source, and returns the instance ID, usage percentages,
-func extractSlotData(bk *booking.Booking, request *tools.APIRequest) (instanceID string, usage map[string]float64, cap *InstanceCapacity) {
+// capacity, and whether a matching Live was found.
+// blocked=true means no Live exists for this resource; the resource must not be scheduled.
+func extractSlotData(bk *booking.Booking, request *tools.APIRequest) (instanceID string, usage map[string]float64, cap *InstanceCapacity, blocked bool) {
 	usage = map[string]float64{}
 	if len(bk.PricedItem) == 0 {
 		return
@@ -250,12 +306,13 @@ func extractSlotData(bk *booking.Booking, request *tools.APIRequest) (instanceID
 	if err != nil {
 		return
 	}
-
 	switch bk.ResourceType {
 	case tools.COMPUTE_RESOURCE:
 		instanceID, usage, cap = extractComputeSlot(b, bk.ResourceID, request)
 	case tools.STORAGE_RESOURCE:
 		instanceID, usage, cap = extractStorageSlot(b, bk.ResourceID, request)
+	case tools.SERVICE_RESOURCE:
+		instanceID, usage, cap, blocked = extractServiceSlot(b, bk.ResourceID, request)
 	}
 	return
 }
@@ -348,6 +405,51 @@ func extractStorageSlot(pricedJSON []byte, resourceID string, request *tools.API
 	return
 }
 
+// extractServiceSlot extracts the instance ID, usage, and capacity for a HOSTED service booking.
+// The LiveService is the authoritative source for MaxConcurrent — the ServiceResource is not trusted.
+// If no LiveService references this resourceID, blocked=true signals the resource cannot be scheduled.
+func extractServiceSlot(pricedJSON []byte, resourceID string, request *tools.APIRequest) (instanceID string, usage map[string]float64, cap *InstanceCapacity, blocked bool) {
+	usage = map[string]float64{}
+
+	var priced resources.PricedServiceResource
+	if err := json.Unmarshal(pricedJSON, &priced); err != nil {
+		blocked = true
+		return
+	}
+
+	// LiveService is the authoritative capacity source — look it up by resources_id.
+	liveResults, _, err := (&live.LiveService{}).GetAccessor(request).Search(
+		&dbs.Filters{
+			And: map[string][]dbs.Filter{
+				"resources_id": {{Operator: dbs.EQUAL.String(), Value: resourceID}},
+			},
+		}, "*", false, 0, 1)
+	if err != nil || len(liveResults) == 0 {
+		blocked = true // no Live → cannot schedule
+		return
+	}
+	ls := liveResults[0].(*live.LiveService)
+	if ls.MaxConcurrent <= 0 {
+		blocked = true
+		return
+	}
+
+	// Instance ID: use the first instance referenced by the priced item.
+	instanceID = priced.GetID()
+	if instanceID == "" {
+		instanceID = resourceID // fallback: treat the resource itself as the instance key
+	}
+
+	maxC := float64(ls.MaxConcurrent)
+	cap = &InstanceCapacity{
+		CPUCores:      map[string]float64{},
+		GPUMemGB:      map[string]float64{},
+		MaxConcurrent: maxC,
+	}
+	usage["calls"] = (1.0 / maxC) * 100.0
+	return
+}
+
 // findComputeInstance returns the instance referenced by the priced item's InstancesRefs,
 // falling back to the first available instance.
 func findComputeInstance(compute *resources.ComputeResource, refs map[string]string) *resources.ComputeResourceInstance {
@@ -432,3 +534,34 @@ func totalRAM(instance *resources.ComputeResourceInstance) float64 {
 	}
 	return total
 }
+
+// NextAvailableStart returns the earliest time >= start when resourceID/instanceID has a
+// free window of duration d. Slots are scanned in order so a single linear pass suffices.
+// If the planner has no slots for this resource/instance, start is returned unchanged.
+func (p *Planner) NextAvailableStart(resourceID, instanceID string, start time.Time, d time.Duration) time.Time {
+	slots := p.Schedule[resourceID]
+	if len(slots) == 0 {
+		return start
+	}
+	// Collect and sort slots for this instance by start time.
+	relevant := make([]*PlannerSlot, 0, len(slots))
+	for _, s := range slots {
+		if s.InstanceID == instanceID {
+			relevant = append(relevant, s)
+		}
+	}
+	sort.Slice(relevant, func(i, j int) bool { return relevant[i].Start.Before(relevant[j].Start) })
+
+	end := start.Add(d)
+	for _, slot := range relevant {
+		if !slot.Start.Before(end) {
+			break // all remaining slots start after our window — done
+		}
+		if slot.End.After(start) {
+			// conflict: push start to after this slot
+			start = slot.End
+			end = start.Add(d)
+		}
+	}
+	return start
+}

models/booking/tests/booking_test.go

@@ -13,8 +13,8 @@ import (
 )
 
 func TestBooking_GetDurations(t *testing.T) {
-	start := time.Now().Add(-2 * time.Hour)
+	start := time.Now().Add(-10 * time.Minute)
-	end := start.Add(1 * time.Hour)
+	end := start.Add(5 * time.Minute)
 	realStart := start.Add(30 * time.Minute)
 	realEnd := realStart.Add(90 * time.Minute)
 

models/collaborative_area/collaborative_area_mongo_accessor.go

@@ -91,8 +91,7 @@ func filterEnrich[T utils.ShallowDBObject](arr []string, isDrafted bool, a utils
 		Or: map[string][]dbs.Filter{
 			"abstractobject.id": {{Operator: dbs.IN.String(), Value: arr}},
 		},
-	}, "", isDrafted)
+	}, "", isDrafted, 0, int64(len(arr)))
-	fmt.Println(res, arr, isDrafted, a)
 	if code == 200 {
 		for _, r := range res {
 			new = append(new, r.(T))

models/common/enum/status.go

@@ -32,6 +32,7 @@ const (
 	FORGOTTEN
 	DELAYED
 	CANCELLED
+	IN_PREPARATION
 )
 
 var str = [...]string{
@@ -43,6 +44,7 @@ var str = [...]string{
 	"forgotten",
 	"delayed",
 	"cancelled",
+	"in_preparation",
 }
 
 func FromInt(i int) string {
@@ -60,5 +62,5 @@ func (d BookingStatus) EnumIndex() int {
 
 // List
 func StatusList() []BookingStatus {
-	return []BookingStatus{DRAFT, SCHEDULED, STARTED, FAILURE, SUCCESS, FORGOTTEN, DELAYED, CANCELLED}
+	return []BookingStatus{DRAFT, SCHEDULED, STARTED, FAILURE, SUCCESS, FORGOTTEN, DELAYED, CANCELLED, IN_PREPARATION}
 }

models/common/models/access_configuration.go

@@ -6,8 +6,6 @@ type Container struct {
 	Args    string            `json:"args,omitempty" bson:"args,omitempty"`       // Args is the container arguments
 	Env     map[string]string `json:"env,omitempty" bson:"env,omitempty"`         // Env is the container environment variables
 	Volumes map[string]string `json:"volumes,omitempty" bson:"volumes,omitempty"` // Volumes is the container volumes
-
-	Exposes []Expose `bson:"exposes,omitempty" json:"exposes,omitempty"` // Expose is the execution
 }
 
 type Expose struct {

models/common/planner.go

@@ -7,36 +7,38 @@ import (
 	"cloud.o-forge.io/core/oc-lib/tools"
 )
 
-func GetPlannerNearestStart(start time.Time, planned map[tools.DataType]map[string]pricing.PricedItemITF, request *tools.APIRequest) float64 {
+func GetPlannerNearestStart(start time.Time, planned map[tools.DataType]map[string]pricing.PricedItemITF) float64 {
-	near := float64(10000000000)    // set a high value
+	near := float64(-1)             // unset sentinel
 	for _, items := range planned { // loop through the planned items
 		for _, priced := range items { // loop through the priced items
 			if priced.GetLocationStart() == nil { // if the start is nil,
 				continue // skip the iteration
 			}
 			newS := priced.GetLocationStart() // get the start
-			if newS.Sub(start).Seconds() < near { // if the difference between the start and the new start is less than the nearest start
+			diff := newS.Sub(start).Seconds() // get the difference
-				near = newS.Sub(start).Seconds()
+			if near < 0 || diff < near {      // if the difference is less than the nearest start
+				near = diff
 			}
 		}
 	}
+	if near < 0 {
+		return 0 // no items found, start at the given start time
+	}
 	return near
 }
 
-func GetPlannerLongestTime(end *time.Time, planned map[tools.DataType]map[string]pricing.PricedItemITF, request *tools.APIRequest) float64 {
+// GetPlannerLongestTime returns the sum of all processing+service durations.
-	if end == nil {
+// Returns -1 if any item is open-ended (no deadline).
+func GetPlannerLongestTime(planned map[tools.DataType]map[string]pricing.PricedItemITF) float64 {
+	longestTime := float64(0)
+	for _, dt := range []tools.DataType{tools.PROCESSING_RESOURCE, tools.SERVICE_RESOURCE} {
+		for _, priced := range planned[dt] {
+			d := priced.GetExplicitDurationInS()
+			if d < 0 {
 				return -1
 			}
-	longestTime := float64(0)
+			longestTime += d
-	for _, priced := range planned[tools.PROCESSING_RESOURCE] {
-		if priced.GetLocationEnd() == nil {
-			continue
 		}
-		newS := priced.GetLocationEnd()
-		if end == nil && longestTime < newS.Sub(*end).Seconds() {
-			longestTime = newS.Sub(*end).Seconds()
-		}
-		// get the nearest start from start var
 	}
 	return longestTime
 }

models/common/pricing/interfaces.go

@@ -9,6 +9,7 @@ import (
 
 type PricedItemITF interface {
 	GetID() string
+	GetName() string
 	GetInstanceID() string
 	GetType() tools.DataType
 	IsPurchasable() bool

models/common/pricing/pricing_profile.go

@@ -28,7 +28,25 @@ func RefundTypeList() []RefundType {
 	return []RefundType{REFUND_DEAD_END, REFUND_ON_ERROR, REFUND_ON_EARLY_END}
 }
 
+type PaymentType int
+
+const (
+	PAY_ONCE PaymentType = iota
+	PAY_EVERY_WEEK
+	PAY_EVERY_MONTH
+	PAY_EVERY_YEAR
+)
+
+func (t PaymentType) String() string {
+	return [...]string{"PAY ONCE", "PAY_EVERY_WEEK", "PAY_EVERY_MONTH", "PAY_EVERY_YEAR"}[t]
+}
+
+func PaymentTypeList() []PaymentType {
+	return []PaymentType{PAY_ONCE, PAY_EVERY_WEEK, PAY_EVERY_MONTH, PAY_EVERY_YEAR}
+}
+
 type AccessPricingProfile[T Strategy] struct { // only use for acces such as : DATA && PROCESSING
+	AllowedPaymentType []PaymentType      `json:"allowed_payment_type,omitempty" bson:"allowed_payment_type,omitempty"` // Price is the price of the resource
 	Pricing            PricingStrategy[T] `json:"pricing,omitempty" bson:"pricing,omitempty"`                           // Price is the price of the resource
 	DefaultRefund      RefundType         `json:"default_refund" bson:"default_refund"`                                 // DefaultRefund is the default refund type of the pricing
 	RefundRatio        int32              `json:"refund_ratio" bson:"refund_ratio" default:"0"`                         // RefundRatio is the refund ratio if missing
@@ -59,8 +77,8 @@ func GetDefaultPricingProfile() PricingProfileITF {
 		Pricing: PricingStrategy[TimePricingStrategy]{
 			Price:               0,
 			Currency:            "EUR",
-			BuyingStrategy:      PERMANENT,
+			BuyingStrategy:      SUBSCRIPTION,
-			TimePricingStrategy: ONCE,
+			TimePricingStrategy: PER_SECOND,
 		},
 	}
 }

models/common/pricing/pricing_strategy.go

@@ -41,14 +41,14 @@ type BuyingStrategy int
 
 // should except... on
 const (
-	PERMANENT              BuyingStrategy = iota // is a permanent buying ( predictible )
+	SUBSCRIPTION           BuyingStrategy = iota // is a permanent buying ( predictible )
 	UNDEFINED_SUBSCRIPTION                       // a endless subscription ( unpredictible )
-	SUBSCRIPTION                                 // a defined subscription ( predictible )
+	PERMANENT                                    // a defined subscription ( predictible )
 	// PAY_PER_USE                                  // per request. ( unpredictible )
 )
 
 func (t BuyingStrategy) String() string {
-	return [...]string{"PERMANENT", "UNDEFINED_SUBSCRIPTION", "SUBSCRIPTION"}[t]
+	return [...]string{"SUBSCRIPTION", "UNDEFINED_SUBSCRIPTION", "PERMANENT"}[t]
 }
 
 func (t BuyingStrategy) IsBillingStrategyAllowed(bs BillingStrategy) (BillingStrategy, bool) {
@@ -65,7 +65,7 @@ func (t BuyingStrategy) IsBillingStrategyAllowed(bs BillingStrategy) (BillingStr
 }
 
 func BuyingStrategyList() []BuyingStrategy {
-	return []BuyingStrategy{PERMANENT, UNDEFINED_SUBSCRIPTION, SUBSCRIPTION}
+	return []BuyingStrategy{SUBSCRIPTION, UNDEFINED_SUBSCRIPTION, PERMANENT}
 }
 
 type Strategy interface {
@@ -112,7 +112,7 @@ func getAverageTimeInSecond(averageTimeInSecond float64, start time.Time, end *t
 	fromAverageDuration := after.Sub(now).Seconds()
 	var tEnd time.Time
 	if end == nil {
-		tEnd = start.Add(1 * time.Hour)
+		tEnd = start.Add(5 * time.Minute)
 	} else {
 		tEnd = *end
 	}
@@ -154,13 +154,16 @@ func BookingEstimation(t TimePricingStrategy, price float64, locationDurationInS
 type PricingStrategy[T Strategy] struct {
 	Price    float64 `json:"price" bson:"price" default:"0"`         // Price is the Price of the pricing
 	Currency string  `json:"currency" bson:"currency" default:"USD"` // Currency is the currency of the pricing
+
+	// NO NEED ?
 	BuyingStrategy      BuyingStrategy      `json:"buying_strategy" bson:"buying_strategy" default:"0"`             // BuyingStrategy is the buying strategy of the pricing
 	TimePricingStrategy TimePricingStrategy `json:"time_pricing_strategy" bson:"time_pricing_strategy" default:"0"` // TimePricingStrategy is the time pricing strategy of the pricing
 	OverrideStrategy    T                   `json:"override_strategy" bson:"override_strategy" default:"-1"`        // Modulation is the modulation of the pricing
 }
 
 func (p PricingStrategy[T]) GetPriceHT(amountOfData float64, bookingTimeDuration float64, start time.Time, end *time.Time, variations []*PricingVariation) (float64, error) {
-	if p.BuyingStrategy == SUBSCRIPTION {
+	switch p.BuyingStrategy {
+	case SUBSCRIPTION:
 		price, err := BookingEstimation(p.GetTimePricingStrategy(), p.Price*float64(amountOfData), bookingTimeDuration, start, end)
 		if err != nil {
 			return 0, err
@@ -174,7 +177,7 @@ func (p PricingStrategy[T]) GetPriceHT(amountOfData float64, bookingTimeDuration
 
 		return p.Price, nil
 
-	} else if p.BuyingStrategy == PERMANENT {
+	case PERMANENT:
 		if variations != nil {
 			price := p.Price
 			for _, v := range variations {

models/common/pricing/tests/pricing_test.go

@@ -63,7 +63,7 @@ func Test_getAverageTimeInSecond_WithoutEnd(t *testing.T) {
 
 func TestBookingEstimation(t *testing.T) {
 	start := time.Now()
-	end := start.Add(2 * time.Hour)
+	end := start.Add(10 * time.Minute)
 	strategies := map[pricing.TimePricingStrategy]float64{
 		pricing.ONCE:       50,
 		pricing.PER_HOUR:   10,
@@ -102,7 +102,7 @@ func TestPricingStrategy_Getters(t *testing.T) {
 
 func TestPricingStrategy_GetPriceHT(t *testing.T) {
 	start := time.Now()
-	end := start.Add(1 * time.Hour)
+	end := start.Add(5 * time.Minute)
 
 	// SUBSCRIPTION case
 	ps := pricing.PricingStrategy[DummyStrategy]{

models/execution_verification/execution_verification.go

@@ -0,0 +1,45 @@
+package execution_verification
+
+import (
+	"cloud.o-forge.io/core/oc-lib/models/utils"
+	"cloud.o-forge.io/core/oc-lib/tools"
+)
+
+/*
+* ExecutionVerification is a struct that represents a list of workflow executions
+* Warning: No user can write (del, post, put) a workflow execution, it is only used by the system
+* workflows generate their own executions
+ */
+type ExecutionVerification struct {
+	utils.AbstractObject        // AbstractObject contains the basic fields of an object (id, name)
+	WorkflowID           string `json:"workflow_id" bson:"workflow_id,omitempty"` // WorkflowID is the ID of the workflow
+	Payload              string `json:"payload" bson:"payload,omitempty"`
+	IsVerified           bool   `json:"is_verified" bson:"is_verified,omitempty"`
+	Validate             bool   `json:"validate" bson:"validate,omitempty"`
+}
+
+func (ri *ExecutionVerification) Extend(typ ...string) map[string][]tools.DataType {
+	ext := ri.AbstractObject.Extend(typ...)
+	for _, t := range typ {
+		switch t {
+		case "wokflow":
+			if _, ok := ext[t]; !ok {
+				ext[t] = []tools.DataType{}
+			}
+			ext[t] = append(ext[t], tools.WORKFLOW)
+		}
+	}
+	return ext
+}
+
+func (r *ExecutionVerification) StoreDraftDefault() {
+	r.IsDraft = false // TODO: TEMPORARY
+}
+
+func (d *ExecutionVerification) GetAccessor(request *tools.APIRequest) utils.Accessor {
+	return NewAccessor(request) // Create a new instance of the accessor
+}
+
+func (d *ExecutionVerification) VerifyAuth(callName string, request *tools.APIRequest) bool {
+	return true
+}

models/execution_verification/execution_verification_mongo_accessor.go

@@ -0,0 +1,38 @@
+package execution_verification
+
+import (
+	"cloud.o-forge.io/core/oc-lib/logs"
+	"cloud.o-forge.io/core/oc-lib/models/utils"
+	"cloud.o-forge.io/core/oc-lib/tools"
+)
+
+type ExecutionVerificationMongoAccessor struct {
+	utils.AbstractAccessor[*ExecutionVerification]
+	shallow bool
+}
+
+func NewAccessor(request *tools.APIRequest) *ExecutionVerificationMongoAccessor {
+	return &ExecutionVerificationMongoAccessor{
+		shallow: false,
+		AbstractAccessor: utils.AbstractAccessor[*ExecutionVerification]{
+			Logger:         logs.CreateLogger(tools.WORKFLOW_EXECUTION.String()), // Create a logger with the data type
+			Request:        request,
+			Type:           tools.WORKFLOW_EXECUTION,
+			New:            func() *ExecutionVerification { return &ExecutionVerification{} },
+			NotImplemented: []string{"DeleteOne", "StoreOne", "CopyOne"},
+		},
+	}
+}
+
+func (wfa *ExecutionVerificationMongoAccessor) StoreOne(set utils.DBObject) (utils.DBObject, int, error) {
+	set.(*ExecutionVerification).IsVerified = false
+	return utils.GenericStoreOne(set, wfa)
+}
+
+func (wfa *ExecutionVerificationMongoAccessor) UpdateOne(set map[string]interface{}, id string) (utils.DBObject, int, error) {
+	set = map[string]interface{}{
+		"is_verified": true,
+		"validate":    set["validate"],
+	}
+	return utils.GenericUpdateOne(set, id, wfa)
+}

models/live/interfaces.go

@@ -1,18 +1,13 @@
 package live
 
 import (
-	"cloud.o-forge.io/core/oc-lib/models/resources"
 	"cloud.o-forge.io/core/oc-lib/models/utils"
-	"cloud.o-forge.io/core/oc-lib/tools"
 )
 
 type LiveInterface interface {
 	utils.DBObject
+	IsCompatible(service map[string]interface{}) bool
 	GetMonitorPath() string
 	GetResourcesID() []string
 	SetResourcesID(string)
-	GetResourceAccessor(request *tools.APIRequest) utils.Accessor
-	GetResource() resources.ResourceInterface
-	GetResourceInstance() resources.ResourceInstanceITF
-	SetResourceInstance(res resources.ResourceInterface, i resources.ResourceInstanceITF) resources.ResourceInterface
 }

models/live/live.go

@@ -3,7 +3,6 @@ package live
 import (
 	"slices"
 
-	"cloud.o-forge.io/core/oc-lib/models/resources"
 	"cloud.o-forge.io/core/oc-lib/models/utils"
 	"cloud.o-forge.io/core/oc-lib/tools"
 	"github.com/biter777/countries"
@@ -32,18 +31,41 @@ type LiveCerts struct {
 }
 
 // TODO in the future multiple type of certs depending of infra type
+type GeoPoint struct {
+	Latitude  float64 `json:"latitude,omitempty" bson:"latitude,omitempty"`
+	Longitude float64 `json:"longitude,omitempty" bson:"longitude,omitempty"`
+}
 
 type AbstractLive struct {
 	utils.AbstractObject
 	Certs LiveCerts `json:"certs,omitempty" bson:"certs,omitempty"`
 
 	MonitorPath    string                `json:"monitor_path,omitempty" bson:"monitor_path,omitempty"`
-	Location       resources.GeoPoint    `json:"location,omitempty" bson:"location,omitempty"`
+	Location       GeoPoint              `json:"location,omitempty" bson:"location,omitempty"`
 	Country        countries.CountryCode `json:"country,omitempty" bson:"country,omitempty"`
 	AccessProtocol string                `json:"access_protocol,omitempty" bson:"access_protocol,omitempty"`
 	ResourcesID    []string              `json:"resources_id" bson:"resources_id"`
 }
 
+func (ri *AbstractLive) Extend(typ ...string) map[string][]tools.DataType {
+	ext := ri.AbstractObject.Extend(typ...)
+	for _, t := range typ {
+		switch t {
+		case "resource":
+			if _, ok := ext[t]; !ok {
+				ext[t] = []tools.DataType{}
+			}
+			ext[t] = append(ext[t], tools.WORKFLOW_RESOURCE)
+			ext[t] = append(ext[t], tools.DATA_RESOURCE)
+			ext[t] = append(ext[t], tools.COMPUTE_RESOURCE)
+			ext[t] = append(ext[t], tools.STORAGE_RESOURCE)
+			ext[t] = append(ext[t], tools.PROCESSING_RESOURCE)
+			ext[t] = append(ext[t], tools.SERVICE_RESOURCE)
+		}
+	}
+	return ext
+}
+
 func (d *AbstractLive) GetMonitorPath() string {
 	return d.MonitorPath
 }
@@ -52,9 +74,9 @@ func (d *AbstractLive) GetResourcesID() []string {
 	return d.ResourcesID
 }
 
-func (d *AbstractLive) SetResourcesID(id string) {
+func (d *AbstractLive) SetResourcesID(resourcesid string) {
-	if !slices.Contains(d.ResourcesID, id) {
+	if slices.Contains(d.ResourcesID, resourcesid) {
-		d.ResourcesID = append(d.ResourcesID, id)
+		d.ResourcesID = append(d.ResourcesID, resourcesid)
 	}
 }
 
@@ -63,7 +85,7 @@ func (r *AbstractLive) GetResourceType() tools.DataType {
 }
 
 func (r *AbstractLive) StoreDraftDefault() {
-	r.IsDraft = true
+	r.IsDraft = false
 }
 
 func (r *AbstractLive) CanDelete() bool {

models/live/live_datacenter.go

@@ -3,7 +3,6 @@ package live
 import (
 	"cloud.o-forge.io/core/oc-lib/models/common/enum"
 	"cloud.o-forge.io/core/oc-lib/models/common/models"
-	"cloud.o-forge.io/core/oc-lib/models/resources"
 	"cloud.o-forge.io/core/oc-lib/models/utils"
 	"cloud.o-forge.io/core/oc-lib/tools"
 )
@@ -12,6 +11,13 @@ import (
 * LiveDatacenter is a struct that represents a compute units in your datacenters
  */
 
+type ComputeNode struct {
+	Name     string           `json:"name,omitempty" bson:"name,omitempty"`
+	Quantity int64            `json:"quantity" bson:"quantity" default:"1"`
+	RAM      *models.RAM      `bson:"ram,omitempty" json:"ram,omitempty"`   // RAM is the RAM
+	CPUs     map[string]int64 `bson:"cpus,omitempty" json:"cpus,omitempty"` // CPUs is the list of CPUs key is model
+	GPUs     map[string]int64 `bson:"gpus,omitempty" json:"gpus,omitempty"` // GPUs is the list of GPUs key is model
+}
 type LiveDatacenter struct {
 	AbstractLive
 
@@ -26,25 +32,13 @@ type LiveDatacenter struct {
 	AnnualCO2Emissions float64                 `json:"annual_co2_emissions,omitempty" bson:"co2_emissions,omitempty"`
 	CPUs               map[string]*models.CPU  `bson:"cpus,omitempty" json:"cpus,omitempty"` // CPUs is the list of CPUs key is model
 	GPUs               map[string]*models.GPU  `bson:"gpus,omitempty" json:"gpus,omitempty"` // GPUs is the list of GPUs key is model
-	Nodes              []*resources.ComputeNode `json:"nodes,omitempty" bson:"nodes,omitempty"`
+	Nodes              []*ComputeNode          `json:"nodes,omitempty" bson:"nodes,omitempty"`
+}
+
+func (r *LiveDatacenter) IsCompatible(service map[string]interface{}) bool {
+	return service["infrastructure"] == r.Infrastructure && service["architecture"] == r.Architecture
 }
 
 func (d *LiveDatacenter) GetAccessor(request *tools.APIRequest) utils.Accessor {
 	return NewAccessor[*LiveDatacenter](tools.LIVE_DATACENTER, request) // Create a new instance of the accessor
 }
-func (d *LiveDatacenter) GetResourceAccessor(request *tools.APIRequest) utils.Accessor {
-	return resources.NewAccessor[*resources.ComputeResource](tools.COMPUTE_RESOURCE, request, func() utils.DBObject { return &resources.ComputeResource{} })
-}
-
-func (d *LiveDatacenter) GetResource() resources.ResourceInterface {
-	return &resources.ComputeResource{}
-}
-func (d *LiveDatacenter) GetResourceInstance() resources.ResourceInstanceITF {
-	return &resources.ComputeResourceInstance{}
-}
-
-func (d *LiveDatacenter) SetResourceInstance(res resources.ResourceInterface, i resources.ResourceInstanceITF) resources.ResourceInterface {
-	r := res.(*resources.ComputeResource)
-	r.Instances = append(r.Instances, i.(*resources.ComputeResourceInstance))
-	return r
-}

models/live/live_mongo_accessor.go

@@ -1,21 +1,19 @@
 package live
 
 import (
-	"encoding/json"
+	"cloud.o-forge.io/core/oc-lib/dbs"
-	"errors"
-
 	"cloud.o-forge.io/core/oc-lib/logs"
 	"cloud.o-forge.io/core/oc-lib/models/utils"
 	"cloud.o-forge.io/core/oc-lib/tools"
 )
 
-type computeUnitsMongoAccessor[T LiveInterface] struct {
+type liveMongoAccessor[T LiveInterface] struct {
 	utils.AbstractAccessor[LiveInterface] // AbstractAccessor contains the basic fields of an accessor (model, caller)
 }
 
 // New creates a new instance of the computeUnitsMongoAccessor
-func NewAccessor[T LiveInterface](t tools.DataType, request *tools.APIRequest) *computeUnitsMongoAccessor[T] {
+func NewAccessor[T LiveInterface](t tools.DataType, request *tools.APIRequest) *liveMongoAccessor[T] {
-	return &computeUnitsMongoAccessor[T]{
+	return &liveMongoAccessor[T]{
 		AbstractAccessor: utils.AbstractAccessor[LiveInterface]{
 			Logger:  logs.CreateLogger(t.String()), // Create a logger with the data type
 			Request: request,
@@ -26,67 +24,34 @@ func NewAccessor[T LiveInterface](t tools.DataType, request *tools.APIRequest) *
 					return &LiveDatacenter{}
 				case tools.LIVE_STORAGE:
 					return &LiveStorage{}
+				case tools.LIVE_SERVICE:
+					return &LiveService{}
 				}
 				return &LiveDatacenter{}
 			},
+			NotImplemented: []string{"CopyOne"},
 		},
 	}
 }
 
-/*
+func (wfa *liveMongoAccessor[T]) LoadAll(isDraft bool, offset int64, limit int64) ([]utils.ShallowDBObject, int, error) {
-* Nothing special here, just the basic CRUD operations
+	return utils.GenericLoadAll[T](wfa.GetExec(isDraft), isDraft, wfa, offset, limit)
- */
-func (a *computeUnitsMongoAccessor[T]) CopyOne(data utils.DBObject) (utils.DBObject, int, error) {
-	// is a publisher... that become a resources.
-	if data.IsDrafted() {
-		return nil, 422, errors.New("can't publish a drafted compute units")
 }
-	live := data.(T)
-	if live.GetMonitorPath() == "" || live.GetID() != "" {
-		return nil, 422, errors.New("publishing is only allowed is it can be monitored and be accessible")
-	}
-	if res, code, err := a.LoadOne(live.GetID()); err != nil {
-		return nil, code, err
-	} else {
-		live = res.(T)
-	}
-	resAccess := live.GetResourceAccessor(a.Request)
-	instance := live.GetResourceInstance()
-	b, _ := json.Marshal(live)
-	json.Unmarshal(b, instance)
 
-	if len(live.GetResourcesID()) > 0 {
+func (wfa *liveMongoAccessor[T]) Search(filters *dbs.Filters, search string, isDraft bool, offset int64, limit int64) ([]utils.ShallowDBObject, int, error) {
-		for _, r := range live.GetResourcesID() {
+	if filters == nil && search == "*" {
-			// TODO dependent of a existing resource
+		return utils.GenericLoadAll[T](func(d utils.DBObject) utils.ShallowDBObject {
-			res, code, err := resAccess.LoadOne(r)
+			return d
-			if err == nil {
+		}, isDraft, wfa, offset, limit)
-				return nil, code, err
 	}
-			existingResource := live.GetResource()
+	return utils.GenericSearch[T](filters, search, wfa.New().GetObjectFilters(search),
-			b, _ := json.Marshal(res)
+		func(d utils.DBObject) utils.ShallowDBObject {
-			json.Unmarshal(b, existingResource)
+			return d
-			live.SetResourceInstance(existingResource, instance)
+		}, isDraft, wfa, offset, limit)
-			resAccess.UpdateOne(existingResource.Serialize(existingResource), existingResource.GetID())
-		}
-		if live.GetID() != "" {
-			return a.LoadOne(live.GetID())
-		} else {
-			return a.StoreOne(live)
-		}
-	} else {
-		r := live.GetResource()
-		b, _ := json.Marshal(live)
-		json.Unmarshal(b, &r)
-		live.SetResourceInstance(r, instance)
-		res, code, err := resAccess.StoreOne(r)
-		if err != nil {
-			return nil, code, err
-		}
-		live.SetResourcesID(res.GetID())
-		if live.GetID() != "" {
-			return a.UpdateOne(live.Serialize(live), live.GetID())
-		} else {
-			return a.StoreOne(live)
 }
+
+func (a *liveMongoAccessor[T]) GetExec(isDraft bool) func(utils.DBObject) utils.ShallowDBObject {
+	return func(d utils.DBObject) utils.ShallowDBObject {
+		return d
 	}
 }

models/live/live_service.go

@@ -0,0 +1,42 @@
+package live
+
+import (
+	"cloud.o-forge.io/core/oc-lib/models/common/enum"
+	"cloud.o-forge.io/core/oc-lib/models/utils"
+	"cloud.o-forge.io/core/oc-lib/tools"
+)
+
+type ServiceProtocol int
+
+const (
+	HTTP ServiceProtocol = iota
+	GRPC
+	WEBSOCKET
+	TCP
+)
+
+func (p ServiceProtocol) String() string {
+	return [...]string{"HTTP", "GRPC", "WEBSOCKET", "TCP"}[p]
+}
+
+// LiveService is the authoritative description of a hosted service run by the peer.
+// MaxConcurrent is the only capacity dimension that matters for scheduling:
+// it caps the number of simultaneous callers the service can accept.
+// All other service metadata (endpoint, protocol) is live-verified here
+// rather than trusted from the ServiceResource, which may be stale.
+type LiveService struct {
+	AbstractLive
+	MaxConcurrent   int                       `json:"max_concurrent" bson:"max_concurrent"`
+	Protocol        ServiceProtocol `json:"protocol" bson:"protocol" default:"0"`
+	EndpointPattern string                    `json:"endpoint_pattern,omitempty" bson:"endpoint_pattern,omitempty"`
+	HealthCheckPath string                    `json:"health_check_path,omitempty" bson:"health_check_path,omitempty"`
+	Infrastructure  enum.InfrastructureType   `json:"infrastructure" bson:"infrastructure" default:"-1"` // Infrastructure is the infrastructure
+}
+
+func (d *LiveService) GetAccessor(request *tools.APIRequest) utils.Accessor {
+	return NewAccessor[*LiveService](tools.LIVE_SERVICE, request)
+}
+
+func (r *LiveService) IsCompatible(service map[string]interface{}) bool {
+	return service["infrastructure"] == r.Infrastructure
+}

models/live/live_storage.go

@@ -2,7 +2,6 @@ package live
 
 import (
 	"cloud.o-forge.io/core/oc-lib/models/common/enum"
-	"cloud.o-forge.io/core/oc-lib/models/resources"
 	"cloud.o-forge.io/core/oc-lib/models/utils"
 	"cloud.o-forge.io/core/oc-lib/tools"
 )
@@ -14,6 +13,7 @@ import (
 type LiveStorage struct {
 	AbstractLive
 
+	StorageType   enum.StorageType `bson:"storage_type" json:"storage_type" default:"-1"`
 	Source        string           `bson:"source,omitempty" json:"source,omitempty"` // Source is the source of the storage
 	Path          string           `bson:"path,omitempty" json:"path,omitempty"`     // Path is the store folders in the source
 	Local         bool             `bson:"local" json:"local"`
@@ -25,22 +25,10 @@ type LiveStorage struct {
 	Throughput    string           `bson:"throughput,omitempty" json:"throughput,omitempty"` // Throughput is the throughput of the storage
 }
 
+func (r *LiveStorage) IsCompatible(service map[string]interface{}) bool {
+	return service["storage_type"] == r.StorageType
+}
+
 func (d *LiveStorage) GetAccessor(request *tools.APIRequest) utils.Accessor {
 	return NewAccessor[*LiveStorage](tools.LIVE_STORAGE, request) // Create a new instance of the accessor
 }
-func (d *LiveStorage) GetResourceAccessor(request *tools.APIRequest) utils.Accessor {
-	return resources.NewAccessor[*resources.ComputeResource](tools.STORAGE_RESOURCE, request, func() utils.DBObject { return &resources.StorageResource{} })
-}
-
-func (d *LiveStorage) GetResource() resources.ResourceInterface {
-	return &resources.StorageResource{}
-}
-func (d *LiveStorage) GetResourceInstance() resources.ResourceInstanceITF {
-	return &resources.StorageResourceInstance{}
-}
-
-func (d *LiveStorage) SetResourceInstance(res resources.ResourceInterface, i resources.ResourceInstanceITF) resources.ResourceInterface {
-	r := res.(*resources.StorageResource)
-	r.Instances = append(r.Instances, i.(*resources.StorageResourceInstance))
-	return r
-}

models/live/tests/live_test.go

@@ -79,18 +79,6 @@ func TestLiveDatacenter_GetAccessor_NilRequest(t *testing.T) {
 	assert.NotNil(t, acc)
 }
 
-func TestLiveDatacenter_GetResource(t *testing.T) {
-	dc := &live.LiveDatacenter{}
-	res := dc.GetResource()
-	assert.NotNil(t, res)
-}
-
-func TestLiveDatacenter_GetResourceInstance(t *testing.T) {
-	dc := &live.LiveDatacenter{}
-	inst := dc.GetResourceInstance()
-	assert.NotNil(t, inst)
-}
-
 func TestLiveDatacenter_IDAndName(t *testing.T) {
 	dc := &live.LiveDatacenter{}
 	dc.AbstractLive.AbstractObject = utils.AbstractObject{UUID: "dc-id", Name: "dc-name"}
@@ -124,18 +112,6 @@ func TestLiveStorage_GetAccessor(t *testing.T) {
 	assert.NotNil(t, acc)
 }
 
-func TestLiveStorage_GetResource(t *testing.T) {
-	s := &live.LiveStorage{}
-	res := s.GetResource()
-	assert.NotNil(t, res)
-}
-
-func TestLiveStorage_GetResourceInstance(t *testing.T) {
-	s := &live.LiveStorage{}
-	inst := s.GetResourceInstance()
-	assert.NotNil(t, inst)
-}
-
 func TestLiveStorage_SetResourcesID_NoDuplication(t *testing.T) {
 	s := &live.LiveStorage{}
 	s.SetResourcesID("storage-1")

models/models.go

@@ -2,10 +2,13 @@ package models
 
 import (
 	"cloud.o-forge.io/core/oc-lib/logs"
+	"cloud.o-forge.io/core/oc-lib/models/allowed_image"
 	"cloud.o-forge.io/core/oc-lib/models/bill"
+	"cloud.o-forge.io/core/oc-lib/models/execution_verification"
 	"cloud.o-forge.io/core/oc-lib/models/live"
 	"cloud.o-forge.io/core/oc-lib/models/order"
 	"cloud.o-forge.io/core/oc-lib/models/resources/purchase_resource"
+	"cloud.o-forge.io/core/oc-lib/models/utils"
 	"cloud.o-forge.io/core/oc-lib/tools"
 
 	"cloud.o-forge.io/core/oc-lib/models/booking"
@@ -13,7 +16,6 @@ import (
 	"cloud.o-forge.io/core/oc-lib/models/collaborative_area/rules/rule"
 	"cloud.o-forge.io/core/oc-lib/models/peer"
 	resource "cloud.o-forge.io/core/oc-lib/models/resources"
-	"cloud.o-forge.io/core/oc-lib/models/utils"
 	w2 "cloud.o-forge.io/core/oc-lib/models/workflow"
 	"cloud.o-forge.io/core/oc-lib/models/workflow_execution"
 	w3 "cloud.o-forge.io/core/oc-lib/models/workspace"
@@ -29,6 +31,7 @@ var ModelsCatalog = map[string]func() utils.DBObject{
 	tools.COMPUTE_RESOURCE.String():       func() utils.DBObject { return &resource.ComputeResource{} },
 	tools.STORAGE_RESOURCE.String():       func() utils.DBObject { return &resource.StorageResource{} },
 	tools.PROCESSING_RESOURCE.String():    func() utils.DBObject { return &resource.ProcessingResource{} },
+	tools.SERVICE_RESOURCE.String():       func() utils.DBObject { return &resource.ServiceResource{} },
 	tools.NATIVE_TOOL.String():            func() utils.DBObject { return &resource.NativeTool{} },
 	tools.WORKFLOW.String():               func() utils.DBObject { return &w2.Workflow{} },
 	tools.WORKFLOW_EXECUTION.String():     func() utils.DBObject { return &workflow_execution.WorkflowExecution{} },
@@ -43,7 +46,10 @@ var ModelsCatalog = map[string]func() utils.DBObject{
 	tools.PURCHASE_RESOURCE.String():      func() utils.DBObject { return &purchase_resource.PurchaseResource{} },
 	tools.LIVE_DATACENTER.String():        func() utils.DBObject { return &live.LiveDatacenter{} },
 	tools.LIVE_STORAGE.String():           func() utils.DBObject { return &live.LiveStorage{} },
+	tools.LIVE_SERVICE.String():           func() utils.DBObject { return &live.LiveService{} },
 	tools.BILL.String():                   func() utils.DBObject { return &bill.Bill{} },
+	tools.EXECUTION_VERIFICATION.String(): func() utils.DBObject { return &execution_verification.ExecutionVerification{} },
+	tools.ALLOWED_IMAGE.String():          func() utils.DBObject { return &allowed_image.AllowedImage{} },
 }
 
 // Model returns the model object based on the model type

models/peer/peer.go

@@ -3,9 +3,19 @@ package peer
 import (
 	"fmt"
 	"strings"
+	"time"
 
 	"cloud.o-forge.io/core/oc-lib/models/utils"
 	"cloud.o-forge.io/core/oc-lib/tools"
+	"github.com/biter777/countries"
+)
+
+type PeerPerm int
+
+const (
+	READ PeerRelation = iota
+	WRITE
+	MONITOR
 )
 
 type PeerRelation int
@@ -16,9 +26,13 @@ const (
 	PARTNER
 	BLACKLIST
 	PENDING_PARTNER
+	MASTER
+	NANO
+	PENDING_NANO
+	PENDING_MASTER
 )
 
-var path = []string{"unknown", "self", "partner", "blacklist", "partner"}
+var path = []string{"unknown", "self", "partner", "blacklist", "partner", "pending_partner", "master", "nano", "pending_nano", "pending_master"}
 
 func GetRelationPath(str string) int {
 	for i, p := range path {
@@ -41,11 +55,47 @@ func (m PeerRelation) EnumIndex() int {
 	return int(m)
 }
 
+// BehaviorWarning records a single misbehavior observed by a trusted service.
+type BehaviorWarning struct {
+	At          time.Time              `json:"at" bson:"at"`
+	ReporterApp string                 `json:"reporter_app" bson:"reporter_app"`
+	Severity    tools.BehaviorSeverity `json:"severity" bson:"severity"`
+	Reason      string                 `json:"reason" bson:"reason"`
+	Evidence    string                 `json:"evidence,omitempty" bson:"evidence,omitempty"`
+}
+
+// PeerLocation holds the voluntarily disclosed geographic position of a node.
+// Granularity controls how precise the location is:
+//
+//	0 = not disclosed
+//	1 = continent   (±15°)
+//	2 = country     (±3°)   — default
+//	3 = region      (±0.5°)
+//	4 = city        (±0.05°)
+//
+// The coordinates are always fuzzed by oc-discovery before publication,
+// so a granularity-2 location identifies only the rough country area.
+type PeerLocation struct {
+	Latitude    float64 `json:"latitude" bson:"latitude"`
+	Longitude   float64 `json:"longitude" bson:"longitude"`
+	Granularity int     `json:"granularity" bson:"granularity"`
+
+	Country  countries.CountryCode `json:"country,omitempty" bson:"country,omitempty"`
+	Timezone string                `json:"timezone,omitempty" bson:"timezone,omitempty"`
+}
+
 // Peer is a struct that represents a peer
 type Peer struct {
 	utils.AbstractObject
+	IsNano bool `json:"is_nano" bson:"is_nano"`
+
+	PeerPerms []PeerPerm `json:"peer_perms" bson:"peer_perms"`
+
+	RelationLastChangeDate time.Time `json:"relation_last_change_date" bson:"relation_last_change_date"`
+	RelationLastChangeUser string    `json:"relation_last_change_user" bson:"relation_last_change_user"`
 
 	Verify         bool   `json:"verify" bson:"verify"`
+	OrganizationID string `json:"organization_id" bson:"organization_id"`
 	PeerID         string `json:"peer_id" bson:"peer_id" validate:"required"`
 
 	APIUrl          string          `json:"api_url" bson:"api_url" validate:"required"`               // Url is the URL of the peer (base64url)
@@ -56,12 +106,76 @@ type Peer struct {
 	Relation        PeerRelation    `json:"relation" bson:"relation" default:"0"`
 	ServicesState   map[string]int  `json:"services_state,omitempty" bson:"services_state,omitempty"`
 	FailedExecution []PeerExecution `json:"failed_execution" bson:"failed_execution"` // FailedExecution is the list of failed executions, to be retried
+
+	// Location is the voluntarily disclosed (and fuzzed) geographic position.
+	Location *PeerLocation `json:"location,omitempty" bson:"location,omitempty"`
+
+	// Trust scoring — maintained by oc-discovery from PEER_BEHAVIOR_EVENT reports.
+	TrustScore       float64           `json:"trust_score" bson:"trust_score" default:"100"`
+	BlacklistReason  string            `json:"blacklist_reason,omitempty" bson:"blacklist_reason,omitempty"`
+	BehaviorWarnings []BehaviorWarning `json:"behavior_warnings,omitempty" bson:"behavior_warnings,omitempty"`
+
+	// Volatile connectivity state — never persisted to DB (bson:"-").
+	// Set in-memory by oc-peer when it receives a PEER_OBSERVE_RESPONSE_EVENT.
+	// Considered offline when LastHeartbeat is older than 60 s (30 s interval + 30 s grace).
+	Online        bool       `json:"online" bson:"-"`
+	LastHeartbeat *time.Time `json:"last_heartbeat,omitempty" bson:"-"`
+}
+
+func (ri *Peer) Extend(typ ...string) map[string][]tools.DataType {
+	ext := ri.AbstractObject.Extend(typ...)
+	for _, t := range typ {
+		switch t {
+		case "peer":
+			if _, ok := ext[t]; !ok {
+				ext[t] = []tools.DataType{}
+			}
+			ext[t] = append(ext[t], tools.PEER)
+		}
+	}
+	return ext
 }
 
 func (ao *Peer) VerifyAuth(callName string, request *tools.APIRequest) bool {
 	return true
 }
 
+// BlacklistThreshold is the trust score below which a peer is auto-blacklisted.
+const BlacklistThreshold = 20.0
+
+// ApplyBehaviorReport records a misbehavior, deducts the trust penalty, and
+// returns true when the trust score has fallen below BlacklistThreshold so the
+// caller can trigger the relation change.
+func (p *Peer) ApplyBehaviorReport(r tools.PeerBehaviorReport) (shouldBlacklist bool) {
+	p.BehaviorWarnings = append(p.BehaviorWarnings, BehaviorWarning{
+		At:          r.At,
+		ReporterApp: r.ReporterApp,
+		Severity:    r.Severity,
+		Reason:      r.Reason,
+		Evidence:    r.Evidence,
+	})
+	if p.TrustScore == 0 {
+		p.TrustScore = 100 // initialise if never set
+	}
+	p.TrustScore -= r.Severity.Penalty()
+	if p.TrustScore < 0 {
+		p.TrustScore = 0
+	}
+	if p.TrustScore <= BlacklistThreshold {
+		p.BlacklistReason = r.Reason
+		return true
+	}
+	return false
+}
+
+// ResetTrust clears all behavior history and resets the trust score to 100.
+// Must be called when a peer relation is manually set to NONE or PARTNER.
+func (p *Peer) ResetTrust() {
+	p.TrustScore = 100
+	p.BlacklistReason = ""
+	p.BehaviorWarnings = nil
+}
+
 // AddExecution adds an execution to the list of failed executions
 func (ao *Peer) AddExecution(exec PeerExecution) {
 	found := false
@@ -96,7 +210,3 @@ func (d *Peer) GetAccessor(request *tools.APIRequest) utils.Accessor {
 	data := NewAccessor(request) // Create a new instance of the accessor
 	return data
 }
-
-func (r *Peer) CanDelete() bool {
-	return false // only draft order can be deleted
-}

models/peer/peer_cache.go

@@ -41,7 +41,6 @@ func CheckPeerStatus(peerID string, appName string) (*Peer, bool) {
 		return nil, false
 	}
 	url := urlFormat(res.(*Peer).APIUrl, tools.PEER) + "/status" // Format the URL
-	fmt.Println(url)
 	state, services := api.CheckRemotePeer(url)
 	res.(*Peer).ServicesState = services                              // Update the services states of the peer
 	access.UpdateOne(res.Serialize(res), peerID)                      // Update the peer in the db

models/peer/peer_mongo_accessor.go

@@ -42,6 +42,23 @@ func (wfa *peerMongoAccessor) ShouldVerifyAuth() bool {
 	return !wfa.OverrideAuth
 }
 
+/*
+TODO : organization_ID est un peer_ID duquel on se revendique faire parti.
+Ca implique une clé d'organisation + une demande d'intégration.
+
+Slave-Master IOT
+*/
+func (dca *peerMongoAccessor) StoreOne(data utils.DBObject) (utils.DBObject, int, error) {
+	pp, _ := utils.GetMySelf(NewAccessor(&tools.APIRequest{Admin: true}))
+	if data != nil {
+		d := data.(*Peer)
+		if pp != nil && d.OrganizationID != "" && d.OrganizationID == pp.(*Peer).OrganizationID {
+			d.Relation = PARTNER // defaulting on partner if same organization.
+		}
+	}
+	return utils.GenericStoreOne(data, dca)
+}
+
 /*
 * Nothing special here, just the basic CRUD operations
  */

models/resources/compute.go

@@ -2,12 +2,14 @@ package resources
 
 import (
 	"errors"
+	"fmt"
 	"strings"
 	"time"
 
 	"cloud.o-forge.io/core/oc-lib/models/common/enum"
 	"cloud.o-forge.io/core/oc-lib/models/common/models"
 	"cloud.o-forge.io/core/oc-lib/models/common/pricing"
+	"cloud.o-forge.io/core/oc-lib/models/live"
 	"cloud.o-forge.io/core/oc-lib/models/utils"
 	"cloud.o-forge.io/core/oc-lib/tools"
 	"github.com/google/uuid"
@@ -24,7 +26,7 @@ type ComputeResource struct {
 }
 
 func (d *ComputeResource) GetAccessor(request *tools.APIRequest) utils.Accessor {
-	return NewAccessor[*ComputeResource](tools.COMPUTE_RESOURCE, request, func() utils.DBObject { return &ComputeResource{} })
+	return NewAccessor[*ComputeResource](tools.COMPUTE_RESOURCE, request)
 }
 
 func (r *ComputeResource) GetType() string {
@@ -35,35 +37,34 @@ func (abs *ComputeResource) ConvertToPricedResource(t tools.DataType, selectedIn
 	if t != tools.COMPUTE_RESOURCE {
 		return nil, errors.New("not the proper type expected : cannot convert to priced resource : have " + t.String() + " wait Compute")
 	}
-	p, err := abs.AbstractInstanciatedResource.ConvertToPricedResource(t, selectedInstance, selectedPartnership, selectedBuyingStrategy, selectedStrategy, selectedBookingModeIndex, request)
+	p, err := ConvertToPricedResource[*ComputeResourcePricingProfile](t, selectedInstance, selectedPartnership, selectedBuyingStrategy, selectedStrategy, selectedBookingModeIndex, abs, request)
 	if err != nil {
 		return nil, err
 	}
-	priced := p.(*PricedResource)
+	priced := p.(*PricedResource[*ComputeResourcePricingProfile])
 	return &PricedComputeResource{
 		PricedResource: *priced,
 	}, nil
 }
 
-type ComputeNode struct {
-	Name     string           `json:"name,omitempty" bson:"name,omitempty"`
-	Quantity int64            `json:"quantity" bson:"quantity" default:"1"`
-	RAM      *models.RAM      `bson:"ram,omitempty" json:"ram,omitempty"`   // RAM is the RAM
-	CPUs     map[string]int64 `bson:"cpus,omitempty" json:"cpus,omitempty"` // CPUs is the list of CPUs key is model
-	GPUs     map[string]int64 `bson:"gpus,omitempty" json:"gpus,omitempty"` // GPUs is the list of GPUs key is model
-}
-
 type ComputeResourceInstance struct {
 	ResourceInstance[*ComputeResourcePartnership]
-	Source             string                 `json:"source,omitempty" bson:"source,omitempty"` // Source is the source of the resource
+	Source             string                 `json:"source,omitempty" bson:"source,omitempty"`
 	SecurityLevel      string                 `json:"security_level,omitempty" bson:"security_level,omitempty"`
 	PowerSources       []string               `json:"power_sources,omitempty" bson:"power_sources,omitempty"`
 	AnnualCO2Emissions float64                `json:"annual_co2_emissions,omitempty" bson:"co2_emissions,omitempty"`
-	CPUs               map[string]*models.CPU `bson:"cpus,omitempty" json:"cpus,omitempty"` // CPUs is the list of CPUs key is model
+	CPUs               map[string]*models.CPU `bson:"cpus,omitempty" json:"cpus,omitempty"`
-	GPUs               map[string]*models.GPU `bson:"gpus,omitempty" json:"gpus,omitempty"` // GPUs is the list of GPUs key is model
+	GPUs               map[string]*models.GPU `bson:"gpus,omitempty" json:"gpus,omitempty"`
-	Nodes              []*ComputeNode         `json:"nodes,omitempty" bson:"nodes,omitempty"`
+	Nodes              []*live.ComputeNode    `json:"nodes,omitempty" bson:"nodes,omitempty"`
+	// AvailableStorages lists storage capabilities activatable on this compute unit (e.g. Minio, local volumes).
+	// These are shallow StorageResource entries — not independent catalog items — but carry full pricing structure.
+	AvailableStorages []*StorageResource `json:"available_storages,omitempty" bson:"available_storages,omitempty"`
 }
 
+// IsPeerless is always false for compute instances: a compute resource is
+// infrastructure owned by a peer and can never be declared peerless.
+func (ri *ComputeResourceInstance) IsPeerless() bool { return false }
+
 func NewComputeResourceInstance(name string, peerID string) ResourceInstanceITF {
 	return &ComputeResourceInstance{
 		ResourceInstance: ResourceInstance[*ComputeResourcePartnership]{
@@ -95,7 +96,8 @@ type ComputeResourcePricingProfile struct {
 }
 
 func (p *ComputeResourcePricingProfile) IsPurchasable() bool {
-	return p.Pricing.BuyingStrategy != pricing.UNDEFINED_SUBSCRIPTION
+	fmt.Println("Buying", p.Pricing.BuyingStrategy)
+	return p.Pricing.BuyingStrategy == pricing.PERMANENT
 }
 
 func (p *ComputeResourcePricingProfile) GetPurchase() pricing.BuyingStrategy {
@@ -120,7 +122,10 @@ func (p *ComputeResourcePricingProfile) GetPriceHT(amountOfData float64, explici
 		return 0, errors.New("params must be set")
 	}
 	pp := float64(0)
-	model := params[1]
+	model := ""
+	if len(params) > 1 {
+		model = params[1]
+	}
 	if strings.Contains(params[0], "cpus") && len(params) > 1 {
 		if _, ok := p.CPUsPrices[model]; ok {
 			p.Pricing.Price = p.CPUsPrices[model]
@@ -156,18 +161,35 @@ func (p *ComputeResourcePricingProfile) GetPriceHT(amountOfData float64, explici
 }
 
 type PricedComputeResource struct {
-	PricedResource
+	PricedResource[*ComputeResourcePricingProfile]
 
 	CPUsLocated map[string]float64 `json:"cpus_in_use" bson:"cpus_in_use"` // CPUsInUse is the list of CPUs in use
 	GPUsLocated map[string]float64 `json:"gpus_in_use" bson:"gpus_in_use"` // GPUsInUse is the list of GPUs in use
 	RAMLocated  float64            `json:"ram_in_use" bson:"ram_in_use"`   // RAMInUse is the RAM in use
 }
 
+func (r *PricedComputeResource) ensurePricing() {
+	if r.SelectedPricing == nil {
+		r.SelectedPricing = &ComputeResourcePricingProfile{}
+	}
+}
+
+func (r *PricedComputeResource) IsPurchasable() bool {
+	r.ensurePricing()
+	return r.SelectedPricing.IsPurchasable()
+}
+
+func (r *PricedComputeResource) IsBooked() bool {
+	r.ensurePricing()
+	return r.SelectedPricing.IsBooked()
+}
+
 func (r *PricedComputeResource) GetType() tools.DataType {
 	return tools.COMPUTE_RESOURCE
 }
 
 func (r *PricedComputeResource) GetPriceHT() (float64, error) {
+	r.ensurePricing()
 	if r.BookingConfiguration == nil {
 		r.BookingConfiguration = &BookingConfiguration{}
 	}
@@ -176,12 +198,9 @@ func (r *PricedComputeResource) GetPriceHT() (float64, error) {
 		r.BookingConfiguration.UsageStart = &now
 	}
 	if r.BookingConfiguration.UsageEnd == nil {
-		add := r.BookingConfiguration.UsageStart.Add(time.Duration(1 * time.Hour))
+		add := r.BookingConfiguration.UsageStart.Add(time.Duration(5 * time.Minute))
 		r.BookingConfiguration.UsageEnd = &add
 	}
-	if r.SelectedPricing == nil {
-		return 0, errors.New("pricing profile must be set on Priced Compute" + r.ResourceID)
-	}
 	pricing := r.SelectedPricing
 	price := float64(0)
 	for _, l := range []map[string]float64{r.CPUsLocated, r.GPUsLocated} {

models/resources/data.go

@@ -30,22 +30,31 @@ type DataResource struct {
 }
 
 func (d *DataResource) GetAccessor(request *tools.APIRequest) utils.Accessor {
-	return NewAccessor[*DataResource](tools.DATA_RESOURCE, request, func() utils.DBObject { return &DataResource{} }) // Create a new instance of the accessor
+	return NewAccessor[*DataResource](tools.DATA_RESOURCE, request) // Create a new instance of the accessor
 }
 
 func (r *DataResource) GetType() string {
 	return tools.DATA_RESOURCE.String()
 }
 
+func (ri *DataResource) StoreDraftDefault() {
+	ri.AbstractObject.StoreDraftDefault()
+	ri.Env = append(ri.Env, models.Param{
+		Attr:     "source",
+		Value:    "[resource]instance.source",
+		Readonly: true,
+	})
+}
+
 func (abs *DataResource) ConvertToPricedResource(t tools.DataType, selectedInstance *int, selectedPartnership *int, selectedBuyingStrategy *int, selectedStrategy *int, selectedBookingModeIndex *int, request *tools.APIRequest) (pricing.PricedItemITF, error) {
 	if t != tools.DATA_RESOURCE {
 		return nil, errors.New("not the proper type expected : cannot convert to priced resource : have " + t.String() + " wait Data")
 	}
-	p, err := abs.AbstractInstanciatedResource.ConvertToPricedResource(t, selectedInstance, selectedPartnership, selectedBuyingStrategy, selectedStrategy, selectedBookingModeIndex, request)
+	p, err := ConvertToPricedResource[*DataResourcePricingProfile](t, selectedInstance, selectedPartnership, selectedBuyingStrategy, selectedStrategy, selectedBookingModeIndex, abs, request)
 	if err != nil {
 		return nil, err
 	}
-	priced := p.(*PricedResource)
+	priced := p.(*PricedResource[*DataResourcePricingProfile])
 	return &PricedDataResource{
 		PricedResource: *priced,
 	}, nil
@@ -67,24 +76,6 @@ func NewDataInstance(name string, peerID string) ResourceInstanceITF {
 	}
 }
 
-func (ri *DataInstance) StoreDraftDefault() {
-	found := false
-	for _, p := range ri.ResourceInstance.Env {
-		if p.Attr == "source" {
-			found = true
-			break
-		}
-	}
-	if !found {
-		ri.ResourceInstance.Env = append(ri.ResourceInstance.Env, models.Param{
-			Attr:     "source",
-			Value:    ri.Source,
-			Readonly: true,
-		})
-	}
-	ri.ResourceInstance.StoreDraftDefault()
-}
-
 type DataResourcePartnership struct {
 	ResourcePartnerShip[*DataResourcePricingProfile]
 	MaxDownloadableGbAllowed      float64 `json:"allowed_gb,omitempty" bson:"allowed_gb,omitempty"`
@@ -95,7 +86,7 @@ type DataResourcePartnership struct {
 type DataResourcePricingStrategy int
 
 const (
-	PER_DOWNLOAD DataResourcePricingStrategy = iota + 6
+	PER_DOWNLOAD DataResourcePricingStrategy = iota + 7
 	PER_TB_DOWNLOADED
 	PER_GB_DOWNLOADED
 	PER_MB_DOWNLOADED
@@ -151,7 +142,7 @@ func (p *DataResourcePricingProfile) GetOverrideStrategyValue() int {
 }
 
 func (p *DataResourcePricingProfile) IsPurchasable() bool {
-	return p.Pricing.BuyingStrategy != pricing.UNDEFINED_SUBSCRIPTION
+	return p.Pricing.BuyingStrategy == pricing.PERMANENT
 }
 
 func (p *DataResourcePricingProfile) IsBooked() bool {
@@ -160,15 +151,32 @@ func (p *DataResourcePricingProfile) IsBooked() bool {
 }
 
 type PricedDataResource struct {
-	PricedResource
+	PricedResource[*DataResourcePricingProfile]
 	UsageStorageGB float64 `json:"storage_gb,omitempty" bson:"storage_gb,omitempty"`
 }
 
+func (r *PricedDataResource) ensurePricing() {
+	if r.SelectedPricing == nil {
+		r.SelectedPricing = &DataResourcePricingProfile{}
+	}
+}
+
+func (r *PricedDataResource) IsPurchasable() bool {
+	r.ensurePricing()
+	return r.SelectedPricing.IsPurchasable()
+}
+
+func (r *PricedDataResource) IsBooked() bool {
+	r.ensurePricing()
+	return r.SelectedPricing.IsBooked()
+}
+
 func (r *PricedDataResource) GetType() tools.DataType {
 	return tools.DATA_RESOURCE
 }
 
 func (r *PricedDataResource) GetPriceHT() (float64, error) {
+	r.ensurePricing()
 	if r.BookingConfiguration == nil {
 		r.BookingConfiguration = &BookingConfiguration{}
 	}
@@ -177,12 +185,9 @@ func (r *PricedDataResource) GetPriceHT() (float64, error) {
 		r.BookingConfiguration.UsageStart = &now
 	}
 	if r.BookingConfiguration.UsageEnd == nil {
-		add := r.BookingConfiguration.UsageStart.Add(time.Duration(1 * time.Hour))
+		add := r.BookingConfiguration.UsageStart.Add(time.Duration(5 * time.Minute))
 		r.BookingConfiguration.UsageEnd = &add
 	}
-	if r.SelectedPricing == nil {
-		return 0, errors.New("pricing profile must be set on Priced Data" + r.ResourceID)
-	}
 	pricing := r.SelectedPricing
 	var err error
 	amountOfData := float64(1)

models/resources/dynamic.go

@@ -0,0 +1,298 @@
+package resources
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"reflect"
+	"slices"
+	"strings"
+
+	"cloud.o-forge.io/core/oc-lib/dbs"
+	"cloud.o-forge.io/core/oc-lib/models/common/pricing"
+	"cloud.o-forge.io/core/oc-lib/models/utils"
+	"cloud.o-forge.io/core/oc-lib/tools"
+)
+
+/*
+* DynamicResource is a struct that represents a data resource
+* it defines the resource data
+ */
+type DynamicResource struct {
+	AbstractResource
+	Type      tools.DataType         `bson:"type,omitempty" json:"type,omitempty"`
+	Filters   map[string]interface{} `bson:"filters,omitempty" json:"filters,omitempty"`
+	SortRules map[string]string      `bson:"rules,omitempty" json:"rules,omitempty"`
+
+	PeerIds     map[int]string `bson:"peer_ids,omitempty" json:"peer_ids,omitempty"`
+	ResourceIds map[int]string `bson:"resource_ids,omitempty" json:"resource_ids,omitempty"`
+
+	SelectedIndex            int  `bson:"selected_index,omitempty" json:"selected_index,omitempty"`
+	SelectedPartnershipIndex *int `bson:"selected_partnership_index,omitempty" json:"selected_partnership_index,omitempty"`
+
+	SelectedBuyingStrategy  int `bson:"selected_buying_strategy" json:"selected_buying_strategy,omitempty"`
+	SelectedPricingStrategy int `bson:"selected_pricing_strategy" json:"selected_pricing_strategy,omitempty"`
+
+	Instances              []ResourceInstanceITF `bson:"instances,omitempty" json:"instances,omitempty"`
+	WatchedDynamicResource []string              `bson:"watched_dynamic_resource,omitempty" json:"watched_dynamic_resource,omitempty"`
+}
+
+func (d *DynamicResource) GetAccessor(request *tools.APIRequest) utils.Accessor {
+	return nil
+}
+
+func (d *DynamicResource) SetAllowedInstances(request *tools.APIRequest, instance_id ...string) []ResourceInstanceITF {
+	d.Instances = []ResourceInstanceITF{}
+	for k, v := range map[tools.DataType]ResourceInterface{
+		tools.COMPUTE_RESOURCE:    &ComputeResource{},
+		tools.DATA_RESOURCE:       &DataResource{},
+		tools.STORAGE_RESOURCE:    &StorageResource{},
+		tools.PROCESSING_RESOURCE: &ProcessingResource{},
+		tools.WORKFLOW_RESOURCE:   &WorkflowResource{}} {
+		if d.Type != k {
+			continue
+		}
+		access := NewAccessor[*DynamicResource](k, request)
+		a, _, _ := access.Search(dbs.FiltersFromFlatMap(d.Filters, v), "", false, 0, 100000)
+		d.PeerIds = map[int]string{}
+		d.ResourceIds = map[int]string{}
+		for _, res := range a {
+			for _, i := range res.(ResourceInterface).SetAllowedInstances(request, instance_id...) {
+				d.PeerIds[len(d.Instances)] = res.GetCreatorID()
+				d.ResourceIds[len(d.Instances)] = res.GetID()
+				d.Instances = append(d.Instances, i)
+			}
+		}
+		break
+	}
+	sorted := make([]ResourceInstanceITF, len(d.Instances))
+	copy(sorted, d.Instances)
+	slices.SortStableFunc(sorted, func(a, b ResourceInstanceITF) int {
+		d.SortRules["partnerships"] = "%v not contains 2"
+		return d.compareByRules(a, b, d.SortRules)
+	})
+	d.WatchedDynamicResource = []string{}
+	return d.Instances
+}
+
+func (d *DynamicResource) AddInstances(instance ResourceInstanceITF) {
+	d.Instances = append(d.Instances, instance)
+}
+
+func (d *DynamicResource) GetSelectedInstance(index *int) ResourceInstanceITF {
+	if len(d.Instances) == 0 {
+		return nil
+	}
+	for i, inst := range d.Instances {
+		if slices.Contains(d.WatchedDynamicResource, inst.GetID()) {
+			continue
+		}
+		d.WatchedDynamicResource = append(d.WatchedDynamicResource, inst.GetID())
+		d.SelectedIndex = i
+
+		for i := range inst.GetPartnerships() {
+			if inst.GetProfile(d.PeerIds[i], &i, &d.SelectedBuyingStrategy, &d.SelectedPricingStrategy) != nil {
+				d.SelectedPartnershipIndex = &i
+				break
+			}
+		}
+		if d.SelectedPartnershipIndex == nil {
+			continue
+		}
+		return inst
+	}
+	return nil
+}
+
+// compareByRules orders instances so those satisfying more sort rules come first.
+// When both satisfy a rule, the one with the lower first-attribute value wins (ASC strict).
+// Key format: "attrA" for single-%s rules, "attrA,attrB" for two-%s rules.
+func (ri *DynamicResource) compareByRules(a, b ResourceInstanceITF, rules map[string]string) int {
+	ma := a.Serialize(a)
+	mb := b.Serialize(b)
+	for attrs, rule := range rules {
+		attrPaths := strings.Split(attrs, ",")
+
+		aOk, aFirst := ri.ruleMatchesAny(rule, attrPaths, ma)
+		bOk, bFirst := ri.ruleMatchesAny(rule, attrPaths, mb)
+
+		if aOk && !bOk {
+			return -1
+		}
+		if !aOk && bOk {
+			return 1
+		}
+		if aOk && bOk {
+			if aFirst < bFirst {
+				return -1
+			}
+			if aFirst > bFirst {
+				return 1
+			}
+		}
+	}
+
+	return 0
+}
+
+// ruleMatchesAny checks if any value (or combination for 2-%s rules) satisfies rule.
+// Arrays at any path level are iterated. Returns (matched, firstMatchingValue).
+func (ri *DynamicResource) ruleMatchesAny(rule string, attrPaths []string, m map[string]interface{}) (bool, string) {
+	placeholders := strings.Count(rule, "%s")
+	if placeholders == 0 {
+		return false, ""
+	}
+	valsA := ri.getVals(strings.Split(strings.TrimSpace(attrPaths[0]), "."), m)
+	if placeholders == 1 {
+		for _, v := range valsA {
+			if ri.byRules(rule, v) {
+				return true, fmt.Sprintf("%v", v)
+			}
+		}
+		return false, ""
+	}
+	if len(attrPaths) < 2 {
+		return false, ""
+	}
+	valsB := ri.getVals(strings.Split(strings.TrimSpace(attrPaths[1]), "."), m)
+	for _, a := range valsA {
+		for _, b := range valsB {
+			if ri.byRules(rule, a, b) {
+				return true, fmt.Sprintf("%v", a)
+			}
+		}
+	}
+	return false, ""
+}
+
+// getVals navigates attrs into m, collecting all leaf values.
+// At each level it detects whether the value is a dict (map) or an array and acts accordingly:
+// - array of maps  → recurse into each element with the remaining path
+// - array of scalars (leaf) → collect all as strings
+// - map             → recurse with the remaining path
+func (ri *DynamicResource) getVals(attrs []string, m map[string]interface{}) []interface{} {
+	if len(attrs) == 0 {
+		return nil
+	}
+	attr := attrs[0]
+	if attr == "" || m[attr] == nil {
+		return nil
+	}
+	b, err := json.Marshal(m[attr])
+	if err != nil {
+		return nil
+	}
+	// Leaf level: detect array vs scalar.
+	if len(attrs) == 1 {
+		var arr []interface{}
+		if err := json.Unmarshal(b, &arr); err == nil {
+			results := []interface{}{}
+			for _, v := range arr {
+				results = append(results, fmt.Sprintf("%v", v))
+			}
+			return results
+		}
+		return []interface{}{m[attr]}
+	}
+	// Intermediate level: detect array of maps vs single map.
+	var arrMaps []map[string]interface{}
+	if err := json.Unmarshal(b, &arrMaps); err == nil {
+		results := []interface{}{}
+		for _, item := range arrMaps {
+			results = append(results, ri.getVals(attrs[1:], item)...)
+		}
+		return results
+	}
+	nm := map[string]interface{}{}
+	if err := json.Unmarshal(b, &nm); err != nil {
+		return nil
+	}
+	return ri.getVals(attrs[1:], nm)
+}
+
+func (ri *DynamicResource) byRules(rule string, vals ...interface{}) bool {
+	if len(vals) == 0 {
+		return false
+	}
+	formatted := fmt.Sprintf(rule, vals...)
+	// hm hm
+	switch {
+	case strings.Contains(rule, "not contains"):
+		a := strings.Split(formatted, " not contains ")
+		if reflect.TypeOf(vals[0]).Kind() == reflect.Map {
+			return vals[0].(map[string]interface{})[fmt.Sprintf("%v", a[1])] != nil
+		}
+		return strings.Contains(a[0], a[1])
+	case strings.Contains(rule, "contains"):
+		a := strings.Split(formatted, " contains ")
+		if reflect.TypeOf(vals[0]).Kind() == reflect.Map {
+			return vals[0].(map[string]interface{})[fmt.Sprintf("%v", a[1])] != nil
+		}
+		return strings.Contains(a[0], a[1])
+	case strings.Contains(rule, "<="):
+		a := strings.Split(formatted, " <= ")
+		return len(a) > 1 && a[0] <= a[1]
+	case strings.Contains(rule, ">="):
+		a := strings.Split(formatted, " >= ")
+		return len(a) > 1 && a[0] >= a[1]
+	case strings.Contains(rule, "<>"), strings.Contains(rule, "not like"):
+		if strings.Contains(rule, "<>") {
+			a := strings.Split(formatted, " <> ")
+			return len(a) > 1 && !strings.Contains(a[0], a[1]) && !strings.Contains(a[1], a[0])
+		}
+		a := strings.Split(formatted, " not like ")
+		return len(a) > 1 && !strings.Contains(a[0], a[1]) && !strings.Contains(a[1], a[0])
+	case strings.Contains(rule, "<"):
+		a := strings.Split(formatted, " < ")
+		return len(a) > 1 && a[0] < a[1]
+	case strings.Contains(rule, ">"):
+		a := strings.Split(formatted, " > ")
+		return len(a) > 1 && a[0] > a[1]
+	case strings.Contains(rule, "=="):
+		a := strings.Split(formatted, " == ")
+		return len(a) > 1 && a[0] == a[1]
+	case strings.Contains(rule, "!="):
+		a := strings.Split(formatted, " != ")
+		return len(a) > 1 && a[0] != a[1]
+	case strings.Contains(rule, "like"):
+		a := strings.Split(formatted, " like ")
+		return len(a) > 1 && (strings.Contains(a[0], a[1]) || strings.Contains(a[1], a[0]))
+	}
+	return false
+}
+
+func (r *DynamicResource) GetType() string {
+	return tools.DYNAMIC_RESOURCE.String()
+}
+
+func (abs *DynamicResource) ConvertToPricedResource(t tools.DataType, selectedInstance *int, selectedPartnership *int, selectedBuyingStrategy *int, selectedStrategy *int, selectedBookingModeIndex *int, request *tools.APIRequest) (pricing.PricedItemITF, error) {
+	var p pricing.PricedItemITF
+	var err error
+	for _, v := range []tools.DataType{
+		tools.COMPUTE_RESOURCE,
+		tools.DATA_RESOURCE,
+		tools.STORAGE_RESOURCE,
+		tools.PROCESSING_RESOURCE,
+		tools.WORKFLOW_RESOURCE,
+	} {
+		switch v {
+		case tools.COMPUTE_RESOURCE:
+			if p, err = ConvertToPricedResource[*ComputeResourcePricingProfile](t, selectedInstance, selectedPartnership, selectedBuyingStrategy, selectedStrategy, selectedBookingModeIndex, abs, request); err == nil {
+				return p.(*PricedResource[*ProcessingResourcePricingProfile]), nil
+			}
+		case tools.DATA_RESOURCE:
+			if p, err = ConvertToPricedResource[*DataResourcePricingProfile](t, selectedInstance, selectedPartnership, selectedBuyingStrategy, selectedStrategy, selectedBookingModeIndex, abs, request); err == nil {
+				return p.(*PricedResource[*DataResourcePricingProfile]), nil
+			}
+		case tools.STORAGE_RESOURCE:
+			if p, err = ConvertToPricedResource[*StorageResourcePricingProfile](t, selectedInstance, selectedPartnership, selectedBuyingStrategy, selectedStrategy, selectedBookingModeIndex, abs, request); err == nil {
+				return p.(*PricedResource[*StorageResourcePricingProfile]), nil
+			}
+		case tools.PROCESSING_RESOURCE:
+			if p, err = ConvertToPricedResource[*ProcessingResourcePricingProfile](t, selectedInstance, selectedPartnership, selectedBuyingStrategy, selectedStrategy, selectedBookingModeIndex, abs, request); err == nil {
+				return p.(*PricedResource[*ProcessingResourcePricingProfile]), nil
+			}
+		}
+	}
+	return nil, errors.New("can't convert priced resource")
+}

models/resources/interfaces.go

@@ -3,11 +3,16 @@ package resources
 import (
 	"cloud.o-forge.io/core/oc-lib/dbs"
 	"cloud.o-forge.io/core/oc-lib/models/booking"
+	"cloud.o-forge.io/core/oc-lib/models/common/models"
 	"cloud.o-forge.io/core/oc-lib/models/common/pricing"
 	"cloud.o-forge.io/core/oc-lib/models/utils"
 	"cloud.o-forge.io/core/oc-lib/tools"
 )
 
+type PricedResourceITF interface {
+	pricing.PricedItemITF
+}
+
 type ResourceInterface interface {
 	utils.DBObject
 	FilterPeer(peerID string) *dbs.Filters
@@ -15,22 +20,31 @@ type ResourceInterface interface {
 	ConvertToPricedResource(t tools.DataType, a *int, selectedPartnership *int, selectedBuyingStrategy *int, selectedStrategy *int, b *int, request *tools.APIRequest) (pricing.PricedItemITF, error)
 	GetType() string
 	ClearEnv() utils.DBObject
-	SetAllowedInstances(request *tools.APIRequest, instance_id ...string)
+	VerifyBuy()
+	SetAllowedInstances(request *tools.APIRequest, instance_id ...string) []ResourceInstanceITF
 	AddInstances(instance ResourceInstanceITF)
 	GetSelectedInstance(index *int) ResourceInstanceITF
+	StoreDraftDefault()
+
+	GetEnv() []models.Param
+	GetInputs() []models.Param
+	GetOutputs() []models.Param
 }
 
 type ResourceInstanceITF interface {
 	utils.DBObject
 	GetID() string
 	GetName() string
-	StoreDraftDefault()
+	GetOrigin() OriginMeta
-	ClearEnv()
+	IsPeerless() bool
 	FilterInstance(peerID string)
 	GetProfile(peerID string, partnershipIndex *int, buying *int, strategy *int) pricing.PricingProfileITF
 	GetPricingsProfiles(peerID string, groups []string) []pricing.PricingProfileITF
 	GetPeerGroups() ([]ResourcePartnerITF, []map[string][]string)
 	ClearPeerGroups()
+	GetPartnerships() []ResourcePartnerITF
+	GetAverageDurationS() float64
+	UpdateAverageDuration(actualS float64)
 }
 
 type ResourcePartnerITF interface {

models/resources/models.go

@@ -12,13 +12,18 @@ type ResourceSet struct {
 	Computes    []string `bson:"computes,omitempty" json:"computes,omitempty"`
 	Workflows   []string `bson:"workflows,omitempty" json:"workflows,omitempty"`
 	NativeTool  []string `bson:"native,omitempty" json:"native,omitempty"`
+	Services    []string `bson:"services,omitempty" json:"services,omitempty"`
+	Dynamics    []string `bson:"dynamics,omitempty" json:"dynamics,omitempty"`
 
+	// DynamicResources are stored inline — no DB collection, resolved at runtime via SetAllowedInstances.
+	DynamicResources    []*DynamicResource    `bson:"-" json:"dynamic_resources,omitempty"`
 	DataResources       []*DataResource       `bson:"-" json:"data_resources,omitempty"`
 	StorageResources    []*StorageResource    `bson:"-" json:"storage_resources,omitempty"`
 	ProcessingResources []*ProcessingResource `bson:"-" json:"processing_resources,omitempty"`
 	ComputeResources    []*ComputeResource    `bson:"-" json:"compute_resources,omitempty"`
 	WorkflowResources   []*WorkflowResource   `bson:"-" json:"workflow_resources,omitempty"`
 	NativeTools         []*NativeTool         `bson:"-" json:"native_tools,omitempty"`
+	ServiceResources    []*ServiceResource    `bson:"-" json:"service_resources,omitempty"`
 }
 
 func (r *ResourceSet) Clear() {
@@ -27,6 +32,8 @@ func (r *ResourceSet) Clear() {
 	r.ProcessingResources = nil
 	r.ComputeResources = nil
 	r.WorkflowResources = nil
+	r.ServiceResources = nil
+	r.DynamicResources = nil
 }
 
 func (r *ResourceSet) Fill(request *tools.APIRequest) {
@@ -37,6 +44,8 @@ func (r *ResourceSet) Fill(request *tools.APIRequest) {
 		(&StorageResource{}):    r.Storages,
 		(&ProcessingResource{}): r.Processings,
 		(&WorkflowResource{}):   r.Workflows,
+		(&ServiceResource{}):    r.Services,
+		(&DynamicResource{}):    r.Dynamics,
 	} {
 		for _, id := range v {
 			d, _, e := k.GetAccessor(request).LoadOne(id)
@@ -52,10 +61,17 @@ func (r *ResourceSet) Fill(request *tools.APIRequest) {
 					r.ProcessingResources = append(r.ProcessingResources, d.(*ProcessingResource))
 				case *WorkflowResource:
 					r.WorkflowResources = append(r.WorkflowResources, d.(*WorkflowResource))
+				case *ServiceResource:
+					r.ServiceResources = append(r.ServiceResources, d.(*ServiceResource))
+				case *DynamicResource:
+					r.DynamicResources = append(r.DynamicResources, d.(*DynamicResource))
 				}
 			}
 		}
 	}
+	for _, d := range r.DynamicResources {
+		d.SetAllowedInstances(request)
+	}
 }
 
 type ItemResource struct {
@@ -65,4 +81,6 @@ type ItemResource struct {
 	Compute    *ComputeResource    `bson:"compute,omitempty" json:"compute,omitempty"`
 	Workflow   *WorkflowResource   `bson:"workflow,omitempty" json:"workflow,omitempty"`
 	NativeTool *NativeTool         `bson:"native_tools,omitempty" json:"native_tools,omitempty"`
+	Service    *ServiceResource    `bson:"service,omitempty" json:"service,omitempty"`
+	Dynamic    *DynamicResource    `bson:"dynamic,omitempty" json:"dynamic,omitempty"`
 }

models/resources/native_tools.go

@@ -23,7 +23,7 @@ func (d *NativeTool) SetName(name string) {
 }
 
 func (d *NativeTool) GetAccessor(request *tools.APIRequest) utils.Accessor {
-	return NewAccessor[*NativeTool](tools.NATIVE_TOOL, request, func() utils.DBObject { return &NativeTool{} })
+	return NewAccessor[*NativeTool](tools.NATIVE_TOOL, request)
 }
 
 func (r *NativeTool) AddInstances(instance ResourceInstanceITF) {
@@ -37,12 +37,13 @@ func (d *NativeTool) ClearEnv() utils.DBObject {
 	return d
 }
 
-func (w *NativeTool) SetAllowedInstances(request *tools.APIRequest, ids ...string) {
+func (w *NativeTool) SetAllowedInstances(request *tools.APIRequest, ids ...string) []ResourceInstanceITF {
 	/* EMPTY */
+	return []ResourceInstanceITF{}
 }
 
 func (w *NativeTool) ConvertToPricedResource(t tools.DataType, selectedInstance *int, selectedPartnership *int, selectedBuyingStrategy *int, selectedStrategy *int, selectedBookingModeIndex *int, request *tools.APIRequest) (pricing.PricedItemITF, error) {
-	return &PricedResource{
+	return &PricedResource[*pricing.ExploitPricingProfile[pricing.TimePricingStrategy]]{
 		Name:         w.Name,
 		Logo:         w.Logo,
 		ResourceID:   w.UUID,
@@ -60,7 +61,7 @@ func InitNative() {
 	for _, kind := range []native_tools.NativeToolsEnum{native_tools.WORKFLOW_EVENT} {
 		newNative := &NativeTool{}
 		access := newNative.GetAccessor(&tools.APIRequest{Admin: true})
-		l, _, err := access.Search(nil, kind.String(), false)
+		l, _, err := access.Search(nil, kind.String(), false, 0, 10)
 		if err != nil || len(l) == 0 {
 			newNative.Name = kind.String()
 			newNative.Kind = int(kind)

models/resources/origin.go

@@ -0,0 +1,31 @@
+package resources
+
+// OriginType qualifies where a resource instance comes from.
+type OriginType int
+
+const (
+	// OriginPeer: instance offered by a known network peer (default).
+	OriginPeer OriginType = iota
+	// OriginPublic: instance from a public registry (Docker Hub, HuggingFace, etc.).
+	// No peer confirmation is needed; access is unrestricted.
+	OriginPublic
+	// OriginSelf: self-hosted instance with no third-party peer.
+	OriginSelf
+)
+
+// OriginMeta carries provenance information for a resource instance.
+type OriginMeta struct {
+	Type     OriginType `json:"origin_type" bson:"origin_type"`
+	Ref      string     `json:"origin_ref,omitempty" bson:"origin_ref,omitempty"`         // e.g. "docker.io/pytorch/pytorch:2.1"
+	License  string     `json:"origin_license,omitempty" bson:"origin_license,omitempty"` // SPDX identifier or free-form
+	Verified bool       `json:"origin_verified" bson:"origin_verified"`                   // manually vetted by an OC admin
+}
+
+// IsPeerless MUST NOT be used for authorization decisions.
+// Use ResourceInstance.IsPeerless() instead, which derives the property
+// from structural invariants rather than this self-declared field.
+//
+// This method is kept only for display/logging purposes.
+func (o OriginMeta) DeclaredPeerless() bool {
+	return o.Type != OriginPeer
+}

models/resources/priced_resource.go

@@ -16,11 +16,11 @@ type BookingConfiguration struct {
 	Mode                     booking.BookingMode `json:"mode,omitempty" bson:"mode,omitempty"`
 }
 
-type PricedResource struct {
+type PricedResource[T pricing.PricingProfileITF] struct {
 	Name                 string                      `json:"name,omitempty" bson:"name,omitempty"`
 	Logo                 string                      `json:"logo,omitempty" bson:"logo,omitempty"`
 	InstancesRefs        map[string]string           `json:"instances_refs,omitempty" bson:"instances_refs,omitempty"`
-	SelectedPricing      pricing.PricingProfileITF   `json:"selected_pricing,omitempty" bson:"selected_pricing,omitempty"`
+	SelectedPricing      T                           `json:"selected_pricing,omitempty" bson:"selected_pricing,omitempty"`
 	Quantity             int                         `json:"quantity,omitempty" bson:"quantity,omitempty"`
 	BookingConfiguration *BookingConfiguration       `json:"booking_configuration,omitempty" bson:"booking_configuration,omitempty"`
 	Variations           []*pricing.PricingVariation `json:"pricing_variations" bson:"pricing_variations"`
@@ -31,101 +31,111 @@ type PricedResource struct {
 	ResourceType tools.DataType `json:"resource_type,omitempty" bson:"resource_type,omitempty"`
 }
 
-func (abs *PricedResource) GetQuantity() int {
+func (abs *PricedResource[T]) GetQuantity() int {
 	return abs.Quantity
 }
 
-func (abs *PricedResource) AddQuantity(amount int) {
+func (abs *PricedResource[T]) AddQuantity(amount int) {
 	abs.Quantity += amount
 }
 
-func (abs *PricedResource) SelectPricing() pricing.PricingProfileITF {
+func (abs *PricedResource[T]) SelectPricing() pricing.PricingProfileITF {
 	return abs.SelectedPricing
 }
 
-func (abs *PricedResource) GetID() string {
+func (abs *PricedResource[T]) GetID() string {
 	return abs.ResourceID
 }
 
-func (abs *PricedResource) GetInstanceID() string {
+func (abs *PricedResource[T]) GetName() string {
+	return abs.Name
+}
+
+func (abs *PricedResource[T]) GetInstanceID() string {
 	return abs.InstanceID
 }
 
-func (abs *PricedResource) GetType() tools.DataType {
+func (abs *PricedResource[T]) GetType() tools.DataType {
 	return abs.ResourceType
 }
 
-func (abs *PricedResource) GetCreatorID() string {
+func (abs *PricedResource[T]) GetCreatorID() string {
 	return abs.CreatorID
 }
 
-func (abs *PricedResource) IsPurchasable() bool {
+// IsPurchasable and IsBooked fall back to false when SelectedPricing is a nil interface.
-	if abs.SelectedPricing == nil {
+// Concrete types (PricedComputeResource, etc.) override these and guarantee non-nil pricing.
+func (abs *PricedResource[T]) IsPurchasable() bool {
+	if any(abs.SelectedPricing) == nil {
 		return false
 	}
-	return (abs.SelectedPricing).IsPurchasable()
+	return abs.SelectedPricing.IsPurchasable()
 }
 
-func (abs *PricedResource) IsBooked() bool {
+func (abs *PricedResource[T]) IsBooked() bool {
-	if abs.SelectedPricing == nil {
+	if any(abs.SelectedPricing) == nil {
 		return false
 	}
-	return (abs.SelectedPricing).IsBooked()
+	return abs.SelectedPricing.IsBooked()
 }
 
-func (abs *PricedResource) GetLocationEnd() *time.Time {
+func (abs *PricedResource[T]) GetLocationEnd() *time.Time {
 	if abs.BookingConfiguration == nil {
 		return nil
 	}
 	return abs.BookingConfiguration.UsageEnd
 }
 
-func (abs *PricedResource) GetLocationStart() *time.Time {
+func (abs *PricedResource[T]) GetLocationStart() *time.Time {
 	if abs.BookingConfiguration == nil {
 		return nil
 	}
 	return abs.BookingConfiguration.UsageStart
 }
 
-func (abs *PricedResource) SetLocationStart(start time.Time) {
+func (abs *PricedResource[T]) SetLocationStart(start time.Time) {
 	if abs.BookingConfiguration == nil {
 		abs.BookingConfiguration = &BookingConfiguration{}
 	}
 	abs.BookingConfiguration.UsageStart = &start
 }
 
-func (abs *PricedResource) SetLocationEnd(end time.Time) {
+func (abs *PricedResource[T]) SetLocationEnd(end time.Time) {
 	if abs.BookingConfiguration == nil {
 		abs.BookingConfiguration = &BookingConfiguration{}
 	}
 	abs.BookingConfiguration.UsageEnd = &end
 }
 
-func (abs *PricedResource) GetBookingMode() booking.BookingMode {
+func (abs *PricedResource[T]) GetBookingMode() booking.BookingMode {
 	if abs.BookingConfiguration == nil {
 		return booking.WHEN_POSSIBLE
 	}
 	return abs.BookingConfiguration.Mode
 }
 
-func (abs *PricedResource) GetExplicitDurationInS() float64 {
+func (abs *PricedResource[T]) GetExplicitDurationInS() float64 {
 	if abs.BookingConfiguration == nil {
 		abs.BookingConfiguration = &BookingConfiguration{}
 	}
 	if abs.BookingConfiguration.ExplicitBookingDurationS == 0 {
 		if abs.BookingConfiguration.UsageEnd == nil && abs.BookingConfiguration.UsageStart == nil {
-			return time.Duration(1 * time.Hour).Seconds()
+			return (5 * time.Minute).Seconds()
 		}
 		if abs.BookingConfiguration.UsageEnd == nil {
-			add := abs.BookingConfiguration.UsageStart.Add(time.Duration(1 * time.Hour))
+			add := abs.BookingConfiguration.UsageStart.Add(5 * time.Minute)
 			abs.BookingConfiguration.UsageEnd = &add
 		}
-		return abs.BookingConfiguration.UsageEnd.Sub(*abs.BookingConfiguration.UsageStart).Seconds()
+		d := abs.BookingConfiguration.UsageEnd.Sub(*abs.BookingConfiguration.UsageStart).Seconds()
+		if d <= 0 {
+			return (5 * time.Minute).Seconds()
+		}
+		return d
 	}
 	return abs.BookingConfiguration.ExplicitBookingDurationS
 }
 
-func (r *PricedResource) GetPriceHT() (float64, error) {
+func (r *PricedResource[T]) GetPriceHT() (float64, error) {
 	now := time.Now()
 	if r.BookingConfiguration == nil {
 		r.BookingConfiguration = &BookingConfiguration{}
@@ -134,11 +144,11 @@ func (r *PricedResource) GetPriceHT() (float64, error) {
 		r.BookingConfiguration.UsageStart = &now
 	}
 	if r.BookingConfiguration.UsageEnd == nil {
-		add := r.BookingConfiguration.UsageStart.Add(time.Duration(1 * time.Hour))
+		add := r.BookingConfiguration.UsageStart.Add(time.Duration(5 * time.Minute))
 		r.BookingConfiguration.UsageEnd = &add
 	}
-	if r.SelectedPricing == nil {
+	if any(r.SelectedPricing) == nil {
-		return 0, errors.New("pricing profile must be set on Priced Resource " + r.ResourceID)
+		return 0, errors.New("pricing profile must be set for resource " + r.ResourceID)
 	}
 	pricing := r.SelectedPricing
 	return pricing.GetPriceHT(1, 0, *r.BookingConfiguration.UsageStart, *r.BookingConfiguration.UsageEnd, r.Variations)

models/resources/processing.go

@@ -1,6 +1,7 @@
 package resources
 
 import (
+	"errors"
 	"time"
 
 	"cloud.o-forge.io/core/oc-lib/models/common/enum"
@@ -27,10 +28,8 @@ type ProcessingUsage struct {
  */
 type ProcessingResource struct {
 	AbstractInstanciatedResource[*ProcessingInstance]
-	IsEvent        bool                    `json:"is_event,omitempty" bson:"is_event,omitempty"`
+	Infrastructure enum.InfrastructureType `json:"infrastructure" bson:"infrastructure" default:"-1"`
-	Infrastructure enum.InfrastructureType `json:"infrastructure" bson:"infrastructure" default:"-1"` // Infrastructure is the infrastructure
+	Usage          *ProcessingUsage        `bson:"usage,omitempty" json:"usage,omitempty"`
-	IsService      bool                    `json:"is_service,omitempty" bson:"is_service,omitempty"`  // IsService is a flag that indicates if the processing is a service
-	Usage          *ProcessingUsage        `bson:"usage,omitempty" json:"usage,omitempty"`            // Usage is the usage of the processing
 	OpenSource     bool                    `json:"open_source" bson:"open_source" default:"false"`
 	License        string                  `json:"license,omitempty" bson:"license,omitempty"`
 	Maturity       string                  `json:"maturity,omitempty" bson:"maturity,omitempty"`
@@ -47,6 +46,8 @@ type ProcessingResourceAccess struct {
 type ProcessingInstance struct {
 	ResourceInstance[*ResourcePartnerShip[*ProcessingResourcePricingProfile]]
 	Access      *ProcessingResourceAccess `json:"access,omitempty" bson:"access,omitempty"` // Access is the access
+	SizeGB      int                       `json:"size_gb,omitempty" bson:"size_gb,omitempty"`
+	ContentType string                    `json:"content_type,omitempty" bson:"content_type,omitempty"`
 }
 
 func NewProcessingInstance(name string, peerID string) ResourceInstanceITF {
@@ -65,8 +66,28 @@ type ProcessingResourcePartnership struct {
 }
 
 type PricedProcessingResource struct {
-	PricedResource
+	PricedResource[*ProcessingResourcePricingProfile]
-	IsService bool
+}
+
+func (r *PricedProcessingResource) ensurePricing() {
+	if r.SelectedPricing == nil {
+		r.SelectedPricing = &ProcessingResourcePricingProfile{}
+	}
+}
+
+func (r *PricedProcessingResource) IsPurchasable() bool {
+	r.ensurePricing()
+	return r.SelectedPricing.IsPurchasable()
+}
+
+func (r *PricedProcessingResource) IsBooked() bool {
+	r.ensurePricing()
+	return r.SelectedPricing.IsBooked()
+}
+
+func (r *PricedProcessingResource) GetPriceHT() (float64, error) {
+	r.ensurePricing()
+	return r.PricedResource.GetPriceHT()
 }
 
 func (r *PricedProcessingResource) GetType() tools.DataType {
@@ -78,11 +99,8 @@ func (a *PricedProcessingResource) GetExplicitDurationInS() float64 {
 		a.BookingConfiguration = &BookingConfiguration{}
 	}
 	if a.BookingConfiguration.ExplicitBookingDurationS == 0 {
-		if a.IsService || a.BookingConfiguration.UsageStart == nil {
+		if a.BookingConfiguration.UsageStart == nil {
-			if a.IsService {
+			return (5 * time.Minute).Seconds()
-				return -1
-			}
-			return time.Duration(1 * time.Hour).Seconds()
 		}
 		return a.BookingConfiguration.UsageEnd.Sub(*a.BookingConfiguration.UsageStart).Seconds()
 	}
@@ -90,7 +108,21 @@ func (a *PricedProcessingResource) GetExplicitDurationInS() float64 {
 }
 
 func (d *ProcessingResource) GetAccessor(request *tools.APIRequest) utils.Accessor {
-	return NewAccessor[*ProcessingResource](tools.PROCESSING_RESOURCE, request, func() utils.DBObject { return &ProcessingResource{} }) // Create a new instance of the accessor
+	return NewAccessor[*ProcessingResource](tools.PROCESSING_RESOURCE, request) // Create a new instance of the accessor
+}
+
+func (abs *ProcessingResource) ConvertToPricedResource(t tools.DataType, selectedInstance *int, selectedPartnership *int, selectedBuyingStrategy *int, selectedStrategy *int, selectedBookingModeIndex *int, request *tools.APIRequest) (pricing.PricedItemITF, error) {
+	if t != tools.PROCESSING_RESOURCE {
+		return nil, errors.New("not the proper type expected : cannot convert to priced resource : have " + t.String() + " wait Data")
+	}
+	p, err := ConvertToPricedResource[*DataResourcePricingProfile](t, selectedInstance, selectedPartnership, selectedBuyingStrategy, selectedStrategy, selectedBookingModeIndex, abs, request)
+	if err != nil {
+		return nil, err
+	}
+	priced := p.(*PricedResource[*DataResourcePricingProfile])
+	return &PricedDataResource{
+		PricedResource: *priced,
+	}, nil
 }
 
 type ProcessingResourcePricingProfile struct {
@@ -98,7 +130,7 @@ type ProcessingResourcePricingProfile struct {
 }
 
 func (p *ProcessingResourcePricingProfile) IsPurchasable() bool {
-	return p.Pricing.BuyingStrategy != pricing.UNDEFINED_SUBSCRIPTION
+	return p.Pricing.BuyingStrategy == pricing.PERMANENT
 }
 
 func (p *ProcessingResourcePricingProfile) IsBooked() bool {

models/resources/purchase_resource/purchase_resource.go

@@ -9,6 +9,7 @@ import (
 
 type PurchaseResource struct {
 	utils.AbstractObject
+	FromNano    string                 `json:"from_nano,omitempty" bson:"priced_item,omitempty"`
 	DestPeerID  string                 `json:"dest_peer_id" bson:"dest_peer_id"`
 	PricedItem  map[string]interface{} `json:"priced_item,omitempty" bson:"priced_item,omitempty" validate:"required"`
 	ExecutionID string                 `json:"execution_id,omitempty" bson:"execution_id,omitempty" validate:"required"` // ExecutionsID is the ID of the executions
@@ -19,8 +20,39 @@ type PurchaseResource struct {
 	InstanceID   string     `json:"instance_id,omitempty" bson:"instance_id,omitempty" validate:"required"` // could be a Compute or a Storage
 
 	ResourceType tools.DataType `json:"resource_type" bson:"resource_type" validate:"required"`
+
+	// Authorization: identifies who created this draft and the Check session it belongs to.
+	SchedulerPeerID string `json:"scheduler_peer_id,omitempty" bson:"scheduler_peer_id,omitempty"`
 }
 
+func (ri *PurchaseResource) Extend(typ ...string) map[string][]tools.DataType {
+	ext := ri.AbstractObject.Extend(typ...)
+	for _, t := range typ {
+		switch t {
+		case "dest_peer", "scheduler_peer":
+			if _, ok := ext[t]; !ok {
+				ext[t] = []tools.DataType{}
+			}
+			ext[t] = append(ext[t], tools.PEER)
+		case "execution":
+			if _, ok := ext[t]; !ok {
+				ext[t] = []tools.DataType{}
+			}
+			ext[t] = append(ext[t], tools.WORKFLOW_EXECUTION)
+		case "resource":
+			if _, ok := ext[t]; !ok {
+				ext[t] = []tools.DataType{}
+			}
+			ext[t] = append(ext[t], tools.WORKFLOW_RESOURCE)
+			ext[t] = append(ext[t], tools.DATA_RESOURCE)
+			ext[t] = append(ext[t], tools.COMPUTE_RESOURCE)
+			ext[t] = append(ext[t], tools.STORAGE_RESOURCE)
+			ext[t] = append(ext[t], tools.PROCESSING_RESOURCE)
+			ext[t] = append(ext[t], tools.SERVICE_RESOURCE)
+		}
+	}
+	return ext
+}
 func (d *PurchaseResource) GetAccessor(request *tools.APIRequest) utils.Accessor {
 	return NewAccessor(request) // Create a new instance of the accessor
 }

models/resources/purchase_resource/purchase_resource_accessor.go

@@ -30,7 +30,7 @@ func NewAccessor(request *tools.APIRequest) *PurchaseResourceMongoAccessor {
 func (a *PurchaseResourceMongoAccessor) LoadOne(id string) (utils.DBObject, int, error) {
 	return utils.GenericLoadOne(id, a.New(), func(d utils.DBObject) (utils.DBObject, int, error) {
 		if d.(*PurchaseResource).EndDate != nil && time.Now().UTC().After(*d.(*PurchaseResource).EndDate) {
-			utils.GenericDeleteOne(id, a)
+			utils.GenericDelete(d, a)
 			return nil, 404, nil
 		}
 		return d, 200, nil
@@ -40,9 +40,13 @@ func (a *PurchaseResourceMongoAccessor) LoadOne(id string) (utils.DBObject, int,
 func (a *PurchaseResourceMongoAccessor) GetExec(isDraft bool) func(utils.DBObject) utils.ShallowDBObject {
 	return func(d utils.DBObject) utils.ShallowDBObject {
 		if d.(*PurchaseResource).EndDate != nil && time.Now().UTC().After(*d.(*PurchaseResource).EndDate) {
-			utils.GenericDeleteOne(d.GetID(), a)
+			utils.GenericDelete(d, a)
 			return nil
 		}
 		return d
 	}
 }
+
+func (dca *PurchaseResourceMongoAccessor) ShouldVerifyAuth() bool {
+	return false // TEMP : by pass
+}

models/resources/purchase_resource/tests/purchase_resource_test.go

@@ -36,8 +36,8 @@ func TestCanUpdate(t *testing.T) {
 
 func TestCanDelete(t *testing.T) {
 	now := time.Now().UTC()
-	past := now.Add(-1 * time.Hour)
+	past := now.Add(-5 * time.Minute)
-	future := now.Add(1 * time.Hour)
+	future := now.Add(5 * time.Minute)
 
 	t.Run("nil EndDate", func(t *testing.T) {
 		r := &purchase_resource.PurchaseResource{}

models/resources/resource.go

@@ -4,36 +4,92 @@ import (
 	"encoding/json"
 	"errors"
 	"slices"
+	"time"
 
 	"cloud.o-forge.io/core/oc-lib/config"
 	"cloud.o-forge.io/core/oc-lib/dbs"
 	"cloud.o-forge.io/core/oc-lib/models/booking"
 	"cloud.o-forge.io/core/oc-lib/models/common/models"
 	"cloud.o-forge.io/core/oc-lib/models/common/pricing"
+	"cloud.o-forge.io/core/oc-lib/models/live"
 	"cloud.o-forge.io/core/oc-lib/models/peer"
+	"cloud.o-forge.io/core/oc-lib/models/resources/purchase_resource"
 	"cloud.o-forge.io/core/oc-lib/models/utils"
 	"cloud.o-forge.io/core/oc-lib/tools"
 	"github.com/biter777/countries"
 	"github.com/google/uuid"
 )
 
+func FiltersFromFlatMap(flatMap map[string]interface{}, target interface{}) *dbs.Filters {
+	return dbs.FiltersFromFlatMap(flatMap, target)
+}
+
 // AbstractResource is the struct containing all of the attributes commons to all ressources
 type AbstractResource struct {
 	utils.AbstractObject                                                   // AbstractObject contains the basic fields of an object (id, name)
-
+	PurchaseID           string                                            `json:"purchase_id,omitempty"`                                          // is_buy precise if a resource is buy or not
 	Type                 string                                            `json:"type,omitempty" bson:"type,omitempty"`                           // Type is the type of the resource
-	Logo                string                                            `json:"logo,omitempty" bson:"logo,omitempty" validate:"required"`                           // Logo is the logo of the resource
+	Logo                 string                                            `json:"logo,omitempty" bson:"logo,omitempty"`                           // Logo is the logo of the resource
 	Description          string                                            `json:"description,omitempty" bson:"description,omitempty"`             // Description is the description of the resource
-	ShortDescription    string                                            `json:"short_description,omitempty" bson:"short_description,omitempty" validate:"required"` // ShortDescription is the short description of the resource
+	ShortDescription     string                                            `json:"short_description,omitempty" bson:"short_description,omitempty"` // ShortDescription is the short description of the resource
 	Owners               []utils.Owner                                     `json:"owners,omitempty" bson:"owners,omitempty"`                       // Owners is the list of owners of the resource
 	UsageRestrictions    string                                            `bson:"usage_restrictions,omitempty" json:"usage_restrictions,omitempty"`
 	AllowedBookingModes  map[booking.BookingMode]*pricing.PricingVariation `bson:"allowed_booking_modes" json:"allowed_booking_modes"`
+
+	Env     []models.Param `json:"env,omitempty" bson:"env,omitempty"`
+	Inputs  []models.Param `json:"inputs,omitempty" bson:"inputs,omitempty"`
+	Outputs []models.Param `json:"outputs,omitempty" bson:"outputs,omitempty"`
+}
+
+func (ri *AbstractResource) Extend(typ ...string) map[string][]tools.DataType {
+	dt := ri.AbstractObject.Extend(typ...)
+	for _, t := range typ {
+		switch t {
+		case "purchase":
+			if _, ok := dt[t]; !ok {
+				dt[t] = []tools.DataType{}
+			}
+			dt[t] = append(dt[t], tools.PURCHASE_RESOURCE)
+		}
+	}
+	return dt
+}
+
+func (abs *AbstractResource) VerifyBuy() {
+	p := &purchase_resource.PurchaseResource{}
+	access := p.GetAccessor(&tools.APIRequest{Admin: true})
+
+	purchase, _, _ := access.Search(&dbs.Filters{
+		And: map[string][]dbs.Filter{
+			"resource_id": {{Operator: dbs.EQUAL.String(), Value: abs.GetID()}},
+		},
+	}, "", false, 0, 1)
+	if len(purchase) > 0 {
+		abs.PurchaseID = purchase[0].GetID()
+	}
+}
+
+func (abs *AbstractResource) GetEnv() []models.Param {
+	return abs.Env
+}
+func (abs *AbstractResource) GetInputs() []models.Param {
+	return abs.Inputs
+}
+func (abs *AbstractResource) GetOutputs() []models.Param {
+	return abs.Outputs
 }
 
 func (abs *AbstractResource) FilterPeer(peerID string) *dbs.Filters {
 	return nil
 }
 
+func (ri *AbstractResource) ClearEnv() utils.DBObject {
+	ri.Env = []models.Param{}
+	ri.Inputs = []models.Param{}
+	ri.Outputs = []models.Param{}
+	return ri
+}
+
 func (r *AbstractResource) GetBookingModes() map[booking.BookingMode]*pricing.PricingVariation {
 	if len(r.AllowedBookingModes) == 0 {
 		return map[booking.BookingMode]*pricing.PricingVariation{
@@ -52,30 +108,26 @@ func (r *AbstractResource) GetType() string {
 }
 
 func (r *AbstractResource) StoreDraftDefault() {
-	r.IsDraft = true
+	//r.IsDraft = true pour le moment on passe outre.
 }
 
 func (r *AbstractResource) CanUpdate(set utils.DBObject) (bool, utils.DBObject) {
 	return r.IsDraft, set
 }
 
-func (r *AbstractResource) CanDelete() bool {
-	return r.IsDraft // only draft bookings can be deleted
-}
-
 type AbstractInstanciatedResource[T ResourceInstanceITF] struct {
 	AbstractResource // AbstractResource contains the basic fields of an object (id, name)
 
-	Instances []T `json:"instances,omitempty" bson:"instances,omitempty"` // Bill is the bill of the resource            // Bill is the bill of the resource
+	Instances []T `json:"instances,omitempty" bson:"instances,omitempty"`
 }
 
 func (abs *AbstractInstanciatedResource[T]) AddInstances(instance ResourceInstanceITF) {
 	abs.Instances = append(abs.Instances, instance.(T))
 }
 
-func (abs *AbstractInstanciatedResource[T]) ConvertToPricedResource(t tools.DataType,
+func ConvertToPricedResource[T pricing.PricingProfileITF](t tools.DataType,
 	selectedInstance *int, selectedPartnership *int, selectedBuyingStrategy *int, selectedStrategy *int,
-	selectedBookingModeIndex *int, request *tools.APIRequest) (pricing.PricedItemITF, error) {
+	selectedBookingModeIndex *int, abs ResourceInterface, request *tools.APIRequest) (pricing.PricedItemITF, error) {
 	instances := map[string]string{}
 	var profile pricing.PricingProfileITF
 	var inst ResourceInstanceITF
@@ -84,7 +136,7 @@ func (abs *AbstractInstanciatedResource[T]) ConvertToPricedResource(t tools.Data
 		instances[t.GetID()] = t.GetName()
 		profile = t.GetProfile(request.PeerID, selectedPartnership, selectedBuyingStrategy, selectedStrategy)
 	} else {
-		for i, instance := range abs.Instances { // TODO why it crush before ?
+		for i, instance := range abs.SetAllowedInstances(request) { // TODO why it crush before ?
 			if i == 0 {
 				inst = instance
 			}
@@ -106,30 +158,36 @@ func (abs *AbstractInstanciatedResource[T]) ConvertToPricedResource(t tools.Data
 		}*/
 	}
 	variations := []*pricing.PricingVariation{}
-	if selectedBookingModeIndex != nil && abs.AllowedBookingModes[booking.BookingMode(*selectedBookingModeIndex)] != nil {
+	if selectedBookingModeIndex != nil && abs.GetBookingModes()[booking.BookingMode(*selectedBookingModeIndex)] != nil {
-		variations = append(variations, abs.AllowedBookingModes[booking.BookingMode(*selectedBookingModeIndex)])
+		variations = append(variations, abs.GetBookingModes()[booking.BookingMode(*selectedBookingModeIndex)])
 	}
-	return &PricedResource{
+	// Seed the booking configuration with the instance's historical average duration
-		Name:            abs.Name,
+	// so GetExplicitDurationInS() returns a realistic default out of the box.
-		Logo:            abs.Logo,
+	var bc *BookingConfiguration
-		ResourceID:      abs.UUID,
+	if inst != nil {
-		InstanceID:      inst.GetID(),
+		if avg := inst.GetAverageDurationS(); avg > 0 {
+			bc = &BookingConfiguration{ExplicitBookingDurationS: avg}
+		}
+	}
+	instanceID := ""
+	if inst != nil {
+		instanceID = inst.GetID()
+	}
+	selectedPricing, _ := profile.(T)
+	return &PricedResource[T]{
+		Name:                 abs.GetName(),
+		ResourceID:           abs.GetID(),
+		InstanceID:           instanceID,
 		ResourceType:         t,
 		Quantity:             1,
 		InstancesRefs:        instances,
-		SelectedPricing: profile,
+		SelectedPricing:      selectedPricing,
 		Variations:           variations,
-		CreatorID:       abs.CreatorID,
+		CreatorID:            abs.GetCreatorID(),
+		BookingConfiguration: bc,
 	}, nil
 }
 
-func (abs *AbstractInstanciatedResource[T]) ClearEnv() utils.DBObject {
-	for _, instance := range abs.Instances {
-		instance.ClearEnv()
-	}
-	return abs
-}
-
 func (r *AbstractInstanciatedResource[T]) GetSelectedInstance(selected *int) ResourceInstanceITF {
 	if selected != nil && len(r.Instances) > *selected {
 		return r.Instances[*selected]
@@ -140,12 +198,17 @@ func (r *AbstractInstanciatedResource[T]) GetSelectedInstance(selected *int) Res
 	return nil
 }
 
-func (abs *AbstractInstanciatedResource[T]) SetAllowedInstances(request *tools.APIRequest, instanceID ...string) {
+func (abs *AbstractInstanciatedResource[T]) SetAllowedInstances(request *tools.APIRequest, instanceID ...string) []ResourceInstanceITF {
-	if (request != nil && request.PeerID == abs.CreatorID && request.PeerID != "") || request.Admin {
+	if !((request != nil && request.PeerID == abs.CreatorID && request.PeerID != "") || request.Admin) {
-		return
-	}
 		abs.Instances = VerifyAuthAction(abs.Instances, request, instanceID...)
 	}
+	inst := []ResourceInstanceITF{}
+	for _, i := range abs.Instances {
+		inst = append(inst, i)
+	}
+
+	return inst
+}
 
 func (abs *AbstractInstanciatedResource[T]) VerifyAuth(callName string, request *tools.APIRequest) bool {
 	return len(VerifyAuthAction(abs.Instances, request)) > 0 || abs.AbstractObject.VerifyAuth(callName, request)
@@ -157,13 +220,20 @@ func VerifyAuthAction[T ResourceInstanceITF](baseInstance []T, request *tools.AP
 		if len(instanceID) > 0 && !slices.Contains(instanceID, instance.GetID()) {
 			continue
 		}
+		// Structurally peerless instances (no creator, no partnerships, non-empty Ref)
+		// are freely accessible by any requester.
+		if instance.IsPeerless() {
+			instances = append(instances, instance)
+			continue
+		}
 		_, peerGroups := instance.GetPeerGroups()
 		for _, peers := range peerGroups {
 			if request == nil {
 				continue
 			}
-			if grps, ok := peers[request.PeerID]; ok || config.GetConfig().Whitelist {
+			_, allOK := peers["*"]
-				if (ok && slices.Contains(grps, "*")) || (!ok && config.GetConfig().Whitelist) {
+			if grps, ok := peers[request.PeerID]; ok || allOK || config.GetConfig().Whitelist {
+				if allOK || (ok && slices.Contains(grps, "*")) || (!ok && config.GetConfig().Whitelist) {
 					instance.FilterInstance(request.PeerID)
 					instances = append(instances, instance)
 					// TODO filter Partners + Profiles...
@@ -181,21 +251,19 @@ func VerifyAuthAction[T ResourceInstanceITF](baseInstance []T, request *tools.AP
 	return instances
 }
 
-type GeoPoint struct {
-	Latitude  float64 `json:"latitude,omitempty" bson:"latitude,omitempty"`
-	Longitude float64 `json:"longitude,omitempty" bson:"longitude,omitempty"`
-}
-
 type ResourceInstance[T ResourcePartnerITF] struct {
 	utils.AbstractObject
-	Location       GeoPoint              `json:"location,omitempty" bson:"location,omitempty"`
+	ContentType    string                `json:"content_type,omitempty" bson:"content_type,omitempty"`
+	LastUpdate     time.Time             `json:"last_update,omitempty" bson:"last_update,omitempty"`
+	Origin         OriginMeta            `json:"origin,omitempty" bson:"origin,omitempty"`
+	Location       live.GeoPoint         `json:"location,omitempty" bson:"location,omitempty"`
 	Country        countries.CountryCode `json:"country,omitempty" bson:"country,omitempty"`
 	AccessProtocol string                `json:"access_protocol,omitempty" bson:"access_protocol,omitempty"`
-	Env            []models.Param        `json:"env,omitempty" bson:"env,omitempty"`
-	Inputs         []models.Param        `json:"inputs,omitempty" bson:"inputs,omitempty"`
-	Outputs        []models.Param        `json:"outputs,omitempty" bson:"outputs,omitempty"`
 
 	Partnerships []T `json:"partnerships,omitempty" bson:"partnerships,omitempty"`
+
+	AverageDurationS       float64 `json:"average_duration_s,omitempty" bson:"average_duration_s,omitempty"`
+	AverageDurationSamples int     `json:"average_duration_samples,omitempty" bson:"average_duration_samples,omitempty"`
 }
 
 // TODO should kicks all selection
@@ -210,10 +278,23 @@ func NewInstance[T ResourcePartnerITF](name string) *ResourceInstance[T] {
 	}
 }
 
+func (ri *ResourceInstance[T]) GetOrigin() OriginMeta {
+	return ri.Origin
+}
+
+// IsPeerless returns true when the instance has no owning peer and a non-empty
+// registry reference. This is derived from structural invariants — NOT from the
+// self-declared Origin.Type field — to prevent auth bypass via metadata manipulation:
+//
+//	CreatorID == "" ∧ len(Partnerships) == 0 ∧ Origin.Ref != ""
+func (ri *ResourceInstance[T]) IsPeerless() bool {
+	return ri.CreatorID == "" && len(ri.Partnerships) == 0 && ri.Origin.Ref != ""
+}
+
 func (ri *ResourceInstance[T]) FilterInstance(peerID string) {
 	partnerships := []T{}
 	for _, p := range ri.Partnerships {
-		if p.GetPeerGroups()[peerID] != nil {
+		if p.GetPeerGroups()["*"] != nil || p.GetPeerGroups()[peerID] != nil {
 			p.FilterPartnership(peerID)
 			partnerships = append(partnerships, p)
 		}
@@ -221,13 +302,10 @@ func (ri *ResourceInstance[T]) FilterInstance(peerID string) {
 	ri.Partnerships = partnerships
 }
 
-func (ri *ResourceInstance[T]) ClearEnv() {
-	ri.Env = []models.Param{}
-	ri.Inputs = []models.Param{}
-	ri.Outputs = []models.Param{}
-}
-
 func (ri *ResourceInstance[T]) GetProfile(peerID string, partnershipIndex *int, buyingIndex *int, strategyIndex *int) pricing.PricingProfileITF {
+	if ri.IsPeerless() {
+		return pricing.GetDefaultPricingProfile()
+	}
 	if partnershipIndex != nil && len(ri.Partnerships) > *partnershipIndex {
 		prts := ri.Partnerships[*partnershipIndex]
 		return prts.GetProfile(buyingIndex, strategyIndex)
@@ -241,6 +319,9 @@ func (ri *ResourceInstance[T]) GetProfile(peerID string, partnershipIndex *int,
 }
 
 func (ri *ResourceInstance[T]) GetPricingsProfiles(peerID string, groups []string) []pricing.PricingProfileITF {
+	if ri.IsPeerless() {
+		return []pricing.PricingProfileITF{pricing.GetDefaultPricingProfile()}
+	}
 	pricings := []pricing.PricingProfileITF{}
 	for _, p := range ri.Partnerships {
 		pricings = append(pricings, p.GetPricingsProfiles(peerID, groups)...)
@@ -256,6 +337,10 @@ func (ri *ResourceInstance[T]) GetPricingsProfiles(peerID string, groups []strin
 }
 
 func (ri *ResourceInstance[T]) GetPeerGroups() ([]ResourcePartnerITF, []map[string][]string) {
+	// Structurally peerless: universally accessible — wildcard on all peers.
+	if ri.IsPeerless() {
+		return []ResourcePartnerITF{}, []map[string][]string{{"*": {"*"}}}
+	}
 	groups := []map[string][]string{}
 	partners := []ResourcePartnerITF{}
 	for _, p := range ri.Partnerships {
@@ -285,6 +370,25 @@ func (ri *ResourceInstance[T]) ClearPeerGroups() {
 	}
 }
 
+func (ri *ResourceInstance[T]) GetAverageDurationS() float64 {
+	return ri.AverageDurationS
+}
+
+func (ri *ResourceInstance[T]) UpdateAverageDuration(actualS float64) {
+	buffered := actualS * 1.20
+	n := float64(ri.AverageDurationSamples)
+	ri.AverageDurationS = (ri.AverageDurationS*n + buffered) / (n + 1)
+	ri.AverageDurationSamples++
+}
+
+func (ri *ResourceInstance[T]) GetPartnerships() []ResourcePartnerITF {
+	rt := []ResourcePartnerITF{}
+	for _, p := range ri.Partnerships {
+		rt = append(rt, p)
+	}
+	return rt
+}
+
 type ResourcePartnerShip[T pricing.PricingProfileITF] struct {
 	Namespace       string              `json:"namespace" bson:"namespace" default:"default-namespace"`
 	PeerGroups      map[string][]string `json:"peer_groups,omitempty" bson:"peer_groups,omitempty"`
@@ -293,11 +397,17 @@ type ResourcePartnerShip[T pricing.PricingProfileITF] struct {
 }
 
 func (ri *ResourcePartnerShip[T]) FilterPartnership(peerID string) {
-	if ri.PeerGroups[peerID] == nil {
+	if ri.PeerGroups["*"] == nil && ri.PeerGroups[peerID] == nil {
-		ri.PeerGroups = map[string][]string{}
-	} else {
 		ri.PeerGroups = map[string][]string{
-			peerID: ri.PeerGroups[peerID],
+			"*": {"*"},
+		}
+	} else {
+		ri.PeerGroups = map[string][]string{}
+		if ri.PeerGroups["*"] != nil {
+			ri.PeerGroups["*"] = ri.PeerGroups["*"]
+		}
+		if ri.PeerGroups[peerID] != nil {
+			ri.PeerGroups[peerID] = ri.PeerGroups[peerID]
 		}
 	}
 }
@@ -323,7 +433,15 @@ Une bill (facture) représente alors... l'emission d'une facture à un instant T
 */
 func (ri *ResourcePartnerShip[T]) GetPricingsProfiles(peerID string, groups []string) []pricing.PricingProfileITF {
 	profiles := []pricing.PricingProfileITF{}
-	if ri.PeerGroups[peerID] == nil {
+	if ri.PeerGroups["*"] == nil && ri.PeerGroups[peerID] == nil {
+		return profiles
+	}
+	if ri.PeerGroups["*"] != nil {
+		for _, ri := range ri.PricingProfiles {
+			for _, i := range ri {
+				profiles = append(profiles, i)
+			}
+		}
 		return profiles
 	}
 	for _, p := range ri.PeerGroups[peerID] {
@@ -355,6 +473,7 @@ func (rp *ResourcePartnerShip[T]) GetPeerGroups() map[string][]string {
 			return rp.PeerGroups
 		}
 		return map[string][]string{
+			"*":        {"*"},
 			pp.GetID(): {"*"},
 		}
 	}
@@ -400,6 +519,12 @@ func ToResource(
 			return nil, err
 		}
 		return &data, nil
+	case tools.SERVICE_RESOURCE.EnumIndex():
+		var data ServiceResource
+		if err := json.Unmarshal(payload, &data); err != nil {
+			return nil, err
+		}
+		return &data, nil
 	}
 	return nil, errors.New("can't found any data resources matching")
 }

models/resources/resource_accessor.go

@@ -2,25 +2,26 @@ package resources
 
 import (
 	"errors"
+	"fmt"
 	"slices"
 
 	"cloud.o-forge.io/core/oc-lib/dbs"
 	"cloud.o-forge.io/core/oc-lib/logs"
+	"cloud.o-forge.io/core/oc-lib/models/live"
 	"cloud.o-forge.io/core/oc-lib/models/utils"
 	"cloud.o-forge.io/core/oc-lib/tools"
 )
 
 type ResourceMongoAccessor[T ResourceInterface] struct {
 	utils.AbstractAccessor[ResourceInterface] // AbstractAccessor contains the basic fields of an accessor (model, caller)
-	generateData                              func() utils.DBObject
 }
 
 // New creates a new instance of the computeMongoAccessor
-func NewAccessor[T ResourceInterface](t tools.DataType, request *tools.APIRequest, g func() utils.DBObject) *ResourceMongoAccessor[T] {
+func NewAccessor[T ResourceInterface](t tools.DataType, request *tools.APIRequest) *ResourceMongoAccessor[T] {
 	if !slices.Contains([]tools.DataType{
 		tools.COMPUTE_RESOURCE, tools.STORAGE_RESOURCE,
-		tools.PROCESSING_RESOURCE, tools.WORKFLOW_RESOURCE,
+		tools.PROCESSING_RESOURCE, tools.SERVICE_RESOURCE,
-		tools.DATA_RESOURCE, tools.NATIVE_TOOL,
+		tools.WORKFLOW_RESOURCE, tools.DATA_RESOURCE, tools.NATIVE_TOOL,
 	}, t) {
 		return nil
 	}
@@ -37,6 +38,8 @@ func NewAccessor[T ResourceInterface](t tools.DataType, request *tools.APIReques
 					return &StorageResource{}
 				case tools.PROCESSING_RESOURCE:
 					return &ProcessingResource{}
+				case tools.SERVICE_RESOURCE:
+					return &ServiceResource{}
 				case tools.WORKFLOW_RESOURCE:
 					return &WorkflowResource{}
 				case tools.DATA_RESOURCE:
@@ -47,7 +50,6 @@ func NewAccessor[T ResourceInterface](t tools.DataType, request *tools.APIReques
 				return nil
 			},
 		},
-		generateData: g,
 	}
 }
 
@@ -55,9 +57,24 @@ func NewAccessor[T ResourceInterface](t tools.DataType, request *tools.APIReques
 * Nothing special here, just the basic CRUD operations
  */
 
+func (dca *ResourceMongoAccessor[T]) LoadOne(id string) (utils.DBObject, int, error) {
+	data, code, err := dca.AbstractAccessor.LoadOne(id)
+	if err == nil {
+		data.(T).VerifyBuy()
+		data.(T).SetAllowedInstances(dca.Request)
+		return data, code, err
+	}
+	return data, code, err
+}
+
 func (dca *ResourceMongoAccessor[T]) UpdateOne(set map[string]interface{}, id string) (utils.DBObject, int, error) {
 	if dca.GetType() == tools.COMPUTE_RESOURCE {
-		return nil, 404, errors.New("can't update a non existing computing units resource not reported onto compute units catalog")
+		delete(set, "architecture")
+		delete(set, "infrastructure")
+	} else if dca.GetType() == tools.SERVICE_RESOURCE {
+		delete(set, "infrastructure")
+	} else if dca.GetType() == tools.STORAGE_RESOURCE {
+		delete(set, "storage_type")
 	}
 	return utils.GenericUpdateOne(set, id, dca)
 }
@@ -67,39 +84,94 @@ func (dca *ResourceMongoAccessor[T]) ShouldVerifyAuth() bool {
 }
 
 func (dca *ResourceMongoAccessor[T]) StoreOne(data utils.DBObject) (utils.DBObject, int, error) {
+	var i string
+	idsToUpdate := []string{}
+	var a utils.Accessor
 	if dca.GetType() == tools.COMPUTE_RESOURCE {
+		r := data.(*ComputeResource)
+		if len(r.Instances) == 0 {
+			return nil, 404, errors.New("can't create a non existing computing units resource with no instances")
+		}
+		a = live.NewAccessor[*live.LiveDatacenter](tools.LIVE_DATACENTER, &tools.APIRequest{Admin: true})
+		res, _, _ := a.LoadOne(r.Instances[0].GetID())
+		if res == nil {
 			return nil, 404, errors.New("can't create a non existing computing units resource not reported onto compute units catalog")
 		}
-	return utils.GenericStoreOne(data, dca)
+		if !res.(*live.LiveDatacenter).IsCompatible(data.Serialize(data)) {
+			return nil, 404, errors.New("live computing units  target is not compatible")
+		}
+		i = res.GetID()
+		idsToUpdate = res.(*live.LiveDatacenter).ResourcesID
+	} else if dca.GetType() == tools.SERVICE_RESOURCE {
+		r := data.(*ServiceResource)
+		if len(r.Instances) == 0 {
+			return nil, 404, errors.New("can't create a non existing service resource with no instances")
+		}
+		a = live.NewAccessor[*live.LiveService](tools.LIVE_SERVICE, &tools.APIRequest{Admin: true})
+		res, _, _ := a.LoadOne(r.Instances[0].GetID())
+		if res == nil {
+			return nil, 404, errors.New("can't create a non existing service resource not reported onto compute units catalog")
+		}
+		if !res.(*live.LiveService).IsCompatible(data.Serialize(data)) {
+			return nil, 404, errors.New("live service target is not compatible")
+		}
+		i = res.GetID()
+		idsToUpdate = res.(*live.LiveService).ResourcesID
+	} else if dca.GetType() == tools.STORAGE_RESOURCE {
+		r := data.(*StorageResource)
+		if len(r.Instances) == 0 {
+			return nil, 404, errors.New("can't create a non existing storage resource with no instances")
+		}
+		a = live.NewAccessor[*live.LiveStorage](tools.LIVE_STORAGE, &tools.APIRequest{Admin: true})
+		res, _, _ := a.LoadOne(r.Instances[0].GetID())
+		if res == nil {
+			return nil, 404, errors.New("can't create a non existing storage resource not reported onto compute units catalog")
+		}
+		if !res.(*live.LiveStorage).IsCompatible(data.Serialize(data)) {
+			return nil, 404, errors.New("live storage target is not compatible")
+		}
+		i = res.GetID()
+		idsToUpdate = res.(*live.LiveStorage).ResourcesID
+	}
+	res, code, err := utils.GenericStoreOne(data, dca)
+	if res != nil && i != "" {
+		idsToUpdate = append(idsToUpdate, res.GetID())
+		a.UpdateOne(map[string]interface{}{
+			"resources_id": idsToUpdate,
+		}, i)
+	}
+	return res, code, err
 }
 
 func (dca *ResourceMongoAccessor[T]) CopyOne(data utils.DBObject) (utils.DBObject, int, error) {
-	if dca.GetType() == tools.COMPUTE_RESOURCE {
-		return nil, 404, errors.New("can't copy/publish a non existing computing units resource not reported onto compute units catalog")
-	}
 	return dca.StoreOne(data)
 }
 
-func (wfa *ResourceMongoAccessor[T]) LoadAll(isDraft bool) ([]utils.ShallowDBObject, int, error) {
+func (wfa *ResourceMongoAccessor[T]) LoadAll(isDraft bool, offset int64, limit int64) ([]utils.ShallowDBObject, int, error) {
-	return utils.GenericLoadAll[T](wfa.GetExec(isDraft), isDraft, wfa)
+	return utils.GenericLoadAll[T](wfa.GetExec(isDraft), isDraft, wfa, offset, limit)
 }
 
-func (wfa *ResourceMongoAccessor[T]) Search(filters *dbs.Filters, search string, isDraft bool) ([]utils.ShallowDBObject, int, error) {
+func (wfa *ResourceMongoAccessor[T]) Search(filters *dbs.Filters, search string, isDraft bool, offset int64, limit int64) ([]utils.ShallowDBObject, int, error) {
 	if filters == nil && search == "*" {
 		return utils.GenericLoadAll[T](func(d utils.DBObject) utils.ShallowDBObject {
+			fmt.Println("Search", d)
+			d.(T).VerifyBuy()
 			d.(T).SetAllowedInstances(wfa.Request)
+			fmt.Println("Search2", d)
 			return d
-		}, isDraft, wfa)
+		}, isDraft, wfa, offset, limit)
 	}
 	return utils.GenericSearch[T](filters, search, wfa.GetObjectFilters(search),
 		func(d utils.DBObject) utils.ShallowDBObject {
+			d.(T).VerifyBuy()
 			d.(T).SetAllowedInstances(wfa.Request)
 			return d
-		}, isDraft, wfa)
+		}, isDraft, wfa, offset, limit)
 }
 
 func (a *ResourceMongoAccessor[T]) GetExec(isDraft bool) func(utils.DBObject) utils.ShallowDBObject {
 	return func(d utils.DBObject) utils.ShallowDBObject {
+		d.(T).VerifyBuy()
 		d.(T).SetAllowedInstances(a.Request)
 		return d
 	}
@@ -108,12 +180,11 @@ func (a *ResourceMongoAccessor[T]) GetExec(isDraft bool) func(utils.DBObject) ut
 func (abs *ResourceMongoAccessor[T]) GetObjectFilters(search string) *dbs.Filters {
 	return &dbs.Filters{
 		Or: map[string][]dbs.Filter{ // filter by like name, short_description, description, owner, url if no filters are provided
-			"abstractintanciatedresource.abstractresource.abstractobject.name":       {{Operator: dbs.LIKE.String(), Value: search}},
+			"abstractinstanciatedresource.abstractresource.abstractobject.name": {{Operator: dbs.LIKE.String(), Value: search}},
-			"abstractintanciatedresource.abstractresource.type":                      {{Operator: dbs.LIKE.String(), Value: search}},
+			"abstractinstanciatedresource.abstractresource.type":                {{Operator: dbs.LIKE.String(), Value: search}},
-			"abstractintanciatedresource.abstractresource.short_description":         {{Operator: dbs.LIKE.String(), Value: search}},
+			"abstractinstanciatedresource.abstractresource.short_description":   {{Operator: dbs.LIKE.String(), Value: search}},
-			"abstractintanciatedresource.abstractresource.description":               {{Operator: dbs.LIKE.String(), Value: search}},
+			"abstractinstanciatedresource.abstractresource.description":         {{Operator: dbs.LIKE.String(), Value: search}},
-			"abstractintanciatedresource.abstractresource.owners.name":               {{Operator: dbs.LIKE.String(), Value: search}},
+			"abstractinstanciatedresource.abstractresource.owners.name":         {{Operator: dbs.LIKE.String(), Value: search}},
-			"abstractintanciatedresource.abstractresource.abstractobject.creator_id": {{Operator: dbs.EQUAL.String(), Value: search}},
 		},
 	}
 }

models/resources/service.go

@@ -0,0 +1,198 @@
+package resources
+
+import (
+	"errors"
+	"time"
+
+	"cloud.o-forge.io/core/oc-lib/models/common/enum"
+	"cloud.o-forge.io/core/oc-lib/models/common/models"
+	"cloud.o-forge.io/core/oc-lib/models/common/pricing"
+	"cloud.o-forge.io/core/oc-lib/models/live"
+	"cloud.o-forge.io/core/oc-lib/models/utils"
+	"cloud.o-forge.io/core/oc-lib/tools"
+	"github.com/google/uuid"
+)
+
+type ServiceMode int
+
+const (
+	DEPLOYMENT ServiceMode = iota // deploy the service, pay for uptime — duration unbounded
+	HOSTED                        // use an existing service, pay per call — duration per request
+)
+
+func (m ServiceMode) String() string {
+	return [...]string{"DEPLOYMENT", "HOSTED"}[m]
+}
+
+type ServiceUsage struct {
+	CPUs         map[string]*models.CPU `bson:"cpus,omitempty" json:"cpus,omitempty"`
+	GPUs         map[string]*models.GPU `bson:"gpus,omitempty" json:"gpus,omitempty"`
+	RAM          *models.RAM            `bson:"ram,omitempty" json:"ram,omitempty"`
+	StorageGb    float64                `bson:"storage,omitempty" json:"storage,omitempty"`
+	Hypothesis   string                 `bson:"hypothesis,omitempty" json:"hypothesis,omitempty"`
+	ScalingModel string                 `bson:"scaling_model,omitempty" json:"scaling_model,omitempty"`
+}
+
+// ServiceResourceAccess describes how to reach the service once running.
+// Populated for HOSTED instances (endpoint already known) and as a template for DEPLOYMENT.
+type ServiceResourceAccess struct {
+	Container       *models.Container    `json:"container,omitempty" bson:"container,omitempty"`
+	Protocol        live.ServiceProtocol `json:"protocol" bson:"protocol" default:"0"`
+	EndpointPattern string               `json:"endpoint_pattern,omitempty" bson:"endpoint_pattern,omitempty"`
+	HealthCheckPath string               `json:"health_check_path,omitempty" bson:"health_check_path,omitempty"`
+}
+
+type ServiceResource struct {
+	AbstractInstanciatedResource[*ServiceInstance]
+	Infrastructure enum.InfrastructureType `json:"infrastructure" bson:"infrastructure" default:"-1"`
+	Usage          *ServiceUsage           `bson:"usage,omitempty" json:"usage,omitempty"`
+	OpenSource     bool                    `json:"open_source" bson:"open_source" default:"false"`
+	License        string                  `json:"license,omitempty" bson:"license,omitempty"`
+	Maturity       string                  `json:"maturity,omitempty" bson:"maturity,omitempty"`
+}
+
+func (r *ServiceResource) GetType() string {
+	return tools.SERVICE_RESOURCE.String()
+}
+
+func (d *ServiceResource) GetAccessor(request *tools.APIRequest) utils.Accessor {
+	return NewAccessor[*ServiceResource](tools.SERVICE_RESOURCE, request)
+}
+
+func (abs *ServiceResource) ConvertToPricedResource(t tools.DataType, selectedInstance *int, selectedPartnership *int, selectedBuyingStrategy *int, selectedStrategy *int, selectedBookingModeIndex *int, request *tools.APIRequest) (pricing.PricedItemITF, error) {
+	if t != tools.SERVICE_RESOURCE {
+		return nil, errors.New("not the proper type expected : cannot convert to priced resource : have " + t.String() + " wait Service")
+	}
+	p, err := ConvertToPricedResource[*ServiceResourcePricingProfile](t, selectedInstance, selectedPartnership, selectedBuyingStrategy, selectedStrategy, selectedBookingModeIndex, abs, request)
+	if err != nil {
+		return nil, err
+	}
+	priced := p.(*PricedResource[*ServiceResourcePricingProfile])
+	return &PricedServiceResource{PricedResource: *priced}, nil
+}
+
+type ServiceInstance struct {
+	ResourceInstance[*ServiceResourcePartnership]
+	Mode          ServiceMode            `json:"mode" bson:"mode" default:"0"`
+	Access        *ServiceResourceAccess `json:"access,omitempty" bson:"access,omitempty"`
+	MaxConcurrent int                    `json:"max_concurrent,omitempty" bson:"max_concurrent,omitempty"`
+}
+
+func (ri *ServiceInstance) IsPeerless() bool { return false }
+
+func NewServiceInstance(name string, peerID string) ResourceInstanceITF {
+	return &ServiceInstance{
+		ResourceInstance: ResourceInstance[*ServiceResourcePartnership]{
+			AbstractObject: utils.AbstractObject{
+				UUID: uuid.New().String(),
+				Name: name,
+			},
+		},
+	}
+}
+
+type ServiceResourcePartnership struct {
+	ResourcePartnerShip[*ServiceResourcePricingProfile]
+}
+
+// ServiceResourcePricingProfile handles both service modes:
+//   - DEPLOYMENT: uptime billing via ExploitPricingProfile (pay while service is up)
+//   - HOSTED:     per-call billing via AccessPricingProfile (pay per request)
+type ServiceResourcePricingProfile struct {
+	Mode          ServiceMode                                                 `json:"mode" bson:"mode"`
+	UptimePricing *pricing.ExploitPricingProfile[pricing.TimePricingStrategy] `json:"uptime_pricing,omitempty" bson:"uptime_pricing,omitempty"`
+	AccessPricing *pricing.AccessPricingProfile[pricing.TimePricingStrategy]  `json:"access_pricing,omitempty" bson:"access_pricing,omitempty"`
+}
+
+func (p *ServiceResourcePricingProfile) ensure() {
+	if p.UptimePricing == nil {
+		p.UptimePricing = &pricing.ExploitPricingProfile[pricing.TimePricingStrategy]{}
+	}
+	if p.AccessPricing == nil {
+		p.AccessPricing = &pricing.AccessPricingProfile[pricing.TimePricingStrategy]{}
+	}
+}
+
+func (p *ServiceResourcePricingProfile) IsPurchasable() bool {
+	p.ensure()
+	if p.Mode == DEPLOYMENT {
+		return p.UptimePricing.IsPurchasable()
+	}
+	return p.AccessPricing.IsPurchasable()
+}
+
+func (p *ServiceResourcePricingProfile) IsBooked() bool {
+	p.ensure()
+	if p.Mode == DEPLOYMENT {
+		return p.UptimePricing.IsBooked()
+	}
+	return p.AccessPricing.IsBooked()
+}
+
+func (p *ServiceResourcePricingProfile) GetPurchase() pricing.BuyingStrategy {
+	p.ensure()
+	if p.Mode == DEPLOYMENT {
+		return p.UptimePricing.GetPurchase()
+	}
+	return p.AccessPricing.GetPurchase()
+}
+
+func (p *ServiceResourcePricingProfile) GetOverrideStrategyValue() int {
+	return -1
+}
+
+func (p *ServiceResourcePricingProfile) GetPriceHT(quantity float64, val float64, start time.Time, end time.Time, variations []*pricing.PricingVariation, params ...string) (float64, error) {
+	p.ensure()
+	if p.Mode == DEPLOYMENT {
+		return p.UptimePricing.GetPriceHT(quantity, val, start, end, variations, params...)
+	}
+	return p.AccessPricing.GetPriceHT(quantity, val, start, end, variations, params...)
+}
+
+type PricedServiceResource struct {
+	PricedResource[*ServiceResourcePricingProfile]
+}
+
+func (r *PricedServiceResource) ensurePricing() {
+	if r.SelectedPricing == nil {
+		r.SelectedPricing = &ServiceResourcePricingProfile{}
+	}
+}
+
+func (r *PricedServiceResource) IsPurchasable() bool {
+	r.ensurePricing()
+	return r.SelectedPricing.IsPurchasable()
+}
+
+func (r *PricedServiceResource) IsBooked() bool {
+	r.ensurePricing()
+	return r.SelectedPricing.IsBooked()
+}
+
+func (r *PricedServiceResource) GetType() tools.DataType {
+	return tools.SERVICE_RESOURCE
+}
+
+func (r *PricedServiceResource) GetPriceHT() (float64, error) {
+	r.ensurePricing()
+	return r.PricedResource.GetPriceHT()
+}
+
+// GetExplicitDurationInS returns -1 for DEPLOYMENT (unbounded uptime).
+// For HOSTED, returns the actual call window duration.
+func (a *PricedServiceResource) GetExplicitDurationInS() float64 {
+	a.ensurePricing()
+	if a.SelectedPricing.Mode == DEPLOYMENT {
+		return -1
+	}
+	if a.BookingConfiguration == nil {
+		a.BookingConfiguration = &BookingConfiguration{}
+	}
+	if a.BookingConfiguration.ExplicitBookingDurationS != 0 {
+		return a.BookingConfiguration.ExplicitBookingDurationS
+	}
+	if a.BookingConfiguration.UsageStart == nil || a.BookingConfiguration.UsageEnd == nil {
+		return -1 // no deadline specified: open-ended
+	}
+	return a.BookingConfiguration.UsageEnd.Sub(*a.BookingConfiguration.UsageStart).Seconds()
+}

models/resources/storage.go

@@ -2,7 +2,6 @@ package resources
 
 import (
 	"errors"
-	"fmt"
 	"time"
 
 	"cloud.o-forge.io/core/oc-lib/models/common/enum"
@@ -13,6 +12,17 @@ import (
 	"github.com/google/uuid"
 )
 
+// EmbeddedStorageSelection records which storage capability was activated on a
+// compute unit graph node, and which pricing options were selected for it.
+// Key in WorkflowExecution.SelectedEmbeddedStorages is the compute graph node ID.
+// A nil/absent entry means no storage was activated on that compute unit.
+type EmbeddedStorageSelection struct {
+	StorageIndex     int `json:"storage_index" bson:"storage_index"`         // index in ComputeResourceInstance.AvailableStorages
+	PartnershipIndex int `json:"partnership_index" bson:"partnership_index"` // index in the storage's partnerships
+	BuyingIndex      int `json:"buying_index" bson:"buying_index"`
+	StrategyIndex    int `json:"strategy_index" bson:"strategy_index"`
+}
+
 /*
 * StorageResource is a struct that represents a storage resource
 * it defines the resource storage
@@ -24,7 +34,7 @@ type StorageResource struct {
 }
 
 func (d *StorageResource) GetAccessor(request *tools.APIRequest) utils.Accessor {
-	return NewAccessor[*StorageResource](tools.STORAGE_RESOURCE, request, func() utils.DBObject { return &StorageResource{} }) // Create a new instance of the accessor
+	return NewAccessor[*StorageResource](tools.STORAGE_RESOURCE, request) // Create a new instance of the accessor
 }
 
 func (r *StorageResource) GetType() string {
@@ -35,16 +45,25 @@ func (abs *StorageResource) ConvertToPricedResource(t tools.DataType, selectedIn
 	if t != tools.STORAGE_RESOURCE {
 		return nil, errors.New("not the proper type expected : cannot convert to priced resource : have " + t.String() + " wait Storage")
 	}
-	p, err := abs.AbstractInstanciatedResource.ConvertToPricedResource(t, selectedInstance, selectedPartnership, selectedBuyingStrategy, selectedStrategy, selectedBookingModeIndex, request)
+	p, err := ConvertToPricedResource[*StorageResourcePricingProfile](t, selectedInstance, selectedPartnership, selectedBuyingStrategy, selectedStrategy, selectedBookingModeIndex, abs, request)
 	if err != nil {
 		return nil, err
 	}
-	priced := p.(*PricedResource)
+	priced := p.(*PricedResource[*StorageResourcePricingProfile])
 	return &PricedStorageResource{
 		PricedResource: *priced,
 	}, nil
 }
 
+func (ri *StorageResource) StoreDraftDefault() {
+	ri.AbstractObject.StoreDraftDefault()
+	ri.Env = append(ri.Env, models.Param{
+		Attr:     "source",
+		Value:    "[resource]instance.source",
+		Readonly: true,
+	})
+}
+
 type StorageResourceInstance struct {
 	ResourceInstance[*StorageResourcePartnership]
 	Source        string           `bson:"source,omitempty" json:"source,omitempty"` // Source is the source of the storage
@@ -58,6 +77,10 @@ type StorageResourceInstance struct {
 	Throughput    string           `bson:"throughput,omitempty" json:"throughput,omitempty"` // Throughput is the throughput of the storage
 }
 
+// IsPeerless is always false for storage instances: a storage resource is
+// infrastructure owned by a peer and can never be declared peerless.
+func (ri *StorageResourceInstance) IsPeerless() bool { return false }
+
 func NewStorageResourceInstance(name string, peerID string) ResourceInstanceITF {
 	return &StorageResourceInstance{
 		ResourceInstance: ResourceInstance[*StorageResourcePartnership]{
@@ -69,30 +92,6 @@ func NewStorageResourceInstance(name string, peerID string) ResourceInstanceITF
 	}
 }
 
-func (ri *StorageResourceInstance) ClearEnv() {
-	ri.Env = []models.Param{}
-	ri.Inputs = []models.Param{}
-	ri.Outputs = []models.Param{}
-}
-
-func (ri *StorageResourceInstance) StoreDraftDefault() {
-	found := false
-	for _, p := range ri.ResourceInstance.Env {
-		if p.Attr == "source" {
-			found = true
-			break
-		}
-	}
-	if !found {
-		ri.ResourceInstance.Env = append(ri.ResourceInstance.Env, models.Param{
-			Attr:     "source",
-			Value:    ri.Source,
-			Readonly: true,
-		})
-	}
-	ri.ResourceInstance.StoreDraftDefault()
-}
-
 type StorageResourcePartnership struct {
 	ResourcePartnerShip[*StorageResourcePricingProfile]
 	MaxSizeGBAllowed     float64 `json:"allowed_gb,omitempty" bson:"allowed_gb,omitempty"`
@@ -118,7 +117,7 @@ func (t PrivilegeStoragePricingStrategy) String() string {
 type StorageResourcePricingStrategy int
 
 const (
-	PER_DATA_STORED StorageResourcePricingStrategy = iota + 6
+	PER_DATA_STORED StorageResourcePricingStrategy = iota + 7
 	PER_TB_STORED
 	PER_GB_STORED
 	PER_MB_STORED
@@ -170,7 +169,7 @@ type StorageResourcePricingProfile struct {
 }
 
 func (p *StorageResourcePricingProfile) IsPurchasable() bool {
-	return p.Pricing.BuyingStrategy != pricing.UNDEFINED_SUBSCRIPTION
+	return p.Pricing.BuyingStrategy == pricing.PERMANENT
 }
 
 func (p *StorageResourcePricingProfile) IsBooked() bool {
@@ -181,30 +180,43 @@ func (p *StorageResourcePricingProfile) IsBooked() bool {
 }
 
 type PricedStorageResource struct {
-	PricedResource
+	PricedResource[*StorageResourcePricingProfile]
 	UsageStorageGB float64 `json:"storage_gb,omitempty" bson:"storage_gb,omitempty"`
 }
 
+func (r *PricedStorageResource) ensurePricing() {
+	if r.SelectedPricing == nil {
+		r.SelectedPricing = &StorageResourcePricingProfile{}
+	}
+}
+
+func (r *PricedStorageResource) IsPurchasable() bool {
+	r.ensurePricing()
+	return r.SelectedPricing.IsPurchasable()
+}
+
+func (r *PricedStorageResource) IsBooked() bool {
+	r.ensurePricing()
+	return r.SelectedPricing.IsBooked()
+}
+
 func (r *PricedStorageResource) GetType() tools.DataType {
 	return tools.STORAGE_RESOURCE
 }
 
 func (r *PricedStorageResource) GetPriceHT() (float64, error) {
+	r.ensurePricing()
 	if r.BookingConfiguration == nil {
 		r.BookingConfiguration = &BookingConfiguration{}
 	}
-	fmt.Println("GetPriceHT", r.BookingConfiguration.UsageStart, r.BookingConfiguration.UsageEnd)
 	now := time.Now()
 	if r.BookingConfiguration.UsageStart == nil {
 		r.BookingConfiguration.UsageStart = &now
 	}
 	if r.BookingConfiguration.UsageEnd == nil {
-		add := r.BookingConfiguration.UsageStart.Add(time.Duration(1 * time.Hour))
+		add := r.BookingConfiguration.UsageStart.Add(time.Duration(5 * time.Minute))
 		r.BookingConfiguration.UsageEnd = &add
 	}
-	if r.SelectedPricing == nil {
-		return 0, errors.New("pricing profile must be set on Priced Storage" + r.ResourceID)
-	}
 	pricing := r.SelectedPricing
 	var err error
 	amountOfData := float64(1)

models/resources/tests/compute_test.go

@@ -37,7 +37,7 @@ func TestComputeResource_ConvertToPricedResource(t *testing.T) {
 
 func TestComputeResourcePricingProfile_GetPriceHT_CPUs(t *testing.T) {
 	start := time.Now()
-	end := start.Add(1 * time.Hour)
+	end := start.Add(5 * time.Minute)
 	profile := resources.ComputeResourcePricingProfile{
 		CPUsPrices: map[string]float64{"Xeon": 2.0},
 		ExploitPricingProfile: pricing.ExploitPricingProfile[pricing.TimePricingStrategy]{
@@ -61,11 +61,18 @@ func TestComputeResourcePricingProfile_GetPriceHT_InvalidParams(t *testing.T) {
 
 func TestPricedComputeResource_GetPriceHT(t *testing.T) {
 	start := time.Now()
-	end := start.Add(1 * time.Hour)
+	end := start.Add(5 * time.Minute)
 	r := resources.PricedComputeResource{
-		PricedResource: resources.PricedResource{
+		PricedResource: resources.PricedResource[*resources.ComputeResourcePricingProfile]{
 			ResourceID: "comp456",
-			SelectedPricing: &MockPricingProfile{ReturnCost: 1.0},
+			SelectedPricing: &resources.ComputeResourcePricingProfile{
+				CPUsPrices: map[string]float64{"Xeon": 2.0},
+				ExploitPricingProfile: pricing.ExploitPricingProfile[pricing.TimePricingStrategy]{
+					AccessPricingProfile: pricing.AccessPricingProfile[pricing.TimePricingStrategy]{
+						Pricing: pricing.PricingStrategy[pricing.TimePricingStrategy]{Price: 1.0},
+					},
+				},
+			},
 			BookingConfiguration: &resources.BookingConfiguration{
 				UsageStart:               &start,
 				UsageEnd:                 &end,
@@ -73,8 +80,8 @@ func TestPricedComputeResource_GetPriceHT(t *testing.T) {
 			},
 		},
 		CPUsLocated: map[string]float64{"Xeon": 2},
-		GPUsLocated: map[string]float64{"Tesla": 1},
+		GPUsLocated: map[string]float64{},
-		RAMLocated:  4,
+		RAMLocated:  0,
 	}
 
 	price, err := r.GetPriceHT()
@@ -84,7 +91,7 @@ func TestPricedComputeResource_GetPriceHT(t *testing.T) {
 
 func TestPricedComputeResource_GetPriceHT_MissingProfile(t *testing.T) {
 	r := resources.PricedComputeResource{
-		PricedResource: resources.PricedResource{
+		PricedResource: resources.PricedResource[*resources.ComputeResourcePricingProfile]{
 			ResourceID: "comp789",
 		},
 	}

models/resources/tests/data_test.go

@@ -4,7 +4,6 @@ import (
 	"testing"
 	"time"
 
-	"cloud.o-forge.io/core/oc-lib/models/common/models"
 	"cloud.o-forge.io/core/oc-lib/models/common/pricing"
 	"cloud.o-forge.io/core/oc-lib/models/resources"
 	"cloud.o-forge.io/core/oc-lib/tools"
@@ -34,23 +33,6 @@ func TestDataResource_ConvertToPricedResource(t *testing.T) {
 	assert.Nil(t, nilRes)
 }
 
-func TestDataInstance_StoreDraftDefault(t *testing.T) {
-	di := &resources.DataInstance{
-		Source: "test-src",
-		ResourceInstance: resources.ResourceInstance[*resources.DataResourcePartnership]{
-			Env: []models.Param{},
-		},
-	}
-	di.StoreDraftDefault()
-	assert.Len(t, di.ResourceInstance.Env, 1)
-	assert.Equal(t, "source", di.ResourceInstance.Env[0].Attr)
-	assert.Equal(t, "test-src", di.ResourceInstance.Env[0].Value)
-
-	// Call again, should not duplicate
-	di.StoreDraftDefault()
-	assert.Len(t, di.ResourceInstance.Env, 1)
-}
-
 func TestDataResourcePricingStrategy_GetQuantity(t *testing.T) {
 	tests := []struct {
 		strategy resources.DataResourcePricingStrategy
@@ -76,13 +58,13 @@ func TestDataResourcePricingStrategy_GetQuantity(t *testing.T) {
 
 func TestDataResourcePricingProfile_IsPurchased(t *testing.T) {
 	profile := &resources.DataResourcePricingProfile{}
-	profile.Pricing.BuyingStrategy = pricing.SUBSCRIPTION
+	profile.Pricing.BuyingStrategy = pricing.PERMANENT
 	assert.True(t, profile.IsPurchasable())
 }
 
 func TestPricedDataResource_GetPriceHT(t *testing.T) {
 	now := time.Now()
-	later := now.Add(1 * time.Hour)
+	later := now.Add(5 * time.Minute)
 	mockPrice := 42.0
 
 	pricingProfile := &resources.DataResourcePricingProfile{AccessPricingProfile: pricing.AccessPricingProfile[resources.DataResourcePricingStrategy]{
@@ -91,7 +73,7 @@ func TestPricedDataResource_GetPriceHT(t *testing.T) {
 	pricingProfile.Pricing.OverrideStrategy = resources.PER_GB_DOWNLOADED
 
 	r := &resources.PricedDataResource{
-		PricedResource: resources.PricedResource{
+		PricedResource: resources.PricedResource[*resources.DataResourcePricingProfile]{
 			SelectedPricing: pricingProfile,
 			BookingConfiguration: &resources.BookingConfiguration{
 				UsageStart: &now,
@@ -107,7 +89,7 @@ func TestPricedDataResource_GetPriceHT(t *testing.T) {
 
 func TestPricedDataResource_GetPriceHT_NoProfiles(t *testing.T) {
 	r := &resources.PricedDataResource{
-		PricedResource: resources.PricedResource{
+		PricedResource: resources.PricedResource[*resources.DataResourcePricingProfile]{
 			ResourceID: "test-resource",
 		},
 	}

models/resources/tests/priced_resource_test.go

@@ -36,7 +36,7 @@ func (m *MockPricingProfile) GetPriceHT(amount float64, explicitDuration float64
 // ---- Tests ----
 
 func TestGetIDAndCreatorAndType(t *testing.T) {
-	r := resources.PricedResource{
+	r := resources.PricedResource[pricing.PricingProfileITF]{
 		ResourceID:   "res-123",
 		CreatorID:    "user-abc",
 		ResourceType: tools.DATA_RESOURCE,
@@ -48,23 +48,23 @@ func TestGetIDAndCreatorAndType(t *testing.T) {
 
 func TestIsPurchased(t *testing.T) {
 	t.Run("nil selected pricing returns false", func(t *testing.T) {
-		r := &resources.PricedResource{}
+		r := &resources.PricedResource[pricing.PricingProfileITF]{}
 		assert.False(t, r.IsPurchasable())
 	})
 
 	t.Run("returns true if pricing profile is purchased", func(t *testing.T) {
 		mock := &MockPricingProfile{Purchased: true}
-		r := &resources.PricedResource{SelectedPricing: mock}
+		r := &resources.PricedResource[pricing.PricingProfileITF]{SelectedPricing: mock}
 		assert.True(t, r.IsPurchasable())
 	})
 }
 
 func TestGetAndSetLocationStartEnd(t *testing.T) {
-	r := &resources.PricedResource{}
+	r := &resources.PricedResource[pricing.PricingProfileITF]{}
 
 	now := time.Now()
 	r.SetLocationStart(now)
-	r.SetLocationEnd(now.Add(2 * time.Hour))
+	r.SetLocationEnd(now.Add(10 * time.Minute))
 
 	assert.Equal(t, now, *r.GetLocationStart())
 	assert.Equal(t, now.Add(2*time.Hour), *r.GetLocationEnd())
@@ -72,7 +72,7 @@ func TestGetAndSetLocationStartEnd(t *testing.T) {
 
 func TestGetExplicitDurationInS(t *testing.T) {
 	t.Run("uses explicit duration if set", func(t *testing.T) {
-		r := &resources.PricedResource{BookingConfiguration: &resources.BookingConfiguration{
+		r := &resources.PricedResource[pricing.PricingProfileITF]{BookingConfiguration: &resources.BookingConfiguration{
 			ExplicitBookingDurationS: 3600,
 		},
 		}
@@ -81,8 +81,8 @@ func TestGetExplicitDurationInS(t *testing.T) {
 
 	t.Run("computes duration from start and end", func(t *testing.T) {
 		start := time.Now()
-		end := start.Add(2 * time.Hour)
+		end := start.Add(10 * time.Minute)
-		r := &resources.PricedResource{
+		r := &resources.PricedResource[pricing.PricingProfileITF]{
 			BookingConfiguration: &resources.BookingConfiguration{
 				UsageStart: &start, UsageEnd: &end,
 			},
@@ -91,14 +91,14 @@ func TestGetExplicitDurationInS(t *testing.T) {
 	})
 
 	t.Run("defaults to 1 hour when times not set", func(t *testing.T) {
-		r := &resources.PricedResource{}
+		r := &resources.PricedResource[pricing.PricingProfileITF]{}
 		assert.InDelta(t, 3600.0, r.GetExplicitDurationInS(), 0.1)
 	})
 }
 
 func TestGetPriceHT(t *testing.T) {
 	t.Run("returns error if no pricing profile", func(t *testing.T) {
-		r := &resources.PricedResource{ResourceID: "no-profile"}
+		r := &resources.PricedResource[pricing.PricingProfileITF]{ResourceID: "no-profile"}
 		price, err := r.GetPriceHT()
 		require.Error(t, err)
 		assert.Contains(t, err.Error(), "pricing profile must be set")
@@ -107,7 +107,7 @@ func TestGetPriceHT(t *testing.T) {
 
 	t.Run("defaults BookingConfiguration when nil", func(t *testing.T) {
 		mock := &MockPricingProfile{ReturnCost: 42.0}
-		r := &resources.PricedResource{
+		r := &resources.PricedResource[pricing.PricingProfileITF]{
 			SelectedPricing: mock,
 		}
 		price, err := r.GetPriceHT()
@@ -117,9 +117,9 @@ func TestGetPriceHT(t *testing.T) {
 
 	t.Run("returns error if profile GetPriceHT fails", func(t *testing.T) {
 		start := time.Now()
-		end := start.Add(1 * time.Hour)
+		end := start.Add(5 * time.Minute)
 		mock := &MockPricingProfile{ReturnErr: true}
-		r := &resources.PricedResource{
+		r := &resources.PricedResource[pricing.PricingProfileITF]{
 			SelectedPricing: mock,
 			BookingConfiguration: &resources.BookingConfiguration{
 				UsageStart: &start,
@@ -133,9 +133,9 @@ func TestGetPriceHT(t *testing.T) {
 
 	t.Run("uses SelectedPricing if set", func(t *testing.T) {
 		start := time.Now()
-		end := start.Add(1 * time.Hour)
+		end := start.Add(5 * time.Minute)
 		mock := &MockPricingProfile{ReturnCost: 10.0}
-		r := &resources.PricedResource{
+		r := &resources.PricedResource[pricing.PricingProfileITF]{
 			SelectedPricing: mock,
 			BookingConfiguration: &resources.BookingConfiguration{
 				UsageStart: &start,

models/resources/tests/processing_test.go

@@ -23,47 +23,40 @@ func TestPricedProcessingResource_GetType(t *testing.T) {
 
 func TestPricedProcessingResource_GetExplicitDurationInS(t *testing.T) {
 	now := time.Now()
-	after := now.Add(2 * time.Hour)
+	after := now.Add(10 * time.Minute)
 
 	tests := []struct {
 		name     string
 		input    PricedProcessingResource
 		expected float64
 	}{
-		{
-			name: "Service without explicit duration",
-			input: PricedProcessingResource{
-				IsService: true,
-			},
-			expected: -1,
-		},
 		{
 			name: "Nil start time, non-service",
 			input: PricedProcessingResource{
-				PricedResource: PricedResource{
+				PricedResource: PricedResource[*ProcessingResourcePricingProfile]{
 					BookingConfiguration: &resources.BookingConfiguration{
 						UsageStart: nil,
 					},
 				},
 			},
-			expected: float64((1 * time.Hour).Seconds()),
+			expected: float64((5 * time.Minute).Seconds()),
 		},
 		{
 			name: "Duration computed from start and end",
 			input: PricedProcessingResource{
-				PricedResource: PricedResource{
+				PricedResource: PricedResource[*ProcessingResourcePricingProfile]{
 					BookingConfiguration: &resources.BookingConfiguration{
 						UsageStart: &now,
 						UsageEnd:   &after,
 					},
 				},
 			},
-			expected: float64((2 * time.Hour).Seconds()),
+			expected: float64((10 * time.Minute).Seconds()),
 		},
 		{
 			name: "Explicit duration takes precedence",
 			input: PricedProcessingResource{
-				PricedResource: PricedResource{
+				PricedResource: PricedResource[*ProcessingResourcePricingProfile]{
 					BookingConfiguration: &resources.BookingConfiguration{
 						ExplicitBookingDurationS: 1337,
 					},
@@ -89,14 +82,14 @@ func TestProcessingResource_GetAccessor(t *testing.T) {
 
 func TestProcessingResourcePricingProfile_GetPriceHT(t *testing.T) {
 	start := time.Now()
-	end := start.Add(2 * time.Hour)
+	end := start.Add(10 * time.Minute)
 	mockPricing := pricing.AccessPricingProfile[pricing.TimePricingStrategy]{
 		Pricing: pricing.PricingStrategy[pricing.TimePricingStrategy]{
 			Price: 100.0,
 		},
 	}
 	profile := &ProcessingResourcePricingProfile{AccessPricingProfile: mockPricing}
-	price, err := profile.GetPriceHT(0, 0, start, end, []*pricing.PricingVariation{})
+	price, err := profile.GetPriceHT(1, 0, start, end, []*pricing.PricingVariation{})
 	assert.NoError(t, err)
 	assert.Equal(t, 100.0, price)
 }

models/resources/tests/resource_test.go

@@ -81,8 +81,8 @@ func TestGetSelectedInstance_NoIndex(t *testing.T) {
 }
 
 func TestCanUpdate_WhenOnlyStateDiffers(t *testing.T) {
-	resource := &resources.AbstractResource{AbstractObject: utils.AbstractObject{IsDraft: false}}
+	resource := &resources.AbstractResource{AbstractObject: utils.AbstractObject{IsDraft: true}}
-	set := &MockDBObject{isDraft: true}
+	set := &MockDBObject{isDraft: false}
 	canUpdate, updated := resource.CanUpdate(set)
 	assert.True(t, canUpdate)
 	assert.Equal(t, set, updated)
@@ -105,12 +105,15 @@ type FakeResource struct {
 	resources.AbstractInstanciatedResource[*MockInstance]
 }
 
-func (f *FakeResource) SetAllowedInstances(*tools.APIRequest, ...string) {}
+func (f *FakeResource) SetAllowedInstances(req *tools.APIRequest, instance_id ...string) []resources.ResourceInstanceITF {
+	return nil
+}
+func (f *FakeResource) ConvertToPricedResource(t tools.DataType, a *int, b *int, c *int, d *int, e *int, req *tools.APIRequest) (pricing.PricedItemITF, error) {
+	return nil, nil
+}
 func (f *FakeResource) VerifyAuth(string, *tools.APIRequest) bool { return true }
 
 func TestNewAccessor_ReturnsValid(t *testing.T) {
-	acc := resources.NewAccessor[*FakeResource](tools.COMPUTE_RESOURCE, &tools.APIRequest{}, func() utils.DBObject {
+	acc := resources.NewAccessor[*FakeResource](tools.COMPUTE_RESOURCE, &tools.APIRequest{})
-		return &FakeResource{}
-	})
 	assert.NotNil(t, acc)
 }

models/resources/tests/storage_test.go

@@ -3,7 +3,6 @@ package resources_test
 import (
 	"testing"
 
-	"cloud.o-forge.io/core/oc-lib/models/common/models"
 	"cloud.o-forge.io/core/oc-lib/tools"
 	"github.com/stretchr/testify/assert"
 
@@ -37,36 +36,6 @@ func TestStorageResource_ConvertToPricedResource_InvalidType(t *testing.T) {
 	assert.Nil(t, priced)
 }
 
-func TestStorageResourceInstance_ClearEnv(t *testing.T) {
-	inst := &resources.StorageResourceInstance{
-		ResourceInstance: resources.ResourceInstance[*resources.StorageResourcePartnership]{
-			Env:     []models.Param{{Attr: "A"}},
-			Inputs:  []models.Param{{Attr: "B"}},
-			Outputs: []models.Param{{Attr: "C"}},
-		},
-	}
-
-	inst.ClearEnv()
-	assert.Empty(t, inst.Env)
-	assert.Empty(t, inst.Inputs)
-	assert.Empty(t, inst.Outputs)
-}
-
-func TestStorageResourceInstance_StoreDraftDefault(t *testing.T) {
-	inst := &resources.StorageResourceInstance{
-		Source: "my-source",
-		ResourceInstance: resources.ResourceInstance[*resources.StorageResourcePartnership]{
-			Env: []models.Param{},
-		},
-	}
-
-	inst.StoreDraftDefault()
-	assert.Len(t, inst.Env, 1)
-	assert.Equal(t, "source", inst.Env[0].Attr)
-	assert.Equal(t, "my-source", inst.Env[0].Value)
-	assert.True(t, inst.Env[0].Readonly)
-}
-
 func TestStorageResourcePricingStrategy_GetQuantity(t *testing.T) {
 	tests := []struct {
 		strategy resources.StorageResourcePricingStrategy
@@ -96,7 +65,7 @@ func TestStorageResourcePricingStrategy_GetQuantity_Invalid(t *testing.T) {
 
 func TestPricedStorageResource_GetPriceHT_NoProfiles(t *testing.T) {
 	res := &resources.PricedStorageResource{
-		PricedResource: resources.PricedResource{
+		PricedResource: resources.PricedResource[*resources.StorageResourcePricingProfile]{
 			ResourceID: "res-id",
 		},
 	}

models/resources/workflow.go

@@ -16,7 +16,7 @@ type WorkflowResource struct {
 }
 
 func (d *WorkflowResource) GetAccessor(request *tools.APIRequest) utils.Accessor {
-	return NewAccessor[*WorkflowResource](tools.WORKFLOW_RESOURCE, request, func() utils.DBObject { return &WorkflowResource{} })
+	return NewAccessor[*WorkflowResource](tools.WORKFLOW_RESOURCE, request)
 }
 
 func (r *WorkflowResource) AddInstances(instance ResourceInstanceITF) {
@@ -30,8 +30,9 @@ func (d *WorkflowResource) ClearEnv() utils.DBObject {
 	return d
 }
 
-func (w *WorkflowResource) SetAllowedInstances(request *tools.APIRequest, ids ...string) {
+func (w *WorkflowResource) SetAllowedInstances(request *tools.APIRequest, ids ...string) []ResourceInstanceITF {
 	/* EMPTY */
+	return []ResourceInstanceITF{}
 }
 
 func (r *WorkflowResource) GetSelectedInstance(selected *int) ResourceInstanceITF {
@@ -39,7 +40,7 @@ func (r *WorkflowResource) GetSelectedInstance(selected *int) ResourceInstanceIT
 }
 
 func (w *WorkflowResource) ConvertToPricedResource(t tools.DataType, selectedInstance *int, selectedPartnership *int, selectedBuyingStrategy *int, selectedStrategy *int, selectedBookingModeIndex *int, request *tools.APIRequest) (pricing.PricedItemITF, error) {
-	return &PricedResource{
+	return &PricedResource[*pricing.ExploitPricingProfile[pricing.TimePricingStrategy]]{
 		Name:         w.Name,
 		Logo:         w.Logo,
 		ResourceID:   w.UUID,

models/utils/abstracts.go

@@ -31,6 +31,7 @@ const (
  */
 type AbstractObject struct {
 	UUID          string     `json:"id,omitempty" bson:"id,omitempty" validate:"required"`
+	NotInCatalog  bool       `json:"not_in_catalog" bson:"not_in_catalog" default:"false"`
 	Name          string     `json:"name,omitempty" bson:"name,omitempty" validate:"required"`
 	IsDraft       bool       `json:"is_draft" bson:"is_draft" default:"false"`
 	CreatorID     string     `json:"creator_id,omitempty" bson:"creator_id,omitempty"`
@@ -43,9 +44,29 @@ type AbstractObject struct {
 	Signature     []byte     `bson:"signature,omitempty" json:"signature,omitempty"`
 }
 
+func (ri *AbstractObject) Extend(typ ...string) map[string][]tools.DataType {
+	dt := map[string][]tools.DataType{}
+	for _, t := range typ {
+		switch t {
+		case "creator", "user_creator", "user_updater":
+			if _, ok := dt[t]; !ok {
+				dt[t] = []tools.DataType{}
+			}
+			dt[t] = append(dt[t], tools.PEER)
+		}
+	}
+	return dt
+}
+
 func (ri *AbstractObject) GetAccessor(request *tools.APIRequest) Accessor {
 	return nil
 }
+func (r *AbstractObject) SetNotInCatalog(ok bool) {
+	r.NotInCatalog = ok
+}
+func (r *AbstractObject) IsNotInCatalog() bool {
+	return r.NotInCatalog
+}
 
 func (r *AbstractObject) Unsign() {
 	r.Signature = nil
@@ -176,6 +197,10 @@ type AbstractAccessor[T DBObject] struct {
 	NotImplemented        []string
 }
 
+func (r *AbstractAccessor[T]) NewObj() DBObject {
+	return r.New()
+}
+
 func (r *AbstractAccessor[T]) ShouldVerifyAuth() bool {
 	return true
 }
@@ -255,12 +280,12 @@ func (a *AbstractAccessor[T]) LoadOne(id string) (DBObject, int, error) {
 	}, a)
 }
 
-func (a *AbstractAccessor[T]) LoadAll(isDraft bool) ([]ShallowDBObject, int, error) {
+func (a *AbstractAccessor[T]) LoadAll(isDraft bool, offset int64, limit int64) ([]ShallowDBObject, int, error) {
-	return GenericLoadAll[T](a.GetExec(isDraft), isDraft, a)
+	return GenericLoadAll[T](a.GetExec(isDraft), isDraft, a, offset, limit)
 }
 
-func (a *AbstractAccessor[T]) Search(filters *dbs.Filters, search string, isDraft bool) ([]ShallowDBObject, int, error) {
+func (a *AbstractAccessor[T]) Search(filters *dbs.Filters, search string, isDraft bool, offset int64, limit int64) ([]ShallowDBObject, int, error) {
-	return GenericSearch[T](filters, search, a.New().GetObjectFilters(search), a.GetExec(isDraft), isDraft, a)
+	return GenericSearch[T](filters, search, a.New().GetObjectFilters(search), a.GetExec(isDraft), isDraft, a, offset, limit)
 }
 
 func (a *AbstractAccessor[T]) GetExec(isDraft bool) func(DBObject) ShallowDBObject {

models/utils/change_bus.go

@@ -0,0 +1,60 @@
+package utils
+
+import (
+	"sync"
+
+	"cloud.o-forge.io/core/oc-lib/tools"
+)
+
+// ChangeEvent is fired whenever a DB object is created, updated or deleted
+// within this process. Deleted=true means the object was removed; Object is
+// the last known snapshot before deletion.
+type ChangeEvent struct {
+	DataType tools.DataType
+	ID       string
+	Object   ShallowDBObject // nil only when the load after the write failed
+	Deleted  bool
+}
+
+var (
+	changeBusMu sync.RWMutex
+	changeBus   = map[tools.DataType][]chan ChangeEvent{}
+)
+
+// SubscribeChanges returns a channel that receives ChangeEvents for dt
+// whenever an object of that type is written or deleted in this process.
+// Call the returned cancel function to unsubscribe; after that the channel
+// will no longer receive events (it is not closed — use a context to stop
+// reading).
+func SubscribeChanges(dt tools.DataType) (<-chan ChangeEvent, func()) {
+	ch := make(chan ChangeEvent, 32)
+	changeBusMu.Lock()
+	changeBus[dt] = append(changeBus[dt], ch)
+	changeBusMu.Unlock()
+	return ch, func() {
+		changeBusMu.Lock()
+		subs := changeBus[dt]
+		for i, c := range subs {
+			if c == ch {
+				changeBus[dt] = append(subs[:i], subs[i+1:]...)
+				break
+			}
+		}
+		changeBusMu.Unlock()
+	}
+}
+
+// NotifyChange broadcasts a ChangeEvent to all current subscribers for dt.
+// Non-blocking: events are dropped for subscribers whose buffer is full.
+func NotifyChange(dt tools.DataType, id string, obj ShallowDBObject, deleted bool) {
+	changeBusMu.RLock()
+	subs := changeBus[dt]
+	changeBusMu.RUnlock()
+	evt := ChangeEvent{DataType: dt, ID: id, Object: obj, Deleted: deleted}
+	for _, ch := range subs {
+		select {
+		case ch <- evt:
+		default:
+		}
+	}
+}

models/utils/common.go

@@ -17,6 +17,9 @@ type Owner struct {
 }
 
 func VerifyAccess(a Accessor, id string) error {
+	if a == nil {
+		return errors.New("no accessor to verify access")
+	}
 	data, _, err := a.LoadOne(id)
 	if err != nil {
 		return err
@@ -32,7 +35,6 @@ func GenericStoreOne(data DBObject, a Accessor) (DBObject, int, error) {
 	if data.GetID() == "" {
 		data.GenerateID()
 	}
-	data.SetID(data.GetID())
 	data.StoreDraftDefault()
 	data.UpToDate(a.GetUser(), a.GetPeerID(), true)
 	data.Unsign()
@@ -52,7 +54,7 @@ func GenericStoreOne(data DBObject, a Accessor) (DBObject, int, error) {
 	if a.ShouldVerifyAuth() && !data.VerifyAuth("store", a.GetRequest()) {
 		return nil, 403, errors.New("you are not allowed to access : " + a.GetType().String())
 	}
-	if cursor, _, _ := a.Search(&f, "", data.IsDrafted()); len(cursor) > 0 {
+	if cursor, _, _ := a.Search(&f, "", data.IsDrafted(), 0, 10); len(cursor) > 0 {
 		return nil, 409, errors.New(a.GetType().String() + " with name " + data.GetName() + " already exists")
 	}
 	err := validate.Struct(data)
@@ -64,26 +66,38 @@ func GenericStoreOne(data DBObject, a Accessor) (DBObject, int, error) {
 		a.GetLogger().Error().Msg("Could not store " + data.GetName() + " to db. Error: " + err.Error())
 		return nil, code, err
 	}
-	return a.LoadOne(id)
+	result, rcode, rerr := a.LoadOne(id)
+	if rerr == nil && result != nil {
+		go NotifyChange(a.GetType(), result.GetID(), result, false)
+	}
+	return result, rcode, rerr
 }
 
 // GenericLoadOne loads one object from the database (generic)
 func GenericDeleteOne(id string, a Accessor) (DBObject, int, error) {
 	res, code, err := a.LoadOne(id)
+	if err != nil {
+		return res, code, err
+	}
+	if res == nil {
+		return res, code, errors.New("not found")
+	}
+	return GenericDelete(res, a)
+}
+
+func GenericDelete(res DBObject, a Accessor) (DBObject, int, error) {
 	if !res.CanDelete() {
 		return nil, 403, errors.New("you are not allowed to delete :" + a.GetType().String())
 	}
-	if err != nil {
-		return nil, code, err
-	}
 	if a.ShouldVerifyAuth() && !res.VerifyAuth("delete", a.GetRequest()) {
 		return nil, 403, errors.New("you are not allowed to access " + a.GetType().String())
 	}
-	_, code, err = mongo.MONGOService.DeleteOne(id, a.GetType().String())
+	_, code, err := mongo.MONGOService.DeleteOne(res.GetID(), a.GetType().String())
 	if err != nil {
-		a.GetLogger().Error().Msg("Could not delete " + id + " to db. Error: " + err.Error())
+		a.GetLogger().Error().Msg("Could not delete " + res.GetID() + " to db. Error: " + err.Error())
 		return nil, code, err
 	}
+	go NotifyChange(a.GetType(), res.GetID(), res, true)
 	return res, 200, nil
 }
 
@@ -92,33 +106,46 @@ func ModelGenericUpdateOne(change map[string]interface{}, id string, a Accessor)
 	if err != nil {
 		return nil, nil, c, err
 	}
-	obj := &AbstractObject{}
+	obj := a.NewObj()
 	b, _ := json.Marshal(r)
 	json.Unmarshal(b, obj)
-	ok, r := r.CanUpdate(obj)
+	if !a.GetRequest().Admin {
+		var ok bool
+		ok, r = r.CanUpdate(obj)
 		if !ok {
 			return nil, nil, 403, errors.New("you are not allowed to update :" + a.GetType().String())
 		}
+		if a.ShouldVerifyAuth() && !r.VerifyAuth("update", a.GetRequest()) {
+			return nil, nil, 403, errors.New("you are not allowed to access :" + a.GetType().String())
+		}
+	}
 	r.UpToDate(a.GetUser(), a.GetPeerID(), false)
 	if a.GetPeerID() == r.GetCreatorID() {
 		r.Unsign()
 		r.Sign()
 	}
-	if a.ShouldVerifyAuth() && !r.VerifyAuth("update", a.GetRequest()) {
-		return nil, nil, 403, errors.New("you are not allowed to access :" + a.GetType().String())
-	}
-	loaded := r.Serialize(r) // get the loaded object
 
+	loaded := r.Serialize(r)   // get the loaded object
 	for k, v := range change { // apply the changes, with a flatten method
 		loaded[k] = v
 	}
-	return r, loaded, 200, nil
+	newObj := a.NewObj()
+	b, err = json.Marshal(loaded)
+	if err != nil {
+		return nil, loaded, 400, nil
+	}
+	err = json.Unmarshal(b, newObj)
+	if err != nil {
+		return nil, loaded, 400, nil
+	}
+	return newObj, loaded, 200, nil
 }
 
 // GenericLoadOne loads one object from the database (generic)
 // json expected in entry is a flatted object no need to respect the inheritance hierarchy
 func GenericUpdateOne(change map[string]interface{}, id string, a Accessor) (DBObject, int, error) {
 	obj, loaded, c, err := ModelGenericUpdateOne(change, id, a)
+
 	if err != nil {
 		return nil, c, err
 	}
@@ -127,7 +154,11 @@ func GenericUpdateOne(change map[string]interface{}, id string, a Accessor) (DBO
 		a.GetLogger().Error().Msg("Could not update " + id + " to db. Error: " + err.Error())
 		return nil, code, err
 	}
-	return a.LoadOne(id)
+	result, rcode, rerr := a.LoadOne(id)
+	if rerr == nil && result != nil {
+		go NotifyChange(a.GetType(), result.GetID(), result, false)
+	}
+	return result, rcode, rerr
 }
 
 func GenericLoadOne[T DBObject](id string, data T, f func(DBObject) (DBObject, int, error), a Accessor) (DBObject, int, error) {
@@ -138,7 +169,6 @@ func GenericLoadOne[T DBObject](id string, data T, f func(DBObject) (DBObject, i
 	if err = res_mongo.Decode(data); err != nil {
 		return nil, 400, err
 	}
-
 	if a.ShouldVerifyAuth() && !data.VerifyAuth("get", a.GetRequest()) {
 		return nil, 403, errors.New("you are not allowed to access :" + a.GetType().String())
 	}
@@ -163,17 +193,27 @@ func genericLoadAll[T DBObject](res *mgb.Cursor, code int, err error, onlyDraft
 	return objs, 200, nil
 }
 
-func GenericLoadAll[T DBObject](f func(DBObject) ShallowDBObject, onlyDraft bool, wfa Accessor) ([]ShallowDBObject, int, error) {
+func GenericLoadAll[T DBObject](f func(DBObject) ShallowDBObject, onlyDraft bool, wfa Accessor, opts ...int64) ([]ShallowDBObject, int, error) {
-	res_mongo, code, err := mongo.MONGOService.LoadAll(wfa.GetType().String())
+	offset := int64(0)
+	limit := int64(0)
+	if len(opts) > 1 {
+		offset = opts[0]
+	}
+	res_mongo, code, err := mongo.MONGOService.LoadAll(wfa.GetType().String(), offset, limit)
 	return genericLoadAll[T](res_mongo, code, err, onlyDraft, f, wfa)
 }
 
 func GenericSearch[T DBObject](filters *dbs.Filters, search string, defaultFilters *dbs.Filters,
-	f func(DBObject) ShallowDBObject, onlyDraft bool, wfa Accessor) ([]ShallowDBObject, int, error) {
+	f func(DBObject) ShallowDBObject, onlyDraft bool, wfa Accessor, opts ...int64) ([]ShallowDBObject, int, error) {
 	if filters == nil && search != "" {
 		filters = defaultFilters
 	}
-	res_mongo, code, err := mongo.MONGOService.Search(filters, wfa.GetType().String())
+	offset := int64(0)
+	limit := int64(0)
+	if len(opts) > 1 {
+		offset = opts[0]
+	}
+	res_mongo, code, err := mongo.MONGOService.Search(filters, wfa.GetType().String(), offset, limit)
 	return genericLoadAll[T](res_mongo, code, err, onlyDraft, f, wfa)
 }
 
@@ -185,7 +225,11 @@ func GenericRawUpdateOne(set DBObject, id string, a Accessor) (DBObject, int, er
 		a.GetLogger().Error().Msg("Could not update " + id + " to db. Error: " + err.Error())
 		return nil, code, err
 	}
-	return a.LoadOne(id)
+	result, rcode, rerr := a.LoadOne(id)
+	if rerr == nil && result != nil {
+		go NotifyChange(a.GetType(), result.GetID(), result, false)
+	}
+	return result, rcode, rerr
 }
 
 func GetMySelf(wfa Accessor) (ShallowDBObject, error) {
@@ -193,7 +237,7 @@ func GetMySelf(wfa Accessor) (ShallowDBObject, error) {
 		And: map[string][]dbs.Filter{
 			"relation": {{Operator: dbs.EQUAL.String(), Value: 1}},
 		},
-	}, "", false)
+	}, "", false, 0, 1)
 	if len(datas) > 0 && datas[0] != nil {
 		return datas[0], nil
 	}

models/utils/interfaces.go

@@ -8,6 +8,7 @@ import (
 
 // ShallowDBObject is an interface that defines the basic methods shallowed version of a DBObject
 type ShallowDBObject interface {
+	DBObject
 	GenerateID()
 	GetID() string
 	GetName() string
@@ -18,6 +19,9 @@ type ShallowDBObject interface {
 // DBObject is an interface that defines the basic methods for a DBObject
 type DBObject interface {
 	GenerateID()
+	Extend(typ ...string) map[string][]tools.DataType
+	SetNotInCatalog(bool)
+	IsNotInCatalog() bool
 	SetID(id string)
 	GetID() string
 	GetName() string
@@ -40,6 +44,7 @@ type DBObject interface {
 
 // Accessor is an interface that defines the basic methods for an Accessor
 type Accessor interface {
+	NewObj() DBObject
 	GetUser() string
 	GetPeerID() string
 	GetGroups() []string
@@ -52,8 +57,8 @@ type Accessor interface {
 	DeleteOne(id string) (DBObject, int, error)
 	CopyOne(data DBObject) (DBObject, int, error)
 	StoreOne(data DBObject) (DBObject, int, error)
-	LoadAll(isDraft bool) ([]ShallowDBObject, int, error)
+	LoadAll(isDraft bool, offset int64, limit int64) ([]ShallowDBObject, int, error)
 	UpdateOne(set map[string]interface{}, id string) (DBObject, int, error)
-	Search(filters *dbs.Filters, search string, isDraft bool) ([]ShallowDBObject, int, error)
+	Search(filters *dbs.Filters, search string, isDraft bool, offset int64, limit int64) ([]ShallowDBObject, int, error)
 	GetExec(isDraft bool) func(DBObject) ShallowDBObject
 }

models/workflow/graph/graph.go

@@ -1,8 +1,6 @@
 package graph
 
 import (
-	"time"
-
 	"cloud.o-forge.io/core/oc-lib/models/resources"
 	"cloud.o-forge.io/core/oc-lib/tools"
 )
@@ -47,6 +45,10 @@ func (wf *Graph) IsProcessing(item GraphItem) bool {
 	return item.Processing != nil
 }
 
+func (wf *Graph) IsService(item GraphItem) bool {
+	return item.Service != nil
+}
+
 func (wf *Graph) IsNativeTool(item GraphItem) bool {
 	return item.NativeTool != nil
 }
@@ -67,46 +69,36 @@ func (wf *Graph) IsWorkflow(item GraphItem) bool {
 	return item.Workflow != nil
 }
 
-func (g *Graph) GetAverageTimeRelatedToProcessingActivity(start time.Time, processings []*resources.ProcessingResource, resource resources.ResourceInterface,
+func (wf *Graph) IsDynamic(item GraphItem) bool {
+	return item.Dynamic != nil
+}
+
+func (g *Graph) GetAverageTimeRelatedToProcessingActivity(processings []*resources.ProcessingResource, resource resources.ResourceInterface,
 	f func(GraphItem) resources.ResourceInterface, instance int, partnership int, buying int, strategy int, bookingMode int, request *tools.APIRequest) (float64, float64, error) {
-	nearestStart := float64(10000000000)
 	oneIsInfinite := false
 	longestDuration := float64(0)
 	for _, link := range g.Links {
 		for _, processing := range processings {
-			var source string                                                                                                                             // source is the source of the link
+			if !(link.Destination.ID == processing.GetID() && f(g.Items[link.Source.ID]) != nil && f(g.Items[link.Source.ID]).GetID() == resource.GetID()) &&
-			if link.Destination.ID == processing.GetID() && f(g.Items[link.Source.ID]) != nil && f(g.Items[link.Source.ID]).GetID() == resource.GetID() { // if the destination is the processing and the source is not a compute
+				!(link.Source.ID == processing.GetID() && f(g.Items[link.Source.ID]) != nil && f(g.Items[link.Source.ID]).GetID() == resource.GetID()) {
-				source = link.Source.ID
+				continue
-			} else if link.Source.ID == processing.GetID() && f(g.Items[link.Source.ID]) != nil && f(g.Items[link.Source.ID]).GetID() == resource.GetID() { // if the source is the processing and the destination is not a compute
-				source = link.Destination.ID
 			}
 			priced, err := processing.ConvertToPricedResource(tools.PROCESSING_RESOURCE, &instance, &partnership, &buying, &strategy, &bookingMode, request)
 			if err != nil {
 				return 0, 0, err
 			}
-			if source != "" {
+			duration := priced.GetExplicitDurationInS()
-				if priced.GetLocationStart() != nil {
+			if duration < 0 {
-					near := float64(priced.GetLocationStart().Sub(start).Seconds())
-					if near < nearestStart {
-						nearestStart = near
-					}
-
-				}
-				if priced.GetLocationEnd() != nil {
-					duration := float64(priced.GetLocationEnd().Sub(*priced.GetLocationStart()).Seconds())
-					if longestDuration < duration {
-						longestDuration = duration
-					}
-				} else {
 				oneIsInfinite = true
-				}
+			} else if longestDuration < duration {
+				longestDuration = duration
 			}
 		}
 	}
 	if oneIsInfinite {
-		return nearestStart, -1, nil
+		return 0, -1, nil
 	}
-	return nearestStart, longestDuration, nil
+	return 0, longestDuration, nil
 }
 
 /*
@@ -155,7 +147,7 @@ func (g *Graph) GetAverageTimeProcessingBeforeStart(average float64, processingI
 
 func (g *Graph) GetResource(id string) (tools.DataType, resources.ResourceInterface) {
 	if item, ok := g.Items[id]; ok {
-		if item.Data != nil {
+		if item.NativeTool != nil {
 			return tools.NATIVE_TOOL, item.NativeTool
 		} else if item.Data != nil {
 			return tools.DATA_RESOURCE, item.Data
@@ -167,6 +159,8 @@ func (g *Graph) GetResource(id string) (tools.DataType, resources.ResourceInterf
 			return tools.PROCESSING_RESOURCE, item.Processing
 		} else if item.Storage != nil {
 			return tools.STORAGE_RESOURCE, item.Storage
+		} else if item.Service != nil {
+			return tools.SERVICE_RESOURCE, item.Service
 		}
 	}
 	return tools.INVALID, nil

models/workflow/graph/item.go

@@ -25,6 +25,12 @@ func (g *GraphItem) GetResource() (tools.DataType, resources.ResourceInterface)
 		return tools.PROCESSING_RESOURCE, g.Processing
 	} else if g.Storage != nil {
 		return tools.STORAGE_RESOURCE, g.Storage
+	} else if g.NativeTool != nil {
+		return tools.NATIVE_TOOL, g.NativeTool
+	} else if g.Service != nil {
+		return tools.SERVICE_RESOURCE, g.Service
+	} else if g.Dynamic != nil {
+		return tools.DYNAMIC_RESOURCE, g.Dynamic
 	}
 	return tools.INVALID, nil
 }
@@ -35,4 +41,6 @@ func (g *GraphItem) Clear() {
 	g.Workflow = nil
 	g.Processing = nil
 	g.Storage = nil
+	g.Service = nil
+	g.Dynamic = nil
 }

models/workflow/plantuml.go

@@ -0,0 +1,282 @@
+package workflow
+
+import (
+	"encoding/json"
+	"fmt"
+	"sort"
+	"strconv"
+	"strings"
+
+	"cloud.o-forge.io/core/oc-lib/models/resources"
+	"cloud.o-forge.io/core/oc-lib/models/workflow/graph"
+)
+
+// ---------------------------------------------------------------------------
+// PlantUML export
+// ---------------------------------------------------------------------------
+
+// plantUMLProcedures defines !procedure blocks for each resource type.
+// Parameters use the $var/$name convention of PlantUML preprocessor v2.
+// Calls are written WITHOUT inline comments (comment on the following line)
+// to avoid the "assumed sequence diagram" syntax error.
+const plantUMLProcedures = `!procedure Processing($var, $name)
+component "$name" as $var <<Processing>>
+!endprocedure
+
+!procedure Data($var, $name)
+file "$name" as $var <<Data>>
+!endprocedure
+
+!procedure Storage($var, $name)
+database "$name" as $var <<Storage>>
+!endprocedure
+
+!procedure ComputeUnit($var, $name)
+node "$name" as $var <<ComputeUnit>>
+!endprocedure
+
+!procedure WorkflowEvent($var, $name)
+usecase "$name" as $var <<WorkflowEvent>>
+!endprocedure
+
+!procedure Workflow($var, $name)
+frame "$name" as $var <<Workflow>>
+!endprocedure
+`
+
+// ToPlantUML serializes the workflow graph to a valid, renderable PlantUML file
+// that is also compatible with ExtractFromPlantUML (round-trip).
+// Resource and instance attributes are written as human-readable comments:
+//
+//	Processing(p1, "NDVI") ' access.container.image: myrepo/ndvi:1.2, infrastructure: 0
+func (w *Workflow) ToPlantUML() string {
+	var sb strings.Builder
+	sb.WriteString("@startuml\n\n")
+	sb.WriteString(plantUMLProcedures)
+	sb.WriteByte('\n')
+
+	varNames := plantUMLVarNames(w.Graph.Items)
+
+	// --- resource declarations ---
+	for id, item := range w.Graph.Items {
+		if line := plantUMLItemLine(varNames[id], item); line != "" {
+			sb.WriteString(line + "\n")
+		}
+	}
+
+	sb.WriteByte('\n')
+
+	// --- links ---
+	for _, link := range w.Graph.Links {
+		src := varNames[link.Source.ID]
+		dst := varNames[link.Destination.ID]
+		if src == "" || dst == "" {
+			continue
+		}
+		sb.WriteString(fmt.Sprintf("%s --> %s\n", src, dst))
+		if comment := plantUMLLinkComment(link); comment != "" {
+			sb.WriteString("' " + comment + "\n")
+		}
+	}
+
+	sb.WriteString("\n@enduml\n")
+	return sb.String()
+}
+
+// plantUMLVarNames assigns short, deterministic variable names to each graph
+// item (d1, d2, p1, s1, c1, e1, wf1 …).
+func plantUMLVarNames(items map[string]graph.GraphItem) map[string]string {
+	counters := map[string]int{}
+	varNames := map[string]string{}
+	// Sort IDs for deterministic output
+	ids := make([]string, 0, len(items))
+	for id := range items {
+		ids = append(ids, id)
+	}
+	sort.Strings(ids)
+	for _, id := range ids {
+		prefix := plantUMLPrefix(items[id])
+		counters[prefix]++
+		varNames[id] = fmt.Sprintf("%s%d", prefix, counters[prefix])
+	}
+	return varNames
+}
+
+func plantUMLPrefix(item graph.GraphItem) string {
+	switch {
+	case item.NativeTool != nil:
+		return "e"
+	case item.Data != nil:
+		return "d"
+	case item.Processing != nil:
+		return "p"
+	case item.Storage != nil:
+		return "s"
+	case item.Compute != nil:
+		return "c"
+	case item.Workflow != nil:
+		return "wf"
+	}
+	return "u"
+}
+
+// plantUMLItemLine builds the PlantUML declaration line for one graph item.
+func plantUMLItemLine(varName string, item graph.GraphItem) string {
+	switch {
+	case item.NativeTool != nil:
+		// WorkflowEvent has no instance and no configurable attributes.
+		return fmt.Sprintf("WorkflowEvent(%s, \"%s\")", varName, item.NativeTool.GetName())
+
+	case item.Data != nil:
+		return plantUMLResourceLine("Data", varName, item.Data)
+
+	case item.Processing != nil:
+		return plantUMLResourceLine("Processing", varName, item.Processing)
+
+	case item.Storage != nil:
+		return plantUMLResourceLine("Storage", varName, item.Storage)
+
+	case item.Compute != nil:
+		return plantUMLResourceLine("ComputeUnit", varName, item.Compute)
+
+	case item.Workflow != nil:
+		return plantUMLResourceLine("Workflow", varName, item.Workflow)
+	}
+	return ""
+}
+
+func plantUMLResourceLine(macro, varName string, res resources.ResourceInterface) string {
+	decl := fmt.Sprintf("%s(%s, \"%s\")", macro, varName, res.GetName())
+	if comment := plantUMLResourceComment(res); comment != "" {
+		// Comment on the line AFTER the declaration. ExtractFromPlantUML uses
+		// look-ahead to merge it back. No inline comment = no !procedure conflict.
+		return decl + "\n' " + comment
+	}
+	return decl
+}
+
+// plantUMLResourceComment merges resource-level fields with the first instance
+// fields (instance overrides resource) and formats them as human-readable pairs.
+func plantUMLResourceComment(res resources.ResourceInterface) string {
+	m := plantUMLToFlatMap(res)
+	if inst := res.GetSelectedInstance(nil); inst != nil {
+		for k, v := range plantUMLToFlatMap(inst) {
+			m[k] = v
+		}
+	}
+	return plantUMLFlatMapToComment(m)
+}
+
+// plantUMLLinkComment serializes StorageLinkInfos (first entry) as flat
+// human-readable pairs prefixed with "storage_link_infos.".
+func plantUMLLinkComment(link graph.GraphLink) string {
+	if len(link.StorageLinkInfos) == 0 {
+		return ""
+	}
+	infoFlat := plantUMLToFlatMap(link.StorageLinkInfos[0])
+	prefixed := make(map[string]string, len(infoFlat))
+	for k, v := range infoFlat {
+		prefixed["storage_link_infos."+k] = v
+	}
+	return plantUMLFlatMapToComment(prefixed)
+}
+
+// ---------------------------------------------------------------------------
+// Flat-map helpers (shared by import & export)
+// ---------------------------------------------------------------------------
+
+// plantUMLSkipFields lists JSON field names (root keys) that must never appear
+// in human-readable comments. All names are the actual JSON tags, not Go field names.
+var plantUMLSkipFields = map[string]bool{
+	// AbstractObject — identity & audit (json tags)
+	"id": true, "name": true, "is_draft": true, "access_mode": true, "signature": true,
+	"creator_id": true, "user_creator_id": true,
+	"creation_date": true, "update_date": true,
+	"updater_id": true, "user_updater_id": true,
+	// internal resource type identifier (AbstractResource.Type / GetType())
+	"type": true,
+	// relationships / pricing
+	"instances": true, "partnerships": true,
+	"allowed_booking_modes": true, "usage_restrictions": true,
+	// display / admin
+	"logo": true, "description": true, "short_description": true, "owners": true,
+	// runtime params
+	"env": true, "inputs": true, "outputs": true,
+	// NativeTool internals
+	"kind": true, "params": true,
+}
+
+// zeroTimeStr is the JSON representation of Go's zero time.Time value.
+// encoding/json does not treat it as "empty" for omitempty, so we filter it explicitly.
+const zeroTimeStr = "0001-01-01T00:00:00Z"
+
+// plantUMLToFlatMap marshals v to JSON and flattens the resulting object into
+// a map[string]string using dot notation for nested keys, skipping zero values
+// and known meta fields.
+func plantUMLToFlatMap(v interface{}) map[string]string {
+	b, err := json.Marshal(v)
+	if err != nil {
+		return nil
+	}
+	var raw map[string]interface{}
+	if err := json.Unmarshal(b, &raw); err != nil {
+		return nil
+	}
+	result := map[string]string{}
+	plantUMLFlattenJSON(raw, "", result)
+	return result
+}
+
+// plantUMLFlattenJSON recursively walks a JSON object and writes scalar leaf
+// values into result using dot-notation keys.
+func plantUMLFlattenJSON(m map[string]interface{}, prefix string, result map[string]string) {
+	for k, v := range m {
+		fullKey := k
+		if prefix != "" {
+			fullKey = prefix + "." + k
+		}
+		// Skip fields whose root key is in the deny-list
+		if plantUMLSkipFields[strings.SplitN(fullKey, ".", 2)[0]] {
+			continue
+		}
+		switch val := v.(type) {
+		case map[string]interface{}:
+			plantUMLFlattenJSON(val, fullKey, result)
+		case []interface{}:
+			// Arrays are not representable in flat human-readable format; skip.
+		case float64:
+			if val != 0 {
+				if val == float64(int64(val)) {
+					result[fullKey] = strconv.FormatInt(int64(val), 10)
+				} else {
+					result[fullKey] = strconv.FormatFloat(val, 'f', -1, 64)
+				}
+			}
+		case bool:
+			if val {
+				result[fullKey] = "true"
+			}
+		case string:
+			if val != "" && val != zeroTimeStr {
+				result[fullKey] = val
+			}
+		}
+	}
+}
+
+// plantUMLFlatMapToComment converts a flat map to a sorted "key: value, …" string.
+func plantUMLFlatMapToComment(m map[string]string) string {
+	if len(m) == 0 {
+		return ""
+	}
+	keys := make([]string, 0, len(m))
+	for k := range m {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	parts := make([]string, 0, len(keys))
+	for _, k := range keys {
+		parts = append(parts, k+": "+m[k])
+	}
+	return strings.Join(parts, ", ")
+}

models/workflow/workflow.go

@@ -6,16 +6,20 @@ import (
 	"errors"
 	"fmt"
 	"mime/multipart"
+	"strconv"
 	"strings"
 	"time"
 
 	"cloud.o-forge.io/core/oc-lib/models/booking"
+	"cloud.o-forge.io/core/oc-lib/models/booking/planner"
 	"cloud.o-forge.io/core/oc-lib/models/collaborative_area/shallow_collaborative_area"
 	"cloud.o-forge.io/core/oc-lib/models/common"
 	"cloud.o-forge.io/core/oc-lib/models/common/models"
 	"cloud.o-forge.io/core/oc-lib/models/common/pricing"
+	"cloud.o-forge.io/core/oc-lib/models/live"
 	"cloud.o-forge.io/core/oc-lib/models/peer"
 	"cloud.o-forge.io/core/oc-lib/models/resources"
+	"cloud.o-forge.io/core/oc-lib/models/resources/native_tools"
 	"cloud.o-forge.io/core/oc-lib/models/utils"
 	"cloud.o-forge.io/core/oc-lib/models/workflow/graph"
 	"cloud.o-forge.io/core/oc-lib/tools"
@@ -40,11 +44,15 @@ type Workflow struct {
 	utils.AbstractObject // AbstractObject contains the basic fields of an object (id, name)
 	resources.ResourceSet
 	Graph *graph.Graph `bson:"graph,omitempty" json:"graph,omitempty"` // Graph UI & logic representation of the workflow
-	ScheduleActive bool         `json:"schedule_active" bson:"schedule_active"` // ScheduleActive is a flag that indicates if the schedule is active, if not the workflow is not scheduled and no execution or booking will be set
 	// Schedule       *WorkflowSchedule `bson:"schedule,omitempty" json:"schedule,omitempty"` // Schedule is the schedule of the workflow
 	Shared []string `json:"shared,omitempty" bson:"shared,omitempty"` // Shared is the ID of the shared workflow     // AbstractWorkflow contains the basic fields of a workflow
-	Env    []models.Param `json:"env,omitempty" bson:"env,omitempty"`
+
-	Inputs []models.Param `json:"inputs,omitempty" bson:"inputs,omitempty"`
+	Env                      map[string][]models.Param                      `json:"env" bson:"env"`
+	Inputs                   map[string][]models.Param                      `json:"inputs" bson:"inputs"`
+	Outputs                  map[string][]models.Param                      `json:"outputs" bson:"outputs"`
+	Args                     map[string][]string                            `json:"args" bson:"args"`
+	Exposes                  map[string][]models.Expose                     `bson:"exposes" json:"exposes"` // Expose is the execution
+	SelectedEmbeddedStorages map[string]*resources.EmbeddedStorageSelection `json:"selected_embedded_storages,omitempty"`
 }
 
 func (d *Workflow) GetAccessor(request *tools.APIRequest) utils.Accessor {
@@ -84,7 +92,18 @@ func (d *Workflow) GetResources(dt tools.DataType) []resources.ResourceInterface
 			itf = append(itf, d)
 		}
 		return itf
+	case tools.SERVICE_RESOURCE:
+		for _, d := range d.ServiceResources {
+			itf = append(itf, d)
 		}
+		return itf
+	case tools.DYNAMIC_RESOURCE:
+		for _, d := range d.DynamicResources {
+			itf = append(itf, d)
+		}
+		return itf
+	}
+
 	return itf
 }
 
@@ -100,12 +119,16 @@ func (d *Workflow) ExtractFromPlantUML(plantUML multipart.File, request *tools.A
 	d.Processings = []string{}
 	d.Computes = []string{}
 	d.Workflows = []string{}
+	d.Dynamics = []string{}
+	d.Services = []string{}
 
 	d.DataResources = []*resources.DataResource{}
 	d.StorageResources = []*resources.StorageResource{}
 	d.ProcessingResources = []*resources.ProcessingResource{}
 	d.ComputeResources = []*resources.ComputeResource{}
 	d.WorkflowResources = []*resources.WorkflowResource{}
+	d.DynamicResources = []*resources.DynamicResource{}
+	d.ServiceResources = []*resources.ServiceResource{}
 
 	d.Graph = graph.NewGraph()
 	resourceCatalog := map[string]func() resources.ResourceInterface{
@@ -137,81 +160,200 @@ func (d *Workflow) ExtractFromPlantUML(plantUML multipart.File, request *tools.A
 				},
 			}
 		},
+		"Service": func() resources.ResourceInterface {
+			return &resources.ServiceResource{
+				AbstractInstanciatedResource: resources.AbstractInstanciatedResource[*resources.ServiceInstance]{
+					Instances: []*resources.ServiceInstance{},
+				},
 			}
-	graphVarName := map[string]*graph.GraphItem{}
+		},
-	scanner := bufio.NewScanner(plantUML)
+		"Dynamic": func() resources.ResourceInterface {
+			return &resources.DynamicResource{}
+		},
+		// WorkflowEvent creates a NativeTool of Kind=WORKFLOW_EVENT directly,
+		// without DB lookup. It has no user-defined instance.
+		"WorkflowEvent": func() resources.ResourceInterface {
+			return &resources.NativeTool{
+				Kind: int(native_tools.WORKFLOW_EVENT),
+			}
+		},
+	}
+	graphVarName := map[string]graph.GraphItem{}
 
+	// Collect all lines first to support look-ahead (comment on the line after
+	// the declaration, as produced by ToPlantUML).
+	scanner := bufio.NewScanner(plantUML)
+	var lines []string
 	for scanner.Scan() {
-		line := scanner.Text()
+		lines = append(lines, scanner.Text())
-		for n, new := range resourceCatalog {
-			if strings.Contains(line, n+"(") && !strings.Contains(line, "!procedure") { // should exclude declaration of type.
-				newRes := new()
-				varName, graphItem, err := d.extractResourcePlantUML(line, newRes, n, request.PeerID)
-				if err != nil {
-					return d, err
-				}
-				graphVarName[varName] = graphItem
-				continue
-			} else if strings.Contains(line, n+"-->") {
-				err := d.extractLink(line, graphVarName, "-->", false)
-				if err != nil {
-					fmt.Println(err)
-					continue
-				}
-			} else if strings.Contains(line, n+"<--") {
-				err := d.extractLink(line, graphVarName, "<--", true)
-				if err != nil {
-					fmt.Println(err)
-					continue
-				}
-			} else if strings.Contains(line, n+"--") {
-				err := d.extractLink(line, graphVarName, "--", false)
-				if err != nil {
-					fmt.Println(err)
-					continue
-				}
-			} else if strings.Contains(line, n+"-") {
-				err := d.extractLink(line, graphVarName, "-", false)
-				if err != nil {
-					fmt.Println(err)
-					continue
-				}
-			}
-		}
 	}
 	if err := scanner.Err(); err != nil {
 		return d, err
 	}
+
+	for i, line := range lines {
+		trimmed := strings.TrimSpace(line)
+
+		// Skip pure comment lines and PlantUML directives — they must never be
+		// parsed as resource declarations or links. Without this guard, a comment
+		// like "' source: http://my-server.com" would match the "-" link check.
+		if strings.HasPrefix(trimmed, "'") ||
+			strings.HasPrefix(trimmed, "!") ||
+			strings.HasPrefix(trimmed, "@") ||
+			trimmed == "" {
+			continue
+		}
+
+		// Build the parse line: if the current line has no inline comment and the
+		// next line is a pure comment, append it so parsers receive one combined line.
+		// Also handles the legacy inline-comment format unchanged.
+		parseLine := line
+		if !strings.Contains(line, "'") && i+1 < len(lines) {
+			if next := strings.TrimSpace(lines[i+1]); strings.HasPrefix(next, "'") {
+				parseLine = line + " " + next
+			}
+		}
+
+		for n, new := range resourceCatalog {
+			if strings.Contains(line, n+"(") && !strings.Contains(line, "!procedure") && !strings.Contains(line, "!define") { // exclude macro declarations
+				newRes := new()
+				newRes.SetID(uuid.New().String())
+				varName, graphItem, err := d.extractResourcePlantUML(parseLine, newRes, n, request.PeerID)
+				if err != nil {
+					return d, err
+				}
+				if graphItem != nil {
+					graphVarName[varName] = *graphItem
+				}
+				continue
+			} else if strings.Contains(line, "-->") {
+				err := d.extractLink(parseLine, graphVarName, "-->", false)
+				if err != nil {
+					fmt.Println(err)
+					continue
+				}
+			} else if strings.Contains(line, "<--") {
+				err := d.extractLink(parseLine, graphVarName, "<--", true)
+				if err != nil {
+					fmt.Println(err)
+					continue
+				}
+			} else if strings.Contains(line, "--") {
+				err := d.extractLink(parseLine, graphVarName, "--", false)
+				if err != nil {
+					fmt.Println(err)
+					continue
+				}
+			} else if strings.Contains(line, "-") {
+				err := d.extractLink(parseLine, graphVarName, "-", false)
+				if err != nil {
+					fmt.Println(err)
+					continue
+				}
+			}
+		}
+	}
 	d.generateResource(d.GetResources(tools.DATA_RESOURCE), request)
 	d.generateResource(d.GetResources(tools.PROCESSING_RESOURCE), request)
+	d.generateResource(d.GetResources(tools.SERVICE_RESOURCE), request)
 	d.generateResource(d.GetResources(tools.STORAGE_RESOURCE), request)
 	d.generateResource(d.GetResources(tools.COMPUTE_RESOURCE), request)
 	d.generateResource(d.GetResources(tools.WORKFLOW_RESOURCE), request)
+	d.generateResource(d.GetResources(tools.SERVICE_RESOURCE), request)
+	d.generateResource(d.GetResources(tools.DYNAMIC_RESOURCE), request)
+	d.Graph.Items = graphVarName
 	return d, nil
 }
 
 func (d *Workflow) generateResource(datas []resources.ResourceInterface, request *tools.APIRequest) error {
 	for _, d := range datas {
-		access := d.GetAccessor(request)
+		if d.GetType() == tools.COMPUTE_RESOURCE.String() {
-		if _, code, err := access.LoadOne(d.GetID()); err != nil && code == 200 {
+			access := live.NewAccessor[*live.LiveDatacenter](tools.LIVE_DATACENTER, request)
+			if b, err := json.Marshal(d); err == nil {
+				var liv live.LiveDatacenter
+				json.Unmarshal(b, &liv)
+				data, _, err := access.StoreOne(&liv)
+				if err == nil {
+					access.CopyOne(data)
+				}
+			}
+			continue
+		} else if d.GetType() == tools.STORAGE_RESOURCE.String() {
+			access := live.NewAccessor[*live.LiveStorage](tools.LIVE_STORAGE, request)
+			if b, err := json.Marshal(d); err == nil {
+				var liv live.LiveStorage
+				json.Unmarshal(b, &liv)
+				data, _, err := access.StoreOne(&liv)
+				if err == nil {
+					access.CopyOne(data)
+				}
+			}
 			continue
 		}
-		access.StoreOne(d)
+		d.GetAccessor(request).StoreOne(d)
 	}
 	return nil
 }
 
-func (d *Workflow) extractLink(line string, graphVarName map[string]*graph.GraphItem, pattern string, reverse bool) error {
+// setNestedKey sets a value in a nested map using dot-notation path.
+// "access.container.image" → m["access"]["container"]["image"] = value
+func setNestedKey(m map[string]any, path string, value any) {
+	parts := strings.SplitN(path, ".", 2)
+	if len(parts) == 1 {
+		m[path] = value
+		return
+	}
+	key, rest := parts[0], parts[1]
+	if _, ok := m[key]; !ok {
+		m[key] = map[string]any{}
+	}
+	if sub, ok := m[key].(map[string]any); ok {
+		setNestedKey(sub, rest, value)
+	}
+}
+
+// parseHumanFriendlyAttrs converts a human-friendly comment into JSON bytes.
+// Supports:
+//   - flat:   "source: http://example.com, encryption: true, size: 500"
+//   - nested: "access.container.image: nginx, access.container.tag: latest"
+//   - raw JSON passthrough (backward-compat): '{"key": "value"}'
+//
+// Values are auto-typed: bool, float64, or string.
+// Note: the first ':' in each pair is the key/value separator,
+// so URLs like "http://..." are handled correctly.
+func parseHumanFriendlyAttrs(comment string) []byte {
+	comment = strings.TrimSpace(comment)
+	if strings.HasPrefix(comment, "{") {
+		return []byte(comment)
+	}
+	m := map[string]any{}
+	for _, pair := range strings.Split(comment, ",") {
+		pair = strings.TrimSpace(pair)
+		parts := strings.SplitN(pair, ":", 2)
+		if len(parts) != 2 {
+			continue
+		}
+		key := strings.TrimSpace(parts[0])
+		val := strings.TrimSpace(parts[1])
+		var typed any
+		if b, err := strconv.ParseBool(val); err == nil {
+			typed = b
+		} else if n, err := strconv.ParseFloat(val, 64); err == nil {
+			typed = n
+		} else {
+			typed = val
+		}
+		setNestedKey(m, key, typed)
+	}
+	b, _ := json.Marshal(m)
+	return b
+}
+
+func (d *Workflow) extractLink(line string, graphVarName map[string]graph.GraphItem, pattern string, reverse bool) error {
 	splitted := strings.Split(line, pattern)
 	if len(splitted) < 2 {
 		return errors.New("links elements not found")
 	}
-	if graphVarName[splitted[0]] != nil {
-		return errors.New("links elements not found -> " + strings.Trim(splitted[0], " "))
-	}
-	if graphVarName[splitted[1]] != nil {
-		return errors.New("links elements not found -> " + strings.Trim(splitted[1], " "))
-	}
 	link := &graph.GraphLink{
 		Source: graph.Position{
 			ID: graphVarName[splitted[0]].ID,
@@ -230,11 +372,10 @@ func (d *Workflow) extractLink(line string, graphVarName map[string]*graph.Graph
 		link.Source = tmp
 	}
 	splittedComments := strings.Split(line, "'")
-	if len(splittedComments) <= 1 {
+	if len(splittedComments) > 1 {
-		return errors.New("Can't deserialize Object, there's no commentary")
+		comment := strings.ReplaceAll(splittedComments[1], "'", "")
+		json.Unmarshal(parseHumanFriendlyAttrs(comment), link)
 	}
-	comment := strings.ReplaceAll(splittedComments[1], "'", "") // for now it's a json.
-	json.Unmarshal([]byte(comment), link)
 	d.Graph.Links = append(d.Graph.Links, *link)
 	return nil
 }
@@ -245,7 +386,7 @@ func (d *Workflow) extractResourcePlantUML(line string, resource resources.Resou
 		return "", nil, errors.New("Can't deserialize Object, there's no func")
 	}
 	splittedParams := strings.Split(splittedFunc[1], ",")
-	if len(splittedFunc) <= 1 {
+	if len(splittedParams) <= 1 {
 		return "", nil, errors.New("Can't deserialize Object, there's no params")
 	}
 
@@ -255,32 +396,40 @@ func (d *Workflow) extractResourcePlantUML(line string, resource resources.Resou
 	if len(splitted) <= 1 {
 		return "", nil, errors.New("Can't deserialize Object, there's no name")
 	}
-	resource.SetName(splitted[1])
+	resource.SetName(strings.ReplaceAll(splitted[1], "\\n", " "))
 
-	splittedComments := strings.Split(line, "'")
+	// Resources with instances get a default one seeded from the parent resource,
-	if len(splittedComments) <= 1 {
+	// then overridden by any explicit comment attributes.
-		return "", nil, errors.New("Can't deserialize Object, there's no commentary")
+	// Event (NativeTool) has no instance: getNewInstance returns nil and is skipped.
-	}
-	comment := strings.ReplaceAll(splittedComments[1], "'", "") // for now it's a json.
 	instance := d.getNewInstance(dataName, splitted[1], peerID)
-	if instance == nil {
+	if instance != nil {
-		return "", nil, errors.New("No instance found.")
+		if b, err := json.Marshal(resource); err == nil {
+			json.Unmarshal(b, instance)
+		}
+		splittedComments := strings.Split(line, "'")
+		if len(splittedComments) > 1 {
+			comment := strings.ReplaceAll(splittedComments[1], "'", "")
+			json.Unmarshal(parseHumanFriendlyAttrs(comment), instance)
 		}
 		resource.AddInstances(instance)
+	}
 
-	json.Unmarshal([]byte(comment), instance)
+	item := d.getNewGraphItem(dataName, resource)
-	// deserializer les instances... une instance doit par défaut avoir certaines valeurs d'accès.
+	if item != nil {
-	graphID := uuid.New()
+		d.Graph.Items[item.ID] = *item
+	}
+
+	return varName, item, nil
+}
+
+func (d *Workflow) getNewGraphItem(dataName string, resource resources.ResourceInterface) *graph.GraphItem {
+	if resource == nil {
+		return nil
+	}
 	graphItem := &graph.GraphItem{
-		ID: graphID.String(),
+		ID:           uuid.New().String(),
+		ItemResource: &resources.ItemResource{},
 	}
-	graphItem = d.getNewGraphItem(dataName, graphItem, resource)
-
-	d.Graph.Items[graphID.String()] = *graphItem
-	return varName, graphItem, nil
-}
-
-func (d *Workflow) getNewGraphItem(dataName string, graphItem *graph.GraphItem, resource resources.ResourceInterface) *graph.GraphItem {
 	switch dataName {
 	case "Data":
 		d.Datas = append(d.Datas, resource.GetID())
@@ -290,15 +439,21 @@ func (d *Workflow) getNewGraphItem(dataName string, graphItem *graph.GraphItem,
 		d.Processings = append(d.Processings, resource.GetID())
 		d.ProcessingResources = append(d.ProcessingResources, resource.(*resources.ProcessingResource))
 		graphItem.Processing = resource.(*resources.ProcessingResource)
-	case "Event":
+	case "Service":
-		access := resources.NewAccessor[*resources.NativeTool](tools.NATIVE_TOOL, &tools.APIRequest{
+		d.Services = append(d.Services, resource.GetID())
-			Admin: true,
+		d.ServiceResources = append(d.ServiceResources, resource.(*resources.ServiceResource))
-		}, func() utils.DBObject { return &resources.NativeTool{} })
+		graphItem.Service = resource.(*resources.ServiceResource)
-		t, _, err := access.Search(nil, "WORKFLOW_EVENT", false)
+	case "Dynamic":
-		if err == nil && len(t) > 0 {
+		d.Dynamics = append(d.Dynamics, resource.GetID())
-			d.NativeTool = append(d.NativeTool, t[0].GetID())
+		d.DynamicResources = append(d.DynamicResources, resource.(*resources.DynamicResource))
-			graphItem.NativeTool = t[0].(*resources.NativeTool)
+		graphItem.Dynamic = resource.(*resources.DynamicResource)
-		}
+	case "WorkflowEvent":
+		// The resource is already a *NativeTool with Kind=WORKFLOW_EVENT set by the
+		// catalog factory. We use it directly without any DB lookup.
+		nt := resource.(*resources.NativeTool)
+		nt.Name = native_tools.WORKFLOW_EVENT.String()
+		d.NativeTool = append(d.NativeTool, nt.GetID())
+		graphItem.NativeTool = nt
 	case "Storage":
 		d.Storages = append(d.Storages, resource.GetID())
 		d.StorageResources = append(d.StorageResources, resource.(*resources.StorageResource))
@@ -308,7 +463,7 @@ func (d *Workflow) getNewGraphItem(dataName string, graphItem *graph.GraphItem,
 		d.ComputeResources = append(d.ComputeResources, resource.(*resources.ComputeResource))
 		graphItem.Compute = resource.(*resources.ComputeResource)
 	default:
-		return graphItem
+		return nil
 	}
 	return graphItem
 }
@@ -323,6 +478,8 @@ func (d *Workflow) getNewInstance(dataName string, name string, peerID string) r
 		return resources.NewStorageResourceInstance(name, peerID)
 	case "ComputeUnit":
 		return resources.NewComputeResourceInstance(name, peerID)
+	case "Service":
+		return resources.NewServiceInstance(name, peerID)
 	default:
 		return nil
 	}
@@ -480,8 +637,37 @@ func (wfa *Workflow) CheckBooking(caller *tools.HTTPCaller) (bool, error) {
 	return true, nil
 }
 
-func (wf *Workflow) Planify(start time.Time, end *time.Time, instances ConfigItem, partnerships ConfigItem, buyings ConfigItem, strategies ConfigItem, bookingMode int, request *tools.APIRequest) (bool, float64, map[tools.DataType]map[string]pricing.PricedItemITF, *Workflow, error) {
+// preemptDelay is the minimum lead time granted before a preempted booking starts.
+const preemptDelay = 30 * time.Second
+
+// Planify computes the scheduled start/end for every resource in the workflow.
+//
+// bookingMode controls availability checking when p (a live planner snapshot) is provided:
+//   - PREEMPTED   : start from now+preemptDelay regardless of existing load.
+//   - WHEN_POSSIBLE: start from max(now, start); if a slot conflicts, slide to the next free window.
+//   - PLANNED     : use start as-is; return an error if the slot is not available.
+//
+// Passing p = nil skips all availability checks (useful for sub-workflow recursion).
+func (wf *Workflow) Planify(start time.Time, end *time.Time, instances ConfigItem, partnerships ConfigItem, buyings ConfigItem, strategies ConfigItem, bookingMode int, p planner.PlannerITF, request *tools.APIRequest) (bool, float64, map[tools.DataType]map[string]pricing.PricedItemITF, *Workflow, error) {
+	// 1. Adjust global start based on booking mode.
+	now := time.Now()
+	switch booking.BookingMode(bookingMode) {
+	case booking.PREEMPTED:
+		if earliest := now.Add(preemptDelay); start.Before(earliest) {
+			start = earliest
+		}
+	case booking.WHEN_POSSIBLE:
+		if start.Before(now) {
+			start = now
+		}
+		// PLANNED: honour the caller's start date as-is.
+	}
+
 	priceds := map[tools.DataType]map[string]pricing.PricedItemITF{}
+	var err error
+
+	// 2. Plan processings and services first so we can derive the total workflow duration.
+	// Services in DEPLOYMENT mode return duration=-1 (open-ended); HOSTED mode returns a bounded call window.
 	ps, priceds, err := plan[*resources.ProcessingResource](tools.PROCESSING_RESOURCE, instances, partnerships, buyings, strategies, bookingMode, wf, priceds, request, wf.Graph.IsProcessing,
 		func(res resources.ResourceInterface, priced pricing.PricedItemITF) (time.Time, float64, error) {
 			d, err := wf.Graph.GetAverageTimeProcessingBeforeStart(0, res.GetID(),
@@ -492,12 +678,35 @@ func (wf *Workflow) Planify(start time.Time, end *time.Time, instances ConfigIte
 			}
 			return start.Add(time.Duration(d) * time.Second), priced.GetExplicitDurationInS(), nil
 		}, func(started time.Time, duration float64) (*time.Time, error) {
-			s := started.Add(time.Duration(duration))
+			s := started.Add(time.Duration(duration) * time.Second)
 			return &s, nil
 		})
 	if err != nil {
 		return false, 0, priceds, nil, err
 	}
+	if _, priceds, err = plan[*resources.ServiceResource](tools.SERVICE_RESOURCE, instances, partnerships, buyings, strategies, bookingMode, wf, priceds, request, wf.Graph.IsService,
+		func(res resources.ResourceInterface, priced pricing.PricedItemITF) (time.Time, float64, error) {
+			d, err := wf.Graph.GetAverageTimeProcessingBeforeStart(0, res.GetID(),
+				*instances.Get(res.GetID()), *partnerships.Get(res.GetID()), *buyings.Get(res.GetID()), *strategies.Get(res.GetID()),
+				bookingMode, request)
+			if err != nil {
+				return start, 0, err
+			}
+			return start.Add(time.Duration(d) * time.Second), priced.GetExplicitDurationInS(), nil
+		}, func(started time.Time, duration float64) (*time.Time, error) {
+			if duration < 0 {
+				return nil, nil // DEPLOYMENT mode: open-ended
+			}
+			s := started.Add(time.Duration(duration) * time.Second)
+			return &s, nil
+		}); err != nil {
+		return false, 0, priceds, nil, err
+	}
+
+	// Total workflow duration used as the booking window for compute/storage.
+	// Returns -1 if any processing is a service (open-ended).
+	workflowDuration := common.GetPlannerLongestTime(priceds)
+
 	if _, priceds, err = plan[resources.ResourceInterface](tools.NATIVE_TOOL, instances, partnerships, buyings, strategies, bookingMode, wf, priceds, request,
 		wf.Graph.IsNativeTool, func(res resources.ResourceInterface, priced pricing.PricedItemITF) (time.Time, float64, error) {
 			return start, 0, nil
@@ -514,11 +723,13 @@ func (wf *Workflow) Planify(start time.Time, end *time.Time, instances ConfigIte
 		}); err != nil {
 		return false, 0, priceds, nil, err
 	}
+
+	// 3. Compute/storage: duration = total workflow duration (conservative bound).
 	for k, f := range map[tools.DataType]func(graph.GraphItem) bool{tools.STORAGE_RESOURCE: wf.Graph.IsStorage,
 		tools.COMPUTE_RESOURCE: wf.Graph.IsCompute} {
 		if _, priceds, err = plan[resources.ResourceInterface](k, instances, partnerships, buyings, strategies, bookingMode, wf, priceds, request,
 			f, func(res resources.ResourceInterface, priced pricing.PricedItemITF) (time.Time, float64, error) {
-				nearestStart, longestDuration, err := wf.Graph.GetAverageTimeRelatedToProcessingActivity(start, ps, res, func(i graph.GraphItem) (r resources.ResourceInterface) {
+				nearestStart, _, err := wf.Graph.GetAverageTimeRelatedToProcessingActivity(ps, res, func(i graph.GraphItem) (r resources.ResourceInterface) {
 					if f(i) {
 						_, r = i.GetResource()
 					}
@@ -526,27 +737,31 @@ func (wf *Workflow) Planify(start time.Time, end *time.Time, instances ConfigIte
 				}, *instances.Get(res.GetID()), *partnerships.Get(res.GetID()),
 					*buyings.Get(res.GetID()), *strategies.Get(res.GetID()), bookingMode, request)
 				if err != nil {
-					return start, longestDuration, err
+					return start, workflowDuration, err
 				}
-				return start.Add(time.Duration(nearestStart) * time.Second), longestDuration, nil
+				return start.Add(time.Duration(nearestStart) * time.Second), workflowDuration, nil
 			}, func(started time.Time, duration float64) (*time.Time, error) {
-				s := started.Add(time.Duration(duration))
+				if duration < 0 {
+					return nil, nil // service: open-ended booking
+				}
+				s := started.Add(time.Duration(duration) * time.Second)
 				return &s, nil
 			}); err != nil {
 			return false, 0, priceds, nil, err
 		}
 	}
-	longest := common.GetPlannerLongestTime(end, priceds, request)
+
+	longest := workflowDuration
 	if _, priceds, err = plan[resources.ResourceInterface](tools.WORKFLOW_RESOURCE, instances, partnerships, buyings, strategies,
 		bookingMode, wf, priceds, request, wf.Graph.IsWorkflow,
 		func(res resources.ResourceInterface, priced pricing.PricedItemITF) (time.Time, float64, error) {
-			start := start.Add(time.Duration(common.GetPlannerNearestStart(start, priceds, request)) * time.Second)
+			start := start.Add(time.Duration(common.GetPlannerNearestStart(start, priceds)) * time.Second)
 			longest := float64(-1)
 			r, code, err := res.GetAccessor(request).LoadOne(res.GetID())
 			if code != 200 || err != nil {
 				return start, longest, err
 			}
-			_, neoLongest, priceds2, _, err := r.(*Workflow).Planify(start, end, instances, partnerships, buyings, strategies, bookingMode, request)
+			_, neoLongest, priceds2, _, err := r.(*Workflow).Planify(start, end, instances, partnerships, buyings, strategies, bookingMode, nil, request)
 			// should ... import priced
 			if err != nil {
 				return start, longest, err
@@ -564,13 +779,26 @@ func (wf *Workflow) Planify(start time.Time, end *time.Time, instances ConfigIte
 
 				}
 			}
-			return start.Add(time.Duration(common.GetPlannerNearestStart(start, priceds, request)) * time.Second), longest, nil
+			return start.Add(time.Duration(common.GetPlannerNearestStart(start, priceds)) * time.Second), longest, nil
 		}, func(start time.Time, longest float64) (*time.Time, error) {
 			s := start.Add(time.Duration(longest) * time.Second)
 			return &s, nil
 		}); err != nil {
 		return false, 0, priceds, nil, err
 	}
+
+	// 4. Availability check against the live planner (skipped for PREEMPTED and sub-workflows).
+	if p != nil && booking.BookingMode(bookingMode) != booking.PREEMPTED {
+		slide, err := plannerAvailabilitySlide(p, priceds, booking.BookingMode(bookingMode))
+		if err != nil {
+			return false, 0, priceds, nil, err
+		}
+		if slide > 0 {
+			// Re-plan from the corrected start; pass nil planner to avoid infinite recursion.
+			return wf.Planify(start.Add(slide), end, instances, partnerships, buyings, strategies, bookingMode, nil, request)
+		}
+	}
+
 	isPreemptible := true
 	for _, first := range wf.GetFirstItems() {
 		_, res := first.GetResource()
@@ -582,6 +810,36 @@ func (wf *Workflow) Planify(start time.Time, end *time.Time, instances ConfigIte
 	return isPreemptible, longest, priceds, wf, nil
 }
 
+// plannerAvailabilitySlide checks all compute/storage resources in priceds against the planner.
+// For PLANNED mode it returns an error immediately on the first conflict.
+// For WHEN_POSSIBLE it returns the maximum slide (duration to add to global start) needed to
+// clear all conflicts, or 0 if the plan is already conflict-free.
+func plannerAvailabilitySlide(p planner.PlannerITF, priceds map[tools.DataType]map[string]pricing.PricedItemITF, mode booking.BookingMode) (time.Duration, error) {
+	maxSlide := time.Duration(0)
+	for _, dt := range []tools.DataType{tools.COMPUTE_RESOURCE, tools.STORAGE_RESOURCE} {
+		for _, priced := range priceds[dt] {
+			locStart := priced.GetLocationStart()
+			locEnd := priced.GetLocationEnd()
+			if locStart == nil || locEnd == nil {
+				continue // open-ended: skip availability check
+			}
+			d := locEnd.Sub(*locStart)
+			next := p.NextAvailableStart(priced.GetID(), priced.GetInstanceID(), *locStart, d)
+			slide := next.Sub(*locStart)
+			if slide <= 0 {
+				continue
+			}
+			if mode == booking.PLANNED {
+				return 0, errors.New("requested slot is not available for resource " + priced.GetID())
+			}
+			if slide > maxSlide {
+				maxSlide = slide
+			}
+		}
+	}
+	return maxSlide, nil
+}
+
 // Returns a map of DataType (processing,computing,data,storage,worfklow) where each resource (identified by its UUID)
 // is mapped to the list of its items (different appearance) in the graph
 // ex: if the same Minio storage is represented by several nodes in the graph, in [tools.STORAGE_RESSOURCE] its UUID will be mapped to
@@ -593,7 +851,9 @@ func (w *Workflow) GetItemsByResources() map[tools.DataType]map[string][]string
 		tools.DATA_RESOURCE:       func() []graph.GraphItem { return w.GetGraphItems(w.Graph.IsData) },
 		tools.COMPUTE_RESOURCE:    func() []graph.GraphItem { return w.GetGraphItems(w.Graph.IsCompute) },
 		tools.PROCESSING_RESOURCE: func() []graph.GraphItem { return w.GetGraphItems(w.Graph.IsProcessing) },
+		tools.SERVICE_RESOURCE:    func() []graph.GraphItem { return w.GetGraphItems(w.Graph.IsService) },
 		tools.WORKFLOW_RESOURCE:   func() []graph.GraphItem { return w.GetGraphItems(w.Graph.IsWorkflow) },
+		tools.DYNAMIC_RESOURCE:    func() []graph.GraphItem { return w.GetGraphItems(w.Graph.IsDynamic) },
 	}
 
 	for dt, meth := range dtMethodMap {
@@ -642,9 +902,6 @@ func plan[T resources.ResourceInterface](
 				priced.SetLocationEnd(*e)
 			}
 		}
-		if e, err := end(started, priced.GetExplicitDurationInS()); err != nil && e != nil {
-			priced.SetLocationEnd(*e)
-		}
 		resources = append(resources, realItem.(T))
 		if priceds[dt][item.ID] != nil {
 			priced.AddQuantity(priceds[dt][item.ID].GetQuantity())

models/workflow/workflow_mongo_accessor.go

@@ -150,7 +150,7 @@ func (a *workflowMongoAccessor) execute(workflow *Workflow, delete bool, active
 			"abstractobject.name": {{Operator: dbs.LIKE.String(), Value: workflow.Name + "_workspace"}},
 		},
 	}
-	resource, _, err := a.workspaceAccessor.Search(filters, "", workflow.IsDraft)
+	resource, _, err := a.workspaceAccessor.Search(filters, "", workflow.IsDraft, 0, 10)
 	if delete { // if delete is set to true, delete the workspace
 		for _, r := range resource {
 			a.workspaceAccessor.DeleteOne(r.GetID())
@@ -192,9 +192,9 @@ func (a *workflowMongoAccessor) LoadOne(id string) (utils.DBObject, int, error)
 	}, a)
 }
 
-func (a *workflowMongoAccessor) Search(filters *dbs.Filters, search string, isDraft bool) ([]utils.ShallowDBObject, int, error) {
+func (a *workflowMongoAccessor) Search(filters *dbs.Filters, search string, isDraft bool, offset int64, limit int64) ([]utils.ShallowDBObject, int, error) {
 	return utils.GenericSearch[*Workflow](filters, search, a.New().GetObjectFilters(search),
-		func(d utils.DBObject) utils.ShallowDBObject { return a.verifyResource(d) }, isDraft, a)
+		func(d utils.DBObject) utils.ShallowDBObject { return a.verifyResource(d) }, isDraft, a, offset, limit)
 }
 
 func (a *workflowMongoAccessor) verifyResource(obj utils.DBObject) utils.DBObject {
@@ -210,15 +210,19 @@ func (a *workflowMongoAccessor) verifyResource(obj utils.DBObject) utils.DBObjec
 		var access utils.Accessor
 		switch t {
 		case tools.COMPUTE_RESOURCE:
-			access = resources.NewAccessor[*resources.ComputeResource](t, a.GetRequest(), func() utils.DBObject { return &resources.ComputeResource{} })
+			access = resources.NewAccessor[*resources.ComputeResource](t, a.GetRequest())
 		case tools.PROCESSING_RESOURCE:
-			access = resources.NewAccessor[*resources.ProcessingResource](t, a.GetRequest(), func() utils.DBObject { return &resources.ProcessingResource{} })
+			access = resources.NewAccessor[*resources.ProcessingResource](t, a.GetRequest())
 		case tools.STORAGE_RESOURCE:
-			access = resources.NewAccessor[*resources.StorageResource](t, a.GetRequest(), func() utils.DBObject { return &resources.StorageResource{} })
+			access = resources.NewAccessor[*resources.StorageResource](t, a.GetRequest())
 		case tools.WORKFLOW_RESOURCE:
-			access = resources.NewAccessor[*resources.WorkflowResource](t, a.GetRequest(), func() utils.DBObject { return &resources.WorkflowResource{} })
+			access = resources.NewAccessor[*resources.WorkflowResource](t, a.GetRequest())
 		case tools.DATA_RESOURCE:
-			access = resources.NewAccessor[*resources.DataResource](t, a.GetRequest(), func() utils.DBObject { return &resources.DataResource{} })
+			access = resources.NewAccessor[*resources.DataResource](t, a.GetRequest())
+		case tools.NATIVE_TOOL:
+			access = resources.NewAccessor[*resources.NativeTool](t, a.GetRequest())
+		case tools.SERVICE_RESOURCE:
+			access = resources.NewAccessor[*resources.ServiceResource](t, a.GetRequest())
 		default:
 			wf.Graph.Clear(resource.GetID())
 		}

models/workflow_execution/execution_graph.go

@@ -0,0 +1,168 @@
+package workflow_execution
+
+import (
+	"slices"
+	"time"
+
+	workflowgraph "cloud.o-forge.io/core/oc-lib/models/workflow/graph"
+)
+
+// ExecutionStepState is the runtime state of a single step in the execution graph.
+type ExecutionStepState string
+
+const (
+	StepWaiting ExecutionStepState = "waiting"
+	StepRunning ExecutionStepState = "running"
+	StepSuccess ExecutionStepState = "success"
+	StepFailure ExecutionStepState = "failure"
+)
+
+// ExecutionGraphItem is the summarized view of one node in the workflow execution graph.
+//
+//   - Name        : human-readable label (resource name or item ID as fallback)
+//   - StartDate   : set when the step transitions to StepRunning
+//   - EndDate     : set when the step transitions to StepSuccess or StepFailure
+//   - State       : current lifecycle state of the step
+//   - Deps        : itemIDs that must reach StepSuccess before this step can start
+//   - WhenRunning : itemIDs (resources) that become active while this step is running
+//                   (e.g. the compute node executing it, the storage it reads/writes)
+type ExecutionGraphItem struct {
+	Name        string             `json:"name" bson:"name"`
+	StartDate   *time.Time         `json:"start_date,omitempty" bson:"start_date,omitempty"`
+	EndDate     *time.Time         `json:"end_date,omitempty" bson:"end_date,omitempty"`
+	State       ExecutionStepState `json:"state" bson:"state"`
+	Deps        []string           `json:"deps,omitempty" bson:"deps,omitempty"`
+	WhenRunning []string           `json:"when_running,omitempty" bson:"when_running,omitempty"`
+}
+
+// ExecutionGraph is a flat, scheduler-friendly summary of a workflow execution graph.
+// The map key is the workflow graph item ID.
+type ExecutionGraph map[string]ExecutionGraphItem
+
+// BuildExecutionGraph derives an initial ExecutionGraph (all steps in StepWaiting)
+// from a workflow graph. It infers:
+//   - Deps        : predecessor item IDs based on link direction
+//   - WhenRunning : sibling item IDs connected to a step by a link
+//     (i.e. resources that are co-active when the step runs)
+func BuildExecutionGraph(g *workflowgraph.Graph) ExecutionGraph {
+	if g == nil {
+		return ExecutionGraph{}
+	}
+
+	// deps[dst] = list of src item IDs that dst depends on
+	deps := map[string][]string{}
+	// whenRunning[id] = list of item IDs active while id is running
+	whenRunning := map[string][]string{}
+
+	for _, link := range g.Links {
+		src := link.Source.ID
+		dst := link.Destination.ID
+		if src == "" || dst == "" {
+			continue
+		}
+
+		srcItem, srcOk := g.Items[src]
+		dstItem, dstOk := g.Items[dst]
+		if !srcOk || !dstOk {
+			continue
+		}
+
+		// Steps (logical nodes that sequence execution): Data, Processing, Workflow, NativeTool.
+		// Resources (infrastructure co-active while a step runs): Compute, Storage.
+		srcIsStep := srcItem.Data != nil || srcItem.Processing != nil || srcItem.Workflow != nil || srcItem.NativeTool != nil
+		dstIsStep := dstItem.Data != nil || dstItem.Processing != nil || dstItem.Workflow != nil || dstItem.NativeTool != nil
+		srcIsResource := srcItem.Compute != nil || srcItem.Storage != nil
+		dstIsResource := dstItem.Compute != nil || dstItem.Storage != nil
+
+		switch {
+		case srcIsStep && dstIsStep:
+			// Sequential dependency: dst must wait for src to succeed.
+			deps[dst] = appendUnique(deps[dst], src)
+
+		case srcIsStep && dstIsResource:
+			// src activates dst (compute/storage) while running.
+			whenRunning[src] = appendUnique(whenRunning[src], dst)
+
+		case srcIsResource && dstIsStep:
+			// dst uses src (compute/storage) while running.
+			whenRunning[dst] = appendUnique(whenRunning[dst], src)
+		}
+	}
+
+	eg := ExecutionGraph{}
+	for id, item := range g.Items {
+		name := id
+		_, r := item.GetResource()
+		if r != nil && r.GetName() != "" {
+			name = r.GetName()
+		}
+		eg[id] = ExecutionGraphItem{
+			Name:        name,
+			State:       StepWaiting,
+			Deps:        deps[id],
+			WhenRunning: whenRunning[id],
+		}
+	}
+	return eg
+}
+
+// MarkRunning transitions the step to StepRunning and records the start time.
+// It is a no-op if the step is already beyond StepRunning.
+func (eg ExecutionGraph) MarkRunning(itemID string, at time.Time) {
+	item, ok := eg[itemID]
+	if !ok || item.State == StepSuccess || item.State == StepFailure {
+		return
+	}
+	item.State = StepRunning
+	item.StartDate = &at
+	eg[itemID] = item
+}
+
+// MarkDone transitions the step to StepSuccess or StepFailure and records the end time.
+func (eg ExecutionGraph) MarkDone(itemID string, success bool, at time.Time) {
+	item, ok := eg[itemID]
+	if !ok {
+		return
+	}
+	if success {
+		item.State = StepSuccess
+	} else {
+		item.State = StepFailure
+	}
+	item.EndDate = &at
+	eg[itemID] = item
+}
+
+// Depssatisfied returns true when all deps of the given item have reached StepSuccess.
+func (eg ExecutionGraph) Depssatisfied(itemID string) bool {
+	item, ok := eg[itemID]
+	if !ok {
+		return false
+	}
+	for _, dep := range item.Deps {
+		depItem, depOk := eg[dep]
+		if !depOk || depItem.State != StepSuccess {
+			return false
+		}
+	}
+	return true
+}
+
+// ReadyToRun returns the IDs of all steps that are still waiting and whose deps
+// are fully satisfied. Useful for the scheduler to decide what to start next.
+func (eg ExecutionGraph) ReadyToRun() []string {
+	ready := []string{}
+	for id, item := range eg {
+		if item.State == StepWaiting && eg.Depssatisfied(id) {
+			ready = append(ready, id)
+		}
+	}
+	return ready
+}
+
+func appendUnique(slice []string, val string) []string {
+	if slices.Contains(slice, val) {
+		return slice
+	}
+	return append(slice, val)
+}

models/workflow_execution/workflow_execution.go

@@ -9,6 +9,7 @@ import (
 	"cloud.o-forge.io/core/oc-lib/models/booking"
 	"cloud.o-forge.io/core/oc-lib/models/common/enum"
 	"cloud.o-forge.io/core/oc-lib/models/common/pricing"
+	"cloud.o-forge.io/core/oc-lib/models/resources"
 	"cloud.o-forge.io/core/oc-lib/models/resources/purchase_resource"
 	"cloud.o-forge.io/core/oc-lib/models/utils"
 	"cloud.o-forge.io/core/oc-lib/models/workflow"
@@ -17,6 +18,17 @@ import (
 	"go.mongodb.org/mongo-driver/bson/primitive"
 )
 
+// BookingState tracks the reservation and completion status of a single booking
+// within a workflow execution.
+//   - IsBooked: true while the resource is actively reserved (set on WORKFLOW_STARTED_EVENT,
+//     cleared on WORKFLOW_STEP_DONE_EVENT / WORKFLOW_DONE_EVENT).
+//   - IsDone: true once the booking has been confirmed by the remote peer (CONSIDERS_EVENT)
+//     or completed (WORKFLOW_STEP_DONE_EVENT / WORKFLOW_DONE_EVENT).
+type BookingState struct {
+	IsBooked bool `json:"is_booked" bson:"is_booked"`
+	IsDone   bool `json:"is_done" bson:"is_done"`
+}
+
 /*
 * WorkflowExecution is a struct that represents a list of workflow executions
 * Warning: No user can write (del, post, put) a workflow execution, it is only used by the system
@@ -33,18 +45,42 @@ type WorkflowExecution struct {
 	State                enum.BookingStatus             `json:"state" bson:"state" default:"0"`                                               // TEMPORARY TODO DEFAULT 1 -> 0 State is the state of the workflow
 	WorkflowID           string                         `json:"workflow_id" bson:"workflow_id,omitempty"`                                     // WorkflowID is the ID of the workflow
 
-	BookingsState  map[string]bool `json:"bookings_state" bson:"bookings_state,omitempty"`   // WorkflowID is the ID of the workflow
+	BookingsState  map[string]BookingState `json:"bookings_state" bson:"bookings_state,omitempty"`   // booking_id → reservation+completion status
-	PurchasesState map[string]bool `json:"purchases_state" bson:"purchases_state,omitempty"` // WorkflowID is the ID of the workflow
+	PurchasesState map[string]bool         `json:"purchases_state" bson:"purchases_state,omitempty"` // purchase_id → confirmed
+
+	// Graph is a lightweight, real-time summary of the workflow execution graph.
+	// Keyed by workflow graph item ID; updated by oc-scheduler on each step-done event.
+	// Consumed by oc-front to render the live execution panel via websocket updates.
+	Graph ExecutionGraph `json:"graph,omitempty" bson:"graph,omitempty"`
 
 	SelectedInstances    workflow.ConfigItem `json:"selected_instances"`
 	SelectedPartnerships workflow.ConfigItem `json:"selected_partnerships"`
 	SelectedBuyings      workflow.ConfigItem `json:"selected_buyings"`
 	SelectedStrategies   workflow.ConfigItem `json:"selected_strategies"`
+
+	// SelectedEmbeddedStorages records which storage capability was activated on
+	// each compute unit graph node (key = compute graph node ID).
+	// Populated by oc-scheduler, consumed by oc-monitord's argo builder.
+	SelectedEmbeddedStorages map[string]*resources.EmbeddedStorageSelection `json:"selected_embedded_storages,omitempty" bson:"selected_embedded_storages,omitempty"`
+}
+
+func (ri *WorkflowExecution) Extend(typ ...string) map[string][]tools.DataType {
+	ext := ri.AbstractObject.Extend(typ...)
+	for _, t := range typ {
+		switch t {
+		case "workflow":
+			if _, ok := ext[t]; !ok {
+				ext[t] = []tools.DataType{}
+			}
+			ext[t] = append(ext[t], tools.PEER)
+		}
+	}
+	return ext
 }
 
 func (r *WorkflowExecution) StoreDraftDefault() {
-	r.IsDraft = false // TODO: TEMPORARY
+	r.IsDraft = true
-	r.State = enum.SCHEDULED
+	r.State = enum.DRAFT
 }
 
 func (r *WorkflowExecution) CanUpdate(set utils.DBObject) (bool, utils.DBObject) {
@@ -65,7 +101,7 @@ func (wfa *WorkflowExecution) Equals(we *WorkflowExecution) bool {
 func (ws *WorkflowExecution) PurgeDraft(request *tools.APIRequest) error {
 	if ws.EndDate == nil {
 		// if no end... then Book like a savage
-		e := ws.ExecDate.Add(time.Hour)
+		e := ws.ExecDate.UTC().Add(time.Hour)
 		ws.EndDate = &e
 	}
 	accessor := ws.GetAccessor(request)
@@ -78,7 +114,7 @@ func (ws *WorkflowExecution) PurgeDraft(request *tools.APIRequest) error {
 				{Operator: dbs.GTE.String(), Value: primitive.NewDateTimeFromTime(ws.ExecDate)},
 			},
 		},
-	}, "", ws.IsDraft)
+	}, "", ws.IsDraft, 0, 10000)
 	if code != 200 || err != nil {
 		return err
 	}
@@ -130,9 +166,9 @@ use of a datacenter or storage can't be buy for permanent access.
 func (d *WorkflowExecution) Buy(bs pricing.BillingStrategy, executionsID string, wfID string, priceds map[tools.DataType]map[string]pricing.PricedItemITF) []*purchase_resource.PurchaseResource {
 	purchases := d.buyEach(bs, executionsID, wfID, tools.PROCESSING_RESOURCE, priceds[tools.PROCESSING_RESOURCE])
 	purchases = append(purchases, d.buyEach(bs, executionsID, wfID, tools.DATA_RESOURCE, priceds[tools.DATA_RESOURCE])...)
+	purchases = append(purchases, d.buyEach(bs, executionsID, wfID, tools.SERVICE_RESOURCE, priceds[tools.SERVICE_RESOURCE])...)
 	d.PurchasesState = map[string]bool{}
 	for _, p := range purchases {
-		p.SetID(uuid.NewString())
 		d.PurchasesState[p.GetID()] = false
 	}
 	return purchases
@@ -154,17 +190,22 @@ func (d *WorkflowExecution) buyEach(bs pricing.BillingStrategy, executionsID str
 			d.PeerBuyByGraph[priced.GetCreatorID()][itemID] = []string{}
 		}
 		start := d.ExecDate
-		if s := priced.GetLocationStart(); s != nil {
+		if s := priced.GetLocationStart(); s != nil && s.After(time.Now()) {
 			start = *s
 		}
 		var m map[string]interface{}
 		b, _ := json.Marshal(priced)
 		json.Unmarshal(b, &m)
-		end := start.Add(time.Duration(priced.GetExplicitDurationInS()) * time.Second)
+		var endDate *time.Time
+		if durS := priced.GetExplicitDurationInS(); durS > 0 {
+			e := start.Add(time.Duration(durS) * time.Second)
+			endDate = &e
+		}
 		bookingItem := &purchase_resource.PurchaseResource{
 			AbstractObject: utils.AbstractObject{
 				UUID:    uuid.New().String(),
 				Name:    d.GetName() + "_" + executionsID + "_" + wfID,
+				IsDraft: true,
 			},
 			PricedItem:   m,
 			ExecutionID:  d.GetID(),
@@ -173,7 +214,7 @@ func (d *WorkflowExecution) buyEach(bs pricing.BillingStrategy, executionsID str
 			ResourceID:   priced.GetID(),
 			InstanceID:   priced.GetInstanceID(),
 			ResourceType: dt,
-			EndDate:      &end,
+			EndDate:      endDate,
 		}
 		items = append(items, bookingItem)
 		d.PeerBuyByGraph[priced.GetCreatorID()][itemID] = append(
@@ -185,11 +226,14 @@ func (d *WorkflowExecution) buyEach(bs pricing.BillingStrategy, executionsID str
 func (d *WorkflowExecution) Book(executionsID string, wfID string, priceds map[tools.DataType]map[string]pricing.PricedItemITF) []*booking.Booking {
 	booking := d.bookEach(executionsID, wfID, tools.STORAGE_RESOURCE, priceds[tools.STORAGE_RESOURCE])
 	booking = append(booking, d.bookEach(executionsID, wfID, tools.PROCESSING_RESOURCE, priceds[tools.PROCESSING_RESOURCE])...)
+	booking = append(booking, d.bookEach(executionsID, wfID, tools.SERVICE_RESOURCE, priceds[tools.SERVICE_RESOURCE])...)
 	booking = append(booking, d.bookEach(executionsID, wfID, tools.COMPUTE_RESOURCE, priceds[tools.COMPUTE_RESOURCE])...)
 	booking = append(booking, d.bookEach(executionsID, wfID, tools.DATA_RESOURCE, priceds[tools.DATA_RESOURCE])...)
 	for _, p := range booking {
-		p.SetID(uuid.NewString())
+		if d.BookingsState == nil {
-		d.BookingsState[p.GetID()] = false
+			d.BookingsState = map[string]BookingState{}
+		}
+		d.BookingsState[p.GetID()] = BookingState{}
 	}
 	return booking
 }
@@ -210,29 +254,45 @@ func (d *WorkflowExecution) bookEach(executionsID string, wfID string, dt tools.
 			d.PeerBookByGraph[priced.GetCreatorID()][itemID] = []string{}
 		}
 		start := d.ExecDate
-		if s := priced.GetLocationStart(); s != nil {
+		if s := priced.GetLocationStart(); s != nil && s.After(time.Now()) {
 			start = *s
 		}
-		end := start.Add(time.Duration(priced.GetExplicitDurationInS()) * time.Second)
+		// Prefer LocationEnd set by Planify; fall back to ExplicitDurationInS only
+		// when Planify did not compute an end (open-ended / service resources).
+		var endDate *time.Time
+		if locEnd := priced.GetLocationEnd(); locEnd != nil {
+			endDate = locEnd
+		} else if durationS := priced.GetExplicitDurationInS(); durationS > 0 {
+			e := start.Add(time.Duration(durationS) * time.Second)
+			endDate = &e
+		}
+		// durationS < 0 means the resource is a service (runs indefinitely):
+		// leave ExpectedEndDate nil so the booking is open-ended.
 		var m map[string]interface{}
 		b, _ := json.Marshal(priced)
 		json.Unmarshal(b, &m)
+		name := priced.GetName()
+		if len(executionsID) > 8 {
+			name += " " + executionsID[:8]
+		}
 		bookingItem := &booking.Booking{
 			AbstractObject: utils.AbstractObject{
 				UUID:    uuid.New().String(),
-				Name: d.GetName() + "_" + executionsID + "_" + wfID,
+				Name:    name + " " + start.Format("2006-01-02 15:04"),
+				IsDraft: true,
 			},
 			PricedItem:        m,
 			ExecutionsID:      executionsID,
-			State:             enum.SCHEDULED,
+			State:             enum.DRAFT,
 			ResourceID:        priced.GetID(),
 			InstanceID:        priced.GetInstanceID(),
 			ResourceType:      dt,
 			DestPeerID:        priced.GetCreatorID(),
+			Peerless:          priced.GetCreatorID() == "",
 			WorkflowID:        wfID,
 			ExecutionID:       d.GetID(),
 			ExpectedStartDate: start,
-			ExpectedEndDate:   &end,
+			ExpectedEndDate:   endDate,
 		}
 		items = append(items, bookingItem)
 		d.PeerBookByGraph[priced.GetCreatorID()][itemID] = append(

models/workflow_execution/workflow_execution_mongo_accessor.go

@@ -24,7 +24,7 @@ func newShallowAccessor(request *tools.APIRequest) *WorkflowExecutionMongoAccess
 			Request:        request,
 			Type:           tools.WORKFLOW_EXECUTION,
 			New:            func() *WorkflowExecution { return &WorkflowExecution{} },
-			NotImplemented: []string{"DeleteOne", "StoreOne", "CopyOne"},
+			NotImplemented: []string{"CopyOne"},
 		},
 	}
 }
@@ -37,7 +37,7 @@ func NewAccessor(request *tools.APIRequest) *WorkflowExecutionMongoAccessor {
 			Request:        request,
 			Type:           tools.WORKFLOW_EXECUTION,
 			New:            func() *WorkflowExecution { return &WorkflowExecution{} },
-			NotImplemented: []string{"DeleteOne", "StoreOne", "CopyOne"},
+			NotImplemented: []string{"CopyOne"},
 		},
 	}
 }
@@ -52,7 +52,7 @@ func (wfa *WorkflowExecutionMongoAccessor) UpdateOne(set map[string]interface{},
 }
 
 func (a *WorkflowExecutionMongoAccessor) LoadOne(id string) (utils.DBObject, int, error) {
-	return utils.GenericLoadOne[*WorkflowExecution](id, a.New(), func(d utils.DBObject) (utils.DBObject, int, error) {
+	return utils.GenericLoadOne(id, a.New(), func(d utils.DBObject) (utils.DBObject, int, error) {
 		now := time.Now()
 		now = now.Add(time.Second * -60)
 		if d.(*WorkflowExecution).State == enum.DRAFT && !a.shallow && now.UTC().After(d.(*WorkflowExecution).ExecDate) {

models/workspace/workspace_mongo_accessor.go

@@ -49,7 +49,7 @@ func (a *workspaceMongoAccessor) DeleteOne(id string) (utils.DBObject, int, erro
 
 // UpdateOne updates a workspace in the database, given its ID, it automatically share to peers if the workspace is shared
 func (a *workspaceMongoAccessor) UpdateOne(set map[string]interface{}, id string) (utils.DBObject, int, error) {
-	if set["active"] == true { // If the workspace is active, deactivate all the other workspaces
+	/*if set["active"] == true { // If the workspace is active, deactivate all the other workspaces
 		res, _, err := a.LoadAll(true)
 		if err == nil {
 			for _, r := range res {
@@ -59,7 +59,7 @@ func (a *workspaceMongoAccessor) UpdateOne(set map[string]interface{}, id string
 				}
 			}
 		}
-	}
+	}*/
 	res, code, err := utils.GenericUpdateOne(set, id, a)
 	if code == 200 && res != nil {
 		a.share(res.(*Workspace), tools.PUT, a.GetCaller())
@@ -76,7 +76,7 @@ func (a *workspaceMongoAccessor) StoreOne(data utils.DBObject) (utils.DBObject,
 		},
 	}
 	// filters *dbs.Filters, word string, isDraft bool
-	res, _, err := a.Search(filters, "", true) // Search for the workspace
+	res, _, err := a.Search(filters, "", true, 0, 10) // Search for the workspace
 	if err == nil && len(res) > 0 {                   // If the workspace already exists, return an error
 		return nil, 409, errors.New("a workspace with the same name already exists")
 	}
@@ -87,24 +87,24 @@ func (a *workspaceMongoAccessor) StoreOne(data utils.DBObject) (utils.DBObject,
 }
 
 func (a *workspaceMongoAccessor) LoadOne(id string) (utils.DBObject, int, error) {
-	return utils.GenericLoadOne[*Workspace](id, a.New(), func(d utils.DBObject) (utils.DBObject, int, error) {
+	return utils.GenericLoadOne(id, a.New(), func(d utils.DBObject) (utils.DBObject, int, error) {
 		d.(*Workspace).Fill(a.GetRequest())
 		return d, 200, nil
 	}, a)
 }
 
-func (a *workspaceMongoAccessor) LoadAll(isDraft bool) ([]utils.ShallowDBObject, int, error) {
+func (a *workspaceMongoAccessor) LoadAll(isDraft bool, offset int64, limit int64) ([]utils.ShallowDBObject, int, error) {
 	return utils.GenericLoadAll[*Workspace](func(d utils.DBObject) utils.ShallowDBObject {
 		d.(*Workspace).Fill(a.GetRequest())
 		return d
-	}, isDraft, a)
+	}, isDraft, a, offset, limit)
 }
 
-func (a *workspaceMongoAccessor) Search(filters *dbs.Filters, search string, isDraft bool) ([]utils.ShallowDBObject, int, error) {
+func (a *workspaceMongoAccessor) Search(filters *dbs.Filters, search string, isDraft bool, offset int64, limit int64) ([]utils.ShallowDBObject, int, error) {
 	return utils.GenericSearch[*Workspace](filters, search, (&Workspace{}).GetObjectFilters(search), func(d utils.DBObject) utils.ShallowDBObject {
 		d.(*Workspace).Fill(a.GetRequest())
 		return d
-	}, isDraft, a)
+	}, isDraft, a, offset, limit)
 }
 
 /*

tools/api.go

@@ -60,16 +60,16 @@ func (s State) String() string {
 
 type API struct{}
 
-func (a *API) Discovered(infos []*beego.ControllerInfo) {
+func (a *API) Discovered(infos []*beego.ControllerInfo, extra ...map[string][]string) {
 	respondToDiscovery := func(resp NATSResponse) {
 		var m map[string]interface{}
 		json.Unmarshal(resp.Payload, &m)
 		if len(m) == 0 {
-			a.SubscribeRouter(infos)
+			a.SubscribeRouter(infos, extra...)
 		}
 	}
 	a.ListenRouter(respondToDiscovery)
-	a.SubscribeRouter(infos)
+	a.SubscribeRouter(infos, extra...)
 }
 
 // GetState returns the state of the API
@@ -99,11 +99,12 @@ func (a *API) ListenRouter(exec func(msg NATSResponse)) {
 	})
 }
 
-func (a *API) SubscribeRouter(infos []*beego.ControllerInfo) {
+func (a *API) SubscribeRouter(infos []*beego.ControllerInfo, extra ...map[string][]string) {
 	nats := NewNATSCaller()
+	appPrefix := "/" + strings.ReplaceAll(config.GetAppName(), "oc-", "")
 	discovery := map[string][]string{}
 	for _, info := range infos {
-		path := strings.ReplaceAll(info.GetPattern(), "/oc/", "/"+strings.ReplaceAll(config.GetAppName(), "oc-", ""))
+		path := strings.ReplaceAll(info.GetPattern(), "/oc/", appPrefix+"/")
 		for k, v := range info.GetMethod() {
 			if discovery[path] == nil {
 				discovery[path] = []string{}
@@ -115,6 +116,15 @@ func (a *API) SubscribeRouter(infos []*beego.ControllerInfo) {
 			}
 		}
 	}
+	for _, extraRoutes := range extra {
+		for rawPath, methods := range extraRoutes {
+			path := strings.ReplaceAll(rawPath, "/oc/", appPrefix+"/")
+			if discovery[path] == nil {
+				discovery[path] = []string{}
+			}
+			discovery[path] = append(discovery[path], methods...)
+		}
+	}
 	b, _ := json.Marshal(discovery)
 
 	go nats.SetNATSPub(DISCOVERY, NATSResponse{

tools/crypto.go

@@ -13,7 +13,6 @@ import (
 
 func LoadKeyFromFilePrivate() (crypto.PrivKey, error) {
 	path := config.GetConfig().PrivateKeyPath
-	fmt.Println(path)
 	data, err := os.ReadFile(path)
 	if err != nil {
 		return nil, err

tools/enums.go

@@ -31,6 +31,11 @@ const (
 	LIVE_STORAGE
 	BILL
 	NATIVE_TOOL
+	EXECUTION_VERIFICATION
+	ALLOWED_IMAGE
+	SERVICE_RESOURCE
+	DYNAMIC_RESOURCE
+	LIVE_SERVICE
 )
 
 var NOAPI = func() string {
@@ -54,6 +59,11 @@ var PEERSAPI = func() string {
 var DATACENTERAPI = func() string {
 	return config.GetConfig().InternalDatacenterAPI
 }
+
+var SCHEDULERAPI = func() string {
+	return config.GetConfig().InternalSchedulerAPI
+}
+
 var PURCHASEAPI = func() string {
 	return config.GetConfig().InternalCatalogAPI + "/purchase"
 }
@@ -72,7 +82,7 @@ var InnerDefaultAPI = [...]func() string{
 	PEERSAPI,
 	SHAREDAPI,
 	SHAREDAPI,
-	DATACENTERAPI,
+	SCHEDULERAPI,
 	NOAPI,
 	NOAPI,
 	NOAPI,
@@ -81,6 +91,11 @@ var InnerDefaultAPI = [...]func() string{
 	DATACENTERAPI,
 	NOAPI,
 	CATALOGAPI,
+	SCHEDULERAPI,
+	DATACENTERAPI,
+	CATALOGAPI,
+	CATALOGAPI,
+	DATACENTERAPI,
 }
 
 // Bind the standard data name to the data type
@@ -106,6 +121,11 @@ var Str = [...]string{
 	"live_storage",
 	"bill",
 	"native_tool",
+	"execution_verification",
+	"allowed_image",
+	"service_resource",
+	"dynamic_resource",
+	"live_service",
 }
 
 func FromString(comp string) int {
@@ -141,7 +161,7 @@ func DataTypeList() []DataType {
 	return []DataType{DATA_RESOURCE, PROCESSING_RESOURCE, STORAGE_RESOURCE, COMPUTE_RESOURCE, WORKFLOW_RESOURCE,
 		WORKFLOW, WORKFLOW_EXECUTION, WORKSPACE, PEER, COLLABORATIVE_AREA, RULE, BOOKING, WORKFLOW_HISTORY, WORKSPACE_HISTORY,
 		ORDER, PURCHASE_RESOURCE,
-		LIVE_DATACENTER, LIVE_STORAGE, BILL, NATIVE_TOOL}
+		LIVE_DATACENTER, LIVE_STORAGE, BILL, NATIVE_TOOL, EXECUTION_VERIFICATION, ALLOWED_IMAGE, SERVICE_RESOURCE, DYNAMIC_RESOURCE, LIVE_SERVICE}
 }
 
 type PropalgationMessage struct {
@@ -163,7 +183,14 @@ const (
 	PB_CONSIDERS
 	PB_ADMIRALTY_CONFIG
 	PB_MINIO_CONFIG
+	PB_PVC_CONFIG
+	PB_CLOSE_SEARCH
 	NONE
+	PB_OBSERVE
+	PB_OBSERVE_CLOSE
+	// PB_PROPAGATE is used by oc-discovery to broadcast a peer's online/offline
+	// state to other oc-discovery nodes in the federation via PROPALGATION_EVENT.
+	PB_PROPAGATE
 )
 
 func GetActionString(ss string) PubSubAction {
@@ -188,13 +215,42 @@ func GetActionString(ss string) PubSubAction {
 		return PB_ADMIRALTY_CONFIG
 	case "minio_config":
 		return PB_MINIO_CONFIG
+	case "close_search":
+		return PB_CLOSE_SEARCH
+	case "observe":
+		return PB_OBSERVE
+	case "observe_close":
+		return PB_OBSERVE_CLOSE
+	case "propagate":
+		return PB_PROPAGATE
 	default:
 		return NONE
 	}
 }
 
-var path = []string{"search", "search_response", "create", "update", "delete", "planner", "close_planner", "considers", "admiralty_config", "minio_config"}
+// path aligns with PubSubAction iota values for String().
+var path = []string{
+	"search",           // 0  PB_SEARCH
+	"search_response",  // 1  PB_SEARCH_RESPONSE
+	"create",           // 2  PB_CREATE
+	"update",           // 3  PB_UPDATE
+	"delete",           // 4  PB_DELETE
+	"planner",          // 5  PB_PLANNER
+	"close_planner",    // 6  PB_CLOSE_PLANNER
+	"considers",        // 7  PB_CONSIDERS
+	"admiralty_config", // 8  PB_ADMIRALTY_CONFIG
+	"minio_config",     // 9  PB_MINIO_CONFIG
+	"pvc_config",       // 10 PB_PVC_CONFIG
+	"close_search",     // 11 PB_CLOSE_SEARCH
+	"none",             // 12 NONE
+	"observe",          // 13 PB_OBSERVE
+	"observe_close",    // 14 PB_OBSERVE_CLOSE
+	"propagate",        // 15 PB_PROPAGATE
+}
 
 func (m PubSubAction) String() string {
+	if int(m) >= len(path) {
+		return "unknown"
+	}
 	return strings.ToUpper(path[m])
 }

tools/kubernetes.go

@@ -14,6 +14,7 @@ import (
 	v1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime/schema"
@@ -35,12 +36,16 @@ type KubernetesService struct {
 }
 
 func NewDynamicClient(host string, ca string, cert string, data string) (*dynamic.DynamicClient, error) {
+	decodedCa, _ := base64.StdEncoding.DecodeString(ca)
+	decodedCert, _ := base64.StdEncoding.DecodeString(cert)
+	decodedKey, _ := base64.StdEncoding.DecodeString(data)
+
 	config := &rest.Config{
 		Host: host,
 		TLSClientConfig: rest.TLSClientConfig{
-			CAData:   []byte(ca),
+			CAData:   []byte(decodedCa),
-			CertData: []byte(cert),
+			CertData: []byte(decodedCert),
-			KeyData:  []byte(data),
+			KeyData:  []byte(decodedKey),
 		},
 	}
 
@@ -56,18 +61,21 @@ func NewDynamicClient(host string, ca string, cert string, data string) (*dynami
 }
 
 func NewKubernetesService(host string, ca string, cert string, data string) (*KubernetesService, error) {
+	decodedCa, _ := base64.StdEncoding.DecodeString(ca)
+	decodedCert, _ := base64.StdEncoding.DecodeString(cert)
+	decodedKey, _ := base64.StdEncoding.DecodeString(data)
+
 	config := &rest.Config{
 		Host: host,
 		TLSClientConfig: rest.TLSClientConfig{
-			CAData:   []byte(ca),
+			CAData:   []byte(decodedCa),
-			CertData: []byte(cert),
+			CertData: []byte(decodedCert),
-			KeyData:  []byte(data),
+			KeyData:  []byte(decodedKey),
 		},
 	}
 
 	// Create clientset
 	clientset, err := kubernetes.NewForConfig(config)
-	fmt.Println("NewForConfig", clientset, err)
 	if err != nil {
 		return nil, errors.New("Error creating Kubernetes client: " + err.Error())
 	}
@@ -84,51 +92,19 @@ func NewKubernetesService(host string, ca string, cert string, data string) (*Ku
 	}, nil
 }
 
-func NewRemoteKubernetesService(url string, ca string, cert string, key string) (*KubernetesService, error) {
-	decodedCa, _ := base64.StdEncoding.DecodeString(ca)
-	decodedCert, _ := base64.StdEncoding.DecodeString(cert)
-	decodedKey, _ := base64.StdEncoding.DecodeString(key)
-
-	config := &rest.Config{
-		Host: url + ":6443",
-		TLSClientConfig: rest.TLSClientConfig{
-			CAData:   decodedCa,
-			CertData: decodedCert,
-			KeyData:  decodedKey,
-		},
-	}
-	// Create clientset
-	clientset, err := kubernetes.NewForConfig(config)
-	fmt.Println("NewForConfig", clientset, err)
-	if err != nil {
-		return nil, errors.New("Error creating Kubernetes client: " + err.Error())
-	}
-	if clientset == nil {
-		return nil, errors.New("Error creating Kubernetes client: clientset is nil")
-	}
-
-	return &KubernetesService{
-		Set:  clientset,
-		Host: url,
-		CA:   string(decodedCa),
-		Cert: string(decodedCert),
-		Data: string(decodedKey),
-	}, nil
-}
-
 func (k *KubernetesService) CreateNamespace(ctx context.Context, ns string) error {
 	// Define the namespace
 	fmt.Println("ExecutionID in CreateNamespace() : ", ns)
 	namespace := &v1.Namespace{
 		ObjectMeta: metav1.ObjectMeta{
 			Name: ns,
-			Labels: map[string]string{
+			Annotations: map[string]string{
-				"multicluster-scheduler": "enabled",
+				"multicluster.admiralty.io/elect": "",
 			},
 		},
 	}
 	// Create the namespace
-	fmt.Println("Creating namespace...", k.Set)
+	fmt.Println("Creating namespace...")
 	if _, err := k.Set.CoreV1().Namespaces().Create(ctx, namespace, metav1.CreateOptions{}); err != nil {
 		return errors.New("Error creating namespace: " + err.Error())
 	}
@@ -208,6 +184,40 @@ func (k *KubernetesService) CreateRoleBinding(ctx context.Context, ns string, ro
 	return nil
 }
 
+// ProvisionExecutionNamespace creates the full Argo execution environment for a
+// namespace: namespace, service-account, role and role-binding. Idempotent — if
+// the namespace already exists the call is a no-op.
+func (k *KubernetesService) ProvisionExecutionNamespace(ctx context.Context, ns string) error {
+	existing, _ := k.GetNamespace(ctx, ns)
+	if existing != nil {
+		return nil
+	}
+	if err := k.CreateNamespace(ctx, ns); err != nil && !strings.Contains(err.Error(), "already exists") {
+		return err
+	}
+	if err := k.CreateServiceAccount(ctx, ns); err != nil && !strings.Contains(err.Error(), "already exists") {
+		return err
+	}
+	role := "argo-role"
+	if err := k.CreateRole(ctx, ns, role,
+		[][]string{{"coordination.k8s.io"}, {""}, {""}, {"multicluster.admiralty.io"}, {"argoproj.io"}},
+		[][]string{{"leases"}, {"secrets"}, {"pods"}, {"podchaperons"}, {"workflowtaskresults"}},
+		[][]string{{"get", "create", "update"}, {"get"}, {"patch"}, {"get", "list", "watch", "create", "update", "patch", "delete"}, {"create", "patch"}},
+	); err != nil {
+		return err
+	}
+	return k.CreateRoleBinding(ctx, ns, "argo-role-binding", role)
+}
+
+// TeardownExecutionNamespace deletes the namespace and lets Kubernetes cascade
+// the deletion of all contained resources (SA, Role, RoleBinding, pods…).
+func (k *KubernetesService) TeardownExecutionNamespace(ctx context.Context, ns string) error {
+	if err := k.Set.CoreV1().Namespaces().Delete(ctx, ns, metav1.DeleteOptions{}); err != nil {
+		return errors.New("error deleting namespace " + ns + ": " + err.Error())
+	}
+	return nil
+}
+
 func (k *KubernetesService) DeleteNamespace(ctx context.Context, ns string, f func()) error {
 	targetGVR := schema.GroupVersionResource{
 		Group:    "multicluster.admiralty.io",
@@ -270,17 +280,12 @@ func (k *KubernetesService) GetTargets(ctx context.Context) ([]string, error) {
 		return nil, err
 	}
 
-	fmt.Println(string(resp))
 	var targetDict map[string]interface{}
 	err = json.Unmarshal(resp, &targetDict)
 	if err != nil {
-		fmt.Println("TODO: handle the error when unmarshalling k8s API response")
 		return nil, err
 	}
 
-	b, _ := json.MarshalIndent(targetDict, "", " ")
-	fmt.Println(string(b))
-
 	data := targetDict["items"].([]interface{})
 
 	for _, item := range data {
@@ -390,7 +395,6 @@ func (k *KubernetesService) CreateKubeconfigSecret(context context.Context, kube
 	// config, err := base64.RawStdEncoding.DecodeString(kubeconfig)
 	if err != nil {
 		fmt.Println("Error while encoding kubeconfig")
-		fmt.Println(err)
 		return nil, err
 	}
 
@@ -400,21 +404,6 @@ func (k *KubernetesService) CreateKubeconfigSecret(context context.Context, kube
 			"config": config,
 		},
 		)
-
-	// exists, err := k.GetKubeconfigSecret(context,executionId)
-	// if err != nil {
-	// 	fmt.Println("Error verifying if kube secret exists in namespace ", executionId)
-	// 	return nil, err
-	// }
-	// if exists != nil {
-	// 	fmt.Println("kube-secret already exists in namespace", executionId)
-	// 	fmt.Println("Overriding existing kube-secret with a newer resource")
-	// 	// TODO : implement DeleteKubeConfigSecret(executionID)
-	// 	deleted, err := k.DeleteKubeConfigSecret(executionId)
-	// 	_ = deleted
-	// 	_ = err
-	// }
-
 	resp, err := k.Set.CoreV1().
 		Secrets(executionId).
 		Apply(context,
@@ -425,14 +414,12 @@ func (k *KubernetesService) CreateKubeconfigSecret(context context.Context, kube
 
 	if err != nil {
 		fmt.Println("Error while trying to contact API to get secret kube-secret-" + executionId)
-		fmt.Println(err)
 		return nil, err
 	}
 
 	data, err := json.Marshal(resp)
 	if err != nil {
 		fmt.Println("Couldn't marshal resp from : ", data)
-		fmt.Println(err)
 		return nil, err
 	}
 	return data, nil
@@ -449,7 +436,6 @@ func (k *KubernetesService) GetKubeconfigSecret(context context.Context, executi
 			return nil, nil
 		}
 		fmt.Println("Error while trying to contact API to get secret kube-secret-" + executionId)
-		fmt.Println(err)
 		return nil, err
 	}
 
@@ -457,7 +443,6 @@ func (k *KubernetesService) GetKubeconfigSecret(context context.Context, executi
 
 	if err != nil {
 		fmt.Println("Couldn't marshal resp from : ", data)
-		fmt.Println(err)
 		return nil, err
 	}
 
@@ -512,15 +497,14 @@ func dynamicClientApply(host string, ca string, cert string, data string, execut
 			},
 		)
 	if err != nil {
-		o, err := json.Marshal(object)
+		fmt.Println("Error from k8s API when applying "+fmt.Sprintf("%v", object)+" to "+gvrSources.String()+" : ", err)
-		fmt.Println("Error from k8s API when applying "+fmt.Sprint(string(o))+" to "+gvrSources.String()+" : ", err)
 		return nil, err
 	}
 
 	// We can add more info to the log with the content of resp if not nil
 	resByte, err := json.Marshal(res)
 	if err != nil {
-		// fmt.Println("Error trying to create a Source on remote cluster : ", err , " : ", res)
+		fmt.Println("Error trying to create a Source on remote cluster : ", err, " : ", res)
 		return nil, err
 	}
 
@@ -578,7 +562,6 @@ func (k *KubernetesService) GetOneNode(context context.Context, executionID stri
 		)
 	if err != nil {
 		fmt.Println("Error getting the list of nodes from k8s API")
-		fmt.Println(err)
 		return nil, err
 	}
 
@@ -616,6 +599,75 @@ func (k *KubernetesService) CreateSecret(context context.Context, minioId string
 	return nil
 }
 
+// CreatePVC creates a static PersistentVolume + PersistentVolumeClaim in the given namespace.
+// Static provisioning (no StorageClass) avoids the WaitForFirstConsumer deadlock
+// with Admiralty virtual nodes — the PVC binds immediately.
+func (k *KubernetesService) CreatePVC(ctx context.Context, name, namespace, storageSize string) error {
+	storageClassName := ""
+	pv := &v1.PersistentVolume{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: name,
+		},
+		Spec: v1.PersistentVolumeSpec{
+			Capacity: v1.ResourceList{
+				v1.ResourceStorage: resource.MustParse(storageSize),
+			},
+			AccessModes:                   []v1.PersistentVolumeAccessMode{v1.ReadWriteOnce},
+			StorageClassName:              storageClassName,
+			PersistentVolumeReclaimPolicy: v1.PersistentVolumeReclaimDelete,
+			PersistentVolumeSource: v1.PersistentVolumeSource{
+				HostPath: &v1.HostPathVolumeSource{
+					Path: "/var/lib/oc-storage/" + name,
+					Type: func() *v1.HostPathType { t := v1.HostPathDirectoryOrCreate; return &t }(),
+				},
+			},
+			ClaimRef: &v1.ObjectReference{
+				Namespace: namespace,
+				Name:      name,
+			},
+		},
+	}
+	_, err := k.Set.CoreV1().PersistentVolumes().Create(ctx, pv, metav1.CreateOptions{})
+	if err != nil && !apierrors.IsAlreadyExists(err) {
+		return fmt.Errorf("CreatePV %s: %w", name, err)
+	}
+
+	pvc := &v1.PersistentVolumeClaim{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: namespace,
+		},
+		Spec: v1.PersistentVolumeClaimSpec{
+			AccessModes:      []v1.PersistentVolumeAccessMode{v1.ReadWriteOnce},
+			StorageClassName: &storageClassName,
+			VolumeName:       name,
+			Resources: v1.VolumeResourceRequirements{
+				Requests: v1.ResourceList{
+					v1.ResourceStorage: resource.MustParse(storageSize),
+				},
+			},
+		},
+	}
+	_, err = k.Set.CoreV1().PersistentVolumeClaims(namespace).Create(ctx, pvc, metav1.CreateOptions{})
+	if err != nil && !apierrors.IsAlreadyExists(err) {
+		return fmt.Errorf("CreatePVC %s/%s: %w", namespace, name, err)
+	}
+	return nil
+}
+
+// DeletePVC deletes a PersistentVolumeClaim and its associated PersistentVolume.
+func (k *KubernetesService) DeletePVC(ctx context.Context, name, namespace string) error {
+	err := k.Set.CoreV1().PersistentVolumeClaims(namespace).Delete(ctx, name, metav1.DeleteOptions{})
+	if err != nil && !apierrors.IsNotFound(err) {
+		return fmt.Errorf("DeletePVC %s/%s: %w", namespace, name, err)
+	}
+	err = k.Set.CoreV1().PersistentVolumes().Delete(ctx, name, metav1.DeleteOptions{})
+	if err != nil && !apierrors.IsNotFound(err) {
+		return fmt.Errorf("DeletePV %s: %w", name, err)
+	}
+	return nil
+}
+
 // ============== ADMIRALTY ==============
 // Returns a concatenation of the peerId and namespace in order for
 // kubernetes ressources to have a unique name, under 63 characters

tools/nats_caller.go

@@ -28,7 +28,10 @@ type NATSMethod int
 
 var meths = []string{"remove execution", "create execution", "planner execution", "discovery",
 	"workflow event", "argo kube event", "create resource", "remove resource",
-	"propalgation event", "search event",
+	"propalgation event", "search event", "confirm event",
+	"considers event", "admiralty config event", "minio config event", "pvc config event",
+	"workflow started event", "workflow step done event", "workflow done event",
+	"peer behavior event", "peer observe response event", "peer observe event",
 }
 
 const (
@@ -45,6 +48,36 @@ const (
 
 	PROPALGATION_EVENT
 	SEARCH_EVENT
+
+	CONFIRM_EVENT
+
+	CONSIDERS_EVENT
+	ADMIRALTY_CONFIG_EVENT
+	MINIO_CONFIG_EVENT
+	PVC_CONFIG_EVENT
+
+	// Workflow lifecycle events emitted by oc-monitord.
+	// oc-scheduler listens to STARTED and DONE to maintain WorkflowExecution state.
+	// oc-datacenter listens to STEP_DONE and DONE to close bookings and tear down infra.
+	WORKFLOW_STARTED_EVENT
+	WORKFLOW_STEP_DONE_EVENT
+	WORKFLOW_DONE_EVENT
+
+	// PEER_BEHAVIOR_EVENT is emitted by any trusted service (oc-scheduler,
+	// oc-datacenter, …) when a peer exhibits suspicious or fraudulent behavior.
+	// oc-discovery consumes it to update the peer's trust score and auto-blacklist
+	// below threshold.
+	PEER_BEHAVIOR_EVENT
+
+	// PEER_OBSERVE_RESPONSE_EVENT is emitted by oc-discovery each time it receives
+	// a heartbeat from an observed remote peer. oc-peer listens to this event to
+	// update the WS connectivity state for its clients.
+	PEER_OBSERVE_RESPONSE_EVENT
+
+	// PEER_OBSERVE_EVENT is emitted by oc-peer to request oc-discovery to start
+	// or stop observing a remote peer. Payload contains the target peer_id and a
+	// boolean close flag.
+	PEER_OBSERVE_EVENT
 )
 
 func (n NATSMethod) String() string {
@@ -54,7 +87,10 @@ func (n NATSMethod) String() string {
 // NameToMethod returns the NATSMethod enum value from a string
 func NameToMethod(name string) NATSMethod {
 	for _, v := range [...]NATSMethod{REMOVE_EXECUTION, CREATE_EXECUTION, PLANNER_EXECUTION, DISCOVERY, WORKFLOW_EVENT, ARGO_KUBE_EVENT,
-		CREATE_RESOURCE, REMOVE_RESOURCE, PROPALGATION_EVENT, SEARCH_EVENT} {
+		CREATE_RESOURCE, REMOVE_RESOURCE, PROPALGATION_EVENT, SEARCH_EVENT, CONFIRM_EVENT,
+		CONSIDERS_EVENT, ADMIRALTY_CONFIG_EVENT, MINIO_CONFIG_EVENT, PVC_CONFIG_EVENT,
+		WORKFLOW_STARTED_EVENT, WORKFLOW_STEP_DONE_EVENT, WORKFLOW_DONE_EVENT,
+		PEER_BEHAVIOR_EVENT, PEER_OBSERVE_RESPONSE_EVENT, PEER_OBSERVE_EVENT} {
 		if strings.Contains(strings.ToLower(v.String()), strings.ToLower(name)) {
 			return v
 		}

tools/peer_behavior.go

@@ -0,0 +1,49 @@
+package tools
+
+import "time"
+
+// BehaviorSeverity qualifies the gravity of a peer misbehavior.
+type BehaviorSeverity int
+
+const (
+	// BehaviorWarn: minor inconsistency — slight trust penalty.
+	BehaviorWarn BehaviorSeverity = iota
+	// BehaviorFraud: deliberate data manipulation (e.g. fake peerless Ref,
+	// invalid booking) — significant trust penalty.
+	BehaviorFraud
+	// BehaviorCritical: severe abuse (secret exfiltration, data corruption,
+	// system-level attack) — heavy penalty, near-immediate blacklist.
+	BehaviorCritical
+)
+
+// scorePenalties maps each severity to a trust-score deduction (out of 100).
+var scorePenalties = map[BehaviorSeverity]float64{
+	BehaviorWarn:     5,
+	BehaviorFraud:    20,
+	BehaviorCritical: 40,
+}
+
+// Penalty returns the trust-score deduction for this severity.
+func (s BehaviorSeverity) Penalty() float64 {
+	if p, ok := scorePenalties[s]; ok {
+		return p
+	}
+	return 5
+}
+
+// PeerBehaviorReport is the payload carried by PEER_BEHAVIOR_EVENT.
+// Any trusted service can emit it; oc-discovery is the sole consumer.
+type PeerBehaviorReport struct {
+	// ReporterApp identifies the emitting service (e.g. "oc-scheduler", "oc-datacenter").
+	ReporterApp string `json:"reporter_app"`
+	// TargetPeerID is the MongoDB DID (_id) of the offending peer.
+	TargetPeerID string `json:"target_peer_id"`
+	// Severity drives how much the trust score drops.
+	Severity BehaviorSeverity `json:"severity"`
+	// Reason is a human-readable description shown in the blacklist warning.
+	Reason string `json:"reason"`
+	// Evidence is an optional reference (booking ID, resource Ref, …).
+	Evidence string `json:"evidence,omitempty"`
+	// At is the timestamp of the observed misbehavior.
+	At time.Time `json:"at"`
+}

tools/remote_caller.go

@@ -8,6 +8,7 @@ import (
 	"net/http"
 	"net/url"
 	"strings"
+	"sync"
 )
 
 // HTTP Method Enum defines the different methods that can be used to interact with the HTTP server
@@ -57,6 +58,7 @@ type HTTPCallerITF interface {
 type HTTPCaller struct {
 	URLS        map[DataType]map[METHOD]string // Map of the different methods and their urls
 	Disabled    bool                           // Disabled flag
+	Mu          sync.RWMutex
 	LastResults map[string]interface{} // Used to store information regarding the last execution of a given method on a given data type
 }
 
@@ -217,6 +219,8 @@ func (caller *HTTPCaller) CallForm(method string, url string, subpath string,
 }
 
 func (caller *HTTPCaller) StoreResp(resp *http.Response) error {
+	caller.Mu.Lock()
+	defer caller.Mu.Unlock()
 	caller.LastResults = make(map[string]interface{})
 	caller.LastResults["header"] = resp.Header
 	caller.LastResults["code"] = resp.StatusCode

tools/workflow_lifecycle.go

@@ -0,0 +1,33 @@
+package tools
+
+import "time"
+
+// StepMetric carries the outcome of one Argo step node as observed by oc-monitord.
+// Embedded in WorkflowLifecycleEvent.Steps for the WORKFLOW_DONE_EVENT recap.
+type StepMetric struct {
+	BookingID string     `json:"booking_id"`
+	State     int        `json:"state"`
+	RealStart *time.Time `json:"real_start,omitempty"`
+	RealEnd   *time.Time `json:"real_end,omitempty"`
+}
+
+// WorkflowLifecycleEvent is the NATS payload emitted by oc-monitord on
+// WORKFLOW_STARTED_EVENT, WORKFLOW_STEP_DONE_EVENT, and WORKFLOW_DONE_EVENT.
+//
+//   - ExecutionID  : WorkflowExecution UUID (used by oc-scheduler to update state)
+//   - ExecutionsID : run-group ID shared by all bookings of the same run
+//   - BookingID    : non-empty only for WORKFLOW_STEP_DONE_EVENT
+//   - State        : target state (enum index: SUCCESS=3, FAILURE=4, STARTED=2, …)
+//   - RealStart    : actual start timestamp recorded by Argo (nil if unknown)
+//   - RealEnd      : actual end timestamp recorded by Argo (nil for STARTED events)
+//   - Steps        : non-nil only for WORKFLOW_DONE_EVENT — full recap of every step
+//     so oc-scheduler and oc-catalog can catch up if they missed STEP_DONE events
+type WorkflowLifecycleEvent struct {
+	ExecutionID  string       `json:"execution_id"`
+	ExecutionsID string       `json:"executions_id"`
+	BookingID    string       `json:"booking_id,omitempty"`
+	State        int          `json:"state"`
+	RealStart    *time.Time   `json:"real_start,omitempty"`
+	RealEnd      *time.Time   `json:"real_end,omitempty"`
+	Steps        []StepMetric `json:"steps,omitempty"`
+}