Commits

main · README.md

Serve a public price and latency page at /stats (#8)OpenVibers · 2 Oct 2026 d2b16bd
Price routing on platform rate cards and provider states per period (#7)OpenVibers · 2 Oct 2026 8903236
Bump openvibe-sdk pin from v0.25.2 to v0.26.0 (#5)OpenVibers · 2 Oct 2026 d056134
Delete dead fallback and per-role model config from the docs (#3)OpenVibers · 2 Oct 2026 e569b27
finish-f2: Pin consistency and git diff --check passed; npm test could…OpenVibers · 1 Oct 2026 746da9f
Capability pools placed by the SDK planner, with explain on every run (plan T6 phase 1; openvibe-sdk v0.25.2): a route may name a capability instead of a fixed primary and fallbacks, and the router asks openvibe-sdk/placement for the order over every provider that can serve it (price from the model rate cards, latency and health from provider_stats_daily and the breaker, hysteresis through placement_state), then runs its unchanged attempt/retry/breaker/log loop over that order. The seeded text routes (Live's roles, default.chat, default.json) are pools whose authority is the shared provider (objective correctness): it serves while healthy and the local model takes over only when it is not, so a small local model never wins Live's text work on price. media.local/media.paid stay pinned; speech and embeddings answer an explicit 503 provider.unavailable until a second provider exists (never synthetic output). Every run response and GET /api/v1/runs/:id carry explain {objective, reasons, selected, candidates}. Migration 0003: routes.capability/constraints/pinned, runs.explain. AI_FALLBACK_* and AI_MODEL_<ROLE> are no longer read. npm test and test:pg 27/27.OpenVibers · 29 Sept 2026 5a418a5
The SQLite era is gone (on PostgreSQL since 2026-09-28; no compatibility kept): the one-time migrate-to-postgres script, *_DB_PATH settings (config, .env.example, systemd unit, test helpers), the unused better-sqlite3 dependency and its lockfile entries, and docs, docstrings and STATUS lines about SQLite or its rollback window. Reviewed independently; its blockers (an edited applied migration, the lockfile) are resolved here, Host's inventory follow-up is separate. npm test 23/23 test files passed.OpenVibers · 29 Sept 2026 fa943d1
AI moves to PostgreSQL (ADR-035, roadmap WS-X2, repository-pass group G2), async from end to end.OpenVibers · 28 Sept 2026 1a52447
npm test no longer counts a skipped test as passed (roadmap WS-Q task 7; openvibe-shared/test-runner, Shared v1.25.0). test/run.js counted every file that exited 0 as passed, so media-analysis without ffmpeg, which runs only its parser part, read as green. It is now the shared runner (same files, one at a time as before, 60 s timeout per file): a test prints "<label>: skipped (<why>)" for what it could not run, and that file is listed with ○ and its reasons and not counted as passed; --strict makes a skip fail the run. media-analysis's four ffmpeg parts printed "(skipped: no ffmpeg/ffprobe)" and now print "media-analysis whisper language / real run / local model down / free disk check: skipped (no ffmpeg/ffprobe)"; workflows.test.js left media.analyze out of its end-to-end run without a word when ffprobe is missing and now prints "workflow media.analyze end to end: skipped (no ffprobe)". Without ffmpeg the run reads 22/24 test files passed, 2 skipped. openvibe-shared is pinned at v1.25.0 (from v1.22.0; 1.23 and 1.24 add the web runtime, release-watch fixes and the readiness skip, and /api/ready answers as before because its db check really runs; the README follows). npm test (Node 22, ffmpeg installed) 24/24.OpenVibers · 28 Sept 2026 f6fdbc9
README and STATUS.json are current (roadmap WS-U task 3): the README gains Purpose (the opening paragraph), Owns, Does not own, Depends on, Capabilities (all seven ai.* capabilities, including ai.credential.manage and ai.quota.attribution.manage, and the grants AI uses at Events and Network) and Security sections; the guarantees table is the Acceptance section; Deploy opens with sudo ovhost deploy ai (unit, port, env file, the local model unit, rollback). Not done yet no longer lists ai.run.* events or people's own provider keys (both built) and dates the citation and passthrough notes. STATUS.json names openvibe-contracts v0.75.0, the seven capabilities and the local model, gains features, dates the Live patch note and is updated 2026-09-28.OpenVibers · 28 Sept 2026 6c8b833
Namespaces are the token's ns claim, nothing else: the fallback for service tokens without ns (AI_NS_FALLBACK) and the open-rule lever (AI_NS_REQUIRED=false) are retired (shims C-22 and C-23, roadmap WS-O task 2). Every caller's token names its namespaces: Live's grant lists live.*, network.site_copy and media.analyze; news and blog list their own; Network mints network.*. Checked in production on 2026-09-28, where this week's runs came only from those services and none of the settings was set. A token without ns now runs nothing. test/auth.test.js: ns-less and empty-ns service tokens are refused even in their own namespace, Live's named namespaces decide, and the retired settings have no effect. README, .env.example and docs/migration.md follow. npm test passes.OpenVibers · 28 Sept 2026 5b73bb9
A local model for media.analyze (WS-O task 5): deploy/systemd/openvibe-llm.service runs llama.cpp's llama-server on 127.0.0.1:8090 (OpenAI API, no key), held back for live streams (2 threads, CPUQuota 150%, nice 19, MemoryMax 3G). Installed on production 2026-09-27: llama.cpp b11222 CPU build and Qwen2.5-1.5B-Instruct Q4_K_M (Apache-2.0), both checked against their published sha256; ai.env gains AI_LOCAL_LLM_URL/AI_LOCAL_LLM_MODEL, so the provider local and route media.local exist. First production run: the overview came from the local model (65 s for 3 min of a Japanese VOD, about 20 s of it the model), but the 1.5B model retold the transcript past the limit. The template now asks for English, at most 500 characters and one short quote; answers over 600 characters are cut after the last whole sentence (sentences()); max_tokens is 250. README: Local model.OpenVibers · 27 Sept 2026 566822e
media.analyze, local-first media analysis (roadmap WS-O task 5). A new step kind, media_analysis (server/workflows/media-analysis.js), behind the workflow media.analyze (server/workflows/media.js, namespace media; Live may run it through the default AI_NS_FALLBACK). A VOD, clip or audio file is fetched like any media input: allow-listed hosts only, into media-tmp beside the database (never /tmp, which is memory on the production host), capped at 4 GB and at that disk's free space less a 3 GB reserve, refused with media.no_space before downloading. Everything runs on this host, one analysis at a time, at nice 15. (1) Signals come from one FFmpeg pass, video decoded at keyframes only: scene changes (scdet), black and frozen picture, silence, and loudness (integrated, range, the typical level, i.e. the median audible second, since one burst drags the gated integrated level up, and loud moments at least 6 LU above it). (2) Scenes come from the changes. (3) Speech is whisper.cpp through live.stt. (4) Highlights are windows scored by loud, scene changes and speech, each with its reasons and transcript excerpt. (5) The overview comes from a local model (new provider `local`, any OpenAI-compatible server on this host, AI_LOCAL_LLM_URL, route media.local), else it is extractive from the measured facts. A paid provider (route media.paid) writes it only with allow_paid and an active quota with workflow_prefix media.paid and a max_cost_usd while today's media.* spend is under it; that quota gates only this call (quotas.paidBudget), never runs. overview.source names the writer, gaps list what is missing, and the output is not cached. test/media-analysis.test.js: the log parser; a real run on a 28 s fixture (cuts, black, still picture, silence, a loud burst) with a fake local model that sees only the facts; the local model down -> extractive and said; paid refused without allow_paid, without a budget and past it, used within it; too little disk refused before any download. workflows.test runs it on the fixture too (both skip the runs without ffmpeg). npm test 19/19.OpenVibers · 27 Sept 2026 67fb2a4
Operator console (roadmap WS-O task 4): /console on ai.openvibe.network, server-rendered with no JavaScript, for OpenVibe.Network staff. Providers (secret reference names and whether they resolve, never a value; base URLs without query or user info), models, routes with their fallbacks in order, templates and workflows with every version, its status and the version in use; runs with status tabs and filters (workflow, requester, error code, UTC time range), failures by error code, and a run page (versions, provider/model, fallback, attempts, tokens, cost, error, grounding, citations, the hash-only request log, and the stored input/output bounded: strings cut at 240 characters, lists at 20 items, credential-named keys blanked); quotas with their current windows, usage by day/requester/workflow/model; cache entries and hits; the audit log by kind, action, actor and target. Sign-in is Network SSO (authorization code + PKCE S256 as OAuth client `ai`, refresh token revoked at once) with Billing's session scheme (__Host- cookie, only its hash stored in console_sessions, 60 min, CSRF token plus same-origin check on every POST, sanitizeNext keeps next on /console and sends control characters and backslashes home). The token's staff claims map to AI's capability ids and are re-mapped on every request: staff.site.view (admin, owner) -> ai.usage.read, staff.ai.manage (admin, owner) -> ai.workflow.manage (version status, cancel a run), staff.secrets.manage (owner) -> ai.provider.manage (provider enable/disable, circuit reset, quotas, cache purge); a global_mod or user gets 403 and no session. Writes reuse the admin API's functions (provider status, circuit reset, cache purge and the status summary move to server/ops.js, shared by both), so each writes the same audit_log row with the person as actor; sign-ins, sign-outs and refusals are audited as console.*. Strict CSP (one hashed stylesheet), noindex, no-store, GET /robots.txt disallows /console, /auth/ and /api/; the nginx reference vhost proxies /console, /auth/ and /robots.txt with the client address from $remote_addr. 503 in production without AI_CONSOLE_SESSION_SECRET or OV_OAUTH_CLIENT_SECRET. Checked in headless Chrome at 390/768/1280 px (no horizontal overflow, wide tables scroll in their container) and with axe (WCAG 2.1 AA, light and dark): no violations. test/console.test.jsOpenVibers · 26 Sept 2026 86e1246
Track O: /metrics for direct loopback callers and a truthful /api/ready (openvibe-shared v1.3.0)OpenVibers · 23 Sept 2026 96dc8a3
Docs: STATUS.json and README match production (2026-09-23)OpenVibers · 23 Sept 2026 b92f5ef
Run queue caps: a run that would wait for a slot is refused 429 queue.full (problem+json, Retry-After) once its caller already has AI_MAX_QUEUED_RUNS_PER_CALLER runs waiting (default 50) or the queue holds AI_MAX_QUEUED_RUNS (default 200), checked before quota so a refused run leaves no row and spends nothing; one caller can no longer fill the queue for every otherOpenVibers · 23 Sept 2026 bdca064
Schema cache: the compiled-validator cache shared by every caller (ai.extract/ai.enrich schemas are caller-supplied) is an LRU capped by entry count and total schema bytes (AI_SCHEMA_CACHE_MAX=500, AI_SCHEMA_CACHE_MAX_BYTES=8 MiB); evicted and failed schemas are removed from Ajv's own cache too, and a schema larger than the byte budget is compiled for that call onlyOpenVibers · 23 Sept 2026 549ec14
Fetcher: a redirect from a public allow-listed host may not reach the internal Media origin. Every hop was judged, but judge() let the internal origin through on any hop, so an allow-listed host that redirects could make the service fetch from loopback Media; now only a hop that is itself internal may redirect there (tests script redirect chains through a transport seam)OpenVibers · 23 Sept 2026 690b068
Namespaces fail closed: a token without an ns claim no longer runs every namespace's workflows. A service token (svc:<id>) without ns falls back to its AI_NS_FALLBACK entry (default live=live.*|network.site_copy, since Network grants Live's ai.run.create with no namespaces), else <id>.*; app and module tokens get nothing; AI_NS_REQUIRED=false is a rollback leverOpenVibers · 23 Sept 2026 f75c66b
Capability proposals (ai.run.create, ai.run.read, ai.workflow.manage, ai.provider.manage, ai.usage.read) and the ai service manifest; README, .env.example, systemd unit, nginx vhost, CI on Node 22.22.1, STATUS alpha W13OpenVibers · 23 Sept 2026 87d38e3
Charter: OpenVibe.AI as defined in the OpenVibe realignment plan (placeholder, no code yet)OpenVibers · 21 Sept 2026 3813e51