Commits

main

Console test: robots.txt allows the public /policy and nothing elseOpenVibers · 26 Sept 2026 8ca3039
Public billing policy at /policy (WS-K task 10): what a viewer pays per Vibe at each tier, what a creator receives and what OpenVibe keeps, tips credited in full, subscription price, split and site-route fee, cashout minimum, hold and review, refunds and rate changes, every number read from the configured rates (and /policy.json); says which ledger applies them; no scripts; robots allow /policy onlyOpenVibers · 26 Sept 2026 72cf2d2
Pins: openvibe-contracts 0.44.0 → 0.49.0, openvibe-shared 1.12.0 → 1.13.0OpenVibers · 25 Sept 2026 2db6158
Pins: openvibe-contracts 0.42.0 → 0.44.0 (Contracts 0.43.0 and 0.44.0 were released after the previous pin commit, leaving 0.42.0 two minors behind the pin-drift limit)OpenVibers · 25 Sept 2026 6c00c55
Pins: openvibe-contracts 0.38.0 → 0.42.0, openvibe-shared 1.7.0 → 1.12.0; CI runs the pin-drift check (shared test and security workflows at 423fe51)OpenVibers · 25 Sept 2026 fe42144
Staff console access from the contracts staff map (WS-D, ADR-022; Contracts 0.38.0): a listed subject must also hold staff.money.cashouts (money is the owner's), not role admin; the session keeps the effective role and is re-checked against the map on every request, so existing admin-role sessions end and the owner signs in again. test/staff-map.test.js fails on raw role checksOpenVibers · 24 Sept 2026 85fd198
The staff console shows what shipped on Billing, server-rendered (it loads no scripts, so the shared widget cannot run there): the newest network-changelog entry, read from Network's loopback proxy at most once a minute in the background, escaped, linked to the network's update log; nothing until an entry has been readOpenVibers · 24 Sept 2026 af1d30e
One W3C trace across services (Track O): openvibe-shared v1.7.0 trace.install(app) keeps each request's traceparent and puts it on the calls made while serving it, to loopback and OpenVibe hosts onlyOpenVibers · 24 Sept 2026 9f51b11
CI calls the shared test workflow (Track Q): OpenVibe.Shared .github/workflows/test.yml@f5e7e73 (install, node --check over server/ and scripts/, npm test, openvibe-contracts-check) instead of a copy of those stepsOpenVibers · 24 Sept 2026 069c53e
Truthful readiness and status: /api/ready answers in the openvibe-shared/ready shape (named db and network_jwks checks, money_writes shown without failing it, release) instead of a bare {ready:true}; STATUS.json describes what production runs (release 421beb4, /metrics, hourly reconciliation, external receipts deployed; shadow import counts; the owner-blocked cutover)OpenVibers · 24 Sept 2026 94f1159
Serve the release manifest (Track R, D43): GET /release.json and POST /release-metrics through openvibe-shared release.mount; the manifest was built but never mounted, so billing.openvibe.network answered 404OpenVibers · 24 Sept 2026 421beb4
SECURITY.md: how to report a vulnerability ([email protected], 7-day reply, scope, supported versions)OpenVibers · 24 Sept 2026 42ad547
openvibe-shared v1.5.1, openvibe-contracts v0.33.0OpenVibers · 23 Sept 2026 d9add4c
openvibe-shared v1.5.0, openvibe-contracts v0.32.0OpenVibers · 23 Sept 2026 ba81008
CI: run the shared security workflow (gitleaks secret scan + dependency audit, Track Q)OpenVibers · 23 Sept 2026 aa445d0
Cashout events carry the payout method's type only: the address (e.g. a PayPal email) stays in Billing for the staff console instead of travelling on the retained event streamOpenVibers · 23 Sept 2026 c646279
Cutover runbook checked against production, and Live's money tables mapped to BillingOpenVibers · 23 Sept 2026 2169593
EXTERNAL PowerChat tips reach Tips; hourly reconciliation; /metrics; overflow and race hardeningOpenVibers · 23 Sept 2026 b774c5c
Docs: STATUS.json and README match production (2026-09-23)OpenVibers · 23 Sept 2026 403c732
Direct PowerChat subscriptions settle only on the streamer's own account: intents need receiving_account (imported ones take it from Live's powerchat_connections); a pcsub ref on a tip to any other account (e.g. the subscriber's own) grants nothing and is held for reviewOpenVibers · 23 Sept 2026 b59725e
nginx: client address headers only from $remote_addr (realip). X-Forwarded-For was appended to and CF-Connecting-IP passed through from the client, so a request reaching the origin without Cloudflare (DNS-only host or the bare IP) chose the address the service bans and rate-limits byOpenVibers · 23 Sept 2026 3001094
.env.example: POWERCHAT_SITE_USERNAME is required for PowerChat site-routed settlementOpenVibers · 23 Sept 2026 839da1b
Security: PowerChat site-routed refs only settle when paid to the site account; case-sensitive routingOpenVibers · 23 Sept 2026 627303c
nginx: billing.openvibe.network uses the openvibe.network wildcard certificate (like events)OpenVibers · 23 Sept 2026 36268f1
openvibe-contracts v0.19.0 (this service's manifest and capabilities are released); contracts check is blockingOpenVibers · 23 Sept 2026 5936807
Docs and deploy for the staff console: README section, cutover runbook (the console replaces Live's cashout admin; Network redirect URI for client billing), .env.example (BILLING_STAFF_SUBJECTS, BILLING_SESSION_SECRET), nginx (console proxied, /api/v1 denied on the public host, /webhooks/* public), STATUS, manifest proposal adds billing.staff.actionOpenVibers · 23 Sept 2026 8af6e69
Staff console: Network SSO (authorization code + PKCE S256, client billing) for Network admins listed in BILLING_STAFF_SUBJECTS; server-rendered, no JS, noindex, no-store, strict CSP; host-only HttpOnly Secure SameSite=Strict short session + CSRF on every formOpenVibers · 23 Sept 2026 fbbb0f3
Live as a Billing client: docs/live-patch.diff (BILLING_AUTHORITY=live|billing, off by default; money_writes_frozen) and the cutover sequence in docs/live-cutover.mdOpenVibers · 23 Sept 2026 5833546
Cutover guards: a Live-credited order never settles twice, later imports never undo Billing's own movements, host freeze CLIOpenVibers · 23 Sept 2026 f876f1a
openvibe-contracts v0.8.0 (billing capabilities released); CI runs openvibe-contracts-check --service billingOpenVibers · 23 Sept 2026 0269fe9

More commits