Commits
-
openvibe-shared 2.12.0: the showcase home and the Frame footer set their font (they rendered serif) (#21)OpenVibers · 7 Oct 2026
96f27b9 -
Codes: the resource index (GET /api/v1/resources, codes.manifest/release) under codes.resource.read; contracts v0.107.0 (T13 step 8). (#20)OpenVibers · 7 Oct 2026
1d362fe -
STATUS.json names the pinned versions and today's date (docs-currency) (#19)OpenVibers · 7 Oct 2026
ed9ce01 -
Pin openvibe-shared v2.9.0 (from v2.6.0): showcase ring icons fill their slot (#15)OpenVibers · 5 Oct 2026
a90da2e -
Add Codes' /llms-full.txt (#14)OpenVibers · 5 Oct 2026
49c7fc7 -
Say usage counts are hourly reports and cost is on BillingOpenVibers · 4 Oct 2026
0dceae7 -
Render every Codes page through openvibe-shared/shell v2.6.0OpenVibers · 4 Oct 2026
cd29b7e -
Bump openvibe-shared v2.4.0 → v2.5.0 (#10)OpenVibers · 3 Oct 2026
f3662e6 -
Publish harness offers as Fabric resource offers of kind harness (#9)OpenVibers · 3 Oct 2026
b612319 -
Add the harness catalog page, sitemap and llms.txt entries (#8)OpenVibers · 2 Oct 2026
9506878 -
Pin openvibe-contracts v0.84.0, sdk v0.26.0 and shared v2.4.0OpenVibers · 2 Oct 2026
6bb0e80 -
The Codes home is built from the showcase kit (plan T11, D92; openvibe-shared v2.3.1): a hero with where to start and a working SDK sample, what an integration gets (credentials, grants, events, generated reference, playgrounds, the SDK), the path from account to integration, the limits a project really gets read live from OpenVibe.Events' /limits.json (never restated; the section is left out when Events does not answer), the reference, recent releases and a closing call to action. The kit's stylesheet is linked (cached, loaded styles-first on a boost swap). Home budgets raised as a decision: HTML 30 KB (measured 27.0: sections and six inline ring icons), CSS 19 KB with the shared stylesheet. 33/33.OpenVibers · 29 Sept 2026
f15150d -
Codes moves between its pages without a reload (plan T11): openvibe-shared v2.2.0 boost swaps <main> styles-first with the shared transition, prefetching on intent, and does a normal load across a deploy (the ov-boost marker carries the release). The navbar's sign-in returns to the current page. test/layout.test.js pins the marker, the boost tag and the login template.OpenVibers · 29 Sept 2026
feb3d8b -
Codes' outbox is openvibe-sdk/events createServiceOutbox (plan T1): the same event_outbox table, event-type allowlist and relay rules in one call, the hand-rolled wrapper gone. Pins openvibe-sdk v0.25.0, openvibe-contracts v0.79.0, openvibe-shared v2.0.0. Both suites green (verified).OpenVibers · 29 Sept 2026
3408517 -
Codes moves to PostgreSQL and Valkey (ADR-035, roadmap WS-X2, repository-pass group G2), async from end to end.OpenVibers · 28 Sept 2026
6329b53 -
npm test no longer counts a skipped test as passed (roadmap WS-Q task 7; openvibe-shared/test-runner, Shared v1.25.0). test/run.js counted every file that exited 0 as passed, so a file that printed that it skipped its work and checked nothing still read as green. It is now the shared runner through run() (same files, one at a time as before, 60 s timeout per file, VERBOSE=1 still prints every file's output): a test prints "<label>: skipped (<why>)" for what it could not run, and that file is listed with ○ and its reasons and not counted as passed; --strict makes a skip fail the run. No test here skips anything. openvibe-shared is pinned at v1.25.0 (from v1.22.0; 1.23 and 1.24 add the web runtime, release-watch fixes and the readiness skip, and /api/ready answers as before because its db check really runs; README and STATUS.json follow). npm test (Node 22) 29/29.OpenVibers · 28 Sept 2026
1246445 -
The webhook tester checks signature v2 only (compatibility shim C-61). OpenVibe.Events stopped sending the v1 header (X-OpenVibe-Signature, an HMAC of the body alone that verifies forever) on 2026-09-28 (shim C-60) and every consumer requires v2, so /tools/webhooks no longer takes or shows v1 "for reference". webhooks.inspect() drops checkV1 and the signature input and returns { accepted, v2, bodyBytes, parsed } (or { accepted: false, reason } for unusable input); a delivery with only a v1 value is refused as having no X-OpenVibe-Signature-V2. The page lists only X-OpenVibe-Timestamp and X-OpenVibe-Signature-V2, keeps why v2 (it covers the time; ±300 s replay window), says v1 is retired, and has no v1 field or result block; verifyResult keys on reason or a missing v2 instead of v1. The in-browser check (public/js/webhook.js) computes and reads no v1; its v2 logic is unchanged. openvibe-sdk is pinned at v0.13.0, whose signDeliveryHeaders is v2 only, so generated samples and their curl replay carry no X-OpenVibe-Signature. README and STATUS.json describe the tester as v2 only and name sdk v0.13.0. Tests: the v1 cases are gone; new checks that inspect() has no v1 in its result, that a v1-only request is refused for want of v2 (also by the SDK receiver), that samples carry no X-OpenVibe-Signature, that the page has no v1 input, and that the browser script reads no v1 field; the secrets and SSRF probes post the v2 field. npm test (Node 22) 29/29.OpenVibers · 28 Sept 2026
64d8feb -
README and STATUS.json are current (roadmap WS-U task 3): the grants section opens with the two capabilities Codes implements and every grant it uses elsewhere (its principal, the person's token, the app's token, Network export tokens); the threat notes are now a Security section that points to SECURITY.md; Deploy says production deploys with sudo ovhost deploy codes (unit, port, env file, state, vhost, rollback and its one blocker) and keeps the first-install steps; Depends on names the current pins (contracts v0.53.0, sdk v0.12.0, shared v1.22.0). STATUS.json gains contracts and features, lists the per-project usage page (no longer under notYet), drops a stale release sha and is updated 2026-09-28.OpenVibers · 28 Sept 2026
7d6f65a -
Project export, the full archive (roadmap WS-N task 9): a project's owner or an admin downloads one zip (POST /projects/:project/export/archive) with manifest.json (counts, limits reached, every file's size and SHA-256, what is not included), README.txt, project.json (the metadata document with the audit log: the configuration), modules/<release>.json (each release's app or mod manifest as validated), and per environment media/<env>/namespaces.json, media/<env>/objects.jsonl (every object, deleted ones too, with its public URL or a 1-hour signed one; objects are listed, not copied) and events/<env>.jsonl (the project's retained app.<project_key>.* events, paged). Media and Events are read only with Network's read-only export tokens (one per service and environment, asked again before they expire, never stored or logged; Network checks the role and audits each). A failing service fails the whole export and the page names the service, part and environment; a limit (CODES_EXPORT_MAX_OBJECTS 5000, CODES_EXPORT_MAX_EVENTS 10000 per environment) makes the part and the archive say complete: false and where they stopped. /docs/export describes the format. test/project-archive.test.jsOpenVibers · 26 Sept 2026
0ef363f -
openvibe-shared v1.5.1, openvibe-contracts v0.33.0OpenVibers · 23 Sept 2026
241cce3 -
openvibe-shared v1.5.0 (Track R release manifest), openvibe-contracts v0.32.0, openvibe-sdk v0.5.0OpenVibers · 23 Sept 2026
e5a6280 -
Governance drafts: code of conduct, contributing, contributor ladder, moderation policyOpenVibers · 23 Sept 2026
d60f279 -
Project export and delete, over Network's /api/v1/projectsOpenVibers · 23 Sept 2026
584012a -
Webhook tester verifies signature v2 (register C-61); openvibe-sdk v0.4.0OpenVibers · 23 Sept 2026
b0381da -
Docs: STATUS.json and README match production (2026-09-23)OpenVibers · 23 Sept 2026
415faa0 -
openvibe-contracts tag v0.27.0 (codes manifest, codes.release.manage|read, codes.app-manifest@1 released): app manifests validate with the released contract (compiled-in proposal and the proposals dropped), release API guarded with requireCapability (reads stay public; a presented token must hold codes.release.read), contracts check blocking in CI; trust tiers per ADR-013 (unreviewed, reviewed, first-party) with an idempotent boot migration of stored values and history; Events playground on the public events.app.publish (app.<project_key>.* types, source app-<ULID>); docs show the pinned tag next to the package versionOpenVibers · 23 Sept 2026
16a2c4a -
README (purpose, owns, does not own, depends on, grants, deploy, acceptance, launch rule, threat notes), STATUS alpha W20, .env.example, deploy (systemd unit, nginx vhost on 4900), CI on Node 22.22.1 (contracts check continue-on-error until release), capability, service manifest and codes.app-manifest@1 proposalsOpenVibers · 23 Sept 2026
958890d -
Charter: OpenVibe.Codes as defined in the OpenVibe realignment plan (placeholder, no code yet)OpenVibers · 21 Sept 2026
af688e0