Commits

main

Add the harness catalog page, sitemap and llms.txt entries (#8)OpenVibers · 2 Oct 2026 9506878
Serve the harness catalog and task routing over the API (#7)OpenVibers · 2 Oct 2026 b27f594
Route coding tasks to harness offers through the SDK placement planner (#6)OpenVibers · 2 Oct 2026 208fd43
Add a validated harness offer catalog (#5)OpenVibers · 2 Oct 2026 dd04042
Move Codes' shutdown onto openvibe-sdk/service (#4)OpenVibers · 2 Oct 2026 8636125
Merge pull request #3 from OpenVibers/agent/codes-bump-the-three-openvibe-package-064750-muqlpp23OpenVibers · 2 Oct 2026 4ee767f
Record integrity hashes for the contracts and shared pinsOpenVibers · 2 Oct 2026 f3ec74f
Pin openvibe-contracts v0.84.0, sdk v0.26.0 and shared v2.4.0OpenVibers · 2 Oct 2026 6bb0e80
Serve Codes' asset and page cache headers from the shared cache-policy (#2)OpenVibers · 2 Oct 2026 5820191
The Codes home is built from the showcase kit (plan T11, D92; openvibe-shared v2.3.1): a hero with where to start and a working SDK sample, what an integration gets (credentials, grants, events, generated reference, playgrounds, the SDK), the path from account to integration, the limits a project really gets read live from OpenVibe.Events' /limits.json (never restated; the section is left out when Events does not answer), the reference, recent releases and a closing call to action. The kit's stylesheet is linked (cached, loaded styles-first on a boost swap). Home budgets raised as a decision: HTML 30 KB (measured 27.0: sections and six inline ring icons), CSS 19 KB with the shared stylesheet. 33/33.OpenVibers · 29 Sept 2026 f15150d
Codes tells search engines when a page changes (plan T11, IndexNow): with INDEXNOW_KEY set the key file is served at /<key>.txt and a release or app page appearing, changing or going away pings the engines (its path and the sitemap); drafts and private pages never; unset, nothing is mounted or sent. A home-page performance budget runs in CI. Tests green (verified).OpenVibers · 29 Sept 2026 98bb8f9
Codes moves between its pages without a reload (plan T11): openvibe-shared v2.2.0 boost swaps <main> styles-first with the shared transition, prefetching on intent, and does a normal load across a deploy (the ov-boost marker carries the release). The navbar's sign-in returns to the current page. test/layout.test.js pins the marker, the boost tag and the login template.OpenVibers · 29 Sept 2026 feb3d8b
Codes' outbox is openvibe-sdk/events createServiceOutbox (plan T1): the same event_outbox table, event-type allowlist and relay rules in one call, the hand-rolled wrapper gone. Pins openvibe-sdk v0.25.0, openvibe-contracts v0.79.0, openvibe-shared v2.0.0. Both suites green (verified).OpenVibers · 29 Sept 2026 3408517
robots.txt, sitemap.xml and a new llms.txt come from openvibe-shared/seo (plan T11, server/http/discovery.js). The sitemap adds each public app and published release with its real publish date (one light query, releases.publicIndex); fixed pages carry STATUS.json's content date, never today; every previous Disallow kept. The home page carries WebSite + WebApplication + WebPage JSON-LD. test/discovery.test.js covers the artifacts.OpenVibers · 29 Sept 2026 9c60e95
Token rejections keep the reason about the token (wrong audience, expired, bad signature): the playground's developers need 'not for openvibe.media'. Only token.no_key, whose SDK text names the internal JWKS URL and the connect error, answers the fixed 'signing key not loaded yet'. The playground test's original assertion stands. npm test 29/29.OpenVibers · 29 Sept 2026 09212f6
Network tokens verify through openvibe-sdk/auth's JWKS client (v0.23.1) in place of Codes' own key fetcher: the last good keys through a Network outage, backoff, a rotation honoured at once. Sign-in sessions and playground app tokens use the SDK's verifyUserToken/verifyAppToken (the clock passed as a number, so expiry is enforced; principal tokens are never a person). The /api/v1 guards verify each service token against the key its kid names, so a rotation that publishes two keys keeps working. Nothing public names the internal JWKS URL or the fetch error: fixed reasons in answers, the real error logged, and /api/ready's network_jwks (still optional) reports counts and times only. Tests: a stub JWKS, two keys by kid, an outage with cached keys, an unreachable JWKS, an expired session. npm test and test:pg 29/29.OpenVibers · 29 Sept 2026 57340a9
The SQLite era is gone (on PostgreSQL since 2026-09-28; no compatibility kept): the one-time migrate-to-postgres script, *_DB_PATH settings (config, .env.example, systemd unit, test helpers), the unused better-sqlite3 dependency and its lockfile entries, and docs, docstrings and STATUS lines about SQLite or its rollback window. Reviewed independently; its blockers (an edited applied migration, the lockfile) are resolved here, Host's inventory follow-up is separate. npm test 28/28 test files passed.OpenVibers · 29 Sept 2026 c265b2a
Await what the transactions start (PostgreSQL pass follow-up): a project export ran detached: the viewer callback returned buildExport()'s promise without awaiting it, so the route answered before the archive existed. A sync callback that calls async code returns before the work is done, so writes could land outside or after their transaction. npm test 28/28.OpenVibers · 29 Sept 2026 03ffd96
openvibe-shared v1.29.2 (from its earlier pin): navbar dropdowns are no longer clipped by the links row, changing the theme repaints the page background, bright accents get dark button text (WCAG), the navbar brand is more compact. npm test: 28/28 test files passedOpenVibers · 29 Sept 2026 74fb1b3
openvibe-shared v1.29.1 (from its earlier pin): changing the theme repaints the page background, bright accents get dark button text (WCAG), the navbar brand is more compact. npm test: 28/28 test files passedOpenVibers · 29 Sept 2026 cf75294
openvibe-shared v1.28.1 (from its earlier pin): the account panel keeps its sections' height on phones, the codes mark at rest shows its V, no empty space under the footer on phones. npm test: 28/28 test files passedOpenVibers · 28 Sept 2026 0d227fb
The limits page test no longer forbids the word "free": the owner took the no-free-copy rule down (2026-09-28); OpenVibe leads with generous free tiers.OpenVibers · 28 Sept 2026 d9a45b0
Readiness names the store: the db check makes a real round trip (db.ready) and reports postgresql or pglite with the pool, as the other services on PostgreSQL do. npm test 28/28.OpenVibers · 28 Sept 2026 c044d02
Codes moves to PostgreSQL and Valkey (ADR-035, roadmap WS-X2, repository-pass group G2), async from end to end.OpenVibers · 28 Sept 2026 6329b53
npm test no longer counts a skipped test as passed (roadmap WS-Q task 7; openvibe-shared/test-runner, Shared v1.25.0). test/run.js counted every file that exited 0 as passed, so a file that printed that it skipped its work and checked nothing still read as green. It is now the shared runner through run() (same files, one at a time as before, 60 s timeout per file, VERBOSE=1 still prints every file's output): a test prints "<label>: skipped (<why>)" for what it could not run, and that file is listed with ○ and its reasons and not counted as passed; --strict makes a skip fail the run. No test here skips anything. openvibe-shared is pinned at v1.25.0 (from v1.22.0; 1.23 and 1.24 add the web runtime, release-watch fixes and the readiness skip, and /api/ready answers as before because its db check really runs; README and STATUS.json follow). npm test (Node 22) 29/29.OpenVibers · 28 Sept 2026 1246445
The webhook tester checks signature v2 only (compatibility shim C-61). OpenVibe.Events stopped sending the v1 header (X-OpenVibe-Signature, an HMAC of the body alone that verifies forever) on 2026-09-28 (shim C-60) and every consumer requires v2, so /tools/webhooks no longer takes or shows v1 "for reference". webhooks.inspect() drops checkV1 and the signature input and returns { accepted, v2, bodyBytes, parsed } (or { accepted: false, reason } for unusable input); a delivery with only a v1 value is refused as having no X-OpenVibe-Signature-V2. The page lists only X-OpenVibe-Timestamp and X-OpenVibe-Signature-V2, keeps why v2 (it covers the time; ±300 s replay window), says v1 is retired, and has no v1 field or result block; verifyResult keys on reason or a missing v2 instead of v1. The in-browser check (public/js/webhook.js) computes and reads no v1; its v2 logic is unchanged. openvibe-sdk is pinned at v0.13.0, whose signDeliveryHeaders is v2 only, so generated samples and their curl replay carry no X-OpenVibe-Signature. README and STATUS.json describe the tester as v2 only and name sdk v0.13.0. Tests: the v1 cases are gone; new checks that inspect() has no v1 in its result, that a v1-only request is refused for want of v2 (also by the SDK receiver), that samples carry no X-OpenVibe-Signature, that the page has no v1 input, and that the browser script reads no v1 field; the secrets and SSRF probes post the v2 field. npm test (Node 22) 29/29.OpenVibers · 28 Sept 2026 64d8feb
README and STATUS.json are current (roadmap WS-U task 3): the grants section opens with the two capabilities Codes implements and every grant it uses elsewhere (its principal, the person's token, the app's token, Network export tokens); the threat notes are now a Security section that points to SECURITY.md; Deploy says production deploys with sudo ovhost deploy codes (unit, port, env file, state, vhost, rollback and its one blocker) and keeps the first-install steps; Depends on names the current pins (contracts v0.53.0, sdk v0.12.0, shared v1.22.0). STATUS.json gains contracts and features, lists the per-project usage page (no longer under notYet), drops a stale release sha and is updated 2026-09-28.OpenVibers · 28 Sept 2026 7d6f65a
Per-actor rate limits at Codes' capability boundaries (roadmap WS-R task 4, openvibe-sdk v0.12.0 limits). server/http/actor-limits.js makes one limiter per app. It covers /api/v1, the signed-in portal (/projects), release actions, the developer tools' forms and the staff trust form. An app token counts as its app (app:app_…, the principal requireCapability verified), a signed-in person as user:usr_…, anyone else by address. Codes hosts no git remotes, so there are no clone or push routes to leave out. Past a limit a route answers 429 problem+json rate_limited with Retry-After before any work (before a form or upload is read and before Network is asked), logs one [Limits] line and counts codes_rate_limited_total{limit,window}.OpenVibers · 28 Sept 2026 d78de70
Security regression suites for the four classes that apply to Codes (roadmap WS-R task 5). test/security-crawl.js lists every route of the booted app from Express's router stack (a route added later is crawled without anyone listing it) and GETs each path as several people, each request from a fresh client address.OpenVibers · 26 Sept 2026 644ce53
Per-project usage page (roadmap WS-N task 4): /projects/:project/usage?days=7|30|90&env=all|production|sandbox, for the project's owner, admins and staff, renders OpenVibe.Network's GET /api/v1/projects/:project/usage (network.project-usage-result@1, read with the person's own Network token like every project read): usage per service and capability (cards) and per day with the job type or tool, each recorded quota's use in its current window with a <meter> for headroom (or why a minute or hour window cannot be shown), the published limits of the services the project used (their /limits.json, through the reader /docs/limits now shares: server/domain/limits.js), errors by code, and the last sampled failures with their trace ids and job or event ids. Server-rendered and complete without JavaScript (the range is a GET form); developers and viewers get 403 without Network being asked; a Network failure shows as it answered. The project page links to it and no longer says usage is not collected; /docs/limits points to it. test/project-usage.test.js (mock Network serves /usage and records query strings)OpenVibers · 26 Sept 2026 253c29d

More commits