Commits
-
openvibe-shared v1.5.1, openvibe-contracts v0.33.0OpenVibers · 23 Sept 2026
241cce3 -
openvibe-shared v1.5.0 (Track R release manifest), openvibe-contracts v0.32.0, openvibe-sdk v0.5.0OpenVibers · 23 Sept 2026
e5a6280 -
CI: run the shared security workflow (gitleaks secret scan + dependency audit, Track Q)OpenVibers · 23 Sept 2026
51d2386 -
Governance drafts: code of conduct, contributing, contributor ladder, moderation policyOpenVibers · 23 Sept 2026
d60f279 -
Project export and delete, over Network's /api/v1/projectsOpenVibers · 23 Sept 2026
584012a -
Webhook tester verifies signature v2 (register C-61); openvibe-sdk v0.4.0OpenVibers · 23 Sept 2026
b0381da -
Docs: STATUS.json and README match production (2026-09-23)OpenVibers · 23 Sept 2026
415faa0 -
Webhook tester docs: Events deliveries also carry X-OpenVibe-Timestamp and X-OpenVibe-Signature-V2 (t=<ts>,v2=<HMAC of "<t>.<raw body>">); refuse v2 outside ±300 s, never fall back to v1 when v2 is present, parseDelivery(..., { requireV2: true }) in openvibe-sdk 0.4.0; the tester itself still checks v1OpenVibers · 23 Sept 2026
a9371c3 -
Sign-out only from this site: a cross-site GET /auth/logout shows a confirm button instead of ending the session; POST /auth/logout needs a same-origin requestOpenVibers · 23 Sept 2026
3160659 -
nginx: client address headers only from $remote_addr (realip). X-Forwarded-For was appended to and CF-Connecting-IP passed through from the client, so a request reaching the origin without Cloudflare (DNS-only host or the bare IP) chose the address the service bans and rate-limits byOpenVibers · 23 Sept 2026
0da020f -
Session cookie accepts only Network session tokens (audience openvibe.network, not FedCM/app tokens)OpenVibers · 23 Sept 2026
76b1234 -
openvibe-sdk v0.3.1; the SDK reference parser skips comments inside declarations (a quote in a doc comment swallowed later declarations)OpenVibers · 23 Sept 2026
04df705 -
Tests follow the v0.28.0 pinOpenVibers · 23 Sept 2026
cd402dd -
openvibe-contracts v0.28.0 (same content as v0.27.0, correctly versioned)OpenVibers · 23 Sept 2026
1f13801 -
openvibe-contracts tag v0.27.0 (codes manifest, codes.release.manage|read, codes.app-manifest@1 released): app manifests validate with the released contract (compiled-in proposal and the proposals dropped), release API guarded with requireCapability (reads stay public; a presented token must hold codes.release.read), contracts check blocking in CI; trust tiers per ADR-013 (unreviewed, reviewed, first-party) with an idempotent boot migration of stored values and history; Events playground on the public events.app.publish (app.<project_key>.* types, source app-<ULID>); docs show the pinned tag next to the package versionOpenVibers · 23 Sept 2026
16a2c4a -
README (purpose, owns, does not own, depends on, grants, deploy, acceptance, launch rule, threat notes), STATUS alpha W20, .env.example, deploy (systemd unit, nginx vhost on 4900), CI on Node 22.22.1 (contracts check continue-on-error until release), capability, service manifest and codes.app-manifest@1 proposalsOpenVibers · 23 Sept 2026
958890d -
OpenVibe.Codes service (Wave 20): SSR developer portal over Network's projects API (PKCE S256 sign-in, httpOnly session; projects, members, apps, secrets shown once and never stored, credential rotate/revoke, grant scope editor offering only grantable capabilities, quotas as recorded limits, audit; Network problems surfaced as answered), docs generated at boot from openvibe-contracts v0.26.0 and openvibe-sdk v0.2.2 (contracts with field tables and fixtures, capability catalog, event types, SDK reference, ADR-derived policy pages) plus the live registry, OAuth callback helper and non-exchanging test callback, webhook verifier and signed sample generator, grant-respecting Media/Events playgrounds with the app's own token through the SDK, app and mod manifest validation, release metadata with codes.app.published|deprecated|revoked through the SDK outbox, trust tiers as metadata; tests with mock Network, Events and MediaOpenVibers · 23 Sept 2026
0deb3d7 -
Charter: OpenVibe.Codes as defined in the OpenVibe realignment plan (placeholder, no code yet)OpenVibers · 21 Sept 2026
af688e0