Commits

main

Roadmap: media reliability item says what shipped (verified-before-play, holds, the monthly stray-file report) and what is leftOpenVibers · 25 Sept 2026 4dde6e9
Forum boards next to feeds: each space is a forum (vBulletin/SMF style: a grouped board index with topics, posts and the last post; topic tables with replies, views and the last post, sticky first, bumped by replies; posts beside the author's panel with Quote) or a feed (votes, hot/new/top); votes and Facepunch-style ratings (Agree, Winner, Funny, Informative, Friendly, Sympathy, Dumb, Disgusting, Bad reading, Late; one per person per post) switch per space; pastes attach to posts as cards and every paste has Discuss in a space; threads crosspost between spaces; moderators create spaces, groups and child boards and change styles; General, Help and Off-topic are forums, Feedback, Roadmap and Showcase feedsOpenVibers · 25 Sept 2026 a1c3b23
Images on forum posts as med_ references (WS-J task 2): up to 4 PNG/JPEG/GIF/WebP images (by content, 8 MB, metadata stripped) per thread or reply, stored through OpenVibe.Media's Object API v2 (init, content, complete) as public objects the person owns; POST /api/v1/spaces/:space/attachments then attachments: [media_id]; the no-JS forms upload and attach in one step; the roadmap marks it doneOpenVibers · 25 Sept 2026 8708672
Categories, feature requests and a public Roadmap space (WS-J tasks 1 and 8): categories per space (Feedback: Ideas, Bugs, Questions), filters by category and status, Feedback threads are requests (open to votes, statuses set by staff), the Roadmap space follows docs/roadmap/public.json at every boot (one thread per item, summaries edited in place, replies and votes kept), staff-only roadmap items; API routes, no-JS pages and formsOpenVibers · 25 Sept 2026 834a14d
community.profile on Network (Contracts 0.41.0 user module, WS-B task 9): threads, replies, comments and public pastes a person wrote (deleted, AI and private not counted), first and last activity; a 5-minute scan of authors whose rows changed writes it as the owning service, only when it changedOpenVibers · 25 Sept 2026 8be21c2
Revocation propagation (WS-B task 4, Contracts 0.39.0, SDK 0.9.1): Community subscribes to network.user.token_valid_after, applies it once through the inbox into openvibe-sdk createRevocationStore, and the viewer resolver treats a token issued before the person's cutoff as anonymous. test/revocation.test.jsOpenVibers · 24 Sept 2026 6b5f6e1
Staff actions on someone else's content publish community.moderation.action for the network's moderation audit log (ADR-022): paste edit, visibility change, delete, censor, bulk and fork cleanup, comment and post removal, thread delete, lock and unlock — in the same transaction as the change, never the content; an owner acting on their own content is not audited; openvibe-contracts 0.36.0OpenVibers · 24 Sept 2026 bd3a551
The OpenVibe Frame from this site's own pinned copy: /shared/* is served by openvibe-shared/serve (1.12.0) and every page references it by content hash (/shared/<file>?v=<hash>), so this site's pin decides what its pages run and its navbar and footer keep working while openvibe.network is downOpenVibers · 24 Sept 2026 8772c78
The OpenVibe Frame and the shared update system on openvibe.community: the home shows what shipped and /updates is the shared log (openvibe-shared/frame 1.11.1), the footer links it, and the shared navbar signs out through this site (logoutUrl)OpenVibers · 24 Sept 2026 58f1b3b
CI calls the shared test workflow (Track Q): OpenVibe.Shared .github/workflows/test.yml@f5e7e73 (install, node --check over server/ and scripts/, npm test, openvibe-contracts-check) instead of a copy of those stepsOpenVibers · 24 Sept 2026 58fa49e
VIP client from openvibe-sdk/vip (v0.7.0): the copy of openvibe-vip/client is replaced by the SDK's published seam, same API and fail-closed behaviour; server/vip/vip-client.js re-exports it so callers are unchangedOpenVibers · 24 Sept 2026 d692a51
VIP convergence (W10): Community subscribes to vip.membership.changed on its Events endpoint; a delivery from VIP drops the member's cached members-only answers for that creator at once (the VIP gate's cache handleEvent, once per event through the inbox) instead of waiting out the TTL; other sources are ignoredOpenVibers · 24 Sept 2026 9074b54
Staff powers from the contracts staff map (D05, ADR-022): a browser viewer is paste staff with staff.moderation.pastes and discussion staff with staff.moderation.discussions, from the role or the staff_caps Network issues (issued claims win); discussionStaff reads the discussion capability. Same answers for every role today. test/staff-map.test.jsOpenVibers · 24 Sept 2026 0a540ea
Pulse is fed from OpenVibe.Events: POST /internal/events (signature v2 only, loopback only, exactly once via the openvibe-sdk inbox) turns public live.stream.started, blog.post.published, wiki.page.published and news.story.published into Pulse items with provenance (a person only when a person acted; noindex or non-public items never enter). Subscriptions are created at boot (COMMUNITY_EVENTS_SECRET, EVENTS_URL). test/pulse-consumer.test.jsOpenVibers · 24 Sept 2026 474c101
Community publishes events (openvibe-contracts 0.35.0): community.paste.created|updated|deleted, community.thread.created, community.post.created and community.comment.created, each queued in the transaction of the write through the openvibe-sdk outbox and relayed with Community's service token. Payloads carry ids, owner/author subject, visibility and the public URL, never a title, body or content; items that are not public (unlisted pastes, members-only or staff spaces, hidden threads) travel as internal events without a URL. Off unless EVENTS_URL and the client secret are set. test/events.test.jsOpenVibers · 24 Sept 2026 c8a70c7
SECURITY.md: how to report a vulnerability ([email protected], 7-day reply, scope, supported versions)OpenVibers · 24 Sept 2026 e075d39
Pastes browse: Show pastes, images or all (?type=), carried through paging (lang=image still means images); the home page's 'What is coming' roadmap block is replaced by what is live (spaces, threads, Pulse); /llms.txt says what Community is and how AI pastes are labelledOpenVibers · 24 Sept 2026 985da86
openvibe-shared v1.5.1 (Track R release manifest), openvibe-contracts v0.33.0OpenVibers · 23 Sept 2026 78f2f9b
Paste list for feeds: GET /api/pastes takes sort=top (views, a like worth five views, newest first on a tie), since= (created at or after; ISO 8601 or 'YYYY-MM-DD HH:MM:SS' UTC, compared with datetime() so imported ISO timestamps work; an unreadable value is ignored) and pinned_first=0 (a pinned paste stays in sort order instead of leading every list). With the existing origin=user|ai this is what OpenVibe.Live's Content feed (people's pastes) and Moments feed (AI pastes) read: a list merged with VODs and clips by date or score needs every source in its own sort order, and "top this week" needs a window. Defaults are unchangedOpenVibers · 23 Sept 2026 6d534d8
Comment threads on a Live channel link to its page, /@<username> (they linked to /<username>, which is not a page on Live); threads on a Live stream link to /stream/<id>OpenVibers · 23 Sept 2026 63b90a8
Members-only discussion through OpenVibe.VIP: a forum space or a single thread can be for one creator's VIP membersOpenVibers · 23 Sept 2026 57d1dd4
CI: run the shared security workflow (gitleaks secret scan + dependency audit, Track Q)OpenVibers · 23 Sept 2026 131f5f5
Live's VOD and clip comments become Community threads (Wave 5 exit: Live and a second product share one thread)OpenVibers · 23 Sept 2026 7d7cc3d
Docs: STATUS.json and README match production (2026-09-23)OpenVibers · 23 Sept 2026 466eaba
Unlisted and private pastes always get a secret slug: a service-named slug only applies to public pastes (Live forwards people's /api/pastes bodies as-is, so a person could pick a guessable slug)OpenVibers · 23 Sept 2026 922f834
Discord relay: a mapping may only name an allow-listed webhook variable (DISCORD_WEBHOOK_*, or exactly the names in DISCORD_RELAY_WEBHOOK_VARS). Staff could point the relay at the URL in any environment variable (an internal service's base URL) and learn which variables are set; such mappings are now refused when made, never sent to if already stored, and never reported as configuredOpenVibers · 23 Sept 2026 be48b73
Unlisted pastes get slugs nobody can guess: a new unlisted or private paste (and a fork of one) gets adj-noun- plus 16 random base62 characters (~2^95) instead of the ~1.5M adj-noun-NN space that could be walked; public pastes keep the short form, service-named slugs are unchanged, and existing slugs keep workingOpenVibers · 23 Sept 2026 2e6f43b
Comment threads cannot be enumerated: every thread gets an unguessable access id (cth_ + 128 random bits, filled in for existing threads on boot, unique index); browsers address threads only by it and get it as the thread id from resolve, while the sequential id keeps working for services (Blog, Wiki, Deals, Reviews resolve by EntityRef with a service token and store it), so walking ids no longer reveals the refs and comments of unlisted or private entitiesOpenVibers · 23 Sept 2026 faa08c2
nginx: client address headers only from $remote_addr (realip). X-Forwarded-For was appended to and CF-Connecting-IP passed through from the client, so a request reaching the origin without Cloudflare (DNS-only host or the bare IP) chose the address the service bans and rate-limits byOpenVibers · 23 Sept 2026 8d782c4
Forum Markdown: fix ReDoS (a heading with trailing spaces was cubic, unclosed **/__/~~ and backtick runs quadratic, fence lines and [ runs in markdownToText quadratic); a 40,000-character post could block the server for minutes on every view; same output, linear-time matchingOpenVibers · 23 Sept 2026 8bba2d6

More commits