Commits

main

Contracts 0.79.0: service-token capabilities for every internal call that still used X-Internal-Key (plan T2, register C-50–C-58): network.avatar.write, network.registry.read, network.coins.read, live.avatar.write, live.url_registry.refresh, live.analytics.read, media.avatar.ingest and tools.analytics.read, each with request/result contracts modelled on the real handlers, catalog entries and fixtures; avatar URLs must be on https://openvibe.media/. The owning services' manifests list them. npm test: 14295 checks passed; compat vs v0.78.0 without breaking changes.OpenVibers · 29 Sept 2026 7ddcf069
Contracts 0.78.0: the realtime service manifest is removed. ADR-005 closed OpenVibe.Realtime (browser realtime is a delivery plane inside OpenVibe.Events) and the service was never built; the ADR-005 contracts it defined stay (identity.realtime-ticket-claims@1, network.realtime-ticket-result@1, network.notification.created@1 are Network's). test/run.js asserts the manifest is absent and that no catalog entry is owned by realtime. Consumers that pinned the realtime row (Network's registry tests) move with this release. npm test: 14061 checks passed; compat vs v0.77.0 without breaking changes.OpenVibers · 29 Sept 2026 5d45dd9a
Contracts 0.77.0: agents, confirmations, the adaptive fabric and the resource index (roadmap section 4C). identity.subject-ref@1 gains the agent subject (agt_<ULID>); ids knows agt and cnf; principalSub accepts agents. events.event-envelope@1 gains optional on_behalf_of. capabilities.capability@1 gains optional sensitive, set on sixteen capabilities with external side effects. New: network.confirmation-request@1, events.delivery-policy@1 (delivery classes, per-key ordering, latency, retention tiers, routing objective, batching, residency, 64 KB ceiling), the first-party platform.* fabric contracts (resource-offer, workload-requirements, placement-result, placement-plan, rate-card, provider-state, cost-snapshot, capacity-snapshot), common.resource-summary@1, common.resource-list-result@1 and common.resource-cost@1. Fixtures and the regenerated bundle. npm test: 14065 checks passed; compat vs v0.76.0 without breaking changes.OpenVibers · 28 Sept 2026 7c16286d
Contracts 0.76.0: the node registry (ADR-034 section 12, roadmap WS-X1). network.node@1 describes one machine of the platform: its roles (web, app, data, media-worker, ingest, edge-probe, edge-relay, edge-cache, gpu, staging, ci), region-level location, provider, an HTTPS beacon clients time for their round trip, and health. No addresses, capacity or secrets are public. network.node.report (internal, Host) with network.node-report-request@1 (POST /internal/nodes/report) sends the complete set of nodes an inventory knows; a node absent from a later report is marked down, never silently deleted. network.node-list-result@1 is GET /api/v1/nodes (public, ?role=, ?region=), the input of the SDK's geo nearest(). Fixtures (valid and invalid: public address, unknown role, bad country, plain-http beacon) and the regenerated OpenAPI and JSON Schema bundle. npm test: 13847 checks passed, compat vs v0.75.0 without breaking changes.OpenVibers · 28 Sept 2026 0f4cf3f7
ADR-035 amendment: one dialect, async-first, every service. After the costs were laid out the owner confirmed: migrate all services, async-focused and tuned. Services write PostgreSQL SQL only; the data layer has no SQLite adapter. Tests run real PostgreSQL in-process through PGlite, and CI also runs each migrated suite against PostgreSQL 18 + PgBouncer (transaction mode) + Valkey. A verified importer (batched COPY, type mapping, per-table counts and checksums) moves each service's SQLite data once. Per-service steps are restated (schema, async data access, per-process state to Valkey, suites, rehearsal on a production copy, freeze-import-switch, SQLite read-only for the N-1 window). The roadmap's engineering standards (section 4B.7) bind each migration.OpenVibers · 28 Sept 2026 d2a89dfe
ADR-035 (accepted, owner decision 2026-09-28): PostgreSQL and Valkey as the data tier. PostgreSQL 18 becomes every service's system of record, one cluster in the data role (on this host until a data server exists): a database, an owner role and a pooled application role per service, PgBouncer transaction pooling, loopback and private-network only, scram-sha-256. pgBackRest keeps 14 days of point-in-time recovery in an encrypted B2 repository, with monthly restore drills. Valkey 9 (BSD, chosen over Redis for its licence) is the shared, never-authoritative store for caches, per-actor limits, queues, pub/sub, presence and sessions: an ACL user per service on its own key prefix, volatile-lru eviction so only TTL keys go, AOF. The SDK gains an async data layer with PostgreSQL and SQLite adapters, and cache, queue and pubsub helpers. New services start on it; existing services migrate one at a time, smallest first (Wiki first, Live last): data access onto the layer while still on SQLite, then a verified copy, then the switch, with SQLite kept read-only for the 7-day N-1 window. Supersedes ADR-007's 2026-09-26 trigger rule; the ownership rule and the 2026-09-24 runtime posture (pooling, replicas, SERIALIZABLE money paths, non-authoritative cache) still bind. ADR-007's status line says so. npm test passes.OpenVibers · 28 Sept 2026 d9f6a412
ADR-034 (proposed): the platform north star, an open affordable cloud. The owner's direction of 2026-09-28 ("the open affordable version of AWS one day"; scalable, interconnected, a full SDK and API, moddable, many locations with geolocation) as rules. Build now what is expensive to retrofit: projects as the tenancy for everything including first-party products, one resource name (ovrn:<service>:<project>:<type>/<id>), resource-scoped grants with conditions evaluated by one SDK policy function, contracts that generate OpenAPI, AsyncAPI, SDK clients, a CLI and later an OpenTofu provider, and metering through common.usage-recorded against a public cost-based price list. Move infrastructure only on a measured trigger (ADR-007, ADR-032): control plane first, then cells (sets of hosts per group of projects) instead of one bigger system. Also a service kit, pulled and gated deploys ordered by contracts, extensions at four levels under one manifest (events, Stage C functions, UI extension points, marketplace), measured efficiency, and per-project observability. Section 12 covers many locations: regions as full cells with project home regions and data residency, cheap edge nodes (probe, relay, ingest and cache roles, no tenant data), three load-balancing layers, and a geo API (nearest node by measured RTT, then Cloudflare colo, then an IP database; region-level only) with a probes API, which game-server lists, a many-location ping tool, ingest, TURN, matchmaking and uptime checks all use. Phased as roadmap WS-W. npm test: 13787 checks passed.OpenVibers · 28 Sept 2026 c05c0eb5
npm test reads skip lines and never reports a skip as a pass (roadmap WS-Q task 7, the rule of openvibe-shared/test-runner). test/run.js ran its sub-scripts (the capability-schema, OpenAPI, loyalty and presence tests, generate --check and compat) with inherited output, so a "<label>: skipped (<why>)" line from one of them could not be seen and the run ended "N checks passed" regardless. They now run with their output captured and shown as before (a failure still stops the run), their skip lines are collected, and the last line says "N checks passed, K skipped (…)" when anything was skipped; only a run with nothing skipped prints the plain line, and --strict (or OV_TEST_STRICT=1) makes a skip fail the run. SKIP_RE and skipsIn are copied from openvibe-shared/test-runner, which this package does not depend on. Nothing here skips today. npm test (Node 22): openvibe-contracts: 13787 checks passed.OpenVibers · 28 Sept 2026 d134d2d8
manifests/services/games.json: rollback follows the 2026-09-27 ovhost cutover. ovhost deploy games (pnpm-build) restores the previous sha, rebuilds and restarts on a failed readiness check, and sudo ovhost rollback games --to <sha> is the manual path. The note that Games was not managed by ovhost was stale. Ships in the next tag.OpenVibers · 28 Sept 2026 6b5dbcf4
README and STATUS.json are current (roadmap WS-U task 3): the README gains Security (SECURITY.md; how serviceAuth and capabilities.check judge tokens, the staff map, fixtures, dependencies) and Deploy (nothing deployed: releases are tags services pin and deploy with ovhost; rollback by pinning the previous tag) sections. Capabilities and events says Contracts implements, produces and calls nothing and defines the rest. The status line names v0.75.0 and today's counts (540 schemas, 31 service manifests, 205 capability manifests, 13 namespace manifests) instead of v0.34.0's, and drops the stale per-consumer pin list. STATUS.json gains deployed false, deployment, contracts and features and is updated 2026-09-28.OpenVibers · 28 Sept 2026 6b969345
scripts/docs-currency.js checks documentation currency (roadmap WS-U task 3) for every service in manifests/services. The README must have a section for Purpose, Owns, Does not own, Depends on, Capabilities or Grants, Acceptance or Tests, Security and Deploy. STATUS.json must have repository (matching the manifest), stage, deployed, contracts, features and updated; contracts must name the tag package.json pins, and updated must be no older than the last change to package.json. It reads local checkouts under a root, fetches and writes nothing, prints ✓/✗ per service (or --json) and exits 1 on any gap. First run on 2026-09-28: 0/31 current. governance/README.md documents it.OpenVibers · 28 Sept 2026 feb8e20f
v0.75.0: per-streamer AI budgets are AI quotas (roadmap WS-O task 2). ai.quota.attribution.manage (first-party): a service caps what runs attributed to one of its own entities may cost or request per hour or day (PUT /api/v1/attribution-quotas/{attribution}, ai.attribution-quota-put@1, optionally for a workflow prefix), reads it with the window's use (ai.attribution-quota@1) or removes it; the attribution's service must be the caller (Live: live:user:<id>). Over the cap a run is refused 429 quota.exceeded before any provider is called.OpenVibers · 28 Sept 2026 8cadcae5
v0.74.0: ai.credential-put@1 api_key is optional after the first put. The stored key is kept for a change of models or budget, and must be entered again to change provider or base_url, so a key never follows a new endpoint on its own (roadmap WS-O task 2).OpenVibers · 28 Sept 2026 59005a5a
v0.73.0: a person's own provider key lives in OpenVibe.AI (roadmap WS-O task 2). ai.credential.manage (first-party): the service holding a person's consent stores their key (PUT /api/v1/credentials/{subject}, ai.credential-put@1: openai or anthropic, an https base_url, models per role, an optional budget_usd_per_day), reads it back without the key (ai.credential@1: a four-character hint and today's spend) or deletes it; only the storing service uses or changes it. ai.run-request@1 gains the optional credential { subject }: that provider with that key only, no fallback, never cached, the shared paid budget untouched, the credential's daily budget enforced; chat operations only.OpenVibers · 27 Sept 2026 872df271
v0.72.0: mod principals in Network (roadmap WS-M task 3, ADR-013). mods.grant.manage is active: the owning runtime registers an install's principal mod:<mod_id> (POST /internal/mods, network.mod-install-request@1: the manifest and the subset approved at install, the rest pending), approves or revokes one capability (POST /internal/mods/{id}/grants, network.mod-grant-change@1), revokes the install (POST /internal/mods/{id}/revoke) and reads them (GET /internal/mods[/{id}]). Only the owner or Network staff (staff.games.manage) change a mod. Adds network.mod-principal@1 and the event network.mod.grants_changed@1 (the complete approved set by revision, the change, runtime or staff), which Games consumes.OpenVibers · 27 Sept 2026 8cccacde
v0.71.0: account export and deletion (roadmap WS-B task 7, ADR-033). Adds the events network.account.export_requested (export_id, subject, requested_at, deadline; each service pushes its part to POST /internal/account-exports/{id}/parts, network.account-export-part@1, capability network.account.export.contribute) and network.account.deleted (deletion_id, subject, aliases, requested_at, deleted_at; each service erases its rows once per deletion_id, keeps money rows pseudonymised, held media and tombstones under others' replies, and confirms at POST /internal/account-deletions/{id}/confirmations, network.account-deletion-confirmation@1, capability network.account.deletion.confirm), network.account-export@1, network.account-deletion@1 and network.account-data-receipt@1. Network's manifest lists the events and capabilities; Live, Chat, Community, Media and Games consume both.OpenVibers · 27 Sept 2026 421c8107
v0.70.0: network.user.token_valid_after gains the reason account_merged (a folded-in account's tokens end at the merge; its sessions moved to the survivor), and modules.namespace@1's description follows ADR-029 (both accounts have a record: the survivor keeps its own and gains only the top-level fields it lacks). Roadmap WS-B task 5.OpenVibers · 27 Sept 2026 1b76cbc6
v0.69.0: account merge (roadmap WS-B task 5, ADR-029). Adds the event network.subject.merged (merge_id, from, into, merged_at, initiated_by person|staff, split_until; visibility internal; each service repoints its own rows from the alias to the survivor, once per merge_id, dropping and counting what it cannot move), network.account-merge-result@1 (what Network moved as counts, replayed for a retry) and staff map 1.2.0 with staff.identity.merge (owner, since 1.2.0: account-recovery merges with a reason and an audit row). Network's manifest lists the event.OpenVibers · 27 Sept 2026 7d0661e2
v0.68.0: creator analytics from events (roadmap WS-E task 6). live.stream.ended gains an optional stats object (peak and average viewers, unique chatters, messages, watch minutes: counts only), network.creator-analytics-result@1 (a creator's daily and per-stream analytics, built on Network) and network.analytics.creator.read (first-party: the full figures for Live's creator dashboards; streams, minutes and peak viewers are public).OpenVibers · 26 Sept 2026 081a23ad
v0.67.0: network.follows.write and network.follow-write-request@1 (ADR-030 step 4): a first-party product records a follow or unfollow on a person's behalf (PUT/DELETE /internal/follows/:type/:target), and Network keeps the graph and emits network.follow.*.OpenVibers · 26 Sept 2026 73fbe393
v0.66.0: incidents and maintenance on the status page (roadmap WS-N task 12). network.status-incident@1, network.status-incident-list@1 (public: active and the last 30 days) and network.status-incident-request@1 (open, or add an update), and the capability network.status.incident (internal; staff admins and the Host principal: ovhost incident / maintenance).OpenVibers · 26 Sept 2026 75b74116
ADR-032: containers for platform services (roadmap WS-N task 12). Platform services stay systemd units (dedicated users, hardening, slices, socket activation for zero-downtime restarts); ovhost keeps one deploy adapter with a reserved inventory runtime field; untrusted tenant code is the Stage C isolation ADR's. Revisit on a second host, a conflicting system dependency, Stage C, or a unit systemd cannot harden enough.OpenVibers · 26 Sept 2026 2a7f385a
v0.65.0: the follow graph on Network (roadmap WS-E task 4, ADR-030). Adds the events network.follow.created and network.follow.deleted (follower, target_type channel, target_id the channel owner's subject, notify flags, per-pair revision; subject visibility), network.follow-status-result@1 (public count plus the caller's own follow), network.follow-list-result@1 (a page of follows, never public) and the capability network.follows.read (first-party, never for apps).OpenVibers · 26 Sept 2026 34266487
v0.64.0: Wiki VIP spaces and pages (roadmap WS-K task 8). vip joins Wiki's visibilities (wiki.space@1, wiki.page@1, the space and page write requests, and the wiki.page.* / wiki.space.updated payloads): readable by the space's roles and the viewers OpenVibe.VIP admits as members of the space owner (vip.resource.policy.evaluate, resource wiki/page or wiki/space, fallback wiki:gated_page). Never in search, sitemaps or feeds. Widening only.OpenVibers · 26 Sept 2026 37546a90
v0.63.0: project usage rollups (roadmap WS-N task 4, ADR-014). New common.usage-recorded@1: one closed hour (or day) of one developer project's use of one capability in one environment, as the owning service counted it: project_id, env, capability, optional dimension (job type or tool), unit, window, window_start/window_end, quantity, errors, error_codes (up to 20) and samples (up to 10 recent failures: time, code, status, trace id, job/event/run/object id), plus revision; totals, not deltas, so a re-sent window replaces the earlier one; never a subject, app, address, session, input or message. New event types tools.usage.recorded (a Tools satellite's hour of a project's jobs, per tools.job.create or tools.tool.run) and events.usage.recorded (events.app.publish in events with refusals as errors; events.app.subscribe in deliveries with failed attempts as errors), both common.usage-recorded@1; the Tools and Events manifests produce them and Network consumes both. New network.project-usage-result@1 for GET /api/v1/projects/:project/usage on Network (daily rows, totals, recorded quotas with what their window used, errors by code and recent sampled failures). Fixtures; npm test checks each <service>.usage.recorded is the common payload, owned by its service and consumed by Network, and that a rollup carries no identity and at most ten samples. Additive (compat vs v0.62.0: no breaking changes).OpenVibers · 26 Sept 2026 6f32032a
v0.62.0: operator alerts (roadmap WS-H task 11). Capability network.operator.alert (internal; POST /internal/operator/alerts on Network, granted to the Host principal) with network.operator-alerts-request@1 (the complete set of alerts firing at one source: fingerprint, name, severity, summary, description, service, started_at) and network.operator-alerts-result@1 (firing, opened, reminded, resolved, notified). Network pages the owner when an alert opens, once a day while it stays open, and when it resolves.OpenVibers · 26 Sept 2026 24c51f23
gitleaks: the sample realtime tickets in the network.realtime-ticket-result fixtures (empty payload, literal "signature") are allowlisted by path and valueOpenVibers · 26 Sept 2026 1152494b
ADR-005 amendment 2: the badge's retry schedule as built in openvibe-shared 1.22.0 (2 s doubling with jitter; ten failures in a row, about 9 to 17 minutes, leave polling only until the browser is online again)OpenVibers · 26 Sept 2026 c232178e
v0.61.0: a person's realtime topic and realtime tickets (roadmap WS-E task 3, WS-F task 1; ADR-005 amendment 2). New event type network.notification.created (payload network.notification.created@1): Network's outbox, in the transaction that stores a notification; subject the recipient, visibility subject, actor system:network; id, type, category, priority, service, created_at and the unread count, never the title, message, link or sender. "user:<id>" is that event type with subject visibility: the badge subscribes to network.notification.* and gets its own only. New identity.realtime-ticket-claims@1 (a two-minute single-use RS256 ticket for Events' /realtime/stream?ticket=; issuer <network>/realtime, typ and purpose realtime, audience openvibe.events only, so it never passes for a session) and network.realtime-ticket-result@1 (POST /api/v1/realtime/ticket). Network manifest produces the event; fixtures; npm test checksOpenVibers · 26 Sept 2026 2df73656
governance/ (roadmap WS-U task 1): the index of the platform's governance documents as published on openvibe.codes (code of conduct, contributing, roles and escalation, proposals, compatibility, moderation with appeals, licensing, billing policy, limits, public roadmap, security), and the licences each repository declares on 2026-09-26, with the eight that disagree or are missing, for the owner's licence and DCO/CLA decision (WS-U task 2)OpenVibers · 26 Sept 2026 8970f0d3

More commits