Commits
-
Per-actor rate limits on Coupons' /api/v1 and its page forms (roadmap WS-R task 4, openvibe-sdk v0.12.0 limits). server/http/actor-limits.js makes one limiter per app and counts requests once req.viewer is resolved. A person counts as user:usr_…, whether they call with their Network token, a service names them in X-OV-Subject, or one of their browser helpers sends the request with its cpx_ install token. Every browser a person connected counts together, never by the address it reports from. A first-party service relaying a signed-out visitor counts by the address it forwards. A service or app acting as itself, such as svc:ai for coupons.extract_coupon, counts by its principal. A signed-out caller counts by address. A first-party service reading for itself is not counted on reads, since the lookup limiter already bounds it at 600 a minute. Past a limit a route answers 429 problem+json rate_limited with Retry-After before the route does any work (on the API after the guard, on forms before the body is read), logs one [Limits] line and counts coupons_rate_limited_total{limit,window}.OpenVibers · 28 Sept 2026
64835d2 -
Moderation audit (ADR-022, WS-D task 1): coupons.moderation.action from the outbox in the same transaction when staff or a staff-capable service disables, expires, re-enables (coupon.disabled|expired|enabled, the note as reason) or approves (coupon.approved) someone else's code, or approves, disables or re-enables a shop (merchant.approved|disabled|enabled, with the codes it published); it names the staff member and never the submitter (owner_subject null) or the code; staff changing their own code reports nothing. Pins: openvibe-contracts 0.49.0 → 0.53.0OpenVibers · 26 Sept 2026
f86f660 -
openvibe-shared v1.5.1, openvibe-contracts v0.33.0OpenVibers · 23 Sept 2026
93f333b -
openvibe-shared v1.5.0 (Track R release manifest), openvibe-contracts v0.32.0, openvibe-sdk v0.5.0OpenVibers · 23 Sept 2026
a6a86b2 -
Docs: STATUS.json and README match production (2026-09-23)OpenVibers · 23 Sept 2026
e48457a -
Reports: the submitter of a code (or of evidence for it) cannot report on itOpenVibers · 23 Sept 2026
870c389 -
OpenVibe.Coupons service (Wave 18): merchants and normalized domains (bundled public-suffix subset, subdomain and path rules), codes with restrictions, honest expiry and evidence, status unknown|reported_working|reported_failed|expired|disabled from deduplicated, rate-limited people's reports only (documented confidence formula with recency decay), public lookup API with extension CORS and per-caller limits, revocable cpx_ extension install tokens, SSR pages useful without JavaScript, feeds, sitemaps, Sources import with holds, events and Search documents through the SDK outbox; README, STATUS alpha W18, .env.example, deploy (systemd, nginx on 4850), CI, capability and service manifest proposalsOpenVibers · 23 Sept 2026
83dd07d -
Charter: OpenVibe.Coupons as defined in the OpenVibe realignment plan (placeholder, no code yet)OpenVibers · 21 Sept 2026
55da4b6