Commits
-
Pins: openvibe-contracts 0.42.0 → 0.44.0 (Contracts 0.43.0 and 0.44.0 were released after the previous pin commit, leaving 0.42.0 two minors behind the pin-drift limit)OpenVibers · 25 Sept 2026
294f7b5 -
Pins: openvibe-contracts 0.38.0 → 0.42.0, openvibe-sdk 0.5.0 → 0.9.1; CI runs the pin-drift check (shared test and security workflows at 423fe51)OpenVibers · 25 Sept 2026
6f83a1a -
Staff powers from the contracts staff map (WS-D, ADR-022; Contracts 0.38.0): moderators are staff.content.moderate (global_mod and up, as before) or DEALS_MODERATORS (the product's own role), not a role list. test/staff-map.test.js fails on raw role checksOpenVibers · 24 Sept 2026
c17c010 -
The OpenVibe Frame from this site's own pinned copy: /shared/* is served by openvibe-shared/serve (1.12.0) and every page references it by content hash (/shared/<file>?v=<hash>), so this site's pin decides what its pages run and its navbar and footer keep working while openvibe.network is down; openvibe-publishing 0.4.0 (openvibe-shared as a peer: one copy, no lockstep releases)OpenVibers · 24 Sept 2026
829013c -
The shared update system and one account UI, on the OpenVibe Frame (openvibe-shared 1.11.0, openvibe/frame): the home shows what shipped, /updates is the shared log and the footer links it; the shared navbar handles sign in and out (logoutUrl ends this site's session) and carries this site's account links in its menu, while the page's own account bar is only for no-JS visitorsOpenVibers · 24 Sept 2026
c2ad40a -
CI calls the shared test workflow (Track Q): OpenVibe.Shared .github/workflows/test.yml@f5e7e73 (install, node --check over server/ and scripts/, npm test, openvibe-contracts-check) instead of a copy of those stepsOpenVibers · 24 Sept 2026
e50a4d0 -
openvibe-publishing v0.2.2 (shares the openvibe-shared v1.5.1 copy instead of installing v1.0.0 alongside)OpenVibers · 24 Sept 2026
3910b58 -
SECURITY.md: how to report a vulnerability ([email protected], 7-day reply, scope, supported versions)OpenVibers · 24 Sept 2026
d12cfbf -
Importer: deals.offer.updated names every field an observation moved (expires_at, product_id, title, status), not just 'observation', so consumers never miss a changed fieldOpenVibers · 24 Sept 2026
24d52a2 -
openvibe-shared v1.5.1, openvibe-contracts v0.33.0OpenVibers · 23 Sept 2026
f453cb5 -
openvibe-shared v1.5.0 (Track R release manifest), openvibe-contracts v0.32.0, openvibe-sdk v0.5.0OpenVibers · 23 Sept 2026
603ff5b -
CI: run the shared security workflow (gitleaks secret scan + dependency audit, Track Q)OpenVibers · 23 Sept 2026
91ca223 -
Docs: STATUS.json and README match production (2026-09-23)OpenVibers · 23 Sept 2026
e7b8da0 -
Events webhook requires signature v2 (replay window); openvibe-sdk v0.4.0OpenVibers · 23 Sept 2026
e72aeec -
nginx: client address headers only from $remote_addr (realip). X-Forwarded-For was appended to and CF-Connecting-IP passed through from the client, so a request reaching the origin without Cloudflare (DNS-only host or the bare IP) chose the address the service bans and rate-limits byOpenVibers · 23 Sept 2026
ac82f60 -
openvibe-publishing v0.2.1 (ReDoS fixes in ssr markdown)OpenVibers · 23 Sept 2026
c1b58e6 -
App and module tokens act only for their on_behalf_of person; sandbox tokens refusedOpenVibers · 23 Sept 2026
3f5fa5b -
API: a moderator-removed deal answers 410 like its page instead of serving its title, description and link; moderators still read itOpenVibers · 23 Sept 2026
2297851 -
openvibe-contracts v0.23.0 (deals manifest and capabilities released); contracts check is blockingOpenVibers · 23 Sept 2026
dd08793 -
README (purpose, owns, does not own, depends on, grants, acceptance, launch rule, threat review, deploy), STATUS alpha W18, .env.example, deploy (systemd unit, nginx vhost on 4840), CI on Node 22.22.1 (contracts check continue-on-error until release), capability and service manifest proposals, Events subscription scriptOpenVibers · 23 Sept 2026
94f99e9 -
OpenVibe.Deals service (Wave 18, Deals): the nine deal_* tables in its own SQLite; community submissions and Sources imports as offers whose every price, shipping, condition and availability is a timestamped observation with its source (fresh/stale, never "current", unknown stays unknown in pages, JSON, JSON-LD, comparison, feeds and Search); product and store records with aliases; reversible, audited duplicate merges that keep every vote (a voter counts once) and all history; server-authoritative votes with rate limits per subject, IP hash and offer, new-account weight and vote-ring flags; deterministic hotness hot@1 snapshots; keyword/product/price-below watches and saved searches that notify at most once per observation (deals.watch.matched); flags and moderation; Community comment threads; SSR pages useful without JavaScript, feeds, sitemaps, robots, llms.txt and the indexability gate; /api/v1 with one capability per route; outbox events and Search index documentsOpenVibers · 23 Sept 2026
040cca5 -
Charter: OpenVibe.Deals as defined in the OpenVibe realignment plan (placeholder, no code yet)OpenVibers · 21 Sept 2026
f58795d