CHANGELOG.md

Changelog

What changed in OpenVibe.Exchange, newest first.

Unreleased

• Search: one engine by default, honest prices, one combined cap when you compare (2026-11-13). A search now
  runs one engine, the router's pick unless you name one; comparing two or three engines is an explicit choice and
  shares ONE spending cap that is shown before the run. Prices are words, never "Free": no provider fee, your
  instance, included allowance (with the allowance), or your key. Every filter says whether the chosen engine
  applies it, we filter the results, or it is not supported and will be refused rather than dropped. Image results
  keep the provider's rank beside our order, and the engine list names each supplier's upstream (Google, Bing,
  Yandex). New image engines: SerpAPI Google Images and reverse image, SearchAPI Images, TinEye. Pexels says new
  keys are paused. Unsplash results have a "Use this picture" action that records its required download event once.
  The picture and search views now allow provider thumbnails and the AI image proxy in the CSP.

• Measured, and your own AI usage (2026-11-12). A model page now has a Measured panel from
  OpenVibe.Report's public performance rows: first token and whole-answer percentiles, tokens a second, success,
  cache hits, what a call and a million output tokens were charged, and calls in the last 30 days. A model below
  Report's floor of 20 calls says "Not measured yet". A signed-in person's dashboard Usage adds Your AI usage
  (calls, tokens, charged, a call a day and the products), read from Report with the person's own Network session.
  Both draw with openvibe-shared/ov-metrics; the same numbers stay as plain text without JavaScript.

• The public pages of ai.openvibe.services are here now (2026-11-07). The old site's home, prices and latency,
  changelog, legal pages and discovery files answer 301 on an exact page map; every API route there is unchanged.
  Three pages carry the content: /start (the endpoint, four steps, OpenAI/Anthropic/Link samples, AI's six
  operations and app-token path, the sandbox and production table, and the links to the session pages /you and
  /runs/:id), /why (the router's own explanation, with a signed-in one-question demo that prints a real run's
  explain: objective, selected, every candidate's cost and latency, and why each was passed over) and /faq (AI's
  six questions merged with Exchange's, with FAQPage JSON-LD). Sitemap, llms.txt, llms-full.txt and the Markdown
  twins (/start.md, /why.md, /faq.md) carry them; openvibe-shared/indexnow pings the new pages on deploy when
  INDEXNOW_KEY is set. /api and /start link to AI's own provider-keys page (/you) because it needs the
  person's session.
• Pooled machines (/sell). Under the single-machine card, a signed-in person with two or more of their
  machines sees "Pool your machines": the four steps of the design as stacked cards. Choose the machines lists
  each machine with its GPU, free VRAM and RAM and Link's measured link in words ("2 ms, 940 Mb/s: good"; a failed
  link says the number and the limit, "40 ms; a pool needs under 5 ms"), and a machine on another network is
  greyed with its reason. What fits is Link's fit table: a measured speed, or "not measured yet". Approve on
  each machine says "Waiting for approval on Laptop" until that machine approves on itself. Offer it shows the
  same price, audience and idle-only controls as one machine, with the privacy sentence (the head sees the prompt,
  the others only numbers in transit), and nothing is offered until every member approves. "Stop pooling" says what
  it does. The machines, pools, links and fit come from Network and AI with the person's own token: Exchange
  measures nothing and keeps no pool. The offer card on model pages and /models says "Community pool (N
  machines)" and only the count; the owner sees the machine names on /sell.

• Private AI. Strict privacy is a switch on /chat and on the API page's keys. It sends AI the private preset:
  only offers that keep nothing and train on nothing (or OpenVibe's own deployments) may answer, the router refuses
  with a plain message when none can, and every answer's receipt carries its label (Private, No training, Anonymized,
  Community, Standard).
• Sealed history. A chat can be sealed with the person's Locker: the browser seals the whole conversation
  (ov-locker.js, people-locked to the person) and Exchange stores only the envelope. The chat list shows a neutral
  title until it is opened, the model still receives the turn it answers, and the page says so plainly. Account
  export carries the envelope and deletion erases it.
• The Arena (/arena). One prompt, two models answering side by side with no names, one vote (left, right, a
  tie, or both bad), then both names and their receipts. The pair is chosen from the live catalogue, free-tier
  capacity first and different families where possible, and each answer is a normal run on the person's own
  allowance. A vote is a Bench human_pairwise judgement for that person, filed under the prompt's task category
  (code, writing, chat, reasoning, translation, analysis), rate-limited per person and counted once per round.
• Rankings (/rankings). Bench's board by task category beside the cheapest live price per million in and
  out, the measured p50 and uptime, and a value column (rating points above 1000 per dollar of output). A
  products-and-apps panel shows which models OpenVibe's products run, and developers' apps as one unnamed row, from AI's aggregate usage
  and never a person.
• Model changelog (/status). A daily snapshot of the catalogue in exchange_model_snapshots names the
  models that arrived, left or changed their price between the last two recorded days, with the dates.
• Account data. A person's arena rounds and votes are exported and erased with their account.

• Theme palettes. A Design theme's listing keeps the preview palette from Design's public API (background,
  surface, text, accent and up to two more), in a new palette array on the API; the card and the listing page draw
  it as small swatches. Only #rrggbb values are stored and painted; a second refresh leaves the row untouched.

0.1.0 — 2026-10-28

The first version: trade what people make, free and swap only.

• Listings. exchange_listings with a unique slug, kind (agent, mcp_tool, template, theme, game_asset,
  service), free/swap mode, SPDX licence, semantic version, public manifest, permission passport and a revision
  that goes up on every change. There is no price, currency or Billing column; a passport's spends is [] and a
  table check, the form and the API all enforce it.
• The passport. Reads, writes, spends and contacts, declared in the manifest and shown before and after install.
  An install stores its own snapshot, so a later edit cannot widen an old install. A manifest that looks like a
  credential is refused.
• Conformance tests. Submitting a draft runs manifest, passport, licence and no_money for its version and
  stores one row each. Only the owner can publish, and only when all four passed.
• Sandbox. A trial is a manifest/passport dry run with four recorded checks, a 60-minute TTL and at most 20 a
  day. A passed trial is consumed by the install. v1 does not execute the listing's code; a real Run sandbox is the
  next version's job and the page says so.
• Install and revoke. exchange_installs with one active install per (listing, person), the passport snapshot,
  a version and a revision. Revoke is one tap, idempotent, and a fresh trial is needed to install again.
• Free and swap. A free listing takes claims (exchange_offers kind claim); a swap listing says what it wants
  in return and takes offers with a required give. The owner accepts or declines; the sender withdraws. Accepting
  closes the listing as given or swapped, declines the other open offers and tombstones its Search document.
• Safety. The fixed prohibited-items and no-money filter is applied to every listing and offer, in the form and
  the API alike; /safety carries the local-swap rules.
• Search. Each public listing is one search.index-document@1 (owner exchange, type listing,
  /listings/<slug>) queued in exchange_outbox in the same transaction; closing or hiding writes a tombstone. The
  relay waits for the search.document.write grant.
• Account data. Listings, installs, sandbox trials and offers are exported and erased with an account. A deleted
  listing has its words replaced, is closed and is tombstoned in Search; a draft is deleted outright; other people's
  listings stay.
• The service. Network sign-in as OAuth client exchange (PKCE S256, exchange_at/exchange_rt/
  exchange_oauth), truthful readiness, Prometheus metrics on loopback, discovery, deploy files, and
  server-rendered pages with stable ex- ids. public/css/exchange.css and public/js/exchange.js are one-comment
  placeholders for the main session.
• The first proof. scripts/seed-proof.js lists a CC0-1.0 Website template, runs its conformance tests, tries it
  in the sandbox, installs it with its passport and revokes that install; it is idempotent.
• Tests. Migration and constraints, the API, sandbox/install/revoke, free/swap offers, pages and cache, SSO,
  Search, account export/deletion, noLooks, safety and the first proof — each file in its own process on a temporary
  PGlite database with a mock Network.