Commits

main · README.md

Add the bot service to host.example.json for OpenVibe.BotOpenVibers · 2 Oct 2026 9a62097
Add a logs subcommand to the ovhost CLI (#3)OpenVibers · 2 Oct 2026 203642c
Host on openvibe-contracts v0.83.0, which releases host.site.config: the local 'proposed capability' path and docs/capabilities-proposal/ plus the service manifest proposal are gone; capabilities are checked by the library alone, and the contracts test now holds the routes, guards and emitted events to the released manifests. npm test 52/52.OpenVibers · 29 Sept 2026 dee29c4
Host: certificate lifecycle, per-site config, tenant sitemaps and preview deploys (plan T12 J1, J3, J4, J6; behind the loopback service until the launch).OpenVibers · 29 Sept 2026 4cbdf05
Host tells search engines when a hosted site changes (plan T11, IndexNow): with INDEXNOW_KEY set, a production site's deploy, rollback, domain change or removal pings the engines for that site (its root and sitemap); sandbox sites never; unset, nothing is sent. A dashboard performance budget runs in CI. Tests green (verified).OpenVibers · 29 Sept 2026 bf33758
Host moves between its pages without a reload (plan T11): openvibe-shared v2.2.0 boost swaps <main> styles-first with the shared transition, prefetching on intent, and does a normal load across a deploy (the ov-boost marker carries the release). The navbar's sign-in returns to the current page.OpenVibers · 29 Sept 2026 92e4727
Host on the service kit (plan T1): sign-in is openvibe-sdk/sso createSsoClient (state + PKCE S256, server-side exchange, next limited to this site and the Network), service tokens are checked by openvibe-sdk/auth verifyServiceToken (the key their kid names; sandbox tokens still confined to sandbox projects), the outbox is createServiceOutbox with Host's event-type list; server/auth/sso.js is deleted. Pins: openvibe-sdk v0.25.0, openvibe-contracts v0.79.0, openvibe-shared v2.0.0. Both suites green (verified).OpenVibers · 29 Sept 2026 4030fdc
ovhost backs up and drills PostgreSQL services natively (every service but network, chat, tools, games and live is on PostgreSQL since 2026-09-28; the old inventory's SQLite paths no longer exist, so backups of those services had silently skipped). databases[] is a union: SQLite { name, path } or PostgreSQL { name, engine: postgresql, database: ov_* }, reached as the postgres OS user over peer auth (lib/dbengine.js; no service env value is read). Backup verifies pgBackRest every run (newest backup within 26 h, stanza ok, WAL archive failures not rising, else the service fails, never skips) and takes a pg_dump -Fc at most weekly (or --logical) for the existing off-site upload; restore-download checks .dump files with pg_restore --list. Drills restore the dump into a scratch database under a freshly generated role (pg_restore --no-owner --no-privileges --role), boot the release with DATABASE_URL and DATABASE_DIRECT_URL on the scratch database (direct port) and VALKEY_URL on a closed port, and refuse to start if any of the three would keep production's value or any PostgreSQL database is left unmapped; the scratch database and role are always dropped (dropdb --force, also after a failed stop), leftovers of a killed drill are swept first, free space is checked, and postgres can traverse the drill directory (0711). Probes gain postgresql-count, nginx tenants read ov_host over psql, metrics openvibe_backup_pg_verified and openvibe_pgbackrest_last_backup_age_seconds, alerts OpenVibeBackupSkipped and DataBackupStale. host.example.json converts the 19 PostgreSQL services (Media's drill also requires DATABASE_URL handling). Built by DeepSeek from the design brief, reviewed independently (FIX) and by Claude; every finding fixed here with tests (unmapped database refused, 0711 directory, leftovers swept, --force and --no-privileges). npm test 45/45. npm test 45/45 test files passed.OpenVibers · 29 Sept 2026 1157859
Host Stage B moves to PostgreSQL and Valkey (ADR-035, roadmap WS-X2, repository-pass group G2), async from end to end.OpenVibers · 28 Sept 2026 03d70e1
The data role in code (ADR-035, roadmap WS-X2): roles/data/provision.sh installs and configures PostgreSQL 18, PgBouncer, pgBackRest, Valkey and their Prometheus exporters, so any machine can take the role the way this host does. Everything listens on loopback until the private network exists. PostgreSQL is tuned for the shared host (shared_buffers 1 GB, effective_cache_size 4 GB, work_mem 16 MB, 120 connections behind the pooler), uses SCRAM, pg_stat_statements, and WAL archiving through pgBackRest. PgBouncer runs transaction pooling with SCRAM through auth_query (pgbouncer.get_auth, SECURITY DEFINER), so there is no password list to maintain. Valkey uses volatile-lru (only TTL keys are evicted), AOF every second, and ACLs with default off, admin and monitor users, and service users kept in services.acl. pgBackRest keeps an encrypted repository beside ovhost's pruned backup prefix in the same B2 bucket, with a weekly full and daily differential by systemd timer and 14 days of point-in-time recovery. The exporters are bound to 127.0.0.1, because the host firewall is off. add-service.sh gives a service its database, owner role, pooled runtime role (DML only, statement_timeout 15 s, lock_timeout 5 s) and a Valkey user confined to ov:<svc>:*, and writes DATABASE_URL, DATABASE_DIRECT_URL, VALKEY_URL and VALKEY_PREFIX into its env file. Passwords are generated once into /etc/openvibe/data.env (root, 0600) and reach PostgreSQL as SCRAM secrets and Valkey as SHA-256 hashes; nothing prints a secret. .gitignore's data/ rule gains a roles/data/ exception. The Prometheus config generator takes the inventory's exporters. test/data-role.test.js (scripts parse, loopback, SCRAM, transaction pooling, volatile-lru, archiving, no printed secret) and the Prometheus config test. npm test 39/39.OpenVibers · 28 Sept 2026 3479300
npm test no longer counts a skipped test as passed (roadmap WS-Q task 7; openvibe-shared/test-runner, Shared v1.25.0). test/run.js counted every file that exited 0 as passed, even one that had skipped part of its work. It is now the shared runner (same files, one at a time as before, 60 s timeout per file): a test prints "<label>: skipped (<why>)" for what it could not run, the same line scripts/release-acceptance.js reads, and that file is listed with ○ and its reasons and not counted as passed; --strict makes a skip fail the run. announce.test.js skipped its payload schema check without a word when the installed openvibe-contracts predates host.release.published@1; it now prints "announce payload schema: skipped (…)" then (the pinned 0.66.0 has the schema, so the check runs here). openvibe-shared is pinned at v1.25.0 (from v1.22.0; 1.23 and 1.24 add the web runtime, release-watch fixes and the readiness skip, and /api/ready answers as before because its db check really runs; README and STATUS.json follow). npm test (Node 22) 38/38.OpenVibers · 28 Sept 2026 ee84fbc
README and STATUS.json are current (roadmap WS-U task 3): the README gains Capabilities (the three host.* capabilities and the grants Host uses: events.event.publish, network.operator.alert, network.status.incident), Deploy (the ovhost CLI checkout and its timers; the Stage B service with sudo ovhost deploy host, unit, port, env file, state, rollback) and Security (SECURITY.md, the threat review, secrets, the operator plane, tenants, egress) sections. Stale facts corrected: every service deploys with ovhost since the 2026-09-27 cutover (not only 20), ovhost is no longer read-only, Stage B runs on loopback, restore drills ran on the host, incident controls and release notifications exist, and the install steps were done; Depends on names the current pins (contracts v0.66.0, sdk v0.12.0, shared v1.22.0). STATUS.json gains contracts and features, updates Stage A and the packages, and is updated 2026-09-28.OpenVibers · 28 Sept 2026 5d35e9d
docs/release-acceptance.md: the release-lifecycle acceptance suite (D46, roadmap WS-P task 16) — how to run it, how a gate is judged, which gates measure each D46 quantity, the scenario table (gate, evidence, budget, where each number comes from), what it found, what is open, and two recorded runs of 2026-09-27.OpenVibers · 27 Sept 2026 9e603ad
ovhost absorbs the per-repository deploy scripts (roadmap WS-N task 11). A service entry's `strategy` picks the engine and the defaults the script it replaces encoded: git-checkout (the default, what ovhost did before), multi-app (Tools: apps/_* skipped, untracked lockfiles the release tracks removed before the merge, preflight checks in each app, every openvibe-tools* unit file restarted via unitsMatch, ready.release and ready.allUnits), static-build (Sites: tracked dist/ restored from git before the merge, npm ci, node build.js, repo vhosts behind nginx -t, one release notification per dist/*/release.json), pnpm-build (Games: one pnpm install --frozen-lockfile for the workspace, pnpm build, generated dist-types/, rebuild on restore) and release-layout (Live, OpenRe; lib/release-layout.js: a release prepared in releases/<id> while current serves, node_modules hard-linked unless dependencies changed, node --check on changed files, an atomic current switch, static-only switches without a restart, the release's unit files, readiness with /release.json naming the new sha, switch back on failure, pruning that keeps any release a worker instance runs from, --prepare-only, ovhost rollback to the release the log says current replaced). The socket rule: pid 1 must hold the listener; only when the socket unit file changed or systemd does not hold the port is the service stopped, the socket restarted and the service started (systemd.rebindSocket, the only socket restart). --wait-idle now also holds a report-policy service. ovhost capabilities <svc> and --version are what the repositories' deploy.sh wrappers probe (deploy-api=1) before handing over, falling back to their deploy-legacy.sh otherwise. docs/deploy-strategies.md: the engines, every inventory field, the rule-by-rule mapping, what was not ported and why, the production cutover checklist and the proposed /etc/openvibe/host.json diff (not applied); host.example.json carries it. Tests: test/strategy-release-layout.test.js, test/strategy-in-place.test.js (fake host: worktrees, symlinked paths, mv -Tf, cp -al, pnpm). Version 0.3.0.OpenVibers · 27 Sept 2026 e4c7a58
ovhost archive (roadmap WS-S task 6, hazard H14): dead and backup database files encrypted with the backup key and copied to <prefix>-archive/<host>/<stamp>/ (outside the backup runs, so retention never prunes them), each upload checked by size, an HMAC'd manifest and a local record; archive list and restore (checked against the manifest). Refuses live inventory databases, open files (fuser), symlinks, paths outside /opt /var/lib /root /srv /home. Never deletes. docs/db-inventory.md: the 58 closed database files on the host, classified with a recommended action (legacy archived first; IP-bearing and secret backups keep their dated deletions, never archived). The in-memory S3 moved to test/s3-mock.jsOpenVibers · 26 Sept 2026 6e5e499
Limits page source (roadmap WS-N task 7): GET /limits.json on the dashboard host lists the default project limits (projects per owner, sites, custom domains, deploys a day, storage, files and file size) for sandbox and production, read from config, with the problem each answers past it; tenant hosts never reach it (host-isolation)OpenVibers · 26 Sept 2026 d1fc66d
Release notifications publish host.release.published, not host.deploy.activated (WS-P task 9)OpenVibers · 26 Sept 2026 100c279
Release notifications (roadmap WS-P task 9): ovhost publishes host.deploy.activated to OpenVibe.EventsOpenVibers · 26 Sept 2026 62fad64
Browser check (WS-Q task 3; WS-T tasks 3-4): scripts/browser-check.js runs openvibe-shared/browser-harness against every public product (the registry's public origins whose home answers HTML; known routes + one sitemap URL per section, detail pages first, up to --max-routes 7; /__ovcheck-404 must answer 404; Billing /policy only): per route x 390/768/1280 status, console errors, overflow, duplicate scripts; no-JS text, canonical and JSON-LD against visible text; axe-core serious/critical; per site repeated-navigation growth and idle work. Known noise (Cloudflare's injected beacon blocked by CSP, signed-out 401 session probes) is counted per label, --strict-errors fails it. --json, --out (appends a dated table + details), --remote <ssh-host> (script + harness streamed over ssh into a temp dir, run with --json there, removed; needs Node 22 + Chrome; OVHOST_SSH), --routes-file. ovhost deploy --browser-check: after a deploy that went through, that site is checked and reported; never changes the exit code or the record (lib/browser-check-hook.js). docs/browser-check.md: what it checks, the remote runner, the 2026-09-26 findings with the fix commits per repo, what is left, and the first recorded production run (11/23 sites pass before the fixes deploy). test/browser-check.test.js (stub harness, local registry, fake ssh, the deploy hook)OpenVibers · 26 Sept 2026 2286531
Lifecycle declarations in ovhost validate (WS-P task 1): lib/lifecycle.js reads each service's lifecycle from the inventory entry (it replaces the manifest's on this host), validate --manifest <file>, or the manifest in the installed openvibe-contracts (0.55.0 and later), and validate fails naming the service and the field when one is missing (live: lifecycle.shutdown.deadlineSeconds is missing), when a running service declares no liveness or shutdown, when shutdown.deadlineSeconds exceeds a unit's stop timeout (systemd's effective TimeoutStopUSec, else TimeoutStopSec in the unit source) or the unit's KillSignal is another signal, and when the checkout's installed openvibe-contracts is outside contracts.range; worker units that drain longer than their stop timeout warn (ovhost never stops them); systemd show reports TimeoutStopUSec and KillSignal; test/lifecycle.test.js (11 cases), fixtures carry a lifecycle; README and host.example.json say where the block comes from and that the v0.49.0 pin has none yetOpenVibers · 26 Sept 2026 70fc2ea
Protected probes (WS-P task 2): kind sum adds up parts (unknown when any part is, never read as zero; each part validated, no sum in a sum); the example inventory probes Chat sockets (/ready connections), Games players online (readiness sessions), OpenRe ingest sessions (openre.db) and Tools running jobs (the img, audio and docs jobs.db)OpenVibers · 26 Sept 2026 cb0cb55
Docs: ovhost deploys 20 services and runs the backups and drills (README said no deploy used it); cutover runbook gains the DNS steps (lower TTL a day ahead, record the old records, 30-minute watch, decommission after twice the old TTL) and port 1936 is recorded as open; register C-81: placeholder labels now come from factsOpenVibers · 24 Sept 2026 f8ac37d
openvibe-shared v1.5.1, openvibe-contracts v0.33.0OpenVibers · 23 Sept 2026 2144ceb
Restore drills for live and media: both inventory entries are now drill-supported, relying on the products' own switches (LIVE_DRILL from OpenVibe.Live 8a58aea, MEDIA_DRILL from OpenVibe.Media 6e74eb0; drill.requires refuses an older checkout). live runs on 13000 with the copy as DB_PATH and DATA_DIR={tmp}/data, compares /api/themes, /api/emotes/global, /api/streams, /api/streams/recently-online?limit=20 and /api/streams/channel/japaneseoldguy/live (ignoring what changes while someone is live, and the one Media-sourced thumbnail) and counts users, channels, managed_streams, streams, follows and chat_messages. media runs on 14100 with the copy as DB_PATH and its storage paths under {tmp}/storage (never created; THUMBNAILS_PATH stays production's, read-only, for the /browse tab counts), compares /browse?tab=videos and /browse?tab=clips byte for byte and counts media_objects, vods, clips and apps. test/drill-live-media.test.js runs both drills from host.example.json on the fake host. docs/restore-drills.md describes both (the results table is unchanged: neither has run on the host), and backups.md, storage-state.md and the README followOpenVibers · 23 Sept 2026 eaa226c
openvibe-shared v1.5.0 (Track R release manifest), openvibe-contracts v0.32.0, openvibe-sdk v0.5.0OpenVibers · 23 Sept 2026 315d852
Stage B launch readiness: threat review, launch release steps with verification and rollback, and the launch-rule evidence per itemOpenVibers · 23 Sept 2026 2bfc62d
D41 proof artifact: scripts/d41-proof.sh deploys, rolls back and redeploys one service through ovhost and proves from systemctl that every other unit kept its process (written and tested, not run on the host)OpenVibers · 23 Sept 2026 cd2fc63
Restore drills for Tools and Games: one unit of a multi-unit service, data-directory databases, bind mounts for checkout-relative files, and a check that the deployed checkout has the drill switchesOpenVibers · 23 Sept 2026 8575c91
OpenRe on ovhost: workerUnits and a restore drill.OpenVibers · 23 Sept 2026 ed7de69
Scheduled, root-only and off-host backups: ovhost backup --all (every service with databases, failure-isolated, 7 daily + 4 weekly retention, JSON run summary), encrypted off-host copies to S3-compatible storage (Node crypto AES-256-GCM, @aws-sdk/client-s3, 30-day remote retention), restore-download, and a daily openvibe-backup.timerOpenVibers · 23 Sept 2026 34d706c

More commits