Commits

main

Site settings as revisioned configuration (WS-C task 7): live.site_settings on openvibe-shared/config 1.14.0 journals every admin change to site_settings as a revision with who and why (bulk and single PUT, DELETE), rows written around it are recorded as a sync revision first so nothing is reverted, history with secrets as keyed fingerprints (GET /api/admin/config…), owner-only rollback; readers (db.getSetting) unchanged; job state and the money freeze stay outside; pins shared 1.14.0, contracts 0.52.0OpenVibers · 26 Sept 2026 c7cb6285
Clip cuts follow their Media job (WS-G task 3): a clip the server cuts answers with its clip.cut job id; the channel page and the broadcast dashboard follow it (public/js/ov-clip-jobs.js) and open the trim editor or say it failed, with a notice per retry; a reload reattaches (pending cuts in localStorage, resumed when the player starts); GET /api/clips/:id/job for the clip's maker or manager, only that clip's cut job; re-cut passes its job idOpenVibers · 26 Sept 2026 73c8a39b
Expand/migrate/contract check (WS-P task 12): a new DROP TABLE, DROP COLUMN or rename of a real table in server/ fails the suite until test/fixtures/destructive-migrations.json lists it with its dated contract step; the five known table rebuilds are recordedOpenVibers · 25 Sept 2026 26c69e06
Rollback with newer writes (WS-P task 13): a database this release migrated and wrote to boots and works under the release of a week ago (checked out into a temporary worktree: initDb over the newer schema without errors, reads, writes), and rolling forward again reads what the rollback wrote; skipped without git historyOpenVibers · 25 Sept 2026 8f2b4c30
Pins: openvibe-contracts 0.46.0 → 0.49.0, openvibe-shared 1.12.0 → 1.13.0, openvibe-sdk 0.9.1 → 0.11.0OpenVibers · 25 Sept 2026 ddb620d7
Bulk notification push: a sender without a Network id is sent as no sender, never as the raw Live id (Network now drops notifications from people the recipient blocked, so a Live id read as a Network id could hide the wrong ones)OpenVibers · 25 Sept 2026 91e62b72
Arena: the other avatar-only fighter links (battle sides, fighter cards) are named tooOpenVibers · 25 Sept 2026 b349af76
Arena: the avatar link beside each mic moment is named (the fighter), found by the browser smoke's --a11yOpenVibers · 25 Sept 2026 3c7e8915
Accessibility (WS-T task 3): the browser smoke's --a11y runs axe-core (WCAG 2.1 A/AA) on every route and fails on serious or critical violations; fixed what it found — the decorative hero collage's links are not focusable, the key-sequence slots are a labelled group, chat send buttons are named, the chat mode select is labelledOpenVibers · 25 Sept 2026 400c95c9
Internal-key retirement (WS-B task 3, C-54): the URL-registry refresh and the chat server's anon resolution ask Network with a service token (identity.subject.resolve), the key only as the fallback when no token can be had — they were the last two Live calls still sending X-Internal-KeyOpenVibers · 25 Sept 2026 1f0bb988
Home: no requests for the Games leaderboards and pixel canvas until OpenVibe.Games serves them (they 404 and every first visit logged CORS errors for sections that stay hidden); one switch, GAMES_HOME_WIDGETS, turns them back on (WS-M task 7, owner decision O15)OpenVibers · 25 Sept 2026 b8016797
nginx template: openvibe.live includes the platform's /.well-known/security.txt, as production does (WS-R task 7)OpenVibers · 25 Sept 2026 897cebcb
CALLS_AUTHORITY flag (WS-I task 1): with CALLS_AUTHORITY=chat the go-live, stream-end, WHIP teardown and admin force-end hooks create and remove stream voice channels in OpenVibe.Chat (POST/DELETE /internal/calls/stream-channel with the chat bridge's service token, retried on 5xx, superseded retries dropped) instead of Live's call server, and Live pushes Chat's call-user notification (notify/call-invite); the default live changes nothing and Live's /ws/call and voice-channel routes stay for one releaseOpenVibers · 25 Sept 2026 5abf2b13
Home live grid on Events realtime (WS-F task 1): public live.stream.started/ended from events.openvibe.network/realtime/stream refresh the grid the moment a stream starts or ends; the 12 s poll stays as the fallback and, while realtime is connected, only runs once a minute; a native EventSource (the SDK's browser transport) instead of the SDK's 128 KB bundle; CSP connect-src allows events.openvibe.networkOpenVibers · 25 Sept 2026 6b2f7c47
Backfill script for the moderation audit log: Live's actions logged before live.moderation.action go to Network with their original time (same rule as logModerationAction), once each (moderation_events_backfill), only before a required --before cutoffOpenVibers · 25 Sept 2026 29a0970d
Live's staff actions reach the network moderation audit log (ADR-022, WS-D task 1, Contracts 0.46.0): logModerationAction writes live.moderation.action to the outbox in the same transaction as the row (actor = the staff member's subject, target subject when linked); tidying one's own messages, configuring one's own channel or acting on oneself stays local. Browser smoke covers /searchOpenVibers · 25 Sept 2026 cf3e516b
Search page (WS-O task 10: product search boxes use the query API): /search finds Live's channels, VODs and clips through OpenVibe.Search (GET /api/search asks anonymously for owner=live at Search's internal origin and returns only public fields; 503 when Search does not answer), with type chips, More paging and the query in the URL; results built as DOM nodes, snippets keep only <mark>; Search in the navbar; a known page, noindex; a link to search the whole networkOpenVibers · 25 Sept 2026 ace58233
VODs and clips in OpenVibe.Search (WS-O task 10, Contracts 0.45.0): Live owns their canonical /vod and /clip pages, so it sends live.index_document type vod and clip (title, channel, category, Live's AI overview and transcript), read from Media, never the frozen tables; re-checked right after a change through /api/vods or /api/clips and when Media announces an item ready or failed, a 5-minute scan of the newest, and a daily refresh that removes what Media stopped listing (never after a partial listing); AI clips and NSFW streams are noindex; private, unlisted, deleted or failed items get one tombstoneOpenVibers · 25 Sept 2026 90641f59
Projection: Network's display name is taken only when it re-cases the username, as Live's own profile route allowsOpenVibers · 25 Sept 2026 31aa74b9
Projection role rules match Live's roles: 'streamer' is Live's own (a channel), so a Network event never lowers it; staff roles follow an explicit Network role change both ways, and someone who has streamed keeps streamer when Network removes staff; any other profile event only raises the role, like the token sync (40 Live streamers vs 7 on Network would otherwise have been demoted)OpenVibers · 25 Sept 2026 5bb4f8f3
Channel search documents go out with priority low (the envelope allows critical, important or low; 'normal' made Events refuse them with 422); the test's stub Events now validates envelopes as Events doesOpenVibers · 25 Sept 2026 278a4981
Channels in OpenVibe.Search (WS-O task 10, Contracts 0.44.0): each streamer's channel is a Search document sent through the outbox as live.index_document.upserted (name, bio, recent stream titles, category, live, followers; NSFW channels noindex) only when it changed, with a tombstone once a channel is banned; a 5-minute scan of what changed and a daily refreshOpenVibers · 25 Sept 2026 80a6b5a6
Live follows the OpenVibe account (WS-B task 2, Contracts 0.43.0): subject_projection kept from Network's network.user.updated (POST /internal/network-events; the subscribe script's --network asks for it), and the linked account follows it: role both ways (a downgrade too), picture, colour, display name and username; an older revision changes nothing, the local owner stays admin, a Network ban never touches Live's own. Live keeps no passwords or emails: createUser refuses a real password hash and never stores an address, the profile route ignores email, the bootstrap admin gets the SSO placeholder instead of a bcrypt hash, the settings page links to the account for email and password; test/identity-columns.test.js is the tripwireOpenVibers · 25 Sept 2026 f7050296
Pins: openvibe-sdk 0.7.0 → 0.9.1, openvibe-contracts 0.41.0 → 0.42.0; CI uses the shared workflows at 423fe51, which run the pin-drift check (WS-C task 5)OpenVibers · 25 Sept 2026 6e74ed30
User modules (Contracts 0.41.0, WS-B task 9): Live writes live.profile and live.stats to Network (server/auth/module-summaries.js: a 5-minute scan of ended streams and new followers, a daily refresh of the 30-day window, written only when changed); the chat panel's text-to-speech and sound settings follow the person through chat.tts_defaults (/api/chat/tts-settings) like the display onesOpenVibers · 25 Sept 2026 c3c95dba
Renamed channels (WS-B task 6): Live follows a Network rename (the signed token's username at sign-in, or GET /api/v1/users/names/:name for a /@name it does not know yet), keeps username_history, and the page fallback answers /@old with a 301 to /@current (sub-path and query kept). A bare /name stays a 404; a name another Live user holds is never taken. test/renamed-channels.test.jsOpenVibers · 24 Sept 2026 0aa56ad0
Revocation propagation (WS-B task 4, Contracts 0.39.0): POST /internal/network-events (signature v2, LIVE_EVENTS_SECRET else MEDIA_EVENTS_SECRET) records network.user.token_valid_after per subject, only ever forwards; verifyToken refuses a Network session token issued before its subject's cutoff (reason revoked), so a signed-out device stops working on Live at once. scripts/subscribe-media-events.js --network subscribes to it. test/revocation.test.jsOpenVibers · 24 Sept 2026 a48c5a2a
Chat sockets never carry the token in the URL (C-05): chat, the media player and the broadcast PiP send it in their first join message; a message typed while the chat socket reconnects stays in the box instead of being re-posted to global chat over REST (C-06). Docs: bots authenticate /ws/chat with an Authorization header or the join message (?token= is deprecated); POST /api/chat/send is the bots' global-chat APIOpenVibers · 24 Sept 2026 ae589aca
openvibe-shared 1.12.0 (the navbar loads its siblings from this site's own /shared/ copy)OpenVibers · 24 Sept 2026 7b2b2f4c
What shipped on Live comes from the network's shared system (openvibe-shared 1.11.1 shipped.js, fed by the network changelog of deployed commits): the hero one-liner, the home Recent Changes (same day groups, same expand button) and /updates (this site or all of OpenVibe, Load more, Patch notes); the footer links this site's log. No 'free'/'$0' copy: the footer tagline and a fallback slogan said 'Free', the slogan prompt asked for it, and generated or stored slogans with it are now dropped. test/shipped-live.test.jsOpenVibers · 24 Sept 2026 a49efd5e

More commits