Commits

main

openvibe-contracts v0.28.0 -> v0.30.1: realtime is the only placeholder manifest left (AI, SDK, Shared and Examples are alpha), so the exposure overlay's comment says how each exists instead of correcting a placeholder label, the contracts library row reads v0.30.1, and AI is polled on its manifest's own /api/health and /api/ready (the READY_PATHS/HEALTH_PATHS stand-ins are gone). Footer site copy reads the answering model from run.provenance.model (ai.run@1; run.route is { key, version }, there is no run.model), and test/chrome.test.js answers with the contract's shape and checks the stored modelOpenVibers · 23 Sept 2026 692c7751
News grants: community.comment.write/moderate (story discussion threads) and ai.run.create/read limited to news.* (story summaries)OpenVibers · 23 Sept 2026 8e34f777
Grant live chat.message.send on openvibe.chat: OpenVibe.Chat now requires it to send chat lines (AI viewers, relays, donations, deploy notices) through the bridgeOpenVibers · 23 Sept 2026 1633b6a6
Notifications from Events: POST /internal/events turns deals.watch.matched (payload.recipient) and trade.alert.triggered (subject user) into inbox notifications (DEAL_WATCH_MATCH / TRADE_ALERT, category service, so the person's mute and email choices apply). openvibe-sdk v0.4.0 parseDelivery with requireV2 (v1-only, stale or forged deliveries are refused), exactly once per event_id through the SDK inbox (network_event_inbox), unknown types acknowledged and ignored, links only to sites whose domain serves the service. Inert until NETWORK_EVENTS_SECRET is set and scripts/subscribe-events.js has created the two subscriptions (consumer network, endpoint http://127.0.0.1:4000/internal/events). Coupons publishes no watch event yet, so there is nothing of it to consumeOpenVibers · 23 Sept 2026 07cd98c7
Footer copy comes from OpenVibe.AI only: drop the fallback to Live's /internal/ai/site-copy. When AI is unreachable or answers badly the last good copy stays (chrome_cache, across restarts), or the hand-written copy when there has never been one; test/chrome.test.js covers AI down, AI ok, AI down again, restart, and that Live is never calledOpenVibers · 23 Sept 2026 31b234a6
Registry, status and chrome say where each service really answers: an exposure overlay (server/registry/exposure.js) gives every manifest one state — live (public), internal (loopback only, no public site yet), library (released), repository or placeholder — from curl checks of every public domain on 2026-09-23. News, Reviews, Deals, Coupons, Trade, Host, Tips, VIP, OpenRe, Search and Sources are internal (their domains serve a placeholder page); AI, Chat internal; SDK v0.4.0, Shared v1.3.0, Contracts v0.29.0 libraries; Examples a repository. The descriptor gives an origin only to live services (planned_origin otherwise), AI is polled on loopback, /status reads "up (loopback only)" and never a bare Up for a placeholder domain, and the chrome nav derives open/soon from the same table. test/registry-exposure.test.js pins the statesOpenVibers · 23 Sept 2026 29cdb09a
Network no longer opens Live's database at boot (ADR-007, register C-58)OpenVibers · 23 Sept 2026 6a1acd3c
Live's ai.run.* grants name their namespaces (live.*, network.site_copy) now that OpenVibe.AI fails closed on a token with no ns; default grants that gain namespaces fill them into rows still seeded emptyOpenVibers · 23 Sept 2026 988330bf
Analytics within ADR-021: no IP, user id or city in raw events; route templates, referer origins and user-agent classes; rotating session ids; raw events pruned after 30 days (nightly job, bounded batches), rollups keptOpenVibers · 23 Sept 2026 3ffd73a9
Grant wiki community.comment.moderate: Wiki hides a page's discussion thread when the page is unpublished, deleted or made privateOpenVibers · 23 Sept 2026 cd1da60f
Account chooser: the app name comes from GET /oauth/client-info (client_id + registered redirect_uri), never from the page URL — a crafted link could claim to be any app; third-party apps also show where the code goesOpenVibers · 23 Sept 2026 5a8189a5
nginx: client address headers only from $remote_addr (realip). X-Forwarded-For was appended to and CF-Connecting-IP passed through from the client, so a request reaching the origin without Cloudflare (DNS-only host or the bare IP) chose the address the service bans and rate-limits by; the generator emits the sameOpenVibers · 23 Sept 2026 9eeab699
Cross-site trust stops at Host tenant sites: *.openvibe.host gets no FedCM assertion, /sso/check answer or redirectOpenVibers · 23 Sept 2026 032f597e
Internal API: /INTERNAL/... no longer bypasses the loopback-only nginx rule; key compared in constant timeOpenVibers · 23 Sept 2026 a4d715c5
Sign-in redirects: /login?return= ran javascript: URLs; fanout next= left for any openvibe.<tld>OpenVibers · 23 Sept 2026 14971760
Sessions: a FedCM assertion is not a session; password changes end OAuth sign-ins and refresh tokensOpenVibers · 23 Sept 2026 173cd668
Footer copy from OpenVibe.AI's network.site_copy workflow with a self-signed service token (Wave 13); Live's endpoint only as fallbackOpenVibers · 23 Sept 2026 422f8e9d
Grants: Live runs and reads OpenVibe.AI workflows (Wave 13)OpenVibers · 23 Sept 2026 9b2af289
docs: retiring the internal key route by route, with the telemetry query (Wave 22)OpenVibers · 23 Sept 2026 529a1143
Wave 22 telemetry: every X-Internal-Key call is counted per route (principal_usage, auth internal-key-route) so the key can be retired route by routeOpenVibers · 23 Sept 2026 bd965db8
Hub: Codes is open (Wave 20 launch)OpenVibers · 23 Sept 2026 539af9c3
Codes portal client (redirect) and event grant (Wave 20)OpenVibers · 23 Sept 2026 4143e5e7
openvibe-contracts v0.28.0: events.app.publish|read|subscribe are real catalog entries, so the default sandbox allowance carries them; tests follow codes leaving placeholder; docs: Events acts on the relayed revocationsOpenVibers · 23 Sept 2026 588ee8b1
Developer projects work without staff in sandbox: DEV_SANDBOX_AUDIENCES defaults to openvibe.media, openvibe.events, openvibe.tools; sandbox allowance (DEV_SANDBOX_ALLOWANCE, default media.object.upload/read, events.app.publish/read/subscribe, tools.job.create/read/cancel, public capabilities only) for sandbox apps; production allowance stays staff-set. dev_audit events relayed to OpenVibe.Events through an openvibe-sdk v0.2.2 outbox when OV_EVENTS_INTERNAL_URL is set (backfilled, self-signed svc:network token)OpenVibers · 23 Sept 2026 a46f6096
Public, CORS-open discovery: /.well-known/openvibe, /api/v1/registry/* and /contracts/*.json answer any origin (preflight included; traceparent, X-OpenVibe-Request-Id, Authorization, Content-Type) without credentials; every other route keeps the first-party allow-listOpenVibers · 23 Sept 2026 8d0e64d9
openvibe-contracts v0.26.0 (developer-project claims, sandbox refusal); grants and clients for deals, coupons and host; tests follow services that left placeholderOpenVibers · 23 Sept 2026 2030e362
Docs: developer projects model, token claims, limits and quotas; contracts proposal (app claims, sandbox refusal, prj prefix, partner visibility, network.project.read|manage, network events)OpenVibers · 23 Sept 2026 84697895
Developer projects foundation (Wave 20, ADR-014): projects, members, apps, hashed credentials, grants within a staff-set allowance, quotas, append-only auditOpenVibers · 23 Sept 2026 1fc254a3
Trade grants (Wave 19) and redirect URIOpenVibers · 23 Sept 2026 992cb2ba
News grants (Wave 17)OpenVibers · 23 Sept 2026 80b02c6a

More commits