Commits

main · package.json

Registry, status and chrome say where each service really answers: an exposure overlay (server/registry/exposure.js) gives every manifest one state — live (public), internal (loopback only, no public site yet), library (released), repository or placeholder — from curl checks of every public domain on 2026-09-23. News, Reviews, Deals, Coupons, Trade, Host, Tips, VIP, OpenRe, Search and Sources are internal (their domains serve a placeholder page); AI, Chat internal; SDK v0.4.0, Shared v1.3.0, Contracts v0.29.0 libraries; Examples a repository. The descriptor gives an origin only to live services (planned_origin otherwise), AI is polled on loopback, /status reads "up (loopback only)" and never a bare Up for a placeholder domain, and the chrome nav derives open/soon from the same table. test/registry-exposure.test.js pins the statesOpenVibers · 23 Sept 2026 29cdb09a
Network no longer opens Live's database at boot (ADR-007, register C-58)OpenVibers · 23 Sept 2026 6a1acd3c
Analytics within ADR-021: no IP, user id or city in raw events; route templates, referer origins and user-agent classes; rotating session ids; raw events pruned after 30 days (nightly job, bounded batches), rollups keptOpenVibers · 23 Sept 2026 3ffd73a9
Sign-in redirects: /login?return= ran javascript: URLs; fanout next= left for any openvibe.<tld>OpenVibers · 23 Sept 2026 14971760
Sessions: a FedCM assertion is not a session; password changes end OAuth sign-ins and refresh tokensOpenVibers · 23 Sept 2026 173cd668
openvibe-contracts v0.28.0: events.app.publish|read|subscribe are real catalog entries, so the default sandbox allowance carries them; tests follow codes leaving placeholder; docs: Events acts on the relayed revocationsOpenVibers · 23 Sept 2026 588ee8b1
Developer projects work without staff in sandbox: DEV_SANDBOX_AUDIENCES defaults to openvibe.media, openvibe.events, openvibe.tools; sandbox allowance (DEV_SANDBOX_ALLOWANCE, default media.object.upload/read, events.app.publish/read/subscribe, tools.job.create/read/cancel, public capabilities only) for sandbox apps; production allowance stays staff-set. dev_audit events relayed to OpenVibe.Events through an openvibe-sdk v0.2.2 outbox when OV_EVENTS_INTERNAL_URL is set (backfilled, self-signed svc:network token)OpenVibers · 23 Sept 2026 a46f6096
openvibe-contracts v0.26.0 (developer-project claims, sandbox refusal); grants and clients for deals, coupons and host; tests follow services that left placeholderOpenVibers · 23 Sept 2026 2030e362
Developer projects foundation (Wave 20, ADR-014): projects, members, apps, hashed credentials, grants within a staff-set allowance, quotas, append-only auditOpenVibers · 23 Sept 2026 1fc254a3
nginx generator: services can ship location includes for another host; openvibe.live includes OpenVibe.Chat's chat locations (glob, before /api/)OpenVibers · 23 Sept 2026 89b67de9
Chat grants (Wave 6): chat reads Live's chat context/effects/mirror; Live bridges to Chat and reads presence; openvibe-contracts v0.13.0OpenVibers · 23 Sept 2026 c3537c4c
openvibe-shared v1.2.1 (release-watch never reloads playing media or live capture)OpenVibers · 23 Sept 2026 e1038fdf
openvibe-shared v1.2.0: the navbar loads release-watch.js itself, so the per-page tags goOpenVibers · 23 Sept 2026 a8f870e0
GET /release.json and /shared/release-watch.js on every Network page (ADR-016); openvibe-shared v1.1.1OpenVibers · 23 Sept 2026 585e2fd5
openvibe-contracts v0.8.0 (Billing alpha in the registry)OpenVibers · 23 Sept 2026 8961ee0d
OAuth: PKCE (S256 only) bound to authorization codes and checked at the token endpoint; codes redeem atomically once; state is URL-encoded in redirects; registry polls Billing's healthOpenVibers · 23 Sept 2026 e4ceedf8
Live may comment, moderate comments and publish Pulse items on Community (Wave 5); openvibe-contracts v0.7.0OpenVibers · 23 Sept 2026 0d42e523
openvibe-shared is the pinned OpenVibe.Shared v1.0.0 release: packages/openvibe-shared is gone, /shared/* (and /shared/v1/*) serves only the package's browser files from node_modules, a ?v= content-hash URL is immutable and nginx no longer adds its own Cache-ControlOpenVibers · 23 Sept 2026 d0771c7c
service-principal.js: create/rotate a service's client credentials straight into its env file (0600, never printed); list clientsOpenVibers · 23 Sept 2026 deedd647
Ecosystem registry: /.well-known/openvibe and /api/v1/registry/{services,domains,capabilities,namespaces,contracts,topics} from openvibe-contracts manifests, with polled, timestamped health; schemas served at their $id URLs (/contracts/...)OpenVibers · 23 Sept 2026 682f80fa
openvibe-contracts v0.5.1OpenVibers · 22 Sept 2026 890a5652
POST /internal/identity/resolve-batch (500 per call); identity lookups accept identity.subject.resolve tokens; Wave 5 grants: community resolves authors and uploads screenshots, live writes pastes into CommunityOpenVibers · 22 Sept 2026 8ac5a0f2
Versioned user modules: per-subject records with revisions, field-level public reads, owner-only service writes behind scoped tokensOpenVibers · 22 Sept 2026 c022dc35
CI: npm test on Node 22 plus the openvibe-contracts check on every push to main and every PR; contracts v0.3.0OpenVibers · 22 Sept 2026 da570785
Service principals: client_credentials tokens scoped by principal_grants; coins and notification pushes accept them alongside X-Internal-KeyOpenVibers · 22 Sept 2026 9a1c9b16
Canonical subject ids: usr_/gst_ ULIDs alongside integer ids, identity_legacy_map, /internal/identity, subject_id in tokensOpenVibers · 22 Sept 2026 139fb443
Wave 0 baseline: generated estate inventory, ownership map, prod discrepancies, D01-D46 status, hazard registerOpenVibers · 22 Sept 2026 dd1db789
Avatar is a network-wide property: openvibe.media pictures or paste screenshots only, verified as images, public /avatar/:username, pushed to sites and accepted from them; profile route validates avatar_url; account page avatar cardOpenVibers · 18 Sept 2026 c83969ce
Shared user menu: grouped sections, display controls, ranked sites, channel link, wallet chip; shared panel coordinator (panels.js); accounts adopt a linked site's avatar and name when they have noneOpenVibers · 18 Sept 2026 bc69ad29
Chrome service: analytics-ranked navigation and AI-assisted footer copy, cached; navbar brand group restyled and hardened against host CSS; network links and ranked launcher; shared legal documents; home layout, icons and copyOpenVibers · 18 Sept 2026 d70cc702

More commits