Commits

main

Pins: openvibe-shared 1.16.0 -> 1.16.1 (the OV mark stops animating when idle, hidden or off-screen)OpenVibers · 26 Sept 2026 5084cfe1
The CSP allows Cloudflare Web Analytics (browser check, WS-Q task 3): script-src https://static.cloudflareinsights.com loads the beacon Cloudflare injects at the edge, connect-src https://cloudflareinsights.com is where it reports. The network's privacy text already says Cloudflare may measure performance, and Live and Tools allow it; here the policy blocked it and every page view logged a CSP error.OpenVibers · 26 Sept 2026 b764d944
Pins: openvibe-shared 1.15.0 -> 1.16.0OpenVibers · 26 Sept 2026 d5805c9e
Operator parity checklist (WS-D task 5): an admin tab and GET /api/admin/operator-checklist list every operator job the old admin did (people, site, health/storage/media, queues, moderation/money/loyalty, releases/readiness) and where it is done now: a tab here, another console, the host CLI, or an API with no console yet (shown as a gap), each with its service readiness; test: every tab exists, every console is an OpenVibe origin, every service is in the registry; scripts/operator-checklist-check.js probes the consoles live (8/8 answer)OpenVibers · 26 Sept 2026 15e4d887
npm test runs test/page-checks.test.js (the browser-check fixes: /login, the /updates filter chip, the home JSON-LD name)OpenVibers · 26 Sept 2026 dae6ab23
Pages the browser check flagged (Host scripts/browser-check.js, WS-Q task 3): /login gets a canonical URL, a no-JS note (the form panels need JavaScript), named password toggles ("Show password"/"Hide password", was axe button-name critical), the active tab on --accent-dark (6.7:1, was 3.67:1) and --text-muted #8e8ea0 (5.2:1 on the input background, was 3.5:1); the /updates site filter's current chip uses --accent-strong/--on-accent-strong (was white on --accent, 3.67:1); the home page's JSON-LD site list is named by its visible heading ("Nine sites, one front door", was "OpenVibe sites", in no visible text). test/page-checks.test.js keeps themOpenVibers · 26 Sept 2026 66652450
Community themes with a review queue, import and export (WS-E task 2): a submitted or imported theme is pending and private to its author (usable by them at once, at most five waiting) until an admin approves it at /api/admin/themes (Theme review tab; a rejection needs a reason the author sees); the catalog and theme pages show approved themes only; themes export as openvibe-theme@1 files; theme and custom-colour values are allow-listed (shared token names only; colours, numbers, lengths and shadows only: no url(), var() or break-out). My account: Share a theme cardOpenVibers · 26 Sept 2026 4f28b66a
Loyalty (WS-K task 9): Live reads and writes its private live.loyalty summary (contracts 0.56.0; a grant row seeded under the older default gains it at boot); test/loyalty-policy.test.js: nobody holds the OpenCoins transfer grant (revoked again at every boot, no default hands it out), live.loyalty has no public value and refuses a money field. Pins: openvibe-contracts 0.54.0 -> 0.56.0OpenVibers · 26 Sept 2026 3900cd32
Graceful stop, all of it (WS-P lifecycle follow-up): SIGTERM now also stops what used to run into the exit: the maintenance timers (notifications, email queue, retired-module sweep, session cleanup), the analytics prune, the ecosystem, deploy-drift and library-tag pollers, the frame rank/copy refreshes (frameService.stop()), the profile-event and grant-expiry timers; then, after the HTTP drain, the developer/profile/grant event relay's send in progress is awaited (unsent rows stay in the outbox), analytics flush and close, network.db closes, exit 0 within 10 s. The drain itself (server/graceful.js) now also answers requests in flight with Connection: close and keeps closing connections as they go idle: before, a keep-alive connection whose request was still running at SIGTERM held the exit for the keep-alive timeout after it finished. test/shutdown.test.js: SIGTERM with a request in flight and an idle keep-alive connection: refused afterwards, the request answered with Connection: close, every step run, exit 0 in < 10 sOpenVibers · 26 Sept 2026 631ed6f2
Graceful stop (WS-P lifecycle): on SIGTERM Network stops taking connections, closes idle keep-alive ones and lets requests in flight finish (10 s at most) before exiting 0; it was the one service without a handler, so every restart cut requestsOpenVibers · 26 Sept 2026 d1b7323a
Size budgets for the home page (WS-T task 1): openvibe-shared/perf-budget 1.15.0 measures / as the server answers it (a fresh database, no browser) in npm test; budgets a little above the 2026-09-26 measurement (html 88 KB, js 6 files 228 KB / 54 KB brotli)OpenVibers · 26 Sept 2026 71cf9577
Site settings as revisioned configuration (WS-C task 7): network.site_settings on openvibe-shared/config 1.14.0 journals every admin change (PUT /api/admin/settings, /email, /discord) as a revision with who and why, rows keep their type (a new row takes the caller's), rows written around it are recorded as a sync revision first, history with secrets as keyed fingerprints and owner-only rollback (GET/POST /api/admin/config…); readers unchanged; migration flags and the push key pair stay outsideOpenVibers · 26 Sept 2026 cc405d58
Moderation audit: media.moderation.action too (Media's staff holds), in the consumer, the subscription topics and the admin filter; contracts 0.54.0OpenVibers · 26 Sept 2026 ce7596b1
Moderation audit log (WS-D task 1): records tools, games, wiki, blog, news, reviews, deals, coupons, trade and codes .moderation.action (common.moderation-action@1, Contracts 0.53.0), one row each with the service from the event's prefix (action, actor_subject, target type/id/owner, reason, details); the consumer's TOPICS (and so scripts/subscribe-events.js) cover them; the admin Moderation log filters by each. Pins: openvibe-contracts 0.49.0 → 0.53.0OpenVibers · 26 Sept 2026 89f3eee4
Tools job proof (WS-L task 4): principal probe gets tools.job.create/read and events.event.read; /status and /api/v1/status show its last run (tools_job_proof) next to the developer pathOpenVibers · 25 Sept 2026 5716fd62
Status: the daily developer path's last run (passed or failed, each step) on /status and in /api/v1/status, from its result file — WS-N task 1OpenVibers · 25 Sept 2026 dc4cfb15
nginx (openvibe.network): /oauth/token gets its own limit (60/min, burst 30) instead of the sign-in limit (5/min) — a developer app's client-credentials tokens got 503s mid-flow (found by the daily developer path); limits answer 429; the security.txt include as production has itOpenVibers · 25 Sept 2026 e5da5ac1
Registration (WS-B task 10): /register and /signup open the create-account view; the form is username, optional email and password — the claim code for a reserved name appears only when the chosen name is reserved (it was an always-visible 'Verification Key' field); the username hint is plain wordsOpenVibers · 25 Sept 2026 186b7fc7
Pins: openvibe-shared 1.12.0 → 1.13.0, openvibe-sdk 0.9.1 → 0.11.0OpenVibers · 25 Sept 2026 ca7b6f0d
Platform blocks (WS-E task 5, Contracts 0.49.0): user_blocks by subject with a per-pair revision, /api/v1/me/blocks to list, block and unblock (never yourself or a guest; staff blockable, staff actions never hidden), network.block.changed in the outbox in the same transaction, GET /internal/blocks for Chat and Community (network.blocks.read, token only), no notification from a person the recipient blocked, Blocked people on the account page, and scripts/import-blocks.js for Chat's dm_blocks exportOpenVibers · 25 Sept 2026 ccbffa75
Production drift: a deployed build with commits main lacks is diverged whatever main has (GitHub's compare status first, the counts as a fallback)OpenVibers · 25 Sept 2026 bca5d3fe
Production drift: the registry exposes releases() (the drift checks called it and failed silently), and a failed refresh is loggedOpenVibers · 25 Sept 2026 a93b7d1c
Production drift (WS-S task 7): hourly, each running service's deployed commit is compared with its repository's main on GitHub (current, behind by N commits since the oldest undeployed one, diverged, unknown); shown under each release on /status, in /api/v1/registry/releases (main, and undeployed: services behind main for over a day), and as openvibe_deploy_drift_seconds{service} for the 24-hour alertOpenVibers · 25 Sept 2026 4a9f8890
nginx generator: generated vhosts include the platform's /.well-known/security.txt (WS-R task 7)OpenVibers · 25 Sept 2026 6a0023ab
CI on the shared test and security workflows (WS-Q task 1, OpenVibe.Shared 66b76f8): install, node --check, tests, contract and pin-drift checks from one definition; this repository's own steps kept as inputs and extra stepsOpenVibers · 25 Sept 2026 621fb9d0
Event deliveries in admin (WS-F task 3): the owner sees OpenVibe.Events' dead, failing and pending deliveries and replays them (one, or all shown for a subscription) through Events' operator API with a self-signed 5-minute events.delivery.admin token; every replay is written to the audit logOpenVibers · 25 Sept 2026 eff91e6d
Audited service grants and staff APIs (WS-D tasks 3 and 4, Contracts 0.48.0): the owner grants, changes or revokes a service principal's capability at /api/admin/grants (and the admin Service grants tab), always with a reason and optionally an expiry; the audience is the capability owner's; each change writes principal_grant_changes and network.principal_grant.changed in one transaction; an expired grant leaves tokens at once and its expiry is recorded once; the seed stays DEFAULT_GRANTS. GET /api/v1/staff/capabilities (the caller's role and staff capabilities) and GET /api/v1/staff/moderators[?service=] (staff with staff.moderation.logs, or a service token with network.staff.read)OpenVibers · 25 Sept 2026 8b480077
Moderation audit log (WS-D task 1): records live.moderation.action (Contracts 0.46.0; Live's staff actions outside chat) as service live; filters by action and a since/until range beside service, actor and target; format=csv exports up to 5,000 matching rows (formula-looking cells kept as text); the admin tab gains the filters, Live as its own service and an Export CSV buttonOpenVibers · 25 Sept 2026 d3c370ec
network.user.updated (WS-B task 2, Contracts 0.43.0): triggers on users record every username, display name, picture, colour, role and ban change in its own transaction, whatever code made it; a relay turns them into one event per person with the whole current profile, a growing profile_revision and what changed; guests never; a new account once it has its subject; the first boot announces every existing account onceOpenVibers · 25 Sept 2026 4a6f310a
Pins: openvibe-contracts 0.42.0 → 0.44.0, openvibe-sdk 0.5.0 → 0.9.1; test/registry-topics.test.js expects the live manifest's two new topics (live.index_document.upserted|deleted, Contracts 0.44.0); CI runs the pin-drift checkOpenVibers · 25 Sept 2026 7c4b37b6

More commits