Commits

main

Manifest-derived registry (WS-C task 1, Contracts 0.42.0): the loopback addresses, exposure states and the frame's site list come from the service manifests (internalOrigin, exposure, site); INTERNAL, READY_PATHS, EXPOSURE and RAW_SITES are no longer written here, OV_<ID>_INTERNAL_URL still overrides; test/registry-manifest-fixture.test.js: a new manifest appears in discovery, the registry, the status page and the site list with no code edit; npm test also runs staff-claims.test.js, which it had missedOpenVibers · 25 Sept 2026 ca0b63ef
Contracts 0.41.1 (plain-language module descriptions); the AI & Data tab names who keeps each record (OpenVibe.Chat, OpenVibe.Tools…)OpenVibers · 25 Sept 2026 c47ad2fc
Home page sites come from the frame's list (open only when the service serves its own domain): nine sites (Chat, Codes, Blog and Wiki joined), Opening next lists only what is not open yet, counts in words, JSON-LD and llms.txt follow; the Tools catalog is fetched at boot so a restart never shows the 49-tool fallback; the Chat entry no longer claims calls (they are still Live's)OpenVibers · 25 Sept 2026 bcc05bf0
my.openvibe.network AI & Data tab: AI preferences (style, length, perspective, keep what I ask AI) saved to the ai.preferences module OpenVibe.AI reads; every module record kept with the account listed with who keeps it, each deletable, all downloadable as JSONOpenVibers · 25 Sept 2026 f17223b2
User modules (Contracts 0.41.0, WS-B task 9): a service reading another's namespace sees only the fields readers lists for it; stored records read at the current version through the namespace's migrations and are stored at it on the next write; grants for chat.tts_defaults/dm_settings/presence_prefs (Chat), live.stats (Live, which loses its chat.* grants), ai.preferences/ai.usage_summary (AI), community.profile, wiki.projects; my.openvibe.network stars favourite tools (tools.usage v2)OpenVibers · 25 Sept 2026 707504c2
Grant media and tools events.subscription.manage: they subscribe to network.user.token_valid_after (sign-out everywhere)OpenVibers · 25 Sept 2026 6b93ae09
Registry flip: chat is live on openvibe.chat (exposure live/service); the Frame's site switcher opens it (its host now comes from the manifest's publicOrigin)OpenVibers · 24 Sept 2026 cfb112be
Contracts 0.40.0: openvibe.chat joins the first-party origins (the shared navbar on the new Chat site talks to Network)OpenVibers · 24 Sept 2026 ee78598d
Names lookup: GET /api/v1/users/names/:name answers { current, network_id, renamed, previous_names } for a current or an old name (banned accounts and unknown names 404), so Live can redirect /@old and pick up a new name it has not seen yet; replaces /api/v1/users/renamed/:name (never deployed)OpenVibers · 24 Sept 2026 3aec618a
Username history (WS-B task 6): admins rename people (admin → Users → Rename, owner-protected, audited); every rename is kept in username_history, the old name stays reserved for 180 days (registration and renames refuse it for anyone else), and GET /api/v1/users/renamed/:name gives the current name so sites redirect /@old → /@new. Admin users also get 'Sign out everywhere'. test/usernames.test.jsOpenVibers · 24 Sept 2026 74d46102
Grant games events.subscription.manage on openvibe.events: Games subscribes to network.user.token_valid_after so a sign-out everywhere closes game sessionsOpenVibers · 24 Sept 2026 67f70139
Revocation propagation (WS-B task 4, Contracts 0.39.0): revokeTokens() moves token_valid_after, ends Network sessions and queues network.user.token_valid_after in the same transaction; password change and reset, bans, POST /api/auth/sign-out-everywhere and admin POST /users/:id/sign-out use it. 'Revoke All Sessions' only deactivated session rows while every token stayed valid: it is now 'Sign out other devices' (all tokens end, this browser gets a fresh one), next to 'Sign out everywhere, this device too'. test/revocation.test.jsOpenVibers · 24 Sept 2026 8033d016
User tokens carry staff_map (the staff map version their staff_caps come from; Contracts 0.38.0, map 1.1.0), so services judge capabilities added later by the role instead of waiting for new tokensOpenVibers · 24 Sept 2026 196c76ef
The GitHub token is configurable in admin (Settings → GitHub, owner-only): GITHUB_TOKEN in the environment first, else the saved value; admin shows its source and last four characters and a Test that asks GitHub for the rate limit, never the value. The registry's library tags read it at call time; OpenVibe.Blog reads it over GET /internal/integrations/github-token with capability network.integration.github.read (Contracts 0.37.0, granted to blog only, no shared key). test/github-integration.test.jsOpenVibers · 24 Sept 2026 8c9fa757
The moderation audit log (ADR-022): Network records chat.moderation.action (Chat and Live), community.moderation.action, tips.interaction.moderated and billing.staff.action from Events, once each inside the consumer's inbox transaction and never as notifications; staff with staff.moderation.logs list them at GET /api/v1/staff/moderation-audit (service/actor/target filters, paged) and in admin's Moderation log tab; openvibe-contracts 0.36.0OpenVibers · 24 Sept 2026 b1b9f92c
openvibe-shared 1.12.0 (the navbar loads its siblings from its own origin)OpenVibers · 24 Sept 2026 6be99391
The registry reports each released library's latest published tag (read from GitHub at boot and hourly; the installed version until then, and whenever a lookup fails) instead of the version Network happens to install — it said openvibe-sdk v0.5.0 while v0.8.0 was outOpenVibers · 24 Sept 2026 eb9a1617
Brand assets (/assets/*: logo, app icons, OG images) are readable cross-origin and cached for a day: helmet's Cross-Origin-Resource-Policy same-origin blocked the logo on every placeholder siteOpenVibers · 24 Sept 2026 fce09312
openvibe-shared 1.11.1: the footer's shipped line follows each site's own serviceOpenVibers · 24 Sept 2026 b95d2d0f
The OpenVibe Frame: server/chrome is server/frame; /api/frame and /api/frame/hit (the /api/chrome names stay as aliases for openvibe-shared older than 1.11.0); chrome_cache/chrome_hits are renamed frame_cache/frame_hits once on boot, rows kept (tested); openvibe-shared 1.11.0 (openvibe-shared/frame)OpenVibers · 24 Sept 2026 7571ba73
What shipped, network-wide: /api/v1/changelog proxies OpenVibe.Blog's changelog (60 s cache, stale on failure, public CORS) so every site's shared widget reads it from openvibe.network; /updates renders the whole network's log (server-side first page, then openvibe-shared shipped.js: days, Load more, a filter per site, Patch notes). openvibe-shared 1.9.0 (footer 'shipped X ago' line and Updates link on every site, navbar stale-token fallback to the site session, footer empty-bar fix); home links All updatesOpenVibers · 24 Sept 2026 0b3b2e36
CORS: every first-party domain the service manifests declare is an allowed origin (exact https origins, never a wildcard). openvibe.blog, openvibe.wiki and openvibe.codes were missing from the hard-coded list, so the shared navbar's /api/auth/me was refused there and signed-in people saw 'Sign In'OpenVibers · 24 Sept 2026 90cd58e7
Recently shipped across OpenVibe on the home page: openvibe-shared v1.8.0 (served as /shared/shipped.js for every site) renders the network changelog from openvibe.blog, each change linked to its commit and the latest Patch notes post; connect-src allows openvibe.blog; a no-JS link to the Patch notes seriesOpenVibers · 24 Sept 2026 6e794b93
Blog may run its AI workflows (ai.run.create and ai.run.read in the blog namespace on openvibe.ai) for Draft with AIOpenVibers · 24 Sept 2026 fba96a03
AI may publish its ai.run.* events (events.event.publish on openvibe.events)OpenVibers · 24 Sept 2026 cbca8071
Network issues staff capabilities in user tokens (D05, ADR-022): staff members' access tokens (login and OAuth) carry staff_caps from the contracts staff map, and the owner carries is_owner; people who are not staff carry neither, so their tokens stay small. Services' staff.can() prefers issued claims, so a map change reaches every service with the next token. test/staff-claims.test.jsOpenVibers · 24 Sept 2026 dde33743
Your recent tools on my.openvibe.network (the tools.usage module OpenVibe.Tools keeps, named from the public Tools registry, built with DOM nodes); Tools may index its tools in Search (search.document.write on openvibe.search)OpenVibers · 24 Sept 2026 1de2e229
Tools grants: live, chat and community hold tools.tool.run and tools.job.read on openvibe.tools, so their Tools run API calls (kiosk page titles, audio conversion, save-as-paste) run on the service tier, never network probesOpenVibers · 24 Sept 2026 cbe77e15
Community may publish its events (events.event.publish on openvibe.events); openvibe-contracts v0.35.0 (community.* payload contracts)OpenVibers · 24 Sept 2026 1837cb89
Roadmap baseline regenerated from origin/main (2026-09-24): D20 remaining is the consumers' switch and OpenRe session lineage (Media owner_subject done, grants issued); new Live tables (channel_points_log, opencoin_admin_grants, tips_deliveries) and routes (/api/content/*, /llms.txt) classified; 6/7 exit criteria pass (EC7 waits on the owner's hazard review)OpenVibers · 24 Sept 2026 89f0e44d

More commits