Commits
-
Receipts on the account home, under Needs you (#681)OpenVibers · 5 days ago
c5a3faa9 -
openvibe.my: the account hub's own home and session (#646)OpenVibers · 6 days ago
6d02560d -
A public first-party client that signs the person in for real (the phone app) (#641)OpenVibers · 6 days ago
106b5cd6 -
Admin reviewer queue: one page across Wiki, Blog, News and Trade (#567)OpenVibers · 7 days ago
62c27861 -
Integrate: D11/D12 — API keys, QR sign-in, owner settings, legacy secrets, project memberships, wallet (#559)OpenVibers · 8 days ago
3e227395 -
Sandbox apps may call Play: openvibe.play joins the default sandbox audiences and play.title.manage, play.result.write and play.player.read the sandbox allowance (Play keeps sandbox- titles apart: guests only, unlisted, at most 3) (#337)OpenVibers · 19 days ago
ab5aaba1 -
Admin panel: TTS reaches OpenVibe.Chat again, Cashouts points to Billing's console, Payments shows Billing's webhooks without the secrets nothing read, paste limits are read-only from Community, and the dead VPN queue tab is gone (#299)OpenVibers · 22 days ago
6c9c8097 -
Network: project secrets — admins write a value once, services sign with it or receive it for a granted origin, nobody reads it back (ADR-056) (#197)OpenVibers · 29 days ago
9aeac0ab -
Network: the go-live consumer always delivers (the cutover flag held every go-live since 10-10) (#142)OpenVibers · 11 Oct 2026
ea7d8f86 -
Network: the migration era is deleted (SQLite tooling, follows import, legacy deploy path, better-sqlite3, DB_PATH) (#116)OpenVibers · 10 Oct 2026
d65d5951 -
Serve llms-full.txt and IndexNow key, grant Trade event manageOpenVibers · 4 Oct 2026
e82af326 -
Serialize agent creation and resume with revoke and cascade transactions (#25)OpenVibers · 3 Oct 2026
4ec36e1b -
Platform plan T2 "Follows", job 1 of 2: Network resolves go-live… (#6)OpenVibers · 2 Oct 2026
e6b426cb -
T2 Network on PostgreSQL, work in progress: what eight DeepSeek attempts left in the working tree (asyncified call sites, dialect fixes, migrations 0003-0006, test fixes); unfinished, continued on this branch by a cloud session.OpenVibers · 29 Sept 2026
206ab360 -
Plan T2 deletions in Network (each proven uncalled across the estate first): the one-time scripts hash-refresh-tokens, follows-backfill and creator-analytics-backfill; the built-in fallback tool catalog (before Tools has answered, the catalog is empty); the legacy OIDC alias /oauth/.well-known/openid-configuration (the issuer-root discovery and RFC 8414 stay); docs/patches; the Wave 0 roadmap baseline (scripts, docs, test), superseded by the plan; every README/docs mention of the retired X-Internal-Key (docs/retirement.md now records its retirement). Kept, with their callers: scripts/import-blocks.js (Chat's DM-blocks migration runs it) and scripts/secrets-out-of-db.js (no record that it ran). With an empty catalog the home page says 'Tools that just open' and 'free online tools' instead of '0', shows no empty rows, and llms.txt leaves the empty section out (test/home-empty-catalog.test.js). npm test green.OpenVibers · 29 Sept 2026
f6fe8570 -
Per-actor limits on the account API's writes (roadmap WS-R task 4; openvibe-sdk 0.11.0 -> 0.12.0 openvibe-sdk/limits). server/auth/actor-limits.js counts writes by the person whose session token makes them (their subject).OpenVibers · 28 Sept 2026
ddd87b68 -
Provider secrets from the environment first (roadmap §18.2(12)): the Resend API key and webhook secret, the Discord bot token and OAuth client secret, and the VAPID private key were read only from site_settings in plaintext. Each now has a variable (RESEND_API_KEY, RESEND_WEBHOOK_SECRET, DISCORD_BOT_TOKEN, DISCORD_OAUTH_CLIENT_SECRET, VAPID_PRIVATE_KEY; server/secrets.js) that db.getSetting reads first, so every reader is environment-first; the database row stays the fallback, so nothing changes until the operator moves a value. Which source each uses is reported by name only: the boot line [Secrets] key=env|database|unset, GET /api/admin/secrets (owner), api_key_source in the email status and sources in the Discord settings. The admin panel shows an environment-provided secret as set in the environment (input disabled), and the email, settings and Discord endpoints never save one into the database while its variable is set. Web push derives the VAPID public key from the private key, so a private key in the environment (or a stale public key beside it) still gives a matching pair and no new pair is generated over it. scripts/secrets-out-of-db.js lists the secret setting names with their variable, whether the env file sets it to the same value and whether the running service has it (never a value); --apply --backup <new file> blanks only the copies the environment and the restarted service already provide (a different value only with --allow-different) plus the settings Network never reads (net.* tokens, old ses_* keys); --restore-from <backup> [--apply] rolls back. Run with sudo, it reads the env file and /proc/<pid>/environ, then becomes the database owner. test/provider-secrets.test.jsOpenVibers · 24 Sept 2026
70050bca -
Developer projects work without staff in sandbox: DEV_SANDBOX_AUDIENCES defaults to openvibe.media, openvibe.events, openvibe.tools; sandbox allowance (DEV_SANDBOX_ALLOWANCE, default media.object.upload/read, events.app.publish/read/subscribe, tools.job.create/read/cancel, public capabilities only) for sandbox apps; production allowance stays staff-set. dev_audit events relayed to OpenVibe.Events through an openvibe-sdk v0.2.2 outbox when OV_EVENTS_INTERNAL_URL is set (backfilled, self-signed svc:network token)OpenVibers · 23 Sept 2026
a46f6096 -
Developer projects foundation (Wave 20, ADR-014): projects, members, apps, hashed credentials, grants within a staff-set allowance, quotas, append-only auditOpenVibers · 23 Sept 2026
1fc254a3 -
Initial OpenVibe releaseOpenVibers · 17 Aug 2026
db04c27f