Commits

main

npm test no longer counts a skipped test as passed (roadmap WS-Q task 7; openvibe-shared/test-runner, Shared v1.25.0). test/run.js counted every file that exited 0 as passed, so a file that printed that it skipped its work and checked nothing still read as green. It is now the shared runner through run() (same files, one at a time as before, 60 s timeout per file, VERBOSE=1 still prints every file's output): a test prints "<label>: skipped (<why>)" for what it could not run, and that file is listed with ○ and its reasons and not counted as passed; --strict makes a skip fail the run. No test here skips anything. openvibe-shared is pinned at v1.25.0 (from v1.24.0; STATUS.json follows, and the README, which still named v1.22.0). npm test (Node 22) 16/16.OpenVibers · 28 Sept 2026 cb6d79e
News's readiness has no fake green (roadmap WS-Q task 7, Shared v1.24.0). sources_pull answered ok ({ pull: 'off' }) when the pull was switched off and had never run, which verified nothing. It now reports skipped with the reason (NEWS_PULL_INTERVAL_MS=0 or NEWS_WORKER=off), never ok; a pull that ran and failed, or is due and has not run, still fails as before. openvibe-shared is pinned at v1.24.0 (from v1.22.0), named in STATUS.json. npm test 16/16.OpenVibers · 28 Sept 2026 2b8bcd1
README and STATUS.json are current (roadmap WS-U task 3): Capabilities is now a level-2 section and lists the grants News uses at Sources, Events, Network, Community and AI; Deploy says production deploys with sudo ovhost deploy news (unit, port, env file, rollback) and keeps the first-install steps; Security points to SECURITY.md; Depends on names the current pins (publishing v0.4.0, contracts v0.49.0, shared v1.22.0, sdk v0.12.0). STATUS.json gains contracts, features, the current package list and updated 2026-09-28.OpenVibers · 28 Sept 2026 97dae43
Per-actor rate limits on News' /api/v1, the editor desk and the comment form (roadmap WS-R task 4, openvibe-sdk v0.12.0 limits). server/http/actor-limits.js makes one limiter per app and counts requests once req.viewer is resolved and a route's capability guard passed, before any work (for a write, before its body is read). A person counts as user:usr_…, whether they use their own token or cookie, a first-party service names them in X-OV-Subject, or an app acts for them through on_behalf_of. A service or app acting as itself counts by its principal; anyone else by address. Past a limit a route answers 429 problem+json rate_limited with Retry-After, logs one line and counts news_rate_limited_total{limit,window}.OpenVibers · 28 Sept 2026 8ab47a6
The notification bell hears new notifications as they happen (notificationsRealtime; Shared 1.22.0, roadmap WS-E task 3): Network's network.notification.created over OpenVibe.Events' realtime stream, with polling as the fallback. Only a signed-in bell with a Network token opens a stream.OpenVibers · 26 Sept 2026 dab7977
Pins: openvibe-shared 1.20.0 -> 1.22.0 (realtime notification badge, off until a site turns it on; the unreachable-host browser check)OpenVibers · 26 Sept 2026 0860cf2
Open redirect fixed (roadmap WS-R task 5): the sign-in next let "/<TAB>/evil.com" through, which browsers read as "//evil.com" (they drop tab and newline characters and read a backslash as "/"); any control character or backslash in next now goes home. test/open-redirect.test.js feeds it the known bypassesOpenVibers · 26 Sept 2026 36b91d3
Pins: openvibe-shared 1.18.0 -> 1.20.0 (the update matrix and release manifest 1.2.0: client generations, the shell)OpenVibers · 26 Sept 2026 90fbbad
Pins: openvibe-shared 1.17.1 -> 1.18.0 (update telemetry: prompted count, sessions by generation)OpenVibers · 26 Sept 2026 57c5ab3
Pins: openvibe-shared 1.16.1 -> 1.17.1 (release notifications)OpenVibers · 26 Sept 2026 9202f90
Pins: openvibe-shared 1.16.0 -> 1.16.1 (the OV mark stops animating when idle, hidden or off-screen)OpenVibers · 26 Sept 2026 48a339d
Pins: openvibe-shared 1.13.0 -> 1.16.0OpenVibers · 26 Sept 2026 9460c86
.env.example: names with a working default are commented (optional), so ovhost validate's from-example check requires only what the service cannot run withoutOpenVibers · 26 Sept 2026 8103b67
Pins: openvibe-contracts 0.44.0 → 0.49.0, openvibe-shared 1.12.0 → 1.13.0, openvibe-sdk 0.9.1 → 0.11.0OpenVibers · 25 Sept 2026 8246a22
Pins: openvibe-contracts 0.42.0 → 0.44.0 (Contracts 0.43.0 and 0.44.0 were released after the previous pin commit, leaving 0.42.0 two minors behind the pin-drift limit)OpenVibers · 25 Sept 2026 9f027d3
Pins: openvibe-contracts 0.38.0 → 0.42.0, openvibe-sdk 0.5.0 → 0.9.1; CI runs the pin-drift check (shared test and security workflows at 423fe51)OpenVibers · 25 Sept 2026 6baef52
Staff powers from the contracts staff map (WS-D, ADR-022; Contracts 0.38.0): staff editors are staff.editorial.manage (admin, as before), not a role list; NEWS_EDITORS stays the product's own editor role. test/staff-map.test.js fails on raw role checksOpenVibers · 24 Sept 2026 b592ef0
The OpenVibe Frame from this site's own pinned copy: /shared/* is served by openvibe-shared/serve (1.12.0) and every page references it by content hash (/shared/<file>?v=<hash>), so this site's pin decides what its pages run and its navbar and footer keep working while openvibe.network is down; openvibe-publishing 0.4.0 (openvibe-shared as a peer: one copy, no lockstep releases)OpenVibers · 24 Sept 2026 9dd0229
The shared update system and one account UI, on the OpenVibe Frame (openvibe-shared 1.11.0, openvibe/frame): the home shows what shipped, /updates is the shared log and the footer links it; the shared navbar handles sign in and out (logoutUrl ends this site's session) and carries this site's account links in its menu, while the page's own account bar is only for no-JS visitorsOpenVibers · 24 Sept 2026 b3e752b
CI calls the shared test workflow (Track Q): OpenVibe.Shared .github/workflows/test.yml@f5e7e73 (install, node --check over server/ and scripts/, npm test, openvibe-contracts-check) instead of a copy of those stepsOpenVibers · 24 Sept 2026 a108ad3
openvibe-publishing v0.2.2 (shares the openvibe-shared v1.5.1 copy instead of installing v1.0.0 alongside)OpenVibers · 24 Sept 2026 42ce43b
SECURITY.md: how to report a vulnerability ([email protected], 7-day reply, scope, supported versions)OpenVibers · 24 Sept 2026 f01c795
Story flag events use priority low (source-removed stays important): 'normal' is not an envelope priority, so Events refused those flag eventsOpenVibers · 24 Sept 2026 0143ae8
openvibe-shared v1.5.1, openvibe-contracts v0.33.0OpenVibers · 23 Sept 2026 c2c31b0
openvibe-shared v1.5.0 (Track R release manifest), openvibe-contracts v0.32.0, openvibe-sdk v0.5.0OpenVibers · 23 Sept 2026 2c4d395
CI: run the shared security workflow (gitleaks secret scan + dependency audit, Track Q)OpenVibers · 23 Sept 2026 5b393d2
Index gate needs two independent sources (NEWS_MIN_INDEPENDENT_SOURCES, default 2)OpenVibers · 23 Sept 2026 5a17e7f
Community comment threads on stories, referenced not copiedOpenVibers · 23 Sept 2026 0d95d9c
Docs: STATUS.json and README match production (2026-09-23)OpenVibers · 23 Sept 2026 d6dae5e
README: the AI grant namespace is news.* (a bare news matches no news.* workflow)OpenVibers · 23 Sept 2026 8650254

More commits