Commits
-
Search page: the app icon's link tags without the web-app manifest (this service serves none, and its CSP has no manifest-src)OpenVibers · 24 Sept 2026
bef5188 -
The OpenVibe Frame from this site's own pinned copy: /shared/* is served by openvibe-shared/serve (1.12.0) and every page references it by content hash (/shared/<file>?v=<hash>), so this site's pin decides what its pages run and its navbar and footer keep working while openvibe.network is downOpenVibers · 24 Sept 2026
ae94086 -
The network's app icon on the search page (link tags only; its inline script would break the no-inline-script CSP), so browsers stop asking for a missing /favicon.icoOpenVibers · 24 Sept 2026
0db444f -
The OpenVibe Frame on search.openvibe.network: the shared navbar, footer and themes (scripts only from this site or openvibe.network; the init is the same-origin /frame-init.js reading a JSON config, so the CSP still allows no inline script), what shipped on the front page, and /updates as the shared log; nginx serves both new paths; openvibe-shared 1.11.1OpenVibers · 24 Sept 2026
b168c70 -
One W3C trace across services (Track O): openvibe-shared v1.7.0 trace.install(app) keeps each request's traceparent and puts it on the calls made while serving it, to loopback and OpenVibe hosts onlyOpenVibers · 24 Sept 2026
bd9faf8 -
CI calls the shared test workflow (Track Q): OpenVibe.Shared .github/workflows/test.yml@f5e7e73 (install, node --check over server/ and scripts/, npm test, openvibe-contracts-check) instead of a copy of those stepsOpenVibers · 24 Sept 2026
2586e9e -
SECURITY.md: how to report a vulnerability ([email protected], 7-day reply, scope, supported versions)OpenVibers · 24 Sept 2026
4603541 -
openvibe-shared v1.5.1, openvibe-contracts v0.33.0OpenVibers · 23 Sept 2026
57155cb -
openvibe-shared v1.5.0 (Track R release manifest), openvibe-contracts v0.32.0OpenVibers · 23 Sept 2026
5a4b08b -
Test: the search.openvibe.network vhost keeps the wildcard certificate, $remote_addr client headers, /metrics 404, loopback-only owner API, webhook and document writes, and a JSON 404 for unknown pathsOpenVibers · 23 Sept 2026
a707e38 -
W14: removal purge queue, freshness ranking, saved searches, a search page and the public vhostOpenVibers · 23 Sept 2026
dd7bcab -
CI: run the shared security workflow (gitleaks secret scan + dependency audit, Track Q)OpenVibers · 23 Sept 2026
9d8a4eb -
Track O: /metrics for direct loopback callers and a truthful /api/ready (openvibe-shared v1.3.0)OpenVibers · 23 Sept 2026
1be4b40 -
Docs: STATUS.json and README match production (2026-09-23)OpenVibers · 23 Sept 2026
cd8e1ea -
Events webhook requires signature v2 (replay window)OpenVibers · 23 Sept 2026
5a7e59b -
nginx: client address headers only from $remote_addr (realip). X-Forwarded-For was appended to and CF-Connecting-IP passed through from the client, so a request reaching the origin without Cloudflare (DNS-only host or the bare IP) chose the address the service bans and rate-limits byOpenVibers · 23 Sept 2026
43ae2a8 -
openvibe-contracts v0.13.0 (manifest, capabilities and schemas released in v0.12.0); contracts check in CIOpenVibers · 23 Sept 2026
12b4046 -
Test: OpenVibe.Sources item documents (staff-only, noindex) index through the Events path and are visible to role:admin onlyOpenVibers · 23 Sept 2026
f4fd8d6 -
Contracts proposal (search.index-document@1), capability and service manifest proposals, engine ADR, README, STATUS alpha W14, env example, systemd unit, nginx vhost, CI on Node 22.22.1OpenVibers · 23 Sept 2026
244d812 -
Search service: index documents with revision ordering and tombstones, event inbox, permission-aware FTS5 query API, removal events through an outboxOpenVibers · 23 Sept 2026
a9d4843