Commits

main · CHANGELOG.md

v1.18.0: update telemetry (roadmap WS-P task 14): release-watch counts the update prompt (prompted: optional, required, window, contract) and beats every 5 minutes with a random in-memory tab id and its release, saying ended on pagehide; the collector keeps tabs heard from in 12 minutes as release_client_sessions{generation=current|older} against the release the process serves. release-watch stays under its 5 KB brotli budget (4.96 KB) by shortening commentsOpenVibers · 26 Sept 2026 e1f7441
v1.17.1: release-watch acts on a release notification only when its origin (when given) is the page's own; Sites' placeholders reuse product service idsOpenVibers · 26 Sept 2026 db02e50
release-watch subscribes to topics=host.release.published (1.17.0, WS-P task 9)OpenVibers · 26 Sept 2026 3290dc5
release-watch: a CSP that leaves Events out of connect-src stops the release stream after one refusal (1.17.0, WS-P task 9)OpenVibers · 26 Sept 2026 2dfb257
v1.17.0: release-watch hears about releases over the Events realtime plane (WS-P task 9, ADR-016 amendment 1)OpenVibers · 26 Sept 2026 17a32e4
v1.16.1: the OV mark moves for its intro, on hover/focus and while busy, not forever (browser check, WS-Q task 3). Its endless SVG animations (ovmFloat, ovmGlow, ovmComet, ovmDot, the V's SMIL light sweep and the orbiting dots) restyled and re-laid-out every frame and kept every idle page with the navbar 12-29% busy. Now a mark runs for the first 8 s of a visit (kept in sessionStorage, so the next page of a multi-page site finishes the intro instead of starting another), while it or its link is hovered or focused (plus 1.2 s) and while island.js shows activity (data-state busy/ok); otherwise its CSS animations are paused where they are and its SMIL clock stopped, so it keeps its look. Never while the page is hidden, while it is off-screen (IntersectionObserver), with data-static, under prefers-reduced-motion or html[data-ov-motion=reduced] (the V sweep used to run under all of those). A removed mark is unobserved and let go. Headless Chrome after five page loads: 12 running animations and 16.5% CPU before, none and 0% after. test/ov-mark.test.js. Not taggedOpenVibers · 26 Sept 2026 e40dbb8
browser-harness: a noindex page (meta robots or X-Robots-Tag) needs no canonical link (Sources' landing page is noindex); a canonical it has is still judgedOpenVibers · 26 Sept 2026 6d4420f
browser-harness: an ItemList's JSON-LD is judged by its items (80 % of the item names visible), not by its own name, which is a label (often a nav's aria-label: Tools' "Tool families"); a list without item names falls back to its nameOpenVibers · 26 Sept 2026 9b8eac3
shipped.js: the update log's selected filter chip is --on-accent-strong on --accent-strong (4.5:1 in every theme) instead of white on --accent (3.67:1, axe color-contrast serious on every site's /updates, found by the browser harness); test/login-contrast.test.js checks itOpenVibers · 26 Sept 2026 f4877e0
v1.16.0: openvibe-shared/browser-harness (WS-Q task 3, WS-T tasks 3-4): Live's browser smoke suite generalised for any site, headless Chrome over the DevTools protocol with Node's own WebSocket (no dependency). Per route at 390/768/1280 px: HTTP status, console errors (exceptions, console.error, failed loads, CSP), horizontal overflow with the offending elements, scripts requested twice; with JavaScript off: visible text, one absolute canonical, JSON-LD parses and its headline/name is visible (title-style names by their leading part, web pages by their title); axe-core at the widest width (serious/critical fail, moderate reported); a non-HTML answer is judged on its status only. Per site: A->B->A navigation five times (links clicked, so an SPA navigates in place; no back/forward cache) with heap, nodes, listeners, documents, intervals, pending timeouts and sockets sampled after a forced GC, failing growth past BUDGETS that is still growing; idle CPU (script/style/layout), requests and running animations reported. ignoreErrors rules are counted per label. axe-core 4.13.0 from an installed package or jsDelivr checked against a pinned sha384, cached. test/browser-harness-chrome.test.js runs it in real Chrome against a fixture and skips without ChromeOpenVibers · 26 Sept 2026 9fc27a5
v1.15.0: openvibe-shared/perf-budget (WS-T task 1): size budgets for a page's first load measured from the running server (HTML, same-origin scripts and stylesheets, raw and brotli; cross-origin assets listed, not weighed), check() and format() for npm testOpenVibers · 26 Sept 2026 55c79b8
v1.14.0: openvibe-shared/config, the configuration model (WS-C task 7); openvibe-contracts pin 0.49.0 → 0.52.0 (the tests check every snapshot against common.config-snapshot@1)OpenVibers · 26 Sept 2026 956f7dd
openvibe-shared/config, the configuration model (WS-C task 7): createConfigStore keeps one namespace of a service's configuration as immutable revisions (common.config-snapshot@1) in the service's own better-sqlite3 database: get() from memory, JSON Schema subset and validate(), public/internal/secret classification, atomic activation with the last-known-good restored in memory and in the database when onActivate throws, rollback as a new revision, pruning that keeps the last-known-good, redacted history (a secret is an HMAC-SHA256 fingerprint under a random 32-byte key per namespace in config_keys, never served or logged; the checksum covers the values as shown), legacy import (fromRows) as revision 1; adminRoutes serves /api/admin/config (list, history, apply, rollback) with problem+json, on Express or plain http without depending on either; no new dependency (unreleased)OpenVibers · 26 Sept 2026 b473e0d
v1.13.0: the Sign In button reads at 4.5:1 in every theme (derived --accent-strong/--on-accent-strong; white on #3b82f6 was 3.67:1 on nine sites) and the footer accepts { label, href } items (empty links on Media and Games) — WS-T task 3OpenVibers · 25 Sept 2026 227e3f8
1.12.0: openvibe-shared/serve — a site serves its own pinned shared browser files at /shared/* with content-addressed URLs (serve.url, ?v=hash immutable, ETag, CORS-open), so its pin decides what its pages run and the Frame survives an openvibe.network outage; the navbar loads its lazy siblings from its own origin (the network's copy is the fallback)OpenVibers · 24 Sept 2026 82255df
1.11.1: the footer's shipped line follows the footer's own service (a local or unmapped host showed the whole network); an id that is not a registry id falls back to the hostnameOpenVibers · 24 Sept 2026 d2dbacb
1.11.0: the OpenVibe Frame — the shared navbar, footer and shipped views are no longer called 'chrome': openvibe-shared/frame (chrome-ssr stays a deprecated alias until 2.0), /api/frame and /api/frame/hit, window.OpenVibeFrame (OpenVibeChrome aliases it), cache key ov_frame_v1; the theme loader's browser-UI colour sync is syncBrowserUi. No behaviour changeOpenVibers · 24 Sept 2026 78883bf
1.10.0: chrome-ssr shipped() (a home page's pill and recent changes), updatesBody() (a site's /updates page) and shippedScript(): the server-side half of the shared update system, so every site renders the same markupOpenVibers · 24 Sept 2026 16c66ef
1.9.0: one shipped/update-log system for every site (shipped.js latest/list/log views from data-ov-shipped markup, via the Network changelog proxy; the footer's 'shipped X ago' line and Updates link); fixes: the footer's empty signed-in bar (display:flex beat [hidden]) and 'Sign In' for signed-in people on sites with their own session (a stale or refused token now falls back to sessionUrl; logoutUrl ends the site session; {path} in login/logout URLs)OpenVibers · 24 Sept 2026 c5b47f3
1.8.0: shipped.js, 'Recently shipped' for any OpenVibe site from the network changelog on OpenVibe.Blog (per site or network-wide, each line linked to its commit, the latest Patch notes post linked); DOM nodes only, https links only, hidden when empty or failing; served at openvibe.network/shared/shipped.jsOpenVibers · 24 Sept 2026 cccccba
1.7.0: openvibe-shared/trace, one W3C trace across services: install(app) keeps each request's trace in AsyncLocalStorage and wraps fetch() so calls to loopback or OpenVibe hosts carry traceparent (new span) and X-OpenVibe-Request-Id; provider and user-chosen URLs are untouched; tested against a real loopback serverOpenVibers · 24 Sept 2026 f62f653
1.6.0: openvibe-shared/egress, the one SSRF rule for Live, Events and Tools (strictest union of their drifted copies: 3fff::/20, 5f00::/16, NAT64 /48, Teredo; connect-time safeLookup, assertPublicUrl, EgressDenied), tested down to a refused socket; release.collect() keys beacons by req.ip (behind the proxy every socket was 127.0.0.1, one bucket for the whole site) or keyOf(req); STATUS versionOpenVibers · 24 Sept 2026 644d4c3
v1.5.1: touch and keyboard feedback in the shared chrome: the navbar, dropdowns, launcher, drawer and footer turn off the browser's blue tap highlight, press slightly (scale) and give keyboard focus one theme-accent ring; zero-specificity :where() rules, reduced motion dims insteadOpenVibers · 23 Sept 2026 ec5f31b
Release v1.5.0OpenVibers · 23 Sept 2026 81f840c
Release v1.4.0OpenVibers · 23 Sept 2026 c6405d4
1.3.0: openvibe-shared/metrics (Prometheus registry, golden-signal HTTP middleware by route template, process metrics, release_info, loopback-only /metrics) and openvibe-shared/ready (named required/optional checks; degraded never reads as down)OpenVibers · 23 Sept 2026 59fa8f9
1.2.1: release-watch treats playing media and live capture as protectedOpenVibers · 23 Sept 2026 ed8f5d4
1.2.0: navbar.js loads release-watch.js after init (opt out with releaseWatch: false)OpenVibers · 23 Sept 2026 7136ff0
1.1.1: release-watch learns its baseline from /release.json when the page has no ov-release metaOpenVibers · 23 Sept 2026 7c9a373
1.1.0: release manifest (/release.json, openvibe-shared/release) and release-watch.js — open tabs are prompted on a new release and reload only when safe (ADR-016)OpenVibers · 23 Sept 2026 6c855ea

More commits