Commits

main

Pins: openvibe-contracts -> 0.61.0 (network.notification.created@1, identity.realtime-ticket-claims@1, network.realtime-ticket-result@1)OpenVibers · 26 Sept 2026 dbf9d39
v1.22.0: the notification bell in realtime, off by default (roadmap WS-E task 3, WS-F task 1; openvibe-contracts 0.61.0, ADR-005 amendment 2). New browser file notification-live.js (OVNotificationLive, 2.4 KB brotli, budget 3 KB): a realtime ticket from Network (POST /api/v1/realtime/ticket, Bearer or the openvibe.network cookie) for every (re)connect, then Events' /realtime/stream?topics=network.notification.*&ticket= without credentials, resuming with last_event_id; only the ticket's person's events count; gaps reported; errors close and back off from 2 s with jitter, ten in a row stop it until online; hidden 5 min closes, shown resumes; CSP refusal, 401/403 and 503 stop it. notification-ui.js (budget 13 KB) loads it from its own directory with init({ realtime: true }) (navbar: notificationsRealtime: true): an event re-reads the count once per burst (and again after a poll in flight), a gap also reloads open lists, the 15 s poll runs every 2 min while the stream is open; setToken() restarts it; realtimeState(). files.js and exports list it; browser-harness exports openPage. Tests: linkedom (subscribe, resume from the cursor, gap -> refetch, CSP-blocked -> polling, guessed topic yields nothing) and headless Chrome with a real EventSource (drop and resume with nothing lost or repeated, retention gap, another person's event ignored)OpenVibers · 26 Sept 2026 3282427
v1.21.0: browser harness checkUnreachable (ADR-024, roadmap WS-E task 1): openPage({ block }) fails every request matching a pattern, and checkUnreachable(url) reports whether a page still paints (200, settled, text, a --accent token, a background) with openvibe.network unreachable; blocked requests are not page errors. Tested in headless ChromeOpenVibers · 26 Sept 2026 749cbcf
v1.20.0: release manifest 1.2.0 (roadmap WS-P task 7, openvibe-contracts 0.60.0): createRelease serves client_generation, min_client_generation (env MIN_CLIENT_GENERATION) and shell { version, components }; the meta tag carries data-generation; a tab below the minimum generation reloads when safe (required) and a changed shell never goes in place (it prompts). Contracts devDependency 0.60.0OpenVibers · 26 Sept 2026 36ac2da
v1.19.0: the update matrix, complete (roadmap WS-P task 8): release-update sends ov:content-dispose before a region is replaced so a widget inside drops its listeners and timers (ov:content-updated follows to mount it again); tests cover every row (style swap and ov:styles-updated, revision-aware content with scroll kept, widget disposal, busy deferral, prompt, security minimum); the README lists the matrixOpenVibers · 26 Sept 2026 d8693c9
v1.18.0: update telemetry (roadmap WS-P task 14): release-watch counts the update prompt (prompted: optional, required, window, contract) and beats every 5 minutes with a random in-memory tab id and its release, saying ended on pagehide; the collector keeps tabs heard from in 12 minutes as release_client_sessions{generation=current|older} against the release the process serves. release-watch stays under its 5 KB brotli budget (4.96 KB) by shortening commentsOpenVibers · 26 Sept 2026 e1f7441
v1.17.1: release-watch acts on a release notification only when its origin (when given) is the page's own; Sites' placeholders reuse product service idsOpenVibers · 26 Sept 2026 db02e50
release-watch subscribes to topics=host.release.published (1.17.0, WS-P task 9)OpenVibers · 26 Sept 2026 3290dc5
release-watch: a CSP that leaves Events out of connect-src stops the release stream after one refusal (1.17.0, WS-P task 9)OpenVibers · 26 Sept 2026 2dfb257
v1.17.0: release-watch hears about releases over the Events realtime plane (WS-P task 9, ADR-016 amendment 1)OpenVibers · 26 Sept 2026 17a32e4
v1.16.1: the OV mark moves for its intro, on hover/focus and while busy, not forever (browser check, WS-Q task 3). Its endless SVG animations (ovmFloat, ovmGlow, ovmComet, ovmDot, the V's SMIL light sweep and the orbiting dots) restyled and re-laid-out every frame and kept every idle page with the navbar 12-29% busy. Now a mark runs for the first 8 s of a visit (kept in sessionStorage, so the next page of a multi-page site finishes the intro instead of starting another), while it or its link is hovered or focused (plus 1.2 s) and while island.js shows activity (data-state busy/ok); otherwise its CSS animations are paused where they are and its SMIL clock stopped, so it keeps its look. Never while the page is hidden, while it is off-screen (IntersectionObserver), with data-static, under prefers-reduced-motion or html[data-ov-motion=reduced] (the V sweep used to run under all of those). A removed mark is unobserved and let go. Headless Chrome after five page loads: 12 running animations and 16.5% CPU before, none and 0% after. test/ov-mark.test.js. Not taggedOpenVibers · 26 Sept 2026 e40dbb8
browser-harness: Chrome runs in its own process group and close() stops that group (only what this launch started: the browser and its renderer/GPU helpers, which outlived a killed browser and kept writing), then removes the temporary profile with retries and resolves once it is gone; if the process ends first, an exit handler does the same. The profile used to be removed on an unref'd timer that never ran when the process ended right after, leaving one per run on a nearly full disk (H7). run() awaits close(); the Chrome test checks the profile is goneOpenVibers · 26 Sept 2026 55c28eb
browser-harness: a noindex page (meta robots or X-Robots-Tag) needs no canonical link (Sources' landing page is noindex); a canonical it has is still judgedOpenVibers · 26 Sept 2026 6d4420f
browser-harness: an ItemList's JSON-LD is judged by its items (80 % of the item names visible), not by its own name, which is a label (often a nav's aria-label: Tools' "Tool families"); a list without item names falls back to its nameOpenVibers · 26 Sept 2026 9b8eac3
shipped.js: the update log's selected filter chip is --on-accent-strong on --accent-strong (4.5:1 in every theme) instead of white on --accent (3.67:1, axe color-contrast serious on every site's /updates, found by the browser harness); test/login-contrast.test.js checks itOpenVibers · 26 Sept 2026 f4877e0
v1.16.0: openvibe-shared/browser-harness (WS-Q task 3, WS-T tasks 3-4): Live's browser smoke suite generalised for any site, headless Chrome over the DevTools protocol with Node's own WebSocket (no dependency). Per route at 390/768/1280 px: HTTP status, console errors (exceptions, console.error, failed loads, CSP), horizontal overflow with the offending elements, scripts requested twice; with JavaScript off: visible text, one absolute canonical, JSON-LD parses and its headline/name is visible (title-style names by their leading part, web pages by their title); axe-core at the widest width (serious/critical fail, moderate reported); a non-HTML answer is judged on its status only. Per site: A->B->A navigation five times (links clicked, so an SPA navigates in place; no back/forward cache) with heap, nodes, listeners, documents, intervals, pending timeouts and sockets sampled after a forced GC, failing growth past BUDGETS that is still growing; idle CPU (script/style/layout), requests and running animations reported. ignoreErrors rules are counted per label. axe-core 4.13.0 from an installed package or jsDelivr checked against a pinned sha384, cached. test/browser-harness-chrome.test.js runs it in real Chrome against a fixture and skips without ChromeOpenVibers · 26 Sept 2026 9fc27a5
v1.15.0: openvibe-shared/perf-budget (WS-T task 1): size budgets for a page's first load measured from the running server (HTML, same-origin scripts and stylesheets, raw and brotli; cross-origin assets listed, not weighed), check() and format() for npm testOpenVibers · 26 Sept 2026 55c79b8
gitleaks: allow the two made-up secrets in test/config.test.js (they prove redaction), matched on path and exact valueOpenVibers · 26 Sept 2026 1c7b280
v1.14.0: openvibe-shared/config, the configuration model (WS-C task 7); openvibe-contracts pin 0.49.0 → 0.52.0 (the tests check every snapshot against common.config-snapshot@1)OpenVibers · 26 Sept 2026 956f7dd
openvibe-shared/config, the configuration model (WS-C task 7): createConfigStore keeps one namespace of a service's configuration as immutable revisions (common.config-snapshot@1) in the service's own better-sqlite3 database: get() from memory, JSON Schema subset and validate(), public/internal/secret classification, atomic activation with the last-known-good restored in memory and in the database when onActivate throws, rollback as a new revision, pruning that keeps the last-known-good, redacted history (a secret is an HMAC-SHA256 fingerprint under a random 32-byte key per namespace in config_keys, never served or logged; the checksum covers the values as shown), legacy import (fromRows) as revision 1; adminRoutes serves /api/admin/config (list, history, apply, rollback) with problem+json, on Express or plain http without depending on either; no new dependency (unreleased)OpenVibers · 26 Sept 2026 b473e0d
pin-drift: one copy of openvibe-shared per package root (WS-C task 8, ADR-008 amendment): after install, every installed copy is found (npm nesting, pnpm store, symlinks resolved) and a second one fails with each copy's version and path; every repository has one todayOpenVibers · 25 Sept 2026 94575ed
Pins: openvibe-contracts 0.44.0 → 0.49.0OpenVibers · 25 Sept 2026 5357179
v1.13.0: the Sign In button reads at 4.5:1 in every theme (derived --accent-strong/--on-accent-strong; white on #3b82f6 was 3.67:1 on nine sites) and the footer accepts { label, href } items (empty links on Media and Games) — WS-T task 3OpenVibers · 25 Sept 2026 227e3f8
Shared test workflow: fetch-depth (a compat check against release tags), package-manager pnpm (sets up pnpm, caches its store), cache off for a repository without a lockfile, and a read-only GITHUB_TOKEN for extra steps — so Contracts, Games, Extensions and Network can call it (WS-Q task 1)OpenVibers · 25 Sept 2026 66b76f8
Pins: openvibe-contracts 0.42.0 → 0.44.0 (Contracts 0.43.0 and 0.44.0 were released after the previous pin commit, leaving 0.42.0 two minors behind the pin-drift limit)OpenVibers · 25 Sept 2026 fbd4053
pin-drift: a pin more than one minor behind fails only once the release that makes it so is over 14 days old (dates from the library's CHANGELOG.md; undated releases count as old), so CI stays green on the day a library ships and still catches pins left behindOpenVibers · 25 Sept 2026 b1e2677
Pins: openvibe-contracts (devDependency) 0.31.0 → 0.42.0; CI runs the pin-drift checkOpenVibers · 25 Sept 2026 7e96d09
Pin drift (WS-C task 5): scripts/pin-drift.js fails on an openvibe-contracts/-shared/-sdk/-publishing pin that is not a published tag or is more than one minor (or a major) behind the latest release; the reusable test workflow runs it from main over the whole repository (pin-drift: false skips); custom CIs run the same curl lineOpenVibers · 25 Sept 2026 423fe51
1.12.0: openvibe-shared/serve — a site serves its own pinned shared browser files at /shared/* with content-addressed URLs (serve.url, ?v=hash immutable, ETag, CORS-open), so its pin decides what its pages run and the Frame survives an openvibe.network outage; the navbar loads its lazy siblings from its own origin (the network's copy is the fallback)OpenVibers · 24 Sept 2026 82255df
test: judge the mixed-version fixtures from inside their release window (fixed now), not today's clock — the test turned red once 2026-09-23T10:00Z + 24 h passedOpenVibers · 24 Sept 2026 a3d616e

More commits