Commits

main

Trade: a product home built with the showcase kit above the instrument search. (#13)OpenVibers · 7 Oct 2026 9ae2814
Pin openvibe-contracts v0.97.0, drop the proposed-capability shim, move shutdown onto the service kit (#12)OpenVibers · 5 Oct 2026 03c0021
Merge pull request #11 from OpenVibers/agent/trade-t11-step-4b-openvibe-trade-221217-muudm88xOpenVibers · 4 Oct 2026 1193e65
Adopt openvibe-publishing 1.3.0 and add llms-full.txtOpenVibers · 4 Oct 2026 8801cd2
Merge pull request #10 from OpenVibers/agent/trade-t11-step-2-second-batch-132729-mutuvc8fOpenVibers · 4 Oct 2026 bc08be8
Render every page through openvibe-publishing/layout on shell v2.6.0OpenVibers · 4 Oct 2026 8efb890
T9 step 1, Trade half — OpenVibe.Trade: make scripts/subscribe.js… (#9)OpenVibers · 4 Oct 2026 f2531a9
T9 steps 3-4: create scripts/subscribe.js with --reconcile (#8)OpenVibers · 4 Oct 2026 1cdb36d
Document TRADEPGLITEDIR in the environment example (#7)OpenVibers · 3 Oct 2026 7b9360a
T9 READY NOW doc/config fix (#6)OpenVibers · 3 Oct 2026 6ec69d1
Bump openvibe-shared v2.4.0 → v2.5.0 (#5)OpenVibers · 3 Oct 2026 522c71f
Bump OpenVibe.Trade's openvibe-shared pin to v2.4.0 (#4)OpenVibers · 3 Oct 2026 1beabea
Move Trade's error helpers onto openvibe-sdk/service (#3)OpenVibers · 2 Oct 2026 7c424ed
Serve all Cache-Control values from openvibe-shared/cache-policy (#2)OpenVibers · 2 Oct 2026 f632763
Trade on the Publishing 1.1.0 chassis (plan T9 J6): the Sources client, change cursor and pull loop, signed event consumer, normalisers, freshness verdict and Search publication glue come from openvibe-publishing/ingest and /publication; Trade keeps its domain half (domain/ingest.js, source-status.js, helpers.js, events/consumer.js). Migration 0002 seeds trade_ingest_cursor once from trade_sync_state (continuity, never a reset to zero). The replaced domain/sync.js, util.js, freshness.js, events/webhook.js and clients/sources.js are deleted. test/chassis.test.js proves nothing requires them and replays the Sources fixture against a golden captured from the pre-change code. npm test and test:pg 18/18 (verified).OpenVibers · 29 Sept 2026 e0fffe7
Trade tells search engines when a page changes (plan T11, IndexNow): with INDEXNOW_KEY set the key file is served at /<key>.txt and an indexable page appearing, changing or going away pings the engines (its path and the sitemap); drafts, private and noindex pages never; unset, nothing is mounted or sent. A home-page performance budget runs in CI where there was none. Tests green (verified).OpenVibers · 29 Sept 2026 6b255e5
Trade moves between its pages without a reload (plan T11): openvibe-shared v2.2.0 boost swaps <main> styles-first with the shared transition, prefetching on intent, and does a normal load across a deploy (the ov-boost marker carries the release). The navbar's sign-in returns to the current page. test/layout-boost.test.js pins the marker, the boost tag and the login template.OpenVibers · 29 Sept 2026 a7c11cd
Trade on the service kit (plan T1): sign-in is openvibe-sdk/sso createSsoClient (state + PKCE S256, server-side exchange, next limited to this site and the Network), service tokens are checked by openvibe-sdk/auth verifyServiceToken (the key their kid names), the outbox is createServiceOutbox; server/auth/sso.js and server/events/outbox.js are deleted. Pins: openvibe-sdk v0.25.0, openvibe-contracts v0.79.0, openvibe-shared v2.0.0. Both suites green (verified).OpenVibers · 29 Sept 2026 72f807b
A regression test pins nested transactions: an inner store.tx that throws rolls back only its own writes while the outer one commits, and an outer throw rolls back everything (plan T0; the SDK makes an inner tx a savepoint). Built on a free model, reviewed on DeepSeek (SHIP).OpenVibers · 29 Sept 2026 211ed12
The SQLite era is gone (on PostgreSQL since 2026-09-28; no compatibility kept): the one-time migrate-to-postgres script, *_DB_PATH settings (config, .env.example, systemd unit, test helpers), the unused better-sqlite3 dependency and its lockfile entries, and docs, docstrings and STATUS lines about SQLite or its rollback window. Reviewed independently before shipping. npm test 13/13 test files passed.OpenVibers · 29 Sept 2026 5e1dcb4
openvibe-shared v1.27.0 (from v1.25.0): an async route handler's rejection now reaches the error handler instead of ending the process. Express 4 leaves such a promise unhandled and Node 22 exits on it; instrument() now applies openvibe-shared/express-async. 1.26.0 adds async gauge collects. npm test: 13/13 test files passed.OpenVibers · 28 Sept 2026 f80bd45
Trade moves to PostgreSQL and Valkey (ADR-035, roadmap WS-X2, repository-pass group G1), async from end to end.OpenVibers · 28 Sept 2026 e140fcb
npm test no longer counts a skipped test as passed (roadmap WS-Q task 7; openvibe-shared/test-runner, Shared v1.25.0). test/run.js counted every file that exited 0 as passed, so a file that printed that it skipped its work and checked nothing still read as green. It is now the shared runner through run() (same files, one at a time as before, 60 s timeout per file, VERBOSE=1 still prints every file's output): a test prints "<label>: skipped (<why>)" for what it could not run, and that file is listed with ○ and its reasons and not counted as passed; --strict makes a skip fail the run. No test here skips anything. openvibe-shared is pinned at v1.25.0 (from v1.22.0; 1.23 and 1.24 add the web runtime, release-watch fixes and the readiness skip, and /api/ready answers as before because its db check really runs; README and STATUS.json follow). npm test (Node 22) 13/13.OpenVibers · 28 Sept 2026 d515e46
README and STATUS.json are current (roadmap WS-U task 3): a Capabilities section lists the twelve capabilities Trade implements and the grants it uses at Events and Sources; Deploy says production deploys with sudo ovhost deploy trade (unit, port, env file, rollback) and keeps the first-install steps; Security points to SECURITY.md; Depends on names the current pins (contracts v0.49.0, publishing v0.4.0, shared v1.22.0, sdk v0.12.0). STATUS.json gains contracts, features, the current package list and updated 2026-09-28.OpenVibers · 28 Sept 2026 273bce7
Per-actor rate limits on Trade's /api/v1 and its watchlist, alert and editor forms (roadmap WS-R task 4, openvibe-sdk v0.12.0 limits). server/http/actor-limits.js makes one limiter per app and counts requests once req.viewer is resolved and a route's capability guard (for a form, the session and form token) passed, before any work. A person counts as user:usr_…, whether they use their own token or cookie, a first-party service names them in X-OV-Subject, or an app acts for them through on_behalf_of. A service or app acting as itself, such as a feed or OpenVibe.AI, counts by its principal; anyone else by address. Past a limit a route answers 429 problem+json rate_limited with Retry-After, logs one line and counts trade_rate_limited_total{limit,window}.OpenVibers · 28 Sept 2026 4658447
The notification bell hears new notifications as they happen (notificationsRealtime; Shared 1.22.0, roadmap WS-E task 3): Network's network.notification.created over OpenVibe.Events' realtime stream, with polling as the fallback. Only a signed-in bell with a Network token opens a stream.OpenVibers · 26 Sept 2026 046d4ee
Pins: openvibe-shared 1.20.0 -> 1.22.0 (realtime notification badge, off until a site turns it on; the unreachable-host browser check)OpenVibers · 26 Sept 2026 fa38288
Open redirect fixed (roadmap WS-R task 5): the sign-in next let "/<TAB>/evil.com" through, which browsers read as "//evil.com" (they drop tab and newline characters and read a backslash as "/"); any control character or backslash in next now goes home. test/open-redirect.test.js feeds it the known bypassesOpenVibers · 26 Sept 2026 e427ca0
Pins: openvibe-shared 1.18.0 -> 1.20.0 (the update matrix and release manifest 1.2.0: client generations, the shell)OpenVibers · 26 Sept 2026 e8fee67
Pins: openvibe-shared 1.17.1 -> 1.18.0 (update telemetry: prompted count, sessions by generation)OpenVibers · 26 Sept 2026 101445e

More commits