Commits

main

Merge pull request #2 from OpenVibers/agent/vip-plan-t11-lane-d-follow-up-220743-muq34vm4OpenVibers · 2 Oct 2026 22542a6
Plan T11 lane D follow-up — attempt 3 reportOpenVibers · 1 Oct 2026 fe4fc64
VIP moves between its pages without a reload (plan T11): openvibe-shared v2.2.0 boost swaps <main> styles-first with the shared transition and does a normal load across a deploy (the ov-boost marker carries the release); page scripts that wire <main> also run on ov:boost:load. Tests pin the marker and the boost tag (verified).OpenVibers · 29 Sept 2026 453d347
VIP on the service kit (plan T1): the outbox is openvibe-sdk/events createServiceOutbox (callers emitIn inside the change's transaction). Pins: openvibe-sdk v0.25.0, openvibe-contracts v0.79.0, openvibe-shared v2.0.0. Both suites green (verified).OpenVibers · 29 Sept 2026 323872f
A published plan and a membership change commit only with their events: outbox.emit() in plans.publish and in the entitlement projection was not awaited (VIP's emit wraps the async PostgreSQL enqueue, so the codemod could not see it), so a failed event write was swallowed and the change committed without its event. Both are awaited; tests make the event write fail and assert the change rolls back (they reject emit rather than add a constraint, so they also run as the DML-only role under test:pg). Found by the estate-wide floating-promise sweep, fixed and reviewed independently (VERDICT: SHIP). npm test and test:pg 10/10. npm test 10/10 test files passed.OpenVibers · 29 Sept 2026 9fbd730
The rest of the SQLite-era cleanup (the previous commit carried only its deletions): *_DB_PATH/dbPath out of config, .env.example, the systemd unit and test helpers; the unused better-sqlite3 dependency and its lockfile entries; docs, docstrings and STATUS lines that still described SQLite or its rollback window. Reviewed independently (VERDICT: SHIP). npm test 10/10 test files passed.OpenVibers · 29 Sept 2026 50beabd
The SQLite era is gone (on PostgreSQL since 2026-09-28; no compatibility kept): the one-time migrate-to-postgres script, the *_DB_PATH settings (config, .env.example, systemd unit, test helpers), the unused better-sqlite3 dependency, and docs, docstrings and STATUS lines that still described SQLite or its rollback window. Reviewed independently before shipping. npm test 10/10 test files passed.OpenVibers · 29 Sept 2026 5a6b392
Health and readiness show the outbox's real counts: status() awaits pending()/rejected() (queries on PostgreSQL), so /api/health and /api/ready no longer serialize two Promises as {}. The API test asserts a number. npm test 11/11.OpenVibers · 29 Sept 2026 78dfe5e
scripts/import-live.js opens the database with openDb(config) (PostgreSQL, ADR-035), not the old SQLite path. npm test import 1/1.OpenVibers · 28 Sept 2026 9ff4277
VIP moves to PostgreSQL and Valkey (ADR-035, roadmap WS-X2, repository-pass group G2), async from end to end.OpenVibers · 28 Sept 2026 4f4ab36
npm test no longer counts a skipped test as passed (roadmap WS-Q task 7; openvibe-shared/test-runner, Shared v1.25.0). test/run.js counted every file that exited 0 as passed, so a file that printed that it skipped its work and checked nothing still read as green. It is now the shared runner (same files, one at a time as before, 60 s timeout per file): a test prints "<label>: skipped (<why>)" for what it could not run, and that file is listed with ○ and its reasons and not counted as passed; --strict makes a skip fail the run. No test here skips anything. openvibe-shared is pinned at v1.25.0 (from v1.22.0; 1.23 and 1.24 add the web runtime, release-watch fixes and the readiness skip, and /api/ready answers as before because its db check really runs; the README follows). npm test (Node 22) 11/11.OpenVibers · 28 Sept 2026 63f46fa
README and STATUS.json are current (roadmap WS-U task 3): the README gains Capabilities (the 14 vip.* capabilities and the grants VIP uses at Billing, Events and Network) and Deploy (sudo ovhost deploy vip, unit, port, env file, state, vhost, rollback and its index blocker) sections; Security notes point to SECURITY.md; Depends on names the current pins (contracts v0.49.0, sdk v0.12.0, shared v1.22.0) and Wiki as a consumer; the status line and acceptance note no longer say the Live import has not run or that production holds no plans. STATUS.json gains contracts and features and is updated 2026-09-28.OpenVibers · 28 Sept 2026 95b3e19
Per-actor rate limits on VIP's /api/v1 (roadmap WS-R task 4, openvibe-sdk v0.12.0 limits). server/api/actor-limits.js makes one limiter per app, counted once api/auth.js resolved the caller and before any work, Billing included: a service as its principal (svc:chat), a person as user:usr_…, anyone else by address. Past a limit a route answers 429 problem+json rate_limited with Retry-After, logs one line and counts vip_rate_limited_total{limit,window}.OpenVibers · 28 Sept 2026 0fbcbb5
The notification bell hears new notifications as they happen (notificationsRealtime; Shared 1.22.0, roadmap WS-E task 3): Network's network.notification.created over OpenVibe.Events' realtime stream, with polling as the fallback. Only a signed-in bell with a Network token opens a stream.OpenVibers · 26 Sept 2026 214e2ba
Pins: openvibe-shared 1.20.0 -> 1.22.0 (realtime notification badge, off until a site turns it on; the unreachable-host browser check)OpenVibers · 26 Sept 2026 4ddf723
Open redirect fixed (roadmap WS-R task 5): the sign-in next let "/<TAB>/evil.com" through, which browsers read as "//evil.com" (they drop tab and newline characters and read a backslash as "/"); any control character or backslash in next now goes home. test/open-redirect.test.js feeds it the known bypassesOpenVibers · 26 Sept 2026 2629597
Pins: openvibe-shared 1.18.0 -> 1.20.0 (the update matrix and release manifest 1.2.0: client generations, the shell)OpenVibers · 26 Sept 2026 7bd0676
Pins: openvibe-shared 1.17.1 -> 1.18.0 (update telemetry: prompted count, sessions by generation)OpenVibers · 26 Sept 2026 3f0380c
Pins: openvibe-shared 1.16.1 -> 1.17.1 (release notifications)OpenVibers · 26 Sept 2026 f2a386e
Pins: openvibe-shared 1.16.0 -> 1.16.1 (the OV mark stops animating when idle, hidden or off-screen)OpenVibers · 26 Sept 2026 3695c03
Pins: openvibe-shared 1.13.0 -> 1.16.0OpenVibers · 26 Sept 2026 194153f
.env.example: names with a working default are commented (optional), so ovhost validate's from-example check requires only what the service cannot run withoutOpenVibers · 26 Sept 2026 ad49965
Pins: openvibe-contracts 0.44.0 → 0.49.0, openvibe-shared 1.12.0 → 1.13.0, openvibe-sdk 0.9.1 → 0.11.0OpenVibers · 25 Sept 2026 f7a3315
Pins: openvibe-contracts 0.42.0 → 0.44.0 (Contracts 0.43.0 and 0.44.0 were released after the previous pin commit, leaving 0.42.0 two minors behind the pin-drift limit)OpenVibers · 25 Sept 2026 1c9a995
Pins: openvibe-contracts 0.38.0 → 0.42.0, openvibe-sdk 0.5.0 → 0.9.1; CI runs the pin-drift check (shared test and security workflows at 423fe51)OpenVibers · 25 Sept 2026 0e32f1d
Staff powers from the contracts staff map (WS-D, ADR-022; Contracts 0.38.0): managing network plans and any creator's plans is staff.site.configure (admin, as before), decided once from the token in userPrincipal; VIP_STAFF_ROLES is gone. test/staff-map.test.js fails on raw role checksOpenVibers · 24 Sept 2026 964a10c
The OpenVibe Frame from this site's own pinned copy: /shared/* is served by openvibe-shared/serve (1.12.0) and every page references it by content hash (/shared/<file>?v=<hash>), so this site's pin decides what its pages run and its navbar and footer keep working while openvibe.network is downOpenVibers · 24 Sept 2026 86e6996
The shared update system and one account UI, on the OpenVibe Frame (openvibe-shared 1.11.0, openvibe/frame): the home shows what shipped, /updates is the shared log and the footer links it; the shared navbar handles sign in and out (logoutUrl ends this site's session) and carries this site's account links in its menu, while the page's own account bar is only for no-JS visitorsOpenVibers · 24 Sept 2026 dcb7546
CI calls the shared test workflow (Track Q): OpenVibe.Shared .github/workflows/test.yml@f5e7e73 (install, node --check over server/ and scripts/, npm test, openvibe-contracts-check) instead of a copy of those stepsOpenVibers · 24 Sept 2026 ee7abc6
STATUS.json describes production: the running release and pins, what is deployed, the Live import that has run, and what is still owner-blockedOpenVibers · 24 Sept 2026 aa2fba9

More commits