What shipped on OpenVibe.Billing
Every change deployed to OpenVibe, newest first. Each line is a commit from the OpenVibers repositories, linked to the change itself. When enough have gathered, or a large feature lands, they are written up as Patch notes on openvibe.blog. JSON: /api/v1/changelog.
2026-09-24
9f51b11One W3C trace across services (Track O): openvibe-shared v1.7.0 trace.install(app) keeps each request's traceparent and puts it on the calls made while serving it, to loopback and OpenVibe hosts only
069c53eCI calls the shared test workflow (Track Q): OpenVibe.Shared .github/workflows/test.yml@f5e7e73 (install, node --check over server/ and scripts/, npm test, openvibe-contracts-check) instead of a copy of those steps
94f1159Truthful readiness and status: /api/ready answers in the openvibe-shared/ready shape (named db and network_jwks checks, money_writes shown without failing it, release) instead of a bare {ready:true}; STATUS.json describes what production…
421beb4Serve the release manifest (Track R, D43): GET /release.json and POST /release-metrics through openvibe-shared release.mount; the manifest was built but never mounted, so billing.openvibe.network answered 404
42ad547SECURITY.md: how to report a vulnerability ([email protected], 7-day reply, scope, supported versions)
2026-09-23
d9add4copenvibe-shared v1.5.1, openvibe-contracts v0.33.0
ba81008openvibe-shared v1.5.0, openvibe-contracts v0.32.0
aa445d0CI: run the shared security workflow (gitleaks secret scan + dependency audit, Track Q)
c646279Cashout events carry the payout method's type only: the address (e.g. a PayPal email) stays in Billing for the staff console instead of travelling on the retained event stream
2169593Cutover runbook checked against production, and Live's money tables mapped to Billing
b774c5cEXTERNAL PowerChat tips reach Tips; hourly reconciliation; /metrics; overflow and race hardening
403c732Docs: STATUS.json and README match production (2026-09-23)
b59725eDirect PowerChat subscriptions settle only on the streamer's own account: intents need receiving_account (imported ones take it from Live's powerchat_connections); a pcsub ref on a tip to any other account (e.g. the subscriber's own)…
3001094nginx: client address headers only from $remote_addr (realip). X-Forwarded-For was appended to and CF-Connecting-IP passed through from the client, so a request reaching the origin without Cloudflare (DNS-only host or the bare IP) chose…
839da1b.env.example: POWERCHAT_SITE_USERNAME is required for PowerChat site-routed settlement
627303cSecurity: PowerChat site-routed refs only settle when paid to the site account; case-sensitive routing
36268f1nginx: billing.openvibe.network uses the openvibe.network wildcard certificate (like events)
5936807openvibe-contracts v0.19.0 (this service's manifest and capabilities are released); contracts check is blocking
fbbb0f3Staff console: Network SSO (authorization code + PKCE S256, client billing) for Network admins listed in BILLING_STAFF_SUBJECTS; server-rendered, no JS, noindex, no-store, strict CSP; host-only HttpOnly Secure SameSite=Strict short session…
8af6e69Docs and deploy for the staff console: README section, cutover runbook (the console replaces Live's cashout admin; Network redirect URI for client billing), .env.example (BILLING_STAFF_SUBJECTS, BILLING_SESSION_SECRET), nginx (console…
f876f1aCutover guards: a Live-credited order never settles twice, later imports never undo Billing's own movements, host freeze CLI
5833546Live as a Billing client: docs/live-patch.diff (BILLING_AUTHORITY=live|billing, off by default; money_writes_frozen) and the cutover sequence in docs/live-cutover.md
0269fe9openvibe-contracts v0.8.0 (billing capabilities released); CI runs openvibe-contracts-check --service billing
ab5ae81OpenVibe.Billing W8: balanced append-only journal, provider receipts, subscriptions, payouts, freeze, reconciliation and the Live import (ADR-012)
2026-09-21
7f719ceCharter: OpenVibe.Billing as defined in the OpenVibe realignment plan (placeholder, no code yet)