What shipped on OpenVibe.Chat
Every change deployed to OpenVibe, newest first. Each line is a commit from the OpenVibers repositories, linked to the change itself. When enough have gathered, or a large feature lands, they are written up as Patch notes on openvibe.blog. JSON: /api/v1/changelog.
2026-09-24
325f878One W3C trace across services (Track O): openvibe-shared v1.7.0 trace.install(app) keeps each request's traceparent and puts it on the calls made while serving it, to loopback and OpenVibe hosts only; Chat also takes the request context…
6d86dd4CI calls the shared test workflow (Track Q): OpenVibe.Shared test.yml@e8b0caf (install, node --check, npm test, openvibe-contracts-check; ffmpeg where the tests need it) instead of a copy of those steps
4e95c11VIP client from openvibe-sdk/vip (v0.7.0): the copy of openvibe-vip/client is replaced by the SDK's published seam, same API and fail-closed behaviour; server/vip/vip-client.js re-exports it so callers are unchanged
fba087aVIP convergence (W10): Chat subscribes to vip.membership.changed; a delivery from VIP drops that member's cached subscriber-badge answers for the creator at once (vip/badges handleEvent) instead of converging by the cache TTL; any other…
9ebde51Release manifest and metrics (Track R D43, Track O): openvibe-shared v1.6.0; GET /release.json (release, contracts and package versions) with POST /release-metrics, and GET /metrics (loopback only: request rates and latencies, process…
990fbd1Staff gates ask the contracts staff map (D05, ADR-022): permissions.can(user, 'staff.<area>.<action>') over openvibe-contracts v0.35.0 (issued staff_caps claims win); per-IP and ban exemptions are staff.limits.exempt, chat-restriction…
1d0e12aSound uploads convert through OpenVibe.Tools (platform S9): the mp3 tool's run API via openvibe-sdk/tools (v0.6.0) with Chat's service token (tools.tool.run, tools.job.read), 128 kbps 44.1 kHz stereo, the result downloaded from the jobs…
1ef6f99SECURITY.md: how to report a vulnerability ([email protected], 7-day reply, scope, supported versions)
d268cf8A chat line that could not be saved is not broadcast: the sender gets an error and nobody sees a message that history, moderation and replays never have (the insert failure used to be swallowed as non-critical). ws-protocol test
2026-09-23
fcc824aopenvibe-contracts v0.33.0
4abf0faopenvibe-contracts v0.32.0: chat.message.send is chat's own capability, checked with a literal id
ed90461Events consumer (compatibility register C-84): Chat subscribes to live.release.deployed and network.module.updated and receives them at POST /internal/events (server/events/consumer.js). live.release.deployed makes the deploy card exactly…
c645a53Chat preferences move to the OpenVibe.Network user module chat.preferences (roadmap Wave 1 item 24; Chat owns the namespace since the Wave 6 cutover). GET /api/chat/preferences and PUT /api/chat/preferences { preferences } (a patch, null…
7897688Deploy notices: a new deploy folds into the last card only if nobody has spoken in ANY room since (the global feed shows stream messages too, so cards kept folding past them and their time ranges ran past the messages below), and only…
d02a73cVIP member badges: a member's messages in a creator's room carry the creator's VIP badge (a perk of their plan version bound to `chat badge`), resolved through OpenVibe.VIP's entitlement check (product chat) behind the shared product cache
9e0563aCI: run the shared security workflow (gitleaks secret scan + dependency audit, Track Q)
bf88760Persisted TTS and sound queue: every TTS utterance, channel !sound and 101soundboards clip is a row of audio_requests (server/chat/audio-queue.js) played one at a time per room, queued -> playing -> played, or skipped / failed. The audio…
49a5011Chat restart and cursor resume: test/restart-resume.test.js runs Chat as its own process, restarts it with SIGTERM on the same database, and proves that stream, global and channel readers that reconnect and read after_id=<last cursor> end…
791cd3dEnforce chat.message.send on the service API: an /internal/live/calls op that sends a chat message (a saveChatMessage write, the deploy notice, or a pushed chat/dm frame through any broadcast op or sendDm) needs chat.message.send in the…
4cc1cbechat.message.deleted: every delete of public-room messages (one message by a moderator or through Live's bridge, a user's / anon's / relay user's history from self-delete or /api/mod, a time-range purge, the auto-delete sweep) adds a…
4dc7b87Docs: STATUS.json and README match production (2026-09-23)
45f2b1f/ready tells the truth: a real chat.db read (required) and the last successful Live sync (optional)
766ee35Credentialed CORS for exact origins only: the *.openvibe.tools suffix rule inherited from Live gave any tools subdomain credentialed access to a signed-in person's DMs and chat, and no tools satellite embeds chat. The list is Live's exact…
f16fe6cnginx: client address headers only from $remote_addr (realip). X-Forwarded-For was appended to and CF-Connecting-IP passed through from the client, so a request reaching the origin without Cloudflare (DNS-only host or the bare IP) chose…
9cdea20Chat protocol security fixes: channel-room bans, room escape, rule bypasses, client address, regex budget
55010a5emotes.media_url and media_asset_id (Live's Media asset sync), added to existing databases on boot
b87ea39openvibe-contracts v0.13.0 (chat capabilities and manifest released); contracts check is blocking
abf1e4bChat service: Live's chat behind a service boundary (roadmap Wave 6)
547e2f9Cutover kit: Live patch (CHAT_AUTHORITY=chat), runbook, capability proposals, ops files
2026-09-21
bfadcf6Charter: OpenVibe.Chat as defined in the OpenVibe realignment plan (placeholder, no code yet)