What shipped on OpenVibe.Codes
Every change deployed to OpenVibe, newest first. Each line is a commit from the OpenVibers repositories, linked to the change itself. When enough have gathered, or a large feature lands, they are written up as Patch notes on openvibe.blog. JSON: /api/v1/changelog.
2026-09-24
df5e0a4The shared update system and one account UI, on the OpenVibe Frame (openvibe-shared 1.11.0, openvibe/frame): the home shows what shipped, /updates is the shared log and the footer links it; the shared navbar handles sign in and out…
e82321bCI calls the shared test workflow (Track Q): OpenVibe.Shared test.yml@e8b0caf (install, node --check, npm test, openvibe-contracts-check; ffmpeg where the tests need it) instead of a copy of those steps
69fc5b1Docs: /docs/tools lists every OpenVibe tool with an API from Tools' live registry (loopback, cached 5 min; how it runs, who may call it, JSON or files), with the run API, jobs, OpenAPI and SDK; linked from /docs and the sitemap
a129415Docs: /docs/events links each event's payload contract (117 published) and marks the rest planned, instead of saying payload schemas do not exist; openvibe-contracts v0.34.2; the per-address rate limit is CODES_RATE_LIMIT_PER_MIN (default…
587fb3fSECURITY.md: how to report a vulnerability ([email protected], 7-day reply, scope, supported versions)
2026-09-23
241cce3openvibe-shared v1.5.1, openvibe-contracts v0.33.0
e5a6280openvibe-shared v1.5.0 (Track R release manifest), openvibe-contracts v0.32.0, openvibe-sdk v0.5.0
51d2386CI: run the shared security workflow (gitleaks secret scan + dependency audit, Track Q)
d60f279Governance drafts: code of conduct, contributing, contributor ladder, moderation policy
584012aProject export and delete, over Network's /api/v1/projects
b0381daWebhook tester verifies signature v2 (register C-61); openvibe-sdk v0.4.0
415faa0Docs: STATUS.json and README match production (2026-09-23)
a9371c3Webhook tester docs: Events deliveries also carry X-OpenVibe-Timestamp and X-OpenVibe-Signature-V2 (t=<ts>,v2=<HMAC of "<t>.<raw body>">); refuse v2 outside ±300 s, never fall back to v1 when v2 is present, parseDelivery(..., { requireV2…
3160659Sign-out only from this site: a cross-site GET /auth/logout shows a confirm button instead of ending the session; POST /auth/logout needs a same-origin request
0da020fnginx: client address headers only from $remote_addr (realip). X-Forwarded-For was appended to and CF-Connecting-IP passed through from the client, so a request reaching the origin without Cloudflare (DNS-only host or the bare IP) chose…
76b1234Session cookie accepts only Network session tokens (audience openvibe.network, not FedCM/app tokens)
04df705openvibe-sdk v0.3.1; the SDK reference parser skips comments inside declarations (a quote in a doc comment swallowed later declarations)
cd402ddTests follow the v0.28.0 pin
1f13801openvibe-contracts v0.28.0 (same content as v0.27.0, correctly versioned)
16a2c4aopenvibe-contracts tag v0.27.0 (codes manifest, codes.release.manage|read, codes.app-manifest@1 released): app manifests validate with the released contract (compiled-in proposal and the proposals dropped), release API guarded with…
0deb3d7OpenVibe.Codes service (Wave 20): SSR developer portal over Network's projects API (PKCE S256 sign-in, httpOnly session; projects, members, apps, secrets shown once and never stored, credential rotate/revoke, grant scope editor offering…
958890dREADME (purpose, owns, does not own, depends on, grants, deploy, acceptance, launch rule, threat notes), STATUS alpha W20, .env.example, deploy (systemd unit, nginx vhost on 4900), CI on Node 22.22.1 (contracts check continue-on-error…
2026-09-21
af688e0Charter: OpenVibe.Codes as defined in the OpenVibe realignment plan (placeholder, no code yet)