What shipped on OpenVibe.Events
Every change deployed to OpenVibe, newest first. Each line is a commit from the OpenVibers repositories, linked to the change itself. When enough have gathered, or a large feature lands, they are written up as Patch notes on openvibe.blog. JSON: /api/v1/changelog.
2026-09-24
3879798App-endpoint guard on openvibe-shared 1.6.0: the public-address rule and internal-name list come from openvibe-shared/egress (shared with Live and Tools; adds *.home.arpa); endpoint syntax rules and the connect-time guarded POST stay here
9f51514rotate-subscription-secret: --consumer rotates every first-party subscription of a service to one new secret (they share one env variable)
82a49f3Subscription secret rotation: POST /api/v1/subscriptions/:id/rotate-secret (the consumer's own subscription; overlap_s default 1 day, max 7) and scripts/rotate-subscription-secret.js for operators (writes the new secret into the consumer's…
74b00d6SECURITY.md: how to report a vulnerability ([email protected], 7-day reply, scope, supported versions)
2026-09-23
d71f6fdopenvibe-shared v1.5.1, openvibe-contracts v0.33.0
039e203openvibe-shared v1.5.0 (Track R release manifest), openvibe-contracts v0.32.0
efc09a7CI: run the shared security workflow (gitleaks secret scan + dependency audit, Track Q)
3366132redact-backfill --include-missing: also redact events about messages Chat no longer has at all (hard-deleted by hand or by its expiry sweep); production had one
18b873fRedaction: a producer takes back its own events. Any event may carry payload.redacts ({ event_ids } and/or { subject_type, subject_ids }, up to 1000 each); in the transaction that stores it, every target of the same source (an app: same…
b251739Docs: STATUS.json and README match production (2026-09-23)
e8ac63eReplay window for webhook deliveries (signature v2): every attempt also carries X-OpenVibe-Timestamp (unix seconds, fresh per retry and replay) and X-OpenVibe-Signature-V2: t=<ts>,v2=<HMAC-SHA256 of "<ts>.<raw body>">; X-OpenVibe-Signature…
5def126docs/replay-window-rollout.md: deploy order for signature v2 (SDK tag, Events, then consumers one by one with requireV2), the consumer inventory, and the exact change each consumer needs (Live, Search, News, Deals, Trade, Reviews, Tips…
b47b99dnginx: client address headers only from $remote_addr (realip). X-Forwarded-For was appended to and CF-Connecting-IP passed through from the client, so a request reaching the origin without Cloudflare (DNS-only host or the bare IP) chose…
cfbd21cDeveloper apps cannot disrupt first-party event flow
06af758Developer apps (Wave 20, ADR-014): events.app.publish|read|subscribe with app tokens on the existing routes — app.<project_key>.* types only (project_key = p + lowercased project ULID, source app-<lowercased app ULID>), reads scoped to the…
0c7f9c5Observability (Track O): GET /metrics (loopback only) with HTTP golden signals by route template, process metrics, release_info and Events gauges (deliveries by status, DLQ depth, latest seq, SSE connections, delivery latency, attempts by…
f5df827Allowed sources: sources, search and the publication products (wiki, blog, news, reviews, deals, coupons, trade)
fade422nginx: use the openvibe.network wildcard certificate (the host has no per-name certificate)
5082c38Capability ids with three segments (events.event.publish, events.event.read, events.subscription.manage, events.delivery.admin); openvibe-contracts v0.6.0; contract check in CI
f8c2e24Events service: durable store, publish API, signed delivery with retry/DLQ/replay, SSE realtime gateway, client library
43103e7Propose the events.publish/subscribe/read/admin capability manifests and the events service manifest for openvibe-contracts
a5fda92Ops and docs: .env.example, systemd unit, nginx vhost for SSE, CI on Node 22.22.1, README usage, STATUS alpha W3
2026-09-21
9c89644Charter: OpenVibe.Events as defined in the OpenVibe realignment plan (placeholder, no code yet)