What shipped on OpenVibe.Games

Every change deployed to OpenVibe, newest first. Each line is a commit from the OpenVibers repositories, linked to the change itself. When enough have gathered, or a large feature lands, they are written up as Patch notes on openvibe.blog. JSON: /api/v1/changelog.

2026-09-24

c318513Prometheus text metrics (Track O): GET /metrics (loopback only) answers the snapshot as games_* gauges in Prometheus text when the scraper asks (Accept text/plain or OpenMetrics, or ?format=prometheus); JSON stays the defaultOpenVibers · 06:53 UTC
f4f3f40dist-types for observability/release (tsc --build)OpenVibers · 06:53 UTC
35a06a0Release manifest and private metrics (Track R D43, Track O): GET /release.json answers the deployed commit (RELEASE_SHA, else read from .git without a child process), openvibe-sdk/contracts versions and components in the shape every…OpenVibers · 06:53 UTC
4e5bc50openvibe-contracts v0.34.3 (was v0.8.0) and openvibe-sdk v0.6.0 (was v0.2.2); CI runs openvibe-contracts-check for the serverOpenVibers · 06:53 UTC
7c4d6bfSECURITY.md: how to report a vulnerability ([email protected], 7-day reply, scope, supported versions)OpenVibers · 06:53 UTC

2026-09-23

84ee13eUnknown paths answer 404 instead of the landing page: a path that was neither a route nor a file of the client build used to get the portal (openvibe.games) or the game (play.openvibe.games) with a 200, a soft 404 that search engines index…OpenVibers · 20:48 UTC
7863fc6CI: run the shared security workflow (gitleaks secret scan + dependency audit, Track Q)OpenVibers · 19:33 UTC
474df50Live legacy import (Wave 12 migration gate): every HoboQuest and canvas table in Live has a recorded decision, and scripts/importLiveLegacy.ts reconciles each one (read = imported + held + excluded). Per-player HoboQuest rows (players…OpenVibers · 18:46 UTC
8aef490Docs: STATUS.json and README match production (2026-09-23)OpenVibers · 18:33 UTC
f11e21cGET /api/ready: 200 only while world.db answers and the simulation ticksOpenVibers · 17:23 UTC
fcf2611CI: typecheck, lint and the vitest suite on Node 22 with a frozen pnpm lockfile (Track Q — Games was the last service without CI)OpenVibers · 17:01 UTC
eea0a10nginx: client address headers only from $remote_addr (realip). X-Forwarded-For was appended to and CF-Connecting-IP passed through from the client, so a request reaching the origin without Cloudflare (DNS-only host or the bare IP) chose…OpenVibers · 16:14 UTC
208f41bDocs: ADR-0006 (canonical subjects, platform boundary), README platform integration (env, grants, mods API), architecture and roadmap notes, platform env in the unit fileOpenVibers · 02:10 UTC
87cf770Games on the platform (Wave 12): players keyed by canonical Network subjects with legacy ovn: adoption and a batch migration; guest tokens can no longer name an account key; the games client-credentials principal for every service call…OpenVibers · 02:10 UTC
9d5997ePersistence schema 12: identity legacy map, mod registry (installs, grants, placements, audit), Media mirror queue, players.subject_id, and store.transaction() so a flush and its outbox events commit togetherOpenVibers · 02:09 UTC

2026-09-18

5710287Home intro: guest versus signed-inOpenVibers · 11:02 UTC
9be6a8ePOST /auth/fedcm on both hosts swaps a FedCM assertion for a session (jwt-bearer grant, nonce pre-check); silent login skips the Network when the ovg_sso cookie already resolvesOpenVibers · 04:28 UTC
d04fcf4SSO: silent sign-in, next-hop chains, ov_sso_hint, /auth/logout and /auth/meOpenVibers · 03:10 UTC
db5d52dShared network chrome on every page, SEO, open-voice verbiageOpenVibers · 03:10 UTC

2026-08-17

a1bedabRun service as ubuntu (matches host layout)OpenVibers · 19:58 UTC
c8c9c25Initial OpenVibe releaseOpenVibers · 19:56 UTC