What shipped on OpenVibe.Network

Every change deployed to OpenVibe, newest first. Each line is a commit from the OpenVibers repositories, linked to the change itself. When enough have gathered, or a large feature lands, they are written up as Patch notes on openvibe.blog. JSON: /api/v1/changelog.

2026-09-24

7571ba7The OpenVibe Frame: server/chrome is server/frame; /api/frame and /api/frame/hit (the /api/chrome names stay as aliases for openvibe-shared older than 1.11.0); chrome_cache/chrome_hits are renamed frame_cache/frame_hits once on boot, rows…OpenVibers · 07:47 UTC
0b3b2e3What shipped, network-wide: /api/v1/changelog proxies OpenVibe.Blog's changelog (60 s cache, stale on failure, public CORS) so every site's shared widget reads it from openvibe.network; /updates renders the whole network's log (server-side…OpenVibers · 07:26 UTC
90cd58eCORS: every first-party domain the service manifests declare is an allowed origin (exact https origins, never a wildcard). openvibe.blog, openvibe.wiki and openvibe.codes were missing from the hard-coded list, so the shared navbar's…OpenVibers · 07:21 UTC
6e794b9Recently shipped across OpenVibe on the home page: openvibe-shared v1.8.0 (served as /shared/shipped.js for every site) renders the network changelog from openvibe.blog, each change linked to its commit and the latest Patch notes post…OpenVibers · 06:47 UTC
fba96a0Blog may run its AI workflows (ai.run.create and ai.run.read in the blog namespace on openvibe.ai) for Draft with AIOpenVibers · 06:47 UTC
cbca807AI may publish its ai.run.* events (events.event.publish on openvibe.events)OpenVibers · 06:47 UTC
dde3374Network issues staff capabilities in user tokens (D05, ADR-022): staff members' access tokens (login and OAuth) carry staff_caps from the contracts staff map, and the owner carries is_owner; people who are not staff carry neither, so their…OpenVibers · 06:47 UTC
1de2e22Your recent tools on my.openvibe.network (the tools.usage module OpenVibe.Tools keeps, named from the public Tools registry, built with DOM nodes); Tools may index its tools in Search (search.document.write on openvibe.search)OpenVibers · 06:47 UTC
cbe77e1Tools grants: live, chat and community hold tools.tool.run and tools.job.read on openvibe.tools, so their Tools run API calls (kiosk page titles, audio conversion, save-as-paste) run on the service tier, never network probesOpenVibers · 06:47 UTC
1837cb8Community may publish its events (events.event.publish on openvibe.events); openvibe-contracts v0.35.0 (community.* payload contracts)OpenVibers · 06:47 UTC
89f0e44Roadmap baseline regenerated from origin/main (2026-09-24): D20 remaining is the consumers' switch and OpenRe session lineage (Media owner_subject done, grants issued); new Live tables (channel_points_log, opencoin_admin_grants…OpenVibers · 06:47 UTC
26c0395SECURITY.md: how to report a vulnerability ([email protected], 7-day reply, scope, supported versions)OpenVibers · 06:47 UTC
1664d04openvibe-contracts v0.34.1 (Tools platform S7): sandbox apps hold tools.tool.read and tools.tool.run by default (the run API is live); the self-service catalog lists public capabilities only (partner ones like tools.net.probe are…OpenVibers · 06:47 UTC
43dd0c5Follow notification links to the follower's channel (openvibe.live/@<username>); it linked to openvibe.network/user/<name>, a page Network never had (a 404 since unknown paths stopped answering the account page)OpenVibers · 06:47 UTC
d063df1Admin settings: the 'prefer the environment variable' hint shows only for provider secrets, not for the VAPID public key (read environment-first too, but not a secret); the settings row says secret: true|falseOpenVibers · 06:47 UTC
9e64f60Registry (roadmap W2 D4, §5.1, §5.3): /api/v1/registry/categories and /featured answered 404. categories[/:id] groups every service by what it is, each with its rule, from Network's exposure overlay and site list: site, platform, library…OpenVibers · 06:47 UTC
9a59212openvibe-contracts v0.33.1: tools.tool.read is active (Tools serves GET /api/v1/tools on the gateway and every satellite), so the registry and /status show it as such; tools.tool@1 1.1.0 adds optional keywords and examples. Additive; pins…OpenVibers · 06:47 UTC
80a841cPrincipals: openre, media and community hold live.lineage.resolve for audience openvibe.live (roadmap §10.5/§15.10, D20-R1), so OpenRe, Media and Community's Pulse can ask Live's canonical channel/owner resolver (GET|POST…OpenVibers · 06:47 UTC
829dafaInternal-key retirement (register C-50/C-52): GET /internal/url-registry/resolved, GET /internal/coins/stats, POST /internal/resolve-anon, POST /internal/identity/legacy-map and POST /internal/link-account (the routes principal_usage still…OpenVibers · 06:47 UTC
11e716dsecrets-out-of-db.js --copy-to-env [--apply]: moves each provider secret the database holds and the env file does not set (an empty VAR= counts as unset) into /etc/openvibe/network.env as VAR=value, after keeping the previous file as…OpenVibers · 06:47 UTC
70050bcProvider secrets from the environment first (roadmap §18.2(12)): the Resend API key and webhook secret, the Discord bot token and OAuth client secret, and the VAPID private key were read only from site_settings in plaintext. Each now has a…OpenVibers · 06:47 UTC
1cf0191Refresh tokens (roadmap §18.2(2)): oauth_tokens held each refresh token in clear, and presenting a rotated token again only failed. Now only its SHA-256 is stored; every token belongs to the family of the sign-in that issued it (family_id)…OpenVibers · 06:47 UTC
abee5dcOpenID Connect discovery at the issuer (roadmap §4.1, §15.4): https://openvibe.network/.well-known/openid-configuration answered with the account page; discovery lived only at /oauth/.well-known/openid-configuration. The document is now…OpenVibers · 06:47 UTC
f87b514Unknown paths answer 404 (roadmap §2.5, D44): the apex sent the account hub (my.html) with 200 for any path, so openvibe.network/<anything> looked like a page. Every real page keeps its own route; the account hub answers only at its own…OpenVibers · 06:47 UTC

2026-09-23

c3b7cf3Principals: media holds identity.subject.resolve (openvibe.network), so Media can record each object's owner as a canonical subject. Its owner_subject backfill and reconcile job resolve the Live user ids Media is given (X-OV-User-Id)…OpenVibers · 23:39 UTC
34e7678Chrome page-view beacon: POST /api/chrome/hit answers Cross-Origin-Resource-Policy: cross-origin. navigator.sendBeacon is a no-cors request, and helmet's same-origin policy made every page of every site log the (empty) answer as blocked…OpenVibers · 23:33 UTC
f76130dopenvibe-shared v1.5.1, openvibe-contracts v0.33.0OpenVibers · 23:18 UTC
7991a59Registry: the libraries' current release (sdk, shared, contracts) is the version Network installs, read from each package.json, instead of hand-written numbers that were three releases stale (v0.4.0 / v1.3.0 / v0.30.1). /status labels and…OpenVibers · 22:46 UTC
ca59964CORS: a refused origin gets a 403 JSON answer (code cors.origin_denied) instead of Express's default 500 with a stack trace on every request, and is logged once an hour per origin (a local test page on a random 127.0.0.1 port produced ~800…OpenVibers · 22:42 UTC
0b75683openvibe-shared v1.5.0 (Track R release manifest), openvibe-contracts v0.32.0, openvibe-sdk v0.5.0OpenVibers · 22:04 UTC
e99a80fRoadmap baseline: D20 canonical resolver is partial, no longer not met (lineage contract in openvibe-contracts v0.32.0, resolver deployed in Live 2026-09-23 21:36 UTC, display-name test, production 401 check); remaining: consumers' grants…OpenVibers · 21:43 UTC
09bf748Chat may manage its own OpenVibe.Events subscriptions: default grant chat events.subscription.manage on openvibe.events (seeded at boot like the others). Chat subscribes to live.release.deployed (the deploy card; register C-84, so the Live…OpenVibers · 21:33 UTC
951e7b1Go-live links open the channel: notifications (Live's direct call and the live.stream.started consumer) and the Discord go-live post linked to https://openvibe.live/<username>, which is not a page on Live (it showed the home page).…OpenVibers · 21:21 UTC
ea29f8eUser modules (roadmap Wave 1 item 24): every change emits network.module.updated, account removal and merge handle module rows, onOwnerRemoved is enforced, and chat.preferences belongs to Chat. Events: server/identity/module-events.js…OpenVibers · 20:53 UTC
b3c3e28Wave 0 baseline regenerated with the 18 services added since 2026-09-22, route and job ownership, and the D01-D46 requirement ledger (roadmap §22.4/§25). The generator now scans Events, Chat, OpenRe, Billing, Tips, VIP, AI, Search…OpenVibers · 20:35 UTC
9bbd90fAnalytics comes from openvibe-shared/analytics (v1.4.0; retires C-80): server/analytics/ keeps only network.js, the service specifics (SERVICE, PARAM_PREFIXES, PATH_RULES, and PATH_OPTS = { paramPrefixes, pathRules }); openAnalytics keeps…OpenVibers · 20:18 UTC
dcc6b5fRegistry exposure: search.openvibe.network serves Search (public page and query API); sources.openvibe.network says it is internalOpenVibers · 20:00 UTC
50552b6VIP grants: chat vip.entitlement.check (subscriber badge), community and blog vip.resource.policy.evaluate (members-only content), live vip.entitlement.checkOpenVibers · 19:43 UTC
2a95548Go-live notifications from Events: POST /internal/events consumes live.stream.started (source live) and notifies every follower of payload.channel.subject once (STREAM_LIVE, category stream, so the person's mute and email choice apply)…OpenVibers · 19:40 UTC
5ad26ecRegistry completeness: /api/v1/registry/topics lists every event type from the manifests' eventsProduced/eventsConsumed and the v0.30 payload contracts (producers, consumers with the Events-syntax pattern that matched, payload contract…OpenVibers · 19:35 UTC
53f24b7CI: run the shared security workflow (gitleaks secret scan + dependency audit, Track Q)OpenVibers · 19:33 UTC
692c775openvibe-contracts v0.28.0 -> v0.30.1: realtime is the only placeholder manifest left (AI, SDK, Shared and Examples are alpha), so the exposure overlay's comment says how each exists instead of correcting a placeholder label, the contracts…OpenVibers · 19:28 UTC
8e34f77News grants: community.comment.write/moderate (story discussion threads) and ai.run.create/read limited to news.* (story summaries)OpenVibers · 19:20 UTC
1633b6aGrant live chat.message.send on openvibe.chat: OpenVibe.Chat now requires it to send chat lines (AI viewers, relays, donations, deploy notices) through the bridgeOpenVibers · 19:11 UTC
07cd98cNotifications from Events: POST /internal/events turns deals.watch.matched (payload.recipient) and trade.alert.triggered (subject user) into inbox notifications (DEAL_WATCH_MATCH / TRADE_ALERT, category service, so the person's mute and…OpenVibers · 18:36 UTC
31b234aFooter copy comes from OpenVibe.AI only: drop the fallback to Live's /internal/ai/site-copy. When AI is unreachable or answers badly the last good copy stays (chrome_cache, across restarts), or the hand-written copy when there has never…OpenVibers · 18:30 UTC
29cdb09Registry, status and chrome say where each service really answers: an exposure overlay (server/registry/exposure.js) gives every manifest one state — live (public), internal (loopback only, no public site yet), library (released)…OpenVibers · 18:29 UTC
6a1acd3Network no longer opens Live's database at boot (ADR-007, register C-58)OpenVibers · 17:16 UTC
988330bLive's ai.run.* grants name their namespaces (live.*, network.site_copy) now that OpenVibe.AI fails closed on a token with no ns; default grants that gain namespaces fill them into rows still seeded emptyOpenVibers · 16:58 UTC
3ffd73aAnalytics within ADR-021: no IP, user id or city in raw events; route templates, referer origins and user-agent classes; rotating session ids; raw events pruned after 30 days (nightly job, bounded batches), rollups keptOpenVibers · 16:33 UTC