What shipped on OpenVibe.Network
Every change deployed to OpenVibe, newest first. Each line is a commit from the OpenVibers repositories, linked to the change itself. When enough have gathered, or a large feature lands, they are written up as Patch notes on openvibe.blog. JSON: /api/v1/changelog.
2026-09-24
7571ba7The OpenVibe Frame: server/chrome is server/frame; /api/frame and /api/frame/hit (the /api/chrome names stay as aliases for openvibe-shared older than 1.11.0); chrome_cache/chrome_hits are renamed frame_cache/frame_hits once on boot, rows…
0b3b2e3What shipped, network-wide: /api/v1/changelog proxies OpenVibe.Blog's changelog (60 s cache, stale on failure, public CORS) so every site's shared widget reads it from openvibe.network; /updates renders the whole network's log (server-side…
90cd58eCORS: every first-party domain the service manifests declare is an allowed origin (exact https origins, never a wildcard). openvibe.blog, openvibe.wiki and openvibe.codes were missing from the hard-coded list, so the shared navbar's…
6e794b9Recently shipped across OpenVibe on the home page: openvibe-shared v1.8.0 (served as /shared/shipped.js for every site) renders the network changelog from openvibe.blog, each change linked to its commit and the latest Patch notes post…
fba96a0Blog may run its AI workflows (ai.run.create and ai.run.read in the blog namespace on openvibe.ai) for Draft with AI
cbca807AI may publish its ai.run.* events (events.event.publish on openvibe.events)
dde3374Network issues staff capabilities in user tokens (D05, ADR-022): staff members' access tokens (login and OAuth) carry staff_caps from the contracts staff map, and the owner carries is_owner; people who are not staff carry neither, so their…
1de2e22Your recent tools on my.openvibe.network (the tools.usage module OpenVibe.Tools keeps, named from the public Tools registry, built with DOM nodes); Tools may index its tools in Search (search.document.write on openvibe.search)
cbe77e1Tools grants: live, chat and community hold tools.tool.run and tools.job.read on openvibe.tools, so their Tools run API calls (kiosk page titles, audio conversion, save-as-paste) run on the service tier, never network probes
1837cb8Community may publish its events (events.event.publish on openvibe.events); openvibe-contracts v0.35.0 (community.* payload contracts)
89f0e44Roadmap baseline regenerated from origin/main (2026-09-24): D20 remaining is the consumers' switch and OpenRe session lineage (Media owner_subject done, grants issued); new Live tables (channel_points_log, opencoin_admin_grants…
26c0395SECURITY.md: how to report a vulnerability ([email protected], 7-day reply, scope, supported versions)
1664d04openvibe-contracts v0.34.1 (Tools platform S7): sandbox apps hold tools.tool.read and tools.tool.run by default (the run API is live); the self-service catalog lists public capabilities only (partner ones like tools.net.probe are…
43dd0c5Follow notification links to the follower's channel (openvibe.live/@<username>); it linked to openvibe.network/user/<name>, a page Network never had (a 404 since unknown paths stopped answering the account page)
d063df1Admin settings: the 'prefer the environment variable' hint shows only for provider secrets, not for the VAPID public key (read environment-first too, but not a secret); the settings row says secret: true|false
9e64f60Registry (roadmap W2 D4, §5.1, §5.3): /api/v1/registry/categories and /featured answered 404. categories[/:id] groups every service by what it is, each with its rule, from Network's exposure overlay and site list: site, platform, library…
9a59212openvibe-contracts v0.33.1: tools.tool.read is active (Tools serves GET /api/v1/tools on the gateway and every satellite), so the registry and /status show it as such; tools.tool@1 1.1.0 adds optional keywords and examples. Additive; pins…
80a841cPrincipals: openre, media and community hold live.lineage.resolve for audience openvibe.live (roadmap §10.5/§15.10, D20-R1), so OpenRe, Media and Community's Pulse can ask Live's canonical channel/owner resolver (GET|POST…
829dafaInternal-key retirement (register C-50/C-52): GET /internal/url-registry/resolved, GET /internal/coins/stats, POST /internal/resolve-anon, POST /internal/identity/legacy-map and POST /internal/link-account (the routes principal_usage still…
11e716dsecrets-out-of-db.js --copy-to-env [--apply]: moves each provider secret the database holds and the env file does not set (an empty VAR= counts as unset) into /etc/openvibe/network.env as VAR=value, after keeping the previous file as…
70050bcProvider secrets from the environment first (roadmap §18.2(12)): the Resend API key and webhook secret, the Discord bot token and OAuth client secret, and the VAPID private key were read only from site_settings in plaintext. Each now has a…
1cf0191Refresh tokens (roadmap §18.2(2)): oauth_tokens held each refresh token in clear, and presenting a rotated token again only failed. Now only its SHA-256 is stored; every token belongs to the family of the sign-in that issued it (family_id)…
abee5dcOpenID Connect discovery at the issuer (roadmap §4.1, §15.4): https://openvibe.network/.well-known/openid-configuration answered with the account page; discovery lived only at /oauth/.well-known/openid-configuration. The document is now…
f87b514Unknown paths answer 404 (roadmap §2.5, D44): the apex sent the account hub (my.html) with 200 for any path, so openvibe.network/<anything> looked like a page. Every real page keeps its own route; the account hub answers only at its own…
2026-09-23
c3b7cf3Principals: media holds identity.subject.resolve (openvibe.network), so Media can record each object's owner as a canonical subject. Its owner_subject backfill and reconcile job resolve the Live user ids Media is given (X-OV-User-Id)…
34e7678Chrome page-view beacon: POST /api/chrome/hit answers Cross-Origin-Resource-Policy: cross-origin. navigator.sendBeacon is a no-cors request, and helmet's same-origin policy made every page of every site log the (empty) answer as blocked…
f76130dopenvibe-shared v1.5.1, openvibe-contracts v0.33.0
7991a59Registry: the libraries' current release (sdk, shared, contracts) is the version Network installs, read from each package.json, instead of hand-written numbers that were three releases stale (v0.4.0 / v1.3.0 / v0.30.1). /status labels and…
ca59964CORS: a refused origin gets a 403 JSON answer (code cors.origin_denied) instead of Express's default 500 with a stack trace on every request, and is logged once an hour per origin (a local test page on a random 127.0.0.1 port produced ~800…
0b75683openvibe-shared v1.5.0 (Track R release manifest), openvibe-contracts v0.32.0, openvibe-sdk v0.5.0
e99a80fRoadmap baseline: D20 canonical resolver is partial, no longer not met (lineage contract in openvibe-contracts v0.32.0, resolver deployed in Live 2026-09-23 21:36 UTC, display-name test, production 401 check); remaining: consumers' grants…
09bf748Chat may manage its own OpenVibe.Events subscriptions: default grant chat events.subscription.manage on openvibe.events (seeded at boot like the others). Chat subscribes to live.release.deployed (the deploy card; register C-84, so the Live…
951e7b1Go-live links open the channel: notifications (Live's direct call and the live.stream.started consumer) and the Discord go-live post linked to https://openvibe.live/<username>, which is not a page on Live (it showed the home page).…
ea29f8eUser modules (roadmap Wave 1 item 24): every change emits network.module.updated, account removal and merge handle module rows, onOwnerRemoved is enforced, and chat.preferences belongs to Chat. Events: server/identity/module-events.js…
b3c3e28Wave 0 baseline regenerated with the 18 services added since 2026-09-22, route and job ownership, and the D01-D46 requirement ledger (roadmap §22.4/§25). The generator now scans Events, Chat, OpenRe, Billing, Tips, VIP, AI, Search…
9bbd90fAnalytics comes from openvibe-shared/analytics (v1.4.0; retires C-80): server/analytics/ keeps only network.js, the service specifics (SERVICE, PARAM_PREFIXES, PATH_RULES, and PATH_OPTS = { paramPrefixes, pathRules }); openAnalytics keeps…
dcc6b5fRegistry exposure: search.openvibe.network serves Search (public page and query API); sources.openvibe.network says it is internal
50552b6VIP grants: chat vip.entitlement.check (subscriber badge), community and blog vip.resource.policy.evaluate (members-only content), live vip.entitlement.check
2a95548Go-live notifications from Events: POST /internal/events consumes live.stream.started (source live) and notifies every follower of payload.channel.subject once (STREAM_LIVE, category stream, so the person's mute and email choice apply)…
5ad26ecRegistry completeness: /api/v1/registry/topics lists every event type from the manifests' eventsProduced/eventsConsumed and the v0.30 payload contracts (producers, consumers with the Events-syntax pattern that matched, payload contract…
53f24b7CI: run the shared security workflow (gitleaks secret scan + dependency audit, Track Q)
692c775openvibe-contracts v0.28.0 -> v0.30.1: realtime is the only placeholder manifest left (AI, SDK, Shared and Examples are alpha), so the exposure overlay's comment says how each exists instead of correcting a placeholder label, the contracts…
8e34f77News grants: community.comment.write/moderate (story discussion threads) and ai.run.create/read limited to news.* (story summaries)
1633b6aGrant live chat.message.send on openvibe.chat: OpenVibe.Chat now requires it to send chat lines (AI viewers, relays, donations, deploy notices) through the bridge
07cd98cNotifications from Events: POST /internal/events turns deals.watch.matched (payload.recipient) and trade.alert.triggered (subject user) into inbox notifications (DEAL_WATCH_MATCH / TRADE_ALERT, category service, so the person's mute and…
31b234aFooter copy comes from OpenVibe.AI only: drop the fallback to Live's /internal/ai/site-copy. When AI is unreachable or answers badly the last good copy stays (chrome_cache, across restarts), or the hand-written copy when there has never…
29cdb09Registry, status and chrome say where each service really answers: an exposure overlay (server/registry/exposure.js) gives every manifest one state — live (public), internal (loopback only, no public site yet), library (released)…
6a1acd3Network no longer opens Live's database at boot (ADR-007, register C-58)
988330bLive's ai.run.* grants name their namespaces (live.*, network.site_copy) now that OpenVibe.AI fails closed on a token with no ns; default grants that gain namespaces fill them into rows still seeded empty
3ffd73aAnalytics within ADR-021: no IP, user id or city in raw events; route templates, referer origins and user-agent classes; rotating session ids; raw events pruned after 30 days (nightly job, bounded batches), rollups kept