{"id":"pst_01M39313D833G8QVPQ9FGEEF5E","url":"https://openvibe.blog/@openvibe/patch-notes-120-changes-across-18-sites","blog":{"id":"blg_01M362MF0EDJ7QHQTRD8A3Q981","handle":"openvibe","title":"The OpenVibe blog","url":"https://openvibe.blog/"},"title":"Patch notes: 120 changes across 18 sites","summary":"What shipped on OpenVibe on 2026-09-24: 120 changes to OpenVibe.Live, OpenVibe.Tools, OpenVibe.Media, OpenVibe.Chat, OpenVibe.Community, OpenRe.Stream and 12 more.","body_markdown":"What shipped on OpenVibe on 2026-09-24: 120 changes to OpenVibe.Live, OpenVibe.Tools, OpenVibe.Media, OpenVibe.Chat, OpenVibe.Community, OpenRe.Stream and 12 more. Every line below is a commit message from the OpenVibers repositories, linked to the change itself.\n\n## OpenVibe.Live\n\n[openvibe.live](https://openvibe.live) · [repository](https://github.com/OpenVibers/OpenVibe.Live)\n\n- Channel links carry the @ everywhere: Live's own go-live push (golive-notify.js) and the AI 'caught live' pastes (stream-memory-job.js) still built https://openvibe.live/<username>, which is a 404 by rule. test/channel-links.test.js scans… ([`4585f61`](https://github.com/OpenVibers/OpenVibe.Live/commit/4585f613a4e745e7fc7c0d35de95ee1c110290a3))\n- Restream control is slot-only: a stream on a slot auto-starts and resumes only that slot's destinations, and a legacy stream with no slot only the owner's unbound ones. _getDestinationsForStream merged every destination the account owned… ([`d378f4f`](https://github.com/OpenVibers/OpenVibe.Live/commit/d378f4f6ee51301b4781fdf6b9a9a4dd0bfdd9ab))\n- AI Moments pages are labelled, credited to no person and kept out of search (roadmap 33.4/33.8): an auto-clip (Media auto_generated), an AI moment paste (Community origin ai) and an AI-written recap render noindex,follow with the canonical… ([`30b1234`](https://github.com/OpenVibers/OpenVibe.Live/commit/30b1234ece0d9aa94d3e903ee5db0c2ac7f4814a))\n- AI clips are never filed as something a person made (roadmap 33.4/33.6/33.7). The auto-clip job cuts in the streamer's name, so every 'clips by user X' list showed the AI's clips as the streamer's own: the clip page now says 'AI clip ·… ([`95a21d8`](https://github.com/OpenVibers/OpenVibe.Live/commit/95a21d824d4a6c2063507a97caf21726a1960715))\n- scripts/rs-integrations-to-slots.js: bind account-level RobotStreamer rows to stream slots, for the lead to run on production before Live stops reading them (5 of 8 rows have no slot). Dry run by default. A row goes to the user's only… ([`3d990d2`](https://github.com/OpenVibers/OpenVibe.Live/commit/3d990d2af3ff3fbd1816cd05760e9954af128037))\n- RobotStreamer is per stream slot only: a stream uses its slot's robotstreamer_integrations row and nothing else. getRobotStreamerIntegrationForStream no longer falls back to the account-level row (which sent every slot without its own row… ([`155f68e`](https://github.com/OpenVibers/OpenVibe.Live/commit/155f68efd0e5e57a0c6a06a7377ff3a45b23cc72))\n- One canonical page per paste (roadmap 32.2): the PASTES_ON_COMMUNITY /p/<slug> handover moves to server/web/paste-handover.js and is mounted before the SEO middleware, so crawlers and browsers get the same 301 to openvibe.community (302… ([`57a83a2`](https://github.com/OpenVibers/OpenVibe.Live/commit/57a83a275715faa4b8bf38a940ff8fdd9c0ea1f3))\n- Go Live needs an account, and a guest is told so: anonymous /broadcast shows a sign-in gate (Sign in with OpenVibe, back to /broadcast) in place of the slot workspace, and loadBroadcastPage returns before any slot, restream or… ([`ae48428`](https://github.com/OpenVibers/OpenVibe.Live/commit/ae4842882fedbf71c455974eaa9fde495812c77e))\n- Server-rendered channel, VOD and clip pages for every client (roadmap 32.1/32.2): the SEO middleware no longer depends on the Accept header (a crawler or tool sending */* or none got the home page's title and canonical for /@finditfixit)… ([`517fbcc`](https://github.com/OpenVibers/OpenVibe.Live/commit/517fbcc219ccab160c214e465399ac96c231d8d1))\n- /llms.txt for Live (roadmap 32.4/32.5, 33.8): plain text (llmstxt.org shape) saying what OpenVibe.Live is, its public pages and the JSON behind them (/content and /api/content/feed, /moments and /api/content/moments, /@user?page=N… ([`faf49f8`](https://github.com/OpenVibers/OpenVibe.Live/commit/faf49f8f87714350a216c0d07f543173c0b49418))\n- Loyalty ledgers use deterministic per-event idempotency keys (ADR-012 rule 5). Media requests: a paid request is written first (status failed, charge_state 'charging', out of the queue and history) and its charge is keyed by its id… ([`9138300`](https://github.com/OpenVibers/OpenVibe.Live/commit/913830038e5825c92ed87322ceda0369afddde99))\n- Tips deliveries stay idempotent across a Live restart: the in-memory done Map in server/tips/delivery-routes.js is now the tips_deliveries table, keyed by Idempotency-Key with the stored answer. A key is claimed before its effect runs; a… ([`4ebc638`](https://github.com/OpenVibers/OpenVibe.Live/commit/4ebc638af13cdaa0078ad08e19dd95991fdfb208))\n- Internal-key routes share one trust rule (server/net/internal-key.js): loopback only and INTERNAL_API_KEY compared in constant time. POST /api/cosmetics/internal-unlock checked only the key, so anyone holding the key shared by Network… ([`912b87c`](https://github.com/OpenVibers/OpenVibe.Live/commit/912b87c57b25e13d8ac7b53d8c0e235a2e526809))\n- A streamer can turn AI Moments off for their channel (roadmap 33.7/33.10): channels.ai_derivation_enabled (on by default, idempotent ADD COLUMN; db.isAiDerivationEnabled, true for an account with no channel row), set through PUT… ([`2a7a0ae`](https://github.com/OpenVibers/OpenVibe.Live/commit/2a7a0ae51621b716b8418185e18e0d4b74bf08c5))\n- Vibe-coding publication needs the narrow vibe_coding_publish scope: /ws/vibe-coding/publish (publish-server.js) and the /api/vibe-coding writes (auth.js token scope table) no longer accept the broad stream scope, which let any… ([`897f356`](https://github.com/OpenVibers/OpenVibe.Live/commit/897f3561d812f16909d7cc5e4f971edcc5350ebc))\n- The home page leads with live content and creators (roadmap 32.7, critique 1): the creator rows (Recently Online, Recent VODs, Recent Clips, Recent Pastes) move from under the site's introduction to above it, after the digest, star and… ([`74616a7`](https://github.com/OpenVibers/OpenVibe.Live/commit/74616a76e9480a511ba8c4057266665ccb52fa3e))\n- No 'free' or $0 in Live's home metadata (owner copy rule; audit 32.2 row 2779): the server-rendered home title, description, heading and Organization description say open-source and community run instead, and the shell's… ([`b6d1c9b`](https://github.com/OpenVibers/OpenVibe.Live/commit/b6d1c9b6bcc57561f61e359d19062456d28d5879))\n- Legacy HoboQuest remnants are read-only in Live: viewing a chat profile no longer creates a game_players row. The profile card (GET /api/chat/user/:username/profile, and /internal/chat-context/users/profile that OpenVibe.Chat reads) called… ([`ee70c40`](https://github.com/OpenVibers/OpenVibe.Live/commit/ee70c40e62fcff5b5f9bef85793aeb0cdf66cb17))\n- Service tokens to Network on link-account, identity legacy-map and resolve-batch (daily identity sync), coins/stats and resolve-anon, which Network guards by capability since 2026-09-24; a refused token falls back to the internal key once… ([`680d383`](https://github.com/OpenVibers/OpenVibe.Live/commit/680d38325a0aa55151b0d0d8d625b4f8ab2ebf10))\n- Follow-ups from running the pages in a browser: the sitemap names channel pages from Live's accounts (Media VOD and clip rows carry user ids, not usernames, so /@user pages were never listed; banned accounts stay out); the channel page… ([`66a2b1b`](https://github.com/OpenVibers/OpenVibe.Live/commit/66a2b1b30fb4a733719676b7ccc3471abd4bacdd))\n- Browser smoke: the guest /broadcast gate check ignores session plumbing (a guest's POST /api/auth/refresh) and analytics beacons when it looks for writes; only the page acting counts. Full smoke (signed in with a local token, and as a… ([`411fa85`](https://github.com/OpenVibers/OpenVibe.Live/commit/411fa858c269b040031a4f356fe51a61e2d3b7b9))\n- Media requests paid in Vibes on Billing: when Billing never answers (an 'unknown' outcome) the request row is kept out of the queue with charge_state 'unknown' instead of being deleted, so the billing action keyed… ([`1240dea`](https://github.com/OpenVibers/OpenVibe.Live/commit/1240dea5664124b405cc75d3d8fc2ff78c4f6caa))\n- Merge L2: restream and RobotStreamer slot-only, anonymous Go Live gate, deterministic loyalty keys, persisted Tips delivery idempotency, internal-key hardening, narrow vibe-coding scope, HoboQuest remnants removed ([`b91058f`](https://github.com/OpenVibers/OpenVibe.Live/commit/b91058fe4bf03031299fba4bfc25e177ab01ec63))\n- docs/dashboard.md: the AI Moments sub-tab, what My Clips holds, and the channel's 'AI Moments from my streams' switch (what it stops, what stays) and the 'inferred' category marker. ([`9721fea`](https://github.com/OpenVibers/OpenVibe.Live/commit/9721fea47eb6b175f97d1bae9ab5a330175ef9a9))\n- Merge L1: AI Moments noindex + canonical to the source VOD, AI attribution in the UI, paste canonical handover, server-rendered channel/VOD/clip pages, llms.txt, per-channel AI derivation opt-out, creators above the about block ([`25c1279`](https://github.com/OpenVibers/OpenVibe.Live/commit/25c12797fc2a669c93e6e5ed8e2cbb3492a72abd))\n- Staff scope on streams: an admin may moderate another streamer's slot or stream (edit, end, delete, read status) but never the site owner's, and nobody acts as another streamer: regenerating a stream key, the ingest endpoint, going live on… ([`80f4221`](https://github.com/OpenVibers/OpenVibe.Live/commit/80f42213f3b0e654ec7105de6157e3411fdf7160))\n- SECURITY.md: how to report a vulnerability (contact@openvibe.network, 7-day reply, scope, supported versions) ([`12c1c11`](https://github.com/OpenVibers/OpenVibe.Live/commit/12c1c11920027b5c511a2916bbe63aae699596e7))\n- Kiosk omnibar titles through OpenVibe.Tools (platform S9): /api/kiosk/site asks the opengraph tool's run API with Live's service token (tools.tool.run on openvibe.tools; anonymous tier without one) and decodes entities in the title; Live… ([`cf72bd9`](https://github.com/OpenVibers/OpenVibe.Live/commit/cf72bd94d507b9f4fa3fb7260cf436c015cdd767))\n- Egress on openvibe-shared 1.6.0: the address policy and connect-time lookup come from openvibe-shared/egress (the rule Events and Tools use; now also refuses 3fff::/20, 5f00::/16, NAT64 64:ff9b:1::/48 and internal names at lookup), Live… ([`b360288`](https://github.com/OpenVibers/OpenVibe.Live/commit/b36028851e472d538260ecdda630c6809665a5cd))\n- Staff gates ask the contracts staff map (D05, ADR-022): permissions.can(user, 'staff.<area>.<action>') and requireCap() over openvibe-contracts v0.35.0 (staff-roles.json; issued staff_caps claims win when Network sends them). Every actor… ([`ff7c541`](https://github.com/OpenVibers/OpenVibe.Live/commit/ff7c5418e6e2f8502e7804b7fc6a245fd15fac8c))\n- Home cards say when the AI inferred a category (roadmap 33.4): live stream cards, featured cards and the Star card show 'Gaming · inferred' with a tooltip when the category is the stream's or channel's ai_category, as the channel and… ([`03e3814`](https://github.com/OpenVibers/OpenVibe.Live/commit/03e38148376f515b93877839759837bcbe94eb02))\n\n## OpenVibe.Tools\n\n[openvibe.tools](https://openvibe.tools) · [repository](https://github.com/OpenVibers/OpenVibe.Tools)\n\n- Tools guard (apps/_shared/guard), used by the gateway and every satellite and driven by the tool descriptors: one caller resolver replaces the four copied auth.js files and the job routes' owner logic (service/app principals by token, aud… ([`6818bcc`](https://github.com/OpenVibers/OpenVibe.Tools/commit/6818bcc73a1949523fa5f4d88d5a7143f9b9e7b9))\n- Guard deploy and docs: systemd resource bounds (MemoryMax 2G img/audio/docs, 1G yt, 768M gateway/text/maps/food; TasksMax 256; Nice 5 for img, audio, docs, yt) and ReadWritePaths for the gateway's data/ (its guard.db); deploy.sh creates… ([`ef14d55`](https://github.com/OpenVibers/OpenVibe.Tools/commit/ef14d5561ad3f74ebfab463d48c5825a7d157d0c))\n- Docs: Protect, Unlock and the password page count give qpdf its password arguments on stdin (@-) instead of an @file argument file. qpdf 12.3.2 on the host did not expand @file (it opened '@/tmp/…/args' as a PDF), so every Protect PDF in… ([`13b79ce`](https://github.com/OpenVibers/OpenVibe.Tools/commit/13b79ce0a506a5ccdbd03486075f19ec25c82a82))\n- Worker threads for sharp and pdf-lib (S5): apps/_shared/jobs/pool.js runs img's image operations and docs' pdf-lib tools in worker_threads, so a large merge or conversion never blocks the event loop (/api/health, the job routes and every… ([`fcc2fe0`](https://github.com/OpenVibers/OpenVibe.Tools/commit/fcc2fe0f2eb55e75b327f0980a6869c85143fbe8))\n- Uniform run API, jobs facade, deprecation headers and the Origin check (S6, ADR-027). POST /api/v1/tools/:id/run takes tools.run-request@1 as JSON or multipart exactly as openvibe-sdk v0.6.0 sends it (uploads as file parts; input, files… ([`48605fa`](https://github.com/OpenVibers/OpenVibe.Tools/commit/48605fa4c791c5ec5fc3dea321f88ce79332ea4a))\n- openvibe-contracts v0.33.1 (gateway, img, audio, docs) and openvibe-shared v1.5.1 (every app). Descriptors now publish the catalogue's keywords (every tool; what ?q= matches) and each API tool's example as examples[] (145 tools; a job… ([`5ac8309`](https://github.com/OpenVibers/OpenVibe.Tools/commit/5ac8309e5abfa74242792b6aee1662b9a85f989a))\n- SECURITY.md: how to report a vulnerability (contact@openvibe.network, 7-day reply, scope, supported versions) ([`b0aada2`](https://github.com/OpenVibers/OpenVibe.Tools/commit/b0aada2c3887b009176ceb934e7df98faa666cae))\n- Tools API for developers (platform S10): GET /api/v1/openapi.json, OpenAPI 3.1 generated from the tool descriptors (registry, one run path per tool with its input schema and an example, the jobs facade, problem responses, bearer auth); a… ([`176a7b8`](https://github.com/OpenVibers/OpenVibe.Tools/commit/176a7b8be92cccf47b16415ddf0152246b280d7a))\n- Save as paste on the developer tools (platform S9): the output becomes an unlisted OpenVibe.Community paste through the gateway's /api/pastes proxy (as the signed-in person when there is one), linked under the buttons; Clear removes the… ([`597fc6a`](https://github.com/OpenVibers/OpenVibe.Tools/commit/597fc6a1a584f9ccdc1eb9d2bec79d6bcbf8ac0f))\n- Tools in Search and in people's recent tools (platform S9). ([`1a8d739`](https://github.com/OpenVibers/OpenVibe.Tools/commit/1a8d739851d6ae5403279e653596ade511d6dd91))\n- tools.usage: a first record is written with If-Match 0, so two apps creating it at once cannot overwrite each other ([`aa1389f`](https://github.com/OpenVibers/OpenVibe.Tools/commit/aa1389ff4e1df9e911d96a2fc86b0b29dabf1f08))\n- Recent tools in the launcher (D31: anonymous and account history): every tool page view puts the tool on top of this browser's ov_recent_tools cookie (first-party, .openvibe.tools, 12 ids, no page script needed across tool hosts); GET… ([`557de61`](https://github.com/OpenVibers/OpenVibe.Tools/commit/557de61d3e4f1b81eabfabfe189f4aa7729f66c2))\n- Network-tool SSRF guard on openvibe-shared 1.6.0 (platform S9, egress consolidation): the public-address rule, internal names and host normalisation come from openvibe-shared/egress, the rule Live and Events use; createEgress keeps the… ([`d1a5f87`](https://github.com/OpenVibers/OpenVibe.Tools/commit/d1a5f87934a038e2c703e138b2ef239be6e1f425))\n\n## OpenVibe.Media\n\n[openvibe.media](https://openvibe.media) · [repository](https://github.com/OpenVibers/OpenVibe.Media)\n\n- VOD durations are measured, never estimated: finalize stores what the file says and vods.duration_source says where it came from. probe = ffprobe's container duration of the finished file; remux = the last packet time of a stream-copy pass… ([`cc84bf1`](https://github.com/OpenVibers/OpenVibe.Media/commit/cc84bf1a10952da5391b689371d19f995bda2b39))\n- vod.finalize job: a recording whose finalize failed or never ran is retried on media_jobs with backoff, instead of a one-shot boot sweep whose failure was swallowed and a stat failure that only cleared is_recording. The orphan sweep (in… ([`24f1962`](https://github.com/OpenVibers/OpenVibe.Media/commit/24f1962d897c7395066fe0732a698d646eb1b07f))\n- vod.duration.reconcile: stored VOD durations are compared with a measurement of the real file in bounded batches, offloaded VODs included, and clearly wrong values are repaired (the health scanner only repaired durations <= 0 and skipped… ([`20a602e`](https://github.com/OpenVibers/OpenVibe.Media/commit/20a602e124f84cffa955af34187b7993453e0c16))\n- trust proxy is loopback only (was true): req.ip is the X-Forwarded-For that the local nginx set when a request came through it, and the socket address for anyone else, so a caller reaching port 4100 directly (HOST defaults to 0.0.0.0) can… ([`47b4349`](https://github.com/OpenVibers/OpenVibe.Media/commit/47b43491a31709bac66d6367b3aefa08d519bb28))\n- object.hash job: sha256 for local copies in bounded batches, recorded on the object (content_hash, with metadata.hash_basis = the file and size it read) and on its local location (checksum, verified_at). Only 14 of 2,839 ready objects had… ([`e5e6f09`](https://github.com/OpenVibers/OpenVibe.Media/commit/e5e6f09cbe9296e31351e50ccbcb7bb71a2ff62a))\n- RTMP pull SSRF: POST /vods/:id/ingest/rtmp makes ffmpeg connect to the URL it is given, and any rtmp:// or rtmps:// URL was accepted, so an app key (or a leaked one) could point Media's ffmpeg at any host and port it can reach. The… ([`cb17f29`](https://github.com/OpenVibers/OpenVibe.Media/commit/cb17f297b00c25da3f774f68251437e3e5209417))\n- Crawler basics at the openvibe.media origin: /robots.txt (openvibe-shared seo.robotsTxt: AI and search crawlers named; /api/, /auth/, /internal/, /o/, /metrics, /release-metrics and the /live/ dev-data endpoints disallowed; the sitemap)… ([`a90d0ed`](https://github.com/OpenVibers/OpenVibe.Media/commit/a90d0ed76725129a344cc464ead08fff142c448c))\n- Events media.object.deleted and media.object.visibility_changed through the outbox, so consumers (Search, Live, Community) learn that an object went away or stopped being public (Media emitted neither). Payloads are minimal… ([`039dc48`](https://github.com/OpenVibers/OpenVibe.Media/commit/039dc48a0d9d5c4d893ce0df804309ac95b40c8f))\n- thumbnail.regenerate refuses a recording with nothing to take a frame from. The five failed jobs on production (all at 2026-09-23 21:36:41, created by app:live, generate_failed) were Live asking for thumbnails of VODs 3044, 5537, 5540… ([`5099c97`](https://github.com/OpenVibers/OpenVibe.Media/commit/5099c972981b5baa06400ac6fc1bae30cd948d0d))\n- R2 tier decisions are recorded and explainable: every promotion to and demotion from the R2 popularity cache gets a media_tier_decisions row with the inputs it saw (view_count, last_accessed_at, provider, recording, hold, size… ([`7114433`](https://github.com/OpenVibers/OpenVibe.Media/commit/7114433029433e4f48518de8f82bb57b8081af2b))\n- SECURITY.md: how to report a vulnerability (contact@openvibe.network, 7-day reply, scope, supported versions) ([`984e7ad`](https://github.com/OpenVibers/OpenVibe.Media/commit/984e7ad9364971286ed1a9665159c5f304372344))\n- Channel lookups through Live's canonical lineage resolver (D20): the dev-data API's @username selector asks OpenVibe.Live /internal/lineage/resolve with Media's service token (live.lineage.resolve) for the channel and its Live user id… ([`9de5cb9`](https://github.com/OpenVibers/OpenVibe.Media/commit/9de5cb9afcac6b06beacf3dfbc83964dec8eb284))\n\n## OpenVibe.Chat\n\n- A chat line that could not be saved is not broadcast: the sender gets an error and nobody sees a message that history, moderation and replays never have (the insert failure used to be swallowed as non-critical). ws-protocol test ([`d268cf8`](https://github.com/OpenVibers/OpenVibe.Chat/commit/d268cf88d76a10f79622c6b6f0c7ee8c0603f136))\n- SECURITY.md: how to report a vulnerability (contact@openvibe.network, 7-day reply, scope, supported versions) ([`1ef6f99`](https://github.com/OpenVibers/OpenVibe.Chat/commit/1ef6f992570328e6f7c8c7a8e5168226fb2987db))\n- Sound uploads convert through OpenVibe.Tools (platform S9): the mp3 tool's run API via openvibe-sdk/tools (v0.6.0) with Chat's service token (tools.tool.run, tools.job.read), 128 kbps 44.1 kHz stereo, the result downloaded from the jobs… ([`1d0e12a`](https://github.com/OpenVibers/OpenVibe.Chat/commit/1d0e12afb9e88123dcda14d5b50276b03c839036))\n- Staff gates ask the contracts staff map (D05, ADR-022): permissions.can(user, 'staff.<area>.<action>') over openvibe-contracts v0.35.0 (issued staff_caps claims win); per-IP and ban exemptions are staff.limits.exempt, chat-restriction… ([`990fbd1`](https://github.com/OpenVibers/OpenVibe.Chat/commit/990fbd1ee56bfc396f7198eb0112e104bb7043e7))\n- Release manifest and metrics (Track R D43, Track O): openvibe-shared v1.6.0; GET /release.json (release, contracts and package versions) with POST /release-metrics, and GET /metrics (loopback only: request rates and latencies, process… ([`9ebde51`](https://github.com/OpenVibers/OpenVibe.Chat/commit/9ebde51bc57bfc6535e18be0aadfc8a127224d40))\n- VIP convergence (W10): Chat subscribes to vip.membership.changed; a delivery from VIP drops that member's cached subscriber-badge answers for the creator at once (vip/badges handleEvent) instead of converging by the cache TTL; any other… ([`fba087a`](https://github.com/OpenVibers/OpenVibe.Chat/commit/fba087a8cd211ee6543b2463ad0029fac7225b95))\n- VIP client from openvibe-sdk/vip (v0.7.0): the copy of openvibe-vip/client is replaced by the SDK's published seam, same API and fail-closed behaviour; server/vip/vip-client.js re-exports it so callers are unchanged ([`4e95c11`](https://github.com/OpenVibers/OpenVibe.Chat/commit/4e95c11fc07e8c01bbc96bbe70809bb8665a34c7))\n- CI calls the shared test workflow (Track Q): OpenVibe.Shared test.yml@e8b0caf (install, node --check, npm test, openvibe-contracts-check; ffmpeg where the tests need it) instead of a copy of those steps ([`6d86dd4`](https://github.com/OpenVibers/OpenVibe.Chat/commit/6d86dd4c499a00a64c1469c30997fb8fd0fd3544))\n- One W3C trace across services (Track O): openvibe-shared v1.7.0 trace.install(app) keeps each request's traceparent and puts it on the calls made while serving it, to loopback and OpenVibe hosts only; Chat also takes the request context… ([`325f878`](https://github.com/OpenVibers/OpenVibe.Chat/commit/325f8781877b58c8a36970de0f99fac0fc3b874a))\n\n## OpenVibe.Community\n\n[openvibe.community](https://openvibe.community) · [repository](https://github.com/OpenVibers/OpenVibe.Community)\n\n- Pastes browse: Show pastes, images or all (?type=), carried through paging (lang=image still means images); the home page's 'What is coming' roadmap block is replaced by what is live (spaces, threads, Pulse); /llms.txt says what Community… ([`985da86`](https://github.com/OpenVibers/OpenVibe.Community/commit/985da86d6c731ef45dec56d733a0e3ebae1724f2))\n- SECURITY.md: how to report a vulnerability (contact@openvibe.network, 7-day reply, scope, supported versions) ([`e075d39`](https://github.com/OpenVibers/OpenVibe.Community/commit/e075d39907c6e9f6d02ae45a760b1052158417d5))\n- Community publishes events (openvibe-contracts 0.35.0): community.paste.created|updated|deleted, community.thread.created, community.post.created and community.comment.created, each queued in the transaction of the write through the… ([`c8a70c7`](https://github.com/OpenVibers/OpenVibe.Community/commit/c8a70c78aab967dc2c06594697bea2f61edda6b9))\n- Pulse is fed from OpenVibe.Events: POST /internal/events (signature v2 only, loopback only, exactly once via the openvibe-sdk inbox) turns public live.stream.started, blog.post.published, wiki.page.published and news.story.published into… ([`474c101`](https://github.com/OpenVibers/OpenVibe.Community/commit/474c101d5aa4bdcfb104b75f5ce1dfc8f5691b9e))\n- Staff powers from the contracts staff map (D05, ADR-022): a browser viewer is paste staff with staff.moderation.pastes and discussion staff with staff.moderation.discussions, from the role or the staff_caps Network issues (issued claims… ([`0a540ea`](https://github.com/OpenVibers/OpenVibe.Community/commit/0a540eade9fcc622e653f0202b6eae6619972988))\n- VIP convergence (W10): Community subscribes to vip.membership.changed on its Events endpoint; a delivery from VIP drops the member's cached members-only answers for that creator at once (the VIP gate's cache handleEvent, once per event… ([`9074b54`](https://github.com/OpenVibers/OpenVibe.Community/commit/9074b5414722f7ce7ee72ff7c8fd9705efa8aa22))\n- VIP client from openvibe-sdk/vip (v0.7.0): the copy of openvibe-vip/client is replaced by the SDK's published seam, same API and fail-closed behaviour; server/vip/vip-client.js re-exports it so callers are unchanged ([`d692a51`](https://github.com/OpenVibers/OpenVibe.Community/commit/d692a51a2e0f5ea245dddf60c38f56db6cf2fcec))\n\n## OpenRe.Stream\n\n[openre.stream](https://openre.stream) · [repository](https://github.com/OpenVibers/OpenRe.Stream)\n\n- SECURITY.md: how to report a vulnerability (contact@openvibe.network, 7-day reply, scope, supported versions) ([`e517ed4`](https://github.com/OpenVibers/OpenRe.Stream/commit/e517ed43466184790187143c974313f1fe7125b3))\n- Session lineage from Live's canonical resolver (D20): the coordinator asks OpenVibe.Live's /internal/lineage/resolve (live.lineage.resolve, OpenRe's service token) which channel each Live-linked definition belongs to (mirror_to_live or a… ([`ef21212`](https://github.com/OpenVibers/OpenRe.Stream/commit/ef212129300508c657ee59bb27f1dd7e32b8c21f))\n- Serve the release manifest (Track R, D43): GET /release.json on openre-api (release, contracts, openvibe-shared/sdk/contracts versions) through openvibe-shared release; test in drill-mode.test.js ([`f391183`](https://github.com/OpenVibers/OpenRe.Stream/commit/f391183ffb913357540a092c1830c32d540bc0d9))\n- release.json names the deployed commit: a release directory (releases/<sha>) has no .git of its own, so the manifest said 0000000; RELEASE_COMMIT, OPENRE_RELEASE or the directory's sha now supply it ([`40afbdd`](https://github.com/OpenVibers/OpenRe.Stream/commit/40afbddc0803af186eebef9bfcc910ec2ac2e8c4))\n- CI calls the shared test workflow (Track Q): OpenVibe.Shared test.yml@e8b0caf (install, node --check, npm test, openvibe-contracts-check; ffmpeg where the tests need it) instead of a copy of those steps ([`7934bd8`](https://github.com/OpenVibers/OpenRe.Stream/commit/7934bd8c28dbe5fb35b59abd0c0a55cc2f3dc5f9))\n- Loopback /metrics (Track O): openvibe-shared/metrics on openre-api (request rates and latencies, process metrics, release_info) plus openre_sessions{state} for starting and live ingest sessions ([`f03a2c0`](https://github.com/OpenVibers/OpenRe.Stream/commit/f03a2c0a9a8442253f4c305c29ec9bf121384a68))\n- One W3C trace across services (Track O): openvibe-shared v1.7.0 trace.install(app) keeps each request's traceparent and puts it on the calls made while serving it, to loopback and OpenVibe hosts only ([`4df7677`](https://github.com/OpenVibers/OpenRe.Stream/commit/4df7677b41ab4c3f357a8550cc0cbb0f65499729))\n\n## OpenVibe.Billing\n\n[billing.openvibe.network](https://billing.openvibe.network) · [repository](https://github.com/OpenVibers/OpenVibe.Billing)\n\n- SECURITY.md: how to report a vulnerability (contact@openvibe.network, 7-day reply, scope, supported versions) ([`42ad547`](https://github.com/OpenVibers/OpenVibe.Billing/commit/42ad547a34d098e28e1ad9abb4ad6759fbac5bdb))\n- Serve the release manifest (Track R, D43): GET /release.json and POST /release-metrics through openvibe-shared release.mount; the manifest was built but never mounted, so billing.openvibe.network answered 404 ([`421beb4`](https://github.com/OpenVibers/OpenVibe.Billing/commit/421beb42db61128c64ece7d2abb46dc6bcbf5f79))\n- Truthful readiness and status: /api/ready answers in the openvibe-shared/ready shape (named db and network_jwks checks, money_writes shown without failing it, release) instead of a bare {ready:true}; STATUS.json describes what production… ([`94f1159`](https://github.com/OpenVibers/OpenVibe.Billing/commit/94f115938ff0854c393fd9113efa116bfdc5d7d9))\n- CI calls the shared test workflow (Track Q): OpenVibe.Shared .github/workflows/test.yml@f5e7e73 (install, node --check over server/ and scripts/, npm test, openvibe-contracts-check) instead of a copy of those steps ([`069c53e`](https://github.com/OpenVibers/OpenVibe.Billing/commit/069c53ecf062421ba3fbe715f7fd5cb47ec19f48))\n- One W3C trace across services (Track O): openvibe-shared v1.7.0 trace.install(app) keeps each request's traceparent and puts it on the calls made while serving it, to loopback and OpenVibe hosts only ([`9f51b11`](https://github.com/OpenVibers/OpenVibe.Billing/commit/9f51b11210bf347efeea162a5c1d7397cd9380d2))\n\n## OpenVibe.AI\n\n[ai.openvibe.network](https://ai.openvibe.network) · [repository](https://github.com/OpenVibers/OpenVibe.AI)\n\n- SECURITY.md: how to report a vulnerability (contact@openvibe.network, 7-day reply, scope, supported versions) ([`a6d4f39`](https://github.com/OpenVibers/OpenVibe.AI/commit/a6d4f39b6562dbd70a343a7d1c61ad46f57c3826))\n- CI calls the shared test workflow (Track Q): OpenVibe.Shared test.yml@e8b0caf (install, node --check, npm test, openvibe-contracts-check; ffmpeg where the tests need it) instead of a copy of those steps ([`beee294`](https://github.com/OpenVibers/OpenVibe.AI/commit/beee29446455ce7f14b5f952a4969f44e45d66e5))\n- One W3C trace across services (Track O): openvibe-shared v1.7.0 trace.install(app) keeps each request's traceparent and puts it on the calls made while serving it, to loopback and OpenVibe hosts only ([`bc26762`](https://github.com/OpenVibers/OpenVibe.AI/commit/bc26762f15106b7fce52dd70eaca16f22128cdd3))\n- ai.run.* events (W13 gate): queued, cached, succeeded and failed runs each queue their openvibe-contracts ai.run.<status>@1 event in the same transaction as the state change (succeeded with its citations; interrupted runs at boot too)… ([`b2ea9d1`](https://github.com/OpenVibers/OpenVibe.AI/commit/b2ea9d1560268eda02b1a96a29899ea84976efba))\n\n## OpenVibe.Events\n\n[events.openvibe.network](https://events.openvibe.network) · [repository](https://github.com/OpenVibers/OpenVibe.Events)\n\n- SECURITY.md: how to report a vulnerability (contact@openvibe.network, 7-day reply, scope, supported versions) ([`74b00d6`](https://github.com/OpenVibers/OpenVibe.Events/commit/74b00d6bb7d9933253c4f6a3b782c7a83073d5a0))\n- Subscription secret rotation: POST /api/v1/subscriptions/:id/rotate-secret (the consumer's own subscription; overlap_s default 1 day, max 7) and scripts/rotate-subscription-secret.js for operators (writes the new secret into the consumer's… ([`82a49f3`](https://github.com/OpenVibers/OpenVibe.Events/commit/82a49f3a014c5656ee5f51973f40e8c5df6e93dc))\n- rotate-subscription-secret: --consumer rotates every first-party subscription of a service to one new secret (they share one env variable) ([`9f51514`](https://github.com/OpenVibers/OpenVibe.Events/commit/9f515142868af343b42c1c58faac1fd6805076fc))\n- App-endpoint guard on openvibe-shared 1.6.0: the public-address rule and internal-name list come from openvibe-shared/egress (shared with Live and Tools; adds *.home.arpa); endpoint syntax rules and the connect-time guarded POST stay here ([`3879798`](https://github.com/OpenVibers/OpenVibe.Events/commit/38797986b927cafc51fb7f5c6262ddf871af1b76))\n\n## OpenVibe.Reviews\n\n[openvibe.reviews](https://openvibe.reviews) · [repository](https://github.com/OpenVibers/OpenVibe.Reviews)\n\n- SECURITY.md: how to report a vulnerability (contact@openvibe.network, 7-day reply, scope, supported versions) ([`08add50`](https://github.com/OpenVibers/OpenVibe.Reviews/commit/08add50f1dbef2489aaefa28760c506d8a58c625))\n- openvibe-publishing v0.2.2 (shares the openvibe-shared v1.5.1 copy instead of installing v1.0.0 alongside) ([`70de372`](https://github.com/OpenVibers/OpenVibe.Reviews/commit/70de372e0c2826c061080826f192ca2d0a51c6a4))\n- CI calls the shared test workflow (Track Q): OpenVibe.Shared .github/workflows/test.yml@f5e7e73 (install, node --check over server/ and scripts/, npm test, openvibe-contracts-check) instead of a copy of those steps ([`ecc4406`](https://github.com/OpenVibers/OpenVibe.Reviews/commit/ecc44065dc2ef8aa74a0802e9e32673a8037ed49))\n- One W3C trace across services (Track O): openvibe-shared v1.7.0 trace.install(app) keeps each request's traceparent and puts it on the calls made while serving it, to loopback and OpenVibe hosts only ([`f68bb8f`](https://github.com/OpenVibers/OpenVibe.Reviews/commit/f68bb8fb8be9b553e4c502283c23b03d9f1533b5))\n\n## OpenVibe.Wiki\n\n[openvibe.wiki](https://openvibe.wiki) · [repository](https://github.com/OpenVibers/OpenVibe.Wiki)\n\n- SECURITY.md: how to report a vulnerability (contact@openvibe.network, 7-day reply, scope, supported versions) ([`4223b6d`](https://github.com/OpenVibers/OpenVibe.Wiki/commit/4223b6d26309a8fd6c22944cc7b8df87b470a548))\n- openvibe-publishing v0.2.2 (shares the openvibe-shared v1.5.1 copy instead of installing v1.0.0 alongside) ([`fe113b9`](https://github.com/OpenVibers/OpenVibe.Wiki/commit/fe113b90321852c24f11f1d19905bd77fbe7f463))\n- CI calls the shared test workflow (Track Q): OpenVibe.Shared .github/workflows/test.yml@f5e7e73 (install, node --check over server/ and scripts/, npm test, openvibe-contracts-check) instead of a copy of those steps ([`6c09371`](https://github.com/OpenVibers/OpenVibe.Wiki/commit/6c093716409c9af4772c4f2a95a657e49622cdd6))\n- One W3C trace across services (Track O): openvibe-shared v1.7.0 trace.install(app) keeps each request's traceparent and puts it on the calls made while serving it, to loopback and OpenVibe hosts only ([`907659c`](https://github.com/OpenVibers/OpenVibe.Wiki/commit/907659c5e829897bafe720cbe443b7bc45cdbe1b))\n\n## OpenVibe.Codes\n\n[openvibe.codes](https://openvibe.codes) · [repository](https://github.com/OpenVibers/OpenVibe.Codes)\n\n- SECURITY.md: how to report a vulnerability (contact@openvibe.network, 7-day reply, scope, supported versions) ([`587fb3f`](https://github.com/OpenVibers/OpenVibe.Codes/commit/587fb3faf9a98fd3960e312fb64f21657a692302))\n- Docs: /docs/events links each event's payload contract (117 published) and marks the rest planned, instead of saying payload schemas do not exist; openvibe-contracts v0.34.2; the per-address rate limit is CODES_RATE_LIMIT_PER_MIN (default… ([`a129415`](https://github.com/OpenVibers/OpenVibe.Codes/commit/a1294156cdb9aa3d82c15708c12509d805ff561f))\n- Docs: /docs/tools lists every OpenVibe tool with an API from Tools' live registry (loopback, cached 5 min; how it runs, who may call it, JSON or files), with the run API, jobs, OpenAPI and SDK; linked from /docs and the sitemap ([`69fc5b1`](https://github.com/OpenVibers/OpenVibe.Codes/commit/69fc5b1a80af534f5cdc94d27c247bfbbae384a2))\n\n## OpenVibe.Coupons\n\n[openvibe.coupons](https://openvibe.coupons) · [repository](https://github.com/OpenVibers/OpenVibe.Coupons)\n\n- Public coupon events carry only a short reason code: a staff note or a calling service's free-text reason became the public lifecycle event's reason; anything that is not a code is 'other' (staff notes 'staff'), and report events drop a… ([`d913e87`](https://github.com/OpenVibers/OpenVibe.Coupons/commit/d913e8759daec286e471b562debf0bc91363bfad))\n- SECURITY.md: how to report a vulnerability (contact@openvibe.network, 7-day reply, scope, supported versions) ([`c47ae98`](https://github.com/OpenVibers/OpenVibe.Coupons/commit/c47ae9811e5e7a7e86546dd4adacb6b87b2ae327))\n- openvibe-publishing v0.2.2 (shares the openvibe-shared v1.5.1 copy instead of installing v1.0.0 alongside) ([`ae3a25e`](https://github.com/OpenVibers/OpenVibe.Coupons/commit/ae3a25ed5d4e33f81df1147940d8f3100d13513b))\n\n## OpenVibe.Deals\n\n[openvibe.deals](https://openvibe.deals) · [repository](https://github.com/OpenVibers/OpenVibe.Deals)\n\n- Importer: deals.offer.updated names every field an observation moved (expires_at, product_id, title, status), not just 'observation', so consumers never miss a changed field ([`24d52a2`](https://github.com/OpenVibers/OpenVibe.Deals/commit/24d52a2674f1277f2a0237064d9f2cab8d7f5485))\n- SECURITY.md: how to report a vulnerability (contact@openvibe.network, 7-day reply, scope, supported versions) ([`d12cfbf`](https://github.com/OpenVibers/OpenVibe.Deals/commit/d12cfbfb1417e5a187c197cf0b7184bf1f12e364))\n- openvibe-publishing v0.2.2 (shares the openvibe-shared v1.5.1 copy instead of installing v1.0.0 alongside) ([`3910b58`](https://github.com/OpenVibers/OpenVibe.Deals/commit/3910b58cd10a700a22c6c7129cd4c1c1e586cc95))\n\n## OpenVibe.News\n\n[openvibe.news](https://openvibe.news) · [repository](https://github.com/OpenVibers/OpenVibe.News)\n\n- Story flag events use priority low (source-removed stays important): 'normal' is not an envelope priority, so Events refused those flag events ([`0143ae8`](https://github.com/OpenVibers/OpenVibe.News/commit/0143ae825e38447691e5835fb892a6eb43bd3189))\n- SECURITY.md: how to report a vulnerability (contact@openvibe.network, 7-day reply, scope, supported versions) ([`f01c795`](https://github.com/OpenVibers/OpenVibe.News/commit/f01c795c117fe8cd87bba4e9c3d25cc0ef40ad67))\n- openvibe-publishing v0.2.2 (shares the openvibe-shared v1.5.1 copy instead of installing v1.0.0 alongside) ([`42ce43b`](https://github.com/OpenVibers/OpenVibe.News/commit/42ce43b84b830ed37f8e02389f4bbdae20212510))\n\n## OpenVibe.Search\n\n[search.openvibe.network](https://search.openvibe.network) · [repository](https://github.com/OpenVibers/OpenVibe.Search)\n\n- SECURITY.md: how to report a vulnerability (contact@openvibe.network, 7-day reply, scope, supported versions) ([`4603541`](https://github.com/OpenVibers/OpenVibe.Search/commit/46035416946d065627a4ed1ec89b5b0ac7a302ec))\n- CI calls the shared test workflow (Track Q): OpenVibe.Shared .github/workflows/test.yml@f5e7e73 (install, node --check over server/ and scripts/, npm test, openvibe-contracts-check) instead of a copy of those steps ([`2586e9e`](https://github.com/OpenVibers/OpenVibe.Search/commit/2586e9e7d0a648ea943494fb9c264da010eb1b06))\n- One W3C trace across services (Track O): openvibe-shared v1.7.0 trace.install(app) keeps each request's traceparent and puts it on the calls made while serving it, to loopback and OpenVibe hosts only ([`bd9faf8`](https://github.com/OpenVibers/OpenVibe.Search/commit/bd9faf8aae2da35eaff295f4cce63b2e1510ea60))\n\n## OpenVibe.Sources\n\n[sources.openvibe.network](https://sources.openvibe.network) · [repository](https://github.com/OpenVibers/OpenVibe.Sources)\n\n- SECURITY.md: how to report a vulnerability (contact@openvibe.network, 7-day reply, scope, supported versions) ([`cf00390`](https://github.com/OpenVibers/OpenVibe.Sources/commit/cf003901ae1000a9f0e568d05390da2c36180dcc))\n- CI calls the shared test workflow (Track Q): OpenVibe.Shared .github/workflows/test.yml@f5e7e73 (install, node --check over server/ and scripts/, npm test, openvibe-contracts-check) instead of a copy of those steps ([`d360451`](https://github.com/OpenVibers/OpenVibe.Sources/commit/d3604518d5d3330a9096a03ce29f6d091cef8277))\n- One W3C trace across services (Track O): openvibe-shared v1.7.0 trace.install(app) keeps each request's traceparent and puts it on the calls made while serving it, to loopback and OpenVibe hosts only ([`ab2bd6a`](https://github.com/OpenVibers/OpenVibe.Sources/commit/ab2bd6a4a379ed0c2af9e7bbbbf290310ad5c973))\n\n## OpenVibe.Trade\n\n[openvibe.trade](https://openvibe.trade) · [repository](https://github.com/OpenVibers/OpenVibe.Trade)\n\n- SECURITY.md: how to report a vulnerability (contact@openvibe.network, 7-day reply, scope, supported versions) ([`46f1eeb`](https://github.com/OpenVibers/OpenVibe.Trade/commit/46f1eeb5084d2e11d7bcf110edc11c8e6c43b3c3))\n- openvibe-publishing v0.2.2 (shares the openvibe-shared v1.5.1 copy instead of installing v1.0.0 alongside) ([`7f418d2`](https://github.com/OpenVibers/OpenVibe.Trade/commit/7f418d25e8ca7288a8cf09738e7c8b5609c2578b))\n\n---\n\nPatch notes are put together automatically when enough changes have shipped, or when a large feature lands. See every site's own updates page for the live list.","revision":1,"state":"published","visibility":"public","published_at":"2026-09-24T06:53:12.495Z","revised_at":"2026-09-24T06:53:12.490Z","author":{"subject":"usr_01KKT9AC60KM7CRTB3WN1Z8P56","name":"goosely","username":"goosely"},"authorship":{"mode":"imported","workflow":null,"reviewed":false,"disclosure":{"mode":"imported","short":"Imported","long":"Imported from Commit messages from the OpenVibers repositories on GitHub; originally by OpenVibers."}},"tags":["patch-notes","live","tools","media","chat","community","openre","billing","ai","events","reviews"],"categories":[],"series":{"title":"Patch notes","url":"https://openvibe.blog/@openvibe/series/patch-notes","position":null},"media":[],"citations":[],"indexability":{"indexable":true,"robots":"index, follow","reasons":[]}}